@openpome/local-gateway 0.28.0-alpha.0 → 0.32.0-alpha.0

package/dist/index.js

@@ -15,6 +15,7 @@ import { createDefaultWorkItemSourceRegistry, createJiraCloudOAuthLogin, exchang
 const execAsync = promisify(exec);
 const execFileAsync = promisify(execFile);
 const jiraOAuthCredentialAccount = "jira-cloud/oauth";
+const githubOAuthCredentialAccount = "github/oauth";
 const openAiCredentialAccount = "model/openai/api-key";
 const anthropicCredentialAccount = "model/anthropic/api-key";
 const workspaceIndexFileName = "workspace-index.json";
@@ -39,7 +40,7 @@ const maxWorkspaceScanRepositories = 200;
 export function getGatewayHealth() {
     return {
         status: "ok",
-        version: "0.28.0-alpha.0"
+        version: "0.32.0-alpha.0"
     };
 }
 export async function initOpenPome() {
@@ -463,7 +464,7 @@ export async function startTaskSession(key, env = process.env) {
 }
 export async function getTaskSessionStatus() {
     const paths = getOpenPomePaths();
-    const persisted = await readActiveTaskSessionIfPresent(paths.homeDirectory);
+    const persisted = await refreshActiveTaskSessionWorkItem(paths.homeDirectory);
     if (!persisted) {
         return {
             active: false,
@@ -494,7 +495,7 @@ export async function getTaskSessionStatus() {
 }
 export async function getTaskSessionTimeline() {
     const paths = getOpenPomePaths();
-    const persisted = await readActiveTaskSessionIfPresent(paths.homeDirectory);
+    const persisted = await refreshActiveTaskSessionWorkItem(paths.homeDirectory);
     return {
         active: Boolean(persisted),
         sessionFile: getActiveTaskSessionFile(paths.homeDirectory),
@@ -504,7 +505,7 @@ export async function getTaskSessionTimeline() {
 }
 export async function getTaskSessionApprovalHistory() {
     const paths = getOpenPomePaths();
-    const persisted = await readActiveTaskSessionIfPresent(paths.homeDirectory);
+    const persisted = await refreshActiveTaskSessionWorkItem(paths.homeDirectory);
     return {
         active: Boolean(persisted),
         sessionFile: getActiveTaskSessionFile(paths.homeDirectory),
@@ -638,7 +639,7 @@ export async function resetTaskSession() {
 }
 export async function createTaskSessionPlan() {
     const paths = getOpenPomePaths();
-    const persisted = await readActiveTaskSessionIfPresent(paths.homeDirectory);
+    const persisted = await refreshActiveTaskSessionWorkItem(paths.homeDirectory);
     if (!persisted) {
         return undefined;
     }
@@ -686,7 +687,7 @@ export async function createTaskSessionPlan() {
 }
 export async function approveTaskSessionPlan() {
     const paths = getOpenPomePaths();
-    const persisted = await readActiveTaskSessionIfPresent(paths.homeDirectory);
+    const persisted = await refreshActiveTaskSessionWorkItem(paths.homeDirectory);
     if (!persisted) {
         return undefined;
     }
@@ -730,7 +731,7 @@ export async function approveTaskSessionPlan() {
 }
 export async function rejectTaskSessionPlan(reason = "Plan rejected by developer.") {
     const paths = getOpenPomePaths();
-    const persisted = await readActiveTaskSessionIfPresent(paths.homeDirectory);
+    const persisted = await refreshActiveTaskSessionWorkItem(paths.homeDirectory);
     if (!persisted) {
         return undefined;
     }
@@ -774,7 +775,7 @@ export async function rejectTaskSessionPlan(reason = "Plan rejected by developer
 }
 export async function createAIPatchProposal() {
     const paths = getOpenPomePaths();
-    const persisted = await readActiveTaskSessionIfPresent(paths.homeDirectory);
+    const persisted = await refreshActiveTaskSessionWorkItem(paths.homeDirectory);
     if (!persisted) {
         return {
             active: false,
@@ -808,18 +809,21 @@ export async function createAIPatchProposal() {
         throw new Error("Manual-copy mode cannot apply code. Run `pome auth ai openai`, `pome auth ai claude`, or `pome auth ai claude-cli` to enable approval-gated AI patches.");
     }
     const createdAt = new Date().toISOString();
+    const retryingFailedTest = hasFailedTestAfterLatestAppliedPatch(persisted);
     const fileContext = await collectPatchContextFiles(workspacePath, persisted);
     const prompt = buildStructuredPatchPrompt(persisted, workspacePath, fileContext);
     const response = await completeModelText(provider, prompt);
     const proposalDraft = parseAIPatchProposal(response, persisted, provider, workspacePath, createdAt);
-    const approval = createFileEditApproval(persisted, proposalDraft, createdAt, "Developer approval is required before OpenPome writes AI-proposed file changes.");
+    const approval = createFileEditApproval(persisted, proposalDraft, createdAt, retryingFailedTest
+        ? "Developer approval is required before OpenPome writes AI-proposed fixes for the failed test."
+        : "Developer approval is required before OpenPome writes AI-proposed file changes.");
     const proposal = {
         ...proposalDraft,
         approval
     };
     const session = {
         ...persisted.session,
-        status: "awaiting_approval",
+        status: retryingFailedTest ? "fixing" : "awaiting_approval",
         updatedAt: createdAt
     };
     await writeActiveTaskSession(paths.homeDirectory, {
@@ -828,7 +832,7 @@ export async function createAIPatchProposal() {
         aiPatchProposal: proposal,
         approvalHistory: appendApprovalHistory(persisted.approvalHistory, approval),
         events: appendSessionEvents(persisted.events, [
-            createSessionEvent(session, persisted.workItem.key, "approval_requested", "AI file changes proposed", createdAt, [
+            createSessionEvent(session, persisted.workItem.key, "approval_requested", retryingFailedTest ? "AI test-failure fix proposed" : "AI file changes proposed", createdAt, [
                 `Provider: ${getModelProviderDisplayName(provider)}`,
                 `Files proposed: ${proposal.files.map((file) => file.path).join(", ") || "none"}`,
                 ...approval.details
@@ -849,7 +853,7 @@ export async function createAIPatchProposal() {
 }
 export async function approveAndApplyAIPatchProposal() {
     const paths = getOpenPomePaths();
-    const persisted = await readActiveTaskSessionIfPresent(paths.homeDirectory);
+    const persisted = await refreshActiveTaskSessionWorkItem(paths.homeDirectory);
     if (!persisted) {
         return undefined;
     }
@@ -919,7 +923,7 @@ export async function approveAndApplyAIPatchProposal() {
 }
 export async function discoverTestCommands() {
     const paths = getOpenPomePaths();
-    const persisted = await readActiveTaskSessionIfPresent(paths.homeDirectory);
+    const persisted = await refreshActiveTaskSessionWorkItem(paths.homeDirectory);
     if (!persisted) {
         return {
             active: false,
@@ -953,7 +957,7 @@ export async function discoverTestCommands() {
 }
 export async function approveTestCommand(command) {
     const paths = getOpenPomePaths();
-    const persisted = await readActiveTaskSessionIfPresent(paths.homeDirectory);
+    const persisted = await refreshActiveTaskSessionWorkItem(paths.homeDirectory);
     if (!persisted) {
         return undefined;
     }
@@ -996,7 +1000,7 @@ export async function approveTestCommand(command) {
 }
 export async function getTestCommandHistory() {
     const paths = getOpenPomePaths();
-    const persisted = await readActiveTaskSessionIfPresent(paths.homeDirectory);
+    const persisted = await refreshActiveTaskSessionWorkItem(paths.homeDirectory);
     return {
         active: Boolean(persisted),
         sessionFile: getActiveTaskSessionFile(paths.homeDirectory),
@@ -1007,7 +1011,7 @@ export async function getTestCommandHistory() {
 }
 export async function runApprovedTestCommand(command) {
     const paths = getOpenPomePaths();
-    const persisted = await readActiveTaskSessionIfPresent(paths.homeDirectory);
+    const persisted = await refreshActiveTaskSessionWorkItem(paths.homeDirectory);
     if (!persisted) {
         return undefined;
     }
@@ -1049,7 +1053,7 @@ export async function runApprovedTestCommand(command) {
 }
 export async function createManualCopyAIContext() {
     const paths = getOpenPomePaths();
-    const persisted = await readActiveTaskSessionIfPresent(paths.homeDirectory);
+    const persisted = await refreshActiveTaskSessionWorkItem(paths.homeDirectory);
     if (!persisted) {
         return {
             active: false,
@@ -1083,7 +1087,7 @@ export async function createManualCopyAIContext() {
 }
 export async function createManualCopyAIPrompt() {
     const paths = getOpenPomePaths();
-    const persisted = await readActiveTaskSessionIfPresent(paths.homeDirectory);
+    const persisted = await refreshActiveTaskSessionWorkItem(paths.homeDirectory);
     if (!persisted) {
         return {
             active: false,
@@ -1119,7 +1123,7 @@ export async function createManualCopyAIPrompt() {
 }
 export async function getDiffSummary() {
     const paths = getOpenPomePaths();
-    const persisted = await readActiveTaskSessionIfPresent(paths.homeDirectory);
+    const persisted = await refreshActiveTaskSessionWorkItem(paths.homeDirectory);
     if (!persisted) {
         return {
             active: false,
@@ -1150,6 +1154,106 @@ export async function getDiffSummary() {
     };
 }
 export async function getGitHubAuthStatus() {
+    const storedToken = await readStoredGitHubOAuth();
+    if (storedToken?.accessToken) {
+        try {
+            const user = await fetchGitHubAuthenticatedUser(storedToken.accessToken);
+            return {
+                provider: "github",
+                cliAvailable: await isGitHubCliAvailable(),
+                cliAuthenticated: await isGitHubCliAuthenticated(),
+                nativeAuthenticated: true,
+                authenticated: true,
+                username: user.login,
+                tokenSource: "openpome",
+                detail: `OpenPome GitHub browser login is connected as ${user.login}.`
+            };
+        }
+        catch (error) {
+            const fallback = await getGitHubCliAuthStatus();
+            if (fallback.authenticated) {
+                return {
+                    ...fallback,
+                    detail: `OpenPome GitHub token could not be verified (${summarizeUnknownError(error)}). ${fallback.detail}`
+                };
+            }
+            return {
+                ...fallback,
+                detail: `OpenPome GitHub token could not be verified (${summarizeUnknownError(error)}). Run \`pome auth github login\` again.`
+            };
+        }
+    }
+    return getGitHubCliAuthStatus();
+}
+export async function createGitHubDeviceLogin(env = process.env) {
+    const clientId = getGitHubOAuthClientId(env);
+    const scope = getGitHubOAuthScope(env);
+    const body = new URLSearchParams({
+        client_id: clientId,
+        scope
+    });
+    const response = await fetch("https://github.com/login/device/code", {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body
+    });
+    if (!response.ok) {
+        throw new Error(`GitHub device login failed: ${response.status} ${response.statusText}`);
+    }
+    const payload = (await response.json());
+    if (!payload.device_code || !payload.user_code || !payload.verification_uri) {
+        throw new Error("GitHub device login response was incomplete.");
+    }
+    const expiresIn = typeof payload.expires_in === "number" ? payload.expires_in : 900;
+    const intervalSeconds = Math.max(1, typeof payload.interval === "number" ? payload.interval : 5);
+    return {
+        provider: "github",
+        deviceCode: payload.device_code,
+        userCode: payload.user_code,
+        verificationUri: payload.verification_uri,
+        expiresIn,
+        expiresAt: new Date(Date.now() + expiresIn * 1000).toISOString(),
+        intervalSeconds,
+        scope,
+        detail: "Open the GitHub verification URL, enter the code, then keep this terminal open."
+    };
+}
+export async function completeGitHubDeviceLogin(login, env = process.env, options = {}) {
+    const clientId = getGitHubOAuthClientId(env);
+    const deadline = Date.now() + login.expiresIn * 1000;
+    let intervalSeconds = login.intervalSeconds;
+    while (Date.now() < deadline) {
+        await delay(options.pollDelayMilliseconds ?? intervalSeconds * 1000);
+        const token = await pollGitHubDeviceAccessToken(clientId, login.deviceCode);
+        if (token.status === "pending") {
+            continue;
+        }
+        if (token.status === "slow_down") {
+            intervalSeconds += 5;
+            continue;
+        }
+        if (token.status === "error") {
+            throw new Error(token.detail);
+        }
+        const store = createCredentialStore();
+        if (!store.isAvailable()) {
+            throw new Error(`Credential store is unavailable: ${store.backend}`);
+        }
+        await setJsonCredential(store, githubOAuthCredentialAccount, token.token);
+        const user = await fetchGitHubAuthenticatedUser(token.token.accessToken);
+        return {
+            provider: "github",
+            authenticated: true,
+            username: user.login,
+            detail: `GitHub browser login completed for ${user.login}.`
+        };
+    }
+    throw new Error("Timed out waiting for GitHub browser login approval.");
+}
+async function getGitHubCliAuthStatus() {
     try {
         await execFileAsync("gh", ["--version"]);
     }
@@ -1157,7 +1261,10 @@ export async function getGitHubAuthStatus() {
         return {
             provider: "github",
             cliAvailable: false,
+            cliAuthenticated: false,
+            nativeAuthenticated: false,
             authenticated: false,
+            tokenSource: "none",
             detail: "GitHub CLI is not installed or is not on PATH."
         };
     }
@@ -1166,7 +1273,10 @@ export async function getGitHubAuthStatus() {
         return {
             provider: "github",
             cliAvailable: true,
+            cliAuthenticated: true,
+            nativeAuthenticated: false,
             authenticated: true,
+            tokenSource: "github-cli",
             detail: "GitHub CLI is authenticated for github.com."
         };
     }
@@ -1174,14 +1284,17 @@ export async function getGitHubAuthStatus() {
         return {
             provider: "github",
             cliAvailable: true,
+            cliAuthenticated: false,
+            nativeAuthenticated: false,
             authenticated: false,
+            tokenSource: "none",
             detail: summarizeExecError(error) || "GitHub CLI is installed but not authenticated for github.com."
         };
     }
 }
 export async function createPullRequestDraft() {
     const paths = getOpenPomePaths();
-    const persisted = await readActiveTaskSessionIfPresent(paths.homeDirectory);
+    const persisted = await refreshActiveTaskSessionWorkItem(paths.homeDirectory);
     if (!persisted) {
         return {
             active: false,
@@ -1212,7 +1325,7 @@ export async function createPullRequestDraft() {
 }
 export async function createPullRequest(options = {}) {
     const paths = getOpenPomePaths();
-    const persisted = await readActiveTaskSessionIfPresent(paths.homeDirectory);
+    const persisted = await refreshActiveTaskSessionWorkItem(paths.homeDirectory);
     if (!persisted) {
         return {
             active: false,
@@ -1310,7 +1423,7 @@ export async function createPullRequest(options = {}) {
 }
 export async function createWorkItemUpdateDraft() {
     const paths = getOpenPomePaths();
-    const persisted = await readActiveTaskSessionIfPresent(paths.homeDirectory);
+    const persisted = await refreshActiveTaskSessionWorkItem(paths.homeDirectory);
     if (!persisted) {
         return {
             active: false,
@@ -1339,7 +1452,7 @@ export async function createWorkItemUpdateDraft() {
 }
 export async function postWorkItemUpdate() {
     const paths = getOpenPomePaths();
-    const persisted = await readActiveTaskSessionIfPresent(paths.homeDirectory);
+    const persisted = await refreshActiveTaskSessionWorkItem(paths.homeDirectory);
     if (!persisted) {
         return {
             active: false,
@@ -1614,6 +1727,122 @@ async function readStoredJiraOAuth() {
     }
     return getJsonCredential(store, jiraOAuthCredentialAccount);
 }
+async function readStoredGitHubOAuth() {
+    const store = createCredentialStore();
+    if (!store.isAvailable()) {
+        return undefined;
+    }
+    return getJsonCredential(store, githubOAuthCredentialAccount);
+}
+function getGitHubOAuthClientId(env) {
+    const clientId = env["OPENPOME_GITHUB_OAUTH_CLIENT_ID"]?.trim();
+    if (!clientId) {
+        throw new Error("OPENPOME_GITHUB_OAUTH_CLIENT_ID is required for native GitHub browser login. Without it, use `gh auth login` as the fallback.");
+    }
+    return clientId;
+}
+function getGitHubOAuthScope(env) {
+    return env["OPENPOME_GITHUB_OAUTH_SCOPE"]?.trim() || "repo read:user";
+}
+async function isGitHubCliAvailable() {
+    try {
+        await execFileAsync("gh", ["--version"]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function isGitHubCliAuthenticated() {
+    try {
+        await execFileAsync("gh", ["auth", "status", "-h", "github.com"]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function fetchGitHubAuthenticatedUser(accessToken) {
+    const response = await fetch("https://api.github.com/user", {
+        headers: {
+            Accept: "application/vnd.github+json",
+            Authorization: `Bearer ${accessToken}`,
+            "X-GitHub-Api-Version": "2022-11-28"
+        }
+    });
+    if (!response.ok) {
+        throw new Error(`GitHub user lookup failed: ${response.status} ${response.statusText}`);
+    }
+    const payload = (await response.json());
+    if (!payload.login) {
+        throw new Error("GitHub user lookup response was incomplete.");
+    }
+    return {
+        login: payload.login,
+        id: payload.id,
+        name: payload.name
+    };
+}
+async function pollGitHubDeviceAccessToken(clientId, deviceCode) {
+    const response = await fetch("https://github.com/login/oauth/access_token", {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: new URLSearchParams({
+            client_id: clientId,
+            device_code: deviceCode,
+            grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+        })
+    });
+    if (!response.ok) {
+        return {
+            status: "error",
+            detail: `GitHub device token polling failed: ${response.status} ${response.statusText}`
+        };
+    }
+    const payload = (await response.json());
+    if (payload.error) {
+        if (payload.error === "authorization_pending") {
+            return { status: "pending" };
+        }
+        if (payload.error === "slow_down") {
+            return { status: "slow_down" };
+        }
+        return {
+            status: "error",
+            detail: payload.error_description || `GitHub device login failed: ${payload.error}`
+        };
+    }
+    if (!payload.access_token) {
+        return {
+            status: "error",
+            detail: "GitHub device token response did not include an access token."
+        };
+    }
+    return {
+        status: "complete",
+        token: {
+            accessToken: payload.access_token,
+            tokenType: payload.token_type || "bearer",
+            scopes: parseGitHubScopes(payload.scope),
+            createdAt: new Date().toISOString()
+        }
+    };
+}
+function parseGitHubScopes(scope) {
+    return (scope ?? "")
+        .split(",")
+        .map((value) => value.trim())
+        .filter((value) => value.length > 0);
+}
+function summarizeUnknownError(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function delay(milliseconds) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
 async function refreshStoredJiraOAuthIfNeeded(tokenSet, env) {
     if (!tokenSet || !shouldRefreshOAuthToken(tokenSet)) {
         return tokenSet;
@@ -1999,6 +2228,134 @@ function appendSessionEvents(existing, events) {
 function appendApprovalHistory(existing, approval) {
     return [...(existing ?? []), approval];
 }
+async function refreshActiveTaskSessionWorkItem(homeDirectory) {
+    const persisted = await readActiveTaskSessionIfPresent(homeDirectory);
+    if (!persisted) {
+        return undefined;
+    }
+    return refreshPersistedTaskSessionWorkItem(homeDirectory, persisted);
+}
+async function refreshPersistedTaskSessionWorkItem(homeDirectory, persisted) {
+    let latest;
+    try {
+        const source = await createJiraSource(process.env);
+        latest = await source.getWorkItem(persisted.workItem.key);
+    }
+    catch {
+        return persisted;
+    }
+    if (!latest) {
+        return persisted;
+    }
+    const previousFullFingerprint = getWorkItemFullFingerprint(persisted.workItem);
+    const latestFullFingerprint = getWorkItemFullFingerprint(latest);
+    if (previousFullFingerprint === latestFullFingerprint) {
+        return persisted;
+    }
+    const materialChanged = getWorkItemMaterialFingerprint(persisted.workItem) !== getWorkItemMaterialFingerprint(latest);
+    const shouldInvalidate = materialChanged && persisted.session.status !== "completed";
+    const now = new Date().toISOString();
+    const session = {
+        ...persisted.session,
+        status: shouldInvalidate ? "planning" : persisted.session.status,
+        updatedAt: now
+    };
+    const refreshDetails = [
+        "OpenPome refreshed the active story from Jira before continuing.",
+        ...summarizeWorkItemRefreshChanges(persisted.workItem, latest),
+        ...(shouldInvalidate
+            ? ["Story scope changed, so the current plan and pending AI outputs were reset."]
+            : ["Only non-planning fields changed; existing plan state was kept."])
+    ];
+    const common = {
+        version: persisted.version,
+        session,
+        workItem: latest,
+        workspaceCandidate: persisted.workspaceCandidate,
+        events: appendSessionEvents(persisted.events, [
+            createSessionEvent(session, latest.key, "work_item_refreshed", "Jira story refreshed", now, refreshDetails, {
+                materialChanged: String(materialChanged),
+                previousStatus: persisted.workItem.status,
+                latestStatus: latest.status
+            })
+        ]),
+        approvalHistory: persisted.approvalHistory ?? [],
+        prCreation: persisted.prCreation,
+        workItemUpdatePost: persisted.workItemUpdatePost
+    };
+    const refreshed = shouldInvalidate
+        ? common
+        : {
+            ...persisted,
+            session,
+            workItem: latest,
+            events: common.events
+        };
+    await writeActiveTaskSession(homeDirectory, refreshed);
+    return refreshed;
+}
+function getWorkItemMaterialFingerprint(item) {
+    return stableStringify({
+        key: item.key,
+        source: item.source,
+        type: item.type,
+        title: item.title,
+        description: item.description ?? "",
+        priority: item.priority ?? "",
+        iteration: item.iteration ?? "",
+        parentKey: item.parentKey ?? "",
+        labels: normalizeStringList(item.labels),
+        components: normalizeStringList(item.components),
+        links: normalizeWorkItemLinks(item.links),
+        subtasks: normalizeWorkItemSummaries(item.subtasks)
+    });
+}
+function getWorkItemFullFingerprint(item) {
+    return stableStringify({
+        material: JSON.parse(getWorkItemMaterialFingerprint(item)),
+        status: item.status,
+        assignee: item.assignee ?? ""
+    });
+}
+function summarizeWorkItemRefreshChanges(previous, latest) {
+    const changes = [
+        previous.title !== latest.title ? "Title changed." : undefined,
+        (previous.description ?? "") !== (latest.description ?? "") ? "Description or acceptance criteria changed." : undefined,
+        previous.status !== latest.status ? `Status changed: ${previous.status} -> ${latest.status}.` : undefined,
+        (previous.priority ?? "") !== (latest.priority ?? "") ? `Priority changed: ${previous.priority ?? "none"} -> ${latest.priority ?? "none"}.` : undefined,
+        (previous.assignee ?? "") !== (latest.assignee ?? "") ? `Assignee changed: ${previous.assignee ?? "none"} -> ${latest.assignee ?? "none"}.` : undefined,
+        stableStringify(normalizeStringList(previous.labels)) !== stableStringify(normalizeStringList(latest.labels)) ? "Labels changed." : undefined,
+        stableStringify(normalizeStringList(previous.components)) !== stableStringify(normalizeStringList(latest.components)) ? "Components changed." : undefined,
+        stableStringify(normalizeWorkItemLinks(previous.links)) !== stableStringify(normalizeWorkItemLinks(latest.links)) ? "Linked work changed." : undefined,
+        stableStringify(normalizeWorkItemSummaries(previous.subtasks)) !== stableStringify(normalizeWorkItemSummaries(latest.subtasks)) ? "Subtasks changed." : undefined
+    ].filter((change) => Boolean(change));
+    return changes.length ? changes.slice(0, 8) : ["Jira returned updated story metadata."];
+}
+function normalizeStringList(values) {
+    return [...new Set((values ?? []).map((value) => value.trim()).filter(Boolean))].sort((left, right) => left.localeCompare(right));
+}
+function normalizeWorkItemLinks(links) {
+    return (links ?? [])
+        .map((link) => ({
+        kind: link.kind,
+        url: link.url,
+        title: link.title ?? ""
+    }))
+        .sort((left, right) => `${left.kind}:${left.url}:${left.title}`.localeCompare(`${right.kind}:${right.url}:${right.title}`));
+}
+function normalizeWorkItemSummaries(summaries) {
+    return (summaries ?? [])
+        .map((summary) => ({
+        key: summary.key,
+        type: summary.type,
+        title: summary.title,
+        status: summary.status
+    }))
+        .sort((left, right) => left.key.localeCompare(right.key));
+}
+function stableStringify(value) {
+    return JSON.stringify(value);
+}
 function createWorkspaceId(path) {
     const hash = createHash("sha256").update(path).digest("hex").slice(0, 12);
     return `${basename(path).toLowerCase().replace(/[^a-z0-9]+/gu, "-").replace(/^-|-$/gu, "")}-${hash}`;
@@ -2433,6 +2790,7 @@ function buildStructuredPatchPrompt(session, workspacePath, contextFiles) {
         file.content,
         "```"
     ].join("\n")).join("\n\n");
+    const failedTestContext = getFailedTestContextAfterLatestPatch(session);
     return [
         "You are OpenPome's implementation engine.",
         "Return only compact JSON. Do not include markdown fences outside JSON.",
@@ -2457,6 +2815,9 @@ function buildStructuredPatchPrompt(session, workspacePath, contextFiles) {
         ...(plan?.steps.map((step) => `- ${step.title}${step.detail ? `: ${step.detail}` : ""}`) ?? []),
         plan?.commandsToRun.length ? `- Checks: ${plan.commandsToRun.join(", ")}` : undefined,
         "",
+        failedTestContext.length ? "Recent failed validation after the latest approved patch:" : undefined,
+        ...failedTestContext,
+        failedTestContext.length ? "" : undefined,
         "Workspace:",
         `- Path: ${workspacePath}`,
         session.workspaceCandidate?.workspace.name ? `- Name: ${session.workspaceCandidate.workspace.name}` : undefined,
@@ -2465,6 +2826,19 @@ function buildStructuredPatchPrompt(session, workspacePath, contextFiles) {
         context || "No source files were safely included. You may propose small new files only if the task clearly asks for them."
     ].filter((line) => Boolean(line)).join("\n");
 }
+function getFailedTestContextAfterLatestPatch(session) {
+    const failedRun = getLatestFailedTestRunAfterLatestPatch(session);
+    if (!failedRun) {
+        return [];
+    }
+    return [
+        `- Command: ${failedRun.command}`,
+        `- Exit code: ${failedRun.exitCode}`,
+        failedRun.cwd ? `- Working directory: ${failedRun.cwd}` : undefined,
+        ...failedRun.stdoutSummary.map((line) => `- stdout: ${line}`),
+        ...failedRun.stderrSummary.map((line) => `- stderr: ${line}`)
+    ].filter((line) => Boolean(line)).slice(0, 48);
+}
 function parseAIPatchProposal(value, session, provider, workspacePath, createdAt) {
     const json = extractJsonObject(value);
     if (!json) {
@@ -2726,7 +3100,21 @@ async function detectPullRequestBaseBranch(workspacePath) {
     return headBranch || "main";
 }
 function hasPassedTestEvidence(session) {
-    return (session.testRunEvidence ?? []).some((run) => run.status === "passed");
+    const latestRunAfterPatch = getLatestTestRunAfterLatestPatch(session);
+    return latestRunAfterPatch?.status === "passed" || (!session.aiPatchProposal?.appliedAt && (session.testRunEvidence ?? []).some((run) => run.status === "passed"));
+}
+function hasFailedTestAfterLatestAppliedPatch(session) {
+    return Boolean(getLatestFailedTestRunAfterLatestPatch(session));
+}
+function getLatestFailedTestRunAfterLatestPatch(session) {
+    const latestRun = getLatestTestRunAfterLatestPatch(session);
+    return latestRun?.status === "failed" ? latestRun : undefined;
+}
+function getLatestTestRunAfterLatestPatch(session) {
+    const appliedAt = session.aiPatchProposal?.appliedAt;
+    const runs = session.testRunEvidence ?? [];
+    const filtered = appliedAt ? runs.filter((run) => run.finishedAt >= appliedAt) : runs;
+    return filtered[filtered.length - 1];
 }
 async function runGitStrict(cwd, args) {
     return execFileStrict("git", args, cwd);