@humanbased/crosscheck 1.3.0-beta.93 → 1.3.0-beta.95

package/dist/lib/auto-fix-branch.js

@@ -0,0 +1,88 @@
+// The separate-fix-PR path is the fallback taken when a fix cannot be pushed onto the
+// PR's own branch. Two things about it were broken in practice, and both are visible in
+// real logs: 43 fix PRs opened, 19 `base: invalid` API failures, 12 push rejections.
+//
+// 1. It opened the PR against the source PR's head branch — which is missing in exactly
+//    the case that sends us down this path (PR merged, branch auto-deleted). The
+//    fallback failed for its own primary trigger, after having already pushed a branch,
+//    leaving that branch orphaned.
+// 2. It pushed with a plain `git push`, so a fix branch left behind by an earlier round
+//    of the same PR made the push non-fast-forward and the fix was lost.
+import { autoFixBranchName, isCrosscheckAutoFixPR } from '../github/superseded-fix-pr.js';
+export function planAutoFixDelivery(baseBranchExists, baseBranch) {
+    return baseBranchExists
+        ? { kind: 'pull_request', base: baseBranch }
+        : { kind: 'comment', reason: 'base_branch_gone' };
+}
+// `--force-with-lease=<ref>:<oid>` states the remote value we believe we are replacing.
+// With an empty oid it means "expect this ref not to exist", so one form covers both
+// creating the branch and replacing a superseded one — and a branch someone else moved
+// in between fails the lease instead of being overwritten.
+//
+// Force is appropriate here only because the branch is crosscheck's own artifact for
+// one PR and one finding: the newer fix is built on the newer PR head and supersedes
+// whatever the previous round pushed. It is never used on a branch a human owns.
+export function forceWithLeaseArgs(branch, remoteOid) {
+    return [
+        'push',
+        `--force-with-lease=refs/heads/${branch}:${remoteOid ?? ''}`,
+        'origin',
+        `HEAD:${branch}`,
+    ];
+}
+// `git ls-remote --heads origin <branch>` prints "<oid>\t<ref>" per match, and nothing
+// at all when the branch does not exist.
+export function parseLsRemoteOid(output) {
+    const line = output.split('\n').map(l => l.trim()).find(Boolean);
+    if (!line)
+        return null;
+    const oid = line.split(/\s+/)[0];
+    return /^[0-9a-f]{40}$/i.test(oid) ? oid : null;
+}
+export function isLeaseRejection(message) {
+    return /stale info|force-with-lease|fetch first|non-fast-forward/i.test(message);
+}
+// Whether the fix branch that already exists on the remote is crosscheck's own artifact,
+// and so safe to replace.
+//
+// Anything the pusher controls is not evidence: a commit message trailer, an author or
+// committer name, and the branch name itself are all free-form strings that whoever
+// creates `fix/cr-<n>-review-issues` can set to whatever they like — so a human branch
+// carrying a `Crosscheck-Reviewer:` trailer would read as crosscheck's and be
+// force-overwritten. Ownership is instead taken from GitHub's own record: a pull request
+// **opened by the identity crosscheck authenticates as**, from this exact branch, whose
+// body carries the auto-fix marker. Another actor cannot produce that record without
+// crosscheck's credentials.
+//
+// The residual case is an install whose token belongs to a human who also works by hand:
+// there, "crosscheck" and "that person" are one account and no check can separate them.
+//
+// Closed PRs count — the branch is still crosscheck's artifact once it has opened a PR
+// from it. A branch with no such PR (an orphan left by a round that pushed before PR
+// creation failed) is deliberately not replaced: the fix is delivered as a diff instead,
+// which loses the follow-up PR but never someone else's commits.
+export function assessFixBranchOwnership(input) {
+    if (!input.crosscheckLogin)
+        return { owned: false, reason: 'identity_unknown' };
+    const login = input.crosscheckLogin.toLowerCase();
+    const fixBranch = autoFixBranchName(input.sourcePrNumber);
+    const ours = input.candidates.find(candidate => candidate.head?.ref === fixBranch
+        && candidate.user?.login?.toLowerCase() === login
+        && isCrosscheckAutoFixPR(candidate.body, input.sourcePrNumber));
+    return ours ? { owned: true, fixPrNumber: ours.number } : { owned: false, reason: 'no_crosscheck_fix_pr' };
+}
+// `pulls.create` rejecting the base branch, which is how a source PR that merges between
+// the pre-flight check and the create call reports itself: GitHub deleted the head branch
+// in that window, so the base we validated is gone by the time we ask for the PR.
+export function isInvalidBaseError(err) {
+    const failure = err;
+    if (failure?.status !== 422)
+        return false;
+    const errors = failure.response?.data?.errors ?? failure.errors ?? [];
+    if (errors.some(entry => entry?.field === 'base' && entry?.code === 'invalid'))
+        return true;
+    // Octokit's RequestError embeds the response body in its message; a shape we don't
+    // recognise field-by-field is still readable there.
+    return /"field"\s*:\s*"base"/.test(failure.message ?? '');
+}
+//# sourceMappingURL=auto-fix-branch.js.map

package/dist/lib/auto-fix-branch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-fix-branch.js","sourceRoot":"","sources":["../../src/lib/auto-fix-branch.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,wFAAwF;AACxF,qFAAqF;AACrF,EAAE;AACF,wFAAwF;AACxF,iFAAiF;AACjF,wFAAwF;AACxF,mCAAmC;AACnC,wFAAwF;AACxF,yEAAyE;AAEzE,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAUzF,MAAM,UAAU,mBAAmB,CAAC,gBAAyB,EAAE,UAAkB;IAC/E,OAAO,gBAAgB;QACrB,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE;QAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;AACrD,CAAC;AAED,wFAAwF;AACxF,qFAAqF;AACrF,uFAAuF;AACvF,2DAA2D;AAC3D,EAAE;AACF,qFAAqF;AACrF,qFAAqF;AACrF,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,SAAwB;IACzE,OAAO;QACL,MAAM;QACN,iCAAiC,MAAM,IAAI,SAAS,IAAI,EAAE,EAAE;QAC5D,QAAQ;QACR,QAAQ,MAAM,EAAE;KACjB,CAAA;AACH,CAAC;AAED,uFAAuF;AACvF,yCAAyC;AACzC,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAChE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAChC,OAAO,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AACjD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,2DAA2D,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AAClF,CAAC;AAeD,yFAAyF;AACzF,0BAA0B;AAC1B,EAAE;AACF,uFAAuF;AACvF,oFAAoF;AACpF,uFAAuF;AACvF,8EAA8E;AAC9E,yFAAyF;AACzF,wFAAwF;AACxF,qFAAqF;AACrF,4BAA4B;AAC5B,EAAE;AACF,yFAAyF;AACzF,wFAAwF;AACxF,EAAE;AACF,uFAAuF;AACvF,qFAAqF;AACrF,yFAAyF;AACzF,iEAAiE;AACjE,MAAM,UAAU,wBAAwB,CAAC,KAIxC;IACC,IAAI,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;IAC/E,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,CAAC,WAAW,EAAE,CAAA;IACjD,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;IACzD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAC7C,SAAS,CAAC,IAAI,EAAE,GAAG,KAAK,SAAS;WAC9B,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,KAAK;WAC9C,qBAAqB,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAA;IACjE,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAA;AAC5G,CAAC;AAED,yFAAyF;AACzF,0FAA0F;AAC1F,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,OAAO,GAAG,GAKf,CAAA;IACD,IAAI,OAAO,EAAE,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAA;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;IACrE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3F,mFAAmF;IACnF,oDAAoD;IACpD,OAAO,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;AAC3D,CAAC"}

package/dist/lib/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/lib/runner.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAA;AAEnE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAqB,KAAK,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAQjE,OAAO,EAAiC,KAAK,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAQ9F,OAAO,EAAuE,KAAK,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAKjJ,OAAO,EAAuE,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACzH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAsB9C,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGzD;AAaD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,MAAM,CAEpF;AAWD,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAA;IACb;;;;OAIG;IACH,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,qBAAqB,CAqB1G;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnF;AAOD,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,CAAA;AAE7F,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IACnC,cAAc,EAAE,OAAO,CAAA;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAOD,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,OAAO,GACP,eAAe,GACf,gBAAgB,GAChB,cAAc,CAAA;AAElB,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,sBAAsB,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsCzB;AAKD,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,MAAM,EACrB,gBAAgB,EAAE,MAAM,EACxB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAOT;AAKD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,OAAO,CAE1E;AAED,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,QAAQ,GAAG,SAAS,CAAA;AAanE,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,yBAAyB,GAAG,SAAS,CAAA;AACzE,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,eAAe,GAAG,UAAU,CAM3E;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,EAAE,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,QAAQ,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IAC1B,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,IAAI,CAAA;IAE1D,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAG3B,YAAY,CAAC,EAAE,OAAO,CAAA;IAEtB,KAAK,CAAC,EAAE,MAAM,CAAA;IAGd,MAAM,CAAC,EAAE,OAAO,CAAA;IAGhB,UAAU,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAGtC,KAAK,CAAC,EAAE,OAAO,eAAe,EAAE,YAAY,EAAE,CAAA;IAG9C,mBAAmB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;IAMxC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IAIrB,oBAAoB,CAAC,EAAE;QACrB,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;IAID,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAG1B,SAAS,CAAC,EAAE,OAAO,GAAG,WAAW,CAAA;IAGjC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAE1B,OAAO,CAAC,EAAE,eAAe,CAAA;IAIzB,YAAY,CAAC,EAAE,MAAM,CAAA;IAIrB,aAAa,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAA;CAChH;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB;uEACmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAA;IAGxB,eAAe,CAAC,EAAE,MAAM,CAAA;IAIxB,aAAa,CAAC,EAAE,MAAM,CAAA;IAItB,mBAAmB,CAAC,EAAE;QACpB,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;IACD;;;uDAGmD;IACnD,YAAY,CAAC,EAAE,YAAY,CAAA;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B;wEACoE;IACpE,GAAG,EAAE,MAAM,EAAE,CAAA;IACb;kCAC8B;IAC9B,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAC5C;AAKD,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAClC,YAAY,CAQd;AAWD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,IAAI,EAAE,YAAY,GAAG,SAAS,GAC7B,YAAY,GAAG,SAAS,CAY1B;AAkDD,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,wBAAgB,4BAA4B,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1F;AA8DD,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,GAC5B;IAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,GAAG,IAAI,CAAC;IAAC,iBAAiB,EAAE,OAAO,CAAC;IAAC,uBAAuB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;CAAE,CAEjH;AAKD,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,GAC5B;IAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,GAAG,IAAI,CAAC;IAAC,iBAAiB,EAAE,OAAO,CAAC;IAAC,uBAAuB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;CAAE,CAEjH;AAgCD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,CAsCrE;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,EAC7C,QAAQ,EAAE,gBAAgB,GAAG,IAAI,GAChC,eAAe,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,CAGtC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAC1D,MAAM,EAAE,CAAC,EACT,QAAQ,EAAE,gBAAgB,GAAG,IAAI,EACjC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,CAAC,CAKH;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACjC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,EACjC,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAIT;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,eAAe,GAAG,gBAAgB,GAAG,IAAI,CAKlF;AAED,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACjC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAA;IACzC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAA;IACvC,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,GAAG,IAAI,EACjC,KAAK,EAAE,MAAM,GACZ,cAAc,CA4ChB;AAuHD,wBAAsB,WAAW,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CA2qC/E"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/lib/runner.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAA;AAEnE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAqB,KAAK,MAAM,EAAE,MAAM,kBAAkB,CAAA;AASjE,OAAO,EAAiC,KAAK,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAQ9F,OAAO,EAAuE,KAAK,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAOjJ,OAAO,EAAuE,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACzH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAsB9C,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGzD;AAaD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,MAAM,CAEpF;AAWD,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAA;IACb;;;;OAIG;IACH,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,qBAAqB,CAqB1G;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnF;AAOD,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,CAAA;AAE7F,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IACnC,cAAc,EAAE,OAAO,CAAA;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAOD,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,OAAO,GACP,eAAe,GACf,gBAAgB,GAChB,cAAc,CAAA;AAElB,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,sBAAsB,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsCzB;AAKD,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,MAAM,EACrB,gBAAgB,EAAE,MAAM,EACxB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAOT;AAKD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,OAAO,CAE1E;AAED,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,QAAQ,GAAG,SAAS,CAAA;AAanE,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,yBAAyB,GAAG,SAAS,CAAA;AACzE,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,eAAe,GAAG,UAAU,CAM3E;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,EAAE,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,QAAQ,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IAC1B,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,IAAI,CAAA;IAE1D,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAG3B,YAAY,CAAC,EAAE,OAAO,CAAA;IAEtB,KAAK,CAAC,EAAE,MAAM,CAAA;IAGd,MAAM,CAAC,EAAE,OAAO,CAAA;IAGhB,UAAU,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAGtC,KAAK,CAAC,EAAE,OAAO,eAAe,EAAE,YAAY,EAAE,CAAA;IAG9C,mBAAmB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;IAMxC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IAIrB,oBAAoB,CAAC,EAAE;QACrB,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;IAID,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAG1B,SAAS,CAAC,EAAE,OAAO,GAAG,WAAW,CAAA;IAGjC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAE1B,OAAO,CAAC,EAAE,eAAe,CAAA;IAIzB,YAAY,CAAC,EAAE,MAAM,CAAA;IAIrB,aAAa,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAA;CAChH;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB;uEACmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAA;IAGxB,eAAe,CAAC,EAAE,MAAM,CAAA;IAIxB,aAAa,CAAC,EAAE,MAAM,CAAA;IAItB,mBAAmB,CAAC,EAAE;QACpB,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;IACD;;;uDAGmD;IACnD,YAAY,CAAC,EAAE,YAAY,CAAA;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B;wEACoE;IACpE,GAAG,EAAE,MAAM,EAAE,CAAA;IACb;kCAC8B;IAC9B,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAC5C;AAKD,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAClC,YAAY,CAQd;AAWD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,IAAI,EAAE,YAAY,GAAG,SAAS,GAC7B,YAAY,GAAG,SAAS,CAY1B;AAkDD,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,wBAAgB,4BAA4B,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1F;AA8DD,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,GAC5B;IAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,GAAG,IAAI,CAAC;IAAC,iBAAiB,EAAE,OAAO,CAAC;IAAC,uBAAuB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;CAAE,CAEjH;AAKD,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,GAC5B;IAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,GAAG,IAAI,CAAC;IAAC,iBAAiB,EAAE,OAAO,CAAC;IAAC,uBAAuB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;CAAE,CAEjH;AAgCD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,CAsCrE;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,EAC7C,QAAQ,EAAE,gBAAgB,GAAG,IAAI,GAChC,eAAe,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,CAGtC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAC1D,MAAM,EAAE,CAAC,EACT,QAAQ,EAAE,gBAAgB,GAAG,IAAI,EACjC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,CAAC,CAKH;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACjC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,EACjC,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAIT;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,eAAe,GAAG,gBAAgB,GAAG,IAAI,CAKlF;AAED,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACjC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAA;IACzC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAA;IACvC,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,GAAG,IAAI,EACjC,KAAK,EAAE,MAAM,GACZ,cAAc,CA4ChB;AAuHD,wBAAsB,WAAW,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAu2C/E"}

package/dist/lib/runner.js

@@ -11,6 +11,7 @@ import { runFixStep, runCodexFixStep } from '../reviewers/fix.js';
 import { runConflictResolveStep, findConflictedFiles } from '../reviewers/conflict-resolve.js';
 import { parseVerdict, prependVerdictToComment, NULL_VERDICT_WARNING, applySeverityGate, SEVERITY_GATE_NOTE } from '../lib/verdict.js';
 import { createGithubClient, postReviewComment, getLastCrossCheckCommentId, getLastCrossCheckReviewComment } from '../github/client.js';
+import { autoFixBranchName, autoFixPRIntro, sourcePRHasMerged } from '../github/superseded-fix-pr.js';
 import { verifyReviewedSha, isVerifiedReviewedSha, reviewedShaRejection } from '../github/reviewed-sha.js';
 import { resolveLinearAuth, withWorker } from '../linear/identity.js';
 import { notifyLinear } from '../linear/notify.js';
@@ -23,6 +24,7 @@ import { resolveClaudeModel, resolveCodexModel } from '../lib/review-models.js';
 import { resolveReviewStrategy, escalate, clampToLevels } from './review-strategy.js';
 import { CLAUDE_EFFORT_LEVELS, CODEX_EFFORT_LEVELS } from '../config/schema.js';
 import { buildStepIdentityFields } from '../lib/event-fields.js';
+import { planAutoFixDelivery, forceWithLeaseArgs, parseLsRemoteOid, isLeaseRejection, assessFixBranchOwnership, isInvalidBaseError } from '../lib/auto-fix-branch.js';
 import { prOpenToVerdictMs } from '../lib/adoption.js';
 import { buildAttributionFooter, buildFixAppliedCommentBody, buildFixFailedCommentBody, buildConflictResolvedCommentBody, buildRetriedReviewBanner } from '../lib/comment-bodies.js';
 import { linearWritePossible, loadWorkflow, loadHarnessSection, evaluateWhen } from '../lib/workflow.js';
@@ -1413,39 +1415,230 @@ export async function runWorkflow(ctx) {
                         results[step.name] = { applied_count: appliedCount, tokens_used: fixTokensUsed, vendor: activeVendor };
                     }
                     else {
-                        // Fallback: the fix could not land on the PR branch. Push the same commit to
-                        // a dedicated branch and open a follow-up PR targeting the original branch.
-                        const fixBranch = `fix/cr-${prNumber}-review-issues`;
-                        execSync(`git push origin HEAD:${fixBranch}`, {
-                            cwd: tmpDir,
-                            env: { ...process.env, GITHUB_TOKEN: token, GH_TOKEN: token },
-                        });
+                        // Fallback: the fix could not land on the PR branch. Push the same commit to a
+                        // dedicated branch and open a follow-up PR targeting the original branch.
+                        const fixBranch = autoFixBranchName(prNumber);
+                        const gitEnv = { ...process.env, GITHUB_TOKEN: token, GH_TOKEN: token };
                         const octokit = createGithubClient(token);
+                        // The fallback commit exists only in this clone until something pushes it, so
+                        // every path that ends without delivering it as a PR has to put HEAD back on the
+                        // PR head. Otherwise a later recheck reviews that commit and stamps its verdict
+                        // either with a sha the repository cannot resolve — which verifyReviewedSha
+                        // refuses to post (#290) — or with one no open PR carries.
+                        const restorePRHeadInClone = () => {
+                            execSync('git reset --hard HEAD~1', { cwd: tmpDir, stdio: 'pipe' });
+                        };
+                        // Deliver the fix as a diff on the original PR. Used wherever opening the
+                        // follow-up PR would either create a stale artifact or overwrite a branch that
+                        // is not ours: the work still reaches a human, just not as a branch.
+                        const deliverFixAsComment = async (outcome) => {
+                            fileLog({ level: 'warn', event: outcome.event, repo: `${owner}/${repoName}`, pr: prNumber, branch: outcome.branch, reason: outcome.reason });
+                            log(chalk.yellow(`⚠  ${outcome.notice}`));
+                            let patch = '';
+                            try {
+                                patch = execSync('git diff HEAD~1', { cwd: tmpDir, encoding: 'utf8' });
+                            }
+                            catch { /* fall through to the empty check */ }
+                            if (patch) {
+                                await octokit.rest.issues.createComment({
+                                    owner, repo: repoName, issue_number: prNumber,
+                                    body: [
+                                        '### Suggested fixes (crosscheck auto-fix)',
+                                        '',
+                                        outcome.explanation,
+                                        '',
+                                        '```diff',
+                                        patch.slice(0, 16000),
+                                        '```',
+                                        '',
+                                        fixAttributionFooter(),
+                                    ].join('\n'),
+                                });
+                            }
+                            restorePRHeadInClone();
+                            onPhaseChange('fixed ✓', { fixCount: appliedCount, phase: 'fixed', fixTokens: fixTokensUsed });
+                            fileLog({ level: 'info', event: 'fix_complete', repo: `${owner}/${repoName}`, pr: prNumber, vendor: activeVendor, applied_count: appliedCount, sha: newSha, delivery: 'comment', tokens_used: fixTokensUsed, skills_activated: activatedSkills.map(skill => skill.name), duration_ms: Date.now() - fixStepStart, ...triggerField });
+                            results[step.name] = { applied_count: appliedCount, tokens_used: fixTokensUsed, vendor: activeVendor };
+                        };
+                        // Ask whether the intended base still exists BEFORE pushing anything. The most
+                        // common reason the PR-branch push failed is that the PR merged and GitHub
+                        // deleted its branch — and `pulls.create` rejects a missing base with
+                        // `field: base, code: invalid`. That used to throw after the branch was already
+                        // pushed, losing the fix and orphaning the branch (19 times in logged runs).
+                        let baseBranchExists = true;
+                        try {
+                            await octokit.rest.repos.getBranch({ owner, repo: repoName, branch: pr.head.ref });
+                        }
+                        catch (err) {
+                            if (err?.status === 404)
+                                baseBranchExists = false;
+                            else
+                                throw err;
+                        }
+                        const delivery = planAutoFixDelivery(baseBranchExists, pr.head.ref);
+                        if (delivery.kind === 'comment') {
+                            // A PR cut from this snapshot would be stale the moment it opened — it is
+                            // exactly the artifact the superseded-auto-fix cleanup exists to close. Post
+                            // the fix as a diff instead, so the work is still delivered and reviewable.
+                            await deliverFixAsComment({
+                                event: 'fix_pr_skipped',
+                                reason: delivery.reason,
+                                branch: pr.head.ref,
+                                notice: `${pr.head.ref} no longer exists — posting the fix as a diff instead of opening a stale follow-up PR`,
+                                explanation: `\`${pr.head.ref}\` no longer exists, so this PR has merged and there is no branch to land on. The fix is below rather than in a follow-up PR — a PR cut from the pre-merge state would reintroduce whatever the merged version changed.`,
+                            });
+                            continue;
+                        }
+                        // A fix branch left behind by an earlier round of this PR made a plain push
+                        // non-fast-forward and lost the fix (12 times in logged runs). Replace it under
+                        // a lease: this round's fix is built on the newer PR head and supersedes it,
+                        // and the lease still refuses if anything other than us moved the branch.
+                        let remoteOid = null;
+                        try {
+                            remoteOid = parseLsRemoteOid(execFileSync('git', ['ls-remote', '--heads', 'origin', fixBranch], { cwd: tmpDir, env: gitEnv, encoding: 'utf8' }));
+                        }
+                        catch { /* treat an unreadable remote as "branch absent"; the lease catches a wrong guess */ }
+                        // `--force-with-lease` only protects against changes made *after* this lookup —
+                        // it happily accepts a branch a human just created or moved as the lease value
+                        // and overwrites it. So establish that the branch is crosscheck's own artifact
+                        // before replacing it, from GitHub's record of who opened the PR from it rather
+                        // than from anything the pusher can write into a commit.
+                        if (remoteOid !== null) {
+                            let crosscheckLogin = null;
+                            let candidates = [];
+                            try {
+                                const [{ data: viewer }, { data: branchPrs }] = await Promise.all([
+                                    octokit.rest.users.getAuthenticated(),
+                                    octokit.rest.pulls.list({ owner, repo: repoName, state: 'all', head: `${owner}:${fixBranch}` }),
+                                ]);
+                                crosscheckLogin = viewer.login;
+                                candidates = branchPrs;
+                            }
+                            catch { /* unreadable identity or PR list — treated as not ours, never overwrite */ }
+                            const ownership = assessFixBranchOwnership({ sourcePrNumber: prNumber, crosscheckLogin, candidates });
+                            if (!ownership.owned) {
+                                await deliverFixAsComment({
+                                    event: 'fix_branch_push_skipped',
+                                    reason: ownership.reason,
+                                    branch: fixBranch,
+                                    notice: `${fixBranch} exists but crosscheck has no PR of its own from it — leaving it in place and posting the fix as a diff instead`,
+                                    explanation: `\`${fixBranch}\` already exists and crosscheck cannot show it opened a pull request from it, so the branch was left untouched rather than force-replaced. The fix is posted here instead.`,
+                                });
+                                continue;
+                            }
+                        }
+                        // From #296: the merged-PR handler sweeps for auto-fix PRs once, so a PR opened
+                        // after that sweep is never seen by it and stays open and mergeable against a
+                        // tree that no longer exists. The base-exists check above already covers a merge
+                        // that deleted the branch; this catches a merge in a repo that keeps its
+                        // branches. It sits immediately before the push — every lookup above widens the
+                        // window it has to close, and nothing has been written to the remote yet, so a
+                        // skip here cannot orphan a branch.
+                        if (await sourcePRHasMerged(octokit, owner, repoName, prNumber)) {
+                            restorePRHeadInClone();
+                            skipFix('source_pr_merged');
+                            continue;
+                        }
+                        try {
+                            execFileSync('git', forceWithLeaseArgs(fixBranch, remoteOid), { cwd: tmpDir, env: gitEnv, stdio: 'pipe' });
+                        }
+                        catch (pushErr) {
+                            const pushMsg = pushErr instanceof Error ? pushErr.message : String(pushErr);
+                            fileLog({
+                                level: 'error', event: 'fix_branch_push_failed', repo: `${owner}/${repoName}`, pr: prNumber,
+                                branch: fixBranch, lease: remoteOid ?? 'absent',
+                                reason: isLeaseRejection(pushMsg) ? 'lease_rejected' : 'push_failed',
+                                error: pushMsg.slice(0, 500),
+                            });
+                            throw pushErr;
+                        }
+                        if (remoteOid !== null) {
+                            fileLog({ level: 'info', event: 'fix_branch_replaced', repo: `${owner}/${repoName}`, pr: prNumber, branch: fixBranch, previous_sha: remoteOid, sha: newSha });
+                        }
+                        // Undo this run's push when the follow-up PR turns out not to be creatable after
+                        // all. Only a branch this run brought into existence is removed — one that was
+                        // already crosscheck's is left at the newer commit rather than deleted out from
+                        // under whatever else references it.
+                        const rollBackPushedFixBranch = () => {
+                            if (remoteOid !== null)
+                                return;
+                            try {
+                                execFileSync('git', ['push', 'origin', '--delete', fixBranch], { cwd: tmpDir, env: gitEnv, stdio: 'pipe' });
+                                fileLog({ level: 'info', event: 'fix_branch_rolled_back', repo: `${owner}/${repoName}`, pr: prNumber, branch: fixBranch, sha: newSha });
+                            }
+                            catch (deleteErr) {
+                                fileLog({ level: 'warn', event: 'fix_branch_rollback_failed', repo: `${owner}/${repoName}`, pr: prNumber, branch: fixBranch, error: deleteErr instanceof Error ? deleteErr.message.slice(0, 500) : String(deleteErr) });
+                            }
+                        };
+                        // The source PR can still merge in the window between the check above and this
+                        // point. Asking again here is what keeps the push from becoming a stale fix PR:
+                        // the branch is already on the remote, so the answer decides whether it stays.
+                        if (await sourcePRHasMerged(octokit, owner, repoName, prNumber)) {
+                            rollBackPushedFixBranch();
+                            restorePRHeadInClone();
+                            skipFix('source_pr_merged');
+                            continue;
+                        }
                         const fixPrTitle = config.post_review.auto_fix.delivery.pr_title.replace('#{original_pr_title}', pr.title);
-                        const { data: fixPr } = await octokit.rest.pulls.create({
-                            owner,
-                            repo: repoName,
-                            head: fixBranch,
-                            base: pr.head.ref,
-                            title: fixPrTitle,
-                            body: [
-                                `Auto-fix by crosscheck for CR issues found in #${prNumber}.`,
-                                '',
-                                `Review: https://github.com/${owner}/${repoName}/pull/${prNumber}`,
-                                '',
-                                fixAttributionFooter(),
-                            ].join('\n'),
+                        // An earlier round may already have an open PR from this branch; the force-push
+                        // above updated it, so opening a second one would be rejected as a duplicate.
+                        const { data: existingFixPrs } = await octokit.rest.pulls.list({
+                            owner, repo: repoName, state: 'open', head: `${owner}:${fixBranch}`,
                         });
+                        let fixPrNumber;
+                        if (existingFixPrs.length > 0) {
+                            fixPrNumber = existingFixPrs[0].number;
+                            fileLog({ level: 'info', event: 'fix_pr_updated', repo: `${owner}/${repoName}`, pr: prNumber, fix_pr: fixPrNumber, sha: newSha });
+                        }
+                        else {
+                            let fixPr;
+                            try {
+                                const created = await octokit.rest.pulls.create({
+                                    owner,
+                                    repo: repoName,
+                                    head: fixBranch,
+                                    base: delivery.base,
+                                    title: fixPrTitle,
+                                    body: [
+                                        autoFixPRIntro(prNumber),
+                                        '',
+                                        `Review: https://github.com/${owner}/${repoName}/pull/${prNumber}`,
+                                        '',
+                                        fixAttributionFooter(),
+                                    ].join('\n'),
+                                });
+                                fixPr = created.data;
+                            }
+                            catch (createErr) {
+                                // A merge landing in a repo that deletes its branches takes the base away
+                                // between the checks above and this call, and `pulls.create` reports that as
+                                // `field: base, code: invalid` — the original failure this fallback exists to
+                                // stop, just in a narrower window. Take the branch back out and deliver the
+                                // fix as a diff rather than leaving it orphaned.
+                                if (!isInvalidBaseError(createErr))
+                                    throw createErr;
+                                rollBackPushedFixBranch();
+                                await deliverFixAsComment({
+                                    event: 'fix_pr_create_failed',
+                                    reason: 'base_branch_gone_after_push',
+                                    branch: delivery.base,
+                                    notice: `${delivery.base} disappeared while the fix branch was being pushed — posting the fix as a diff instead of opening a stale follow-up PR`,
+                                    explanation: `\`${delivery.base}\` existed when this fix started and was gone by the time the follow-up PR was opened, so this PR merged mid-run. The fix is below rather than in a follow-up PR — a PR cut from the pre-merge state would reintroduce whatever the merged version changed.`,
+                                });
+                                continue;
+                            }
+                            fixPrNumber = fixPr.number;
+                        }
                         if (config.post_review.auto_fix.delivery.label) {
                             try {
                                 await octokit.rest.issues.addLabels({
-                                    owner, repo: repoName, issue_number: fixPr.number, labels: [config.post_review.auto_fix.delivery.label],
+                                    owner, repo: repoName, issue_number: fixPrNumber, labels: [config.post_review.auto_fix.delivery.label],
                                 });
                             }
                             catch { /* label may not exist in this repo — skip */ }
                         }
                         onPhaseChange('fixed ✓', { fixCount: appliedCount, phase: 'fixed', fixTokens: fixTokensUsed });
-                        fileLog({ level: 'info', event: 'fix_complete', repo: `${owner}/${repoName}`, pr: prNumber, vendor: activeVendor, applied_count: appliedCount, sha: newSha, delivery: 'pull_request', fix_pr: fixPr.number, tokens_used: fixTokensUsed, skills_activated: activatedSkills.map(skill => skill.name), duration_ms: Date.now() - fixStepStart, ...triggerField });
+                        fileLog({ level: 'info', event: 'fix_complete', repo: `${owner}/${repoName}`, pr: prNumber, vendor: activeVendor, applied_count: appliedCount, sha: newSha, delivery: 'pull_request', fix_pr: fixPrNumber, tokens_used: fixTokensUsed, skills_activated: activatedSkills.map(skill => skill.name), duration_ms: Date.now() - fixStepStart, ...triggerField });
                         results[step.name] = { applied_count: appliedCount, tokens_used: fixTokensUsed, vendor: activeVendor };
                     }
                 }