@henryqw/pi-pr 4.0.10 → 5.0.1

package/README.md

@@ -116,7 +116,7 @@ If Herdr lookup, JSON validation, or rename fails, the PR and normal UI refresh
 
 Current-branch discovery reads pull requests associated with the exact push repository ref. It does not run a global branch search. It finds a fork-head PR whose base is an upstream repository. A unique historical match uses the exact remote push-ref OID, not local HEAD.
 
-A no-action state includes drafts, merged or closed pull requests, running or unsupported failed CI, pending review, and blocked merge policy. A dirty tree or mismatched local HEAD also blocks a mutating workflow.
+A no-action state includes drafts, merged or closed pull requests, unsupported failed CI, pending review, and blocked merge policy. Running CI blocks merge but not other mutating workflows. A dirty tree or mismatched local HEAD also blocks a mutating workflow.
 
 ### Route priority
 
@@ -172,7 +172,8 @@ The GitHub response must match the observed URL, host, repository, head ref, hea
 - A merge, rebase, cherry-pick, revert, or sequencer state blocks direct merge, even when `git status` is empty.
 - A branch update resolves the base repository ref directly. It stops if that ref moves before merge or push.
 - Before a comment-sweep push, it revalidates the configured destination, full PR identity, and local HEAD. It pushes the captured OID.
-- CI repair streams a bounded failed-step log tail and runs one narrow local reproducer before editing.
+- CI repair resolves workflow runs from check-suite IDs. It does not treat HTML details links as identity.
+- It streams a bounded failed-step log tail and runs one narrow local reproducer before editing.
 - Before push, CI repair revalidates the saved destination, open PR, failure evidence, and repair HEAD.
 - An already-published local HEAD needs no second push.
 - Direct merge requires final confirmation and a fresh readiness check.

package/extensions/pr-ci.ts

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { spawnBounded, type Exec, type ExecOptions } from "@henryqw/pi-process";
 import {
+	cloneCurrentPullRequest,
 	loadCurrentPullRequest,
 	readValidatedRemoteAuthority,
 	samePullRequestSnapshot,
@@ -9,6 +9,7 @@ import {
 	type PullRequestLoadContext,
 } from "./pr-github.ts";
 import {
+	extensionExecApi,
 	inspectWorktree,
 	isAncestor,
 	readHead,
@@ -50,9 +51,6 @@ type StepIdentity = {
 
 type JobIdentity = {
 	id: number;
-	url: string;
-	htmlUrl: string;
-	checkRunUrl: string;
 	runId: number;
 	attempt: number;
 	headOid: string;
@@ -64,8 +62,6 @@ type JobIdentity = {
 
 type CheckIdentity = {
 	id: number;
-	url: string;
-	detailsUrl: string | null;
 	suiteId: number;
 	headOid: string;
 	name: string;
@@ -76,8 +72,6 @@ type CheckIdentity = {
 
 type RunIdentity = {
 	id: number;
-	url: string;
-	htmlUrl: string;
 	attempt: number;
 	suiteId: number;
 	headOid: string;
@@ -87,7 +81,7 @@ type RunIdentity = {
 };
 
 type FailureIdentity = {
-	check: CheckIdentity;
+	checks: CheckIdentity[];
 	run: RunIdentity;
 	job: JobIdentity;
 	failedSteps: StepIdentity[];
@@ -99,7 +93,7 @@ type CiSnapshot = {
 };
 
 export type CiFailureEvidence = {
-	checkRun: { id: number; url: string; detailsUrl: string; name: string; conclusion: string };
+	checkRuns: Array<{ id: number; name: string; conclusion: string }>;
 	checkSuite: { id: number };
 	run: { id: number; url: string; attempt: number };
 	job: { id: number; url: string; name: string; conclusion: string };
@@ -138,18 +132,6 @@ export type CiPublishResult = {
 	attempt: "applied";
 };
 
-function cloneAuthority(value: CurrentPullRequest): CurrentPullRequest {
-	return {
-		...value,
-		url: new URL(value.url.href),
-		conditions: { ...value.conditions },
-		local: { ...value.local },
-		base: { ...value.base },
-		head: { ...value.head },
-		target: { ...value.target },
-	};
-}
-
 function record(value: unknown, label: string): Record<string, unknown> {
 	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} returned invalid JSON`);
 	return value as Record<string, unknown>;
@@ -204,91 +186,12 @@ function outputLine(output: string, label: string): string {
 	return requiredText(lines[0], label);
 }
 
-function secureUrl(value: unknown, label: string): URL {
-	const raw = text(value, label);
-	let url: URL;
-	try {
-		url = new URL(raw);
-	} catch {
-		throw new Error(`${label} returned an invalid URL`);
-	}
-	if (url.protocol !== "https:" || url.username || url.password || url.port || url.search || url.hash) {
-		throw new Error(`${label} returned an invalid URL`);
-	}
-	return url;
-}
-
-function pathParts(url: URL): string[] {
-	const parts = url.pathname.split("/").filter(Boolean);
-	if (parts.some((part) => !part || part === "." || part === ".." || part.includes("%"))) {
-		throw new Error("GitHub returned an invalid identity URL");
-	}
-	return parts;
-}
-
-function sameRepository(parts: readonly string[], repository: string): boolean {
-	const expected = repository.split("/");
-	return parts.length === 2 && expected.length === 2 &&
-		parts[0]!.toLowerCase() === expected[0]!.toLowerCase() &&
-		parts[1]!.toLowerCase() === expected[1]!.toLowerCase();
-}
-
-function parseApiIdentityUrl(
-	value: unknown,
-	label: string,
-	host: string,
-	repository: string,
-	kind: "check-runs" | "runs" | "jobs",
-	expectedId: number,
-): string {
-	const url = secureUrl(value, label);
-	const parts = pathParts(url);
-	const expectedHost = (host === "github.com" ? "api.github.com" : host).toLowerCase();
-	if (url.hostname.toLowerCase() !== expectedHost) throw new Error(`${label} returned an unexpected API origin`);
-	const tailSize = kind === "check-runs" ? 5 : 6;
-	const tail = parts.slice(-tailSize);
-	const valid = kind === "check-runs"
-		? tail[0] === "repos" && sameRepository(tail.slice(1, 3), repository) && tail[3] === kind
-		: tail[0] === "repos" && sameRepository(tail.slice(1, 3), repository) && tail[3] === "actions" && tail[4] === kind;
-	if (!valid || tail[tail.length - 1] !== String(expectedId)) throw new Error(`${label} did not match its immutable ID`);
+function actionsUrl(authority: CurrentPullRequest, suffix: string): string {
+	const url = new URL(authority.url.origin);
+	url.pathname = `/${authority.base.repository}/actions/${suffix}`;
 	return url.href;
 }
 
-function parseRunHtmlUrl(value: unknown, label: string, host: string, repository: string, expectedId: number): string {
-	const url = secureUrl(value, label);
-	const parts = pathParts(url);
-	if (url.hostname.toLowerCase() !== host || parts.length !== 5 || !sameRepository(parts.slice(0, 2), repository) ||
-		parts[2] !== "actions" || parts[3] !== "runs" || parts[4] !== String(expectedId)) {
-		throw new Error(`${label} did not match its immutable ID`);
-	}
-	return url.href;
-}
-
-function decimalIdentity(value: string, label: string): number {
-	const parsed = integer(Number(value), label);
-	if (String(parsed) !== value) throw new Error(`${label} returned a noncanonical decimal ID`);
-	return parsed;
-}
-
-function parseJobHtmlUrl(
-	value: unknown,
-	label: string,
-	host: string,
-	repository: string,
-): { url: string; runId: number; jobId: number } {
-	const url = secureUrl(value, label);
-	const parts = pathParts(url);
-	if (url.hostname.toLowerCase() !== host || parts.length !== 7 || !sameRepository(parts.slice(0, 2), repository) ||
-		parts[2] !== "actions" || parts[3] !== "runs" || parts[5] !== "job") {
-		throw new Error(`${label} was not an immutable GitHub Actions job URL`);
-	}
-	return {
-		url: url.href,
-		runId: decimalIdentity(parts[4]!, `${label} run ID`),
-		jobId: decimalIdentity(parts[6]!, `${label} job ID`),
-	};
-}
-
 function tailUtf8(value: string, limit: number): { text: string; truncated: boolean } {
 	const total = Buffer.byteLength(value, "utf8");
 	if (total <= limit) return { text: value, truncated: false };
@@ -308,24 +211,28 @@ function tailUtf8(value: string, limit: number): { text: string; truncated: bool
 }
 
 function failureEvidence(
+	authority: CurrentPullRequest,
 	failure: FailureIdentity,
 	log: { text: string; truncated: boolean },
 ): CiFailureEvidence {
-	const { check, run, job, failedSteps } = failure;
-	if (check.detailsUrl === null || check.conclusion === null || job.conclusion === null) {
+	const { checks, run, job, failedSteps } = failure;
+	if (job.conclusion === null || checks.some(({ conclusion: value }) => value === null)) {
 		throw new Error(`Failed job ${job.id} omitted required evidence identity`);
 	}
 	return {
-		checkRun: {
+		checkRuns: checks.map((check) => ({
 			id: check.id,
-			url: check.url,
-			detailsUrl: check.detailsUrl,
 			name: check.name,
-			conclusion: check.conclusion,
+			conclusion: check.conclusion!,
+		})),
+		checkSuite: { id: run.suiteId },
+		run: { id: run.id, url: actionsUrl(authority, `runs/${run.id}`), attempt: run.attempt },
+		job: {
+			id: job.id,
+			url: actionsUrl(authority, `runs/${run.id}/job/${job.id}`),
+			name: job.name,
+			conclusion: job.conclusion,
 		},
-		checkSuite: { id: check.suiteId },
-		run: { id: run.id, url: run.htmlUrl, attempt: run.attempt },
-		job: { id: job.id, url: job.htmlUrl, name: job.name, conclusion: job.conclusion },
 		failedSteps: failedSteps.map((step) => {
 			if (step.conclusion === null) throw new Error(`Failed job ${job.id} step omitted its conclusion`);
 			return { number: step.number, name: step.name, conclusion: step.conclusion };
@@ -339,17 +246,18 @@ function jsonBytes(value: unknown): number {
 }
 
 function boundedEvidenceRecord(
+	authority: CurrentPullRequest,
 	failure: FailureIdentity,
 	rawLog: { text: string; truncated: boolean },
 	maxBytes: number,
 ): CiFailureEvidence {
-	const metadata = failureEvidence(failure, { text: "", truncated: false });
+	const metadata = failureEvidence(authority, failure, { text: "", truncated: false });
 	const metadataBytes = jsonBytes(metadata);
 	if (metadataBytes > maxBytes) throw new Error(`Failed job ${failure.job.id} metadata exceeds its evidence budget`);
 	let logBytes = Math.min(Buffer.byteLength(rawLog.text, "utf8"), maxBytes - metadataBytes);
 	while (true) {
 		const retained = tailUtf8(rawLog.text, logBytes);
-		const evidence = failureEvidence(failure, {
+		const evidence = failureEvidence(authority, failure, {
 			text: retained.text,
 			truncated: rawLog.truncated || retained.truncated,
 		});
@@ -376,21 +284,16 @@ function authorityIdentity(value: CurrentPullRequest) {
 function snapshotFingerprint(authority: CurrentPullRequest, failures: FailureIdentity[]): string {
 	return createHash("sha256").update(JSON.stringify({
 		authority: authorityIdentity(authority),
-		failures: failures.map(({ check, run, job, failedSteps }) => ({
-			check,
+		failures: failures.map(({ checks, run, job, failedSteps }) => ({
+			checks,
 			run: {
 				id: run.id,
-				url: run.url,
-				htmlUrl: run.htmlUrl,
 				attempt: run.attempt,
 				suiteId: run.suiteId,
 				headOid: run.headOid,
 			},
 			job: {
 				id: job.id,
-				url: job.url,
-				htmlUrl: job.htmlUrl,
-				checkRunUrl: job.checkRunUrl,
 				runId: job.runId,
 				attempt: job.attempt,
 				headOid: job.headOid,
@@ -432,7 +335,7 @@ export class PullRequestCiFixer {
 			: requiredOid(options.authority.target.remoteOid, "remote OID");
 		if (remote !== head) throw new TypeError("CI repair requires the pull request head to match the configured remote OID");
 		this.cwd = requiredText(options.cwd, "cwd");
-		this.authority = cloneAuthority(options.authority);
+		this.authority = cloneCurrentPullRequest(options.authority);
 		this.signal = options.signal;
 		this.agentDir = options.agentDir;
 		this.exec = options.exec ?? spawnBounded;
@@ -443,14 +346,8 @@ export class PullRequestCiFixer {
 		return { cwd: this.cwd, signal: this.signal, ...extra };
 	}
 
-	private pi(): Pick<ExtensionAPI, "exec"> {
-		return {
-			exec: (command, args, options) => this.exec(command, args, {
-				cwd: options?.cwd ?? this.cwd,
-				signal: options?.signal ?? this.signal,
-				timeoutMs: options?.timeout,
-			}),
-		} as Pick<ExtensionAPI, "exec">;
+	private pi() {
+		return extensionExecApi(this.exec, this.cwd, this.signal);
 	}
 
 	private context(): PullRequestLoadContext {
@@ -506,11 +403,8 @@ export class PullRequestCiFixer {
 		if (suite.head_sha !== undefined && requiredOid(suite.head_sha, `check run ${id} suite head OID`) !== headOid) {
 			throw new Error(`Check run ${id} suite is stale for the frozen pull request head`);
 		}
-		const detailsUrl = item.details_url === null ? null : secureUrl(item.details_url, `check run ${id} details URL`).href;
 		return {
 			id,
-			url: parseApiIdentityUrl(item.url, `check run ${id} URL`, this.authority.host, this.authority.base.repository, "check-runs", id),
-			detailsUrl,
 			suiteId: integer(suite.id, `check run ${id} suite ID`),
 			headOid,
 			name: text(item.name, `check run ${id} name`),
@@ -555,8 +449,7 @@ export class PullRequestCiFixer {
 		}
 		if (expectedTotal === undefined || checks.length !== expectedTotal) throw new Error("Check-run pagination was incomplete");
 		checks.sort((left, right) => left.id - right.id);
-		if (new Set(checks.map(({ id }) => id)).size !== checks.length ||
-			new Set(checks.map(({ url }) => url)).size !== checks.length) {
+		if (new Set(checks.map(({ id }) => id)).size !== checks.length) {
 			throw new Error("Check-run pagination returned duplicate immutable identities");
 		}
 		return checks;
@@ -586,13 +479,8 @@ export class PullRequestCiFixer {
 		const steps = array(item.steps, `job ${id} steps`).map((step) => this.parseStep(step, id));
 		steps.sort((left, right) => left.number - right.number);
 		if (new Set(steps.map(({ number }) => number)).size !== steps.length) throw new Error(`Job ${id} returned duplicate step identities`);
-		const html = parseJobHtmlUrl(item.html_url, `job ${id} HTML URL`, this.authority.host, this.authority.base.repository);
-		if (html.runId !== runId || html.jobId !== id) throw new Error(`Job ${id} HTML URL did not match its immutable IDs`);
 		return {
 			id,
-			url: parseApiIdentityUrl(item.url, `job ${id} URL`, this.authority.host, this.authority.base.repository, "jobs", id),
-			htmlUrl: html.url,
-			checkRunUrl: secureUrl(item.check_run_url, `job ${id} check-run URL`).href,
 			runId,
 			attempt,
 			headOid,
@@ -603,7 +491,25 @@ export class PullRequestCiFixer {
 		};
 	}
 
-	private async readRun(runId: number, budget: { pages: number; records: number }): Promise<RunIdentity> {
+	private async readRunIdForSuite(suiteId: number, budget: { pages: number; records: number }): Promise<number> {
+		const label = `List workflow runs for check suite ${suiteId}`;
+		this.consumePage(budget);
+		const endpoint = `repos/${this.authority.base.repository}/actions/runs?check_suite_id=${suiteId}&head_sha=${this.authority.head.oid}&per_page=2&page=1`;
+		const parsed = record(parseJson(await this.api(endpoint, label), label), label);
+		const runs = array(parsed.workflow_runs, label);
+		if (integer(parsed.total_count, `${label} total`, true) !== 1 || runs.length !== 1) {
+			throw new Error(`Check suite ${suiteId} did not resolve to exactly one workflow run`);
+		}
+		this.consumeRecords(budget, 1);
+		const item = record(runs[0], label);
+		if (integer(item.check_suite_id, `${label} suite ID`) !== suiteId ||
+			requiredOid(item.head_sha, `${label} head OID`) !== this.authority.head.oid) {
+			throw new Error(`${label} returned a stale or unrelated run`);
+		}
+		return integer(item.id, `${label} run ID`);
+	}
+
+	private async readRun(runId: number, suiteId: number, budget: { pages: number; records: number }): Promise<RunIdentity> {
 		const label = `Read workflow run ${runId}`;
 		const item = record(parseJson(await this.api(
 			`repos/${this.authority.base.repository}/actions/runs/${runId}`,
@@ -620,12 +526,13 @@ export class PullRequestCiFixer {
 			throw new Error(`${label} does not belong to the frozen pull request repositories`);
 		}
 		const currentStatus = status(item.status, label);
+		if (integer(item.check_suite_id, `${label} suite ID`) !== suiteId) {
+			throw new Error(`${label} does not belong to check suite ${suiteId}`);
+		}
 		const run: RunIdentity = {
 			id: runId,
-			url: parseApiIdentityUrl(item.url, `${label} URL`, this.authority.host, this.authority.base.repository, "runs", runId),
-			htmlUrl: parseRunHtmlUrl(item.html_url, `${label} HTML URL`, this.authority.host, this.authority.base.repository, runId),
 			attempt,
-			suiteId: integer(item.check_suite_id, `${label} suite ID`),
+			suiteId,
 			headOid,
 			status: currentStatus,
 			conclusion: conclusion(item.conclusion, currentStatus, label),
@@ -660,9 +567,7 @@ export class PullRequestCiFixer {
 		}
 		if (expectedTotal === undefined || run.jobs.length !== expectedTotal) throw new Error(`Workflow run ${runId} job pagination was incomplete`);
 		run.jobs.sort((left, right) => left.id - right.id);
-		if (new Set(run.jobs.map(({ id }) => id)).size !== run.jobs.length ||
-			new Set(run.jobs.map(({ url }) => url)).size !== run.jobs.length ||
-			new Set(run.jobs.map(({ checkRunUrl }) => checkRunUrl)).size !== run.jobs.length) {
+		if (new Set(run.jobs.map(({ id }) => id)).size !== run.jobs.length) {
 			throw new Error(`Workflow run ${runId} returned duplicate job identities`);
 		}
 		return run;
@@ -678,68 +583,44 @@ export class PullRequestCiFixer {
 		const unsupported = failed.find(({ provider }) => provider !== "github-actions");
 		if (unsupported) throw new Error(`Unsupported failed check provider for immutable evidence: ${unsupported.provider}`);
 
-		const runIds = new Set<number>();
-		const detailIdentities = new Map<number, { url: string; runId: number; jobId: number }>();
+		const checksBySuite = new Map<number, CheckIdentity[]>();
 		for (const check of failed) {
-			if (check.detailsUrl === null) throw new Error(`Failed check run ${check.id} omitted its immutable job URL`);
-			const detail = parseJobHtmlUrl(
-				check.detailsUrl,
-				`check run ${check.id} details URL`,
-				this.authority.host,
-				this.authority.base.repository,
-			);
-			detailIdentities.set(check.id, detail);
-			runIds.add(detail.runId);
+			const suiteChecks = checksBySuite.get(check.suiteId) ?? [];
+			suiteChecks.push(check);
+			checksBySuite.set(check.suiteId, suiteChecks);
 		}
 
 		const runs: RunIdentity[] = [];
-		this.consumeRecords(pageBudget, runIds.size);
-		for (const runId of [...runIds].sort((left, right) => left - right)) {
-			runs.push(await this.readRun(runId, pageBudget));
+		for (const suiteId of [...checksBySuite.keys()].sort((left, right) => left - right)) {
+			const runId = await this.readRunIdForSuite(suiteId, pageBudget);
+			this.consumeRecords(pageBudget, 1);
+			runs.push(await this.readRun(runId, suiteId, pageBudget));
+		}
+		if (new Set(runs.map(({ id }) => id)).size !== runs.length) {
+			throw new Error("Check suites returned ambiguous duplicate workflow run identities");
 		}
 		const allJobs = runs.flatMap(({ jobs }) => jobs);
-		if (new Set(allJobs.map(({ id }) => id)).size !== allJobs.length ||
-			new Set(allJobs.map(({ checkRunUrl }) => checkRunUrl)).size !== allJobs.length) {
+		if (new Set(allJobs.map(({ id }) => id)).size !== allJobs.length) {
 			throw new Error("Workflow runs returned ambiguous duplicate job identities");
 		}
-		const runById = new Map(runs.map((run) => [run.id, run]));
-		for (const run of runs) {
-			for (const job of run.jobs) {
-				const linked = checks.filter((check) => check.url === job.checkRunUrl);
-				if (linked.length !== 1 || linked[0]!.detailsUrl !== job.htmlUrl || linked[0]!.suiteId !== run.suiteId ||
-					linked[0]!.status !== job.status || linked[0]!.conclusion !== job.conclusion) {
-					throw new Error(`Job ${job.id} has an incomplete, replaced, or ambiguous immutable check-run mapping`);
-				}
-			}
-		}
-		const usedJobs = new Set<number>();
+
 		const failures: FailureIdentity[] = [];
-		for (const check of failed) {
-			const detail = detailIdentities.get(check.id)!;
-			const run = runById.get(detail.runId);
-			if (!run || run.suiteId !== check.suiteId) {
-				throw new Error(`Failed check run ${check.id} has an ambiguous or stale suite-to-run mapping`);
-			}
-			const matches = run.jobs.filter((job) =>
-				job.id === detail.jobId && job.checkRunUrl === check.url && job.htmlUrl === detail.url
+		for (const run of runs) {
+			const failedJobs = run.jobs.filter(({ status: value, conclusion: result }) =>
+				value === "completed" && result !== null && FAILED_CONCLUSIONS.has(result)
 			);
-			if (matches.length !== 1 || usedJobs.has(detail.jobId)) {
-				throw new Error(`Failed check run ${check.id} has an incomplete, duplicate, or ambiguous immutable job mapping`);
-			}
-			const job = matches[0]!;
-			if (job.status !== "completed" || job.conclusion !== check.conclusion ||
-				job.conclusion === null || !FAILED_CONCLUSIONS.has(job.conclusion)) {
-				throw new Error(`Failed check run ${check.id} was replaced or is stale relative to its job`);
+			if (!failedJobs.length) throw new Error(`Check suite ${run.suiteId} has no current failed workflow jobs`);
+			const suiteChecks = checksBySuite.get(run.suiteId)!;
+			for (const job of failedJobs) {
+				failures.push({
+					checks: suiteChecks,
+					run,
+					job,
+					failedSteps: job.steps.filter(({ conclusion: value }) => value !== null && FAILED_CONCLUSIONS.has(value)),
+				});
 			}
-			usedJobs.add(job.id);
-			failures.push({
-				check,
-				run,
-				job,
-				failedSteps: job.steps.filter(({ conclusion: value }) => value !== null && FAILED_CONCLUSIONS.has(value)),
-			});
 		}
-		failures.sort((left, right) => left.check.id - right.check.id);
+		failures.sort((left, right) => left.run.id - right.run.id || left.job.id - right.job.id);
 		return {
 			fingerprint: snapshotFingerprint(fresh, failures),
 			failures,
@@ -763,7 +644,7 @@ export class PullRequestCiFixer {
 		this.state.phase = "collecting";
 		try {
 			const before = await this.readSnapshot(true);
-			const metadata = before.failures.map((failure) => failureEvidence(failure, { text: "", truncated: false }));
+			const metadata = before.failures.map((failure) => failureEvidence(this.authority, failure, { text: "", truncated: false }));
 			const metadataBytes = metadata.map(jsonBytes);
 			const metadataTotal = jsonBytes(metadata);
 			if (metadataBytes.some((bytes) => bytes > EVIDENCE_RECORD_BYTES) || metadataTotal > EVIDENCE_TOTAL_BYTES) {
@@ -776,7 +657,7 @@ export class PullRequestCiFixer {
 				const baseBytes = metadataBytes[index]!;
 				const share = Math.floor(remainingBytes / (before.failures.length - index));
 				const raw = await this.readJobLog(failure.job.id);
-				const evidence = boundedEvidenceRecord(failure, raw, Math.min(EVIDENCE_RECORD_BYTES, baseBytes + share));
+				const evidence = boundedEvidenceRecord(this.authority, failure, raw, Math.min(EVIDENCE_RECORD_BYTES, baseBytes + share));
 				remainingBytes -= jsonBytes(evidence) - baseBytes;
 				failures.push(evidence);
 			}

package/extensions/pr-comment-sweep.ts

@@ -1,7 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
 import { realpath, rm } from "node:fs/promises";
 import { join } from "node:path";
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { spawnBounded, type Exec, type ExecOptions } from "@henryqw/pi-process";
 import {
 	extensionConfigDir,
@@ -28,8 +27,10 @@ import {
 	type PullRequestLoadContext,
 } from "./pr-github.ts";
 import {
+	extensionExecApi,
 	inspectGitOperation,
 	isAncestor,
+	isRecord,
 	parseNulPaths,
 	parseStatusSnapshot,
 	readHead,
@@ -134,10 +135,6 @@ export type PullRequestCommentSweepOptions = {
 	newRunId?: () => string;
 	pause?: (milliseconds: number) => Promise<void>;
 };
-function isRecord(value: unknown): value is Record<string, unknown> {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-
 function exactKeys(value: Record<string, unknown>, keys: readonly string[], label: string): void {
 	const actual = Object.keys(value).sort();
 	const expected = [...keys].sort();
@@ -558,14 +555,8 @@ export class PullRequestCommentSweep {
 		return { cwd: this.cwd, signal: this.signal, ...extra };
 	}
 
-	private pi(): Pick<ExtensionAPI, "exec"> {
-		return {
-			exec: (command, args, options) => this.exec(command, args, {
-				cwd: options?.cwd ?? this.cwd,
-				signal: options?.signal ?? this.signal,
-				timeoutMs: options?.timeout,
-			}),
-		} as Pick<ExtensionAPI, "exec">;
+	private pi() {
+		return extensionExecApi(this.exec, this.cwd, this.signal);
 	}
 
 	private context(): PullRequestLoadContext {

package/extensions/pr-create.ts

@@ -1,4 +1,3 @@
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { spawnBounded, type Exec, type ExecOptions } from "@henryqw/pi-process";
 import {
 	branchTrackingRef,
@@ -22,8 +21,10 @@ import {
 } from "./pr-routing.ts";
 import {
 	assertOnlyDeclaredStatusChanged,
+	extensionExecApi,
 	inspectWorktree,
 	isAncestor,
+	isRecord,
 	parseNulPaths,
 	readHead,
 	readRemoteOid,
@@ -95,10 +96,6 @@ function line(output: string, label: string): string {
 	return values[0];
 }
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
 function graphQlResponse(output: string, action: string): Record<string, unknown> {
 	let value: unknown;
 	try {
@@ -208,14 +205,8 @@ export class PullRequestCreator {
 		return { cwd: this.cwd, signal: this.signal, ...extra };
 	}
 
-	private pi(): Pick<ExtensionAPI, "exec"> {
-		return {
-			exec: (command, args, options) => this.exec(command, args, {
-				cwd: options?.cwd ?? this.cwd,
-				signal: options?.signal ?? this.signal,
-				timeoutMs: options?.timeout,
-			}),
-		} as Pick<ExtensionAPI, "exec">;
+	private pi() {
+		return extensionExecApi(this.exec, this.cwd, this.signal);
 	}
 
 	private context(): PullRequestLoadContext {

package/extensions/pr-execution.ts

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { lstat, mkdir, realpath } from "node:fs/promises";
 import { join, resolve } from "node:path";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { extensionConfigDir } from "@henryqw/pi-config-store";
 import { spawnBounded, type Exec, type ExecOptions, type ExecResult } from "@henryqw/pi-process";
 import { lock } from "proper-lockfile";
@@ -16,6 +17,10 @@ const WORKTREE_LOCK_OPTIONS = { realpath: false, stale: 30_000, update: 5_000, r
 export type AttemptState = "none" | "attempting" | "applied" | "blocked" | "unknown";
 export type GitWorktreeState = "clean" | "dirty" | "operation";
 
+export function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 export function requiredText(value: unknown, label: string): string {
 	if (typeof value !== "string" || !value || value.trim() !== value || /[\u0000-\u001f\u007f]/.test(value)) {
 		throw new TypeError(`${label} must be a non-empty string`);
@@ -33,6 +38,16 @@ export function commandText(command: string, args: readonly string[]): string {
 	return [command, ...args].join(" ");
 }
 
+export function extensionExecApi(exec: Exec, cwd: string, signal?: AbortSignal): Pick<ExtensionAPI, "exec"> {
+	return {
+		exec: (command, args, options) => exec(command, args, {
+			cwd: options?.cwd ?? cwd,
+			signal: options?.signal ?? signal,
+			timeoutMs: options?.timeout,
+		}),
+	} as Pick<ExtensionAPI, "exec">;
+}
+
 export async function runChecked(
 	exec: Exec,
 	command: string,

package/extensions/pr-feedback.ts

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import type { Exec, ExecOptions } from "@henryqw/pi-process";
 import {
+	isRecord,
 	runChecked,
 	requiredOid,
 	requiredText,
@@ -103,10 +104,6 @@ type Connection = {
 	endCursor: string | null;
 };
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-
 function plainText(value: unknown, label: string): string {
 	if (typeof value !== "string" || value.includes("\0")) throw new Error(`${label} must be a string without NUL bytes`);
 	return value;

package/extensions/pr-github.ts

@@ -7,6 +7,7 @@ import { dirname, join, resolve } from "node:path";
 import { inspectLocalMergeSafety } from "./pr-merge.ts";
 import {
 	inspectWorktreeState,
+	isRecord,
 	withWorktreeLock,
 	type GitWorktreeState,
 } from "./pr-execution.ts";
@@ -97,6 +98,18 @@ export type CurrentPullRequest = PullRequest & {
 
 export type CurrentPullRequestDiscovery = PullRequestDiscovery<CurrentPullRequest>;
 
+export function cloneCurrentPullRequest(value: CurrentPullRequest): CurrentPullRequest {
+	return {
+		...value,
+		url: new URL(value.url.href),
+		conditions: { ...value.conditions },
+		local: { ...value.local },
+		base: { ...value.base },
+		head: { ...value.head },
+		target: { ...value.target },
+	};
+}
+
 export type PullRequestObservation = {
 	pullRequest: { url: string; number: number; host: string };
 	head: PullRequestRef;
@@ -253,10 +266,6 @@ function fail(action: string, reason: string): never {
 	throw new PullRequestLoadError(`${action} failed: ${reason}`);
 }
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
 function text(value: unknown, action: string, field: string): string {
 	if (
 		typeof value !== "string" || !value || value.trim() !== value ||
@@ -602,37 +611,13 @@ function checkOutcome(state: string): "failure" | "success" | "running" {
 	return "running";
 }
 
-function canonicalPositiveDecimal(value: string): boolean {
-	const parsed = Number(value);
-	return Number.isSafeInteger(parsed) && parsed > 0 && String(parsed) === value;
-}
-
-function isActionsJobUrl(value: unknown, pullRequestUrl: URL, repository: string): boolean {
-	if (typeof value !== "string" || !value) return false;
-	let url: URL;
-	try {
-		url = new URL(value);
-	} catch {
-		return false;
-	}
-	if (url.protocol !== "https:" || url.username || url.password || url.port || url.search || url.hash ||
-		url.hostname.toLowerCase() !== pullRequestUrl.hostname.toLowerCase()) return false;
-	const parts = url.pathname.split("/").filter(Boolean);
-	const expected = repository.split("/");
-	return parts.length === 7 && expected.length === 2 &&
-		parts[0]!.toLowerCase() === expected[0]!.toLowerCase() &&
-		parts[1]!.toLowerCase() === expected[1]!.toLowerCase() &&
-		parts[2] === "actions" && parts[3] === "runs" && canonicalPositiveDecimal(parts[4]!) &&
-		parts[5] === "job" && canonicalPositiveDecimal(parts[6]!);
-}
-
-function isDiagnosableActionsCheck(check: Record<string, unknown>, pullRequestUrl: URL, repository: string): boolean {
+function isDiagnosableActionsCheck(check: Record<string, unknown>): boolean {
 	const workflowName = check.workflowName;
 	return typeof workflowName === "string" && !!workflowName && workflowName.trim() === workflowName &&
-		!/\p{Cc}/u.test(workflowName) && isActionsJobUrl(check.detailsUrl, pullRequestUrl, repository);
+		!/\p{Cc}/u.test(workflowName);
 }
 
-function checkState(value: unknown, pullRequestUrl: URL, repository: string): CheckState {
+function checkState(value: unknown): CheckState {
 	if (!isRecord(value) || (value.__typename !== "CheckRun" && value.__typename !== "StatusContext")) {
 		return fail("Find pull requests", "invalid statusCheckRollup");
 	}
@@ -652,14 +637,14 @@ function checkState(value: unknown, pullRequestUrl: URL, repository: string): Ch
 	return {
 		state: selected,
 		diagnosableFailure: FAILED_CHECK_STATES.has(selected) && value.__typename === "CheckRun" &&
-			isDiagnosableActionsCheck(value, pullRequestUrl, repository),
+			isDiagnosableActionsCheck(value),
 	};
 }
 
-function checkStates(value: unknown, pullRequestUrl: URL, repository: string): CheckState[] {
+function checkStates(value: unknown): CheckState[] {
 	if (value === null) return [];
 	if (!Array.isArray(value)) fail("Find pull requests", "invalid statusCheckRollup");
-	return value.map((check) => checkState(check, pullRequestUrl, repository));
+	return value.map(checkState);
 }
 
 function listedPullRequest(value: unknown): ListedPullRequest | null {
@@ -692,7 +677,7 @@ function listedPullRequest(value: unknown): ListedPullRequest | null {
 		mergeable: mergeable(value.mergeable),
 		mergeStateStatus: mergeStateStatus(value.mergeStateStatus),
 		reviewDecision: reviewDecision(value.reviewDecision),
-		checkStates: checkStates(value.statusCheckRollup, parsedUrl.url, parsedUrl.repository),
+		checkStates: checkStates(value.statusCheckRollup),
 	};
 }
 

package/extensions/pr-merge.ts

@@ -1,6 +1,7 @@
 import type { Exec } from "@henryqw/pi-process";
 import {
 	inspectWorktree,
+	isRecord,
 	readHead,
 	requiredOid,
 	requiredText,
@@ -32,10 +33,6 @@ export type ExecuteGitHubMergeInput = InspectLocalMergeSafetyInput & {
 	revalidateReadiness: (local: InspectedLocalMergeSafety) => Promise<void>;
 };
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
 function validateInspectionInput(input: InspectLocalMergeSafetyInput): void {
 	requiredText(input.cwd, "cwd");
 	requiredOid(input.expectedHead, "expected PR head");

package/extensions/pr-routing.ts

@@ -93,10 +93,10 @@ export function derivePullRequestNextStep(pullRequest: PullRequest): Exclude<Nex
 		return localMutationSafe(local) ? "sweep" : "none";
 	}
 	if (
-		conditions.ci === "running" ||
 		conditions.review === "pending" ||
 		conditions.policy === "pending" ||
-		!localMergeSafe(local)
+		!localMergeSafe(local) ||
+		conditions.ci === "running"
 	) return "none";
 	return "merge";
 }

package/extensions/pr-update-branch.ts

@@ -1,6 +1,6 @@
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { spawnBounded, type Exec, type ExecOptions } from "@henryqw/pi-process";
 import {
+	cloneCurrentPullRequest,
 	loadCurrentPullRequest,
 	samePullRequestSnapshot,
 	type CurrentPullRequest,
@@ -8,6 +8,7 @@ import {
 } from "./pr-github.ts";
 import {
 	assertOnlyDeclaredStatusChanged,
+	extensionExecApi,
 	inspectWorktree,
 	isAncestor,
 	parseNulPaths,
@@ -43,18 +44,6 @@ export type UpdateBranchOptions = {
 	loadCurrentPullRequest?: Load;
 };
 
-function cloneAuthority(value: CurrentPullRequest): CurrentPullRequest {
-	return {
-		...value,
-		url: new URL(value.url.href),
-		conditions: { ...value.conditions },
-		local: { ...value.local },
-		base: { ...value.base },
-		head: { ...value.head },
-		target: { ...value.target },
-	};
-}
-
 function sameAuthority(frozen: CurrentPullRequest, fresh: CurrentPullRequest): boolean {
 	return samePullRequestSnapshot(frozen, fresh) && frozen.base.oid === fresh.base.oid &&
 		fresh.lifecycle === "open" && (fresh.conditions.baseUpdateRequired || fresh.conditions.conflict);
@@ -95,7 +84,7 @@ export class PullRequestBranchUpdater {
 			throw new TypeError("Pull request does not require a branch update");
 		}
 		this.cwd = options.cwd;
-		this.authority = cloneAuthority(options.authority);
+		this.authority = cloneCurrentPullRequest(options.authority);
 		this.signal = options.signal;
 		this.agentDir = options.agentDir;
 		this.exec = options.exec ?? spawnBounded;
@@ -106,14 +95,8 @@ export class PullRequestBranchUpdater {
 		return { cwd: this.cwd, signal: this.signal, ...extra };
 	}
 
-	private pi(): Pick<ExtensionAPI, "exec"> {
-		return {
-			exec: (command, args, options) => this.exec(command, args, {
-				cwd: options?.cwd ?? this.cwd,
-				signal: options?.signal ?? this.signal,
-				timeoutMs: options?.timeout,
-			}),
-		} as Pick<ExtensionAPI, "exec">;
+	private pi() {
+		return extensionExecApi(this.exec, this.cwd, this.signal);
 	}
 
 	private context(): PullRequestLoadContext {
@@ -135,13 +118,6 @@ export class PullRequestBranchUpdater {
 		return discovery.pullRequest;
 	}
 
-	private async liveBaseMatches(): Promise<void> {
-		const discovery = await this.load(this.pi(), this.context());
-		if (discovery.kind !== "current" || !sameAuthority(this.authority, discovery.pullRequest)) {
-			throw new Error("Branch update cancelled: live base or pull request authority changed");
-		}
-	}
-
 	private async verifyMerge(originalHead: string): Promise<{ head: string; fastForward: boolean }> {
 		const head = await readHead(this.exec, this.execOptions());
 		const parentsOutput = singleLine((await runChecked(this.exec, "git", ["rev-list", "--parents", "-n", "1", "HEAD"], this.execOptions())).stdout, "merge parents");

package/extensions/pr.ts

@@ -16,7 +16,6 @@ import {
 	type PrCommandDependencies,
 	type PrCommandInvocation,
 	type WorkflowPromptIdentity,
-	type WorkflowReservation,
 } from "./pr-command.ts";
 import { PullRequestCreator, type CreatePullRequestOptions } from "./pr-create.ts";
 import {
@@ -27,7 +26,7 @@ import {
 	samePullRequestObservation,
 	type PullRequestObservation,
 } from "./pr-github.ts";
-import { runChecked } from "./pr-execution.ts";
+import { isRecord, runChecked } from "./pr-execution.ts";
 import {
 	discoveryIssueKey,
 	discoveryIssueMessage,
@@ -193,10 +192,6 @@ function matchesWorkflowPrompt(prompt: string, identity: WorkflowPromptIdentity)
 	return matchesSkill && tokens.has(`runId=${identity.runId}`) && tokens.has(`action=${identity.action}`);
 }
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
 function parseWorkspaceLabel(response: Record<string, unknown>, workspaceId: string): string {
 	const result = response.result;
 	const workspace = isRecord(result) && isRecord(result.workspace) ? result.workspace : undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@henryqw/pi-pr",
-  "version": "4.0.10",
+  "version": "5.0.1",
   "description": "Run /pr to safely discover or link the current pull request, then create, update, address feedback, fix CI, or merge when ready.",
   "keywords": [
     "pi-package",

package/skills/pi-pr-fix-ci/SKILL.md

@@ -18,8 +18,9 @@ The invocation authorizes one scoped edit, commit, and guarded publish.
 - Never expose raw logs, credentials, or environment values in the final report.
 
 The collect action closes after one call. It returns only current failed GitHub
-Actions jobs bound to immutable check, suite, run, attempt, job, and step IDs.
-If it blocks, report the blocker and stop.
+Actions jobs bound to immutable check-suite, run, attempt, job, and step IDs.
+It resolves runs through GitHub API fields, not HTML details links. If it blocks,
+report the blocker and stop.
 
 ## Diagnose and repair
 
@@ -49,7 +50,7 @@ If publication blocks or reports an unknown outcome, stop without another push.
 
 Report only:
 
-- **Checks:** failed check names and returned URLs.
+- **Checks:** failed check and job names with returned run and job URLs.
 - **Fix:** root cause and scoped files changed.
 - **Validation:** commands and results, including reproduction limits.
 - **Commit:** commit ID and message, or state that none was made.