@humanbased/crosscheck 1.2.0 → 1.3.0-beta.82

package/dist/commands/status.js

@@ -1,18 +1,37 @@
 import { execSync } from 'child_process';
 import { existsSync, statSync } from 'fs';
 import chalk from 'chalk';
-import { loadConfig, getGithubTokenSource, getWebhookSecretPath, resolveConfigPath } from '../config/loader.js';
+import { loadConfig, getGithubTokenSource, getWebhookSecretPath, resolveConfigPath, getLinearCredentials } from '../config/loader.js';
+import { verifyLinearIdentity } from '../linear/verify.js';
 import { checkCodexAuth } from '../reviewers/codex.js';
 import { checkClaudeAuth } from '../reviewers/claude.js';
 import { getLogDir, getTodayLogPath } from '../lib/logger.js';
 import { buildImpactReport } from './impact.js';
+import { formatSkillIdentity, loadSkillCatalog } from '../skills/catalog.js';
 function row(label, value, ok) {
     const indicator = ok === undefined ? ' ' : ok ? chalk.green('✓') : chalk.red('✗');
     console.log(`  ${indicator} ${chalk.bold(label.padEnd(22))} ${value}`);
 }
+const LINEAR_PROBE_TIMEOUT_MS = 10_000;
 export async function runStatus(configPath) {
     const config = loadConfig(configPath);
     const activeConfigPath = resolveConfigPath(configPath);
+    // Start the Linear probe before the CLI auth checks so the two network round
+    // trips overlap, and bound it — status must stay responsive even if Linear is
+    // slow or unreachable. verifyLinearIdentity never throws; the timeout is the
+    // only way this can reject, so it resolves to a report either way.
+    const linearProbe = config.linear.enabled
+        ? Promise.race([
+            verifyLinearIdentity(config.linear, getLinearCredentials(config.linear.auth)),
+            new Promise(resolve => setTimeout(() => resolve({
+                ok: false,
+                mode: config.linear.auth.mode,
+                actor: config.linear.identity.actor,
+                attribution: config.linear.auth.mode === 'client_credentials' ? 'app' : 'user',
+                error: `timed out after ${LINEAR_PROBE_TIMEOUT_MS / 1000}s`,
+            }), LINEAR_PROBE_TIMEOUT_MS).unref?.()),
+        ])
+        : null;
     console.log(chalk.bold('\ncrosscheck status\n'));
     // Auth
     console.log(chalk.dim('  Auth'));
@@ -38,6 +57,15 @@ export async function runStatus(configPath) {
     row('config path', activeConfigPath ?? 'defaults only');
     row('mode', config.mode);
     row('quality tier', config.quality.tier);
+    const skillCatalog = loadSkillCatalog();
+    const bundledSkills = new Map(skillCatalog.map(skill => [skill.name, skill]));
+    row('installed skills', skillCatalog.map(formatSkillIdentity).join(', '));
+    row('enabled skills', config.skills.enabled.length > 0
+        ? config.skills.enabled.map(name => {
+            const skill = bundledSkills.get(name);
+            return skill ? formatSkillIdentity(skill) : `${name} (not installed or failed integrity check)`;
+        }).join(', ')
+        : 'none');
     row('codex auth', config.vendors.codex.auth);
     row('codex model', config.vendors.codex.model ?? 'auto (by tier)');
     row('claude model', config.vendors.claude.model ?? 'default');
@@ -50,6 +78,30 @@ export async function runStatus(configPath) {
     if (config.quality.focus.length > 0) {
         row('focus', config.quality.focus.join(', '));
     }
+    // Linear identity — only when the operator has opted in.
+    if (linearProbe) {
+        console.log();
+        console.log(chalk.dim('  Linear'));
+        const report = await linearProbe;
+        row('auth mode', report.mode, report.ok);
+        if (!report.ok) {
+            row('identity', report.error ?? 'verification failed', false);
+        }
+        else {
+            row('organization', report.organization ?? 'unknown');
+            if (report.attribution === 'app') {
+                const actor = config.linear.identity.per_step_actor ? `${report.actor}/<step>` : report.actor;
+                row('writes as', `${actor} ${chalk.dim('(crosscheck itself)')}`, true);
+            }
+            else {
+                // Deliberately not a failed check. Attributing to a person is the wrong
+                // state for a shared workspace, but it is a perfectly reasonable choice for
+                // a solo user with no attribution problem — so this informs, it does not nag.
+                row('writes as', `${report.attributesTo ?? 'your Linear account'} ${chalk.dim('(api key)')}`);
+                console.log(chalk.dim('    to post as crosscheck itself, see docs/linear-identity.md'));
+            }
+        }
+    }
     // Logs
     console.log();
     console.log(chalk.dim('  Logs'));

package/dist/commands/status.js.map

@@ -1 +1 @@
-{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAA;AACzC,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC/G,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE/C,SAAS,GAAG,CAAC,KAAa,EAAE,KAAa,EAAE,EAAY;IACrD,MAAM,SAAS,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACjF,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAA;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAAmB;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;IACrC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAA;IAEtD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAA;IAEhD,OAAO;IACP,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;IAChC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;IACxF,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,IAAI,eAAe,EAAE,SAAS,CAAC,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,IAAI,eAAe,EAAE,UAAU,CAAC,EAAE,CAAC,CAAA;IAElE,MAAM,WAAW,GAAG,oBAAoB,EAAE,CAAA;IAC1C,MAAM,aAAa,GAAG,WAAW;QAC/B,CAAC,CAAC,QAAQ,WAAW,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,GAAG;QAC1E,CAAC,CAAC,SAAS,CAAA;IACb,GAAG,CAAC,cAAc,EAAE,aAAa,EAAE,WAAW,KAAK,IAAI,CAAC,CAAA;IAExD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAA;IAChG,MAAM,iBAAiB,GAAG,oBAAoB,EAAE,CAAA;IAChD,MAAM,mBAAmB,GAAG,aAAa;QACvC,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC;YAC7B,CAAC,CAAC,mBAAmB,iBAAiB,EAAE;YACxC,CAAC,CAAC,kCAAkC,iBAAiB,EAAE,CAAA;IAC3D,GAAG,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAA;IAEhD,SAAS;IACT,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;IAClC,GAAG,CAAC,aAAa,EAAE,gBAAgB,IAAI,eAAe,CAAC,CAAA;IACvD,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;IACxB,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACxC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC5C,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,gBAAgB,CAAC,CAAA;IAClE,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,CAAA;IAC7D,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc;QACnE,CAAC,CAAC,0BAA0B;QAC5B,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAElD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IACxE,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/C,CAAC;IAED,OAAO;IACP,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;IAChC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAChE,GAAG,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,CAAA;IACtD,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAA;IAC3B,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;IAClC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAA;QACrC,MAAM,EAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QACpC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,QAAQ,EAAE,CAAC,CAAA;IACxC,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;IAClC,CAAC;IAED,iBAAiB;IACjB,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;IAClC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC/C,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,SAAS,EAAE,wDAAwD,CAAC,CAAA;IAC1E,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,aAAa,eAAe,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,aAAa,MAAM,CAAC,aAAa,mBAAmB,KAAK,CAAC,GAAG,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAA;IAClM,CAAC;IAED,eAAe;IACf,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;IAChC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QAC9E,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;IAClC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,QAAQ,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QAChF,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;IACnC,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAA;AACf,CAAC"}
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAA;AACzC,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AACrI,OAAO,EAAE,oBAAoB,EAA6B,MAAM,qBAAqB,CAAA;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAE5E,SAAS,GAAG,CAAC,KAAa,EAAE,KAAa,EAAE,EAAY;IACrD,MAAM,SAAS,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACjF,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAA;AACxE,CAAC;AAED,MAAM,uBAAuB,GAAG,MAAM,CAAA;AAEtC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAAmB;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;IACrC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAA;IAEtD,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,mEAAmE;IACnE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO;QACvC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;YACX,oBAAoB,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7E,IAAI,OAAO,CAAuB,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;gBACpE,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI;gBAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK;gBACnC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;gBAC9E,KAAK,EAAE,mBAAmB,uBAAuB,GAAG,IAAI,GAAG;aAC5D,CAAC,EAAE,uBAAuB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;SACxC,CAAC;QACJ,CAAC,CAAC,IAAI,CAAA;IAER,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAA;IAEhD,OAAO;IACP,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;IAChC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;IACxF,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,IAAI,eAAe,EAAE,SAAS,CAAC,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,IAAI,eAAe,EAAE,UAAU,CAAC,EAAE,CAAC,CAAA;IAElE,MAAM,WAAW,GAAG,oBAAoB,EAAE,CAAA;IAC1C,MAAM,aAAa,GAAG,WAAW;QAC/B,CAAC,CAAC,QAAQ,WAAW,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,GAAG;QAC1E,CAAC,CAAC,SAAS,CAAA;IACb,GAAG,CAAC,cAAc,EAAE,aAAa,EAAE,WAAW,KAAK,IAAI,CAAC,CAAA;IAExD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAA;IAChG,MAAM,iBAAiB,GAAG,oBAAoB,EAAE,CAAA;IAChD,MAAM,mBAAmB,GAAG,aAAa;QACvC,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC;YAC7B,CAAC,CAAC,mBAAmB,iBAAiB,EAAE;YACxC,CAAC,CAAC,kCAAkC,iBAAiB,EAAE,CAAA;IAC3D,GAAG,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAA;IAEhD,SAAS;IACT,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;IAClC,GAAG,CAAC,aAAa,EAAE,gBAAgB,IAAI,eAAe,CAAC,CAAA;IACvD,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;IACxB,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACxC,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAA;IACvC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;IAC7E,GAAG,CAAC,kBAAkB,EAAE,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IACzE,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QACpD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YAC/B,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACrC,OAAO,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,4CAA4C,CAAA;QACjG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACf,CAAC,CAAC,MAAM,CAAC,CAAA;IACX,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC5C,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,gBAAgB,CAAC,CAAA;IAClE,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,CAAA;IAC7D,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc;QACnE,CAAC,CAAC,0BAA0B;QAC5B,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAElD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IACxE,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/C,CAAC;IAED,yDAAyD;IACzD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,EAAE,CAAA;QACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAA;QAChC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACxC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,IAAI,qBAAqB,EAAE,KAAK,CAAC,CAAA;QAC/D,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,IAAI,SAAS,CAAC,CAAA;YACrD,IAAI,MAAM,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAA;gBAC7F,GAAG,CAAC,WAAW,EAAE,GAAG,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;YACxE,CAAC;iBAAM,CAAC;gBACN,wEAAwE;gBACxE,4EAA4E;gBAC5E,8EAA8E;gBAC9E,GAAG,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,YAAY,IAAI,qBAAqB,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;gBAC7F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC,CAAA;YACzF,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;IACP,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;IAChC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAChE,GAAG,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,CAAA;IACtD,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAA;IAC3B,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;IAClC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAA;QACrC,MAAM,EAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QACpC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,QAAQ,EAAE,CAAC,CAAA;IACxC,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;IAClC,CAAC;IAED,iBAAiB;IACjB,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;IAClC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC/C,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,SAAS,EAAE,wDAAwD,CAAC,CAAA;IAC1E,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,aAAa,eAAe,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,aAAa,MAAM,CAAC,aAAa,mBAAmB,KAAK,CAAC,GAAG,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAA;IAClM,CAAC;IAED,eAAe;IACf,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;IAChC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QAC9E,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;IAClC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,QAAQ,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QAChF,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;IACnC,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAA;AACf,CAAC"}

package/dist/commands/watch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"watch.d.ts","sourceRoot":"","sources":["../../src/commands/watch.ts"],"names":[],"mappings":"AAyKA,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED,wBAAsB,QAAQ,CAAC,IAAI,GAAE,SAAc,iBAqvClD"}
+{"version":3,"file":"watch.d.ts","sourceRoot":"","sources":["../../src/commands/watch.ts"],"names":[],"mappings":"AA2KA,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAuBD,wBAAsB,QAAQ,CAAC,IAAI,GAAE,SAAc,iBAo1ClD"}

package/dist/commands/watch.js

@@ -3,18 +3,19 @@ import chalk from 'chalk';
 import { createWebhookServer } from '../github/webhook.js';
 import { createGithubClient, getCommitMessage, registerOrgWebhook, deleteOrgWebhook, registerRepoWebhook, deleteRepoWebhook, patchOrgWebhookEvents, patchRepoWebhookEvents, findOrgWebhook, findRepoWebhook, listUserRepos, checkRepoAccessible, } from '../github/client.js';
 import { detectOriginFull, assignReviewer } from '../github/detector.js';
-import { loadConfig, getGithubToken, getWebhookSecret, resolveConfigPath, promptDeploymentMode, detectScopesForDeployment, patchDeploymentConfig, detectGitHubLogin, } from '../config/loader.js';
+import { loadConfig, getGithubToken, getWebhookSecret, resolveConfigPath, promptDeploymentMode, detectScopesForDeployment, patchDeploymentConfig, detectGitHubLogin, getLinearCredentials, } from '../config/loader.js';
 import { randomFortune } from '../lib/fortune.js';
 import { scanUnreviewedPRs } from '../lib/backtrace.js';
 import { initLogger, log as fileLog, logError, logUncaught } from '../lib/logger.js';
 import { isAuthorAllowed } from '../lib/filter.js';
 import { runWorkflow } from '../lib/runner.js';
-import { loadWorkflow, DEFAULT_RECHECK_INSTRUCTIONS } from '../lib/workflow.js';
-import { filterStepsByTypes, formatRepoWorkflowSteps, isRecheckWithoutFix, isReviewOnlyWorkflow, readRepoWorkflowStepTypes, resolveRepoWorkflowSteps, workflowHasStep } from '../lib/repo-workflow.js';
+import { loadWorkflow, linearWritePossible, DEFAULT_RECHECK_INSTRUCTIONS } from '../lib/workflow.js';
+import { filterStepsByTypes, formatRepoWorkflowSteps, isReviewOnlyWorkflow, readRepoWorkflowStepTypes, resolveRepoWorkflowSteps, workflowHasStep } from '../lib/repo-workflow.js';
 import { fetchStepHistory, identifyNextWorkflowStep, decideReviewOnly } from '../lib/pr-workflow-state.js';
 import { parseAnnotation } from '../lib/annotation.js';
 import { PRBoard, fmtTime, FMT_TIME_WIDTH } from '../lib/board.js';
 import { clonePRForReview } from '../lib/clone.js';
+import { resolveLinearAuth, isLinearConfigError } from '../linear/identity.js';
 import { getSmartSwitch, isSubscriptionLimitError, detectFailedVendor, triggerSwitch, notifyReviewSuccess, stopSmartSwitch, } from '../lib/smart-switch.js';
 import { buildReviewFailedCommentBody } from '../lib/comment-bodies.js';
 import { classifyReviewerError } from '../lib/reviewer-error.js';
@@ -128,6 +129,21 @@ function openTunnel(localPort) {
         });
     });
 }
+// PR history is what decides whether a step runs at all — the approval stop, the
+// per-SHA dedup, the resume point. Acting without it means posting a duplicate review
+// or modifying an already-approved commit, so callers fail closed rather than assume an
+// empty history. One short retry first: the usual cause is a transient GitHub blip or a
+// rate-limit tick, and deferring the event strands the PR until something else happens.
+const HISTORY_RETRY_DELAY_MS = 3_000;
+async function fetchStepHistoryWithRetry(owner, repo, prNumber, token) {
+    try {
+        return await fetchStepHistory(owner, repo, prNumber, token);
+    }
+    catch {
+        await new Promise(resolve => setTimeout(resolve, HISTORY_RETRY_DELAY_MS));
+        return await fetchStepHistory(owner, repo, prNumber, token);
+    }
+}
 export async function runWatch(opts = {}) {
     const configPath = opts.config;
     let config = loadConfig(configPath);
@@ -156,6 +172,25 @@ export async function runWatch(opts = {}) {
         console.error(chalk.red(`✗ ${err instanceof Error ? err.message : String(err)}`));
         process.exit(1);
     }
+    // Preflight Linear identity at startup. watch is a long-running daemon: a bad
+    // credential discovered per-event would either drop events silently or spam the
+    // board. Fail loudly at boot instead, the way the run path fails before its
+    // clone. The token is discarded — per-event resolution mints a fresh one, since
+    // app tokens outlive neither a long daemon run nor a rotation.
+    // Same gate as the run and per-event paths: a daemon whose configured workflow
+    // is fix/conflict-resolve only can never call notifyLinear, so a missing
+    // credential must not stop it booting.
+    if (linearWritePossible(config.linear, loadWorkflow(process.cwd()))) {
+        try {
+            const preflight = await resolveLinearAuth(config.linear, getLinearCredentials(config.linear.auth));
+            console.log(chalk.dim(`  linear: ${preflight.mode} — writes as ${preflight.actor}`));
+        }
+        catch (err) {
+            logError({ command: 'watch', phase: 'linear-auth' }, err);
+            console.error(chalk.red(`✗ ${err instanceof Error ? err.message : String(err)}`));
+            process.exit(isLinearConfigError(err) ? 1 : 2);
+        }
+    }
     fileLog({ level: 'info', event: 'session_start', command: 'watch' });
     // Fetch the authenticated user so the onComment handler can reject annotation
     // injection from non-token accounts. If this fails, the handler is disabled
@@ -191,12 +226,16 @@ export async function runWatch(opts = {}) {
     // Last-reviewed diff hash per PR — skip reviews when a new SHA has identical diff vs base
     // (force-push, amend, no-op rebase). Persisted so restarts don't re-review unchanged content.
     const diffHashes = new PersistentDiffHashMap();
-    // PRs reviewed at least once this session — synchronize events on these run as recheck rounds
-    const reviewedPRKeys = new Set();
+    // Completed round count per PR — the auto-loop's round counter, which history cannot
+    // supply (it returns the last recheck's round unchanged across iterations).
     const prRoundCounts = new Map();
-    // PR+sha pairs completed by this watch session — used to suppress issue_comment
-    // re-entries for reviews that watch posted itself (as opposed to kickass).
-    const reviewedPRShaKeys = new Set();
+    // Comment IDs the issue_comment bridge has already handled, so a webhook redelivery
+    // of the same comment does not dispatch twice. There is no need to guess at which
+    // comments are "ours": webhook.ts forwards only `trigger=kickass` annotations, and
+    // this watcher's own reviews carry trigger=watch/comment/backtrace, so they never
+    // reach the bridge. Every comment that does reach it is a kickass dispatch whose
+    // verdict this watcher is meant to act on — history detection decides how.
+    const handledCommentIds = new Set();
     // Idle tracking — reset on any PR activity; used by the idle-issue timer.
     let lastActivityAt = Date.now();
     let idleAnalysisRunning = false;
@@ -215,6 +254,7 @@ export async function runWatch(opts = {}) {
                 fileLog({ level: 'info', event: 'pr_skipped', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'author_not_allowed', author: params.author });
                 return;
             }
+            const prKey = `${owner}/${repoName}#${prNumber}`;
             const { origin, method: originMethod } = await detectOriginFull(params.body ?? '', params.headRef, owner, repoName, prNumber, config, token, params.author);
             // Smart-switch: when cross-vendor is degraded, override to single-vendor with the healthy vendor
             const ss = getSmartSwitch();
@@ -235,9 +275,16 @@ export async function runWatch(opts = {}) {
                 title: params.title,
                 body: params.body ?? '',
                 head: { ref: params.headRef, sha: params.headSha, repo: params.headRepo ? { full_name: params.headRepo } : null },
-                base: { ref: params.baseRef, repo: { full_name: `${owner}/${repoName}` } },
+                base: {
+                    ref: params.baseRef,
+                    repo: {
+                        full_name: `${owner}/${repoName}`,
+                        ...(params.defaultBranch !== undefined && { default_branch: params.defaultBranch }),
+                    },
+                },
                 html_url: `https://github.com/${owner}/${repoName}/pull/${prNumber}`,
                 user: { login: params.author },
+                ...(params.labels !== undefined && { labels: params.labels.map(name => ({ name })) }),
             };
             if (!acquirePRLock(owner, repoName, prNumber, params.headSha)) {
                 fileLog({ level: 'info', event: 'pr_skipped', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'in_progress_local' });
@@ -257,21 +304,26 @@ export async function runWatch(opts = {}) {
                 logError({ repo: `${owner}/${repoName}`, pr: prNumber, phase: 'lock' }, err);
                 return;
             }
-            const prKey = `${owner}/${repoName}#${prNumber}`;
-            // Determine the correct starting step from PR comment history so watch
-            // behaves correctly after a restart (reviewedPRKeys is in-memory only).
-            // Fast-path: if the PR was reviewed in this session, skip the API call.
-            // Exception: comment-triggered runs must always do live detection —
-            // reviewedPRKeys is SHA-agnostic and would misroute a kickass review
-            // annotation for a new SHA as a recheck run instead of routing to fix.
-            // auto_loop runs also skip the session fast-path so history detection
-            // picks the correct starting step (fix, not recheck); round is instead
-            // incremented from prRoundCounts to match the completed round count.
-            let isRecheckRun = params.action === 'comment'
-                ? reviewedPRShaKeys.has(key) // SHA-specific: already processed this exact sha
-                : params.action === 'auto_loop'
-                    ? false // always use history detection for auto-loop rounds
-                    : reviewedPRKeys.has(prKey); // session fast-path for webhook/backtrace events
+            // Determine the correct starting step from PR comment history. Webhook, backtrace,
+            // and auto_loop events always ask — there is no PR-level session fast-path.
+            //
+            // There used to be one (`reviewedPRKeys`): reviewed-in-this-session meant "run the
+            // next event as a recheck". It was wrong by construction on two axes. It is
+            // SHA-agnostic, so a push it had never seen inherited the previous SHA's routing;
+            // and it only knows what THIS process did, so an approval, a forced re-review, or a
+            // fix pushed by `kickass`, `crosscheck run`, or a second watcher was invisible to
+            // it. Each case where it guessed wrong grew its own guard — recheck-no-fix depth,
+            // repo overrides, approvals — and every one of those guards did the same thing:
+            // undo the guess and ask history. So ask history. It costs one call per event, and
+            // it is the only thing that sees the PR as it actually is.
+            //
+            // Comment triggers ask too. The SHA-specific fast path they used to take ran an
+            // externally-posted NEEDS_WORK as a recheck instead of routing to fix, because it
+            // skipped detection whenever this session had already touched the SHA.
+            let isRecheckRun = false;
+            // auto_loop's round is pre-computed from the completed round count rather than
+            // from history, which returns the last recheck's round unchanged across iterations
+            // and would defeat the max_rounds cap.
             let round = params.action === 'auto_loop'
                 ? (prRoundCounts.get(prKey) ?? 1) + 1
                 : isRecheckRun ? (prRoundCounts.get(prKey) ?? 1) + 1 : 1;
@@ -285,17 +337,6 @@ export async function runWatch(opts = {}) {
                 isRecheckRun = false;
                 round = 1;
             }
-            // A recheck-no-fix depth (`review,recheck`) decides review-vs-recheck per SHA from
-            // the last verdict: an unresolved review gets a recheck, an APPROVE gets a fresh
-            // review (identifyNextWorkflowStep). The session fast-path above is PR-level and
-            // SHA-agnostic, so it would coerce every later push in this process into a recheck
-            // and never consult that decision. Force history detection instead. Comment-
-            // triggered runs keep their SHA-specific fast path — a kickass re-review targets a
-            // SHA history detection would report as already complete.
-            if (isRecheckWithoutFix(repoStepOverride) && isRecheckRun && params.action !== 'comment') {
-                isRecheckRun = false;
-                round = 1;
-            }
             if (reviewOnlyForRepo) {
                 // Review-only comes from a per-repo override (crosscheck alter --review-only).
                 // Restrict the workflow to review step(s) and dedup on the exact head sha so
@@ -312,7 +353,7 @@ export async function runWatch(opts = {}) {
                 round = 1;
                 resolvedSteps = reviewSteps;
                 try {
-                    const history = await fetchStepHistory(owner, repoName, prNumber, token);
+                    const history = await fetchStepHistoryWithRetry(owner, repoName, prNumber, token);
                     const decision = decideReviewOnly(history, params.headSha);
                     if (decision.alreadyReviewed) {
                         await releaseRemoteLock(lockOctokit, owner, repoName, params.headSha, 'success');
@@ -322,7 +363,18 @@ export async function runWatch(opts = {}) {
                     }
                     round = decision.round;
                 }
-                catch { /* best-effort — fall back to a fresh round-1 review */ }
+                catch (err) {
+                    // The dedup this mode relies on lives in that history. Reviewing without it
+                    // would post a second review on a SHA already covered.
+                    // Released as `failure`, not `success`: this SHA was not reviewed, and
+                    // `crosscheck/review` is a commit status a repo can require for merge — a
+                    // green one here would let an unreviewed HEAD satisfy branch protection
+                    // during a GitHub outage.
+                    await releaseRemoteLock(lockOctokit, owner, repoName, params.headSha, 'failure');
+                    releasePRLock(owner, repoName, prNumber, params.headSha);
+                    fileLog({ level: 'warn', event: 'pr_skipped', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'history_unavailable', sha: params.headSha, error: err instanceof Error ? err.message : String(err) });
+                    return;
+                }
             }
             else if (!isRecheckRun) {
                 try {
@@ -331,14 +383,14 @@ export async function runWatch(opts = {}) {
                     // fresh so live edits to workflow.yml apply across events.
                     const globalWorkflow = loadWorkflow(process.cwd());
                     const allSteps = repoStepOverride ? filterStepsByTypes(globalWorkflow, repoStepOverride) : globalWorkflow;
-                    const history = await fetchStepHistory(owner, repoName, prNumber, token);
+                    const history = await fetchStepHistoryWithRetry(owner, repoName, prNumber, token);
                     const nextResult = identifyNextWorkflowStep(history, allSteps, params.headSha);
                     if (nextResult.step === null) {
                         // Workflow already complete for this HEAD sha — release lock and skip.
                         // Happens when a synchronize event fires after all steps are done.
                         await releaseRemoteLock(lockOctokit, owner, repoName, params.headSha, 'success');
                         releasePRLock(owner, repoName, prNumber, params.headSha);
-                        fileLog({ level: 'info', event: 'pr_skipped', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'workflow_complete', sha: params.headSha });
+                        fileLog({ level: 'info', event: 'pr_skipped', repo: `${owner}/${repoName}`, pr: prNumber, reason: nextResult.stopReason ?? 'workflow_complete', sha: params.headSha });
                         return;
                     }
                     if (nextResult.hasExistingReview) {
@@ -391,15 +443,26 @@ export async function runWatch(opts = {}) {
                         }
                     }
                 }
-                catch {
-                    // best-effort — fall back to session-based detection.
-                    // For auto_loop, force isRecheckRun=true so a transient history-fetch
-                    // failure does not restart the workflow from the review step.
-                    // A recheck-no-fix repo has no session state left to fall back to (the guard
-                    // above cleared it), so it re-reviews the new SHA — the conservative direction,
-                    // since a fresh review never assumes findings that may already be resolved.
-                    if (params.action === 'auto_loop')
-                        isRecheckRun = true;
+                catch (err) {
+                    // History still unreadable after the retry. Everything this function decides —
+                    // whether HEAD is already approved, already reviewed, or mid-loop — lives in
+                    // that history, so running anyway risks a second review on an approved commit
+                    // or a fix re-applied to code that already has one. Defer instead: release the
+                    // locks and let the next event, `kickass`, or `crosscheck run` pick the PR up.
+                    //
+                    // auto_loop is the exception. It is a continuation of a run this process just
+                    // completed, so the state is known from the session rather than from history,
+                    // and deferring would strand the loop — nothing else re-triggers it.
+                    if (params.action !== 'auto_loop') {
+                        // `failure`, not `success` — see the review-only branch above: a green
+                        // `crosscheck/review` on a HEAD nobody reviewed can satisfy branch
+                        // protection.
+                        await releaseRemoteLock(lockOctokit, owner, repoName, params.headSha, 'failure');
+                        releasePRLock(owner, repoName, prNumber, params.headSha);
+                        fileLog({ level: 'warn', event: 'pr_skipped', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'history_unavailable', sha: params.headSha, error: err instanceof Error ? err.message : String(err) });
+                        return;
+                    }
+                    isRecheckRun = true;
                 }
             }
             const reviewStart = Date.now();
@@ -407,6 +470,32 @@ export async function runWatch(opts = {}) {
             let stopHeartbeat = () => { };
             let boardAdded = false;
             try {
+                // Board first, so any failure below is visible rather than swallowed by the
+                // enclosing catch (which only calls logError — a no-op when file logging is
+                // off). Then auth, then the clone: during an outage a long-running watcher
+                // would otherwise pay for a full clone on every event before rejecting it.
+                // Computed here rather than at the runWorkflow call so the auth gate below
+                // sees the workflow that will actually run. resolvedSteps alone is
+                // undefined for a plain event, and canWriteVerdict fails open on undefined
+                // — which let a fix-only daemon resolve credentials on every event.
+                const workflowStepsForRun = resolvedSteps
+                    ?? (repoStepOverride ? filterStepsByTypes(loadWorkflow(process.cwd()), repoStepOverride) : loadWorkflow(process.cwd()));
+                board.addPR(key, prNumber, `${owner}/${repoName}`, params.headRef, round);
+                boardAdded = true;
+                // Only workflows that can write a verdict need an identity — the fix and
+                // resolve paths never call notifyLinear.
+                let linearAuth = null;
+                if (linearWritePossible(effectiveConfig.linear, workflowStepsForRun)) {
+                    try {
+                        linearAuth = await resolveLinearAuth(effectiveConfig.linear, getLinearCredentials(effectiveConfig.linear.auth));
+                    }
+                    catch (err) {
+                        const message = err instanceof Error ? err.message : String(err);
+                        board.failPR(key, `linear identity unavailable: ${message}`);
+                        fileLog({ level: 'error', event: 'linear_auth_failed', repo: `${owner}/${repoName}`, pr: prNumber, reason: message });
+                        throw err;
+                    }
+                }
                 await clonePRForReview({
                     owner, repo: repoName, prNumber, baseRef: params.baseRef,
                     tmpDir, token, protocol: config.clone_protocol,
@@ -442,18 +531,18 @@ export async function runWatch(opts = {}) {
                         logError({ repo: `${owner}/${repoName}`, pr: prNumber, phase: 'no_diff_comment' }, err);
                     }
                     await releaseRemoteLock(lockOctokit, owner, repoName, params.headSha, 'success');
+                    // The PR is on the board from before the clone, so close its slot rather
+                    // than leaving a row that never resolves.
+                    board.completePR(key, { elapsedMs: Date.now() - reviewStart, url: `https://github.com/${owner}/${repoName}/pull/${prNumber}` });
                     return;
                 }
-                board.addPR(key, prNumber, `${owner}/${repoName}`, params.headRef, round);
-                boardAdded = true;
                 const prLoc = computePRLoc(tmpDir, params.baseRef);
                 board.updatePR(key, { prLoc });
                 stopHeartbeat = startRemoteLockHeartbeat(lockOctokit, owner, repoName, params.headSha);
-                const workflowStepsForRun = resolvedSteps
-                    ?? (repoStepOverride ? filterStepsByTypes(loadWorkflow(process.cwd()), repoStepOverride) : undefined);
-                const { verdict, fixAppliedCount } = await runWorkflow({
+                const { verdict, fixAppliedCount, strategySkipped } = await runWorkflow({
                     owner, repoName, prNumber, pr,
                     tmpDir, token, config: effectiveConfig, origin,
+                    linearAuth,
                     reviewStart,
                     log: (msg) => bLog(`${chalk.dim(fmtTime())}  ${msg}`),
                     onPhaseChange: (label, data) => board.updatePR(key, { label, ...data }),
@@ -470,10 +559,11 @@ export async function runWatch(opts = {}) {
                     round,
                     trigger: params.action === 'backtrace' ? 'backtrace' : params.action === 'comment' ? 'comment' : 'watch',
                 });
-                void verdict;
-                reviewedPRKeys.add(prKey);
-                reviewedPRShaKeys.add(key); // key = "owner/repo#pr@sha"
-                prRoundCounts.set(prKey, round);
+                // A strategy-skipped PR never ran a review, so it must not advance the
+                // auto-loop's round counter — that run posted nothing to count.
+                if (strategySkipped === undefined) {
+                    prRoundCounts.set(prKey, round);
+                }
                 // Recompute the diff hash AFTER runWorkflow — workflow steps such as
                 // `conflict-resolve` or `fix` followed by `recheck` can mutate the checkout,
                 // so the pre-workflow hash may not represent the content that was actually
@@ -493,7 +583,10 @@ export async function runWatch(opts = {}) {
                     }
                     catch { /* fall back — skip auto-loop this cycle */ }
                 }
-                if (newDiffHash) {
+                // Same gate as the session caches above: caching the diff of a PR that was
+                // never reviewed would make the first event that *should* review it get
+                // skipped as `no_diff_change`.
+                if (newDiffHash && strategySkipped === undefined) {
                     // For non-commit delivery with an applied fix the checkout may be on a fix
                     // branch; computeDiffHash would return the post-fix diff, not the original PR
                     // diff. Caching that under prKey corrupts future no_diff_change checks for the
@@ -514,9 +607,15 @@ export async function runWatch(opts = {}) {
                         }
                     }
                 }
+                // A class-skipped PR (e.g. lockfile-only) never ran a review, so say so
+                // rather than reporting it as a completed one.
+                if (strategySkipped) {
+                    bLog(`${chalk.dim(fmtTime())}  ${chalk.dim(`PR #${prNumber} skipped — ${strategySkipped} class, nothing to review`)}`);
+                }
                 board.completePR(key, {
                     elapsedMs: Date.now() - reviewStart,
                     url: `github.com/${owner}/${repoName}/pull/${prNumber}`,
+                    ...(strategySkipped !== undefined && { label: `skipped · ${strategySkipped}` }),
                 });
                 // Smart-switch recovery confirmation: if a restore attempt is pending and
                 // this reviewer matches the previously-degraded vendor, announce full restoration.
@@ -649,6 +748,8 @@ export async function runWatch(opts = {}) {
             title: pr.title, body: pr.body, author: pr.user.login,
             headSha: pr.head.sha, headRef: pr.head.ref, headRepo: pr.head.repo?.full_name ?? null,
             baseRef: pr.base.ref, action: event.action,
+            ...(pr.labels !== undefined && { labels: pr.labels.map(l => l.name) }),
+            ...(pr.base.repo.default_branch !== undefined && { defaultBranch: pr.base.repo.default_branch }),
         });
     }, (msg) => bLog(chalk.dim(fmtTime()) + '  ' + msg), fileLog, async (event) => {
         const owner = event.repository.owner.login;
@@ -698,10 +799,11 @@ export async function runWatch(opts = {}) {
                 fileLog({ level: 'info', event: 'pr_skipped', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'comment_stale_sha', sha: prData.head.sha, annotation_sha: annotationSha });
                 return;
             }
-            if (reviewedPRShaKeys.has(`${owner}/${repoName}#${prNumber}@${prData.head.sha}`)) {
-                fileLog({ level: 'info', event: 'pr_skipped', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'comment_self_trigger', sha: prData.head.sha });
+            if (handledCommentIds.has(event.comment.id)) {
+                fileLog({ level: 'info', event: 'pr_skipped', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'comment_already_handled', comment_id: event.comment.id });
                 return;
             }
+            handledCommentIds.add(event.comment.id);
             // GitHub can deliver issue_comment before ck run's finally block releases
             // the remote lock. Retry with backoff; re-fetch the PR head on each attempt
             // so we don't dispatch against a sha that advanced while we were waiting.
@@ -725,10 +827,6 @@ export async function runWatch(opts = {}) {
                         break;
                     }
                 }
-                if (reviewedPRShaKeys.has(`${owner}/${repoName}#${prNumber}@${prData.head.sha}`)) {
-                    fileLog({ level: 'info', event: 'pr_skipped', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'comment_self_trigger', sha: prData.head.sha });
-                    break;
-                }
                 if (await checkRemoteLock(octokit, owner, repoName, prData.head.sha).catch(() => false)) {
                     fileLog({ level: 'info', event: 'comment_trigger_deferred', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'in_progress_remote', attempt });
                     continue;
@@ -743,6 +841,11 @@ export async function runWatch(opts = {}) {
                     headRepo: prData.head.repo?.full_name ?? null,
                     baseRef: prData.base.ref,
                     action: 'comment',
+                    // Same fields the webhook path forwards: without them the risky
+                    // class's label and hotfix rules classify this PR differently
+                    // depending on which trigger ran it.
+                    ...(prData.labels !== undefined && { labels: prData.labels.map((l) => l.name) }),
+                    ...(prData.base.repo?.default_branch !== undefined && { defaultBranch: prData.base.repo.default_branch }),
                 });
                 break;
             }
@@ -1029,6 +1132,8 @@ export async function runWatch(opts = {}) {
                     title: pr.title, body: pr.body, author: pr.author,
                     headSha: pr.headSha, headRef: pr.headRef, headRepo: pr.headRepo,
                     baseRef: pr.baseRef, action: 'backtrace',
+                    ...(pr.labels !== undefined && { labels: pr.labels }),
+                    ...(pr.defaultBranch !== undefined && { defaultBranch: pr.defaultBranch }),
                 })));
             }
             catch (err) {