@defrex/autobuild 0.11.0 → 0.13.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@defrex/autobuild",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "Agent-driven software delivery from groomed ticket to merged PR",
   "repository": {
     "type": "git",
@@ -86,6 +86,10 @@
       "types": "./packages/core/src/operator/sandbox-host.ts",
       "import": "./packages/core/src/operator/sandbox-host.ts",
       "default": "./packages/core/src/operator/sandbox-host.ts"
+    },
+    "./connection": {
+      "types": "./packages/core/src/connection.ts",
+      "import": "./packages/core/src/connection.ts"
     }
   },
   "files": [
@@ -139,8 +143,8 @@
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.5",
-    "@defrex/autobuild-postgres-store": "0.10.1",
-    "@defrex/autobuild-vercel-sandbox": "0.10.1",
+    "@defrex/autobuild-postgres-store": "0.12.0",
+    "@defrex/autobuild-vercel-sandbox": "0.12.0",
     "@resvg/resvg-js": "2.6.2",
     "@types/bun": "^1.3.14",
     "@types/node": "^24.0.0",
@@ -150,8 +154,5 @@
     "git-format-staged": "4.0.1",
     "husky": "9.1.7",
     "typescript": "5.9.3"
-  },
-  "patchedDependencies": {
-    "better-auth@1.4.18": "patches/better-auth@1.4.18.patch"
   }
 }

package/packages/core/src/cli/attention.ts

@@ -0,0 +1,209 @@
+import type { AbEvent } from '../events/catalog'
+import type { RepositoryEvent } from '../events/repository'
+import { currentAutoMergeDeferral } from '../kernel/auto-merge'
+import { reduceBuild, type BuildState } from '../kernel/reducer'
+
+export interface MergeDecision {
+  type: 'build.merge-decision'
+  pr: { number: number; url: string; headSha: string }
+  reason: string
+  observedAt: string
+}
+
+/** Consent pending application is armed; only a current actionable deferral
+ * or withdrawn consent needs a person. Currency is owned by the kernel. */
+export function mergeDecision(
+  events: AbEvent[],
+  now: Date,
+  state = reduceBuild(events),
+): MergeDecision | null {
+  if (
+    !state.finalizeCompletedSeq ||
+    !state.pr ||
+    state.prState !== 'open' ||
+    state.status === 'done' ||
+    state.status === 'aborted'
+  )
+    return null
+  const deferral = currentAutoMergeDeferral(events, state)
+  if (state.autoMerge.requested && deferral === undefined) return null
+  return {
+    type: 'build.merge-decision',
+    pr: state.pr,
+    reason: deferral ?? 'Auto-merge is not armed',
+    observedAt: now.toISOString(),
+  }
+}
+
+export function buildNeedsAttention(events: AbEvent[], state: BuildState): boolean {
+  return (
+    (state.openEscalations?.length ?? 0) > 0 || mergeDecision(events, new Date(0), state) !== null
+  )
+}
+
+export function mergeIdentity(slug: string, pr: number): string {
+  return JSON.stringify([slug, pr])
+}
+
+export function repositoryNeedsAttention(event: RepositoryEvent): boolean {
+  switch (event.type) {
+    case 'harvest.escalated':
+    case 'harvest.recovery-exhausted':
+    case 'dispatcher.config-rejected':
+      return true
+    case 'dispatcher.config-reloaded':
+      return event.payload.restartRequired.length > 0
+    case 'dispatcher.run-stopped':
+      return event.payload.outcome === 'abnormal'
+    default:
+      return false
+  }
+}
+
+type Degraded = Extract<RepositoryEvent, { type: 'dispatcher.ticket-source-degraded' }>
+type Failed = Extract<RepositoryEvent, { type: 'dispatcher.tick-failed' }>
+export type PersistenceObservation =
+  | {
+      type: 'dispatcher.ticket-source-persistent'
+      source: string
+      cause: string
+      message: string
+      resetAt?: string
+      episodeSeq: number
+      observedAt: string
+      dependencyLimited: boolean
+    }
+  | {
+      type: 'dispatcher.tick-failure-persistent'
+      run: string
+      firstFailure: string
+      error: string
+      episodeSeq: number
+      observedAt: string
+    }
+
+/** Incremental journal projection. Episode starts survive run anchors and
+ * repeated evidence can strengthen, but never postpone, an existing deadline. */
+export class RepositoryAttention {
+  private sources = new Map<
+    string,
+    {
+      event: Degraded
+      deadline: number
+      dependencyLimited: boolean
+      requiresRetry: boolean
+      retryObserved: boolean
+    }
+  >()
+  private failure: Failed | undefined
+  private tickStarts = new Map<string, number>()
+
+  private sourceDefersTick(now: number): boolean {
+    return [...this.sources.values()].some(
+      (source) => now < source.deadline || (source.requiresRetry && !source.retryObserved),
+    )
+  }
+
+  /** Crossing resetAt alone does not prove persistence: the dispatcher must
+   * finish a tick that could actually retry after the provider cooldown. */
+  private observeRetry(run: string): void {
+    const startedAt = this.tickStarts.get(run)
+    this.tickStarts.delete(run)
+    if (startedAt === undefined) return
+    for (const source of this.sources.values()) {
+      if (startedAt >= source.deadline) source.retryObserved = true
+    }
+  }
+  fold(event: RepositoryEvent): void {
+    switch (event.type) {
+      case 'dispatcher.ticket-source-degraded': {
+        const existing = this.sources.get(event.payload.source)
+        const deadline =
+          'resetAt' in event.payload
+            ? Date.parse(event.payload.resetAt)
+            : Date.parse(event.ts) + 15 * 60_000
+        if (existing) {
+          existing.deadline = Math.min(existing.deadline, deadline)
+          existing.requiresRetry ||= 'resetAt' in event.payload
+        } else
+          this.sources.set(event.payload.source, {
+            event,
+            deadline,
+            dependencyLimited: false,
+            requiresRetry: 'resetAt' in event.payload,
+            retryObserved: false,
+          })
+        // Cooldown-driven failures are not an independent dispatcher outage.
+        if (this.sourceDefersTick(Date.parse(event.ts))) this.failure = undefined
+        break
+      }
+      case 'dispatcher.ticket-source-dependency-limited': {
+        const source = this.sources.get(event.payload.source)
+        if (source) source.dependencyLimited = true
+        break
+      }
+      case 'dispatcher.ticket-source-recovered':
+        this.sources.delete(event.payload.source)
+        break
+      case 'dispatcher.run-started':
+        this.failure = undefined
+        this.tickStarts.clear()
+        break
+      case 'dispatcher.run-stopped':
+        this.tickStarts.delete(event.payload.run)
+        if (this.failure?.payload.run === event.payload.run) this.failure = undefined
+        break
+      case 'dispatcher.tick-started':
+        this.tickStarts.set(event.payload.run, Date.parse(event.ts))
+        break
+      case 'dispatcher.tick-completed':
+        this.observeRetry(event.payload.run)
+        if (this.failure?.payload.run === event.payload.run) this.failure = undefined
+        break
+      case 'dispatcher.tick-failed':
+        this.observeRetry(event.payload.run)
+        if (this.sourceDefersTick(Date.parse(event.ts))) this.failure = undefined
+        else if (this.failure?.payload.run !== event.payload.run) this.failure = event
+        break
+    }
+  }
+  pending(now: Date): { identity: string; observation: PersistenceObservation }[] {
+    const results: { identity: string; observation: PersistenceObservation }[] = []
+    for (const {
+      event,
+      deadline,
+      dependencyLimited,
+      requiresRetry,
+      retryObserved,
+    } of this.sources.values()) {
+      if (now.getTime() < deadline || (requiresRetry && !retryObserved)) continue
+      results.push({
+        identity: `source:${event.seq}`,
+        observation: {
+          type: 'dispatcher.ticket-source-persistent',
+          ...event.payload,
+          episodeSeq: event.seq,
+          observedAt: now.toISOString(),
+          dependencyLimited,
+        },
+      })
+    }
+    const event = this.failure
+    if (
+      event &&
+      !this.sourceDefersTick(now.getTime()) &&
+      now.getTime() >= Date.parse(event.ts) + 5 * 60_000
+    )
+      results.push({
+        identity: `tick:${event.seq}`,
+        observation: {
+          type: 'dispatcher.tick-failure-persistent',
+          ...event.payload,
+          firstFailure: event.ts,
+          episodeSeq: event.seq,
+          observedAt: now.toISOString(),
+        },
+      })
+    return results
+  }
+}

package/packages/core/src/cli/build-control.ts

@@ -464,6 +464,7 @@ export interface ControlBuildOpts {
   via?: Via
   action: BuildControlAction
   /** Injected only for --revise-spec-from-ticket. */
+  prepareTicketAssets?: (ref: TicketRef, store: BuildStore, repo: string) => Promise<PinnedAsset[]>
   readTicketBody?: (ref: TicketRef) => Promise<string>
 }
 
@@ -624,7 +625,15 @@ export async function controlBuild(opts: ControlBuildOpts): Promise<BuildControl
               )
             }
             body = await opts.readTicketBody(record.ticket)
-            assets = await samplePinnedAssets(opts.store, record.repo, record.ticket.id)
+            if (record.ticket.source === 'hosted' && !opts.prepareTicketAssets) {
+              throw new BuildControlError(
+                'ticket-unavailable',
+                'hosted ticket asset preparation is unavailable',
+              )
+            }
+            assets = opts.prepareTicketAssets
+              ? await opts.prepareTicketAssets(record.ticket, opts.store, record.repo)
+              : await samplePinnedAssets(opts.store, record.repo, record.ticket.id)
           }
           const conformance = specConformance(body)
           if (!conformance.conforms) {
@@ -862,6 +871,7 @@ export interface AbBuildControlOpts {
   /** Explicit `--store`; selection remains --store > AB_STORE > repo-local. */
   storeRef?: string
   /** Injected only for --revise-spec-from-ticket. */
+  prepareTicketAssets?: (ref: TicketRef, store: BuildStore, repo: string) => Promise<PinnedAsset[]>
   readTicketBody?: (ref: TicketRef) => Promise<string>
   /** Injectable adapter seam for unit tests. */
   openStore?: StoreOpener
@@ -881,6 +891,7 @@ export async function abBuildControl(opts: AbBuildControlOpts): Promise<BuildCon
       env: opts.env,
       action: opts.action,
       ...(opts.readTicketBody !== undefined ? { readTicketBody: opts.readTicketBody } : {}),
+      ...(opts.prepareTicketAssets ? { prepareTicketAssets: opts.prepareTicketAssets } : {}),
     }),
   )
 }

package/packages/core/src/cli/configured-store.ts

@@ -0,0 +1,17 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { parse } from 'smol-toml'
+import { storeSchema } from '../config/schema'
+
+/** Store selection happens before full dispatch configuration is loaded. */
+export function configuredStore(checkout: string): string | undefined {
+  let text: string
+  try {
+    text = readFileSync(join(checkout, 'autobuild.toml'), 'utf8')
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return undefined
+    throw error
+  }
+  const table = parse(text)
+  return table.store === undefined ? undefined : storeSchema.parse(table.store).url
+}

package/packages/core/src/cli/connect.ts

@@ -0,0 +1,364 @@
+import { parseConfig } from '../config/load'
+import { HostedTicketSource } from '../ports/tickets/remote'
+import { ticketLifecycle } from '../ports/tickets/lifecycle'
+import { createHash, randomBytes, randomUUID } from 'node:crypto'
+import { access, readFile, rename, unlink, writeFile } from 'node:fs/promises'
+import { constants } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { parse } from 'smol-toml'
+import {
+  normalizeConnectionRepository,
+  normalizeServiceURL,
+  type ConnectionStarted,
+  type ConnectionOutcome,
+} from '../connection'
+import type { Exec } from '../ports/workspace/git-worktree'
+import { resolveMainRepo } from './repo-state'
+import { ProjectCredentials } from './project-credentials'
+
+interface ConnectOptions {
+  tickets?: boolean
+  builds?: boolean
+  cwd: string
+  env: Record<string, string | undefined>
+  exec: Exec
+  print: (message: string) => void
+  signal?: AbortSignal
+  fetch?: (input: string, init?: RequestInit) => Promise<Response>
+  browser?: (url: string) => Promise<void>
+  sleep?: (ms: number) => Promise<void>
+  now?: () => number
+}
+function requireOperator(env: ConnectOptions['env']) {
+  if (
+    ['AB_BUILD', 'AB_PHASE', 'AB_SESSION', 'AB_HARVEST', 'AB_REPO'].some(
+      (key) => env[key] !== undefined,
+    )
+  )
+    throw new Error('connect and disconnect are unavailable inside build or harvest sessions')
+}
+async function project(opts: ConnectOptions) {
+  requireOperator(opts.env)
+  const checkout = await resolveMainRepo(opts.cwd, opts.exec)
+  const remote = await opts.exec(['git', 'remote', 'get-url', 'origin'], { cwd: checkout })
+  if (remote.exitCode !== 0 || !remote.stdout.trim())
+    throw new Error('A network origin remote is required; add an origin before running ab connect')
+  const repo = normalizeConnectionRepository(remote.stdout.trim())
+  const path = join(checkout, 'autobuild.toml')
+  const text = await readFile(path, 'utf8')
+  const table = parse(text)
+  const store = table.store as { url?: unknown } | undefined
+  if (store && (typeof store !== 'object' || Array.isArray(store)))
+    throw new Error('Invalid [store] configuration')
+  const tickets = table.tickets as { source?: string; url?: string } | undefined
+  const buildService = opts.env.AB_STORE?.trim() || store?.url
+  const ticketService = tickets?.source === 'hosted' ? (tickets.url ?? buildService) : undefined
+  const selected = opts.tickets ? ticketService : buildService
+  const service =
+    typeof selected === 'string' && /^https?:/.test(selected)
+      ? normalizeServiceURL(selected)
+      : undefined
+  return { checkout, repo, path, text, table, service, buildService, ticketService }
+}
+async function request(
+  opts: ConnectOptions,
+  service: string,
+  path: string,
+  body?: unknown,
+  token?: string,
+) {
+  const response = await (opts.fetch ?? fetch)(`${service}/connect/v1/${path}`, {
+    method: body === undefined ? 'GET' : 'POST',
+    headers: {
+      'content-type': 'application/json',
+      ...(token ? { authorization: `Bearer ${token}` } : {}),
+    },
+    ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+    signal: AbortSignal.timeout(15000),
+    redirect: 'error',
+  })
+  return response
+}
+async function revoke(opts: ConnectOptions, service: string, token: string) {
+  const response = await request(opts, service, 'revoke', {}, token)
+  if (!response.ok && response.status !== 401)
+    throw new Error('Remote revocation failed; retry ab disconnect when the service is reachable')
+}
+async function atomicConfig(path: string, before: string, after: string) {
+  const temporary = `${path}.${randomUUID()}.tmp`
+  try {
+    await writeFile(temporary, after, { flag: 'wx' })
+    if ((await readFile(path, 'utf8')) !== before)
+      throw new Error('autobuild.toml changed during connection; retry ab connect')
+    await rename(temporary, path)
+  } finally {
+    await unlink(temporary).catch(() => {})
+  }
+}
+export async function abConnect(raw: string | undefined, opts: ConnectOptions): Promise<void> {
+  if (opts.tickets && opts.builds) throw new Error('Choose --tickets or --builds')
+  const p = await project(opts)
+  if (opts.tickets && (p.table.tickets as { source?: string } | undefined)?.source !== 'hosted')
+    throw new Error('ab connect --tickets requires [tickets] source = "hosted"')
+  const credentials = new ProjectCredentials(opts.env)
+  if (raw === undefined) {
+    const connections = new Map<string, string[]>()
+    for (const [use, candidate] of [
+      ['builds', p.buildService],
+      ['tickets', p.ticketService],
+    ] as const) {
+      if (typeof candidate !== 'string' || !/^https?:/.test(candidate)) continue
+      const service = normalizeServiceURL(candidate)
+      connections.set(service, [...(connections.get(service) ?? []), use])
+    }
+    if (connections.size === 0) {
+      opts.print(`Project: ${p.repo}\nService: unconfigured`)
+      return
+    }
+    for (const [service, uses] of connections) {
+      opts.print(`Uses: ${uses.join(', ')}`)
+      if (!service) {
+        opts.print(
+          `Project: ${p.repo}\nService: unconfigured\nCredential: missing; run ab connect <url>`,
+        )
+        return
+      }
+      const entry = credentials.load(service, p.repo)
+      let status = 'missing; run ab connect'
+      if (entry) {
+        try {
+          const response = await request(opts, service, 'status', undefined, entry.token)
+          if (response.ok) {
+            const body = (await response.json()) as {
+              repo?: string
+              credentialId?: string
+              accepted?: boolean
+            }
+            if (body.repo !== p.repo || body.credentialId !== entry.id || body.accepted !== true)
+              throw new Error('Invalid status response')
+          }
+          status = response.ok
+            ? 'accepted'
+            : response.status === 401 || response.status === 403
+              ? 'rejected; run ab connect'
+              : 'unreachable'
+        } catch {
+          status = 'unreachable'
+        }
+      }
+      opts.print(`Service: ${service}\nProject: ${p.repo}\nCredential: ${status}`)
+    }
+    return
+  }
+  const service = normalizeServiceURL(raw)
+  if (!opts.tickets && p.service && p.service !== service)
+    throw new Error(
+      `Configured [${opts.tickets ? 'tickets' : 'store'}] url differs; update it explicitly before connecting to another service`,
+    )
+  await access(p.path, constants.W_OK)
+  await access(dirname(p.path), constants.W_OK)
+  const previous = credentials.load(service, p.repo)
+  const id = randomBytes(16).toString('hex'),
+    secret = randomBytes(32).toString('hex')
+  const token = `abp_1_${id}_${secret}`
+  const response = await request(opts, service, 'requests', {
+    repo: p.repo,
+    credentialId: id,
+    digest: createHash('sha256').update(secret).digest('hex'),
+  })
+  if (!response.ok)
+    throw new Error('Could not start connection approval; verify the web-enabled service URL')
+  const started = (await response.json()) as ConnectionStarted
+  if (
+    !/^[a-f0-9]{32}$/.test(started.id) ||
+    !/^[a-f0-9]{64}$/.test(started.capability) ||
+    !/^[A-F0-9]{10}$/.test(started.code) ||
+    !Number.isFinite(Date.parse(started.expiresAt))
+  )
+    throw new Error('Invalid connection response')
+  const verification = `${service}/connect?code=${started.code}`
+  opts.print(`Approve project ${p.repo}\nOpen ${verification}\nCode: ${started.code}`)
+  try {
+    if (opts.browser) await opts.browser(verification)
+    else {
+      const command =
+        process.platform === 'darwin'
+          ? ['open', verification]
+          : process.platform === 'win32'
+            ? ['rundll32', 'url.dll,FileProtocolHandler', verification]
+            : ['xdg-open', verification]
+      const child = Bun.spawn(command, { stdout: 'ignore', stderr: 'ignore' })
+      child.unref()
+    }
+  } catch {
+    opts.print('Browser could not be opened. Use the URL and code on another device.')
+  }
+  const capability = { id: started.id, capability: started.capability }
+  const now = opts.now ?? Date.now
+  const sleep = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)))
+  const interval = Math.max(5, Math.min(30, started.interval || 5)) * 1000
+  let approved = false
+  let configChanged = false
+  let saved = false
+  let updatedText = p.text
+  try {
+    let outcome: ConnectionOutcome | undefined
+    while (!opts.signal?.aborted && now() <= Date.parse(started.expiresAt) + interval) {
+      await sleep(interval)
+      const polled = await request(opts, service, 'poll', capability)
+      if (polled.status === 429) continue
+      if (!polled.ok) throw new Error('Approval polling failed; retry ab connect')
+      outcome = (await polled.json()) as ConnectionOutcome
+      if (outcome.status !== 'pending') break
+    }
+    if (!outcome || outcome.status === 'pending' || opts.signal?.aborted) {
+      const cancelled = await request(opts, service, 'cancel', capability)
+      if (!cancelled.ok)
+        throw new Error(
+          'Could not confirm cancellation; use the owner credential list to check this connection',
+        )
+      opts.print(
+        opts.signal?.aborted
+          ? 'Connection cancelled; local configuration unchanged.'
+          : 'Connection timed out; local configuration unchanged.',
+      )
+      return
+    }
+    if (outcome.status !== 'approved') {
+      opts.print(`Connection ${outcome.status}; local configuration unchanged.`)
+      return
+    }
+    approved = true
+    if (outcome.repo !== p.repo || outcome.credentialId !== id)
+      throw new Error('Approval identity mismatch')
+    if (!p.service || (opts.tickets && (p.table.tickets as { url?: string }).url !== service)) {
+      updatedText = setConnectionURL(p.text, opts.tickets ? 'tickets' : 'store', service)
+      if (opts.tickets) parseConfig(updatedText)
+      else parse(updatedText)
+      await atomicConfig(p.path, p.text, updatedText)
+      configChanged = true
+    }
+    const configuredTickets = p.table.tickets as { source?: string; url?: string } | undefined
+    if (
+      opts.tickets ||
+      (configuredTickets?.source === 'hosted' &&
+        (!configuredTickets.url || normalizeServiceURL(configuredTickets.url) === service))
+    ) {
+      const tickets = parseConfig(updatedText).tickets
+      const lifecycle = ticketLifecycle(tickets)
+      await new HostedTicketSource({
+        url: service,
+        token,
+        repo: p.repo,
+        teamKey: tickets.teamKey!,
+        ...(opts.fetch ? { fetchFn: (input, init) => opts.fetch!(String(input), init) } : {}),
+      }).synchronizePolicy({
+        version: 1,
+        tickets: {
+          source: 'hosted',
+          teamKey: tickets.teamKey!,
+          readyState: lifecycle.ready,
+          triageState: lifecycle.triage,
+          claimedState: lifecycle.doing,
+          doneState: lifecycle.done,
+          createState: lifecycle.create,
+          proposalState: lifecycle.proposal,
+          ...(tickets.readyLabels !== undefined ? { readyLabels: tickets.readyLabels } : {}),
+        },
+      })
+    }
+    credentials.save({ service, repo: p.repo, id, token })
+    saved = true
+    if (previous) {
+      try {
+        await revoke(opts, service, previous.token)
+      } catch {
+        opts.print(
+          `Connected, but the previous credential ${previous.id} could not be revoked; revoke it using the service administrative tools.`,
+        )
+      }
+    }
+    opts.print(`Connected ${p.repo} to ${service}.`)
+    if (configChanged) opts.print(`Updated ${p.path}; review and commit this non-secret setting.`)
+  } catch (error) {
+    if (!saved) {
+      try {
+        const cancelled = await request(opts, service, 'cancel', capability)
+        if (!cancelled.ok) throw new Error()
+      } catch {
+        opts.print(
+          `Could not confirm remote cleanup for credential ${id}; check the service administrative credential list.`,
+        )
+      }
+      if (configChanged) {
+        try {
+          await atomicConfig(p.path, updatedText, p.text)
+        } catch {
+          opts.print(
+            `Restore [${opts.tickets ? 'tickets' : 'store'}] url manually if needed; configuration changed concurrently.`,
+          )
+        }
+      }
+    }
+    throw new Error(
+      approved
+        ? `Connection could not be saved; previous credential retained. ${(error as Error).message}. Repair the reported error and run ab connect again.`
+        : (error as Error).message,
+    )
+  }
+}
+export async function abDisconnect(opts: ConnectOptions): Promise<void> {
+  if (opts.tickets && opts.builds) throw new Error('Choose --tickets or --builds')
+  const p = await project(opts)
+  if (
+    !opts.tickets &&
+    !opts.builds &&
+    p.ticketService &&
+    p.service &&
+    normalizeServiceURL(String(p.ticketService)) !== p.service
+  )
+    throw new Error(
+      'Multiple services: use ab disconnect --tickets for tickets; set AB_STORE to the build service and select --builds for builds',
+    )
+  if (!p.service && !opts.builds && p.ticketService) return abDisconnect({ ...opts, tickets: true })
+  if (!p.service) throw new Error('No configured service')
+  const credentials = new ProjectCredentials(opts.env)
+  const entry = credentials.load(p.service, p.repo)
+  if (!entry) {
+    opts.print('No stored credential; project configuration and service data retained.')
+    return
+  }
+  if (p.ticketService && p.buildService === p.ticketService)
+    opts.print('Builds and tickets share this credential; disconnecting affects both uses.')
+  await revoke(opts, p.service, entry.token)
+  credentials.remove(p.service, p.repo)
+  opts.print('Disconnected; project registration, data, and [store] url retained.')
+}
+
+/** Edit only the selected table; preserve unrelated configuration and comments. */
+export function setConnectionURL(
+  text: string,
+  table: 'tickets' | 'store',
+  service: string,
+): string {
+  const lines = text.split('\n')
+  let inside = false
+  let start = -1
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]!
+    if (/^\s*\[/.test(line)) {
+      if (inside) {
+        lines.splice(i, 0, `url = ${JSON.stringify(service)}`)
+        return lines.join('\n')
+      }
+      inside = new RegExp(`^\\s*\\[${table}\\]\\s*(?:#.*)?$`).test(line)
+      if (inside) start = i
+    } else if (inside && /^\s*url\s*=/.test(line)) {
+      lines[i] = `url = ${JSON.stringify(service)}`
+      return lines.join('\n')
+    }
+  }
+  if (start >= 0) lines.splice(start + 1, 0, `url = ${JSON.stringify(service)}`)
+  else lines.push(`[${table}]`, `url = ${JSON.stringify(service)}`)
+  return lines.join('\n')
+}

package/packages/core/src/cli/context.ts

@@ -273,7 +273,13 @@ export async function buildContext(deps: ContextDeps): Promise<ContextManifest>
   if (inputs.ticket === true) {
     const created = events.find((event) => event.type === 'build.created')
     if (created !== undefined && created.type === 'build.created') {
-      const ticket = created.payload.ticket
+      const original = created.payload.ticket
+      const current =
+        original.source === 'hosted' ? (await store.getBuild(build))?.ticket : undefined
+      const ticket = {
+        ...original,
+        ...(current?.source === original.source ? { id: current.id } : {}),
+      }
       const lines = [
         `# Ticket: ${ticket.title ?? ticket.id}`,
         '',