@letta-ai/letta-code 0.31.6 → 0.31.7

package/scripts/builtin-skills-watch/result-artifacts.test.ts

@@ -0,0 +1,83 @@
+import { describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  discoverReviewArtifacts,
+  formatFailureReceipt,
+} from "./result-artifacts.ts";
+
+const CANDIDATE = "creating-skills@aaaaaaaaaaaa-abcdef0123456789";
+
+describe("review artifact discovery", () => {
+  test("finds both nested and root-level result artifacts", () => {
+    const directory = mkdtempSync(join(tmpdir(), "skill-artifacts-"));
+    try {
+      const nested = join(directory, "builtin-skill-result-creating-skills");
+      mkdirSync(nested);
+      writeFileSync(
+        join(nested, "result.json"),
+        JSON.stringify({ candidate_id: CANDIDATE }),
+      );
+
+      const discovered = discoverReviewArtifacts(directory);
+      expect(discovered.results.get(CANDIDATE)).toBe(
+        join(nested, "result.json"),
+      );
+
+      rmSync(nested, { recursive: true });
+      writeFileSync(
+        join(directory, "result.json"),
+        JSON.stringify({ candidate_id: CANDIDATE }),
+      );
+      expect(discoverReviewArtifacts(directory).results.get(CANDIDATE)).toBe(
+        join(directory, "result.json"),
+      );
+    } finally {
+      rmSync(directory, { recursive: true, force: true });
+    }
+  });
+
+  test("preserves a runner-authored failure receipt", () => {
+    const directory = mkdtempSync(join(tmpdir(), "skill-artifacts-"));
+    try {
+      writeFileSync(
+        join(directory, "failure.json"),
+        JSON.stringify({
+          schema_version: 1,
+          candidate_id: CANDIDATE,
+          skill: "creating-skills",
+          kind: "action_failed",
+          message: "Letta Code Action failed before returning a result",
+          conversation_id: "conv-123",
+        }),
+      );
+
+      const receipt =
+        discoverReviewArtifacts(directory).failures.get(CANDIDATE);
+      expect(receipt).toBeDefined();
+      expect(formatFailureReceipt(receipt!)).toContain("conversation conv-123");
+    } finally {
+      rmSync(directory, { recursive: true, force: true });
+    }
+  });
+
+  test("rejects duplicate results for one candidate", () => {
+    const directory = mkdtempSync(join(tmpdir(), "skill-artifacts-"));
+    try {
+      mkdirSync(join(directory, "first"));
+      mkdirSync(join(directory, "second"));
+      for (const subdirectory of ["first", "second"]) {
+        writeFileSync(
+          join(directory, subdirectory, "result.json"),
+          JSON.stringify({ candidate_id: CANDIDATE }),
+        );
+      }
+      expect(() => discoverReviewArtifacts(directory)).toThrow(
+        `duplicate review result for ${CANDIDATE}`,
+      );
+    } finally {
+      rmSync(directory, { recursive: true, force: true });
+    }
+  });
+});

package/scripts/builtin-skills-watch/result-artifacts.ts

@@ -0,0 +1,160 @@
+import { readdirSync, readFileSync } from "node:fs";
+import { basename, join } from "node:path";
+
+export interface ReviewFailureReceipt {
+  schema_version: 1;
+  candidate_id: string;
+  skill: string;
+  kind:
+    | "action_failed"
+    | "execution_file_missing"
+    | "result_marker_missing"
+    | "result_decode_failed";
+  message: string;
+  conversation_id: string | null;
+}
+
+export interface ReviewArtifacts {
+  results: Map<string, string>;
+  failures: Map<string, ReviewFailureReceipt>;
+}
+
+export function discoverReviewArtifacts(root: string): ReviewArtifacts {
+  const artifacts: ReviewArtifacts = {
+    results: new Map(),
+    failures: new Map(),
+  };
+  for (const path of walkFiles(root)) {
+    const name = basename(path);
+    if (name === "result.json") {
+      const candidateId = readCandidateId(path, "review result");
+      addUnique(artifacts.results, candidateId, path, "review result");
+    } else if (name === "failure.json") {
+      const receipt = parseFailureReceipt(
+        JSON.parse(readFileSync(path, "utf8")) as unknown,
+      );
+      addUnique(
+        artifacts.failures,
+        receipt.candidate_id,
+        receipt,
+        "failure receipt",
+      );
+    }
+  }
+  return artifacts;
+}
+
+export function formatFailureReceipt(receipt: ReviewFailureReceipt): string {
+  const conversation = receipt.conversation_id
+    ? ` (conversation ${receipt.conversation_id})`
+    : "";
+  return `${receipt.kind}: ${receipt.message}${conversation}`;
+}
+
+function walkFiles(root: string): string[] {
+  const files: string[] = [];
+  let entries: ReturnType<typeof readdirSync>;
+  try {
+    entries = readdirSync(root, { withFileTypes: true });
+  } catch (error) {
+    if (isMissingPath(error)) return files;
+    throw error;
+  }
+  for (const entry of entries) {
+    const path = join(root, entry.name);
+    if (entry.isDirectory()) files.push(...walkFiles(path));
+    else if (entry.isFile()) files.push(path);
+  }
+  return files.sort();
+}
+
+function readCandidateId(path: string, description: string): string {
+  const value = JSON.parse(readFileSync(path, "utf8")) as unknown;
+  if (!isRecord(value) || !isCandidateId(value.candidate_id)) {
+    throw new Error(`${description} ${path} has no valid candidate_id`);
+  }
+  return value.candidate_id;
+}
+
+function parseFailureReceipt(value: unknown): ReviewFailureReceipt {
+  if (
+    !isRecord(value) ||
+    !hasExactKeys(value, [
+      "schema_version",
+      "candidate_id",
+      "skill",
+      "kind",
+      "message",
+      "conversation_id",
+    ]) ||
+    value.schema_version !== 1 ||
+    !isCandidateId(value.candidate_id) ||
+    !isSkillName(value.skill) ||
+    !isFailureKind(value.kind) ||
+    typeof value.message !== "string" ||
+    value.message.length === 0 ||
+    value.message.length > 500 ||
+    (value.conversation_id !== null && !isConversationId(value.conversation_id))
+  ) {
+    throw new Error("Review failure receipt is invalid");
+  }
+  return value as unknown as ReviewFailureReceipt;
+}
+
+function addUnique<T>(
+  values: Map<string, T>,
+  candidateId: string,
+  value: T,
+  description: string,
+): void {
+  if (values.has(candidateId)) {
+    throw new Error(`Found duplicate ${description} for ${candidateId}`);
+  }
+  values.set(candidateId, value);
+}
+
+function isFailureKind(value: unknown): value is ReviewFailureReceipt["kind"] {
+  return (
+    value === "action_failed" ||
+    value === "execution_file_missing" ||
+    value === "result_marker_missing" ||
+    value === "result_decode_failed"
+  );
+}
+
+function isCandidateId(value: unknown): value is string {
+  return (
+    typeof value === "string" &&
+    /^[a-z0-9]+(?:-[a-z0-9]+)*@[a-f0-9]{12}-[a-f0-9]{16}$/.test(value)
+  );
+}
+
+function isSkillName(value: unknown): value is string {
+  return typeof value === "string" && /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(value);
+}
+
+function isConversationId(value: unknown): value is string {
+  return typeof value === "string" && /^conv-[a-zA-Z0-9-]+$/.test(value);
+}
+
+function isMissingPath(error: unknown): boolean {
+  return (
+    error instanceof Error &&
+    "code" in error &&
+    (error as NodeJS.ErrnoException).code === "ENOENT"
+  );
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function hasExactKeys(
+  value: Record<string, unknown>,
+  expected: string[],
+): boolean {
+  return (
+    JSON.stringify(Object.keys(value).sort()) ===
+    JSON.stringify([...expected].sort())
+  );
+}

package/scripts/builtin-skills-watch/update-tracker.test.ts

@@ -6,6 +6,7 @@ import {
   parseReviewResult,
   type TrackerIssueView,
   validatePullRequestView,
+  validateReconciledPullRequestView,
   validateTrackerIssueView,
 } from "./update-tracker.ts";
 
@@ -79,6 +80,21 @@ describe("watcher PR validation", () => {
       ),
     ).toThrow("outside the selected skill scope");
   });
+
+  test("accepts a merged exact-candidate PR only during reconciliation", () => {
+    const merged = validPullRequest({
+      isDraft: false,
+      mergedAt: "2026-08-27T00:00:00Z",
+      state: "MERGED",
+    });
+
+    expect(() =>
+      validateReconciledPullRequestView(merged, URL, analysis(), LOGIN),
+    ).not.toThrow();
+    expect(() =>
+      validatePullRequestView(merged, URL, analysis(), LOGIN),
+    ).toThrow("open and draft");
+  });
 });
 
 describe("watcher analysis validation", () => {
@@ -135,7 +151,7 @@ describe("watcher result validation", () => {
       evidence: evidence(current),
     };
     expect(() => parseReviewResult({ ...base, secret: "no" }, current)).toThrow(
-      "does not match",
+      "unknown or missing fields",
     );
     expect(() =>
       parseReviewResult(

package/scripts/builtin-skills-watch/update-tracker.ts

@@ -37,6 +37,7 @@ export interface PullRequestView {
   files: Array<{ path: string }>;
   headRefOid: string;
   isDraft: boolean;
+  mergedAt?: string | null;
   state: string;
   url: string;
 }
@@ -337,19 +338,35 @@ export function parseReviewResult(
       "notes",
       "pr_url",
       "evidence",
-    ]) ||
-    value.schema_version !== 1 ||
+    ])
+  ) {
+    throw new Error("Review result has unknown or missing fields");
+  }
+  if (value.schema_version !== 1) {
+    throw new Error("Review result must use schema version 1");
+  }
+  if (
     value.candidate_id !== analysis.candidate_id ||
-    value.skill !== analysis.skill ||
-    (value.outcome !== "no_drift" &&
-      value.outcome !== "pr_created" &&
-      value.outcome !== "needs_human_review") ||
+    value.skill !== analysis.skill
+  ) {
+    throw new Error("Review result does not match the pending candidate");
+  }
+  if (
+    value.outcome !== "no_drift" &&
+    value.outcome !== "pr_created" &&
+    value.outcome !== "needs_human_review"
+  ) {
+    throw new Error("Review result outcome is invalid");
+  }
+  if (
     typeof value.notes !== "string" ||
     value.notes.length === 0 ||
-    value.notes.length > 120 ||
-    (value.pr_url !== null && typeof value.pr_url !== "string")
+    value.notes.length > 120
   ) {
-    throw new Error("Review result does not match the pending candidate");
+    throw new Error("Review result notes must contain 1 to 120 characters");
+  }
+  if (value.pr_url !== null && typeof value.pr_url !== "string") {
+    throw new Error("Review result pr_url must be a string or null");
   }
   if (
     (value.outcome === "pr_created") !==
@@ -381,28 +398,61 @@ export function verifyPullRequest(
   analysis: BuiltinSkillWatchAnalysis,
   expectedGithubLogin: string,
 ): void {
+  verifyPullRequestIdentity(expectedGithubLogin);
+  const pullRequest = getPullRequest(repo, prUrl);
+  validatePullRequestView(pullRequest, prUrl, analysis, expectedGithubLogin);
+  verifyPullRequestAncestry(repo, pullRequest, analysis);
+}
+
+export function verifyReconciledPullRequest(
+  repo: string,
+  prUrl: string,
+  analysis: BuiltinSkillWatchAnalysis,
+  expectedGithubLogin: string,
+): void {
+  verifyPullRequestIdentity(expectedGithubLogin);
+  const pullRequest = getPullRequest(repo, prUrl);
+  validateReconciledPullRequestView(
+    pullRequest,
+    prUrl,
+    analysis,
+    expectedGithubLogin,
+  );
+  verifyPullRequestAncestry(repo, pullRequest, analysis);
+}
+
+function verifyPullRequestIdentity(expectedGithubLogin: string): void {
   const authenticatedLogin = ghJson<{ login: string }>(["api", "user"]).login;
   if (authenticatedLogin !== expectedGithubLogin) {
     throw new Error(
       `Authenticated GitHub login ${authenticatedLogin} does not match ${expectedGithubLogin}`,
     );
   }
+}
+
+function getPullRequest(repo: string, prUrl: string): PullRequestView {
   const match = prUrl.match(
     /^https:\/\/github\.com\/([^/]+\/[^/]+)\/pull\/(\d+)\/?$/,
   );
   if (!match || match[1] !== repo) {
     throw new Error(`PR URL must belong to https://github.com/${repo}`);
   }
-  const pullRequest = ghJson<PullRequestView>([
+  return ghJson<PullRequestView>([
     "pr",
     "view",
     match[2] as string,
     "--repo",
     repo,
     "--json",
-    "author,baseRefName,body,files,headRefOid,isDraft,state,url",
+    "author,baseRefName,body,files,headRefOid,isDraft,mergedAt,state,url",
   ]);
-  validatePullRequestView(pullRequest, prUrl, analysis, expectedGithubLogin);
+}
+
+function verifyPullRequestAncestry(
+  repo: string,
+  pullRequest: PullRequestView,
+  analysis: BuiltinSkillWatchAnalysis,
+): void {
   const comparison = ghJson<{
     status: string;
     merge_base_commit: { sha: string };
@@ -423,6 +473,33 @@ export function validatePullRequestView(
   prUrl: string,
   analysis: BuiltinSkillWatchAnalysis,
   expectedGithubLogin: string,
+): void {
+  validatePullRequestScope(pullRequest, prUrl, analysis, expectedGithubLogin);
+  if (pullRequest.state !== "OPEN" || !pullRequest.isDraft) {
+    throw new Error("Watcher PR must be open and draft");
+  }
+}
+
+export function validateReconciledPullRequestView(
+  pullRequest: PullRequestView,
+  prUrl: string,
+  analysis: BuiltinSkillWatchAnalysis,
+  expectedGithubLogin: string,
+): void {
+  validatePullRequestScope(pullRequest, prUrl, analysis, expectedGithubLogin);
+  const isOpenDraft = pullRequest.state === "OPEN" && pullRequest.isDraft;
+  const isMerged =
+    pullRequest.state === "MERGED" && typeof pullRequest.mergedAt === "string";
+  if (!isOpenDraft && !isMerged) {
+    throw new Error("Reconciled watcher PR must be an open draft or merged");
+  }
+}
+
+function validatePullRequestScope(
+  pullRequest: PullRequestView,
+  prUrl: string,
+  analysis: BuiltinSkillWatchAnalysis,
+  expectedGithubLogin: string,
 ): void {
   if (pullRequest.url !== prUrl.replace(/\/$/, "")) {
     throw new Error(`PR URL mismatch: ${pullRequest.url}`);
@@ -432,9 +509,6 @@ export function validatePullRequestView(
       `PR author ${pullRequest.author.login} does not match ${expectedGithubLogin}`,
     );
   }
-  if (pullRequest.state !== "OPEN" || !pullRequest.isDraft) {
-    throw new Error("Watcher PR must be open and draft");
-  }
   if (pullRequest.baseRefName !== "main") {
     throw new Error("Watcher PR must target main");
   }

package/scripts/claude-watch/update-tracker.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, test } from "bun:test";
+import { parseArgs } from "./update-tracker.ts";
+
+describe("parseArgs", () => {
+  const required = [
+    "--tracker-issue",
+    "123",
+    "--analysis-file",
+    "/tmp/analysis.json",
+    "--state-commit-sha",
+    "abc123",
+    "--outcome",
+    "pr_created",
+    "--pr-url",
+    "https://github.com/letta-ai/letta-code/pull/456",
+  ];
+
+  test("requires the expected GitHub login for a PR", () => {
+    expect(() => parseArgs(required)).toThrow(
+      "--expected-github-login is required for pr_created",
+    );
+  });
+
+  test("accepts the expected GitHub login for a PR", () => {
+    expect(
+      parseArgs([...required, "--expected-github-login", "amelia-letta"])
+        .expectedGithubLogin,
+    ).toBe("amelia-letta");
+  });
+});

package/scripts/claude-watch/update-tracker.ts

@@ -27,6 +27,7 @@ interface Args {
   outcome: ClaudeWatchOutcome | null;
   notes: string;
   prUrl: string | null;
+  expectedGithubLogin: string | null;
   assertTerminal: boolean;
   dryRun: boolean;
 }
@@ -41,6 +42,7 @@ export function parseArgs(argv: string[]): Args {
     outcome: null,
     notes: "",
     prUrl: null,
+    expectedGithubLogin: null,
     assertTerminal: false,
     dryRun: false,
   };
@@ -59,6 +61,8 @@ export function parseArgs(argv: string[]): Args {
       args.outcome = parseOutcome(argv[++index]);
     else if (argument === "--notes") args.notes = argv[++index] ?? "";
     else if (argument === "--pr-url") args.prUrl = argv[++index] ?? null;
+    else if (argument === "--expected-github-login")
+      args.expectedGithubLogin = argv[++index] ?? null;
     else if (argument === "--assert-terminal") args.assertTerminal = true;
     else if (argument === "--dry-run") args.dryRun = true;
     else throw new Error(`Unknown argument: ${argument}`);
@@ -75,8 +79,12 @@ export function parseArgs(argv: string[]): Args {
     if (!args.outcome) throw new Error("--outcome is required");
     if (isTerminalOutcome(args.outcome) && !args.stateCommitSha)
       throw new Error("terminal outcomes require --state-commit-sha");
-    if (args.outcome === "pr_created" && !args.prUrl)
-      throw new Error("--pr-url is required for pr_created");
+    if (args.outcome === "pr_created") {
+      if (!args.prUrl) throw new Error("--pr-url is required for pr_created");
+      if (!args.expectedGithubLogin) {
+        throw new Error("--expected-github-login is required for pr_created");
+      }
+    }
   }
   return args;
 }
@@ -117,15 +125,16 @@ function verifyParityPr(
   repo: string,
   prUrl: string,
   candidateId: string,
+  expectedGithubLogin: string,
 ): void {
   const pr = ghJson<{
     isDraft: boolean;
     author: { login: string };
     body: string | null;
   }>(["pr", "view", prUrl, "--repo", repo, "--json", "isDraft,author,body"]);
-  if (!pr.isDraft || pr.author.login !== "carenthomas") {
+  if (!pr.isDraft || pr.author.login !== expectedGithubLogin) {
     throw new Error(
-      `Parity PR must be a draft authored by carenthomas (got draft=${pr.isDraft}, author=${pr.author.login})`,
+      `Parity PR must be a draft authored by ${expectedGithubLogin} (got draft=${pr.isDraft}, author=${pr.author.login})`,
     );
   }
   if (!pr.body?.includes(`Claude-watch: ${candidateId}`)) {
@@ -164,7 +173,12 @@ export function main(argv = process.argv.slice(2)): void {
     verifyStateCandidate(analysis.candidate_id, args.stateCommitSha as string);
   }
   if (args.outcome === "pr_created") {
-    verifyParityPr(args.repo, args.prUrl as string, analysis.candidate_id);
+    verifyParityPr(
+      args.repo,
+      args.prUrl as string,
+      analysis.candidate_id,
+      args.expectedGithubLogin as string,
+    );
   }
   const next = recordAnalysis(state, {
     analysis,

package/scripts/codex-watch/update-tracker.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, test } from "bun:test";
+import { parseArgs } from "./update-tracker.ts";
+
+describe("parseArgs", () => {
+  const required = [
+    "--tracker-issue",
+    "123",
+    "--analysis-file",
+    "/tmp/analysis.json",
+    "--outcome",
+    "pr_created",
+    "--pr-url",
+    "https://github.com/letta-ai/letta-code/pull/456",
+  ];
+
+  test("requires the expected GitHub login for a PR", () => {
+    expect(() => parseArgs(required)).toThrow(
+      "--expected-github-login is required for pr_created",
+    );
+  });
+
+  test("accepts the expected GitHub login for a PR", () => {
+    expect(
+      parseArgs([...required, "--expected-github-login", "amelia-letta"])
+        .expectedGithubLogin,
+    ).toBe("amelia-letta");
+  });
+});

package/scripts/codex-watch/update-tracker.ts

@@ -7,7 +7,7 @@
  */
 
 import { readFileSync } from "node:fs";
-import { editIssueBody, getIssueBody } from "./github.ts";
+import { editIssueBody, getIssueBody, ghJson } from "./github.ts";
 import {
   type CodexWatchAnalysis,
   DEFAULT_TARGET_REPO,
@@ -26,10 +26,11 @@ interface Args {
   outcome: TrackerOutcome | null;
   notes: string;
   prUrl: string | null;
+  expectedGithubLogin: string | null;
   dryRun: boolean;
 }
 
-function parseArgs(argv: string[]): Args {
+export function parseArgs(argv: string[]): Args {
   const args: Args = {
     repo: DEFAULT_TARGET_REPO,
     trackerIssue: null,
@@ -37,6 +38,7 @@ function parseArgs(argv: string[]): Args {
     outcome: null,
     notes: "",
     prUrl: null,
+    expectedGithubLogin: null,
     dryRun: false,
   };
 
@@ -49,10 +51,12 @@ function parseArgs(argv: string[]): Args {
     else if (a === "--outcome") args.outcome = parseOutcome(argv[++i]);
     else if (a === "--notes") args.notes = argv[++i] ?? "";
     else if (a === "--pr-url") args.prUrl = argv[++i] ?? null;
-    else if (a === "--dry-run") args.dryRun = true;
+    else if (a === "--expected-github-login") {
+      args.expectedGithubLogin = argv[++i] ?? null;
+    } else if (a === "--dry-run") args.dryRun = true;
     else if (a === "--help" || a === "-h") {
       console.log(
-        "Usage: bun scripts/codex-watch/update-tracker.ts --tracker-issue ISSUE --analysis-file FILE --outcome OUTCOME [--notes TEXT] [--pr-url URL] [--repo OWNER/REPO] [--dry-run]",
+        "Usage: bun scripts/codex-watch/update-tracker.ts --tracker-issue ISSUE --analysis-file FILE --outcome OUTCOME [--notes TEXT] [--pr-url URL --expected-github-login LOGIN] [--repo OWNER/REPO] [--dry-run]",
       );
       process.exit(0);
     } else {
@@ -65,8 +69,13 @@ function parseArgs(argv: string[]): Args {
   }
   if (!args.analysisFile) throw new Error("--analysis-file is required");
   if (!args.outcome) throw new Error("--outcome is required");
-  if (args.outcome === "pr_created" && !args.prUrl) {
-    throw new Error("--pr-url is required when --outcome pr_created");
+  if (args.outcome === "pr_created") {
+    if (!args.prUrl) {
+      throw new Error("--pr-url is required when --outcome pr_created");
+    }
+    if (!args.expectedGithubLogin) {
+      throw new Error("--expected-github-login is required for pr_created");
+    }
   }
 
   return args;
@@ -94,6 +103,14 @@ function main() {
   const analysis = readAnalysis(args.analysisFile as string);
   const body = getIssueBody(args.repo, args.trackerIssue as number);
   const state = parseTrackerState(body);
+  if (args.outcome === "pr_created") {
+    verifyParityPr(
+      args.repo,
+      args.prUrl as string,
+      args.expectedGithubLogin as string,
+      analysis.current_tag,
+    );
+  }
   const next = recordAnalysis(state, {
     analysis,
     outcome: args.outcome as TrackerOutcome,
@@ -113,6 +130,41 @@ function main() {
   );
 }
 
+function verifyParityPr(
+  repo: string,
+  prUrl: string,
+  expectedGithubLogin: string,
+  currentTag: string,
+): void {
+  const pullRequest = ghJson<{
+    author: { login: string };
+    body: string | null;
+    isDraft: boolean;
+    state: string;
+  }>([
+    "pr",
+    "view",
+    prUrl,
+    "--repo",
+    repo,
+    "--json",
+    "author,body,isDraft,state",
+  ]);
+  if (
+    pullRequest.author.login !== expectedGithubLogin ||
+    !pullRequest.isDraft ||
+    pullRequest.state !== "OPEN"
+  ) {
+    throw new Error(
+      `Codex PR must be an open draft authored by ${expectedGithubLogin} (got author=${pullRequest.author.login}, draft=${pullRequest.isDraft}, state=${pullRequest.state})`,
+    );
+  }
+  const marker = `Codex-watch: openai/codex ${currentTag}`;
+  if (!pullRequest.body?.includes(marker)) {
+    throw new Error(`Codex PR body is missing marker: ${marker}`);
+  }
+}
+
 function defaultNotes(outcome: TrackerOutcome): string {
   switch (outcome) {
     case "recorded_noop":
@@ -128,4 +180,4 @@ function defaultNotes(outcome: TrackerOutcome): string {
   }
 }
 
-main();
+if (import.meta.main) main();