@henryqw/pi-pr 4.0.3 → 4.0.5

package/extensions/pr-execution.ts

@@ -1,8 +1,9 @@
-import { createHash, randomUUID } from "node:crypto";
-import { lstat, realpath } from "node:fs/promises";
-import { resolve } from "node:path";
+import { createHash } from "node:crypto";
+import { lstat, mkdir, realpath } from "node:fs/promises";
+import { join, resolve } from "node:path";
 import { spawn } from "node:child_process";
 import { extensionConfigDir } from "@henryqw/pi-config-store";
+import { lock } from "proper-lockfile";
 
 export const DEFAULT_EXEC_TIMEOUT_MS = 30_000;
 export const DEFAULT_OUTPUT_LIMIT_BYTES = 64 * 1024;
@@ -13,10 +14,7 @@ export const MAX_CONFLICT_PATHS_BYTES = 32 * 1024;
 const OID = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
 const GIT_OPERATION_STATES = ["MERGE_HEAD", "rebase-merge", "rebase-apply", "CHERRY_PICK_HEAD", "REVERT_HEAD", "sequencer"];
 const PROCESS_TERMINATION_GRACE_MS = 250;
-const LOCK_OWNER_MAX_BYTES = 128;
-const LOCK_NONCE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-const LOCK_OWNER_PAYLOAD = /^pid=([1-9][0-9]*)\nnonce=([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\n$/;
-const LOCK_REF_PREFIX = "refs/pi-pr/worktree-locks";
+const WORKTREE_LOCK_OPTIONS = { realpath: false, stale: 30_000, update: 5_000, retries: 0 } as const;
 
 export type ExecResult = {
 	stdout: string;
@@ -265,135 +263,7 @@ export async function inspectWorktree(exec: Exec, options: ExecOptions): Promise
 	return status.stdout === "" ? "clean" : "dirty";
 }
 
-type WorktreeLockOwner = {
-	oid: string;
-	pid: number;
-};
-
-function gitFailure(args: string[], result: ExecResult): Error {
-	const detail = result.stderr.trim() || result.stdout.trim() || (result.killed ? "command was killed" : `exit code ${result.code}`);
-	return new Error(`${commandText("git", args)} failed: ${detail}`);
-}
-
-function oidLine(output: string, label: string): string {
-	const normalized = output.replace(/\r\n/g, "\n");
-	if (!normalized.endsWith("\n") || normalized.slice(0, -1).includes("\n")) {
-		throw new Error(`${label} returned invalid output`);
-	}
-	return requiredOid(normalized.slice(0, -1), label);
-}
-
-function lockOwnerPid(payload: string): number {
-	const match = LOCK_OWNER_PAYLOAD.exec(payload);
-	if (!match || match[0] !== payload) throw new Error("Git worktree lock owner object is invalid");
-	const pid = Number(match[1]);
-	if (!Number.isSafeInteger(pid) || pid <= 0 || String(pid) !== match[1]) {
-		throw new Error("Git worktree lock owner PID is invalid");
-	}
-	return pid;
-}
-
-function ownerIsDead(pid: number): boolean {
-	positiveInteger(pid, "Git worktree lock owner PID");
-	try {
-		process.kill(pid, 0);
-		return false;
-	} catch (error) {
-		return !!error && typeof error === "object" && (error as NodeJS.ErrnoException).code === "ESRCH";
-	}
-}
-
-function zeroOid(oid: string): string {
-	return requiredOid(oid, "Git worktree lock owner OID").replace(/[0-9a-f]/g, "0");
-}
-
-async function readWorktreeLock(cwd: string, lockRef: string, signal?: AbortSignal): Promise<WorktreeLockOwner | null> {
-	const symbolicArgs = ["symbolic-ref", "-q", lockRef];
-	const symbolic = await spawnBounded("git", symbolicArgs, { cwd, signal });
-	if (symbolic.killed || (symbolic.code !== 0 && symbolic.code !== 1)) throw gitFailure(symbolicArgs, symbolic);
-	if (symbolic.code === 0) throw new Error("Git worktree lock ref is symbolic");
-	if (symbolic.stdout !== "" || symbolic.stderr !== "") throw new Error("Git worktree lock symbolic-ref check returned invalid output");
-
-	const refArgs = ["rev-parse", "--verify", "--quiet", lockRef];
-	const ref = await spawnBounded("git", refArgs, { cwd, signal });
-	if (ref.killed || (ref.code !== 0 && ref.code !== 1)) throw gitFailure(refArgs, ref);
-	if (ref.code === 1) {
-		if (ref.stdout !== "" || ref.stderr !== "") throw new Error("Git worktree lock ref lookup returned invalid output");
-		return null;
-	}
-	if (ref.stderr !== "") throw new Error("Git worktree lock ref lookup returned invalid output");
-	const oid = oidLine(ref.stdout, "Git worktree lock ref");
-
-	const objectArgs = ["cat-file", "blob", oid];
-	const object = await runChecked(spawnBounded, "git", objectArgs, {
-		cwd,
-		signal,
-		stdoutLimitBytes: LOCK_OWNER_MAX_BYTES,
-		stderrLimitBytes: LOCK_OWNER_MAX_BYTES,
-	});
-	if (object.stderr !== "") throw new Error("Git worktree lock owner object returned invalid output");
-	return { oid, pid: lockOwnerPid(object.stdout) };
-}
-
-async function updateWorktreeLock(cwd: string, args: string[]): Promise<boolean> {
-	const result = await spawnBounded("git", args, { cwd });
-	if (result.killed) throw gitFailure(args, result);
-	return result.code === 0;
-}
-
-async function createWorktreeLock(cwd: string, lockRef: string, ownerOid: string): Promise<boolean> {
-	return await updateWorktreeLock(cwd, ["update-ref", "--no-deref", lockRef, ownerOid, zeroOid(ownerOid)]);
-}
-
-async function deleteWorktreeLock(cwd: string, lockRef: string, ownerOid: string): Promise<boolean> {
-	return await updateWorktreeLock(cwd, ["update-ref", "--no-deref", "-d", lockRef, ownerOid]);
-}
-
-async function releaseWorktreeLock(cwd: string, lockRef: string, ownerOid: string): Promise<void> {
-	const args = ["update-ref", "--no-deref", "-d", lockRef, ownerOid];
-	const result = await spawnBounded("git", args, { cwd });
-	if (result.killed || result.code !== 0) throw gitFailure(args, result);
-}
-
-async function acquireWorktreeLock(
-	cwd: string,
-	canonical: string,
-	lockRef: string,
-	ownerOid: string,
-	signal?: AbortSignal,
-): Promise<void> {
-	signal?.throwIfAborted();
-	if (await createWorktreeLock(cwd, lockRef, ownerOid)) return;
-	signal?.throwIfAborted();
-	const observed = await readWorktreeLock(cwd, lockRef, signal);
-	if (!observed) throw new Error("Git worktree lock acquisition failed without a competing owner");
-	if (!ownerIsDead(observed.pid)) throw new Error(`Another pi-pr mutation is active for ${canonical}`);
-	signal?.throwIfAborted();
-	const reclaimed = await deleteWorktreeLock(cwd, lockRef, observed.oid);
-	signal?.throwIfAborted();
-	if (await createWorktreeLock(cwd, lockRef, ownerOid)) return;
-	const replacement = await readWorktreeLock(cwd, lockRef, signal);
-	if (!replacement) throw new Error("Git worktree lock disappeared during stale owner recovery");
-	if (!ownerIsDead(replacement.pid)) throw new Error(`Another pi-pr mutation is active for ${canonical}`);
-	if (replacement.oid !== observed.oid) throw new Error("Git worktree lock changed during stale owner recovery");
-	if (!reclaimed) throw new Error("Git worktree stale lock owner could not be reclaimed");
-	throw new Error("Git worktree stale lock owner remained after reclamation");
-}
-
-async function writeWorktreeLockOwner(cwd: string, signal?: AbortSignal): Promise<string> {
-	const pid = positiveInteger(process.pid, "process PID");
-	const nonce = randomUUID();
-	if (!LOCK_NONCE.test(nonce)) throw new Error("Generated Git worktree lock nonce is invalid");
-	const result = await runChecked(spawnBounded, "git", ["hash-object", "-w", "--stdin", "--no-filters"], {
-		cwd,
-		signal,
-		stdin: `pid=${pid}\nnonce=${nonce}\n`,
-	});
-	if (result.stderr !== "") throw new Error("Git worktree lock owner creation returned invalid output");
-	return oidLine(result.stdout, "Git worktree lock owner");
-}
-
-/** Exclude concurrent PR mutations for one canonical worktree and pi-pr namespace with a Git-ref lease. */
+/** Exclude concurrent PR mutations for one canonical worktree and pi-pr namespace. */
 export async function withWorktreeLock<T>(
 	cwd: string,
 	operation: () => Promise<T>,
@@ -409,17 +279,29 @@ export async function withWorktreeLock<T>(
 	if (rootLines.length !== 1 || !rootLines[0]) throw new Error("Git worktree root resolution returned invalid output");
 	const canonical = requiredText(await realpath(rootLines[0]), "canonical Git worktree root");
 	const lockNamespace = resolve(extensionConfigDir("pi-pr", options.agentDir));
-	const identity = createHash("sha256").update(lockNamespace).update("\0").update(canonical).digest("hex");
-	const lockRef = `${LOCK_REF_PREFIX}/${identity}`;
-	const ownerOid = await writeWorktreeLockOwner(canonical, options.signal);
-	let acquired = false;
+	const lockDirectory = join(lockNamespace, "worktree-locks");
+	const identity = createHash("sha256").update(canonical).digest("hex");
+	const lockPath = join(lockDirectory, identity);
+	options.signal?.throwIfAborted();
+	await mkdir(lockDirectory, { recursive: true, mode: 0o700 });
+	options.signal?.throwIfAborted();
+	let release: () => Promise<void>;
+	try {
+		release = await lock(lockPath, {
+			...WORKTREE_LOCK_OPTIONS,
+			lockfilePath: `${lockPath}.lock`,
+		});
+	} catch (error) {
+		if (error && typeof error === "object" && (error as NodeJS.ErrnoException).code === "ELOCKED") {
+			throw new Error("Another pi-pr mutation is active", { cause: error });
+		}
+		throw error;
+	}
 	try {
-		await acquireWorktreeLock(canonical, canonical, lockRef, ownerOid, options.signal);
-		acquired = true;
 		options.signal?.throwIfAborted();
 		return await operation();
 	} finally {
-		if (acquired) await releaseWorktreeLock(canonical, lockRef, ownerOid);
+		await release();
 	}
 }
 
@@ -535,24 +417,7 @@ export async function resolveRepositoryFetchSource(
 	if (!/^[^/\s]+\/[^/\s]+$/.test(repository)) throw new TypeError("repository must be OWNER/REPOSITORY");
 	const protocol = (await runChecked(exec, "gh", ["config", "get", "git_protocol", "--host", host], options)).stdout.trim();
 	if (protocol !== "https" && protocol !== "ssh") throw new Error("GitHub CLI git protocol must be https or ssh");
-	const response = await runChecked(exec, "gh", [
-		"api", "--hostname", host,
-		"-H", "Accept: application/vnd.github+json",
-		"-H", "X-GitHub-Api-Version: 2022-11-28",
-		`repos/${repository}`,
-	], options);
-	let value: unknown;
-	try {
-		value = JSON.parse(response.stdout);
-	} catch {
-		throw new Error("Read repository URLs returned invalid JSON");
-	}
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Read repository URLs returned invalid JSON");
-	const record = value as Record<string, unknown>;
-	const expectedHttps = `https://${host}/${repository}.git`;
-	const expectedSsh = `git@${host}:${repository}.git`;
-	if (record.clone_url !== expectedHttps || record.ssh_url !== expectedSsh) {
-		throw new Error("Read repository URLs did not match frozen repository authority");
-	}
-	return protocol === "https" ? expectedHttps : expectedSsh;
+	return protocol === "https"
+		? `https://${host}/${repository}.git`
+		: `git@${host}:${repository}.git`;
 }

package/extensions/pr-github.ts

@@ -15,7 +15,6 @@ import type {
 	PullRequestLifecycle,
 	PullRequestTarget,
 	ReviewReadiness,
-	PolicyReadiness,
 } from "./pr-routing.ts";
 
 const EXEC_TIMEOUT_MS = 10_000;
@@ -27,7 +26,6 @@ const PR_PUBLICATION_FIELDS = "number,url,state,baseRefName,headRefName,headRefO
 const PR_DISCOVERY_QUERY = "query($owner:String!,$name:String!,$qualifiedName:String!,$endCursor:String){repository(owner:$owner,name:$name){nameWithOwner ref(qualifiedName:$qualifiedName){name associatedPullRequests(first:100,after:$endCursor){totalCount edges{cursor node{__typename number url state baseRepository{nameWithOwner}headRepository{nameWithOwner}headRefName headRefOid}}pageInfo{hasNextPage startCursor endCursor}}}}}";
 const REVIEW_THREADS_QUERY = "query($id:ID!,$endCursor:String){node(id:$id){...on PullRequest{reviewThreads(first:100,after:$endCursor){nodes{isResolved}pageInfo{hasNextPage endCursor}}}}}";
 const BASE_REF_QUERY = "query($owner:String!,$name:String!,$qualifiedName:String!){repository(owner:$owner,name:$name){nameWithOwner ref(qualifiedName:$qualifiedName){name target{oid}}}}";
-const BASE_BRANCH_POLICY_QUERY = "query($owner:String!,$name:String!,$qualifiedName:String!){repository(owner:$owner,name:$name){nameWithOwner ref(qualifiedName:$qualifiedName){name branchProtectionRule{requiresStrictStatusChecks}}}}";
 const OID = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i;
 const FAILED_CHECK_STATES = new Set([
 	"ACTION_REQUIRED",
@@ -60,7 +58,6 @@ const MERGE_STATE_VALUES = new Set([
 	"UNSTABLE",
 ]);
 const REVIEW_DECISION_VALUES = new Set(["APPROVED", "CHANGES_REQUESTED", "REVIEW_REQUIRED"]);
-const MERGE_METHODS: MergeMethod[] = ["merge", "rebase", "squash"];
 
 export class PullRequestLoadError extends Error {
 	constructor(message: string) {
@@ -75,13 +72,6 @@ export type PullRequestRef = {
 	oid: string;
 };
 
-export type MergeMethod = "merge" | "rebase" | "squash";
-
-export type PullRequestMerge = {
-	allowedMergeMethods: MergeMethod[];
-	viewerDefaultMergeMethod: MergeMethod;
-};
-
 export type CurrentPullRequest = PullRequest & {
 	id: string;
 	number: number;
@@ -92,7 +82,6 @@ export type CurrentPullRequest = PullRequest & {
 	head: PullRequestRef;
 	headFetchSource: string;
 	target: PullRequestTarget;
-	merge: PullRequestMerge | null;
 };
 
 export type CurrentPullRequestDiscovery = PullRequestDiscovery<CurrentPullRequest>;
@@ -118,6 +107,10 @@ export type PullRequestCreationPreflight = {
 	ahead: number;
 };
 
+type CreationPreflightResult =
+	| { kind: "same-ref" }
+	| { kind: "distinct-ref"; preflight: PullRequestCreationPreflight };
+
 type CreationIdentity = {
 	target: PullRequestTarget;
 	head: string;
@@ -225,11 +218,6 @@ type SearchPage = {
 	endCursor: string | null;
 };
 
-type RulesetBranchPolicy = {
-	requiresStrictStatusChecks: boolean;
-	allowedMergeMethods: MergeMethod[] | null;
-};
-
 type CheckState = {
 	state: string;
 	diagnosableFailure: boolean;
@@ -894,7 +882,6 @@ function ciStatus(checks: CheckState[]): CiStatus {
 function conditions(
 	candidate: ListedPullRequest,
 	unresolvedThreads: number,
-	requiresStrictStatusChecks: boolean,
 ): PullRequestConditions {
 	if (
 		(candidate.mergeable === "MERGEABLE" && candidate.mergeStateStatus === "DIRTY") ||
@@ -904,19 +891,17 @@ function conditions(
 		? "pending"
 		: "ready";
 	const behind = candidate.mergeStateStatus === "BEHIND";
-	const policy: PolicyReadiness = candidate.mergeable === "MERGEABLE" &&
-		(candidate.mergeStateStatus === "CLEAN" || (behind && !requiresStrictStatusChecks))
-		? "ready"
-		: "pending";
 	return {
 		draft: candidate.isDraft,
-		baseUpdateRequired: behind && requiresStrictStatusChecks,
+		baseUpdateRequired: behind,
 		conflict: candidate.mergeable === "CONFLICTING" || candidate.mergeStateStatus === "DIRTY",
 		changesRequested: candidate.reviewDecision === "CHANGES_REQUESTED",
 		unresolvedThreads,
 		ci: ciStatus(candidate.checkStates),
 		review,
-		policy,
+		policy: candidate.mergeable === "MERGEABLE" && candidate.mergeStateStatus === "CLEAN"
+			? "ready"
+			: "pending",
 	};
 }
 
@@ -983,100 +968,27 @@ function parseBaseRefOid(output: string, candidate: ListedPullRequest): string {
 	return parseBaseRefAuthority(output, candidate.base);
 }
 
-function parseLegacyBaseBranchPolicy(output: string, candidate: ListedPullRequest): boolean {
-	const value = parseJson(output, "Read base branch policy");
-	if (!isRecord(value)) fail("Read base branch policy", "invalid GitHub CLI output");
-	if (value.errors !== undefined) {
-		if (!Array.isArray(value.errors)) fail("Read base branch policy", "invalid GitHub CLI output");
-		if (value.errors.length) fail("Read base branch policy", "GitHub GraphQL returned errors");
-	}
-	const repository = isRecord(value.data) ? value.data.repository : undefined;
-	if (!isRecord(repository) || !isRecord(repository.ref)) {
-		fail("Read base branch policy", "invalid GitHub CLI output");
-	}
-	if (
-		normalizeRepository(repositoryName(repository.nameWithOwner, "Read base branch policy", "repository")) !==
-		normalizeRepository(candidate.base.repository) ||
-		text(repository.ref.name, "Read base branch policy", "ref") !== candidate.base.ref
-	) fail("Read base branch policy", "response does not match pull request base");
-	const rule = repository.ref.branchProtectionRule;
-	if (rule === null) return false;
-	if (!isRecord(rule) || typeof rule.requiresStrictStatusChecks !== "boolean") {
-		fail("Read base branch policy", "invalid GitHub CLI output");
-	}
-	return rule.requiresStrictStatusChecks;
-}
-
-function parseRulesetBaseBranchPolicy(output: string): RulesetBranchPolicy {
-	const pages = parseJson(output, "Read base branch rulesets");
-	if (!Array.isArray(pages) || !pages.length) fail("Read base branch rulesets", "invalid GitHub CLI output");
-	let requiresStrictStatusChecks = false;
-	let allowedMergeMethods: Set<MergeMethod> | null = null;
-	for (const page of pages) {
-		if (!Array.isArray(page)) fail("Read base branch rulesets", "invalid GitHub CLI output");
-		for (const rule of page) {
-			if (!isRecord(rule)) fail("Read base branch rulesets", "invalid GitHub CLI output");
-			const type = text(rule.type, "Read base branch rulesets", "rule type");
-			if (type === "required_status_checks") {
-				if (!isRecord(rule.parameters) || typeof rule.parameters.strict_required_status_checks_policy !== "boolean") {
-					fail("Read base branch rulesets", "invalid GitHub CLI output");
-				}
-				requiresStrictStatusChecks ||= rule.parameters.strict_required_status_checks_policy;
-			}
-			if (type === "pull_request") {
-				if (!isRecord(rule.parameters) || !Array.isArray(rule.parameters.allowed_merge_methods)) {
-					fail("Read base branch rulesets", "invalid GitHub CLI output");
-				}
-				const methods = rule.parameters.allowed_merge_methods;
-				if (
-					methods.some((method) => typeof method !== "string" || !MERGE_METHODS.includes(method as MergeMethod)) ||
-					new Set(methods).size !== methods.length
-				) fail("Read base branch rulesets", "invalid GitHub CLI output");
-				const restriction = new Set<MergeMethod>(methods as MergeMethod[]);
-				allowedMergeMethods = allowedMergeMethods === null
-					? restriction
-					: new Set<MergeMethod>([...allowedMergeMethods].filter((method: MergeMethod) => restriction.has(method)));
-			}
-		}
-	}
-	return {
-		requiresStrictStatusChecks,
-		allowedMergeMethods: allowedMergeMethods === null
-			? null
-			: MERGE_METHODS.filter((method) => allowedMergeMethods.has(method)),
-	};
-}
-
-function parseMergeMethodSettings(output: string, rulesetMethods: MergeMethod[] | null): PullRequestMerge {
-	const value = parseJson(output, "Read merge methods");
-	if (!isRecord(value)) fail("Read merge methods", "invalid GitHub CLI output");
-	const { mergeCommitAllowed, rebaseMergeAllowed, squashMergeAllowed } = value;
-	if (
-		typeof mergeCommitAllowed !== "boolean" || typeof rebaseMergeAllowed !== "boolean" ||
-		typeof squashMergeAllowed !== "boolean"
-	) fail("Read merge methods", "invalid GitHub CLI output");
-	let allowedMergeMethods: MergeMethod[] = [];
-	if (mergeCommitAllowed) allowedMergeMethods.push("merge");
-	if (rebaseMergeAllowed) allowedMergeMethods.push("rebase");
-	if (squashMergeAllowed) allowedMergeMethods.push("squash");
-	if (!allowedMergeMethods.length) fail("Read merge methods", "repository allows no merge method");
-	const viewerDefaultMergeMethod = value.viewerDefaultMergeMethod === "MERGE"
-		? "merge"
-		: value.viewerDefaultMergeMethod === "REBASE"
-		? "rebase"
-		: value.viewerDefaultMergeMethod === "SQUASH"
-		? "squash"
-		: fail("Read merge methods", "invalid viewerDefaultMergeMethod");
-	if (!allowedMergeMethods.includes(viewerDefaultMergeMethod)) {
-		fail("Read merge methods", "viewerDefaultMergeMethod is not allowed");
-	}
-	if (rulesetMethods !== null) {
-		allowedMergeMethods = allowedMergeMethods.filter((method) => rulesetMethods.includes(method));
-	}
-	if (!allowedMergeMethods.length) {
-		fail("Read merge methods", "repository and applicable rules allow no common merge method");
-	}
-	return { allowedMergeMethods, viewerDefaultMergeMethod };
+export async function hasLocalCommit(
+	pi: Pick<ExtensionAPI, "exec">,
+	context: PullRequestLoadContext,
+): Promise<boolean> {
+	const branch = singleLine(
+		(await execute(pi, context, "Read current branch", "git", ["branch", "--show-current"])).stdout,
+		"Read current branch",
+		"branch",
+	);
+	const output = (await execute(pi, context, "Read branch history", "git", [
+		"reflog",
+		"show",
+		"--format=%H",
+		`refs/heads/${branch}`,
+	])).stdout.replace(/\r\n/g, "\n");
+	const entries = output.split("\n");
+	if (entries.at(-1) === "") entries.pop();
+	if (!entries.length) fail("Read branch history", "missing branch creation entry");
+	const commits = entries.map((entry) => oid(entry, "Read branch history", "commit"));
+	// ponytail: reflog expiry can hide old branch history; resolve the PR base if this becomes observable.
+	return commits[0] !== commits.at(-1);
 }
 
 function validatedCreationTarget(target: PullRequestTarget): PullRequestTarget {
@@ -1196,19 +1108,18 @@ function parseCreationRepositoryLineage(output: string, expected: PushRepository
 	return normalizeRepository(sourceName);
 }
 
-async function assertCreationRepositoryRelation(
+async function inspectCreationRepositoryRelation(
 	pi: Pick<ExtensionAPI, "exec">,
 	context: PullRequestLoadContext,
 	target: PullRequestTarget,
 	origin: { repository: PushRepository },
 	baseRef: string,
-): Promise<void> {
+): Promise<"same-ref" | "distinct-ref"> {
 	if (target.host !== origin.repository.host) {
 		fail("Read creation repository", "base and head hosts do not match");
 	}
 	if (normalizeRepository(target.repository) === origin.repository.normalizedName) {
-		if (target.ref === baseRef) fail("Read creation repository", "head and base refs match");
-		return;
+		return target.ref === baseRef ? "same-ref" : "distinct-ref";
 	}
 	const read = async (repository: PushRepository): Promise<string> => {
 		const [owner, name] = repository.nameWithOwner.split("/");
@@ -1225,6 +1136,7 @@ async function assertCreationRepositoryRelation(
 		host: target.host,
 	});
 	if (originSource !== targetSource) fail("Read creation repository", "base and head are unrelated");
+	return "distinct-ref";
 }
 
 function parseCreationAhead(output: string): number {
@@ -1241,7 +1153,7 @@ async function preflightCreation(
 	target: PullRequestTarget,
 	explicitBaseRef: string | undefined,
 	identity: CreationIdentity,
-): Promise<PullRequestCreationPreflight> {
+): Promise<CreationPreflightResult> {
 	const validatedTarget = validatedCreationTarget(target);
 	if (!sameCreationTarget(identity.target, validatedTarget)) {
 		fail("Read creation target", "target changed");
@@ -1252,7 +1164,8 @@ async function preflightCreation(
 		? await readConfiguredCreationBaseRef(pi, context, identity.target.branch)
 		: await validateCreationRef(pi, context, explicitBaseRef);
 	const baseRef = configuredBaseRef ?? await readDefaultCreationBaseRef(pi, context, origin);
-	await assertCreationRepositoryRelation(pi, context, identity.target, origin, baseRef);
+	const relation = await inspectCreationRepositoryRelation(pi, context, identity.target, origin, baseRef);
+	if (relation === "same-ref") return { kind: relation };
 	const trackingRef = `refs/remotes/origin/${baseRef}`;
 	await execute(pi, context, "Fetch creation base", "git", [
 		"fetch", "--no-write-fetch-head", "--no-tags", "--no-recurse-submodules", "--",
@@ -1272,16 +1185,19 @@ async function preflightCreation(
 		"rev-list", "--count", `${mergeBase}..${identity.head}`,
 	])).stdout);
 	return {
-		head: identity.head,
-		base: {
-			host: origin.repository.host,
-			repository: origin.repository.nameWithOwner,
-			fetchSource: origin.fetchSource,
-			ref: baseRef,
-			oid: baseOid,
-			mergeBase,
+		kind: relation,
+		preflight: {
+			head: identity.head,
+			base: {
+				host: origin.repository.host,
+				repository: origin.repository.nameWithOwner,
+				fetchSource: origin.fetchSource,
+				ref: baseRef,
+				oid: baseOid,
+				mergeBase,
+			},
+			ahead,
 		},
-		ahead,
 	};
 }
 
@@ -1292,7 +1208,9 @@ export async function preflightPullRequestCreation(
 	explicitBaseRef?: string,
 ): Promise<PullRequestCreationPreflight> {
 	const identity = await captureCreationIdentity(pi, context, target);
-	return await preflightCreation(pi, context, target, explicitBaseRef, identity);
+	const result = await preflightCreation(pi, context, target, explicitBaseRef, identity);
+	if (result.kind === "same-ref") fail("Read creation repository", "head and base refs match");
+	return result.preflight;
 }
 
 async function creationDiscovery(
@@ -1303,8 +1221,12 @@ async function creationDiscovery(
 	identity?: CreationIdentity,
 ): Promise<CurrentPullRequestDiscovery> {
 	const captured = identity ?? await captureCreationIdentity(pi, context, target);
-	const preflight = await preflightCreation(pi, context, target, explicitBaseRef, captured);
-	return { kind: "none", creationTarget: target, branch: { ahead: preflight.ahead } };
+	const result = await preflightCreation(pi, context, target, explicitBaseRef, captured);
+	return {
+		kind: "none",
+		creationTarget: target,
+		branch: { ahead: result.kind === "same-ref" ? 0 : result.preflight.ahead },
+	};
 }
 
 async function readRemoteAuthority(
@@ -1690,66 +1612,6 @@ export async function readPullRequestBaseRefOid(
 	return parseBaseRefAuthority(result.stdout, { repository, ref });
 }
 
-async function readLegacyBaseBranchPolicy(
-	pi: Pick<ExtensionAPI, "exec">,
-	context: PullRequestLoadContext,
-	candidate: ListedPullRequest,
-): Promise<boolean> {
-	const [owner, name] = candidate.base.repository.split("/");
-	const result = await execute(pi, context, "Read base branch policy", "gh", [
-		"api",
-		"graphql",
-		"--hostname",
-		candidate.url.hostname,
-		"-f",
-		`query=${BASE_BRANCH_POLICY_QUERY}`,
-		"-F",
-		`owner=${owner}`,
-		"-F",
-		`name=${name}`,
-		"-F",
-		`qualifiedName=refs/heads/${candidate.base.ref}`,
-	]);
-	return parseLegacyBaseBranchPolicy(result.stdout, candidate);
-}
-
-async function readRulesetBaseBranchPolicy(
-	pi: Pick<ExtensionAPI, "exec">,
-	context: PullRequestLoadContext,
-	candidate: ListedPullRequest,
-): Promise<RulesetBranchPolicy> {
-	const [owner, name] = candidate.base.repository.split("/");
-	const result = await execute(pi, context, "Read base branch rulesets", "gh", [
-		"api",
-		"--hostname",
-		candidate.url.hostname,
-		"--paginate",
-		"--slurp",
-		"-H",
-		"Accept: application/vnd.github+json",
-		"-H",
-		"X-GitHub-Api-Version: 2022-11-28",
-		`repos/${owner}/${name}/rules/branches/${encodeURIComponent(candidate.base.ref)}`,
-	]);
-	return parseRulesetBaseBranchPolicy(result.stdout);
-}
-
-async function readMergeMethods(
-	pi: Pick<ExtensionAPI, "exec">,
-	context: PullRequestLoadContext,
-	candidate: ListedPullRequest,
-	rulesetMethods: MergeMethod[] | null,
-): Promise<PullRequestMerge> {
-	const result = await execute(pi, context, "Read merge methods", "gh", [
-		"repo",
-		"view",
-		`${candidate.url.hostname}/${candidate.base.repository}`,
-		"--json",
-		"mergeCommitAllowed,rebaseMergeAllowed,squashMergeAllowed,viewerDefaultMergeMethod",
-	]);
-	return parseMergeMethodSettings(result.stdout, rulesetMethods);
-}
-
 async function loadPullRequestDetails(
 	pi: Pick<ExtensionAPI, "exec">,
 	context: PullRequestLoadContext,
@@ -1768,17 +1630,7 @@ async function loadPullRequestDetails(
 	const liveBaseOid = candidate.lifecycle === "open"
 		? await readBaseRefOid(pi, context, candidate)
 		: null;
-	const rulesetPolicy = candidate.lifecycle === "open"
-		? await readRulesetBaseBranchPolicy(pi, context, candidate)
-		: null;
-	const legacyStrict = candidate.lifecycle === "open" && candidate.mergeStateStatus === "BEHIND"
-		? await readLegacyBaseBranchPolicy(pi, context, candidate)
-		: false;
-	const requiresStrictStatusChecks = legacyStrict || (rulesetPolicy?.requiresStrictStatusChecks ?? false);
-	const pullRequestConditions = conditions(candidate, unresolvedThreads, requiresStrictStatusChecks);
-	const merge = candidate.lifecycle === "open"
-		? await readMergeMethods(pi, context, candidate, rulesetPolicy?.allowedMergeMethods ?? null)
-		: null;
+	const pullRequestConditions = conditions(candidate, unresolvedThreads);
 	const inspected = inspectedLocal ?? await inspectLocalMergeSafety({
 		exec: (command, args, options) => pi.exec(command, args, {
 			...options,
@@ -1803,7 +1655,6 @@ async function loadPullRequestDetails(
 		head: candidate.head,
 		headFetchSource: pushTarget.fetchSource,
 		target: publicTarget(pushTarget),
-		merge,
 	};
 }