@hearsay-tools/squawk 0.0.0-stage → 0.17.0-dev.5685

package/dist/server/provider-action-gate.js

@@ -0,0 +1,28 @@
+import { controlLocation } from '../contract/index.js';
+export { providersRequiredByWorkflow } from '../contract/index.js';
+const LABEL = {
+    claude: 'Claude Code',
+    codex: 'Codex',
+    opencode: 'OpenCode',
+    pi: 'pi',
+    cursor: 'Cursor',
+    omp: 'OMP',
+};
+export function providerForExistingRun(run, override) {
+    if (override)
+        return override;
+    return run.runner ?? 'claude';
+}
+export function unavailableProviderMessage(required, response) {
+    for (const provider of required) {
+        const row = response.providers.find(({ provider: id }) => id === provider);
+        if (row?.enabled === false) {
+            return `${LABEL[provider]} is disabled. Enable it in ${controlLocation('providers')}.`;
+        }
+        if (row?.status !== 'connected') {
+            return `${LABEL[provider]} credentials are unavailable. Authorize it in ${controlLocation('providers')}.`;
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=provider-action-gate.js.map

package/dist/server/provider-action-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-action-gate.js","sourceRoot":"","sources":["../../src/server/provider-action-gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gDAAgD,CAAC;AAMjF,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AAErF,MAAM,KAAK,GAA+B;IACxC,MAAM,EAAE,aAAa;IACrB,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,EAAE,EAAE,IAAI;IACR,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,MAAM,UAAU,sBAAsB,CACpC,GAAc,EACd,QAAqB;IAErB,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,QAA+B,EAC/B,QAAgC;IAEhC,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;QAC3E,IAAI,GAAG,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YAC3B,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,8BAA8B,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC;QACzF,CAAC;QACD,IAAI,GAAG,EAAE,MAAM,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,iDAAiD,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC;QAC5G,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/server/provider-auth-runtime.d.ts

@@ -0,0 +1,34 @@
+import type { Home } from '../home/home.ts';
+import { type ProviderAuthService, type ProviderId, type ProviderStatus } from '../core/provider-auth.ts';
+import type { RunStore } from '../runs/store.ts';
+import { type RuntimeAuthVerificationTarget } from '../workspace/agent-profiles.ts';
+/** Where the self-check's probe is aimed. Injectable so tests can pin the account resolution;
+ *  the default reads `~/.cezar/agent-accounts.json` (see {@link resolveRuntimeAuthVerificationTarget}).
+ *  Resolving to `null` means "this incident cannot be checked" — the latch then stands. */
+export type RuntimeAuthProfileResolver = (provider: ProviderId, profileId: string | undefined, home: Home) => Promise<RuntimeAuthVerificationTarget | null>;
+/**
+ * Watch runtime authentication errors, latch the provider and verify the failing account through
+ * its native CLI. Bind checks to the observed generation; unresolved accounts and inconclusive
+ * results keep the incident.
+ */
+export declare function watchProviderRuntimeAuthFailures(store: RunStore, providerAuth: ProviderAuthService, onProviderStatus: (status: ProviderStatus) => void, resolveProfile: RuntimeAuthProfileResolver | undefined, home: Home): () => void;
+/**
+ * Process-wide dedupe for store observation. The same boot store is wired
+ * before recovery and again when the HTTP app is constructed; lazy stores are
+ * wired both at creation and at the existing context-built hook. One listener
+ * per RunStore keeps those lifecycle overlaps harmless.
+ */
+export declare class ProviderRuntimeAuthObserver {
+    private readonly providerAuth;
+    private readonly onProviderStatus;
+    private readonly resolveProfile;
+    private readonly home;
+    private readonly watched;
+    constructor(providerAuth: ProviderAuthService, onProviderStatus: (status: ProviderStatus) => void, resolveProfile: RuntimeAuthProfileResolver | undefined, home: Home);
+    watch(store: RunStore): void;
+}
+/**
+ * Boot ordering seam: observation must exist before recovery starts because a
+ * resumed runner can emit its first normalized error before recover() returns.
+ */
+export declare function recoverWithProviderRuntimeAuthObservation(store: RunStore, recover: () => Promise<void>, observer: ProviderRuntimeAuthObserver): Promise<void>;

package/dist/server/provider-auth-runtime.js

@@ -0,0 +1,118 @@
+import { isRuntimeProviderAuthFailure, } from '../core/provider-auth.js';
+import { resolveRuntimeAuthVerificationTarget, } from '../workspace/agent-profiles.js';
+const AUTH_ERROR_EVENT_TYPES = new Set(['error', 'session.error', 'note']);
+/**
+ * Watch runtime authentication errors, latch the provider and verify the failing account through
+ * its native CLI. Bind checks to the observed generation; unresolved accounts and inconclusive
+ * results keep the incident.
+ */
+export function watchProviderRuntimeAuthFailures(store, providerAuth, onProviderStatus, resolveProfile = resolveRuntimeAuthVerificationTarget, home) {
+    const onEvent = ({ runId, event }) => {
+        if (!AUTH_ERROR_EVENT_TYPES.has(event.type))
+            return;
+        const message = event.message;
+        if (typeof message !== 'string' || !isRuntimeProviderAuthFailure(message))
+            return;
+        const run = store.getRun(runId);
+        if (!run)
+            return;
+        const step = typeof event.stepId === 'string'
+            ? run.steps.find(({ id }) => id === event.stepId)
+            : undefined;
+        const provider = step?.backend ?? run.runner ?? 'claude';
+        // The run-level profile belongs to the run's RUNNER: a mixed-backend step failing on another
+        // backend ran under THAT backend's own default login, and asking the resolver for the runner's
+        // profile under the wrong provider can only mis-answer the check or stall it unresolved.
+        const profileId = step?.profileId
+            ?? (provider === (run.runner ?? 'claude') ? run.agentProfile : undefined);
+        const report = providerAuth.reportRuntimeAuthFailure(provider);
+        if (!report)
+            return;
+        if (report.transitioned)
+            onProviderStatus(report.status);
+        const duplicate = store.readEvents(runId).some((candidate) => candidate.type === 'provider-auth-required'
+            && candidate.provider === provider
+            && candidate.authFailureId === report.status.authFailureId);
+        if (!duplicate) {
+            store.appendEvent(runId, {
+                type: 'provider-auth-required',
+                provider,
+                authFailureId: report.status.authFailureId,
+                ...(event.stepId ? { stepId: event.stepId } : {}),
+            });
+        }
+        // The self-check rides the LATCH EDGE, not every matching line: the second and third auth-shaped
+        // error of one failing run describe the incident already standing, and re-asking the CLI about it
+        // would only spend spawns on an answer we have. The service's own cooldown backstops the case the
+        // edge cannot see — a rejection that re-latches right after a successful recovery.
+        if (!report.transitioned)
+            return;
+        // The check carries the incident's generation THROUGH the account-resolution wait: while the
+        // resolver is pending a newer failure can replace the incident, and an older question must
+        // then stand down rather than answer for it.
+        const observed = { generation: report.generation };
+        void (async () => {
+            const target = await resolveProfile(provider, profileId, home);
+            // An account we cannot name cannot be verified: leave the latch exactly as it stands and let
+            // Settings' Try again — which asks no such question — stay the way out.
+            if (!target)
+                return;
+            const recovered = target.kind === 'profile'
+                ? await providerAuth.verifyRuntimeAuthFailure(provider, {
+                    id: target.id,
+                    configDir: target.configDir,
+                }, observed)
+                : await providerAuth.verifyRuntimeAuthFailure(provider, undefined, observed);
+            if (!recovered)
+                return;
+            if (target.kind !== 'profile') {
+                onProviderStatus(recovered);
+                return;
+            }
+            // A NAMED recovery answers for one account, not for the provider's default login, and this
+            // channel carries default rows — the cockpit's parser drops `profileId`, so publishing the
+            // account row would mark a disconnected default connected. Publish the provider's CURRENT
+            // default row (cache only, no spawn) so observers see the latch lift with the default's own
+            // answer; with nothing cached there is no default row to reconcile on this channel.
+            const defaultRow = providerAuth.peekStatus()?.providers.find(({ provider: id }) => id === provider);
+            if (defaultRow)
+                onProviderStatus(defaultRow);
+        })().catch(() => { });
+    };
+    store.on('event', onEvent);
+    return () => store.off('event', onEvent);
+}
+/**
+ * Process-wide dedupe for store observation. The same boot store is wired
+ * before recovery and again when the HTTP app is constructed; lazy stores are
+ * wired both at creation and at the existing context-built hook. One listener
+ * per RunStore keeps those lifecycle overlaps harmless.
+ */
+export class ProviderRuntimeAuthObserver {
+    providerAuth;
+    onProviderStatus;
+    resolveProfile;
+    home;
+    watched = new WeakSet();
+    constructor(providerAuth, onProviderStatus, resolveProfile = resolveRuntimeAuthVerificationTarget, home) {
+        this.providerAuth = providerAuth;
+        this.onProviderStatus = onProviderStatus;
+        this.resolveProfile = resolveProfile;
+        this.home = home;
+    }
+    watch(store) {
+        if (this.watched.has(store))
+            return;
+        this.watched.add(store);
+        watchProviderRuntimeAuthFailures(store, this.providerAuth, this.onProviderStatus, this.resolveProfile, this.home);
+    }
+}
+/**
+ * Boot ordering seam: observation must exist before recovery starts because a
+ * resumed runner can emit its first normalized error before recover() returns.
+ */
+export async function recoverWithProviderRuntimeAuthObservation(store, recover, observer) {
+    observer.watch(store);
+    await recover();
+}
+//# sourceMappingURL=provider-auth-runtime.js.map

package/dist/server/provider-auth-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-auth-runtime.js","sourceRoot":"","sources":["../../src/server/provider-auth-runtime.ts"],"names":[],"mappings":"AACA,OAAO,EACL,4BAA4B,GAI7B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,oCAAoC,GAErC,MAAM,gCAAgC,CAAC;AAExC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;AAW3E;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAC9C,KAAe,EACf,YAAiC,EACjC,gBAAkD,EAClD,cAAc,GAA+B,oCAAoC,EACjF,IAAU;IAEV,MAAM,OAAO,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,EAAsC,EAAQ,EAAE;QAC7E,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO;QACpD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC;YAAE,OAAO;QAElF,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;YAC3C,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,MAAM,CAAC;YACjD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,QAAQ,GAAe,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC;QACrE,6FAA6F;QAC7F,+FAA+F;QAC/F,yFAAyF;QACzF,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS;eAC5B,CAAC,QAAQ,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,YAAY,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,MAAM,CAAC,YAAY;YAAE,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEzD,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3D,SAAS,CAAC,IAAI,KAAK,wBAAwB;eACxC,SAAS,CAAC,QAAQ,KAAK,QAAQ;eAC/B,SAAS,CAAC,aAAa,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE;gBACvB,IAAI,EAAE,wBAAwB;gBAC9B,QAAQ;gBACR,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa;gBAC1C,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;QAED,iGAAiG;QACjG,kGAAkG;QAClG,kGAAkG;QAClG,mFAAmF;QACnF,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,OAAO;QACjC,6FAA6F;QAC7F,2FAA2F;QAC3F,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;QACnD,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAC/D,6FAA6F;YAC7F,wEAAwE;YACxE,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS;gBACzC,CAAC,CAAC,MAAM,YAAY,CAAC,wBAAwB,CAAC,QAAQ,EAAE;oBACtD,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,EAAE,QAAQ,CAAC;gBACZ,CAAC,CAAC,MAAM,YAAY,CAAC,wBAAwB,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC/E,IAAI,CAAC,SAAS;gBAAE,OAAO;YACvB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,2FAA2F;YAC3F,2FAA2F;YAC3F,0FAA0F;YAC1F,4FAA4F;YAC5F,oFAAoF;YACpF,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;YACpG,IAAI,UAAU;gBAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC/C,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvB,CAAC,CAAC;IAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3B,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA2B;IAInB,YAAY;IACZ,gBAAgB;IAChB,cAAc;IACd,IAAI;IANN,OAAO,GAAG,IAAI,OAAO,EAAY,CAAC;IAEnD,YACmB,YAAiC,EACjC,gBAAkD,EAClD,cAAc,GAA+B,oCAAoC,EACjF,IAAU;4BAHV,YAAY;gCACZ,gBAAgB;8BAChB,cAAc;oBACd,IAAI;IACpB,CAAC;IAEJ,KAAK,CAAC,KAAe;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO;QACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,gCAAgC,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACpH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,KAAe,EACf,OAA4B,EAC5B,QAAqC;IAErC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtB,MAAM,OAAO,EAAE,CAAC;AAClB,CAAC"}

package/dist/server/repo-branch-forge.d.ts

@@ -0,0 +1,61 @@
+import type { BranchPrState } from '../contract/index.js';
+import { type GraphqlRunner } from './forge/github.ts';
+import { type ForgeFactory } from './forge/index.ts';
+export interface ForgePr {
+    number: number;
+    url: string;
+    headRefName: string;
+    /** The branch the PR targets, and its head commit — at merge time, for a merged PR. Together
+     *  they are what proves a merged PR landed THIS tip on THIS base. */
+    baseRefName: string;
+    headRefOid: string;
+    /** The commit the merge put on the base (a squash commit, or the merge commit), null until merged. */
+    mergeCommitOid: string | null;
+    state: BranchPrState;
+}
+/** The PRs of some heads. `incomplete` names each head whose PRs GitHub did not return in full:
+ *  its batch failed, or it has more PRs than one page holds. `available` is false once any batch
+ *  failed: GitHub did not answer, which a classification must report as unknown PR state. */
+export interface HeadPrs {
+    available: boolean;
+    prs: ForgePr[];
+    incomplete: ReadonlySet<string>;
+}
+/**
+ * What the classifier asks GitHub. Both calls degrade to `available: false` instead of throwing;
+ * the classifier then falls back to ancestry and reports `prStateKnown: false`.
+ */
+export interface BranchForge {
+    /** States of the PRs runs CREATED (`pullRequestUrl`), by number — the ref-status cache. */
+    prStates(repoRoot: string, numbers: number[]): Promise<{
+        available: boolean;
+        states: Record<number, BranchPrState>;
+    }>;
+    /** Every PR whose head is one of `heads`, with the base and head a `merged` verdict is checked
+     *  against. */
+    prsForHeads(repoRoot: string, heads: readonly string[]): Promise<HeadPrs>;
+}
+/** Heads per GraphQL query, and PRs per head: GitHub caps a connection page at 100. */
+export declare const HEADS_PER_QUERY = 50;
+/** One query for up to `HEADS_PER_QUERY` heads. A head comes back complete with its PRs, or is
+ *  named incomplete; a failed or unreadable reply makes every head of the batch incomplete and
+ *  the batch `failed`. */
+export declare function fetchHeadBatch(run: GraphqlRunner, owner: string, name: string, heads: readonly string[]): Promise<{
+    complete: Map<string, ForgePr[]>;
+    incomplete: string[];
+    failed: boolean;
+}>;
+export interface GithubBranchForgeDeps {
+    forgeFactory?: ForgeFactory | undefined;
+    graphql?: (repoRoot: string) => GraphqlRunner;
+    handle?: (repoRoot: string) => Promise<{
+        owner: string;
+        name: string;
+    } | null>;
+}
+/** The default forge: the ref-status cache for created PRs, and per-head GraphQL lookups with a
+ *  one-minute cache per head. `CEZ_DRY_RUN=1` never shells out. */
+export declare function createGithubBranchForge(deps?: GithubBranchForgeDeps): BranchForge;
+export declare const githubBranchForge: BranchForge;
+/** Test-only: forget cached per-head answers. */
+export declare function __clearPrListCacheForTests(): void;

package/dist/server/repo-branch-forge.js

@@ -0,0 +1,158 @@
+import { productEnv } from '../core/product-env.js';
+/**
+ * What branch classification asks GitHub: the states of the PRs runs created, and every PR whose
+ * head is one of the branches still in question. The second is asked per head, never as one
+ * newest-first list, so a branch merged long ago keeps its evidence however many PRs came after it
+ * (hearsay-tools/cezarion#2268). A head GitHub did not answer in full is reported, never read as
+ * "no PR".
+ */
+import { z } from 'zod';
+import { ghGraphqlArgs, resolveRepoHandle } from './forge/github.js';
+import { resolveForgeRoot, GH_REF_STATUS_MAX } from './forge/index.js';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const exec = promisify(execFile);
+function prStateOf(status) {
+    if (status === 'merged')
+        return 'merged';
+    if (status === 'closed')
+        return 'closed';
+    if (status === 'draft')
+        return 'draft';
+    return 'open';
+}
+const prNodeSchema = z.object({
+    number: z.number(),
+    url: z.string(),
+    headRefName: z.string(),
+    baseRefName: z.string(),
+    headRefOid: z.string(),
+    mergeCommit: z.object({ oid: z.string() }).nullable().optional(),
+    state: z.string(),
+    isDraft: z.boolean().optional(),
+});
+const headConnectionSchema = z.object({
+    pageInfo: z.object({ hasNextPage: z.boolean() }),
+    nodes: z.array(prNodeSchema),
+});
+const headReplySchema = z.object({
+    data: z.object({ repository: z.record(z.string(), headConnectionSchema.nullable()).nullable() }),
+});
+/** Heads per GraphQL query, and PRs per head: GitHub caps a connection page at 100. */
+export const HEADS_PER_QUERY = 50;
+const PRS_PER_HEAD = 100;
+const HEAD_TTL_MS = 60_000;
+const HEAD_CACHE_MAX = 20_000;
+function headQuery(count) {
+    const vars = Array.from({ length: count }, (_, i) => `$h${i}: String!`).join(', ');
+    const fields = Array.from({ length: count }, (_, i) => `h${i}: pullRequests(headRefName: $h${i}, first: ${PRS_PER_HEAD}, states: [OPEN, CLOSED, MERGED]) { pageInfo { hasNextPage } nodes { number url headRefName baseRefName headRefOid mergeCommit { oid } state isDraft } }`).join('\n    ');
+    return `query ($owner: String!, $name: String!, ${vars}) {\n  repository(owner: $owner, name: $name) {\n    ${fields}\n  }\n}`;
+}
+function toForgePr(row) {
+    return {
+        number: row.number,
+        url: row.url,
+        headRefName: row.headRefName,
+        baseRefName: row.baseRefName,
+        headRefOid: row.headRefOid,
+        mergeCommitOid: row.mergeCommit?.oid ?? null,
+        state: row.state === 'MERGED' ? 'merged' : row.state === 'CLOSED' ? 'closed' : row.isDraft ? 'draft' : 'open',
+    };
+}
+/** One query for up to `HEADS_PER_QUERY` heads. A head comes back complete with its PRs, or is
+ *  named incomplete; a failed or unreadable reply makes every head of the batch incomplete and
+ *  the batch `failed`. */
+export async function fetchHeadBatch(run, owner, name, heads) {
+    const variables = { owner, name };
+    heads.forEach((head, i) => { variables[`h${i}`] = head; });
+    const complete = new Map();
+    let repository = null;
+    try {
+        repository = headReplySchema.parse(JSON.parse(await run(headQuery(heads.length), variables))).data.repository;
+    }
+    catch {
+        // An unreadable reply answers nothing, like no reply.
+    }
+    // `repository: null` says the handle did not resolve: GitHub answered none of these heads.
+    if (!repository)
+        return { complete, incomplete: [...heads], failed: true };
+    const found = repository;
+    const incomplete = [];
+    heads.forEach((head, i) => {
+        const connection = found[`h${i}`];
+        if (!connection || connection.pageInfo.hasNextPage)
+            incomplete.push(head);
+        else
+            complete.set(head, connection.nodes.map(toForgePr).filter((pr) => pr.headRefName === head));
+    });
+    return { complete, incomplete, failed: false };
+}
+function defaultGraphql(repoRoot) {
+    return async (query, variables) => {
+        const { stdout } = await exec('gh', ghGraphqlArgs(query, variables), { cwd: repoRoot, timeout: 30_000, maxBuffer: 16 * 1024 * 1024 });
+        return stdout;
+    };
+}
+const headCache = new Map();
+/** The default forge: the ref-status cache for created PRs, and per-head GraphQL lookups with a
+ *  one-minute cache per head. `CEZ_DRY_RUN=1` never shells out. */
+export function createGithubBranchForge(deps = {}) {
+    const graphql = deps.graphql ?? defaultGraphql;
+    const handleOf = deps.handle ?? ((root) => resolveRepoHandle(root));
+    return {
+        async prStates(repoRoot, numbers) {
+            const states = {};
+            for (let i = 0; i < numbers.length; i += GH_REF_STATUS_MAX) {
+                const data = await resolveForgeRoot(repoRoot, deps.forgeFactory).refStatus({ prs: numbers.slice(i, i + GH_REF_STATUS_MAX) });
+                if (!data.available)
+                    return { available: false, states };
+                for (const [n, status] of Object.entries(data.prs))
+                    states[Number(n)] = prStateOf(status);
+            }
+            return { available: true, states };
+        },
+        async prsForHeads(repoRoot, heads) {
+            const wanted = [...new Set(heads)];
+            if (productEnv('DRY_RUN') === '1' || wanted.length === 0)
+                return { available: true, prs: [], incomplete: new Set() };
+            const prs = [];
+            const misses = [];
+            const now = Date.now();
+            for (const head of wanted) {
+                const hit = headCache.get(`${repoRoot}\0${head}`);
+                if (hit && now - hit.at < HEAD_TTL_MS)
+                    prs.push(...hit.prs);
+                else
+                    misses.push(head);
+            }
+            if (misses.length === 0)
+                return { available: true, prs, incomplete: new Set() };
+            const handle = await handleOf(repoRoot).catch(() => null);
+            if (!handle)
+                return { available: false, prs: [], incomplete: new Set(wanted) };
+            const run = graphql(repoRoot);
+            const incomplete = new Set();
+            let failed = false;
+            for (let i = 0; i < misses.length; i += HEADS_PER_QUERY) {
+                const batch = await fetchHeadBatch(run, handle.owner, handle.name, misses.slice(i, i + HEADS_PER_QUERY));
+                failed ||= batch.failed;
+                for (const head of batch.incomplete)
+                    incomplete.add(head);
+                for (const [head, found] of batch.complete) {
+                    prs.push(...found);
+                    headCache.delete(`${repoRoot}\0${head}`);
+                    headCache.set(`${repoRoot}\0${head}`, { at: Date.now(), prs: found });
+                }
+            }
+            while (headCache.size > HEAD_CACHE_MAX)
+                headCache.delete(headCache.keys().next().value);
+            return { available: !failed, prs, incomplete };
+        },
+    };
+}
+export const githubBranchForge = createGithubBranchForge();
+/** Test-only: forget cached per-head answers. */
+export function __clearPrListCacheForTests() {
+    headCache.clear();
+}
+//# sourceMappingURL=repo-branch-forge.js.map

package/dist/server/repo-branch-forge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-branch-forge.js","sourceRoot":"","sources":["../../src/server/repo-branch-forge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAsB,MAAM,mBAAmB,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAA2C,MAAM,kBAAkB,CAAC;AAChH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAoCjC,SAAS,SAAS,CAAC,MAAuB;IACxC,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACzC,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACzC,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACvC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;CAC7B,CAAC,CAAC;AACH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;CACjG,CAAC,CAAC;AAEH,uFAAuF;AACvF,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,WAAW,GAAG,MAAM,CAAC;AAC3B,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACpD,IAAI,CAAC,iCAAiC,CAAC,YAAY,YAAY,0JAA0J,CAC1N,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjB,OAAO,2CAA2C,IAAI,wDAAwD,MAAM,UAAU,CAAC;AACjI,CAAC;AAED,SAAS,SAAS,CAAC,GAAiC;IAClD,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,cAAc,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,IAAI,IAAI;QAC5C,KAAK,EAAE,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;KAC9G,CAAC;AACJ,CAAC;AAED;;0BAE0B;AAC1B,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAkB,EAClB,KAAa,EACb,IAAY,EACZ,KAAwB;IAExB,MAAM,SAAS,GAA2B,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC1D,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC9C,IAAI,UAAU,GAAuE,IAAI,CAAC;IAC1F,IAAI,CAAC;QACH,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAChH,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IACD,2FAA2F;IAC3F,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC3E,MAAM,KAAK,GAAG,UAAU,CAAC;IACzB,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,WAAW;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YACrE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACjD,CAAC;AAQD,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;QAChC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;QACtI,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0C,CAAC;AAEpE;mEACmE;AACnE,MAAM,UAAU,uBAAuB,CAAC,IAAI,GAA0B,EAAE;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO;YAC9B,MAAM,MAAM,GAAkC,EAAE,CAAC;YACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,iBAAiB,EAAE,CAAC;gBAC3D,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;gBAC7H,IAAI,CAAC,IAAI,CAAC,SAAS;oBAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;gBACzD,KAAK,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAC5F,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACrC,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK;YAC/B,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YACnC,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;YACrH,MAAM,GAAG,GAAc,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC;gBAClD,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,WAAW;oBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;;oBACvD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;YAChF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/E,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC9B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;YACrC,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,eAAe,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;gBACzG,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;gBACxB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,UAAU;oBAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;oBAC3C,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;oBACnB,SAAS,CAAC,MAAM,CAAC,GAAG,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC;oBACzC,SAAS,CAAC,GAAG,CAAC,GAAG,QAAQ,KAAK,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;gBACxE,CAAC;YACH,CAAC;YACD,OAAO,SAAS,CAAC,IAAI,GAAG,cAAc;gBAAE,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;YAClG,OAAO,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAgB,uBAAuB,EAAE,CAAC;AAExE,iDAAiD;AACjD,MAAM,UAAU,0BAA0B;IACxC,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC"}

package/dist/server/repo-branch-sweep.d.ts

@@ -0,0 +1,21 @@
+import { type BranchForge, type ClassifyProject, type DeleteBranchesResult } from './repo-branches.ts';
+export interface SweepResult {
+    deleted: string[];
+    refused: DeleteBranchesResult['refused'];
+}
+export interface SweepOptions {
+    forge?: BranchForge;
+    /** The retention keep-count; 0 means "keep everything", and the sweep does nothing. */
+    keep: number;
+    /** Skip the sweep when this repository was swept less than this long ago. Startup passes none. */
+    minIntervalMs?: number;
+    /** Where the one summary line goes. */
+    log?: (line: string) => void;
+}
+/** After a terminal transition, at most one sweep per repository in this window. */
+export declare const SWEEP_MIN_INTERVAL_MS: number;
+/** Delete every `merged` and `empty` branch of `project`. A sweep already running for the same
+ *  repository is joined, not repeated. Resolves null when nothing ran. */
+export declare function sweepMergedBranches(project: ClassifyProject, options: SweepOptions): Promise<SweepResult | null>;
+/** Test-only: forget running sweeps and their start times. */
+export declare function __resetBranchSweepForTests(): void;

package/dist/server/repo-branch-sweep.js

@@ -0,0 +1,64 @@
+/**
+ * The automatic branch sweep (hearsay-tools/cezarion#2268). Retention reclaims a finished task's
+ * worktree DIRECTORY and keeps its branch, so Continue can recover local-only commits; nothing
+ * removed the branch once its work had landed, and local branches piled up by the thousand. The
+ * sweep deletes the refs that hold no local-only work: the bulk-safe classes `merged` and `empty`.
+ *
+ * It reads every `refs/heads` ref, not the worktree directories, so it finds a branch whose
+ * directory is long gone. Every guarantee comes from `deleteBranches`: a fresh classification under
+ * run claims and the worktree mutation lock, a recheck of checkouts and owned-workspace receipts,
+ * and a ref transaction that verifies the base and the tip it classified. It also holds the
+ * cockpit's checkout-and-pull claim, so no branch switch lands between the verdict and the delete.
+ * `worktreeRetention: 0` ("keep every worktree") turns it off with retention. Never throws.
+ */
+import { claimRepoGitMutation } from './repo-pull.js';
+import { classifyBranches, classifyInputFor, deleteBranches, githubBranchForge } from './repo-branches.js';
+/** After a terminal transition, at most one sweep per repository in this window. */
+export const SWEEP_MIN_INTERVAL_MS = 5 * 60_000;
+const running = new Map();
+const lastStarted = new Map();
+/** Delete every `merged` and `empty` branch of `project`. A sweep already running for the same
+ *  repository is joined, not repeated. Resolves null when nothing ran. */
+export function sweepMergedBranches(project, options) {
+    if (!Number.isFinite(options.keep) || options.keep <= 0)
+        return Promise.resolve(null);
+    const joined = running.get(project.root);
+    if (joined)
+        return joined;
+    const last = lastStarted.get(project.root);
+    if (options.minIntervalMs && last !== undefined && Date.now() - last < options.minIntervalMs)
+        return Promise.resolve(null);
+    lastStarted.set(project.root, Date.now());
+    const sweep = runSweep(project, options).catch(() => null).finally(() => running.delete(project.root));
+    running.set(project.root, sweep);
+    return sweep;
+}
+async function runSweep(project, options) {
+    const input = await classifyInputFor(project, options.forge ?? githubBranchForge);
+    if (!input)
+        return null;
+    const release = claimRepoGitMutation(input.root);
+    // A branch switch or pull is running: the next sweep tries again.
+    if (!release)
+        return null;
+    try {
+        const { payload } = await classifyBranches(input, { diffStats: false });
+        const names = payload.branches.filter((b) => b.class === 'merged' || b.class === 'empty').map((b) => b.name);
+        if (names.length === 0)
+            return { deleted: [], refused: [] };
+        const result = await deleteBranches(input, names);
+        if (result.deleted.length > 0 || result.refused.length > 0) {
+            (options.log ?? console.log)(`  removed ${result.deleted.length} merged local branch(es)${result.refused.length > 0 ? `, kept ${result.refused.length} that changed or are in use` : ''}`);
+        }
+        return { deleted: result.deleted, refused: result.refused };
+    }
+    finally {
+        release();
+    }
+}
+/** Test-only: forget running sweeps and their start times. */
+export function __resetBranchSweepForTests() {
+    running.clear();
+    lastStarted.clear();
+}
+//# sourceMappingURL=repo-branch-sweep.js.map

package/dist/server/repo-branch-sweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-branch-sweep.js","sourceRoot":"","sources":["../../src/server/repo-branch-sweep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,iBAAiB,EAAqE,MAAM,oBAAoB,CAAC;AAiB9K,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,MAAM,CAAC;AAEhD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuC,CAAC;AAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE9C;0EAC0E;AAC1E,MAAM,UAAU,mBAAmB,CAAC,OAAwB,EAAE,OAAqB;IACjF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,aAAa,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3H,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,OAAwB,EAAE,OAAqB;IACrE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,IAAI,iBAAiB,CAAC,CAAC;IAClF,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjD,kEAAkE;IAClE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7G,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3D,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAC1B,aAAa,MAAM,CAAC,OAAO,CAAC,MAAM,2BAA2B,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,OAAO,CAAC,MAAM,6BAA6B,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7J,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,0BAA0B;IACxC,OAAO,CAAC,KAAK,EAAE,CAAC;IAChB,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC"}

package/dist/server/repo-branches.d.ts

@@ -0,0 +1,103 @@
+import type { Home } from '../home/home.ts';
+import type { RepoBranchCountsResponse, RepoBranchesResponse } from '../contract/index.js';
+import type { BranchOwner, RunStore } from '../runs/store.ts';
+import type { RunManager } from '../workflows/run.ts';
+import { type LogEntryWithParents } from './git.ts';
+import type { BranchForge } from './repo-branch-forge.ts';
+export { __clearPrListCacheForTests, githubBranchForge, type BranchForge, type ForgePr } from './repo-branch-forge.ts';
+export interface ClassifyInput {
+    /** Repository top level (`RepoInfo.root`). */
+    root: string;
+    /** Every run that owns a branch (`RunStore.listBranchOwners`): the few fields read here. */
+    runs: readonly BranchOwner[];
+    /** The run manager's liveness — a run can be live while its record still says `done`. */
+    isActive: (runId: string) => boolean;
+    /** `config.baseBranch`, when the repo sets one. */
+    configuredBase?: string | undefined;
+    /** The main checkout's branch (`RepoInfo.branch`). */
+    currentBranch: string;
+    /** Whether the repo has a remote at all; without one the forge is not asked. */
+    hasRemote: boolean;
+    forge: BranchForge;
+    /** Claims the runs owning a branch for the length of its delete, or returns null when one is in
+     *  use (`RunManager.claimForBranchCleanup`). Absent, a delete trusts the classification alone. */
+    claimRuns?: (runIds: readonly string[]) => (() => void) | null;
+}
+/** The project a classification reads: its root, its runs and the run manager's liveness. */
+export interface ClassifyProject {
+    root: string;
+    home: Home;
+    store: Pick<RunStore, 'listBranchOwners'>;
+    manager: Pick<RunManager, 'isActive' | 'claimForBranchCleanup'>;
+}
+/** What the branch classifier reads for one project, or null outside a repository. */
+export declare function classifyInputFor(project: ClassifyProject, forge: BranchForge): Promise<ClassifyInput | null>;
+export interface Classification {
+    payload: RepoBranchesResponse;
+    /** The base as a commit, or null when it did not resolve (everything is then "not on base"). */
+    baseSha: string | null;
+    /** The fully qualified ref `baseSha` was read from, or null for a pinned sha — what a delete
+     *  verifies is unchanged in the same ref transaction. */
+    baseFullRef: string | null;
+    /** Branch name → tip sha at classification time. */
+    tips: Map<string, string>;
+}
+/**
+ * Where each run forked: a pinned sha, or the branch's creation entry in its reflog. Only an entry
+ * git wrote as a creation counts: once older entries expire, the oldest SURVIVING one can be a task
+ * commit, and reading that as the fork point would call committed work "empty".
+ *
+ * One `git log -g` per chunk of branches, never one per branch (hearsay-tools/cezarion#2029). git
+ * walks every named reflog and prints each entry once, in date order, so entries are matched by
+ * their `refs/heads/<name>@{n}` selector, and the oldest is the highest `n`. A ref with no reflog
+ * prints nothing: no fork point. A chunk that fails (a branch deleted since it was listed) is read
+ * again one branch at a time, and a single branch that still fails has no fork point.
+ */
+export declare function forkPoints(root: string, wanted: ReadonlyArray<{
+    run: BranchOwner;
+    branch: string;
+}>, chunkSize?: number): Promise<Map<string, string | null>>;
+/** What a kept row says when GitHub did not return its PR history in full. */
+export declare const INCOMPLETE_PR_LOOKUP = "Kept: GitHub did not return this branch's full pull request history";
+export interface ClassifyOptions {
+    /** Compute each not-landed row's diff stat (the default). Off for the counts and for a delete,
+     *  which read none. */
+    diffStats?: boolean;
+}
+export declare function classifyBranches(input: ClassifyInput, options?: ClassifyOptions): Promise<Classification>;
+/** `GET /repo/branches`: the classification, cached on the refs state. */
+export declare function readRepoBranches(input: ClassifyInput): Promise<RepoBranchesResponse>;
+/** `GET /repo/branches/counts`: the classification's counts, with no diff stat per branch, and
+ *  the All branches count — `GET /repo`'s names plus every local branch, as the list joins them. */
+export declare function readRepoBranchCounts(input: ClassifyInput): Promise<RepoBranchCountsResponse>;
+/** Drop the cached classification — after any mutation this server makes. */
+export declare function forgetRepoBranches(root: string): void;
+export interface DeleteBranchesResult {
+    deleted: string[];
+    refused: Array<{
+        name: string;
+        reason: string;
+    }>;
+    dropped?: Array<{
+        sha: string;
+        subject: string;
+    }>;
+}
+/**
+ * Delete from fresh classification under mutation and cleanup claims. Verify base and tip
+ * atomically; recheck checkout/receipt protection. Retention refs must be outside this request.
+ * Unlanded work requires a single exact-name confirmation. Never throw.
+ */
+export declare function deleteBranches(input: ClassifyInput, requested: string[], confirm?: string): Promise<DeleteBranchesResult>;
+export interface LogSource {
+    runId: string;
+    title: string;
+    prNumber: number | null;
+}
+/**
+ * Best-effort task attribution for base-branch commits (issue 08 §B5). A merge commit maps its
+ * second parent to a run by `branch` (through any ref still pointing at it, else the branch its
+ * subject names); a squash commit maps its trailing `(#123)` to a run by `pullRequestUrl`.
+ * Commits nothing maps stay unattributed — `null` in the returned list, never a guess.
+ */
+export declare function attributeLog(root: string, entries: readonly LogEntryWithParents[], runs: readonly BranchOwner[]): Promise<Array<LogSource | null>>;