@humanbased/crosscheck 1.2.0-beta.81 → 1.3.0-beta.100

package/dist/github/detector.js

@@ -1,7 +1,30 @@
 import { getPRCommits } from './client.js';
 import { checkCodexAuth } from '../reviewers/codex.js';
 import { checkClaudeAuth } from '../reviewers/claude.js';
-// Applies codex_reviews_patterns / claude_reviews_patterns against a single text block.
+// Crosscheck's own attribution on work crosscheck wrote. Not part of
+// routing.*_reviews_patterns on purpose: Zod defaults apply only when a field is
+// absent, so an install that pinned its own pattern list would never receive
+// these and would keep reading its own fix PRs as human. This is a fact about
+// output crosscheck produced — same footing as the annotation contract — not a
+// routing preference, so it is always checked.
+//
+// Authorship only. The 'Reviewed' footer says who looked at the code and the
+// 'Attempted' footer marks a fix that failed and produced nothing; neither is
+// evidence of authorship, and matching them would route every reviewed PR back
+// to the other vendor as if it were agent-authored.
+const SELF_AUTHORED_PATTERNS = [
+    // Fix-PR body footer — buildAttributionFooter({ action: 'Fixed', ... }).
+    { pattern: /Fixed with \[Claude Code\]/i, origin: 'claude' },
+    { pattern: /Fixed with \[OpenAI Codex\]/i, origin: 'codex' },
+    // Commit trailer — buildCommitTrailers on fix and conflict-resolve commits.
+    // Anchored to its own line: the field name is quoted in prose (this repo's
+    // changelog and docs do it), and prose is not a trailer.
+    { pattern: /^Crosscheck-Reviewer:[^\S\n]*claude[^\S\n]*$/im, origin: 'claude' },
+    { pattern: /^Crosscheck-Reviewer:[^\S\n]*codex[^\S\n]*$/im, origin: 'codex' },
+];
+// Applies codex_reviews_patterns / claude_reviews_patterns against a single text
+// block, then crosscheck's own always-on markers. Configured patterns are
+// checked first: they are explicit routing intent and outrank the default.
 // Returns the detected origin or null if nothing matched.
 function matchPatterns(text, config) {
     for (const pattern of config.routing.codex_reviews_patterns) {
@@ -12,6 +35,10 @@ function matchPatterns(text, config) {
         if (new RegExp(pattern, 'i').test(text))
             return 'codex';
     }
+    for (const { pattern, origin } of SELF_AUTHORED_PATTERNS) {
+        if (pattern.test(text))
+            return origin;
+    }
     return null;
 }
 // Step 1 — PR body patterns

package/dist/github/detector.js.map

@@ -1 +1 @@
-{"version":3,"file":"detector.js","sourceRoot":"","sources":["../../src/github/detector.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAIxD,wFAAwF;AACxF,0DAA0D;AAC1D,SAAS,aAAa,CAAC,IAAY,EAAE,MAAc;IACjD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;QAC5D,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,QAAQ,CAAA;IAC1D,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC;QAC7D,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,OAAO,CAAA;IACzD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,4BAA4B;AAC5B,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAc;IACjE,OAAO,aAAa,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,CAAC,CAAA;AAC5C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,uBAAuB,CAAC,QAAkB,EAAE,MAAc;IACxE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACzC,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAA;IACpC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,8BAA8B;AAC9B,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,MAAc;IACpE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;QAC3D,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,QAAQ,CAAA;IACjD,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;QAC1D,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,OAAO,CAAA;IAChD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,wEAAwE;AACxE,gFAAgF;AAChF,EAAE;AACF,0CAA0C;AAC1C,uFAAuF;AACvF,yEAAyE;AACzE,uFAAuF;AACvF,oFAAoF;AACpF,oFAAoF;AACpF,iFAAiF;AACjF,kBAAkB;AAClB,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,OAAe,EACf,KAAa,EACb,IAAY,EACZ,QAAgB,EAChB,MAAc,EACd,KAAa,EACb,MAAe;IAEf,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrD,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;IAElE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;QACjE,MAAM,WAAW,GAAG,uBAAuB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC7D,IAAI,WAAW,KAAK,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC7E,CAAC;IAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;IAE5C,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC1D,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAExE,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,KAAK,cAAc;eAC7C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO;eAC7B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAA;QACjC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;QAClF,CAAC;QACD,8EAA8E;QAC9E,wDAAwD;QACxD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAA;IAC9D,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AAC5C,CAAC;AAED,gEAAgE;AAChE,iDAAiD;AACjD,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,MAAc,EAAE,MAAe;IAC5E,OAAO,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC;WACtC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;WAChE,OAAO,CAAA;AACd,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAc;IAC3C,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAA;IAC3C,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC5B,IAAI,EAAE,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IACxE,IAAI,EAAE,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;IACxF,IAAI,SAAS,CAAC,EAAE;QAAE,OAAO,OAAO,CAAA;IAChC,IAAI,UAAU,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAA;IAClC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAgB,EAAE,MAAc;IACnE,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,OAAO,CAAA;QAChD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,OAAO,CAAA;IACvE,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAA;IACxE,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAA;IACtD,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"detector.js","sourceRoot":"","sources":["../../src/github/detector.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAIxD,qEAAqE;AACrE,iFAAiF;AACjF,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,+CAA+C;AAC/C,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,oDAAoD;AACpD,MAAM,sBAAsB,GAAyD;IACnF,yEAAyE;IACzE,EAAE,OAAO,EAAE,6BAA6B,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC5D,EAAE,OAAO,EAAE,8BAA8B,EAAE,MAAM,EAAE,OAAO,EAAE;IAC5D,4EAA4E;IAC5E,2EAA2E;IAC3E,yDAAyD;IACzD,EAAE,OAAO,EAAE,gDAAgD,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC/E,EAAE,OAAO,EAAE,+CAA+C,EAAE,MAAM,EAAE,OAAO,EAAE;CAC9E,CAAA;AAED,iFAAiF;AACjF,0EAA0E;AAC1E,2EAA2E;AAC3E,0DAA0D;AAC1D,SAAS,aAAa,CAAC,IAAY,EAAE,MAAc;IACjD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;QAC5D,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,QAAQ,CAAA;IAC1D,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC;QAC7D,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,OAAO,CAAA;IACzD,CAAC;IACD,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,sBAAsB,EAAE,CAAC;QACzD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAA;IACvC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,4BAA4B;AAC5B,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAc;IACjE,OAAO,aAAa,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,CAAC,CAAA;AAC5C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,uBAAuB,CAAC,QAAkB,EAAE,MAAc;IACxE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACzC,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAA;IACpC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,8BAA8B;AAC9B,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,MAAc;IACpE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;QAC3D,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,QAAQ,CAAA;IACjD,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;QAC1D,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,OAAO,CAAA;IAChD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,wEAAwE;AACxE,gFAAgF;AAChF,EAAE;AACF,0CAA0C;AAC1C,uFAAuF;AACvF,yEAAyE;AACzE,uFAAuF;AACvF,oFAAoF;AACpF,oFAAoF;AACpF,iFAAiF;AACjF,kBAAkB;AAClB,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,OAAe,EACf,KAAa,EACb,IAAY,EACZ,QAAgB,EAChB,MAAc,EACd,KAAa,EACb,MAAe;IAEf,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrD,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;IAElE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;QACjE,MAAM,WAAW,GAAG,uBAAuB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC7D,IAAI,WAAW,KAAK,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC7E,CAAC;IAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;IAE5C,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC1D,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAExE,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,KAAK,cAAc;eAC7C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO;eAC7B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAA;QACjC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;QAClF,CAAC;QACD,8EAA8E;QAC9E,wDAAwD;QACxD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAA;IAC9D,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AAC5C,CAAC;AAED,gEAAgE;AAChE,iDAAiD;AACjD,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,MAAc,EAAE,MAAe;IAC5E,OAAO,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC;WACtC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;WAChE,OAAO,CAAA;AACd,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAc;IAC3C,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAA;IAC3C,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC5B,IAAI,EAAE,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IACxE,IAAI,EAAE,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;IACxF,IAAI,SAAS,CAAC,EAAE;QAAE,OAAO,OAAO,CAAA;IAChC,IAAI,UAAU,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAA;IAClC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAgB,EAAE,MAAc;IACnE,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,OAAO,CAAA;QAChD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,OAAO,CAAA;IACvE,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAA;IACxE,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAA;IACtD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/github/merge.d.ts

@@ -1,9 +1,4 @@
 import type { Octokit } from 'octokit';
 import type { PRMergeSummary } from '../lib/pr-status.js';
-export type MergeMethod = 'merge' | 'squash' | 'rebase';
 export declare function getPRMergeSummary(octokit: Octokit, owner: string, repo: string, pullNumber: number, baseRef: string): Promise<PRMergeSummary>;
-export declare function mergePullRequest(octokit: Octokit, owner: string, repo: string, pullNumber: number, options: {
-    method: MergeMethod;
-    expectedHeadSha?: string;
-}): Promise<void>;
 //# sourceMappingURL=merge.d.ts.map

package/dist/github/merge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"merge.d.ts","sourceRoot":"","sources":["../../src/github/merge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEzD,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAEvD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,cAAc,CAAC,CAezB;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,GACzD,OAAO,CAAC,IAAI,CAAC,CAQf"}
+{"version":3,"file":"merge.d.ts","sourceRoot":"","sources":["../../src/github/merge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEzD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,cAAc,CAAC,CAezB"}

package/dist/github/merge.js

@@ -12,15 +12,6 @@ export async function getPRMergeSummary(octokit, owner, repo, pullNumber, baseRe
         protectedBase,
     };
 }
-export async function mergePullRequest(octokit, owner, repo, pullNumber, options) {
-    await octokit.rest.pulls.merge({
-        owner,
-        repo,
-        pull_number: pullNumber,
-        merge_method: options.method,
-        ...(options.expectedHeadSha && { sha: options.expectedHeadSha }),
-    });
-}
 async function getProtectedBase(octokit, owner, repo, branch) {
     try {
         const { data } = await octokit.rest.repos.getBranch({ owner, repo, branch });

package/dist/github/merge.js.map

@@ -1 +1 @@
-{"version":3,"file":"merge.js","sourceRoot":"","sources":["../../src/github/merge.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,UAAkB,EAClB,OAAe;IAEf,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;QAChE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC;KAChD,CAAC,CAAA;IAEF,MAAM,gBAAgB,GAAG,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ;QAC/D,CAAC,CAAC,IAAI,CAAC,eAAe;QACtB,CAAC,CAAC,SAAS,CAAA;IAEb,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,GAAG,CAAC,gBAAgB,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAC7C,aAAa;KACd,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,UAAkB,EAClB,OAA0D;IAE1D,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAC7B,KAAK;QACL,IAAI;QACJ,WAAW,EAAE,UAAU;QACvB,YAAY,EAAE,OAAO,CAAC,MAAM;QAC5B,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;KACjE,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;QAC5E,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}
+{"version":3,"file":"merge.js","sourceRoot":"","sources":["../../src/github/merge.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,UAAkB,EAClB,OAAe;IAEf,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;QAChE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC;KAChD,CAAC,CAAA;IAEF,MAAM,gBAAgB,GAAG,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ;QAC/D,CAAC,CAAC,IAAI,CAAC,eAAe;QACtB,CAAC,CAAC,SAAS,CAAA;IAEb,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,GAAG,CAAC,gBAAgB,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAC7C,aAAa;KACd,CAAA;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;QAC5E,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/github/reviewed-sha.d.ts

@@ -0,0 +1,13 @@
+import type { Octokit } from 'octokit';
+export type ReviewedShaStatus = 'head' | 'ancestor' | 'descendant' | 'unknown_commit' | 'diverged' | 'unverifiable';
+export interface ReviewedShaVerification {
+    status: ReviewedShaStatus;
+    /** The PR head at verification time, freshly read — `pr.head.sha` goes stale after a fix push. */
+    headSha: string | null;
+    /** Populated for `unverifiable`, to name the API failure in the error. */
+    error?: string;
+}
+export declare function isVerifiedReviewedSha(status: ReviewedShaStatus): boolean;
+export declare function verifyReviewedSha(octokit: Octokit, owner: string, repo: string, pullNumber: number, sha: string): Promise<ReviewedShaVerification>;
+export declare function reviewedShaRejection(verification: ReviewedShaVerification, sha: string, verdict: string | null): string;
+//# sourceMappingURL=reviewed-sha.d.ts.map

package/dist/github/reviewed-sha.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reviewed-sha.d.ts","sourceRoot":"","sources":["../../src/github/reviewed-sha.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAYtC,MAAM,MAAM,iBAAiB,GAEzB,MAAM,GACN,UAAU,GACV,YAAY,GAQZ,gBAAgB,GAChB,UAAU,GACV,cAAc,CAAA;AAElB,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,iBAAiB,CAAA;IACzB,kGAAkG;IAClG,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAExE;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,uBAAuB,CAAC,CAkClC;AAED,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,uBAAuB,EACrC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB,MAAM,CAaR"}

package/dist/github/reviewed-sha.js

@@ -0,0 +1,62 @@
+export function isVerifiedReviewedSha(status) {
+    return status === 'head' || status === 'ancestor' || status === 'descendant';
+}
+export async function verifyReviewedSha(octokit, owner, repo, pullNumber, sha) {
+    let headSha;
+    try {
+        const { data: pull } = await octokit.rest.pulls.get({ owner, repo, pull_number: pullNumber });
+        headSha = pull.head.sha;
+    }
+    catch (err) {
+        return { status: 'unverifiable', headSha: null, error: errorText(err) };
+    }
+    if (sha === headSha)
+        return { status: 'head', headSha };
+    // compareCommits with the reviewed sha as base answers both questions in one call:
+    // a 404 means the sha does not resolve in this repo, and the status says how the two
+    // commits are related.
+    try {
+        const { data: comparison } = await octokit.rest.repos.compareCommits({
+            owner, repo, base: sha, head: headSha,
+        });
+        switch (comparison.status) {
+            // 'identical' — short and long sha of the same commit.
+            case 'identical':
+            // 'ahead' — the head is ahead of the reviewed sha, i.e. the sha is an ancestor.
+            case 'ahead':
+                return { status: 'ancestor', headSha };
+            // 'behind' — the head is behind the reviewed sha, i.e. the sha descends from it.
+            case 'behind':
+                return { status: 'descendant', headSha };
+            default:
+                return { status: 'diverged', headSha };
+        }
+    }
+    catch (err) {
+        if (statusCode(err) === 404)
+            return { status: 'unknown_commit', headSha };
+        return { status: 'unverifiable', headSha, error: errorText(err) };
+    }
+}
+export function reviewedShaRejection(verification, sha, verdict) {
+    const subject = `${verdict ?? 'verdict'} not posted`;
+    const head = verification.headSha ?? 'unknown';
+    switch (verification.status) {
+        case 'unknown_commit':
+            return `${subject}: reviewed commit ${sha} does not exist in the repository — the reviewed tree was never pushed (PR head is ${head}). Re-run once the commit has landed.`;
+        case 'diverged':
+            return `${subject}: reviewed commit ${sha} shares no history with the PR head ${head} — the verdict describes code this PR would not merge.`;
+        case 'unverifiable':
+            return `${subject}: could not verify reviewed commit ${sha} against the repository — ${verification.error ?? 'unknown error'}.`;
+        default:
+            return `${subject}: reviewed commit ${sha} failed verification.`;
+    }
+}
+function statusCode(err) {
+    const status = err?.status;
+    return typeof status === 'number' ? status : undefined;
+}
+function errorText(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=reviewed-sha.js.map

package/dist/github/reviewed-sha.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reviewed-sha.js","sourceRoot":"","sources":["../../src/github/reviewed-sha.ts"],"names":[],"mappings":"AAoCA,MAAM,UAAU,qBAAqB,CAAC,MAAyB;IAC7D,OAAO,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,YAAY,CAAA;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,UAAkB,EAClB,GAAW;IAEX,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAA;QAC7F,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;IACzB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAA;IACzE,CAAC;IAED,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAEvD,mFAAmF;IACnF,qFAAqF;IACrF,uBAAuB;IACvB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;YACnE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO;SACtC,CAAC,CAAA;QACF,QAAQ,UAAU,CAAC,MAAM,EAAE,CAAC;YAC1B,uDAAuD;YACvD,KAAK,WAAW,CAAC;YACjB,gFAAgF;YAChF,KAAK,OAAO;gBACV,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;YACxC,iFAAiF;YACjF,KAAK,QAAQ;gBACX,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAA;YAC1C;gBACE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;QAC1C,CAAC;IACH,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAA;QACzE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAA;IACnE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,YAAqC,EACrC,GAAW,EACX,OAAsB;IAEtB,MAAM,OAAO,GAAG,GAAG,OAAO,IAAI,SAAS,aAAa,CAAA;IACpD,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,IAAI,SAAS,CAAA;IAC9C,QAAQ,YAAY,CAAC,MAAM,EAAE,CAAC;QAC5B,KAAK,gBAAgB;YACnB,OAAO,GAAG,OAAO,qBAAqB,GAAG,sFAAsF,IAAI,uCAAuC,CAAA;QAC5K,KAAK,UAAU;YACb,OAAO,GAAG,OAAO,qBAAqB,GAAG,uCAAuC,IAAI,wDAAwD,CAAA;QAC9I,KAAK,cAAc;YACjB,OAAO,GAAG,OAAO,sCAAsC,GAAG,6BAA6B,YAAY,CAAC,KAAK,IAAI,eAAe,GAAG,CAAA;QACjI;YACE,OAAO,GAAG,OAAO,qBAAqB,GAAG,uBAAuB,CAAA;IACpE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,MAAM,GAAI,GAA4B,EAAE,MAAM,CAAA;IACpD,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC"}

package/dist/github/superseded-fix-pr.d.ts

@@ -0,0 +1,19 @@
+import type { Octokit } from 'octokit';
+export declare function autoFixBranchName(sourcePrNumber: number): string;
+export declare function autoFixPRIntro(sourcePrNumber: number): string;
+export declare function isCrosscheckAutoFixPR(body: string | null | undefined, sourcePrNumber: number): boolean;
+export declare function buildSupersededComment(input: {
+    owner: string;
+    repo: string;
+    sourcePrNumber: number;
+    mergeCommitSha: string | null;
+}): string;
+export type SupersedeStatus = 'closed' | 'not_crosscheck' | 'failed';
+export interface SupersedeOutcome {
+    prNumber: number;
+    status: SupersedeStatus;
+    reason?: string;
+}
+export declare function sourcePRHasMerged(octokit: Octokit, owner: string, repo: string, sourcePrNumber: number): Promise<boolean>;
+export declare function closeSupersededAutoFixPRs(octokit: Octokit, owner: string, repo: string, sourcePrNumber: number, mergeCommitSha: string | null): Promise<SupersedeOutcome[]>;
+//# sourceMappingURL=superseded-fix-pr.d.ts.map

package/dist/github/superseded-fix-pr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"superseded-fix-pr.d.ts","sourceRoot":"","sources":["../../src/github/superseded-fix-pr.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAatC,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAEhE;AAID,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAE7D;AAID,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAEtG;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B,GAAG,MAAM,CAaT;AAED,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,gBAAgB,GAAG,QAAQ,CAAA;AAEpE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,eAAe,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAeD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAOlB;AAWD,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,GAAG,IAAI,GAC5B,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA2B7B"}

package/dist/github/superseded-fix-pr.js

@@ -0,0 +1,97 @@
+// An auto-fix PR is a snapshot of the reviewed PR at the moment the fix ran. Once the
+// source PR merges, that snapshot is frozen against a tree that no longer exists: if
+// the author pushed their own fix for the same finding, the two fixes live side by side
+// and merging the auto-fix reintroduces exactly what the author's version removed —
+// while reading, on the PR page, like a routine cleanup merge. Nothing in the auto-fix
+// PR says it was superseded.
+//
+// So when the source PR merges, close its auto-fix PR and say why. The finding is
+// either fixed on the base branch or still open there; either way the stale snapshot
+// is not the vehicle for it.
+export function autoFixBranchName(sourcePrNumber) {
+    return `fix/cr-${sourcePrNumber}-review-issues`;
+}
+// First line of every auto-fix PR body. Doubles as the ownership check below, so it is
+// built here rather than inlined at the creation site.
+export function autoFixPRIntro(sourcePrNumber) {
+    return `Auto-fix by crosscheck for CR issues found in #${sourcePrNumber}.`;
+}
+// Branch-name matching alone would let a hand-created branch of the same name be
+// closed by crosscheck. Require the body it writes as well.
+export function isCrosscheckAutoFixPR(body, sourcePrNumber) {
+    return (body ?? '').includes(autoFixPRIntro(sourcePrNumber));
+}
+export function buildSupersededComment(input) {
+    const mergedAs = input.mergeCommitSha
+        ? ` as [\`${input.mergeCommitSha.slice(0, 9)}\`](https://github.com/${input.owner}/${input.repo}/commit/${input.mergeCommitSha})`
+        : '';
+    return [
+        '### Superseded — closing',
+        '',
+        `#${input.sourcePrNumber} merged${mergedAs}, so the changes on this branch are a snapshot of a tree that no longer exists. If the author fixed the same finding themselves, merging this PR would reintroduce what their fix removed.`,
+        '',
+        `Re-run a review against \`${input.owner}/${input.repo}\`'s base branch if the finding still stands there — this branch is not the right vehicle for it.`,
+        '',
+        '<!-- crosscheck: superseded_auto_fix -->',
+    ].join('\n');
+}
+// True once the source PR has merged. A PR closed *unmerged* is not a merge: the
+// source branch is still where that finding gets addressed.
+//
+// The merge handler sweeps for auto-fix PRs exactly once, so a fallback auto-fix
+// PR opened after that sweep is never seen by it and stays open and mergeable —
+// the stale-snapshot regression this module exists to prevent. The fix step asks
+// this immediately before it pushes the branch and opens the PR, which closes
+// the window down to that single call.
+//
+// Fails open: an unreadable state returns false and the fix is delivered as
+// usual. A dropped fix is invisible to everyone, whereas today's behaviour is to
+// create unconditionally — so failing open is no regression, and the merge
+// webhook remains the primary mechanism.
+export async function sourcePRHasMerged(octokit, owner, repo, sourcePrNumber) {
+    try {
+        const { data } = await octokit.rest.pulls.get({ owner, repo, pull_number: sourcePrNumber });
+        return data.merged === true;
+    }
+    catch {
+        return false;
+    }
+}
+// Closes every open auto-fix PR cut from `sourcePrNumber`, commenting first so the
+// reason survives on the timeline. Returns one outcome per candidate found, in the
+// order GitHub listed them; an empty array means there was nothing cut from that PR
+// (the common case).
+//
+// Candidates are handled concurrently — a comment+close pair is two round-trips,
+// and serialising them makes every later candidate wait on all the earlier ones.
+// Ordering that matters is preserved: comment still precedes close *within* a
+// candidate, and Promise.all keeps the results positional.
+export async function closeSupersededAutoFixPRs(octokit, owner, repo, sourcePrNumber, mergeCommitSha) {
+    const branch = autoFixBranchName(sourcePrNumber);
+    const { data: candidates } = await octokit.rest.pulls.list({
+        owner, repo, state: 'open', head: `${owner}:${branch}`,
+    });
+    return Promise.all(candidates.map(async (candidate) => {
+        if (!isCrosscheckAutoFixPR(candidate.body, sourcePrNumber)) {
+            return { prNumber: candidate.number, status: 'not_crosscheck' };
+        }
+        try {
+            await octokit.rest.issues.createComment({
+                owner, repo, issue_number: candidate.number,
+                body: buildSupersededComment({ owner, repo, sourcePrNumber, mergeCommitSha }),
+            });
+            await octokit.rest.pulls.update({ owner, repo, pull_number: candidate.number, state: 'closed' });
+            return { prNumber: candidate.number, status: 'closed' };
+        }
+        catch (err) {
+            // Per-candidate catch, so one failure cannot reject the whole batch and
+            // leave the remaining candidates unreported.
+            return {
+                prNumber: candidate.number,
+                status: 'failed',
+                reason: err instanceof Error ? err.message : String(err),
+            };
+        }
+    }));
+}
+//# sourceMappingURL=superseded-fix-pr.js.map

package/dist/github/superseded-fix-pr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"superseded-fix-pr.js","sourceRoot":"","sources":["../../src/github/superseded-fix-pr.ts"],"names":[],"mappings":"AAEA,sFAAsF;AACtF,qFAAqF;AACrF,wFAAwF;AACxF,oFAAoF;AACpF,uFAAuF;AACvF,6BAA6B;AAC7B,EAAE;AACF,kFAAkF;AAClF,qFAAqF;AACrF,6BAA6B;AAE7B,MAAM,UAAU,iBAAiB,CAAC,cAAsB;IACtD,OAAO,UAAU,cAAc,gBAAgB,CAAA;AACjD,CAAC;AAED,uFAAuF;AACvF,uDAAuD;AACvD,MAAM,UAAU,cAAc,CAAC,cAAsB;IACnD,OAAO,kDAAkD,cAAc,GAAG,CAAA;AAC5E,CAAC;AAED,iFAAiF;AACjF,4DAA4D;AAC5D,MAAM,UAAU,qBAAqB,CAAC,IAA+B,EAAE,cAAsB;IAC3F,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAKtC;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc;QACnC,CAAC,CAAC,UAAU,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,0BAA0B,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,cAAc,GAAG;QACjI,CAAC,CAAC,EAAE,CAAA;IACN,OAAO;QACL,0BAA0B;QAC1B,EAAE;QACF,IAAI,KAAK,CAAC,cAAc,UAAU,QAAQ,4LAA4L;QACtO,EAAE;QACF,6BAA6B,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,mGAAmG;QACzJ,EAAE;QACF,0CAA0C;KAC3C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAUD,iFAAiF;AACjF,4DAA4D;AAC5D,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,uCAAuC;AACvC,EAAE;AACF,4EAA4E;AAC5E,iFAAiF;AACjF,2EAA2E;AAC3E,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,cAAsB;IAEtB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAA;QAC3F,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,mFAAmF;AACnF,oFAAoF;AACpF,qBAAqB;AACrB,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,8EAA8E;AAC9E,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,cAAsB,EACtB,cAA6B;IAE7B,MAAM,MAAM,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAA;IAChD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QACzD,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,IAAI,MAAM,EAAE;KACvD,CAAC,CAAA;IAEF,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAA6B,EAAE;QAC/E,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;YAC3D,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;QACjE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;gBACtC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC,MAAM;gBAC3C,IAAI,EAAE,sBAAsB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC;aAC9E,CAAC,CAAA;YACF,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;YAChG,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;QACzD,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,wEAAwE;YACxE,6CAA6C;YAC7C,OAAO;gBACL,QAAQ,EAAE,SAAS,CAAC,MAAM;gBAC1B,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD,CAAA;QACH,CAAC;IACH,CAAC,CAAC,CAAC,CAAA;AACL,CAAC"}

package/dist/github/webhook.d.ts

@@ -27,6 +27,9 @@ export interface PREvent {
         labels?: Array<{
             name: string;
         }>;
+        merged?: boolean;
+        merge_commit_sha?: string | null;
+        created_at?: string;
     };
     repository: {
         name: string;
@@ -65,5 +68,5 @@ export interface WebhookFileLogEntry {
     event: string;
     [key: string]: unknown;
 }
-export declare function createWebhookServer(config: Config, webhookSecret: string, onPR: (event: PREvent) => void, onLog: (msg: string) => void, onFileLog?: (entry: WebhookFileLogEntry) => void, onComment?: (event: IssueCommentEvent) => void): import("http").Server<typeof IncomingMessage, typeof ServerResponse>;
+export declare function createWebhookServer(config: Config, webhookSecret: string, onPR: (event: PREvent) => void, onLog: (msg: string) => void, onFileLog?: (entry: WebhookFileLogEntry) => void, onComment?: (event: IssueCommentEvent) => void, onMerged?: (event: PREvent) => void): import("http").Server<typeof IncomingMessage, typeof ServerResponse>;
 //# sourceMappingURL=webhook.d.ts.map

package/dist/github/webhook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/github/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,MAAM,CAAA;AAC9E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAIjD,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE;QACZ,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE;gBAAE,SAAS,EAAE,MAAM,CAAA;aAAE,GAAG,IAAI,CAAA;SAAE,CAAA;QAItE,IAAI,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE;gBAAE,SAAS,EAAE,MAAM,CAAC;gBAAC,cAAc,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAA;QAC3E,QAAQ,EAAE,MAAM,CAAA;QAChB,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;QAEvB,MAAM,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KACjC,CAAA;IACD,UAAU,EAAE;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;QACxB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;CACF;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,CAAA;QACd,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;QACvB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KACvC,CAAA;IACD,OAAO,EAAE;QACP,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;KACxB,CAAA;IACD,UAAU,EAAE;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;KACzB,CAAA;CACF;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,EAC9B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAC5B,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,EAChD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,wEAuF/C"}
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/github/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,MAAM,CAAA;AAC9E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAIjD,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE;QACZ,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE;gBAAE,SAAS,EAAE,MAAM,CAAA;aAAE,GAAG,IAAI,CAAA;SAAE,CAAA;QAItE,IAAI,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE;gBAAE,SAAS,EAAE,MAAM,CAAC;gBAAC,cAAc,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAA;QAC3E,QAAQ,EAAE,MAAM,CAAA;QAChB,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;QAEvB,MAAM,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;QAGhC,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QAKhC,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;IACD,UAAU,EAAE;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;QACxB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;CACF;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,CAAA;QACd,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;QACvB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KACvC,CAAA;IACD,OAAO,EAAE;QACP,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;KACxB,CAAA;IACD,UAAU,EAAE;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;KACzB,CAAA;CACF;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,EAC9B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAC5B,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,EAChD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,EAC9C,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,wEA6FpC"}

package/dist/github/webhook.js

@@ -1,7 +1,7 @@
 import { createServer } from 'http';
 import { verifyWebhookSignature } from './client.js';
 import { parseAnnotation } from '../lib/annotation.js';
-export function createWebhookServer(config, webhookSecret, onPR, onLog, onFileLog, onComment) {
+export function createWebhookServer(config, webhookSecret, onPR, onLog, onFileLog, onComment, onMerged) {
     const server = createServer(async (req, res) => {
         const { pathname } = new URL(req.url ?? '/', `http://localhost`);
         if (pathname !== config.server.webhook_path) {
@@ -77,6 +77,13 @@ export function createWebhookServer(config, webhookSecret, onPR, onLog, onFileLo
             // async — don't block the webhook response
             setImmediate(() => onPR(body));
         }
+        else if (body.action === 'closed' && body.pull_request.merged === true && onMerged) {
+            // A merge freezes any auto-fix PR cut from this one into a snapshot of a tree
+            // that no longer exists; the handler closes it. Closed-unmerged is not the same
+            // case — the source PR's branch is still the place the finding gets addressed.
+            res.writeHead(200).end('ok');
+            setImmediate(() => onMerged(body));
+        }
         else {
             res.writeHead(200).end('ok');
         }

package/dist/github/webhook.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../../src/github/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,MAAM,CAAA;AAE9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAkDtD,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,aAAqB,EACrB,IAA8B,EAC9B,KAA4B,EAC5B,SAAgD,EAChD,SAA8C;IAE9C,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QAC9E,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAA;QAEhE,IAAI,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC5C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;YACxB,OAAM;QACR,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;YACxB,OAAM;QACR,CAAC;QAED,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAA;QAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAEtD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAW,IAAI,EAAE,CAAA;QACpE,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;YAC/D,KAAK,CAAC,oDAAoD,CAAC,CAAA;YAC3D,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAA;YAC1F,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;YACxB,OAAM;QACR,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAW,CAAA;QAErD,IAAI,KAAK,KAAK,eAAe,IAAI,SAAS,EAAE,CAAC;YAC3C,IAAI,IAAuB,CAAA;YAC3B,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAsB,CAAA;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAA;gBAC3F,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;gBACxB,OAAM;YACR,CAAC;YACD,6EAA6E;YAC7E,6EAA6E;YAC7E,6EAA6E;YAC7E,gFAAgF;YAChF,8EAA8E;YAC9E,8EAA8E;YAC9E,iFAAiF;YACjF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY;gBACrE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBACpC,CAAC,CAAC,IAAI,CAAA;YACR,kEAAkE;YAClE,wEAAwE;YACxE,0CAA0C;YAC1C,iFAAiF;YACjF,2EAA2E;YAC3E,+DAA+D;YAC/D,IAAI,UAAU,EAAE,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBACtE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBAC5B,YAAY,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;YACrC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC9B,CAAC;YACD,OAAM;QACR,CAAC;QAED,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC5B,OAAM;QACR,CAAC;QAED,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAA;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAA;YAC3F,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;YACxB,OAAM;QACR,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YAC9D,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC5B,2CAA2C;YAC3C,YAAY,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QAChC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../../src/github/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,MAAM,CAAA;AAE9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AA2DtD,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,aAAqB,EACrB,IAA8B,EAC9B,KAA4B,EAC5B,SAAgD,EAChD,SAA8C,EAC9C,QAAmC;IAEnC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QAC9E,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAA;QAEhE,IAAI,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC5C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;YACxB,OAAM;QACR,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;YACxB,OAAM;QACR,CAAC;QAED,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAA;QAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAEtD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAW,IAAI,EAAE,CAAA;QACpE,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;YAC/D,KAAK,CAAC,oDAAoD,CAAC,CAAA;YAC3D,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAA;YAC1F,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;YACxB,OAAM;QACR,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAW,CAAA;QAErD,IAAI,KAAK,KAAK,eAAe,IAAI,SAAS,EAAE,CAAC;YAC3C,IAAI,IAAuB,CAAA;YAC3B,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAsB,CAAA;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAA;gBAC3F,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;gBACxB,OAAM;YACR,CAAC;YACD,6EAA6E;YAC7E,6EAA6E;YAC7E,6EAA6E;YAC7E,gFAAgF;YAChF,8EAA8E;YAC9E,8EAA8E;YAC9E,iFAAiF;YACjF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY;gBACrE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBACpC,CAAC,CAAC,IAAI,CAAA;YACR,kEAAkE;YAClE,wEAAwE;YACxE,0CAA0C;YAC1C,iFAAiF;YACjF,2EAA2E;YAC3E,+DAA+D;YAC/D,IAAI,UAAU,EAAE,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBACtE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBAC5B,YAAY,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;YACrC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC9B,CAAC;YACD,OAAM;QACR,CAAC;QAED,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC5B,OAAM;QACR,CAAC;QAED,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAA;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAA;YAC3F,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;YACxB,OAAM;QACR,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YAC9D,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC5B,2CAA2C;YAC3C,YAAY,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QAChC,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,IAAI,IAAI,QAAQ,EAAE,CAAC;YACrF,8EAA8E;YAC9E,gFAAgF;YAChF,+EAA+E;YAC/E,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC5B,YAAY,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;QACpC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/lib/adoption.d.ts

@@ -0,0 +1,64 @@
+export interface AdoptionLogLine {
+    ts: string;
+    event: string;
+    repo?: string;
+    pr?: number;
+    command?: string;
+    verdict?: string;
+    outcome?: string;
+    category?: string;
+    step_type?: string;
+    applied_count?: number;
+    open_to_verdict_ms?: number;
+}
+export interface WeeklyActivity {
+    /** Monday of the ISO week, `YYYY-MM-DD`. */
+    week: string;
+    active_repos: number;
+    reviews: number;
+}
+export interface LatencySummary {
+    count: number;
+    /** Milliseconds from PR open to posted verdict. */
+    p50_ms: number;
+    p90_ms: number;
+    max_ms: number;
+    /** Verdicts whose PR event carried no `created_at`, so they have no latency. */
+    unmeasured: number;
+}
+export interface AdoptionReport {
+    period: {
+        from: string;
+        to: string;
+        log_files: number;
+    };
+    onboarding: {
+        started: number;
+        completed: number;
+        abandoned: number;
+    };
+    activity: {
+        reviews_started: number;
+        reviews_completed: number;
+        rechecks_completed: number;
+        blocking_findings_posted: number;
+        fixes_applied: number;
+        /** Distinct repos with at least one completed review in the window. */
+        active_repos: number;
+    };
+    weekly: WeeklyActivity[];
+    open_to_verdict: LatencySummary;
+    /** Error category of the first failure in each session that never completed a
+     *  review — the thing that stops a new install from ever getting a verdict. */
+    first_run_failures: Record<string, number>;
+}
+export declare function prOpenToVerdictMs(createdAt: string | undefined, verdict: string | null, now?: number): number | undefined;
+export declare function isoWeekMonday(ts: string): string | null;
+export declare function percentile(sorted: number[], fraction: number): number;
+export declare function buildAdoptionReport(lines: AdoptionLogLine[], period: {
+    from: string;
+    to: string;
+    log_files: number;
+}): AdoptionReport;
+export declare function firstRunFailures(lines: AdoptionLogLine[]): Record<string, number>;
+//# sourceMappingURL=adoption.d.ts.map

package/dist/lib/adoption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adoption.d.ts","sourceRoot":"","sources":["../../src/lib/adoption.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IACvD,UAAU,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IACrE,QAAQ,EAAE;QACR,eAAe,EAAE,MAAM,CAAA;QACvB,iBAAiB,EAAE,MAAM,CAAA;QACzB,kBAAkB,EAAE,MAAM,CAAA;QAC1B,wBAAwB,EAAE,MAAM,CAAA;QAChC,aAAa,EAAE,MAAM,CAAA;QACrB,uEAAuE;QACvE,YAAY,EAAE,MAAM,CAAA;KACrB,CAAA;IACD,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,eAAe,EAAE,cAAc,CAAA;IAC/B;mFAC+E;IAC/E,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC3C;AAID,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,GAAG,GAAE,MAAmB,GACvB,MAAM,GAAG,SAAS,CAQpB;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOvD;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMrE;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,eAAe,EAAE,EACxB,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACtD,cAAc,CAsFhB;AAMD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgCjF"}

package/dist/lib/adoption.js

@@ -0,0 +1,165 @@
+// Adoption metrics answer "is crosscheck actually being used, and does it reach a
+// verdict fast enough to matter" — a different question from `impact`, which prices
+// the value of reviews that already happened.
+//
+// Every number here is derived from the local NDJSON logs in ~/.crosscheck/logs.
+// Nothing is transmitted: there is no endpoint, no account, and no network call in
+// this file. See docs/metrics.md for the field-by-field inventory.
+// A verdict-bearing latency is only meaningful for a review that produced one; a
+// verdictless review (from `crosscheck review`) has nothing to time to.
+export function prOpenToVerdictMs(createdAt, verdict, now = Date.now()) {
+    if (verdict === null || createdAt === undefined)
+        return undefined;
+    const opened = new Date(createdAt).getTime();
+    if (Number.isNaN(opened))
+        return undefined;
+    const elapsed = now - opened;
+    // A negative elapsed time means the clocks disagree, not that the PR was
+    // reviewed before it existed. Drop it rather than publish a nonsense number.
+    return elapsed >= 0 ? elapsed : undefined;
+}
+export function isoWeekMonday(ts) {
+    const d = new Date(ts);
+    if (Number.isNaN(d.getTime()))
+        return null;
+    const day = d.getUTCDay();
+    const diff = day === 0 ? -6 : 1 - day;
+    return new Date(Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate() + diff))
+        .toISOString().slice(0, 10);
+}
+export function percentile(sorted, fraction) {
+    if (sorted.length === 0)
+        return 0;
+    // Nearest-rank on the sorted sample: no interpolation, so every reported value
+    // is one that actually occurred.
+    const rank = Math.ceil(fraction * sorted.length) - 1;
+    return sorted[Math.min(Math.max(rank, 0), sorted.length - 1)];
+}
+export function buildAdoptionReport(lines, period) {
+    const weekly = new Map();
+    const activeRepos = new Set();
+    const latencies = [];
+    let unmeasured = 0;
+    const counts = {
+        onboard_started: 0,
+        onboard_completed: 0,
+        reviews_started: 0,
+        reviews_completed: 0,
+        rechecks_completed: 0,
+        blocking: 0,
+        fixes: 0,
+    };
+    for (const line of lines) {
+        switch (line.event) {
+            case 'onboard_started':
+                counts.onboard_started++;
+                break;
+            case 'onboard_completed':
+                // The event is emitted for both outcomes so an abandoned setup is
+                // visible; only a success counts as completed.
+                if (line.outcome === 'completed')
+                    counts.onboard_completed++;
+                break;
+            case 'review_started':
+                counts.reviews_started++;
+                break;
+            case 'review_complete': {
+                counts.reviews_completed++;
+                if (line.step_type === 'recheck')
+                    counts.rechecks_completed++;
+                if (line.repo) {
+                    activeRepos.add(line.repo);
+                    const week = isoWeekMonday(line.ts);
+                    if (week) {
+                        const bucket = weekly.get(week) ?? { repos: new Set(), reviews: 0 };
+                        bucket.repos.add(line.repo);
+                        bucket.reviews++;
+                        weekly.set(week, bucket);
+                    }
+                }
+                if (typeof line.open_to_verdict_ms === 'number')
+                    latencies.push(line.open_to_verdict_ms);
+                else if (line.verdict)
+                    unmeasured++;
+                break;
+            }
+            case 'blocking_finding_posted':
+                counts.blocking++;
+                break;
+            case 'fix_complete':
+                // delivery: 'comment' still counts — a suggestion the author applied is
+                // adoption. A no-op fix (applied_count 0) is not.
+                if ((line.applied_count ?? 0) > 0)
+                    counts.fixes++;
+                break;
+        }
+    }
+    latencies.sort((a, b) => a - b);
+    return {
+        period,
+        onboarding: {
+            started: counts.onboard_started,
+            completed: counts.onboard_completed,
+            abandoned: Math.max(0, counts.onboard_started - counts.onboard_completed),
+        },
+        activity: {
+            reviews_started: counts.reviews_started,
+            reviews_completed: counts.reviews_completed,
+            rechecks_completed: counts.rechecks_completed,
+            blocking_findings_posted: counts.blocking,
+            fixes_applied: counts.fixes,
+            active_repos: activeRepos.size,
+        },
+        weekly: [...weekly.entries()]
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([week, { repos, reviews }]) => ({ week, active_repos: repos.size, reviews })),
+        open_to_verdict: {
+            count: latencies.length,
+            p50_ms: percentile(latencies, 0.5),
+            p90_ms: percentile(latencies, 0.9),
+            max_ms: latencies.at(-1) ?? 0,
+            unmeasured,
+        },
+        first_run_failures: firstRunFailures(lines),
+    };
+}
+// "First run" is a session that never completed a review. Its first error is the
+// one that stopped a new install from reaching a verdict — the category worth
+// fixing. Sessions that did complete a review are excluded even if they later
+// errored: those are operational failures, not activation failures.
+export function firstRunFailures(lines) {
+    const sessions = [];
+    let current = null;
+    const close = () => {
+        if (current)
+            sessions.push(current);
+        current = null;
+    };
+    for (const line of lines) {
+        if (line.event === 'session_start') {
+            close();
+            current = { completedReview: false, firstErrorCategory: null };
+            continue;
+        }
+        // Logs from before session events existed, or a truncated file, would
+        // otherwise drop every entry on the floor.
+        if (current === null)
+            current = { completedReview: false, firstErrorCategory: null };
+        if (line.event === 'review_complete')
+            current.completedReview = true;
+        if (line.event === 'error' && current.firstErrorCategory === null) {
+            current.firstErrorCategory = line.category ?? 'unknown';
+        }
+        if (line.event === 'session_end')
+            close();
+    }
+    close();
+    const failures = {};
+    for (const session of sessions) {
+        if (session.completedReview || session.firstErrorCategory === null)
+            continue;
+        failures[session.firstErrorCategory] = (failures[session.firstErrorCategory] ?? 0) + 1;
+    }
+    return failures;
+}
+//# sourceMappingURL=adoption.js.map