@harness-engineering/cli 3.0.0 → 3.1.0

package/dist/{chunk-N24HCQA4.js → chunk-A65QO5KN.js}

@@ -1505,6 +1505,7 @@ __export(dist_exports, {
   assertPortUsable: () => assertPortUsable,
   assertSanitized: () => assertSanitized,
   assignFeature: () => assignFeature,
+  assigneeInvariantHolds: () => assigneeInvariantHolds,
   buildCiReviewVerdict: () => buildCiReviewVerdict,
   buildDependencyGraph: () => buildDependencyGraph,
   buildExclusionSet: () => buildExclusionSet,
@@ -1519,6 +1520,7 @@ __export(dist_exports, {
   checkOverlap: () => checkOverlap,
   checkRoadmapHealth: () => checkRoadmapHealth,
   checkTaint: () => checkTaint,
+  claim: () => claim,
   classifyConfidence: () => classifyConfidence,
   classifyFinding: () => classifyFinding,
   clearEventHashCache: () => clearEventHashCache,
@@ -1639,8 +1641,10 @@ __export(dist_exports, {
   insecureDefaultsRules: () => insecureDefaultsRules,
   invalidateCheckState: () => invalidateCheckState,
   isBadPort: () => isBadPort,
+  isClaimableBy: () => isClaimableBy,
   isDuplicateFinding: () => isDuplicateFinding,
   isErr: () => isErr,
+  isMachineAssignee: () => isMachineAssignee,
   isOk: () => isOk,
   isRegression: () => isRegression,
   isSanitizedResult: () => isSanitizedResult,
@@ -1712,6 +1716,7 @@ __export(dist_exports, {
   promoteSessionLearnings: () => promoteSessionLearnings,
   proposalsDir: () => proposalsDir,
   pruneLearnings: () => pruneLearnings,
+  pushAssigneeToExternal: () => pushAssigneeToExternal,
   reactRules: () => reactRules,
   readAdoptionRecords: () => readAdoptionRecords,
   readCheckState: () => readCheckState,
@@ -1723,6 +1728,7 @@ __export(dist_exports, {
   readTaint: () => readTaint,
   registerMockAdapter: () => registerMockAdapter,
   registerPulseAdapter: () => registerPulseAdapter,
+  release: () => release,
   removeContributions: () => removeContributions,
   removeProvenance: () => removeProvenance,
   requestMultiplePeerReviews: () => requestMultiplePeerReviews,
@@ -1774,6 +1780,7 @@ __export(dist_exports, {
   serializeRoadmap: () => serializeRoadmap,
   serializeStrategyDoc: () => serializeStrategyDoc,
   setActiveStream: () => setActiveStream,
+  setStatus: () => setStatus,
   sharpEdgesRules: () => sharpEdgesRules,
   shouldRunCheck: () => shouldRunCheck,
   spawnBackgroundCheck: () => spawnBackgroundCheck,
@@ -11702,6 +11709,61 @@ function resolveReverseStatus(externalStatus, labels, config) {
   }
   return null;
 }
+function isMachineAssignee(assignee) {
+  if (assignee === null) return false;
+  return MACHINE_ASSIGNEE_PATTERNS.some((re) => re.test(assignee));
+}
+function assigneeInvariantHolds(feature) {
+  return feature.assignee !== null === (feature.status === "in-progress");
+}
+function pushAssigneeToExternal(assignee) {
+  return assignee !== null && !isMachineAssignee(assignee);
+}
+function pushUnassigned(roadmap, feature, prev, date) {
+  roadmap.assignmentHistory.push({
+    feature: feature.name,
+    assignee: prev,
+    action: "unassigned",
+    date
+  });
+}
+function isClaimableBy(feature, assignee) {
+  return feature.assignee === null || feature.assignee === assignee;
+}
+function claim(roadmap, feature, assignee, date) {
+  if (feature.status === "in-progress" && feature.assignee !== null && feature.assignee !== assignee) {
+    return;
+  }
+  feature.status = "in-progress";
+  if (feature.assignee === assignee) return;
+  if (feature.assignee !== null) {
+    pushUnassigned(roadmap, feature, feature.assignee, date);
+  }
+  feature.assignee = assignee;
+  roadmap.assignmentHistory.push({
+    feature: feature.name,
+    assignee,
+    action: "assigned",
+    date
+  });
+}
+function release(roadmap, feature, date) {
+  if (feature.status === "in-progress") {
+    feature.status = "planned";
+  }
+  if (feature.assignee === null) return;
+  const prev = feature.assignee;
+  feature.assignee = null;
+  pushUnassigned(roadmap, feature, prev, date);
+}
+function setStatus(roadmap, feature, status, date) {
+  feature.status = status;
+  if (status !== "in-progress" && feature.assignee !== null) {
+    const prev = feature.assignee;
+    feature.assignee = null;
+    pushUnassigned(roadmap, feature, prev, date);
+  }
+}
 function parseExternalId(externalId) {
   const match = externalId.match(/^github:([^/]+)\/([^#]+)#(\d+)$/);
   if (!match) return null;
@@ -11827,8 +11889,9 @@ async function syncToExternal(roadmap, adapter2, config, prefetchedTickets) {
   }
   return result;
 }
-function applyTicketToFeature(ticketState, feature, config, forceSync, result) {
-  if (ticketState.assignee !== feature.assignee) {
+function applyTicketToFeature(roadmap, ticketState, feature, config, forceSync, result) {
+  const localMachineClaim = isMachineAssignee(feature.assignee);
+  if (!localMachineClaim && ticketState.assignee !== feature.assignee) {
     result.assignmentChanges.push({
       feature: feature.name,
       from: feature.assignee,
@@ -11841,6 +11904,11 @@ function applyTicketToFeature(ticketState, feature, config, forceSync, result) {
   const newStatus = resolvedStatus;
   if (!forceSync && isRegression(feature.status, newStatus)) return;
   if (!forceSync && feature.status === "blocked" && newStatus === "planned") return;
+  const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  if (localMachineClaim && newStatus !== "in-progress") {
+    setStatus(roadmap, feature, newStatus, date);
+    return;
+  }
   feature.status = newStatus;
 }
 async function syncFromExternal(roadmap, adapter2, config, options, prefetchedTickets) {
@@ -11869,7 +11937,7 @@ async function syncFromExternal(roadmap, adapter2, config, options, prefetchedTi
   for (const ticketState of tickets) {
     const feature = featureByExternalId.get(ticketState.externalId);
     if (!feature) continue;
-    applyTicketToFeature(ticketState, feature, config, forceSync, result);
+    applyTicketToFeature(roadmap, ticketState, feature, config, forceSync, result);
   }
   return result;
 }
@@ -12656,6 +12724,17 @@ function checkRoadmapHealth(roadmap, options) {
           suggestion: `Link a spec/plan to make it actionable, or demote it to "backlog".`
         });
       }
+      if (!assigneeInvariantHolds(feature)) {
+        const orphaned = feature.status === "in-progress" && feature.assignee === null;
+        findings.push({
+          ruleId: "RMH005",
+          severity: "error",
+          milestone: milestone.name,
+          feature: feature.name,
+          message: orphaned ? `"${feature.name}" is "in-progress" with no assignee; an in-progress row must name who is executing it.` : `"${feature.name}" has assignee "${feature.assignee}" but status "${feature.status}"; an assignee means in-progress (set at execution start, cleared otherwise).`,
+          suggestion: orphaned ? `Demote it to "planned" (or claim it) \u2014 run the roadmap skill's --groom mode.` : `Clear the assignee (or move it to "in-progress") \u2014 run the roadmap skill's --groom mode.`
+        });
+      }
     }
   }
   return findings;
@@ -12680,6 +12759,23 @@ function groomRoadmap(roadmap, options) {
           to: "backlog"
         });
       }
+      if (feature.status !== "in-progress" && feature.assignee !== null) {
+        changes.push({
+          kind: "unassigned",
+          feature: feature.name,
+          from: milestone.name,
+          to: feature.assignee
+        });
+        feature.assignee = null;
+      } else if (feature.status === "in-progress" && feature.assignee === null) {
+        feature.status = "planned";
+        changes.push({
+          kind: "demoted",
+          feature: feature.name,
+          from: milestone.name,
+          to: "planned"
+        });
+      }
       if (archiveDone && feature.status === "done" && !archive && !isIntake) {
         archived.push(feature);
         changes.push({
@@ -14111,7 +14207,7 @@ function acquireCompoundLock(category, opts = {}) {
   fs46.writeSync(fd, String(process.pid));
   fs46.closeSync(fd);
   let released = false;
-  const release = () => {
+  const release2 = () => {
     if (released) return;
     released = true;
     try {
@@ -14123,13 +14219,13 @@ function acquireCompoundLock(category, opts = {}) {
     process.removeListener("SIGTERM", onSignal);
     process.removeListener("uncaughtException", onUncaught);
   };
-  const onExit = () => release();
+  const onExit = () => release2();
   const onSignal = (sig) => {
-    release();
+    release2();
     process.kill(process.pid, sig);
   };
   const onUncaught = (err) => {
-    release();
+    release2();
     console.error(err && err.stack ? err.stack : err);
     process.exit(1);
   };
@@ -14137,7 +14233,7 @@ function acquireCompoundLock(category, opts = {}) {
   process.once("SIGINT", onSignal);
   process.once("SIGTERM", onSignal);
   process.once("uncaughtException", onUncaught);
-  return { category, lockPath, release };
+  return { category, lockPath, release: release2 };
 }
 function readHolderPid(lockPath) {
   try {
@@ -14852,7 +14948,7 @@ function writeStrategyDoc(doc, opts) {
     throw e;
   }
 }
-var WHATWG_BAD_PORTS, BAD_PORT_SET, VALID_TYPES, CONVENTIONAL_PATTERN, LOOKBACK_PATTERN, PulseDbSourceSchema, PulseSourcesSchema, PulseConfigSchema, KNOWN_SECTION_NAMES, ISO_DATE, PLACEHOLDER_INLINE, REQUIRED, ALLOWED, StrategyFrontmatterSchema, StrategySectionSchema, StrategyDocSchema, BUG_TRACK_CATEGORIES, KNOWLEDGE_TRACK_CATEGORIES, ALL_SOLUTION_CATEGORIES, ISO_DATE2, BugTrackSchema, KnowledgeTrackSchema, BaseFrontmatter, SolutionDocFrontmatterSchema, TRACK_CATEGORIES, DEFAULT_AGNIX_TIMEOUT_MS, HARNESS_AGNIX_DISABLE, HARNESS_AGNIX_BIN, CLAUDE_MD_WARN_BYTES, CLAUDE_MD_ERROR_BYTES, CONTEXT_FILES, MIN_DESCRIPTION_LENGTH, SETTINGS_PATHS, KNOWN_HOOK_EVENTS, MCP_SETTINGS_FILES, REQUIRED_SECTIONS, SETTINGS_FILES, KNOWN_AGNIX_TOOLS, KEBAB_CASE, TICKET_ID, DEFAULT_SECTIONS, DEFAULT_RATIOS, NODE_TYPE_TO_CATEGORY, SECTION_LEVEL_MAP, DEFAULT_LEVEL, DEFAULT_BUDGET, DEFAULT_LOADER_CONFIG, LEVEL_FRACTIONS, PHASE_PRIORITIES, ManifestSchema, BundleConstraintsSchema, BundleSchema, ContributionsSchema, LockfilePackageSchema, LockfileSchema, SharableLayerSchema, SharableForbiddenImportSchema, SharableBoundaryConfigSchema, SharableSecurityRulesSchema, VALID_SCOPES, LINE_PATTERN, START_PATTERN, END_PATTERN, readFile72, writeFile32, unlink22, mkdir22, copyFile2, DEFAULT_FIX_CONFIG, EXPORT_TYPE_KEYWORD, ALWAYS_UNSAFE_TYPES, idCounter, DEAD_CODE_FIX_ACTIONS, MustExportRuleSchema, MustExportDefaultRuleSchema, NoExportRuleSchema, MustImportRuleSchema, NoImportRuleSchema, NamingRuleSchema, MaxExportsRuleSchema, MaxLinesRuleSchema, RequireJSDocRuleSchema, RuleSchema, ConfigPatternSchema, PatternConfigSchema, DriftConfigSchema, DeadCodeConfigSchema, EntropyConfigSchema, BaselineManager, BenchmarkRunner, RegressionDetector, SOURCE_EXTENSIONS, FUNCTION_DECL_RE, CONST_DECL_RE, CriticalPathResolver, NoOpTelemetryAdapter, NoOpExecutor, ConsoleSink, feedbackConfig, ChecklistBuilder, AgentActionEmitter, globalEmitter, FileSink, NoOpSink, ConfidenceTierSchema, RegressionResultSchema, DirectionSchema, CategoryForecastSchema, SpecImpactSignalsSchema, SpecImpactEstimateSchema, ContributingFeatureSchema, AdjustedForecastSchema, PredictionWarningSchema, StabilityForecastSchema, PredictionResultSchema, PredictionOptionsSchema, VALID_STATUSES, EM_DASH, VALID_PRIORITIES, ALL_CATEGORIES, DIRECTION_THRESHOLD, PredictionEngine, DEFAULT_COEFFICIENTS, SpecImpactEstimator, EMPTY_HISTORY, ViolationHistoryManager, NORMALIZERS, MAX_SAMPLES, DEFAULT_WINDOW_WEEKS, DEFAULT_MIN_OCCURRENCES, FailureEntrySchema, HandoffSchema, GateCheckSchema, GateResultSchema, GateConfigSchema, HarnessStateSchema, DEFAULT_STATE, StreamInfoSchema, StreamIndexSchema, DEFAULT_STREAM_INDEX, HARNESS_DIR, STATE_FILE, LEARNINGS_FILE, FAILURES_FILE, HANDOFF_FILE, GATE_CONFIG_FILE, INDEX_FILE, SESSIONS_DIR, SESSION_INDEX_FILE, SUMMARY_FILE, SESSION_STATE_FILE, ARCHIVE_DIR, CONTENT_HASHES_FILE, EVENTS_FILE, STREAMS_DIR, STREAM_NAME_REGEX, branchCache, BRANCH_CACHE_TTL_MS, STATE_FILES, MAX_CACHE_ENTRIES, learningsCacheMap, WEIGHTS, LOCK_RETRIES, LOCK_BACKOFFS, PROMOTABLE_OUTCOMES, failuresCacheMap, FAILURE_LINE_REGEX, SAFE_GATE_COMMAND, SkillEventSchema, knownHashesCache, EVENT_FORMATTERS, RuleRegistry, DEFAULT_SECURITY_CONFIG, RuleOverrideSchema, SecurityConfigSchema, secretRules, injectionRules, xssRules, cryptoRules, pathTraversalRules, networkRules, deserializationRules, agentConfigRules, mcpRules, insecureDefaultsRules, sharpEdgesRules, nodeRules, expressRules, reactRules, goRules, SecurityScanner, OSV_ENDPOINT, DEFAULT_CACHE_DIR, DEFAULT_TTL_HOURS, hiddenUnicodePatterns, reRolingPatterns, permissionEscalationPatterns, encodedPayloadPatterns, indirectInjectionPatterns, contextManipulationPatterns, socialEngineeringPatterns, suspiciousPatterns, ALL_PATTERNS, DESTRUCTIVE_BASH, TAINT_DURATION_MS, DEFAULT_SESSION_ID, SecurityCategorySnapshotSchema, SupplyChainSnapshotSchema, SecurityTimelineSnapshotSchema, FindingLifecycleSchema, SecurityTimelineFileSchema, DirectionSchema2, SecurityTrendLineSchema, TrendAttributionSchema, SecurityTrendResultSchema, TimeToFixStatsSchema, TimeToFixResultSchema, EMPTY_SUPPLY_CHAIN, SecurityTimelineManager, ALL_CHECKS, STATUS_ICONS, CINotifier, ExclusionSet, PREFIX_PATTERNS, TEST_FILE_PATTERN, MD_FILE_PATTERN, ALL_DOMAINS, SECURITY_PATTERNS, JS_EXT_FALLBACKS, SEVERITY_RANK, SEVERITY_ORDER, SEVERITY_LABELS, VALIDATED_BY_RANK, VALIDATION_SCORES, DOMAIN_BASELINES, FACTOR_WEIGHTS, EVIDENCE_SATURATION, CORROBORATED_AGREEMENT, STANDALONE_AGREEMENT, AGREEMENT_LINE_GAP, COMPLIANCE_DESCRIPTOR, EXPORT_RE, BUG_DETECTION_DESCRIPTOR, SECURITY_DESCRIPTOR, EVAL_PATTERN, SECRET_PATTERNS, SQL_CONCAT_PATTERN, SHELL_EXEC_PATTERN, ARCHITECTURE_DESCRIPTOR, LARGE_FILE_THRESHOLD, VIOLATION_FILE_RE, LEARNINGS_DESCRIPTOR, RELEVANCE_THRESHOLD, ADVERSARIAL_DESCRIPTOR, UNVERIFIED_INPUT_PATTERN, PROMISE_NO_REJECT_PATTERN, UNGUARDED_OPTIONAL_CALL, COMPOSE_NO_AWAIT, FETCH_NO_TIMEOUT, TYPESCRIPT_STRICT_DESCRIPTOR, EXPLICIT_ANY_PATTERN, TS_IGNORE_PATTERN, UNSAFE_AS_UNKNOWN, NON_NULL_ASSERTION, VAGUE_HELPER_NAME, FRONTEND_RACES_DESCRIPTOR, AGENT_DESCRIPTORS, CONDITIONAL_SUBAGENT_DESCRIPTORS, AGENT_RUNNERS, SUBAGENT_ORDER, RISK_KEYWORDS, EXCLUDED_PATH_PATTERNS, ASYNC_UI_SIGNALS, WORD_BOUNDARY, DOWNGRADE_MAP, DEFAULT_PROVIDER_TIERS, SMALL_SUGGESTION_LINE_LIMIT, FILE_LINE_RANGE_PATTERN, FILE_LINE_PATTERN, FILE_ONLY_PATTERN, SECURITY_SENSITIVE_PATH, MIGRATION_PATH, TEST_PATH, CONFIG_PATH, STAGE_DOMAINS, CI_REVIEW_VERDICT_SCHEMA_VERSION, CI_RUNNERS, CI_ASSESSMENTS, CI_REVIEW_DOMAINS, ReviewFindingSchema, CiReviewVerdictSchema, VERDICT_MAP, RUNNER_PRESETS, VERDICT_MAP2, DEFAULT_EXEC_TIMEOUT_MS, DEFAULT_EXEC_MAX_STDOUT_BYTES, STDERR_CAP_BYTES, STDERR_TAIL_BYTES, defaultExecFile, EMPTY_TIER, EM_DASH2, STATUS_RANK, EM_DASH3, DEFAULT_MILESTONE, MAX_CLOSEST_MATCHES, RETRY_DEFAULTS, GitHubIssuesSyncAdapter, syncMutex, PRIORITY_RANK, PRIORITY_RANK2, POSITION_WEIGHT, DEPENDENTS_WEIGHT, AFFINITY_WEIGHT, ConflictError, DEFAULTS, GitHubHttp, ETagStore, START_MARKER, END_MARKER, SERIALIZER_FIELDS, GitHubIssuesTrackerAdapter, migrate_exports, HASH_RE, DEFAULT_CATCH_ALL, DEFAULT_INTAKE, DEFAULT_MAX_ACTIVE, InteractionTypeSchema, QuestionSchema, ConfirmationSchema, TransitionSchema, EmitInteractionInputSchema, ProjectScanner, SHELL_TEMPLATE, STYLES, SCRIPTS, MockLLMService, llmService, ContentPipeline, BlueprintGenerator, TOKENS_PER_MILLION, fallback_default, LITELLM_PRICING_URL, CACHE_TTL_MS, STALENESS_WARNING_DAYS, MICRODOLLARS_PER_DOLLAR, TOKENS_PER_MILLION2, StructuralStrategy, DEFAULT_TOKEN_BUDGET, CHARS_PER_TOKEN, TRUNCATION_MARKER, TruncationStrategy, CompactionPipeline, STABILITY_LOOKUP, TIER_ORDER, AnthropicCacheAdapter, TIER_ORDER2, OpenAICacheAdapter, TIER_ORDER3, CACHED_CONTENT_MARKER, GeminiCacheAdapter, VERSION, POSTHOG_BATCH_URL, MAX_ATTEMPTS, TIMEOUT_MS, DEFAULT_CAPACITY, CacheMetricsRecorder, RETRY_BACKOFFS_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_BATCH_SIZE, defaultFetch, defaultWarn, OTLPExporter, SERVICE_NAME_ATTR, SpanKind, ModeSchema, SeveritySchema, TierSchema, StrengthFindingSchema, HarnessConfigSubsetSchema, HookFileSchema, ProjectContextSchema, AuditSummarySchema, AuditResultSchema, SEVERITY_WEIGHTS, clamp, HOOK_SCRIPT_TOKEN, NEVER_BLOCKS, ALWAYS_EXIT_ZERO, EXIT_ZERO_LINE, NONZERO_EXIT, GATE, ERREXIT, strength001NonblockingHooks, BASELINE_REWRITE, strength002Autobaseline, SKIP_RE, strength003SkipList, strength004EmptyThresholds, INIT_SKILL_PATH, DEFAULT_BASIC, strength005LowestTier, AUTO_PATTERN, COMMENT_LINE, NAME_VALUE_LINE, PAT_GATING, REVIEW_SIGNAL, strength006AutoapproveBaseline, CHECK_SIGNAL_MAP, strength007SnapshotSignalMismatch, ALL_RULES, HarnessStrengthAuditor, MAX_TOP_AFFECTED, CompoundLockHeldError, KNOWN_CATEGORIES, ProposalNotFoundError, ProposalConflictError, ALLOWED_FIELD_KEYS, PII_TOKENS, PII_FIELD_DENYLIST, PII_LINE_RE, ALLOWED_SET, PulseAdapterAlreadyRegisteredError, REGISTRY, MOCK_ADAPTER_NAME, ALLOWED_FIELD_SET, adapter, LOOKBACK_RE, MAX_LINES, INLINE_TEMPLATE, TRUNCATION_MARKER2, execFileAsync, FIX_RE, EMPTY_REPO_RE, execFileAsync2, TRACK_CATEGORIES2, STOPWORDS, KEYWORD_TO_CATEGORY, SECTION_ORDER, FILENAME;
+var WHATWG_BAD_PORTS, BAD_PORT_SET, VALID_TYPES, CONVENTIONAL_PATTERN, LOOKBACK_PATTERN, PulseDbSourceSchema, PulseSourcesSchema, PulseConfigSchema, KNOWN_SECTION_NAMES, ISO_DATE, PLACEHOLDER_INLINE, REQUIRED, ALLOWED, StrategyFrontmatterSchema, StrategySectionSchema, StrategyDocSchema, BUG_TRACK_CATEGORIES, KNOWLEDGE_TRACK_CATEGORIES, ALL_SOLUTION_CATEGORIES, ISO_DATE2, BugTrackSchema, KnowledgeTrackSchema, BaseFrontmatter, SolutionDocFrontmatterSchema, TRACK_CATEGORIES, DEFAULT_AGNIX_TIMEOUT_MS, HARNESS_AGNIX_DISABLE, HARNESS_AGNIX_BIN, CLAUDE_MD_WARN_BYTES, CLAUDE_MD_ERROR_BYTES, CONTEXT_FILES, MIN_DESCRIPTION_LENGTH, SETTINGS_PATHS, KNOWN_HOOK_EVENTS, MCP_SETTINGS_FILES, REQUIRED_SECTIONS, SETTINGS_FILES, KNOWN_AGNIX_TOOLS, KEBAB_CASE, TICKET_ID, DEFAULT_SECTIONS, DEFAULT_RATIOS, NODE_TYPE_TO_CATEGORY, SECTION_LEVEL_MAP, DEFAULT_LEVEL, DEFAULT_BUDGET, DEFAULT_LOADER_CONFIG, LEVEL_FRACTIONS, PHASE_PRIORITIES, ManifestSchema, BundleConstraintsSchema, BundleSchema, ContributionsSchema, LockfilePackageSchema, LockfileSchema, SharableLayerSchema, SharableForbiddenImportSchema, SharableBoundaryConfigSchema, SharableSecurityRulesSchema, VALID_SCOPES, LINE_PATTERN, START_PATTERN, END_PATTERN, readFile72, writeFile32, unlink22, mkdir22, copyFile2, DEFAULT_FIX_CONFIG, EXPORT_TYPE_KEYWORD, ALWAYS_UNSAFE_TYPES, idCounter, DEAD_CODE_FIX_ACTIONS, MustExportRuleSchema, MustExportDefaultRuleSchema, NoExportRuleSchema, MustImportRuleSchema, NoImportRuleSchema, NamingRuleSchema, MaxExportsRuleSchema, MaxLinesRuleSchema, RequireJSDocRuleSchema, RuleSchema, ConfigPatternSchema, PatternConfigSchema, DriftConfigSchema, DeadCodeConfigSchema, EntropyConfigSchema, BaselineManager, BenchmarkRunner, RegressionDetector, SOURCE_EXTENSIONS, FUNCTION_DECL_RE, CONST_DECL_RE, CriticalPathResolver, NoOpTelemetryAdapter, NoOpExecutor, ConsoleSink, feedbackConfig, ChecklistBuilder, AgentActionEmitter, globalEmitter, FileSink, NoOpSink, ConfidenceTierSchema, RegressionResultSchema, DirectionSchema, CategoryForecastSchema, SpecImpactSignalsSchema, SpecImpactEstimateSchema, ContributingFeatureSchema, AdjustedForecastSchema, PredictionWarningSchema, StabilityForecastSchema, PredictionResultSchema, PredictionOptionsSchema, VALID_STATUSES, EM_DASH, VALID_PRIORITIES, ALL_CATEGORIES, DIRECTION_THRESHOLD, PredictionEngine, DEFAULT_COEFFICIENTS, SpecImpactEstimator, EMPTY_HISTORY, ViolationHistoryManager, NORMALIZERS, MAX_SAMPLES, DEFAULT_WINDOW_WEEKS, DEFAULT_MIN_OCCURRENCES, FailureEntrySchema, HandoffSchema, GateCheckSchema, GateResultSchema, GateConfigSchema, HarnessStateSchema, DEFAULT_STATE, StreamInfoSchema, StreamIndexSchema, DEFAULT_STREAM_INDEX, HARNESS_DIR, STATE_FILE, LEARNINGS_FILE, FAILURES_FILE, HANDOFF_FILE, GATE_CONFIG_FILE, INDEX_FILE, SESSIONS_DIR, SESSION_INDEX_FILE, SUMMARY_FILE, SESSION_STATE_FILE, ARCHIVE_DIR, CONTENT_HASHES_FILE, EVENTS_FILE, STREAMS_DIR, STREAM_NAME_REGEX, branchCache, BRANCH_CACHE_TTL_MS, STATE_FILES, MAX_CACHE_ENTRIES, learningsCacheMap, WEIGHTS, LOCK_RETRIES, LOCK_BACKOFFS, PROMOTABLE_OUTCOMES, failuresCacheMap, FAILURE_LINE_REGEX, SAFE_GATE_COMMAND, SkillEventSchema, knownHashesCache, EVENT_FORMATTERS, RuleRegistry, DEFAULT_SECURITY_CONFIG, RuleOverrideSchema, SecurityConfigSchema, secretRules, injectionRules, xssRules, cryptoRules, pathTraversalRules, networkRules, deserializationRules, agentConfigRules, mcpRules, insecureDefaultsRules, sharpEdgesRules, nodeRules, expressRules, reactRules, goRules, SecurityScanner, OSV_ENDPOINT, DEFAULT_CACHE_DIR, DEFAULT_TTL_HOURS, hiddenUnicodePatterns, reRolingPatterns, permissionEscalationPatterns, encodedPayloadPatterns, indirectInjectionPatterns, contextManipulationPatterns, socialEngineeringPatterns, suspiciousPatterns, ALL_PATTERNS, DESTRUCTIVE_BASH, TAINT_DURATION_MS, DEFAULT_SESSION_ID, SecurityCategorySnapshotSchema, SupplyChainSnapshotSchema, SecurityTimelineSnapshotSchema, FindingLifecycleSchema, SecurityTimelineFileSchema, DirectionSchema2, SecurityTrendLineSchema, TrendAttributionSchema, SecurityTrendResultSchema, TimeToFixStatsSchema, TimeToFixResultSchema, EMPTY_SUPPLY_CHAIN, SecurityTimelineManager, ALL_CHECKS, STATUS_ICONS, CINotifier, ExclusionSet, PREFIX_PATTERNS, TEST_FILE_PATTERN, MD_FILE_PATTERN, ALL_DOMAINS, SECURITY_PATTERNS, JS_EXT_FALLBACKS, SEVERITY_RANK, SEVERITY_ORDER, SEVERITY_LABELS, VALIDATED_BY_RANK, VALIDATION_SCORES, DOMAIN_BASELINES, FACTOR_WEIGHTS, EVIDENCE_SATURATION, CORROBORATED_AGREEMENT, STANDALONE_AGREEMENT, AGREEMENT_LINE_GAP, COMPLIANCE_DESCRIPTOR, EXPORT_RE, BUG_DETECTION_DESCRIPTOR, SECURITY_DESCRIPTOR, EVAL_PATTERN, SECRET_PATTERNS, SQL_CONCAT_PATTERN, SHELL_EXEC_PATTERN, ARCHITECTURE_DESCRIPTOR, LARGE_FILE_THRESHOLD, VIOLATION_FILE_RE, LEARNINGS_DESCRIPTOR, RELEVANCE_THRESHOLD, ADVERSARIAL_DESCRIPTOR, UNVERIFIED_INPUT_PATTERN, PROMISE_NO_REJECT_PATTERN, UNGUARDED_OPTIONAL_CALL, COMPOSE_NO_AWAIT, FETCH_NO_TIMEOUT, TYPESCRIPT_STRICT_DESCRIPTOR, EXPLICIT_ANY_PATTERN, TS_IGNORE_PATTERN, UNSAFE_AS_UNKNOWN, NON_NULL_ASSERTION, VAGUE_HELPER_NAME, FRONTEND_RACES_DESCRIPTOR, AGENT_DESCRIPTORS, CONDITIONAL_SUBAGENT_DESCRIPTORS, AGENT_RUNNERS, SUBAGENT_ORDER, RISK_KEYWORDS, EXCLUDED_PATH_PATTERNS, ASYNC_UI_SIGNALS, WORD_BOUNDARY, DOWNGRADE_MAP, DEFAULT_PROVIDER_TIERS, SMALL_SUGGESTION_LINE_LIMIT, FILE_LINE_RANGE_PATTERN, FILE_LINE_PATTERN, FILE_ONLY_PATTERN, SECURITY_SENSITIVE_PATH, MIGRATION_PATH, TEST_PATH, CONFIG_PATH, STAGE_DOMAINS, CI_REVIEW_VERDICT_SCHEMA_VERSION, CI_RUNNERS, CI_ASSESSMENTS, CI_REVIEW_DOMAINS, ReviewFindingSchema, CiReviewVerdictSchema, VERDICT_MAP, RUNNER_PRESETS, VERDICT_MAP2, DEFAULT_EXEC_TIMEOUT_MS, DEFAULT_EXEC_MAX_STDOUT_BYTES, STDERR_CAP_BYTES, STDERR_TAIL_BYTES, defaultExecFile, EMPTY_TIER, EM_DASH2, STATUS_RANK, EM_DASH3, DEFAULT_MILESTONE, MAX_CLOSEST_MATCHES, MACHINE_ASSIGNEE_PATTERNS, RETRY_DEFAULTS, GitHubIssuesSyncAdapter, syncMutex, PRIORITY_RANK, PRIORITY_RANK2, POSITION_WEIGHT, DEPENDENTS_WEIGHT, AFFINITY_WEIGHT, ConflictError, DEFAULTS, GitHubHttp, ETagStore, START_MARKER, END_MARKER, SERIALIZER_FIELDS, GitHubIssuesTrackerAdapter, migrate_exports, HASH_RE, DEFAULT_CATCH_ALL, DEFAULT_INTAKE, DEFAULT_MAX_ACTIVE, InteractionTypeSchema, QuestionSchema, ConfirmationSchema, TransitionSchema, EmitInteractionInputSchema, ProjectScanner, SHELL_TEMPLATE, STYLES, SCRIPTS, MockLLMService, llmService, ContentPipeline, BlueprintGenerator, TOKENS_PER_MILLION, fallback_default, LITELLM_PRICING_URL, CACHE_TTL_MS, STALENESS_WARNING_DAYS, MICRODOLLARS_PER_DOLLAR, TOKENS_PER_MILLION2, StructuralStrategy, DEFAULT_TOKEN_BUDGET, CHARS_PER_TOKEN, TRUNCATION_MARKER, TruncationStrategy, CompactionPipeline, STABILITY_LOOKUP, TIER_ORDER, AnthropicCacheAdapter, TIER_ORDER2, OpenAICacheAdapter, TIER_ORDER3, CACHED_CONTENT_MARKER, GeminiCacheAdapter, VERSION, POSTHOG_BATCH_URL, MAX_ATTEMPTS, TIMEOUT_MS, DEFAULT_CAPACITY, CacheMetricsRecorder, RETRY_BACKOFFS_MS, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_BATCH_SIZE, defaultFetch, defaultWarn, OTLPExporter, SERVICE_NAME_ATTR, SpanKind, ModeSchema, SeveritySchema, TierSchema, StrengthFindingSchema, HarnessConfigSubsetSchema, HookFileSchema, ProjectContextSchema, AuditSummarySchema, AuditResultSchema, SEVERITY_WEIGHTS, clamp, HOOK_SCRIPT_TOKEN, NEVER_BLOCKS, ALWAYS_EXIT_ZERO, EXIT_ZERO_LINE, NONZERO_EXIT, GATE, ERREXIT, strength001NonblockingHooks, BASELINE_REWRITE, strength002Autobaseline, SKIP_RE, strength003SkipList, strength004EmptyThresholds, INIT_SKILL_PATH, DEFAULT_BASIC, strength005LowestTier, AUTO_PATTERN, COMMENT_LINE, NAME_VALUE_LINE, PAT_GATING, REVIEW_SIGNAL, strength006AutoapproveBaseline, CHECK_SIGNAL_MAP, strength007SnapshotSignalMismatch, ALL_RULES, HarnessStrengthAuditor, MAX_TOP_AFFECTED, CompoundLockHeldError, KNOWN_CATEGORIES, ProposalNotFoundError, ProposalConflictError, ALLOWED_FIELD_KEYS, PII_TOKENS, PII_FIELD_DENYLIST, PII_LINE_RE, ALLOWED_SET, PulseAdapterAlreadyRegisteredError, REGISTRY, MOCK_ADAPTER_NAME, ALLOWED_FIELD_SET, adapter, LOOKBACK_RE, MAX_LINES, INLINE_TEMPLATE, TRUNCATION_MARKER2, execFileAsync, FIX_RE, EMPTY_REPO_RE, execFileAsync2, TRACK_CATEGORIES2, STOPWORDS, KEYWORD_TO_CATEGORY, SECTION_ORDER, FILENAME;
 var init_dist3 = __esm({
   "../core/dist/index.mjs"() {
     init_chunk_FYTJQ2ZY();
@@ -19248,6 +19344,10 @@ var init_dist3 = __esm({
     EM_DASH3 = "\u2014";
     DEFAULT_MILESTONE = "Intake";
     MAX_CLOSEST_MATCHES = 3;
+    MACHINE_ASSIGNEE_PATTERNS = [
+      /^orchestrator-[0-9a-f]{8}$/,
+      /^[\w-]+-[0-9a-f]{8}$/
+    ];
     RETRY_DEFAULTS = { maxRetries: 5, baseDelayMs: 1e3 };
     GitHubIssuesSyncAdapter = class {
       token;
@@ -19259,8 +19359,6 @@ var init_dist3 = __esm({
       retryOpts;
       /** Cached GitHub milestone name -> ID mapping */
       milestoneCache = null;
-      /** Cached authenticated user login (e.g., "@octocat") */
-      authenticatedUserCache = null;
       constructor(options) {
         this.token = options.token;
         this.config = options.config;
@@ -19311,41 +19409,20 @@ var init_dist3 = __esm({
         cache.set(name, data.number);
         return data.number;
       }
-      async getAuthenticatedUser() {
-        if (this.authenticatedUserCache) return Ok(this.authenticatedUserCache);
-        try {
-          const response = await fetchWithRetry(
-            this.fetchFn,
-            `${this.apiBase}/user`,
-            { method: "GET", headers: this.headers() },
-            this.retryOpts
-          );
-          if (!response.ok) {
-            const text = await response.text();
-            return Err(new Error(`GitHub API error ${response.status}: ${text}`));
-          }
-          const data = await response.json();
-          this.authenticatedUserCache = `@${data.login}`;
-          return Ok(this.authenticatedUserCache);
-        } catch (error) {
-          return Err(error instanceof Error ? error : new Error(String(error)));
-        }
-      }
       /**
-       * Resolve an assignee value to a GitHub login.
+       * Resolve a *human* assignee value to a GitHub login.
        * - "@username" → "username"
        * - "username" (no @) → "username"
-       * - Orchestrator IDs (hostname-hash like "chads-macbook-pro-8565381d") →
-       *   resolved via authenticated user, since they're not valid GitHub logins.
-       * Returns null if the assignee cannot be resolved.
+       *
+       * Machine (orchestrator) ids are NOT GitHub logins and must never reach the
+       * issue `assignee` field — callers gate on `pushAssigneeToExternal` before
+       * calling this, so a machine id should not arrive here. As defense in depth
+       * this returns `null` for one (rather than laundering it to the authenticated
+       * user, the original bug that made machine claims look human-owned).
        */
-      async resolveAssigneeLogin(assignee) {
+      resolveAssigneeLogin(assignee) {
+        if (!pushAssigneeToExternal(assignee)) return null;
         if (assignee.startsWith("@")) return assignee.slice(1);
-        if (/^orchestrator-[0-9a-f]{8}$/.test(assignee) || /^[\w-]+-[0-9a-f]{8}$/.test(assignee)) {
-          const userResult = await this.getAuthenticatedUser();
-          if (userResult.ok) return userResult.value.replace(/^@/, "");
-          return null;
-        }
         return assignee;
       }
       headers() {
@@ -19382,8 +19459,8 @@ var init_dist3 = __esm({
             type: "Feature"
           };
           if (milestoneId) issuePayload.milestone = milestoneId;
-          if (feature.assignee) {
-            const login = await this.resolveAssigneeLogin(feature.assignee);
+          if (feature.assignee && pushAssigneeToExternal(feature.assignee)) {
+            const login = this.resolveAssigneeLogin(feature.assignee);
             if (login) {
               issuePayload.assignees = [login];
             }
@@ -19423,9 +19500,11 @@ var init_dist3 = __esm({
           }
           if (changes.assignee !== void 0) {
             if (changes.assignee) {
-              const login = await this.resolveAssigneeLogin(changes.assignee);
-              if (login) {
-                patch.assignees = [login];
+              if (pushAssigneeToExternal(changes.assignee)) {
+                const login = this.resolveAssigneeLogin(changes.assignee);
+                if (login) {
+                  patch.assignees = [login];
+                }
               }
             } else {
               patch.assignees = [];
@@ -21618,6 +21697,13 @@ export {
   decidePromotionForRow,
   promoteFeature,
   resolveReverseStatus,
+  isMachineAssignee,
+  assigneeInvariantHolds,
+  pushAssigneeToExternal,
+  isClaimableBy,
+  claim,
+  release,
+  setStatus,
   GitHubIssuesSyncAdapter,
   loadTrackerSyncConfig,
   syncToExternal,

package/dist/{chunk-UX3PQKVZ.js → chunk-BXKNWSG4.js}

@@ -1,6 +1,6 @@
 import {
   init_dist
-} from "./chunk-N24HCQA4.js";
+} from "./chunk-A65QO5KN.js";
 import {
   Err,
   Ok

package/dist/{chunk-XX4OLNWQ.js → chunk-C2ZGWMTN.js}

@@ -4,7 +4,7 @@ import {
 import {
   init_dist,
   paginate
-} from "./chunk-N24HCQA4.js";
+} from "./chunk-A65QO5KN.js";
 
 // src/mcp/tools/review-pipeline.ts
 init_dist();
@@ -84,7 +84,7 @@ var runCodeReviewDefinition = {
 };
 async function handleRunCodeReview(input) {
   try {
-    const { parseDiff, runReviewPipeline } = await import("./dist-LHINSVK4.js");
+    const { parseDiff, runReviewPipeline } = await import("./dist-3HW4LCHE.js");
     const parseResult = parseDiff(input.diff);
     if (!parseResult.ok) {
       return {

package/dist/{chunk-HEIMJJI4.js → chunk-DNX35Q5K.js}

@@ -27,7 +27,7 @@ var runSecurityScanDefinition = {
 };
 async function handleRunSecurityScan(input) {
   try {
-    const core = await import("./dist-LHINSVK4.js");
+    const core = await import("./dist-3HW4LCHE.js");
     const projectRoot = sanitizePath(input.path);
     let configData = {};
     try {
@@ -114,7 +114,7 @@ var getSecurityTrendsDefinition = {
 };
 async function handleGetSecurityTrends(input) {
   try {
-    const core = await import("./dist-LHINSVK4.js");
+    const core = await import("./dist-3HW4LCHE.js");
     const projectRoot = sanitizePath(input.path);
     const manager = new core.SecurityTimelineManager(projectRoot);
     const trendOptions = {};

package/dist/{chunk-BYVT5LVO.js → chunk-ERZCC5VH.js}

@@ -33,7 +33,7 @@ var createSelfReviewDefinition = {
 };
 async function handleCreateSelfReview(input) {
   try {
-    const { parseDiff, createSelfReview } = await import("./dist-LHINSVK4.js");
+    const { parseDiff, createSelfReview } = await import("./dist-3HW4LCHE.js");
     const parseResult = parseDiff(input.diff);
     if (!parseResult.ok) {
       return resultToMcpResponse(parseResult);
@@ -119,7 +119,7 @@ var analyzeDiffDefinition = {
 };
 async function handleAnalyzeDiff(input) {
   try {
-    const { parseDiff, analyzeDiff } = await import("./dist-LHINSVK4.js");
+    const { parseDiff, analyzeDiff } = await import("./dist-3HW4LCHE.js");
     const parseResult = parseDiff(input.diff);
     if (!parseResult.ok) {
       return resultToMcpResponse(parseResult);
@@ -195,7 +195,7 @@ var requestPeerReviewDefinition = {
 };
 async function handleRequestPeerReview(input) {
   try {
-    const { parseDiff, requestPeerReview } = await import("./dist-LHINSVK4.js");
+    const { parseDiff, requestPeerReview } = await import("./dist-3HW4LCHE.js");
     const parseResult = parseDiff(input.diff);
     if (!parseResult.ok) {
       return resultToMcpResponse(parseResult);