@humanbased/crosscheck 1.2.0 → 1.3.0-beta.100

package/dist/commands/watch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"watch.d.ts","sourceRoot":"","sources":["../../src/commands/watch.ts"],"names":[],"mappings":"AAyKA,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED,wBAAsB,QAAQ,CAAC,IAAI,GAAE,SAAc,iBAqvClD"}
+{"version":3,"file":"watch.d.ts","sourceRoot":"","sources":["../../src/commands/watch.ts"],"names":[],"mappings":"AA4KA,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAuBD,wBAAsB,QAAQ,CAAC,IAAI,GAAE,SAAc,iBAo4ClD"}

package/dist/commands/watch.js

@@ -2,19 +2,21 @@ import { execSync, spawn } from 'child_process';
 import chalk from 'chalk';
 import { createWebhookServer } from '../github/webhook.js';
 import { createGithubClient, getCommitMessage, registerOrgWebhook, deleteOrgWebhook, registerRepoWebhook, deleteRepoWebhook, patchOrgWebhookEvents, patchRepoWebhookEvents, findOrgWebhook, findRepoWebhook, listUserRepos, checkRepoAccessible, } from '../github/client.js';
+import { closeSupersededAutoFixPRs } from '../github/superseded-fix-pr.js';
 import { detectOriginFull, assignReviewer } from '../github/detector.js';
-import { loadConfig, getGithubToken, getWebhookSecret, resolveConfigPath, promptDeploymentMode, detectScopesForDeployment, patchDeploymentConfig, detectGitHubLogin, } from '../config/loader.js';
+import { loadConfig, getGithubToken, getWebhookSecret, resolveConfigPath, promptDeploymentMode, detectScopesForDeployment, patchDeploymentConfig, detectGitHubLogin, getLinearCredentials, } from '../config/loader.js';
 import { randomFortune } from '../lib/fortune.js';
 import { scanUnreviewedPRs } from '../lib/backtrace.js';
 import { initLogger, log as fileLog, logError, logUncaught } from '../lib/logger.js';
 import { isAuthorAllowed } from '../lib/filter.js';
 import { runWorkflow } from '../lib/runner.js';
-import { loadWorkflow, DEFAULT_RECHECK_INSTRUCTIONS } from '../lib/workflow.js';
-import { filterStepsByTypes, formatRepoWorkflowSteps, isRecheckWithoutFix, isReviewOnlyWorkflow, readRepoWorkflowStepTypes, resolveRepoWorkflowSteps, workflowHasStep } from '../lib/repo-workflow.js';
+import { loadWorkflow, linearWritePossible, DEFAULT_RECHECK_INSTRUCTIONS } from '../lib/workflow.js';
+import { filterStepsByTypes, formatRepoWorkflowSteps, isReviewOnlyWorkflow, readRepoWorkflowStepTypes, resolveRepoWorkflowSteps, workflowHasStep } from '../lib/repo-workflow.js';
 import { fetchStepHistory, identifyNextWorkflowStep, decideReviewOnly } from '../lib/pr-workflow-state.js';
 import { parseAnnotation } from '../lib/annotation.js';
 import { PRBoard, fmtTime, FMT_TIME_WIDTH } from '../lib/board.js';
 import { clonePRForReview } from '../lib/clone.js';
+import { resolveLinearAuth, isLinearConfigError } from '../linear/identity.js';
 import { getSmartSwitch, isSubscriptionLimitError, detectFailedVendor, triggerSwitch, notifyReviewSuccess, stopSmartSwitch, } from '../lib/smart-switch.js';
 import { buildReviewFailedCommentBody } from '../lib/comment-bodies.js';
 import { classifyReviewerError } from '../lib/reviewer-error.js';
@@ -128,6 +130,21 @@ function openTunnel(localPort) {
         });
     });
 }
+// PR history is what decides whether a step runs at all — the approval stop, the
+// per-SHA dedup, the resume point. Acting without it means posting a duplicate review
+// or modifying an already-approved commit, so callers fail closed rather than assume an
+// empty history. One short retry first: the usual cause is a transient GitHub blip or a
+// rate-limit tick, and deferring the event strands the PR until something else happens.
+const HISTORY_RETRY_DELAY_MS = 3_000;
+async function fetchStepHistoryWithRetry(owner, repo, prNumber, token) {
+    try {
+        return await fetchStepHistory(owner, repo, prNumber, token);
+    }
+    catch {
+        await new Promise(resolve => setTimeout(resolve, HISTORY_RETRY_DELAY_MS));
+        return await fetchStepHistory(owner, repo, prNumber, token);
+    }
+}
 export async function runWatch(opts = {}) {
     const configPath = opts.config;
     let config = loadConfig(configPath);
@@ -156,6 +173,25 @@ export async function runWatch(opts = {}) {
         console.error(chalk.red(`✗ ${err instanceof Error ? err.message : String(err)}`));
         process.exit(1);
     }
+    // Preflight Linear identity at startup. watch is a long-running daemon: a bad
+    // credential discovered per-event would either drop events silently or spam the
+    // board. Fail loudly at boot instead, the way the run path fails before its
+    // clone. The token is discarded — per-event resolution mints a fresh one, since
+    // app tokens outlive neither a long daemon run nor a rotation.
+    // Same gate as the run and per-event paths: a daemon whose configured workflow
+    // is fix/conflict-resolve only can never call notifyLinear, so a missing
+    // credential must not stop it booting.
+    if (linearWritePossible(config.linear, loadWorkflow(process.cwd()))) {
+        try {
+            const preflight = await resolveLinearAuth(config.linear, getLinearCredentials(config.linear.auth));
+            console.log(chalk.dim(`  linear: ${preflight.mode} — writes as ${preflight.actor}`));
+        }
+        catch (err) {
+            logError({ command: 'watch', phase: 'linear-auth' }, err);
+            console.error(chalk.red(`✗ ${err instanceof Error ? err.message : String(err)}`));
+            process.exit(isLinearConfigError(err) ? 1 : 2);
+        }
+    }
     fileLog({ level: 'info', event: 'session_start', command: 'watch' });
     // Fetch the authenticated user so the onComment handler can reject annotation
     // injection from non-token accounts. If this fails, the handler is disabled
@@ -191,12 +227,16 @@ export async function runWatch(opts = {}) {
     // Last-reviewed diff hash per PR — skip reviews when a new SHA has identical diff vs base
     // (force-push, amend, no-op rebase). Persisted so restarts don't re-review unchanged content.
     const diffHashes = new PersistentDiffHashMap();
-    // PRs reviewed at least once this session — synchronize events on these run as recheck rounds
-    const reviewedPRKeys = new Set();
+    // Completed round count per PR — the auto-loop's round counter, which history cannot
+    // supply (it returns the last recheck's round unchanged across iterations).
     const prRoundCounts = new Map();
-    // PR+sha pairs completed by this watch session — used to suppress issue_comment
-    // re-entries for reviews that watch posted itself (as opposed to kickass).
-    const reviewedPRShaKeys = new Set();
+    // Comment IDs the issue_comment bridge has already handled, so a webhook redelivery
+    // of the same comment does not dispatch twice. There is no need to guess at which
+    // comments are "ours": webhook.ts forwards only `trigger=kickass` annotations, and
+    // this watcher's own reviews carry trigger=watch/comment/backtrace, so they never
+    // reach the bridge. Every comment that does reach it is a kickass dispatch whose
+    // verdict this watcher is meant to act on — history detection decides how.
+    const handledCommentIds = new Set();
     // Idle tracking — reset on any PR activity; used by the idle-issue timer.
     let lastActivityAt = Date.now();
     let idleAnalysisRunning = false;
@@ -215,6 +255,7 @@ export async function runWatch(opts = {}) {
                 fileLog({ level: 'info', event: 'pr_skipped', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'author_not_allowed', author: params.author });
                 return;
             }
+            const prKey = `${owner}/${repoName}#${prNumber}`;
             const { origin, method: originMethod } = await detectOriginFull(params.body ?? '', params.headRef, owner, repoName, prNumber, config, token, params.author);
             // Smart-switch: when cross-vendor is degraded, override to single-vendor with the healthy vendor
             const ss = getSmartSwitch();
@@ -235,9 +276,17 @@ export async function runWatch(opts = {}) {
                 title: params.title,
                 body: params.body ?? '',
                 head: { ref: params.headRef, sha: params.headSha, repo: params.headRepo ? { full_name: params.headRepo } : null },
-                base: { ref: params.baseRef, repo: { full_name: `${owner}/${repoName}` } },
+                base: {
+                    ref: params.baseRef,
+                    repo: {
+                        full_name: `${owner}/${repoName}`,
+                        ...(params.defaultBranch !== undefined && { default_branch: params.defaultBranch }),
+                    },
+                },
                 html_url: `https://github.com/${owner}/${repoName}/pull/${prNumber}`,
                 user: { login: params.author },
+                ...(params.labels !== undefined && { labels: params.labels.map(name => ({ name })) }),
+                ...(params.createdAt !== undefined && { created_at: params.createdAt }),
             };
             if (!acquirePRLock(owner, repoName, prNumber, params.headSha)) {
                 fileLog({ level: 'info', event: 'pr_skipped', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'in_progress_local' });
@@ -257,21 +306,26 @@ export async function runWatch(opts = {}) {
                 logError({ repo: `${owner}/${repoName}`, pr: prNumber, phase: 'lock' }, err);
                 return;
             }
-            const prKey = `${owner}/${repoName}#${prNumber}`;
-            // Determine the correct starting step from PR comment history so watch
-            // behaves correctly after a restart (reviewedPRKeys is in-memory only).
-            // Fast-path: if the PR was reviewed in this session, skip the API call.
-            // Exception: comment-triggered runs must always do live detection —
-            // reviewedPRKeys is SHA-agnostic and would misroute a kickass review
-            // annotation for a new SHA as a recheck run instead of routing to fix.
-            // auto_loop runs also skip the session fast-path so history detection
-            // picks the correct starting step (fix, not recheck); round is instead
-            // incremented from prRoundCounts to match the completed round count.
-            let isRecheckRun = params.action === 'comment'
-                ? reviewedPRShaKeys.has(key) // SHA-specific: already processed this exact sha
-                : params.action === 'auto_loop'
-                    ? false // always use history detection for auto-loop rounds
-                    : reviewedPRKeys.has(prKey); // session fast-path for webhook/backtrace events
+            // Determine the correct starting step from PR comment history. Webhook, backtrace,
+            // and auto_loop events always ask — there is no PR-level session fast-path.
+            //
+            // There used to be one (`reviewedPRKeys`): reviewed-in-this-session meant "run the
+            // next event as a recheck". It was wrong by construction on two axes. It is
+            // SHA-agnostic, so a push it had never seen inherited the previous SHA's routing;
+            // and it only knows what THIS process did, so an approval, a forced re-review, or a
+            // fix pushed by `kickass`, `crosscheck run`, or a second watcher was invisible to
+            // it. Each case where it guessed wrong grew its own guard — recheck-no-fix depth,
+            // repo overrides, approvals — and every one of those guards did the same thing:
+            // undo the guess and ask history. So ask history. It costs one call per event, and
+            // it is the only thing that sees the PR as it actually is.
+            //
+            // Comment triggers ask too. The SHA-specific fast path they used to take ran an
+            // externally-posted NEEDS_WORK as a recheck instead of routing to fix, because it
+            // skipped detection whenever this session had already touched the SHA.
+            let isRecheckRun = false;
+            // auto_loop's round is pre-computed from the completed round count rather than
+            // from history, which returns the last recheck's round unchanged across iterations
+            // and would defeat the max_rounds cap.
             let round = params.action === 'auto_loop'
                 ? (prRoundCounts.get(prKey) ?? 1) + 1
                 : isRecheckRun ? (prRoundCounts.get(prKey) ?? 1) + 1 : 1;
@@ -285,17 +339,6 @@ export async function runWatch(opts = {}) {
                 isRecheckRun = false;
                 round = 1;
             }
-            // A recheck-no-fix depth (`review,recheck`) decides review-vs-recheck per SHA from
-            // the last verdict: an unresolved review gets a recheck, an APPROVE gets a fresh
-            // review (identifyNextWorkflowStep). The session fast-path above is PR-level and
-            // SHA-agnostic, so it would coerce every later push in this process into a recheck
-            // and never consult that decision. Force history detection instead. Comment-
-            // triggered runs keep their SHA-specific fast path — a kickass re-review targets a
-            // SHA history detection would report as already complete.
-            if (isRecheckWithoutFix(repoStepOverride) && isRecheckRun && params.action !== 'comment') {
-                isRecheckRun = false;
-                round = 1;
-            }
             if (reviewOnlyForRepo) {
                 // Review-only comes from a per-repo override (crosscheck alter --review-only).
                 // Restrict the workflow to review step(s) and dedup on the exact head sha so
@@ -312,7 +355,7 @@ export async function runWatch(opts = {}) {
                 round = 1;
                 resolvedSteps = reviewSteps;
                 try {
-                    const history = await fetchStepHistory(owner, repoName, prNumber, token);
+                    const history = await fetchStepHistoryWithRetry(owner, repoName, prNumber, token);
                     const decision = decideReviewOnly(history, params.headSha);
                     if (decision.alreadyReviewed) {
                         await releaseRemoteLock(lockOctokit, owner, repoName, params.headSha, 'success');
@@ -322,7 +365,18 @@ export async function runWatch(opts = {}) {
                     }
                     round = decision.round;
                 }
-                catch { /* best-effort — fall back to a fresh round-1 review */ }
+                catch (err) {
+                    // The dedup this mode relies on lives in that history. Reviewing without it
+                    // would post a second review on a SHA already covered.
+                    // Released as `failure`, not `success`: this SHA was not reviewed, and
+                    // `crosscheck/review` is a commit status a repo can require for merge — a
+                    // green one here would let an unreviewed HEAD satisfy branch protection
+                    // during a GitHub outage.
+                    await releaseRemoteLock(lockOctokit, owner, repoName, params.headSha, 'failure');
+                    releasePRLock(owner, repoName, prNumber, params.headSha);
+                    fileLog({ level: 'warn', event: 'pr_skipped', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'history_unavailable', sha: params.headSha, error: err instanceof Error ? err.message : String(err) });
+                    return;
+                }
             }
             else if (!isRecheckRun) {
                 try {
@@ -331,18 +385,34 @@ export async function runWatch(opts = {}) {
                     // fresh so live edits to workflow.yml apply across events.
                     const globalWorkflow = loadWorkflow(process.cwd());
                     const allSteps = repoStepOverride ? filterStepsByTypes(globalWorkflow, repoStepOverride) : globalWorkflow;
-                    const history = await fetchStepHistory(owner, repoName, prNumber, token);
-                    const nextResult = identifyNextWorkflowStep(history, allSteps, params.headSha);
+                    const history = await fetchStepHistoryWithRetry(owner, repoName, prNumber, token);
+                    // The webhook payload carries no usable `mergeable`, so ask — but only for
+                    // workflows that can act on the answer. GitHub computes it lazily, and a null
+                    // simply means the conflict route is not offered on this event. Unlike the
+                    // history read above this one stays best-effort: not knowing whether the PR
+                    // conflicts only costs a deferred resolve, not a wrong review.
+                    let mergeable = null;
+                    if (allSteps.some(s => s.type === 'conflict-resolve')) {
+                        try {
+                            const { data: freshPR } = await lockOctokit.rest.pulls.get({ owner, repo: repoName, pull_number: prNumber });
+                            mergeable = freshPR.mergeable;
+                        }
+                        catch { /* best-effort — unknown mergeability just skips the conflict route */ }
+                    }
+                    const nextResult = identifyNextWorkflowStep(history, allSteps, params.headSha, { mergeable });
                     if (nextResult.step === null) {
                         // Workflow already complete for this HEAD sha — release lock and skip.
                         // Happens when a synchronize event fires after all steps are done.
                         await releaseRemoteLock(lockOctokit, owner, repoName, params.headSha, 'success');
                         releasePRLock(owner, repoName, prNumber, params.headSha);
-                        fileLog({ level: 'info', event: 'pr_skipped', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'workflow_complete', sha: params.headSha });
+                        fileLog({ level: 'info', event: 'pr_skipped', repo: `${owner}/${repoName}`, pr: prNumber, reason: nextResult.stopReason ?? 'workflow_complete', sha: params.headSha });
                         return;
                     }
                     if (nextResult.hasExistingReview) {
-                        isRecheckRun = nextResult.step.type !== 'review';
+                        // conflict-resolve is excluded: the run continues into the review step, and
+                        // the merge commit it produces is new content owed a real review, not a
+                        // recheck of findings the merge had nothing to do with.
+                        isRecheckRun = nextResult.step.type !== 'review' && nextResult.step.type !== 'conflict-resolve';
                         // auto_loop pre-computed the correct incremented round from prRoundCounts;
                         // history detection returns the last recheck's round (unchanged across
                         // iterations), so overwriting here would defeat the max_rounds cap.
@@ -391,15 +461,26 @@ export async function runWatch(opts = {}) {
                         }
                     }
                 }
-                catch {
-                    // best-effort — fall back to session-based detection.
-                    // For auto_loop, force isRecheckRun=true so a transient history-fetch
-                    // failure does not restart the workflow from the review step.
-                    // A recheck-no-fix repo has no session state left to fall back to (the guard
-                    // above cleared it), so it re-reviews the new SHA — the conservative direction,
-                    // since a fresh review never assumes findings that may already be resolved.
-                    if (params.action === 'auto_loop')
-                        isRecheckRun = true;
+                catch (err) {
+                    // History still unreadable after the retry. Everything this function decides —
+                    // whether HEAD is already approved, already reviewed, or mid-loop — lives in
+                    // that history, so running anyway risks a second review on an approved commit
+                    // or a fix re-applied to code that already has one. Defer instead: release the
+                    // locks and let the next event, `kickass`, or `crosscheck run` pick the PR up.
+                    //
+                    // auto_loop is the exception. It is a continuation of a run this process just
+                    // completed, so the state is known from the session rather than from history,
+                    // and deferring would strand the loop — nothing else re-triggers it.
+                    if (params.action !== 'auto_loop') {
+                        // `failure`, not `success` — see the review-only branch above: a green
+                        // `crosscheck/review` on a HEAD nobody reviewed can satisfy branch
+                        // protection.
+                        await releaseRemoteLock(lockOctokit, owner, repoName, params.headSha, 'failure');
+                        releasePRLock(owner, repoName, prNumber, params.headSha);
+                        fileLog({ level: 'warn', event: 'pr_skipped', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'history_unavailable', sha: params.headSha, error: err instanceof Error ? err.message : String(err) });
+                        return;
+                    }
+                    isRecheckRun = true;
                 }
             }
             const reviewStart = Date.now();
@@ -407,6 +488,32 @@ export async function runWatch(opts = {}) {
             let stopHeartbeat = () => { };
             let boardAdded = false;
             try {
+                // Board first, so any failure below is visible rather than swallowed by the
+                // enclosing catch (which only calls logError — a no-op when file logging is
+                // off). Then auth, then the clone: during an outage a long-running watcher
+                // would otherwise pay for a full clone on every event before rejecting it.
+                // Computed here rather than at the runWorkflow call so the auth gate below
+                // sees the workflow that will actually run. resolvedSteps alone is
+                // undefined for a plain event, and canWriteVerdict fails open on undefined
+                // — which let a fix-only daemon resolve credentials on every event.
+                const workflowStepsForRun = resolvedSteps
+                    ?? (repoStepOverride ? filterStepsByTypes(loadWorkflow(process.cwd()), repoStepOverride) : loadWorkflow(process.cwd()));
+                board.addPR(key, prNumber, `${owner}/${repoName}`, params.headRef, round);
+                boardAdded = true;
+                // Only workflows that can write a verdict need an identity — the fix and
+                // resolve paths never call notifyLinear.
+                let linearAuth = null;
+                if (linearWritePossible(effectiveConfig.linear, workflowStepsForRun)) {
+                    try {
+                        linearAuth = await resolveLinearAuth(effectiveConfig.linear, getLinearCredentials(effectiveConfig.linear.auth));
+                    }
+                    catch (err) {
+                        const message = err instanceof Error ? err.message : String(err);
+                        board.failPR(key, `linear identity unavailable: ${message}`);
+                        fileLog({ level: 'error', event: 'linear_auth_failed', repo: `${owner}/${repoName}`, pr: prNumber, reason: message });
+                        throw err;
+                    }
+                }
                 await clonePRForReview({
                     owner, repo: repoName, prNumber, baseRef: params.baseRef,
                     tmpDir, token, protocol: config.clone_protocol,
@@ -442,18 +549,18 @@ export async function runWatch(opts = {}) {
                         logError({ repo: `${owner}/${repoName}`, pr: prNumber, phase: 'no_diff_comment' }, err);
                     }
                     await releaseRemoteLock(lockOctokit, owner, repoName, params.headSha, 'success');
+                    // The PR is on the board from before the clone, so close its slot rather
+                    // than leaving a row that never resolves.
+                    board.completePR(key, { elapsedMs: Date.now() - reviewStart, url: `https://github.com/${owner}/${repoName}/pull/${prNumber}` });
                     return;
                 }
-                board.addPR(key, prNumber, `${owner}/${repoName}`, params.headRef, round);
-                boardAdded = true;
                 const prLoc = computePRLoc(tmpDir, params.baseRef);
                 board.updatePR(key, { prLoc });
                 stopHeartbeat = startRemoteLockHeartbeat(lockOctokit, owner, repoName, params.headSha);
-                const workflowStepsForRun = resolvedSteps
-                    ?? (repoStepOverride ? filterStepsByTypes(loadWorkflow(process.cwd()), repoStepOverride) : undefined);
-                const { verdict, fixAppliedCount } = await runWorkflow({
+                const { verdict, fixAppliedCount, strategySkipped } = await runWorkflow({
                     owner, repoName, prNumber, pr,
                     tmpDir, token, config: effectiveConfig, origin,
+                    linearAuth,
                     reviewStart,
                     log: (msg) => bLog(`${chalk.dim(fmtTime())}  ${msg}`),
                     onPhaseChange: (label, data) => board.updatePR(key, { label, ...data }),
@@ -470,10 +577,11 @@ export async function runWatch(opts = {}) {
                     round,
                     trigger: params.action === 'backtrace' ? 'backtrace' : params.action === 'comment' ? 'comment' : 'watch',
                 });
-                void verdict;
-                reviewedPRKeys.add(prKey);
-                reviewedPRShaKeys.add(key); // key = "owner/repo#pr@sha"
-                prRoundCounts.set(prKey, round);
+                // A strategy-skipped PR never ran a review, so it must not advance the
+                // auto-loop's round counter — that run posted nothing to count.
+                if (strategySkipped === undefined) {
+                    prRoundCounts.set(prKey, round);
+                }
                 // Recompute the diff hash AFTER runWorkflow — workflow steps such as
                 // `conflict-resolve` or `fix` followed by `recheck` can mutate the checkout,
                 // so the pre-workflow hash may not represent the content that was actually
@@ -493,7 +601,10 @@ export async function runWatch(opts = {}) {
                     }
                     catch { /* fall back — skip auto-loop this cycle */ }
                 }
-                if (newDiffHash) {
+                // Same gate as the session caches above: caching the diff of a PR that was
+                // never reviewed would make the first event that *should* review it get
+                // skipped as `no_diff_change`.
+                if (newDiffHash && strategySkipped === undefined) {
                     // For non-commit delivery with an applied fix the checkout may be on a fix
                     // branch; computeDiffHash would return the post-fix diff, not the original PR
                     // diff. Caching that under prKey corrupts future no_diff_change checks for the
@@ -514,9 +625,15 @@ export async function runWatch(opts = {}) {
                         }
                     }
                 }
+                // A class-skipped PR (e.g. lockfile-only) never ran a review, so say so
+                // rather than reporting it as a completed one.
+                if (strategySkipped) {
+                    bLog(`${chalk.dim(fmtTime())}  ${chalk.dim(`PR #${prNumber} skipped — ${strategySkipped} class, nothing to review`)}`);
+                }
                 board.completePR(key, {
                     elapsedMs: Date.now() - reviewStart,
                     url: `github.com/${owner}/${repoName}/pull/${prNumber}`,
+                    ...(strategySkipped !== undefined && { label: `skipped · ${strategySkipped}` }),
                 });
                 // Smart-switch recovery confirmation: if a restore attempt is pending and
                 // this reviewer matches the previously-degraded vendor, announce full restoration.
@@ -649,6 +766,9 @@ export async function runWatch(opts = {}) {
             title: pr.title, body: pr.body, author: pr.user.login,
             headSha: pr.head.sha, headRef: pr.head.ref, headRepo: pr.head.repo?.full_name ?? null,
             baseRef: pr.base.ref, action: event.action,
+            ...(pr.labels !== undefined && { labels: pr.labels.map(l => l.name) }),
+            ...(pr.base.repo.default_branch !== undefined && { defaultBranch: pr.base.repo.default_branch }),
+            ...(pr.created_at !== undefined && { createdAt: pr.created_at }),
         });
     }, (msg) => bLog(chalk.dim(fmtTime()) + '  ' + msg), fileLog, async (event) => {
         const owner = event.repository.owner.login;
@@ -698,10 +818,11 @@ export async function runWatch(opts = {}) {
                 fileLog({ level: 'info', event: 'pr_skipped', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'comment_stale_sha', sha: prData.head.sha, annotation_sha: annotationSha });
                 return;
             }
-            if (reviewedPRShaKeys.has(`${owner}/${repoName}#${prNumber}@${prData.head.sha}`)) {
-                fileLog({ level: 'info', event: 'pr_skipped', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'comment_self_trigger', sha: prData.head.sha });
+            if (handledCommentIds.has(event.comment.id)) {
+                fileLog({ level: 'info', event: 'pr_skipped', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'comment_already_handled', comment_id: event.comment.id });
                 return;
             }
+            handledCommentIds.add(event.comment.id);
             // GitHub can deliver issue_comment before ck run's finally block releases
             // the remote lock. Retry with backoff; re-fetch the PR head on each attempt
             // so we don't dispatch against a sha that advanced while we were waiting.
@@ -725,10 +846,6 @@ export async function runWatch(opts = {}) {
                         break;
                     }
                 }
-                if (reviewedPRShaKeys.has(`${owner}/${repoName}#${prNumber}@${prData.head.sha}`)) {
-                    fileLog({ level: 'info', event: 'pr_skipped', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'comment_self_trigger', sha: prData.head.sha });
-                    break;
-                }
                 if (await checkRemoteLock(octokit, owner, repoName, prData.head.sha).catch(() => false)) {
                     fileLog({ level: 'info', event: 'comment_trigger_deferred', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'in_progress_remote', attempt });
                     continue;
@@ -743,6 +860,12 @@ export async function runWatch(opts = {}) {
                     headRepo: prData.head.repo?.full_name ?? null,
                     baseRef: prData.base.ref,
                     action: 'comment',
+                    // Same fields the webhook path forwards: without them the risky
+                    // class's label and hotfix rules classify this PR differently
+                    // depending on which trigger ran it.
+                    ...(prData.labels !== undefined && { labels: prData.labels.map((l) => l.name) }),
+                    ...(prData.base.repo?.default_branch !== undefined && { defaultBranch: prData.base.repo.default_branch }),
+                    ...(prData.created_at !== undefined && { createdAt: prData.created_at }),
                 });
                 break;
             }
@@ -750,6 +873,29 @@ export async function runWatch(opts = {}) {
         catch (err) {
             logError({ repo: `${owner}/${repoName}`, pr: prNumber, phase: 'comment_trigger' }, err);
         }
+    }, async (event) => {
+        const owner = event.repository.owner.login;
+        const repoName = event.repository.name;
+        const prNumber = event.number;
+        try {
+            const octokit = createGithubClient(token);
+            const outcomes = await closeSupersededAutoFixPRs(octokit, owner, repoName, prNumber, event.pull_request.merge_commit_sha ?? null);
+            for (const outcome of outcomes) {
+                fileLog({
+                    level: outcome.status === 'failed' ? 'warn' : 'info',
+                    event: 'auto_fix_pr_superseded',
+                    repo: `${owner}/${repoName}`, pr: prNumber,
+                    fix_pr: outcome.prNumber, status: outcome.status,
+                    ...(outcome.reason && { reason: outcome.reason }),
+                });
+                if (outcome.status === 'closed') {
+                    bLog(chalk.dim(fmtTime()) + `  closed superseded auto-fix PR ${owner}/${repoName}#${outcome.prNumber} (${prNumber} merged)`);
+                }
+            }
+        }
+        catch (err) {
+            logError({ repo: `${owner}/${repoName}`, pr: prNumber, phase: 'auto_fix_supersede' }, err);
+        }
     });
     await new Promise((resolve, reject) => {
         server.on('error', (err) => {
@@ -1029,6 +1175,9 @@ export async function runWatch(opts = {}) {
                     title: pr.title, body: pr.body, author: pr.author,
                     headSha: pr.headSha, headRef: pr.headRef, headRepo: pr.headRepo,
                     baseRef: pr.baseRef, action: 'backtrace',
+                    ...(pr.labels !== undefined && { labels: pr.labels }),
+                    ...(pr.defaultBranch !== undefined && { defaultBranch: pr.defaultBranch }),
+                    createdAt: pr.createdAt,
                 })));
             }
             catch (err) {