@dylanpiercey/work 0.0.120 → 0.0.122

package/dist/_DJyHc1w-.js

@@ -0,0 +1,1739 @@
+import { $ as setSetting, V as publish, Y as getSetting, _t as git, bt as config, c as killWorkspaceSessions, dt as all, ft as db, gt as gh, i as disposeSessions, l as listSessions, nt as ghKnownHosts, ot as DEFAULT_GITHUB_HOST, p as panePids, pt as get, vt as run } from "./_Cr71Xd0d.js";
+import fs from "node:fs";
+import path from "node:path";
+import { AsyncLocalStorage } from "node:async_hooks";
+import os from "node:os";
+import fs$1 from "node:fs/promises";
+import crypto from "node:crypto";
+//#region src/server/branches.ts
+/** The one branch-prefix rule: `ref` is this workspace's branch or one of
+* its `-topic` lanes. Another workspace's branch can extend this prefix
+* (slugs are user-chosen), so prefix matching must also subtract
+* `otherWorkspaceBranches` — every caller of this predicate does. */
+/** Is `ref` the workspace branch named by `prefix`, or a `-topic` lane of
+* it? Lives alone in its own module: both `workspaces.ts` and `prs.ts` need
+* it, and either importing the other would drag a heavy import graph along. */
+function ownsBranch(ref, prefix) {
+	return ref === prefix || ref.startsWith(`${prefix}-`);
+}
+//#endregion
+//#region src/server/github-hosts.ts
+/** GitHub hosts: github.com plus any Enterprise servers the user added or
+* signed `gh` in to. A repo's full name carries its host as a leading
+* segment (`ghe.corp.example/owner/name`) and omits it for github.com, so
+* every existing `owner/name` row, cache dir, and picker entry keeps its
+* meaning — the same shape `gh repo clone HOST/OWNER/REPO` accepts. */
+var DEFAULT_HOST = DEFAULT_GITHUB_HOST;
+/** `[host/]owner/name` → parts. Anything without a dot in its first
+* segment is an owner, not a host. */
+function splitRepo(fullName) {
+	const parts = fullName.split("/");
+	if (parts.length >= 3 && parts[0].includes(".")) return {
+		host: parts[0],
+		name: parts.slice(1).join("/")
+	};
+	return {
+		host: DEFAULT_HOST,
+		name: fullName
+	};
+}
+function joinRepo(host, name) {
+	return host === DEFAULT_HOST ? name : `${host}/${name}`;
+}
+function repoWebUrl(fullName) {
+	const { host, name } = splitRepo(fullName);
+	return `https://${host}/${name}`;
+}
+function cloneUrl(fullName) {
+	return `${repoWebUrl(fullName)}.git`;
+}
+/** Enterprise hosts the user added in Settings (persisted). */
+function addedHosts() {
+	try {
+		return JSON.parse(getSetting("github.hosts") || "[]");
+	} catch {
+		return [];
+	}
+}
+/** Every host in play: github.com, added ones, and any gh already knows. */
+function configuredHosts() {
+	return [.../* @__PURE__ */ new Set([
+		DEFAULT_HOST,
+		...addedHosts(),
+		...ghKnownHosts()
+	])];
+}
+function isValidHost(host) {
+	return /^[a-z0-9-]+(\.[a-z0-9-]+)+$/i.test(host);
+}
+/** `https://ghe.corp/anything/` → `ghe.corp`: people paste URLs. */
+function normalizeHost(input) {
+	return input.trim().toLowerCase().replace(/^[a-z]+:\/\//, "").replace(/[/?#].*$/, "").replace(/:\d+$/, "");
+}
+function addHost(host) {
+	const h = normalizeHost(host);
+	if (!isValidHost(h)) throw new Error(`invalid host: ${host}`);
+	if (h !== DEFAULT_HOST) setSetting("github.hosts", JSON.stringify([.../* @__PURE__ */ new Set([...addedHosts(), h])]));
+	return h;
+}
+function removeHost(host) {
+	const h = normalizeHost(host);
+	setSetting("github.hosts", JSON.stringify(addedHosts().filter((x) => x !== h)));
+}
+/** Point git's credential helper for `host` at gh (`gh auth setup-git`),
+* so clones/pushes over https use the token gh holds. Idempotent and
+* cheap; without it git prompts "Username for https://<host>" on a pipe
+* and the clone hangs. */
+async function ensureGitCredentials(host) {
+	await run("gh", [
+		"auth",
+		"setup-git",
+		"--hostname",
+		host
+	]).catch(() => {});
+}
+function graphqlUrl(host) {
+	return host === DEFAULT_HOST ? "https://api.github.com/graphql" : `https://${host}/api/graphql`;
+}
+var tokens = /* @__PURE__ */ new Map();
+/** The token `gh` holds for a host, read once per process per host.
+* Environment first (`GH_TOKEN` for github.com, `GH_ENTERPRISE_TOKEN` for
+* anything else — gh's own convention) so a CI-style token works without
+* `gh` being logged in at all. */
+function hostToken(host) {
+	let p = tokens.get(host);
+	if (!p) {
+		p = (async () => {
+			const fromEnv = host === DEFAULT_HOST ? process.env.GH_TOKEN || process.env.GITHUB_TOKEN : process.env.GH_ENTERPRISE_TOKEN || process.env.GITHUB_ENTERPRISE_TOKEN;
+			if (fromEnv) return fromEnv;
+			return run("gh", [
+				"auth",
+				"token",
+				"--hostname",
+				host
+			]);
+		})().catch((err) => {
+			tokens.delete(host);
+			throw err;
+		});
+		tokens.set(host, p);
+	}
+	return p;
+}
+/** Forget a cached token (401/403 — rotated under us, or just signed in). */
+function forgetToken(host) {
+	tokens.delete(host);
+}
+//#endregion
+//#region src/server/cache.ts
+/** Keyed stale-while-revalidate cache: a cached value is served immediately
+* (revalidating in the background when older than `ttlMs`); loads are deduped
+* per key, and `refresh` bypasses both the cache and any in-flight load. */
+function swr(ttlMs, load, seed) {
+	const cache = /* @__PURE__ */ new Map();
+	const inflight = /* @__PURE__ */ new Map();
+	function start(key, refresh) {
+		const startedAt = Date.now();
+		const promise = load(key, refresh).then((value) => {
+			const existing = cache.get(key);
+			if (!existing || existing.at <= startedAt) cache.set(key, {
+				at: Date.now(),
+				value
+			});
+			return value;
+		}).finally(() => {
+			if (inflight.get(key)?.promise === promise) inflight.delete(key);
+		});
+		inflight.set(key, {
+			promise,
+			refresh
+		});
+		return promise;
+	}
+	const read = (key, refresh = false) => {
+		if (refresh) {
+			const current = inflight.get(key);
+			return current?.refresh ? current.promise : start(key, true);
+		}
+		let cached = cache.get(key);
+		if (!cached && seed) {
+			cached = seed(key);
+			if (cached) cache.set(key, cached);
+		}
+		if (cached) {
+			if (Date.now() - cached.at >= ttlMs && !inflight.has(key)) start(key, false).catch(() => {});
+			return Promise.resolve(cached.value);
+		}
+		return inflight.get(key)?.promise ?? start(key, false);
+	};
+	/** Inject an externally fetched value (e.g. from a batched load). */
+	read.set = (key, value) => {
+		cache.set(key, {
+			at: Date.now(),
+			value
+		});
+	};
+	/** Current cached value, if any — used when a batch update must merge
+	* with a richer per-key load rather than replace it. */
+	read.get = (key) => cache.get(key)?.value;
+	return read;
+}
+/** Serialize async work per key: calls for one key run in submission order,
+* each starting only after the previous settled. The stored tail is the
+* all-settled form, so a rejection neither blocks the next caller nor leaves
+* the entry behind — the map holds only keys with work still in flight. */
+var locks = /* @__PURE__ */ new Map();
+function withLock(key, fn) {
+	const run = (locks.get(key) ?? Promise.resolve()).then(fn);
+	const tail = run.then(() => {}, () => {});
+	locks.set(key, tail);
+	tail.then(() => {
+		if (locks.get(key) === tail) locks.delete(key);
+	});
+	return run;
+}
+//#endregion
+//#region src/server/github.ts
+var TTL_MS = 9e5;
+/** github.com keeps the historical file name; Enterprise hosts get their own. */
+var cachePath = (host) => path.join(config.dataDir, host === DEFAULT_HOST ? "repos.json" : `repos.${host}.json`);
+/**
+* User's repos plus every org's on every configured host, merged and cached
+* (in memory, persisted to disk across restarts). Cached results are served
+* immediately no matter their age, with a background revalidate when stale
+* — only an explicit refresh or an empty cache blocks. Hosts are
+* independent: a signed-out Enterprise server costs its own repos, never
+* github.com's.
+*/
+async function repoCatalog(refresh = false) {
+	const hosts = configuredHosts();
+	const [parts, ssoParts] = await Promise.all([Promise.all(hosts.map((host) => catalog(host, refresh).catch(() => {
+		if (host === DEFAULT_HOST && refresh) throw new Error(`gh repo listing failed`);
+		return catalog.get(host) ?? null;
+	}))), Promise.all(hosts.map((host) => pendingSsoOrgs(host, refresh).catch(() => [])))]);
+	const repos = parts.flatMap((c) => c?.repos ?? []);
+	const sso = dedupeSso(ssoParts.flat());
+	return {
+		fetchedAt: Math.min(...parts.map((c) => c?.fetchedAt ?? Date.now())),
+		repos: repos.sort((a, b) => a.nameWithOwner.localeCompare(b.nameWithOwner)),
+		...sso.length ? { sso } : {}
+	};
+}
+var catalog = swr(TTL_MS, fetchCatalog, readDiskCache);
+function readDiskCache(host) {
+	try {
+		const cached = JSON.parse(fs.readFileSync(cachePath(host), "utf8"));
+		if (!Array.isArray(cached?.repos)) return void 0;
+		for (const r of cached.repos) r.host ||= host;
+		return {
+			at: cached.fetchedAt,
+			value: cached
+		};
+	} catch {
+		return;
+	}
+}
+var LIST_FIELDS = "nameWithOwner,defaultBranchRef,isArchived,parent";
+var LIST_FIELDS_NO_PARENT = "nameWithOwner,defaultBranchRef,isArchived";
+/** Orgs that still need SAML SSO for this host's gh token. Memberships
+* list them even when unauthorized; probing `orgs/<login>` yields the
+* authorize URL via `X-GitHub-SSO`. Authorize URLs live ~1 h; both
+* authorize flows pass `refresh=true`, so a 15 min TTL is enough and
+* keeps the status poll from re-probing every minute. */
+var ssoCache = swr(9e5, (host) => probePendingSso(host));
+function pendingSsoOrgs(host, refresh = false) {
+	return ssoCache(host, refresh);
+}
+async function probePendingSso(host) {
+	const logins = (await gh([
+		"api",
+		"user/memberships/orgs",
+		"--jq",
+		".[].organization.login"
+	], host).catch(() => "")).split("\n").filter(Boolean);
+	return (await Promise.all(logins.map(async (org) => {
+		const { out } = await ghCapture([
+			"api",
+			`orgs/${org}`,
+			"--include"
+		], host);
+		return parseSsoRequired(out, org, host);
+	}))).filter((x) => !!x);
+}
+/** Run gh and keep stdout/stderr even when it exits non-zero — needed for
+* `gh api --include` SAML 403s that put `X-GitHub-SSO` on stdout. */
+async function ghCapture(args, host) {
+	try {
+		return {
+			ok: true,
+			out: await gh(args, host)
+		};
+	} catch (err) {
+		const e = err;
+		return {
+			ok: false,
+			out: [
+				e.stdout,
+				e.stderr,
+				e.message
+			].filter(Boolean).join("\n")
+		};
+	}
+}
+/** Pull org + authorize URL from an `X-GitHub-SSO` header or error body. */
+function parseSsoRequired(text, fallbackOrg, host) {
+	const header = /^x-github-sso:\s*required;\s*url=(\S+)/im.exec(text);
+	const fromBody = /https:\/\/[^\s"'<>]+\/orgs\/[^/\s"'<>]+\/sso\?authorization_request=[^\s"'<>]+/i.exec(text)?.[0];
+	const raw = header?.[1] || fromBody;
+	if (!raw) return null;
+	const authorizeUrl = raw.replace(/[.,);\]}>]+$/g, "");
+	const org = /\/orgs\/([^/]+)\/sso/i.exec(authorizeUrl)?.[1] || fallbackOrg;
+	if (!org) return null;
+	return {
+		org,
+		host,
+		authorizeUrl
+	};
+}
+function dedupeSso(items) {
+	const byOrg = /* @__PURE__ */ new Map();
+	for (const item of items) byOrg.set(item.org, item);
+	return [...byOrg.values()].sort((a, b) => a.org.localeCompare(b.org));
+}
+/** One owner's repos. Prefer including `parent`; when a fork's upstream is
+* behind org SAML that the OAuth token has not authorized, GraphQL fails
+* the *whole* list — retry without `parent` rather than treating the
+* owner as unlistable (which would fail an explicit catalog refresh). */
+async function listOwnerRepos(host, owner) {
+	const args = (fields) => [
+		"repo",
+		"list",
+		...owner ? [owner] : [],
+		"--limit",
+		"500",
+		"--json",
+		fields
+	];
+	try {
+		const out = await gh(args(LIST_FIELDS), host);
+		return {
+			repos: JSON.parse(out),
+			parents: true,
+			partial: false
+		};
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : String(err);
+		if (/SAML enforcement|protected by organization/i.test(msg)) try {
+			const out = await gh(args(LIST_FIELDS_NO_PARENT), host);
+			return {
+				repos: JSON.parse(out),
+				parents: false,
+				partial: false
+			};
+		} catch {}
+		return {
+			repos: [],
+			parents: true,
+			partial: true
+		};
+	}
+}
+async function fetchCatalog(host) {
+	let partial = false;
+	const orgs = (await gh([
+		"api",
+		"user/orgs",
+		"--jq",
+		".[].login"
+	], host).catch(() => {
+		partial = true;
+		return "";
+	})).split("\n").filter(Boolean);
+	const lists = await Promise.all([void 0, ...orgs].map(async (owner) => {
+		const listed = await listOwnerRepos(host, owner);
+		if (listed.partial) partial = true;
+		return listed;
+	}));
+	const byName = /* @__PURE__ */ new Map();
+	for (const { repos: rows, parents } of lists) for (const r of rows) byName.set(r.nameWithOwner, {
+		nameWithOwner: joinRepo(host, r.nameWithOwner),
+		host,
+		defaultBranch: r.defaultBranchRef?.name || "main",
+		isArchived: !!r.isArchived,
+		parent: !parents ? void 0 : r.parent ? joinRepo(host, `${r.parent.owner.login}/${r.parent.name}`) : null
+	});
+	const repos = [...byName.values()].sort((a, b) => a.nameWithOwner.localeCompare(b.nameWithOwner));
+	const catalog = {
+		fetchedAt: Date.now(),
+		repos
+	};
+	if (partial) {
+		if (readDiskCache(host)) throw new Error("gh repo listing failed");
+		return catalog;
+	}
+	const tmp = cachePath(host) + ".tmp";
+	fs.writeFileSync(tmp, JSON.stringify(catalog));
+	fs.renameSync(tmp, cachePath(host));
+	return catalog;
+}
+/** Fork `fullName` under the signed-in user and return the fork's
+* `[host/]owner/name`. Idempotent: GitHub answers the POST with the
+* existing fork if there is one. Fork creation is async on GitHub's side,
+* so wait until the fork actually has branches — cloning too early gets a
+* repo with no refs and the worktree add fails on a missing base. An
+* empty *upstream* also has no branches; the timeout lets that case fall
+* through to the clone rather than erroring here. */
+async function ensureFork(fullName) {
+	const { host, name } = splitRepo(fullName);
+	const out = await gh([
+		"api",
+		"-X",
+		"POST",
+		`repos/${name}/forks`,
+		"--jq",
+		".full_name"
+	], host);
+	const fork = out.trim();
+	if (!/^[\w.-]+\/[\w.-]+$/.test(fork)) throw new Error(`forking ${fullName} failed: ${out || "no response"}`);
+	const forkFull = joinRepo(host, fork);
+	for (let tries = 0; tries < 15; tries++) {
+		if (await forkHasRefs(forkFull, host, fork)) break;
+		if (tries < 14) await new Promise((r) => setTimeout(r, 2e3));
+	}
+	return forkFull;
+}
+async function forkHasRefs(forkFull, host, fork) {
+	try {
+		await ensureGitCredentials(host);
+		if ((await git([
+			"ls-remote",
+			"--heads",
+			cloneUrl(forkFull)
+		])).split("\n").some((l) => l.includes("	refs/heads/"))) return true;
+	} catch {}
+	const count = await gh([
+		"api",
+		`repos/${fork}/branches?per_page=1`,
+		"--jq",
+		"length"
+	], host).catch(() => "");
+	return !!count && count !== "0";
+}
+/** Branch names for a repo (for base-branch selection). `refresh` bypasses
+* the cache, for the picker's refresh button — a branch pushed a moment ago
+* must not wait out the TTL. */
+var repoBranches = (fullName, refresh = false) => branches(fullName, refresh);
+/** Upstream `[host/]owner/name` when the repo is a fork, else null. A PR
+* opened from a fork lives in the upstream repo, so PR search needs this to
+* know where else to look. The catalog answers from disk for listed repos
+* (the status batch asks for every active repo at once, and must not fan
+* out into per-repo REST calls on a cold start); the per-repo lookup covers
+* repos outside it. Failures resolve to null (and age out with the TTL) —
+* a blip here must cost fork PRs, not the whole status tick. */
+async function repoParent(fullName) {
+	const hit = (await repoCatalog().catch(() => null))?.repos.find((r) => r.nameWithOwner === fullName);
+	if (hit && hit.parent !== void 0) return hit.parent;
+	return (await repoMeta(fullName)).parent;
+}
+/** The repo's default branch, or null when the lookup failed. */
+var repoDefaultBranch = async (fullName, refresh = false) => (await repoMeta(fullName, refresh)).defaultBranch;
+var repoMeta = swr(36e5, async (fullName) => {
+	const { host, name } = splitRepo(fullName);
+	const out = await gh([
+		"api",
+		`repos/${name}`,
+		"--jq",
+		"{parent: (.parent.full_name // null), default: .default_branch}"
+	], host).catch(() => "");
+	let parsed = {};
+	try {
+		parsed = JSON.parse(out);
+	} catch {}
+	if (!parsed.default) try {
+		await ensureGitCredentials(host);
+		const symref = await git([
+			"ls-remote",
+			"--symref",
+			cloneUrl(fullName),
+			"HEAD"
+		]);
+		parsed.default = /^ref: refs\/heads\/(\S+)\tHEAD/m.exec(symref)?.[1] ?? null;
+	} catch {}
+	return {
+		parent: parsed.parent ? joinRepo(host, parsed.parent) : null,
+		defaultBranch: parsed.default || null
+	};
+});
+/** REST pages branches at 100 and orders them alphabetically, so a repo
+* with more than one page hid everything past it — on a repo with a couple
+* hundred workspace branches that silently cut `main` itself out of the
+* picker. Paginate, but bounded: a repo past this many pages costs more
+* round trips than a picker should, and the filter is how you find a branch
+* there anyway. */
+var BRANCH_PAGES = 10;
+var branches = swr(3e5, async (fullName) => {
+	const { host, name } = splitRepo(fullName);
+	try {
+		const all = [];
+		for (let page = 1; page <= BRANCH_PAGES; page++) {
+			const names = (await gh([
+				"api",
+				`repos/${name}/branches?per_page=100&page=${page}`,
+				"--jq",
+				".[].name"
+			], host)).split("\n").filter(Boolean);
+			all.push(...names);
+			if (names.length < 100) break;
+		}
+		return all;
+	} catch {
+		await ensureGitCredentials(host);
+		return (await git([
+			"ls-remote",
+			"--heads",
+			cloneUrl(fullName)
+		])).split("\n").map((l) => l.split("	refs/heads/")[1]).filter(Boolean);
+	}
+});
+//#endregion
+//#region src/server/git-refs.ts
+/** The checked-out commit (and branch name) of a worktree, read off disk
+* instead of spawned.
+*
+* Every status tick needs the oid for every repo of every active workspace —
+* it is what tells an open review that an agent committed, since a local
+* commit reaches GitHub through nothing the app can be told about. Diff
+* loads also need the branch; both answers come from the same HEAD read.
+* As a process per repo per tick that was the bulk of the git the server
+* ran; the same answer is three small file reads.
+*
+* `git` stays the authority for anything this cannot read confidently: a
+* ref backend it does not understand, a chain that does not end in an oid,
+* a layout it has never seen. Being slower is better than being wrong,
+* because the drift banner reads a stale oid as "your checkout differs
+* from the review". */
+async function headOid(dir) {
+	const read = await readHead(dir).catch(() => null);
+	if (read) return read;
+	const [oid, branch] = await Promise.all([spawnHead(dir), git([
+		"rev-parse",
+		"--abbrev-ref",
+		"HEAD"
+	], dir).catch(() => "HEAD")]);
+	return {
+		oid,
+		branch
+	};
+}
+var spawnHead = (dir) => git(["rev-parse", "HEAD"], dir).catch(() => "");
+/** Does the remote-tracking store hold any real branch head? Decides
+* "empty upstream" (diff every file as an add, create an orphan branch)
+* vs a misconfigured base that should fail loudly.
+*
+* `origin/HEAD` does not count: it can exist as a symref even when the
+* branch it points at has no commits yet (a plain clone of an empty repo),
+* and counting it would make an empty repo look configured. */
+async function remoteHasHeads(repo) {
+	return (await git([
+		"for-each-ref",
+		"--format=%(refname)",
+		"refs/remotes/origin/"
+	], repo).catch(() => "")).split("\n").some((ref) => ref.startsWith("refs/remotes/origin/") && ref !== "refs/remotes/origin/HEAD");
+}
+/** Both hash algorithms, since a repo may be SHA-256. */
+var OID = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;
+/** A symref chain that runs this long is a loop, not a layout. */
+var MAX_HOPS = 5;
+async function readHead(dir) {
+	const { gitDir, common } = await gitDirs(dir);
+	if (await exists(path.join(common, "reftable"))) return null;
+	let ref = (await fs$1.readFile(path.join(gitDir, "HEAD"), "utf8")).trim();
+	let branch = "HEAD";
+	if (ref.startsWith("ref: ")) {
+		const name = ref.slice(5).trim();
+		if (name.startsWith("refs/heads/")) branch = name.slice(11);
+	} else if (OID.test(ref)) return {
+		oid: ref,
+		branch: "HEAD"
+	};
+	else return null;
+	for (let hop = 0; ref.startsWith("ref: ") && hop < MAX_HOPS; hop++) {
+		const name = ref.slice(5).trim();
+		const loose = await read(path.join(gitDir, name)) ?? await read(path.join(common, name));
+		if (loose !== void 0) {
+			ref = loose.trim();
+			continue;
+		}
+		const packed = await read(path.join(common, "packed-refs"));
+		if (packed === void 0) return {
+			oid: "",
+			branch
+		};
+		const line = packed.split("\n").find((l) => !l.startsWith("^") && l.endsWith(` ${name}`));
+		if (!line) return {
+			oid: "",
+			branch
+		};
+		ref = line.slice(0, line.indexOf(" "));
+	}
+	return OID.test(ref) ? {
+		oid: ref,
+		branch
+	} : null;
+}
+/** A worktree's `.git` is a file pointing at its admin directory inside the
+* shared bare cache, which in turn points back at the common ref store. */
+async function gitDirs(dir) {
+	const dotGit = path.join(dir, ".git");
+	const gitDir = await isDir(dotGit) ? dotGit : path.resolve(dir, (await fs$1.readFile(dotGit, "utf8")).replace(/^gitdir:/, "").trim());
+	const commonRef = await read(path.join(gitDir, "commondir"));
+	return {
+		gitDir,
+		common: commonRef ? path.resolve(gitDir, commonRef.trim()) : gitDir
+	};
+}
+var read = (file) => fs$1.readFile(file, "utf8").catch(() => void 0);
+var exists = (file) => fs$1.stat(file).then(() => true, () => false);
+var isDir = (file) => fs$1.stat(file).then((s) => s.isDirectory(), () => false);
+//#endregion
+//#region src/server/procs.ts
+var darwin = process.platform === "darwin";
+/** Is `cwd` the workspace root or somewhere under it? The trailing slash is
+* the whole point: a sibling `…/work-2` must not read as inside `…/work`. */
+function inside(cwd, root) {
+	return cwd === root || cwd.startsWith(root + "/");
+}
+/** Listening TCP ports attributed to workspaces by the owning process's cwd. */
+async function portsByWorkspace(paths) {
+	const result = /* @__PURE__ */ new Map();
+	const canonical = new Map([...paths].map(([wsId, p]) => [wsId, realPath(p)]));
+	const [ports, cwds] = darwin ? await Promise.all([listeningPorts(), processCwds()]) : await (async () => {
+		const ports = await listeningPorts();
+		const cwds = /* @__PURE__ */ new Map();
+		await Promise.all([...new Set(ports.map((p) => p.pid))].map(async (pid) => {
+			const cwd = await readCwd(pid);
+			if (cwd) cwds.set(pid, cwd);
+		}));
+		return [ports, cwds];
+	})();
+	for (const info of ports) {
+		const cwd = cwds.get(info.pid);
+		if (!cwd) continue;
+		for (const [wsId, wsPath] of canonical) if (inside(cwd, wsPath)) {
+			const list = result.get(wsId) || [];
+			list.push(info);
+			result.set(wsId, list);
+		}
+	}
+	return result;
+}
+/** Processes whose cwd is inside the workspace, with their listening ports. */
+async function workspaceProcs(wsPath) {
+	wsPath = realPath(wsPath);
+	const portsByPid = /* @__PURE__ */ new Map();
+	const [ports, panes, cwds] = await Promise.all([
+		listeningPorts(),
+		panePids(),
+		processCwds()
+	]);
+	for (const { port, pid } of ports) portsByPid.set(pid, [...portsByPid.get(pid) || [], port]);
+	const procs = [];
+	for (const [pid, cwd] of cwds) {
+		if (!inside(cwd, wsPath)) continue;
+		const parts = await procArgs(pid);
+		if (!parts.length) continue;
+		const cmd = parts[0].split("/").pop() || parts[0];
+		if (cmd === "tmux" || cmd.startsWith("tmux:") || cmd === "git" || cmd.startsWith("git-") || panes.has(pid)) continue;
+		procs.push({
+			pid,
+			cmd,
+			args: parts.slice(1).join(" ").slice(0, 120),
+			ports: [...new Set(portsByPid.get(pid) || [])]
+		});
+	}
+	return procs.sort((a, b) => b.ports.length - a.ports.length || a.pid - b.pid);
+}
+/** SIGTERM every process running inside the workspace (dev servers etc.). */
+async function killWorkspaceProcs(wsPath) {
+	for (const proc of await workspaceProcs(wsPath)) try {
+		process.kill(proc.pid, "SIGTERM");
+	} catch {}
+}
+/** SIGTERM a single pid, but only when its cwd sits inside one of the
+* given workspace paths — the kill endpoint must never be able to signal
+* arbitrary host processes. Returns whether a signal was sent. */
+async function killWorkspaceProc(pid, wsPaths) {
+	const cwd = await readCwd(pid);
+	if (!cwd) return false;
+	if (!wsPaths.some((p) => inside(cwd, realPath(p)))) return false;
+	try {
+		process.kill(pid, "SIGTERM");
+	} catch {
+		return false;
+	}
+	return true;
+}
+/** Every listening TCP port with its owning pid/command: `ss` on Linux,
+* `lsof` on macOS (no /proc, no ss there). */
+async function listeningPorts() {
+	const seen = /* @__PURE__ */ new Set();
+	const ports = [];
+	if (darwin) {
+		const out = await run("/usr/sbin/lsof", [
+			"-nP",
+			"-iTCP",
+			"-sTCP:LISTEN",
+			"-Fpcn"
+		]).catch(() => "");
+		let pid = 0;
+		let cmd = "?";
+		for (const line of out.split("\n")) if (line.startsWith("p")) pid = Number(line.slice(1));
+		else if (line.startsWith("c")) cmd = line.slice(1) || "?";
+		else if (line.startsWith("n")) {
+			const port = Number(line.match(/:(\d+)$/)?.[1]);
+			if (!port || !pid || seen.has(`${pid}:${port}`)) continue;
+			seen.add(`${pid}:${port}`);
+			ports.push({
+				port,
+				pid,
+				cmd
+			});
+		}
+		return ports;
+	}
+	const out = await run("ss", ["-tlnpH"]).catch(() => "");
+	for (const line of out.split("\n")) {
+		const port = Number(line.match(/:(\d+)\s/)?.[1]);
+		const pid = Number(line.match(/pid=(\d+)/)?.[1]);
+		const cmd = line.match(/users:\(\("([^"]+)"/)?.[1] || "?";
+		if (!port || !pid || seen.has(`${pid}:${port}`)) continue;
+		seen.add(`${pid}:${port}`);
+		ports.push({
+			port,
+			pid,
+			cmd
+		});
+	}
+	return ports;
+}
+/** Every process's cwd: /proc scan on Linux, one `lsof` sweep on macOS. */
+async function processCwds() {
+	const cwds = /* @__PURE__ */ new Map();
+	if (darwin) {
+		const out = await run("/usr/sbin/lsof", [
+			"-a",
+			"-d",
+			"cwd",
+			"-Fpn"
+		]).catch(() => "");
+		let pid = 0;
+		for (const line of out.split("\n")) if (line.startsWith("p")) pid = Number(line.slice(1));
+		else if (line.startsWith("n") && pid) cwds.set(pid, line.slice(1));
+		return cwds;
+	}
+	for (const entry of await fs$1.readdir("/proc")) {
+		const pid = Number(entry);
+		if (!pid) continue;
+		const cwd = await readCwd(pid);
+		if (cwd) cwds.set(pid, cwd);
+	}
+	return cwds;
+}
+/** A process's argv (best-effort; empty when it died or is unreadable). */
+async function procArgs(pid) {
+	if (darwin) return (await run("ps", [
+		"-p",
+		String(pid),
+		"-o",
+		"args="
+	]).catch(() => "")).trim().split(/\s+/).filter(Boolean);
+	try {
+		return (await fs$1.readFile(`/proc/${pid}/cmdline`, "utf8")).split("\0").filter(Boolean);
+	} catch {
+		return [];
+	}
+}
+async function readCwd(pid) {
+	if (darwin) {
+		const line = (await run("/usr/sbin/lsof", [
+			"-a",
+			"-d",
+			"cwd",
+			"-p",
+			String(pid),
+			"-Fn"
+		]).catch(() => "")).split("\n").find((l) => l.startsWith("n"));
+		return line ? line.slice(1) : void 0;
+	}
+	try {
+		return await fs$1.readlink(`/proc/${pid}/cwd`);
+	} catch {
+		return;
+	}
+}
+/** Resolve symlinks (e.g. /home → /var/home on ostree) so paths compare
+* equal to the fully-resolved targets the cwd lookups return. */
+function realPath(p) {
+	try {
+		return fs.realpathSync(p);
+	} catch {
+		return p;
+	}
+}
+//#endregion
+//#region src/server/hook-token.ts
+/** Shared secret baked into git push hooks. /api/repo-pushed rides the
+* public port now (no internal-port split), so the token keeps strangers
+* on the LAN/tunnel from spending our GitHub API budget with spoofed
+* refresh pings. Persisted so hooks survive server restarts; migrate.mjs
+* reads the same file. */
+var file = path.join(config.dataDir, "hook-token");
+var cached;
+function hookToken() {
+	if (cached) return cached;
+	try {
+		cached = fs.readFileSync(file, "utf8").trim();
+		if (cached) return cached;
+	} catch {}
+	cached = crypto.randomBytes(16).toString("hex");
+	fs.writeFileSync(file, `${cached}\n`, { mode: 384 });
+	return cached;
+}
+//#endregion
+//#region src/server/repo-events.ts
+/** Ref-update detection: a reference-transaction hook in each bare-cache
+* repo (work-owned — never a user worktree) posts the transaction's ref
+* lines to the app the moment any workspace pushes, fetches or commits.
+* Remote-tracking updates refresh PR badges in seconds instead of waiting
+* out the poll; local branch updates are what auto-push acts on (see
+* auto-push.ts). scripts/migrate.mjs backfills existing caches — keep the
+* script text there in sync with this one. */
+function hookScript(fullName) {
+	return `#!/bin/sh
+# installed by work: signals ref updates to the app server.
+[ "\$1" = "committed" ] || exit 0
+refs=\$(cat)
+case "\$refs" in *"refs/remotes/origin/"*|*" refs/heads/"*) ;; *) exit 0 ;; esac
+printf '%s\\n' "$refs" | curl -sf -m 2 -X POST --data-binary @- "http://127.0.0.1:${config.appPort}/api/repo-pushed?repo=${encodeURIComponent(fullName)}&token=${hookToken()}" >/dev/null 2>&1 &\nexit 0\n`;
+}
+function ensurePushHook(bare, fullName) {
+	const script = hookScript(fullName);
+	try {
+		const file = path.join(bare, "hooks", "reference-transaction");
+		try {
+			if (fs.readFileSync(file, "utf8") === script) return;
+		} catch {}
+		fs.mkdirSync(path.dirname(file), { recursive: true });
+		fs.writeFileSync(file, script, { mode: 493 });
+	} catch (err) {
+		console.warn(`[work] failed to install push hook in ${bare}`, err);
+	}
+}
+/** Every bare cache on disk gets the current hook at boot: the script
+* changes between versions, and a repo that no workspace touches after an
+* update would otherwise keep signalling the old way. */
+function ensureAllPushHooks() {
+	let hosts;
+	try {
+		hosts = fs.readdirSync(config.cacheDir);
+	} catch {
+		return;
+	}
+	for (const host of hosts) {
+		const hostDir = path.join(config.cacheDir, host);
+		let owners = [];
+		try {
+			owners = fs.readdirSync(hostDir);
+		} catch {}
+		for (const owner of owners) {
+			const ownerDir = path.join(hostDir, owner);
+			let repos = [];
+			try {
+				repos = fs.readdirSync(ownerDir);
+			} catch {}
+			for (const repo of repos) {
+				if (!repo.endsWith(".git")) continue;
+				const name = `${owner}/${repo.slice(0, -4)}`;
+				ensurePushHook(path.join(ownerDir, repo), host === "github.com" ? name : `${host}/${name}`);
+			}
+		}
+	}
+}
+//#endregion
+//#region src/server/workspaces.ts
+function listWorkspaces() {
+	return all("SELECT * FROM workspaces ORDER BY created_at DESC").map(hydrate);
+}
+/** Single-row lookup — this runs on every /api/workspaces/:id/* request,
+* so it mustn't load every workspace. */
+function getWorkspace(id) {
+	const ws = get("SELECT * FROM workspaces WHERE id = ?", id);
+	return ws && hydrate(ws);
+}
+var home = os.homedir();
+/** Materialize failures, by workspace id — the row stays pending and the
+* nav shows why until a retry (un-archive, restart) gets through. */
+var materializeErrors = /* @__PURE__ */ new Map();
+function hydrate(ws) {
+	const raw = ws;
+	ws.pending = raw.materialized === 0;
+	delete raw.materialized;
+	if (ws.pending && materializeErrors.has(ws.id)) ws.pending_error = materializeErrors.get(ws.id);
+	ws.repos = all("SELECT full_name, worktree, base_branch, default_branch FROM repos WHERE workspace_id = ? ORDER BY worktree", ws.id);
+	ws.display_path = ws.path.startsWith(home) ? `~${ws.path.slice(home.length)}` : ws.path;
+	return ws;
+}
+async function createWorkspace(name, repos, opts = {}) {
+	if (!name.trim()) throw new Error("workspace name required");
+	for (const repo of repos) assertKnownHost(repo.fullName);
+	const join = opts.join?.trim() || null;
+	if (join) {
+		if (!/^[\w./+@-]+$/.test(join)) throw new Error(`not a branch name: ${join}`);
+		await git([
+			"check-ref-format",
+			"--branch",
+			join
+		], config.workRoot).catch(() => {
+			throw new Error(`not a branch name: ${join}`);
+		});
+		const own = listWorkspaces().find((w) => w.branch === join || ownsBranch(join, w.branch));
+		if (own) throw new Error(`${join} is ${own.name}, a workspace on this machine — open it instead`);
+	}
+	const slug = slugify(name);
+	const id = randomId();
+	const dir = path.join(config.workRoot, `${slug}-${id}`);
+	const branch = join ? `${join}-${slugify(config.branchPrefix)}` : `${config.branchPrefix}-${slug}-${id}`;
+	const siblings = assignSiblingNames(repos.map((r) => r.fullName));
+	const added = [];
+	fs.mkdirSync(dir, { recursive: true });
+	try {
+		const results = await Promise.allSettled(repos.map(async (repo) => {
+			const worktree = siblings.get(repo.fullName);
+			const fullName = await resolveFork(repo);
+			return withRepoLock(fullName, async () => {
+				const bare = await ensureBare(fullName);
+				const defaultBranch = await bareDefaultBranch(bare);
+				const base = join || repo.baseBranch || defaultBranch;
+				if (join && !await revParse(bare, `refs/remotes/origin/${join}`)) throw new Error(`${fullName} has no branch ${join} on origin — its owner has not pushed it yet`);
+				await addWorkspaceWorktree(bare, path.join(dir, worktree), branch, base);
+				return {
+					full_name: fullName,
+					worktree,
+					base_branch: base,
+					default_branch: defaultBranch
+				};
+			});
+		}));
+		for (const r of results) if (r.status === "fulfilled") added.push(r.value);
+		const failed = results.find((r) => r.status === "rejected");
+		if (failed && failed.status === "rejected") throw failed.reason;
+	} catch (err) {
+		for (const r of added) await withRepoLock(r.full_name, () => git([
+			"worktree",
+			"remove",
+			"--force",
+			path.join(dir, r.worktree)
+		], barePath(r.full_name))).catch(() => {});
+		fs.rmSync(dir, {
+			recursive: true,
+			force: true
+		});
+		throw err;
+	}
+	db.prepare("INSERT INTO workspaces (id, name, path, branch, origin_branch, imported_at) VALUES (?, ?, ?, ?, ?, ?)").run(id, name, dir, branch, join, join ? (/* @__PURE__ */ new Date()).toISOString() : null);
+	for (const r of added) db.prepare("INSERT INTO repos (workspace_id, full_name, worktree, base_branch, default_branch) VALUES (?, ?, ?, ?, ?)").run(id, r.full_name, r.worktree, r.base_branch, r.default_branch);
+	writeAgentsMd(dir, branch, added, join);
+	notifyWorkspacesChanged();
+	return getWorkspace(id);
+}
+/** Insert a workspace from a backup as a pending row: the directory and
+* worktrees come later (see materializeWorkspace), so a restore of many
+* workspaces is instant and clones happen one at a time behind it. The
+* id is kept — it is what a manifest and this machine agree on — unless
+* this database already has it. Returns the new path. */
+/** One path segment, no traversal — a workspace id or a worktree dir. */
+var SEGMENT_RE = /^(?!\.{1,2}$)[\w.-]+$/;
+var BRANCH_RE = /^[\w./+@-]+$/;
+function insertPendingWorkspace(row) {
+	if (!SEGMENT_RE.test(row.id)) throw new Error(`not a workspace id: ${row.id}`);
+	if (!BRANCH_RE.test(row.branch)) throw new Error(`not a branch name: ${row.branch}`);
+	if (row.origin_branch && !BRANCH_RE.test(row.origin_branch)) throw new Error(`not a branch name: ${row.origin_branch}`);
+	for (const r of row.repos) {
+		if (!SEGMENT_RE.test(r.worktree)) throw new Error(`not a directory name: ${r.worktree}`);
+		for (const b of [r.base_branch, r.default_branch]) if (b && !BRANCH_RE.test(b)) throw new Error(`not a branch name: ${b}`);
+	}
+	if (getWorkspace(row.id)) throw new Error(`${row.name} is already here`);
+	for (const repo of row.repos) assertKnownHost(repo.full_name);
+	const slug = slugify(row.name);
+	let dir = path.join(config.workRoot, `${slug}-${row.id}`);
+	for (let n = 2; fs.existsSync(dir); n++) dir = path.join(config.workRoot, `${slug}-${row.id}-${n}`);
+	const repos = new Map(row.repos.map((r) => [r.full_name, r]));
+	const dirs = /* @__PURE__ */ new Set();
+	for (const r of repos.values()) {
+		if (dirs.has(r.worktree)) throw new Error(`two repos in ${row.name} share the directory ${r.worktree}`);
+		dirs.add(r.worktree);
+	}
+	db.exec("BEGIN");
+	try {
+		db.prepare("INSERT INTO workspaces (id, name, path, branch, status, created_at, origin_branch, imported_at, materialized) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 0)").run(row.id, row.name, dir, row.branch, row.status, row.created_at || (/* @__PURE__ */ new Date()).toISOString(), row.origin_branch ?? null, (/* @__PURE__ */ new Date()).toISOString());
+		for (const r of repos.values()) db.prepare("INSERT INTO repos (workspace_id, full_name, worktree, base_branch, default_branch) VALUES (?, ?, ?, ?, ?)").run(row.id, r.full_name, r.worktree, r.base_branch, r.default_branch);
+		db.exec("COMMIT");
+	} catch (err) {
+		db.exec("ROLLBACK");
+		throw err;
+	}
+	materializeErrors.delete(row.id);
+	notifyWorkspacesChanged();
+	return dir;
+}
+/** Put a pending workspace on disk: clone/fetch every repo and check its
+* branch out from origin (the branch a backup names, or a fresh one from
+* the base when it was never pushed). A failure rolls the directory back
+* and leaves the row pending with the reason. */
+async function materializeWorkspace(id) {
+	const ws = getWorkspace(id);
+	if (!ws || !ws.pending) return;
+	materializeErrors.delete(id);
+	const added = [];
+	fs.mkdirSync(ws.path, { recursive: true });
+	try {
+		for (const repo of ws.repos) await withRepoLock(repo.full_name, async () => {
+			const bare = await ensureBare(repo.full_name);
+			const defaultBranch = await bareDefaultBranch(bare);
+			if (!repo.base_branch) repo.base_branch = defaultBranch;
+			if (repo.default_branch !== defaultBranch || repo.base_branch !== defaultBranch) {
+				repo.default_branch = defaultBranch;
+				db.prepare("UPDATE repos SET base_branch = ?, default_branch = ? WHERE workspace_id = ? AND full_name = ?").run(repo.base_branch, defaultBranch, id, repo.full_name);
+			}
+			(await import("./_Dpa8WFuv.js")).muteAutoPush(repo.full_name, ws.branch);
+			await addWorkspaceWorktree(bare, path.join(ws.path, repo.worktree), ws.branch, repo.base_branch);
+			added.push(repo);
+		});
+	} catch (err) {
+		for (const r of added) await withRepoLock(r.full_name, () => git([
+			"worktree",
+			"remove",
+			"--force",
+			path.join(ws.path, r.worktree)
+		], barePath(r.full_name))).catch(() => {});
+		fs.rmSync(ws.path, {
+			recursive: true,
+			force: true
+		});
+		materializeErrors.set(id, err instanceof Error ? err.message : String(err));
+		notifyWorkspacesChanged();
+		throw err;
+	}
+	writeAgentsMd(ws.path, ws.branch, ws.repos, ws.origin_branch);
+	db.prepare("UPDATE workspaces SET materialized = 1 WHERE id = ?").run(id);
+	notifyWorkspacesChanged();
+}
+/** One materialize at a time: they share the bare caches and the network,
+* and a restore of ten workspaces should not fan out ten clones. Each runs
+* under its own progress op so a nav row can follow its own steps. */
+var materializeChain = Promise.resolve();
+function queueMaterialize(id) {
+	materializeChain = materializeChain.then(() => withProgressOp(`restore:${id}`, () => materializeWorkspace(id)).catch((err) => {
+		console.warn(`[work] restore of workspace ${id} failed`, err);
+	}));
+	return materializeChain;
+}
+/** Pending active workspaces left over from a restore that did not finish
+* (a restart mid-way, a clone that failed) — retried on boot. */
+function resumePendingWorkspaces() {
+	for (const ws of listWorkspaces()) if (ws.pending && ws.status === "active") queueMaterialize(ws.id);
+}
+async function addRepo(workspaceId, fullName, baseBranch, fork) {
+	const ws = getWorkspace(workspaceId);
+	if (!ws) throw new Error(`unknown workspace: ${workspaceId}`);
+	assertKnownHost(fullName);
+	const requested = fullName;
+	const worktree = assignSiblingNames([...ws.repos.map((r) => r.full_name), requested]).get(requested);
+	fullName = await resolveFork({
+		fullName: requested,
+		fork
+	});
+	await assertRepoNotInWorkspace(ws, requested, fullName);
+	const { base, defaultBranch } = await withRepoLock(fullName, async () => {
+		const bare = await ensureBare(fullName);
+		const defaultBranch = await bareDefaultBranch(bare);
+		const base = baseBranch || defaultBranch;
+		try {
+			await addWorkspaceWorktree(bare, path.join(ws.path, worktree), ws.branch, base);
+		} catch (err) {
+			const dest = path.join(ws.path, worktree);
+			await git([
+				"worktree",
+				"remove",
+				"--force",
+				dest
+			], bare).catch(() => {
+				fs.rmSync(dest, {
+					recursive: true,
+					force: true
+				});
+			});
+			await git(["worktree", "prune"], bare).catch(() => {});
+			throw err;
+		}
+		return {
+			base,
+			defaultBranch
+		};
+	});
+	db.prepare("INSERT INTO repos (workspace_id, full_name, worktree, base_branch, default_branch) VALUES (?, ?, ?, ?, ?)").run(workspaceId, fullName, worktree, base, defaultBranch);
+	const updated = getWorkspace(workspaceId);
+	writeAgentsMd(ws.path, ws.branch, updated.repos, ws.origin_branch);
+	notifyWorkspacesChanged();
+	return updated;
+}
+async function removeRepo(workspaceId, worktree) {
+	const ws = getWorkspace(workspaceId);
+	if (!ws) throw new Error(`unknown workspace: ${workspaceId}`);
+	const repo = ws.repos.find((r) => r.worktree === worktree);
+	if (!repo) throw new Error(`unknown repo: ${worktree}`);
+	const bare = barePath(repo.full_name);
+	const dir = path.join(ws.path, worktree);
+	progress(`Removing worktree ${worktree}/…`);
+	const foreign = otherWorkspaceBranches(ws.id);
+	await withRepoLock(repo.full_name, async () => {
+		await git([
+			"worktree",
+			"remove",
+			"--force",
+			dir
+		], bare).catch(() => {
+			fs.rmSync(dir, {
+				recursive: true,
+				force: true
+			});
+		});
+		await git(["worktree", "prune"], bare).catch(() => {});
+		for (const branch of await workspaceBranches(bare, ws.branch, foreign)) await git([
+			"branch",
+			"-D",
+			branch
+		], bare).catch(() => {});
+	});
+	db.prepare("DELETE FROM repos WHERE workspace_id = ? AND worktree = ?").run(workspaceId, worktree);
+	db.prepare("DELETE FROM review_comments WHERE workspace_id = ? AND worktree = ?").run(workspaceId, worktree);
+	db.prepare("DELETE FROM review_viewed WHERE workspace_id = ? AND key GLOB ? || '/*'").run(workspaceId, worktree);
+	const updated = getWorkspace(workspaceId);
+	try {
+		writeAgentsMd(ws.path, ws.branch, updated.repos, ws.origin_branch);
+	} catch {}
+	notifyWorkspacesChanged();
+	publish("review.changed", { workspaceId });
+	return updated;
+}
+async function setWorkspaceStatus(id, status) {
+	const ws = getWorkspace(id);
+	db.prepare("UPDATE workspaces SET status = ? WHERE id = ?").run(status, id);
+	notifyWorkspacesChanged();
+	if (status === "active" && ws?.pending) queueMaterialize(id);
+	if (status === "archived") {
+		progress(`Stopping sessions…`);
+		await killWorkspaceSessions(id);
+		if (ws) {
+			progress(`Stopping processes…`);
+			await killWorkspaceProcs(ws.path);
+		}
+	}
+}
+async function deleteWorkspace(id) {
+	const ws = getWorkspace(id);
+	if (!ws) throw new Error(`unknown workspace: ${id}`);
+	const sessions = listSessions(id);
+	db.prepare("DELETE FROM workspaces WHERE id = ?").run(id);
+	db.prepare("DELETE FROM settings WHERE key = ?").run(`review.seen:${id}`);
+	db.prepare("DELETE FROM settings WHERE key IN (?, ?, ?)").run(`ui.tab:${id}`, `ui.diff-filter:${id}`, `ui.diff-pos:${id}`);
+	notifyWorkspacesChanged();
+	progress(`Stopping sessions and processes…`);
+	await disposeSessions(sessions);
+	await killWorkspaceProcs(ws.path);
+	const foreign = otherWorkspaceBranches(ws.id);
+	for (const repo of ws.repos) {
+		const bare = barePath(repo.full_name);
+		const worktree = path.join(ws.path, repo.worktree);
+		progress(`Removing worktree ${repo.worktree}/…`);
+		await withRepoLock(repo.full_name, async () => {
+			await git([
+				"worktree",
+				"remove",
+				"--force",
+				worktree
+			], bare).catch(() => {});
+			await git(["worktree", "prune"], bare).catch(() => {});
+			for (const branch of await workspaceBranches(bare, ws.branch, foreign)) await git([
+				"branch",
+				"-D",
+				branch
+			], bare).catch(() => {});
+		});
+	}
+	progress(`Deleting workspace files…`);
+	fs.rmSync(ws.path, {
+		recursive: true,
+		force: true
+	});
+	materializeErrors.delete(id);
+}
+/** SSE payload: full workspace list so clients don't refetch. */
+function notifyWorkspacesChanged() {
+	publish("workspaces.changed", listWorkspaces());
+}
+/** Creation/add-repo progress, streamed to clients over SSE — and kept in
+* a small ring so clients whose SSE a proxy/VPN buffers can poll it
+* (see /api/progress). Seqs let the two paths dedupe. Each entry carries
+* the id of the operation that produced it (see withProgressOp) so a
+* client's progress view never shows another operation's steps. */
+var progressSeq = 0;
+var progressLog = [];
+var progressOp = new AsyncLocalStorage();
+/** Tag every progress() emitted inside fn with an operation id — route
+* handlers wrap the workspace mutation they run so concurrent operations
+* don't cross-contaminate each other's step lists. */
+function withProgressOp(op, fn) {
+	return progressOp.run(op, fn);
+}
+function progress(message) {
+	const entry = {
+		seq: ++progressSeq,
+		op: progressOp.getStore(),
+		message
+	};
+	progressLog.push(entry);
+	if (progressLog.length > 50) progressLog.shift();
+	publish("workspace.progress", entry);
+}
+function progressSince(seq, op) {
+	return {
+		seq: progressSeq,
+		messages: seq === void 0 ? [] : progressLog.filter((e) => e.seq > seq && (!op || e.op === op))
+	};
+}
+/** The name to clone: the user's fork of `fullName` when asked, made (or
+* found — GitHub's fork POST is idempotent) on the spot. */
+async function resolveFork(repo) {
+	if (!repo.fork) return repo.fullName;
+	progress(`Forking ${repo.fullName}…`);
+	return ensureFork(repo.fullName);
+}
+/** Only github.com and hosts the user added (or gh already knows). Blocks
+* pasted `evil.com/o/r` from reaching ls-remote / clone. */
+function assertKnownHost(fullName) {
+	const { host } = splitRepo(fullName);
+	if (!configuredHosts().includes(host)) throw new Error(`unknown host ${host}: add it in Settings before cloning`);
+}
+/** Reject when the workspace already holds the resolved name, the
+* requested upstream, or a fork/parent pair of either — so forking
+* `torvalds/linux` then pasting that URL as-is (or the reverse) fails
+* cleanly instead of adding a second worktree. */
+async function assertRepoNotInWorkspace(ws, requested, resolved) {
+	const held = new Set(ws.repos.map((r) => r.full_name));
+	if (held.has(resolved) || held.has(requested)) throw new Error(`${held.has(resolved) ? resolved : requested} is already in this workspace`);
+	for (const r of ws.repos) {
+		const parent = await repoParent(r.full_name).catch(() => null);
+		if (parent === requested || parent === resolved) throw new Error(`${r.full_name} (fork of ${parent}) is already in this workspace`);
+	}
+	const parentOfRequested = await repoParent(requested).catch(() => null);
+	if (parentOfRequested && held.has(parentOfRequested)) throw new Error(`${parentOfRequested} (upstream of ${requested}) is already in this workspace`);
+}
+/** One operation at a time per shared bare cache: concurrent create/delete
+* on the same repo would race `worktree add` against `worktree prune` and
+* concurrent fetches. Chained promises, released even on failure. */
+var repoLocks = /* @__PURE__ */ new Map();
+function withRepoLock(fullName, fn) {
+	const run = (repoLocks.get(fullName) ?? Promise.resolve()).then(fn);
+	const tail = run.then(() => {}, () => {});
+	repoLocks.set(fullName, tail);
+	tail.then(() => {
+		if (repoLocks.get(fullName) === tail) repoLocks.delete(fullName);
+	});
+	return run;
+}
+/** `<cache>/<host>/<owner>/<name>.git` — the host segment a full name
+* carries (or github.com) becomes the directory, so the pre-hosts layout
+* is unchanged for github.com repos. */
+function barePath(fullName) {
+	const { host, name } = splitRepo(fullName);
+	return path.join(config.cacheDir, host, `${name}.git`);
+}
+async function ensureBare(fullName) {
+	const bare = barePath(fullName);
+	if (fs.existsSync(bare)) {
+		ensurePushHook(bare, fullName);
+		progress(`Fetching ${fullName}…`);
+		await git([
+			"fetch",
+			"--prune",
+			"--quiet",
+			"origin"
+		], bare);
+	} else {
+		progress(`Cloning ${fullName} (first time, may take a while)…`);
+		fs.mkdirSync(path.dirname(bare), { recursive: true });
+		await ensureGitCredentials(splitRepo(fullName).host);
+		await git([
+			"clone",
+			"--bare",
+			cloneUrl(fullName),
+			bare
+		]);
+		await git([
+			"config",
+			"remote.origin.fetch",
+			"+refs/heads/*:refs/remotes/origin/*"
+		], bare);
+		ensurePushHook(bare, fullName);
+		await git([
+			"fetch",
+			"--prune",
+			"--quiet",
+			"origin"
+		], bare);
+	}
+	return bare;
+}
+async function bareDefaultBranch(bare) {
+	try {
+		const out = await git([
+			"ls-remote",
+			"--symref",
+			"origin",
+			"HEAD"
+		], bare);
+		const remote = /^ref: refs\/heads\/(\S+)\tHEAD/m.exec(out)?.[1];
+		if (remote) {
+			await git([
+				"symbolic-ref",
+				"HEAD",
+				`refs/heads/${remote}`
+			], bare);
+			return remote;
+		}
+	} catch {}
+	return (await git(["symbolic-ref", "HEAD"], bare)).replace("refs/heads/", "");
+}
+/** `git rev-parse --verify` → oid, or null if the ref is missing. */
+async function revParse(cwd, ref) {
+	try {
+		return await git([
+			"rev-parse",
+			"--verify",
+			ref
+		], cwd);
+	} catch {
+		return null;
+	}
+}
+/**
+* Create a worktree on the workspace branch tip that matches latest
+* `origin/<base>`.
+*
+* Fresh branch → cut from `origin/<base>` after fetch (ensureBare).
+* Existing `origin/<ws-branch>` (re-add, open PR, prior push) → restore
+* that branch then rebase onto `origin/<base>` so the checkout is not
+* stuck on an old main tip. Empty upstream (GitHub "no commits yet") →
+* `worktree add --orphan` so the first real commit can be the root.
+* Leftover local branches with no worktree are deleted so
+* `worktree add -b` can recreate them.
+*/
+async function addWorkspaceWorktree(bare, dest, branch, base) {
+	const baseRef = `origin/${base}`;
+	const baseOid = await revParse(bare, baseRef);
+	await git(["worktree", "prune"], bare).catch(() => {});
+	if (await revParse(bare, `refs/heads/${branch}`)) {
+		if ((await git([
+			"worktree",
+			"list",
+			"--porcelain"
+		], bare)).includes(`branch refs/heads/${branch}`)) throw new Error(`${branch} is already checked out in another worktree`);
+		await git([
+			"branch",
+			"-D",
+			branch
+		], bare);
+	}
+	const label = path.basename(dest);
+	if (!baseOid) {
+		if (await remoteHasHeads(bare)) throw new Error(`missing ${baseRef} after fetch`);
+		progress(`Adding empty worktree ${label}/…`);
+		await git([
+			"worktree",
+			"add",
+			"--orphan",
+			"-b",
+			branch,
+			dest
+		], bare);
+		return;
+	}
+	if (await revParse(bare, `refs/remotes/origin/${branch}`)) {
+		progress(`Restoring ${label}/ from origin/${branch}…`);
+		await git([
+			"worktree",
+			"add",
+			"-b",
+			branch,
+			dest,
+			`origin/${branch}`
+		], bare);
+		if (await git([
+			"merge-base",
+			branch,
+			baseRef
+		], dest) !== baseOid) {
+			progress(`Rebasing ${label}/ onto ${base}…`);
+			try {
+				await git(["rebase", baseRef], dest);
+			} catch (err) {
+				await git(["rebase", "--abort"], dest).catch(() => {});
+				const why = err instanceof Error ? err.message : String(err);
+				throw new Error(`Could not rebase ${branch} onto ${baseRef} for ${label}/. ${why}`);
+			}
+		}
+	} else {
+		progress(`Adding worktree ${label}/ (${base})…`);
+		await git([
+			"worktree",
+			"add",
+			"-b",
+			branch,
+			dest,
+			baseRef
+		], bare);
+	}
+}
+/** Branches of every other workspace — slugs are user-chosen, so one
+* workspace's branch can be a strict prefix of another's; prefix matching
+* (cleanup, PR attribution) must exclude these. */
+function otherWorkspaceBranches(id) {
+	return all("SELECT branch FROM workspaces WHERE id != ?", id).map((r) => r.branch);
+}
+/** The workspace branch plus its `-topic` lanes, if they exist locally —
+* minus any ref that actually belongs to another workspace whose branch
+* extends this one's (see otherWorkspaceBranches). */
+async function workspaceBranches(bare, branch, exclude) {
+	return (await git([
+		"for-each-ref",
+		"--format=%(refname:short)",
+		"refs/heads/"
+	], bare).catch(() => "")).split("\n").filter((b) => ownsBranch(b, branch) && !exclude.some((x) => ownsBranch(b, x)));
+}
+/** Delete a finished lane's local branch from the shared bare cache.
+*
+* Only a `-topic` lane, never the workspace branch itself: that one is
+* reused for the next change, so it outlives every PR opened from it.
+*
+* `headOid` is the finished PR's own head commit, and the local tip has to
+* still be sitting on it. That is what separates "this branch is the PR you
+* just finished with" from "this branch has commits you never pushed" — the
+* former stays reachable through the PR on GitHub (`refs/pull/N/head`
+* outlives both the merge and the branch, so a closed-unmerged lane is as
+* recoverable as a merged one), the latter would be gone for good. The
+* remote ref is not the test: GitHub prunes it on merge exactly when
+* pruning is safest.
+*
+* `-D` rather than `-d` because a squash-merged lane is not an ancestor of
+* its base, so git cannot see the merge that GitHub reports. It is also
+* what refuses when the lane is still checked out in a worktree — that
+* returns false rather than raising, a lane you are standing on being a
+* reason to keep it, not an error. */
+async function pruneLaneBranch(workspaceId, fullName, lane, headOid) {
+	const ws = getWorkspace(workspaceId);
+	if (!ws || !headOid || lane === ws.branch) return false;
+	if (!ownsBranch(lane, ws.branch)) return false;
+	if (otherWorkspaceBranches(workspaceId).some((b) => ownsBranch(lane, b))) return false;
+	if (!ws.repos.some((r) => r.full_name === fullName)) return false;
+	return withRepoLock(fullName, async () => {
+		const bare = barePath(fullName);
+		if (await revParse(bare, `refs/heads/${lane}`) !== headOid) return false;
+		return git([
+			"branch",
+			"-D",
+			lane
+		], bare).then(() => true, () => false);
+	});
+}
+/** Directory/branch-safe prefix for a workspace name. Decomposing first keeps
+* accented Latin readable (é → e); a name with nothing ASCII left (another
+* script, emoji) falls back to a generic prefix — the random id is what makes
+* the name unique, so the slug never has to be rejected. */
+function slugify(name) {
+	return name.normalize("NFKD").replace(/\p{M}+/gu, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "ws";
+}
+function randomId() {
+	return Math.random().toString(36).slice(2, 8);
+}
+/** Sibling dir per repo; on basename collision fall back to owner-repo. */
+function assignSiblingNames(fullNames) {
+	const byBase = /* @__PURE__ */ new Map();
+	for (const fullName of fullNames) {
+		const base = splitRepo(fullName).name.split("/")[1];
+		byBase.set(base, [...byBase.get(base) || [], fullName]);
+	}
+	const result = /* @__PURE__ */ new Map();
+	for (const [base, names] of byBase) for (const fullName of names) result.set(fullName, names.length > 1 ? splitRepo(fullName).name.replace("/", "-") : base);
+	return result;
+}
+function writeAgentsMd(dir, branch, repos, origin = null) {
+	const repoLines = repos.map((r) => `- \`${r.worktree}/\`: ${r.full_name} (base: \`${r.base_branch}\`)`).join("\n");
+	const content = `# Workspace
+
+Workspace branch: **\`${branch}\`**. Every repo here is checked out on it, and
+it is the required **prefix** for every other branch you create.
+
+${origin ? `- **Shared workspace:** \`${branch}\` is a lane on \`${origin}\`, another
+  person's workspace branch. Every PR from here targets it
+  (\`gh pr create --base ${origin}\`), and when \`origin/${origin}\` moves,
+  rebase onto it. Never push to \`${origin}\` itself. Once \`${origin}\` has
+  landed and is gone from origin: \`git fetch --prune\`, rebase onto
+  \`origin/<base>\`, and retarget the PR (\`gh pr edit --base <base>\`).
+` : ""}- **Branches:** stay on \`${branch}\` and keep pushing it: one open PR, more
+  commits. After it lands, \`git fetch\` and reset \`${branch}\` to
+  \`origin/<base>\` so the next change reuses this branch. Do not cut a
+  \`${branch}-<topic>\` just to start the next piece of work.
+  A topic lane is only for when \`${branch}\` must stay unmerged (a larger
+  change) and you need a second PR on top of it. Then push every repo's
+  workspace branch first, cut from the parent
+  (\`git switch -c ${branch}-<topic> origin/${branch}\`), and keep the prefix.
+  Only two levels: never \`${branch}-a-b\`. Tooling finds PRs by that prefix,
+  so a branch named anything else is invisible: never invent one.
+- **Repos:**
+${repoLines}
+- **Repo agents files:** you **MUST** read a repo's \`AGENTS.md\` (or
+  \`CLAUDE.md\`) before doing any work in it. It is not loaded for you.
+- **No \`git stash\`:** every workspace using a repo shares one stash stack, so
+  a pop can take another workspace's work. Commit as you go; uncommitted
+  work isn't part of the review.
+- **Push:** \`git push -u origin HEAD\` in each repo, for review on GitHub.
+  Never commit on a base branch.
+- **Rebase after merge:** when \`${branch}\` is still open and \`origin/<base>\`
+  moves, rebase onto it. A squash-merge does not move the fork point, so the
+  review keeps showing landed work until you do. On a topic lane, rebase onto
+  \`${branch}\` when the parent moves; after the parent merges: \`git fetch
+  --prune\`, rebase onto \`origin/<base>\`, and retarget (\`gh pr edit --base
+  <base>\`).
+- **PRs:** the description covers only what is in the diff, a few sentences on
+  what changed and why. No verification logs or file-by-file detail. A topic
+  lane's PR is \`gh pr create --base ${branch}\`. GitHub will otherwise target
+  the repo default, and the local review will disagree with the files tab.
+- **Ask \`work\` for facts:** the \`work\` CLI answers from the same data as
+  the app: \`work workspace\` (this workspace: repos, base branches, open PRs,
+  sessions, running procs/ports), \`work repos\`, \`work procs\`,
+  \`work review\` (review comments the user left on the diff and has not
+  sent yet, as markdown), \`work workspaces\`, \`work doctor\` (installed
+  tools / agents / GitHub sign-in), \`work usage\` (agent plan quotas). Add
+  \`--json\` for machine output. Prefer these over guessing from the
+  filesystem or calling GitHub.
+`;
+	fs.writeFileSync(path.join(dir, "AGENTS.md"), content);
+	const claudeMd = path.join(dir, "CLAUDE.md");
+	if (!fs.existsSync(claudeMd)) fs.symlinkSync("AGENTS.md", claudeMd);
+}
+//#endregion
+//#region src/server/auto-push.ts
+/** Auto-push: every commit on a workspace branch (or one of its lanes)
+* goes to origin on its own, a few seconds after it lands. What it buys is
+* that a workspace is always recoverable from a backup manifest — the
+* branch is the only copy of the work, and an export that finds unpushed
+* commits can only warn.
+*
+* Signal comes from the bare cache's reference-transaction hook (see
+* repo-events.ts): worktrees share the bare's ref store, so a commit in
+* any of them updates `refs/heads/<branch>` there. Pushes run from the
+* bare. A fast-forward always goes. A rewrite (rebase, amend, the reset
+* after a squash-merge) goes only when origin's tip is one this machine
+* put there — `--force-with-lease` against the remote-tracking ref is not
+* enough on its own, since any fetch refreshes that ref to whatever
+* someone else pushed, and a lease that matches it would overwrite them. */
+function autoPushEnabled() {
+	return getSetting("autoPush") !== "0";
+}
+function setAutoPush(on) {
+	setSetting("autoPush", on ? "1" : "0");
+}
+/** A commit is usually the first of several (an agent commits, amends,
+* rebases); wait for the burst to settle before pushing once. */
+var SETTLE_MS = 2500;
+var timers = /* @__PURE__ */ new Map();
+/** Failed pushes, `fullName#branch` → why. Cleared by the next success. */
+var failures = /* @__PURE__ */ new Map();
+/** One push per branch at a time; a hook that lands mid-push queues one
+* more run rather than racing it (two pushes with the same lease → the
+* second is rejected as stale, and the branch shows as unpushed). */
+var inflight = /* @__PURE__ */ new Map();
+var rerun = /* @__PURE__ */ new Set();
+/** Keys the hook must ignore until the time given: a restore rebases the
+* branch it checks out, and that rewrite is not something to publish. */
+var muted = /* @__PURE__ */ new Map();
+var key = (fullName, branch) => `${fullName}#${branch}`;
+/** Origin tips this machine put there, `fullName#branch` → oid. Kept in
+* the settings table so a restart still knows which rewrites are ours.
+* Bounded by the number of branches ever pushed; entries go when the
+* branch does. */
+var PUSHED_KEY = "autoPush.pushed";
+function pushedTips() {
+	try {
+		return JSON.parse(getSetting(PUSHED_KEY) || "{}");
+	} catch {
+		return {};
+	}
+}
+function rememberPushed(k, oid) {
+	const tips = pushedTips();
+	if (oid) tips[k] = oid;
+	else delete tips[k];
+	setSetting(PUSHED_KEY, JSON.stringify(tips));
+}
+/** The workspace whose branch (or lane) `branch` is, in `fullName` — the
+* most specific owner, since one workspace's branch can prefix another's. */
+function ownerOf(fullName, branch) {
+	let best;
+	for (const ws of listWorkspaces()) {
+		if (!ws.repos.some((r) => r.full_name === fullName)) continue;
+		if (!ownsBranch(branch, ws.branch)) continue;
+		if (!best || ws.branch.length > best.branch.length) best = ws;
+	}
+	return best;
+}
+/** Refs a branch with no commits of its own would equal: its repo base,
+* and the workspace branch a lane was cut from. */
+function basesFor(ws, fullName) {
+	return [ws.repos.find((r) => r.full_name === fullName)?.base_branch, ws.branch].filter((b) => !!b);
+}
+/** Ignore the hook for this branch for a moment — around a checkout that
+* rewrites it (restore's rebase onto the base). */
+function muteAutoPush(fullName, branch, ms = 1e4) {
+	const k = key(fullName, branch);
+	muted.set(k, Date.now() + ms);
+	clearTimeout(timers.get(k));
+	timers.delete(k);
+}
+/** Local branch heads the hook reported for `fullName`. */
+function noteLocalRefs(fullName, refs) {
+	if (!autoPushEnabled()) return;
+	for (const ref of refs) {
+		if (!ref.startsWith("refs/heads/")) continue;
+		const branch = ref.slice(11);
+		const k = key(fullName, branch);
+		const until = muted.get(k);
+		if (until && until > Date.now()) continue;
+		muted.delete(k);
+		const ws = ownerOf(fullName, branch);
+		if (!ws) continue;
+		const bases = basesFor(ws, fullName);
+		clearTimeout(timers.get(k));
+		timers.set(k, setTimeout(() => {
+			timers.delete(k);
+			if (autoPushEnabled()) pushBranch(fullName, branch, bases);
+		}, SETTLE_MS));
+	}
+}
+/** The hook saw `refs/remotes/origin/<branch>` move to `oid` — a push from
+* a worktree, or a fetch. A hand push that put the local tip up clears a
+* recorded failure (and counts as ours for the next rewrite). */
+async function noteRemoteRef(fullName, branch, oid) {
+	const k = key(fullName, branch);
+	if (await revParse(barePath(fullName), `refs/heads/${branch}`) !== oid) return;
+	rememberPushed(k, oid);
+	if (failures.delete(k)) {
+		const { pokeStatusWatch } = await import("./_Bjh5JEm7.js");
+		pokeStatusWatch();
+	}
+}
+/** Push one branch from the bare cache. Returns the failure text, or null
+* when the branch is up (or has nothing of its own yet). */
+function pushBranch(fullName, branch, bases = []) {
+	const k = key(fullName, branch);
+	const running = inflight.get(k);
+	if (running) {
+		rerun.add(k);
+		return running;
+	}
+	const run = withRepoLock(fullName, () => pushOnce(fullName, branch, bases)).finally(() => {
+		inflight.delete(k);
+	}).then((result) => {
+		if (!rerun.delete(k)) return result;
+		return pushBranch(fullName, branch, bases);
+	});
+	inflight.set(k, run);
+	return run;
+}
+async function pushOnce(fullName, branch, bases) {
+	const bare = barePath(fullName);
+	const k = key(fullName, branch);
+	const local = await revParse(bare, `refs/heads/${branch}`);
+	if (!local) {
+		failures.delete(k);
+		rememberPushed(k, null);
+		return null;
+	}
+	const remote = await revParse(bare, `refs/remotes/origin/${branch}`);
+	if (remote === local) {
+		failures.delete(k);
+		return null;
+	}
+	if (!remote) {
+		for (const base of bases) if (await revParse(bare, `refs/remotes/origin/${base}`) === local) return null;
+	}
+	if (remote && remote !== pushedTips()[k]) {
+		if (!await git([
+			"merge-base",
+			"--is-ancestor",
+			remote,
+			local
+		], bare).then(() => true, () => false)) return fail(k, `origin/${branch} has commits this machine did not push — pull them in, then push by hand`);
+	}
+	try {
+		await git([
+			"push",
+			"--quiet",
+			`--force-with-lease=refs/heads/${branch}:${remote ?? ""}`,
+			"origin",
+			`refs/heads/${branch}:refs/heads/${branch}`
+		], bare);
+		failures.delete(k);
+		rememberPushed(k, local);
+		return null;
+	} catch (err) {
+		const lines = (err instanceof Error ? err.message : String(err)).split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("Command failed"));
+		return fail(k, lines.find((l) => /^!\s*\[rejected\]|\(stale info\)/.test(l)) || lines.pop() || "push failed");
+	}
+}
+async function fail(k, why) {
+	failures.set(k, why);
+	const { pokeStatusWatch } = await import("./_Bjh5JEm7.js");
+	pokeStatusWatch();
+	return why;
+}
+/** Push every branch a workspace owns in one repo. Used by the backup
+* export, which needs everything on origin before a manifest means
+* anything. Returns the branches that still failed. */
+async function pushWorkspaceRepo(ws, fullName, foreign, log) {
+	const bare = barePath(fullName);
+	const bases = basesFor(ws, fullName);
+	const failed = [];
+	for (const branch of await workspaceBranches(bare, ws.branch, foreign)) {
+		log?.(`Pushing ${branch}…`);
+		const error = await pushBranch(fullName, branch, bases);
+		if (error) failed.push({
+			branch,
+			error
+		});
+	}
+	return failed;
+}
+/** The failure to show on a workspace's repo row, if any of its branches
+* could not be pushed. */
+function pushFailureFor(fullName, branch, foreign) {
+	for (const [k, why] of failures) {
+		const sep = k.indexOf("#");
+		if (k.slice(0, sep) !== fullName) continue;
+		const b = k.slice(sep + 1);
+		if (ownsBranch(b, branch) && !foreign.some((x) => ownsBranch(b, x))) return why;
+	}
+}
+//#endregion
+export { portsByWorkspace as A, withLock as B, revParse as C, ensureAllPushHooks as D, workspaceBranches as E, repoBranches as F, ensureGitCredentials as G, addHost as H, repoCatalog as I, hostToken as J, forgetToken as K, repoDefaultBranch as L, headOid as M, remoteHasHeads as N, hookToken as O, pendingSsoOrgs as P, ownsBranch as Q, repoParent as R, resumePendingWorkspaces as S, withProgressOp as T, cloneUrl as U, DEFAULT_HOST as V, configuredHosts as W, removeHost as X, joinRepo as Y, splitRepo as Z, progress as _, pushBranch as a, queueMaterialize as b, setAutoPush as c, createWorkspace as d, deleteWorkspace as f, otherWorkspaceBranches as g, listWorkspaces as h, noteRemoteRef as i, workspaceProcs as j, killWorkspaceProc as k, addRepo as l, insertPendingWorkspace as m, muteAutoPush as n, pushFailureFor as o, getWorkspace as p, graphqlUrl as q, noteLocalRefs as r, pushWorkspaceRepo as s, autoPushEnabled as t, barePath as u, progressSince as v, setWorkspaceStatus as w, removeRepo as x, pruneLaneBranch as y, swr as z };