@overdeck/desktop 0.45.22 → 0.45.24

package/server/{workflows-BZNNYkGC.js → workflows-mbQzh6mQ.js}

@@ -1,23 +1,22 @@
-import { Bt as resolveProjectForIssue, It as readIssueRecord, Mt as getProjectConfigFromWorkspacePath, Nt as init_record, Pt as markRecordPipelineClosedOutSync, Ut as writeCloseOutDodGate, Vr as OVERDECK_HOME, dr as extractPrefixSync, fr as init_issue_id, ii as init_paths, ur as extractNumberSync } from "./config-yaml-ig8Nwtiw.js";
-import { c as init_review_status, o as getReviewStatus } from "./review-status-DFRjDFef.js";
-import { i as listRunningAgents, s as init_agents } from "./queries-ZABd5aXP.js";
-import { n as recordFeatureRegistryLifecycle, t as init_feature_registry_population } from "./feature-registry-population-B-CI9hgE.js";
-import { f as init_config, s as getDashboardApiUrlSync } from "./config-q4Gvd8dq.js";
-import { i as loadCloisterConfig, r as init_config$1 } from "./config-DeTsoZdR.js";
-import { r as getAutoCloseOutCanonicalState, t as pruneStoppedAgentsForIssue } from "./agent-gc-Dj2gncak.js";
-import { i as findWorkspacePath, o as init_archive_planning, t as archivePlanning } from "./archive-planning-BvDuWNMo.js";
-import { a as stepSkipped, i as stepOk, n as init_types, r as stepFailed, t as getLinearApiKey } from "./types-7-GnJn0t.js";
-import { t as closeIssue } from "./close-issue-CxReRxIc.js";
-import { o as init_pull_requests, r as fetchIssuePullRequest, t as fetchCommitCheckRuns } from "./pull-requests-8z2N1UOV.js";
-import { n as acceptFlagFor, t as DOD_ROWS } from "./dod-DbJLYcHv.js";
-import { t as teardownWorkspace } from "./teardown-workspace-DDCf5n-a.js";
+import { Dt as getProjectConfigFromWorkspacePath, Ft as resolveProjectForIssue, Jn as extractPrefixSync, Lt as writeCloseOutDodGate, Ot as init_record, Vr as init_paths, Yn as init_issue_id, jt as readIssueRecord, kt as markRecordPipelineClosedOutSync, qn as extractNumberSync, wr as OVERDECK_HOME } from "./config-yaml-DySPNmKN.js";
+import { l as init_review_status, s as getReviewStatus } from "./review-status-kZj_KyCk.js";
+import { b as init_agents, i as listRunningAgents } from "./queries-CjNIf-Ub.js";
+import { n as recordFeatureRegistryLifecycle, t as init_feature_registry_population } from "./feature-registry-population-DKZFMbFt.js";
+import { f as init_config, s as getDashboardApiUrlSync } from "./config-BZ0sHTju.js";
+import { i as loadCloisterConfig, r as init_config$1 } from "./config-CKxYiCmX.js";
+import { r as getAutoCloseOutCanonicalState, t as pruneStoppedAgentsForIssue } from "./agent-gc-CHcnvonI.js";
+import { i as findWorkspacePath, o as init_archive_planning, t as archivePlanning } from "./archive-planning-Du25Jtst.js";
+import { a as stepSkipped, i as stepOk, n as init_types, r as stepFailed, t as getLinearApiKey } from "./types-5M0lupud.js";
+import { t as closeIssue } from "./close-issue-DoOifFIK.js";
+import { o as init_pull_requests, r as fetchIssuePullRequest, t as fetchCommitCheckRuns } from "./pull-requests-_lHueOHW.js";
+import { n as acceptFlagFor, t as DOD_ROWS } from "./dod-C6n9RV3G.js";
+import { t as teardownWorkspace } from "./teardown-workspace-DeTTImn-.js";
 import { resolve } from "node:path";
 import { Effect } from "effect";
 import { existsSync } from "fs";
 import { join as join$1 } from "path";
 import { userInfo } from "node:os";
-import { stat } from "node:fs/promises";
-import { copyFile, readFile as readFile$1, writeFile as writeFile$1 } from "fs/promises";
+import { copyFile, readFile, writeFile } from "fs/promises";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { exec as exec$1 } from "child_process";
@@ -98,32 +97,7 @@ const defaultDeployRowDeps = {
 		} catch {
 			return false;
 		}
-	},
-	serverStartedAt: async (port) => {
-		const { stdout: pidOutput } = await execFileAsync("lsof", [
-			"-ti",
-			`tcp:${port}`,
-			"-sTCP:LISTEN"
-		], {
-			encoding: "utf-8",
-			timeout: 1e4
-		});
-		const pid = pidOutput.trim().split("\n")[0];
-		if (!pid) throw new Error(`no dashboard process owns port ${port}`);
-		const { stdout } = await execFileAsync("ps", [
-			"-o",
-			"lstart=",
-			"-p",
-			pid
-		], {
-			encoding: "utf-8",
-			timeout: 1e4
-		});
-		const startedAt = new Date(stdout.trim());
-		if (Number.isNaN(startedAt.getTime())) throw new Error(`could not parse dashboard process start time: ${stdout.trim()}`);
-		return startedAt;
-	},
-	distMtime: async (repoRoot) => new Date((await stat(resolve(repoRoot, "dist/dashboard/server.js"))).mtime)
+	}
 };
 const defaultDeps = {
 	getReviewStatus: (issueId) => Effect.runPromise(getReviewStatus(issueId)),
@@ -248,25 +222,13 @@ async function checkDeployRow(ctx, merge, deps = defaultDeployRowDeps) {
 	const repoRoot = typeof health.repoRoot === "string" ? health.repoRoot : "";
 	if (!repoRoot) return result("deploy", "miss", `dashboard at ${baseUrl} did not report repoRoot`);
 	if (resolve(repoRoot) !== resolve(ctx.projectPath)) return result("deploy", "skip", `live dashboard serves ${repoRoot}, not this project — deploy semantics undefined for ${ctx.projectPath}`);
+	const buildCommit = typeof health.buildCommit === "string" && health.buildCommit.trim() ? health.buildCommit : void 0;
+	if (!buildCommit) return result("deploy", "miss", `dashboard at ${baseUrl} did not report buildCommit; live deployment cannot be proven`);
+	if (!merge.mergeCommit) return result("deploy", "miss", "cannot resolve merge commit; live deployment cannot be proven");
 	try {
-		let version = {};
-		try {
-			version = await deps.readJson(`${baseUrl}/api/version`);
-		} catch {}
-		const buildCommit = typeof version.buildCommit === "string" ? version.buildCommit : typeof version.commit === "string" ? version.commit : void 0;
-		if (buildCommit && merge.mergeCommit) {
-			const contains = await deps.commitContains(repoRoot, merge.mergeCommit, buildCommit);
-			const observed = `build commit ${buildCommit.slice(0, 8)} ${contains ? "contains" : "does not contain"} merge ${merge.mergeCommit.slice(0, 8)}`;
-			return result("deploy", contains ? "pass" : "miss", observed);
-		}
-		if (!merge.mergedAt) return result("deploy", "miss", "cannot resolve merge time for best-effort deploy check");
-		const mergedAt = new Date(merge.mergedAt);
-		if (Number.isNaN(mergedAt.getTime())) return result("deploy", "miss", `cannot parse merge time ${merge.mergedAt}`);
-		const port = Number(new URL(baseUrl).port || (new URL(baseUrl).protocol === "https:" ? 443 : 80));
-		const [startedAt, builtAt] = await Promise.all([deps.serverStartedAt(port), deps.distMtime(repoRoot)]);
-		const fresh = startedAt > mergedAt && builtAt > mergedAt;
-		const observed = `best-effort — build commit not exposed (PAN-2713): server started ${startedAt.toISOString()}, dist built ${builtAt.toISOString()}, merge ${mergedAt.toISOString()}`;
-		return result("deploy", fresh ? "pass" : "miss", observed);
+		const contains = await deps.commitContains(repoRoot, merge.mergeCommit, buildCommit);
+		const observed = `build commit ${buildCommit.slice(0, 8)} ${contains ? "contains" : "does not contain"} merge ${merge.mergeCommit.slice(0, 8)}`;
+		return result("deploy", contains ? "pass" : "miss", observed);
 	} catch (error) {
 		return result("deploy", "miss", `deploy evidence unavailable: ${error instanceof Error ? error.message : String(error)}`);
 	}
@@ -390,7 +352,7 @@ function close(ctx, opts = {}) {
 *
 * 1. Verify branch merged (hard fail if not — must pass before any cleanup)
 * 2. Move PRD + archive workspace artifacts (hard fail if archiving fails)
-* 3. Mark vBRIEF completed
+* 3. Mark xBRIEF completed
 * 4. Clean up workspace (tmux, TLDR, Docker, worktree)
 * 5. Clean up agent state
 * 6. Close issue on tracker
@@ -424,10 +386,10 @@ function closeOut(ctx, opts = {}) {
 			allSteps.push(stepFailed("close-out:abort", "Stopped — archiving failed, workspace preserved"));
 			return buildResult("close-out", ctx.issueId, allSteps, start, dodGate);
 		}
-		const vbriefStep = yield* Effect.promise(() => completeVBriefStep(ctx));
-		allSteps.push(vbriefStep);
-		if (!vbriefStep.success && !vbriefStep.skipped) {
-			allSteps.push(stepFailed("close-out:abort", "Stopped — vBRIEF completion failed, workspace preserved"));
+		const xbriefStep = yield* Effect.promise(() => completeXBriefStep(ctx));
+		allSteps.push(xbriefStep);
+		if (!xbriefStep.success && !xbriefStep.skipped) {
+			allSteps.push(stepFailed("close-out:abort", "Stopped — xBRIEF completion failed, workspace preserved"));
 			return buildResult("close-out", ctx.issueId, allSteps, start, dodGate);
 		}
 		const closeOutConfig = (yield* Effect.promise(() => Effect.runPromise(loadCloisterConfig()))).close_out;
@@ -577,19 +539,19 @@ function resetToTodo(ctx, opts = {}) {
 function cancelIssueWorkflow(ctx, opts = {}) {
 	return destructiveResetWorkflow("cancel", ctx, opts, resetIssueToCanceled, "Canceling issue", "Issue moved to Canceled");
 }
-async function completeVBriefStep(ctx) {
+async function completeXBriefStep(ctx) {
 	const step = "close-out:vbrief-completed";
 	try {
-		const { transitionVBriefOnMain } = await import("./lifecycle-io-DmY2qwCn.js");
-		const result = await Effect.runPromise(transitionVBriefOnMain(ctx.projectPath, ctx.issueId, "completed", "completed", `scope: complete ${ctx.issueId.toUpperCase()} vBRIEF`));
-		const details = [result.moved ? "Updated vBRIEF lifecycle to completed" : "vBRIEF lifecycle already completed", result.statusUpdated ? "Updated plan.status to completed" : "plan.status already completed"];
-		if (result.committed) details.push("Committed vBRIEF completion on main");
+		const { transitionXBriefOnMain } = await import("./lifecycle-io-DPo7x11I.js");
+		const result = await Effect.runPromise(transitionXBriefOnMain(ctx.projectPath, ctx.issueId, "completed", "completed", `scope: complete ${ctx.issueId.toUpperCase()} xBRIEF`));
+		const details = [result.moved ? "Updated xBRIEF lifecycle to completed" : "xBRIEF lifecycle already completed", result.statusUpdated ? "Updated plan.status to completed" : "plan.status already completed"];
+		if (result.committed) details.push("Committed xBRIEF completion on main");
 		return stepOk(step, details);
 	} catch (err) {
 		const cause = err.cause ?? err;
 		const message = cause instanceof Error ? cause.message : String(cause);
-		if (message.includes("No vBRIEF found")) return stepSkipped(step, [`No vBRIEF found for ${ctx.issueId}`]);
-		return stepFailed(step, `vBRIEF completion failed: ${message}`);
+		if (message.includes("No xBRIEF found")) return stepSkipped(step, [`No xBRIEF found for ${ctx.issueId}`]);
+		return stepFailed(step, `xBRIEF completion failed: ${message}`);
 	}
 }
 async function verifyBranchMergedImpl(ctx) {
@@ -597,7 +559,7 @@ async function verifyBranchMergedImpl(ctx) {
 	const branchName = `feature/${ctx.issueId.toLowerCase()}`;
 	try {
 		try {
-			const { loadReviewStatuses } = await import("./review-status-Bnh-rdkY.js");
+			const { loadReviewStatuses } = await import("./review-status-btEYlaxA.js");
 			if (loadReviewStatuses()[ctx.issueId.toUpperCase()]?.mergeStatus === "merged") return stepOk(step, ["Merge specialist confirmed merge completed"]);
 		} catch {}
 		const { stdout: branchExists } = await execAsync(`git branch --list "${branchName}" 2>/dev/null || true`, {
@@ -821,7 +783,7 @@ async function resetIssueToTodoImpl(ctx) {
 */
 async function resetPostMergeStateForIssue(issueId) {
 	try {
-		const { resetPostMergeState } = await import("./merge-agent-B-SnXOoc.js");
+		const { resetPostMergeState } = await import("./merge-agent-CKkgIBPB.js");
 		resetPostMergeState(issueId);
 		resetPostMergeState(issueId.toUpperCase());
 	} catch {
@@ -837,18 +799,18 @@ function clearReviewStatusStep(issueId) {
 async function clearReviewStatusStepImpl(issueId) {
 	const step = "clear-review-status";
 	try {
-		const { clearReviewStatus } = await import("./review-status-Bnh-rdkY.js");
+		const { clearReviewStatus } = await import("./review-status-btEYlaxA.js");
 		clearReviewStatus(issueId.toUpperCase());
 		return stepOk(step, ["Review status cleared"]);
 	} catch {
 		try {
 			const statusFile = join$1(OVERDECK_HOME, "review-status.json");
 			if (existsSync(statusFile)) {
-				const data = JSON.parse(await readFile$1(statusFile, "utf-8"));
+				const data = JSON.parse(await readFile(statusFile, "utf-8"));
 				const upperKey = issueId.toUpperCase();
 				if (data[upperKey]) {
 					delete data[upperKey];
-					await writeFile$1(statusFile, JSON.stringify(data, null, 2));
+					await writeFile(statusFile, JSON.stringify(data, null, 2));
 				}
 			}
 			return stepOk(step, ["Review status cleared (direct)"]);
@@ -904,4 +866,4 @@ async function resetIssueToCanceledImpl(ctx) {
 //#endregion
 export { deepWipe as a, closeOut as i, cancelIssueWorkflow as n, resetToTodo as o, close as r, verifyBranchMergedImpl as s, approve as t };
 
-//# sourceMappingURL=workflows-BZNNYkGC.js.map
+//# sourceMappingURL=workflows-mbQzh6mQ.js.map

package/server/{workspace-3IC-UkAi.js → workspace--8tnhDI0.js}

@@ -1,3 +1,3 @@
-import { i as injectMemoryHookSettings, n as init_workspace, r as injectCavemanSettings, t as determineCavemanVariant } from "./workspace-D9ppycdg.js";
+import { i as injectMemoryHookSettings, n as init_workspace, r as injectCavemanSettings, t as determineCavemanVariant } from "./workspace-BPUws1-_.js";
 init_workspace();
 export { determineCavemanVariant, injectCavemanSettings, injectMemoryHookSettings };

package/server/{workspace-D9ppycdg.js → workspace-BPUws1-_.js}

@@ -1,6 +1,6 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { jr as init_errors, xr as FsError } from "./config-yaml-ig8Nwtiw.js";
-import { i as init_settings, t as areMemoryObservationsEnabled } from "./settings-BNbocWOg.js";
+import { ir as FsError, mr as init_errors } from "./config-yaml-DySPNmKN.js";
+import { i as init_settings, t as areMemoryObservationsEnabled } from "./settings-BTMvpNFU.js";
 import { Effect } from "effect";
 import { existsSync } from "fs";
 import { join } from "path";
@@ -238,4 +238,4 @@ var init_workspace = __esmMin((() => {
 //#endregion
 export { readCavemanVariant as a, injectMemoryHookSettings as i, init_workspace as n, injectCavemanSettings as r, determineCavemanVariant as t };
 
-//# sourceMappingURL=workspace-D9ppycdg.js.map
+//# sourceMappingURL=workspace-BPUws1-_.js.map

package/server/{workspace-config-Bigl_-Lk.js → workspace-config-CIVWZOQr.js}

@@ -25,4 +25,4 @@ var init_workspace_config = __esmMin((() => {}));
 //#endregion
 export { init_workspace_config as n, replacePlaceholdersSync as r, getDefaultWorkspaceConfigSync as t };
 
-//# sourceMappingURL=workspace-config-Bigl_-Lk.js.map
+//# sourceMappingURL=workspace-config-CIVWZOQr.js.map

package/server/{workspace-manager-ClkCIWTe.js → workspace-manager-CBhNdzE4.js}

@@ -1,14 +1,14 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Dr as ProcessSpawnError, Fr as CACHE_AGENTS_DIR, Ir as CACHE_RULES_DIR, f as loadConfigSync, ii as init_paths, jr as init_errors, qr as SKILLS_DIR, t as init_config_yaml, xr as FsError } from "./config-yaml-ig8Nwtiw.js";
+import { Ar as SKILLS_DIR, Vr as init_paths, f as loadConfigSync, ir as FsError, mr as init_errors, t as init_config_yaml, ur as ProcessSpawnError, vr as CACHE_AGENTS_DIR, yr as CACHE_RULES_DIR } from "./config-yaml-DySPNmKN.js";
 import { a as PAN_DIRNAME, c as PAN_SESSIONS_FILENAME, i as PAN_CONTINUE_FILENAME, n as PAN_CONTEXT_FILENAME, s as PAN_FEEDBACK_DIRNAME } from "./types-hraoaQIp.js";
-import { t as init_pan_dir } from "./pan-dir-DOcf6ug3.js";
-import { n as init_workspace_config, r as replacePlaceholdersSync, t as getDefaultWorkspaceConfigSync } from "./workspace-config-Bigl_-Lk.js";
-import { n as init_tunnel, r as removeTunnelIngress, t as addTunnelIngress } from "./tunnel-IdK1iTHx.js";
-import { i as init_hume, n as createHumeConfig, r as deleteHumeConfig } from "./hume-Dz_OymXE.js";
-import { a as renderDevcontainerSync, i as processTemplatesSync, n as createWorkspacePlaceholdersSync, o as sanitizeComposeFileSync, r as init_devcontainer_renderer, t as DEVCONTAINER_DIRNAME } from "./devcontainer-renderer-CNmQy0pL.js";
-import { n as init_docker, r as stopWorkspaceDockerPromise, t as getContainersReferencingWorkspacePathPromise } from "./docker-BCZ89M9X.js";
+import { t as init_pan_dir } from "./pan-dir-B0c3w0Ya.js";
+import { n as init_workspace_config, r as replacePlaceholdersSync, t as getDefaultWorkspaceConfigSync } from "./workspace-config-CIVWZOQr.js";
+import { n as init_tunnel, r as removeTunnelIngress, t as addTunnelIngress } from "./tunnel-CDVKJpRv.js";
+import { i as init_hume, n as createHumeConfig, r as deleteHumeConfig } from "./hume-Cz8igP9E.js";
+import { a as renderDevcontainerSync, i as processTemplatesSync, n as createWorkspacePlaceholdersSync, o as sanitizeComposeFileSync, r as init_devcontainer_renderer, t as DEVCONTAINER_DIRNAME } from "./devcontainer-renderer-_d6XhyND.js";
+import { n as init_docker, r as stopWorkspaceDockerPromise, t as getContainersReferencingWorkspacePathPromise } from "./docker-DcMTFTUC.js";
 import { Effect } from "effect";
-import { copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "fs";
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "fs";
 import { basename, dirname, extname, join, relative, resolve } from "path";
 import { homedir, platform } from "os";
 import { createHash } from "crypto";
@@ -587,6 +587,37 @@ function relocateVenvScripts(sourceVenv, destVenv) {
 		} catch {}
 	}
 }
+/** Install the agent-only rebase guard in Git's configured hooks directory. */
+async function installPreRebaseHook(targetPath) {
+	const { stdout } = await execAsync$2("git rev-parse --git-path hooks", {
+		cwd: targetPath,
+		encoding: "utf-8"
+	});
+	const hooksDir = resolve(targetPath, stdout.trim());
+	const hookPath = join(hooksDir, "pre-rebase");
+	mkdirSync(hooksDir, { recursive: true });
+	const originalHookPath = `${hookPath}${PRE_REBASE_ORIGINAL_SUFFIX}`;
+	const existingHook = existsSync(hookPath) ? readFileSync(hookPath, "utf-8") : "";
+	if (!existingHook.includes(PRE_REBASE_HOOK_MARKER)) {
+		if (existingHook) {
+			rmSync(originalHookPath, { force: true });
+			renameSync(hookPath, originalHookPath);
+		}
+		writeFileSync(hookPath, [
+			PRE_REBASE_HOOK_PREFIX,
+			`if [ -x "\${0}${PRE_REBASE_ORIGINAL_SUFFIX}" ]; then`,
+			`  exec "\${0}${PRE_REBASE_ORIGINAL_SUFFIX}" "$@"`,
+			"fi",
+			"exit 0",
+			""
+		].join("\n"), {
+			encoding: "utf-8",
+			mode: 493
+		});
+	}
+	chmodSync(hookPath, 493);
+	return hookPath;
+}
 /**
 * Create a git worktree
 * @param repoPath Path to the source git repository
@@ -604,6 +635,7 @@ async function createWorktree(repoPath, targetPath, branchName, defaultBranch =
 		const remoteList = remoteBranches.split("\n").map((b) => b.trim()).filter(Boolean);
 		if (localList.includes(branchName) || remoteList.includes(`origin/${branchName}`)) await execAsync$2(`git worktree add "${targetPath}" "${branchName}"`, { cwd: repoPath });
 		else await execAsync$2(`git worktree add "${targetPath}" -b "${branchName}" "${defaultBranch}"`, { cwd: repoPath });
+		await installPreRebaseHook(targetPath);
 		await execAsync$2("git restore .", { cwd: targetPath }).catch(() => {});
 		return {
 			success: true,
@@ -778,11 +810,23 @@ function preTrustDirectorySync(dirPath) {
 	}
 	if (dirty) writeFileSync(claudeJsonPath, JSON.stringify(data, null, 2), "utf8");
 }
-var execAsync$2, TEXT_EXTENSIONS;
+var execAsync$2, PRE_REBASE_HOOK_MARKER, PRE_REBASE_ORIGINAL_SUFFIX, PRE_REBASE_HOOK_PREFIX, TEXT_EXTENSIONS;
 var init_worktree_ops = __esmMin((() => {
 	init_workspace_config();
 	init_types();
 	execAsync$2 = promisify(exec);
+	PRE_REBASE_HOOK_MARKER = "# OVERDECK MANAGED PRE-REBASE GUARD";
+	PRE_REBASE_ORIGINAL_SUFFIX = ".overdeck-original";
+	PRE_REBASE_HOOK_PREFIX = [
+		"#!/bin/sh",
+		PRE_REBASE_HOOK_MARKER,
+		"if [ \"$OVERDECK_PAN_GIT_OP\" != \"1\" ] && [ -n \"$OVERDECK_AGENT_ID\" ]; then",
+		"  echo \"Overdeck agents must not run git rebase directly.\" >&2",
+		"  echo \"Use pan sync-main <ISSUE-ID> to sync main or pan done <ISSUE-ID> to submit.\" >&2",
+		"  exit 1",
+		"fi",
+		""
+	].join("\n");
 	TEXT_EXTENSIONS = new Set([
 		".md",
 		".sh",
@@ -826,13 +870,20 @@ function ensurePolyrepoWorkspaceGitignoreSync(workspacePath, repos) {
 		const entry = `${repo.name}/`;
 		if (!normalizedLines.includes(entry) && !normalizedLines.includes(repo.name)) added.push(entry);
 	}
-	if (added.length === 0 && removed.length === 0) return {
+	const addRuntimeEntry = !normalizedLines.includes(".overdeck/") && !normalizedLines.includes(".overdeck");
+	if (added.length === 0 && !addRuntimeEntry && removed.length === 0) return {
 		added,
 		removed
 	};
 	if (content && !content.endsWith("\n")) content += "\n";
-	if (!normalizedLines.some((l) => l.includes("Polyrepo") || l.includes("polyrepo"))) content += "\n# Polyrepo sub-repositories\n";
-	content += added.join("\n") + "\n";
+	if (added.length > 0) {
+		if (!normalizedLines.some((l) => l.includes("Polyrepo") || l.includes("polyrepo"))) content += "\n# Polyrepo sub-repositories\n";
+		content += added.join("\n") + "\n";
+	}
+	if (addRuntimeEntry) {
+		content += "\n# Overdeck workspace runtime (PAN-2541: durable state lives on overdeck-state)\n.overdeck/\n";
+		added.push(".overdeck/");
+	}
 	writeFileSync(gitignorePath, content, "utf-8");
 	return {
 		added,
@@ -1014,6 +1065,13 @@ async function createWorkspacePromise(options) {
 		progress("Installing dependencies", "Failed — workspace creation aborted", "complete");
 		return result;
 	}
+	const hookTargets = workspaceConfig.type === "polyrepo" && workspaceConfig.repos ? workspaceConfig.repos.filter((repo) => repo.link_type !== "symlink").map((repo) => join(workspacePath, repo.name)).filter((path) => existsSync(join(path, ".git"))) : [workspacePath];
+	try {
+		for (const hookTarget of hookTargets) await installPreRebaseHook(hookTarget);
+	} catch (hookErr) {
+		result.errors.push(`Pre-rebase guard install failed: ${hookErr.message?.slice(0, 200)}`);
+		return result;
+	}
 	const workspacePackages = projectConfig.workspace_packages;
 	if (workspacePackages && workspacePackages.length > 0) {
 		progress("Building workspace packages", workspacePackages.map((p) => p.path).join(", "));
@@ -1061,7 +1119,7 @@ async function createWorkspacePromise(options) {
 				await execAsync$1(`cp -r "${mainTldrDir}" "${workspaceTldrDir}"`);
 				result.steps.push("Copied TLDR index from main branch");
 			}
-			const { getTldrDaemonServiceSync } = await import("./tldr-daemon-B8_oT5gx.js");
+			const { getTldrDaemonServiceSync } = await import("./tldr-daemon-BYFkts95.js");
 			const tldrService = getTldrDaemonServiceSync(workspacePath, venvPath);
 			await tldrService.start(true);
 			result.steps.push("Started TLDR daemon");
@@ -1182,7 +1240,7 @@ async function createWorkspacePromise(options) {
 		result.steps.push("Pre-trusted workspace in Claude Code");
 	} catch {}
 	try {
-		const { determineCavemanVariant, injectCavemanSettings } = await import("./workspace-3IC-UkAi.js");
+		const { determineCavemanVariant, injectCavemanSettings } = await import("./workspace--8tnhDI0.js");
 		const cavemanConfig = loadConfigSync().config.caveman;
 		const variant = determineCavemanVariant(cavemanConfig);
 		await Effect.runPromise(injectCavemanSettings(workspacePath, variant));
@@ -1198,7 +1256,7 @@ async function createWorkspacePromise(options) {
 		result.steps.push(`Overdeck settings copy skipped: ${settingsErr instanceof Error ? settingsErr.message : String(settingsErr)}`);
 	}
 	try {
-		const { injectMemoryHookSettings } = await import("./workspace-3IC-UkAi.js");
+		const { injectMemoryHookSettings } = await import("./workspace--8tnhDI0.js");
 		await injectMemoryHookSettings(workspacePath);
 		result.steps.push("Injected memory hooks into .claude/settings.json");
 	} catch (memoryHookErr) {
@@ -1250,7 +1308,7 @@ async function removeWorkspacePromise(options) {
 	}
 	const venvPath = join(workspacePath, ".venv");
 	if (existsSync(venvPath)) try {
-		const { getTldrDaemonServiceSync } = await import("./tldr-daemon-B8_oT5gx.js");
+		const { getTldrDaemonServiceSync } = await import("./tldr-daemon-BYFkts95.js");
 		await getTldrDaemonServiceSync(workspacePath, venvPath).stop();
 		result.steps.push("Stopped TLDR daemon");
 	} catch (error) {
@@ -1370,6 +1428,6 @@ var init_workspace_manager = __esmMin((() => {
 	});
 }));
 //#endregion
-export { removeWorkspace as a, relocateVenvScripts as c, copyOverdeckSettingsToWorkspaceSync as d, ensurePanGitignoreSync as f, preTrustDirectory as i, detectPlatform as l, getContainersReferencingWorkspacePath as n, stopWorkspaceDocker as o, init_workspace_manager as r, preTrustDirectorySync as s, createWorkspace as t, init_platform as u };
+export { removeWorkspace as a, preTrustDirectorySync as c, init_platform as d, copyOverdeckSettingsToWorkspaceSync as f, preTrustDirectory as i, relocateVenvScripts as l, getContainersReferencingWorkspacePath as n, stopWorkspaceDocker as o, ensurePanGitignoreSync as p, init_workspace_manager as r, installPreRebaseHook as s, createWorkspace as t, detectPlatform as u };
 
-//# sourceMappingURL=workspace-manager-ClkCIWTe.js.map
+//# sourceMappingURL=workspace-manager-CBhNdzE4.js.map

package/server/workspace-manager-CWT55qeI.js

@@ -0,0 +1,3 @@
+import { a as removeWorkspace, c as preTrustDirectorySync, f as copyOverdeckSettingsToWorkspaceSync, i as preTrustDirectory, o as stopWorkspaceDocker, r as init_workspace_manager, t as createWorkspace } from "./workspace-manager-CBhNdzE4.js";
+init_workspace_manager();
+export { copyOverdeckSettingsToWorkspaceSync, createWorkspace, preTrustDirectory, preTrustDirectorySync, removeWorkspace, stopWorkspaceDocker };

package/server/{workspace-metadata-BE0efUv_.js → workspace-metadata-BzHnwwX4.js}

@@ -1,2 +1,2 @@
-import { n as deleteWorkspaceMetadataSync } from "./workspace-metadata-tiSRIWJP.js";
+import { n as deleteWorkspaceMetadataSync } from "./workspace-metadata-_WygnyoX.js";
 export { deleteWorkspaceMetadataSync };

package/server/{workspace-metadata-tiSRIWJP.js → workspace-metadata-_WygnyoX.js}

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM } from "./rolldown-runtime-DNCzzKnI.js";
-import { _r as require_dist, jr as init_errors } from "./config-yaml-ig8Nwtiw.js";
+import { er as require_dist, mr as init_errors } from "./config-yaml-DySPNmKN.js";
 import "effect";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "fs";
 import { join } from "path";
@@ -70,4 +70,4 @@ function deleteWorkspaceMetadataSync(issueId) {
 //#endregion
 export { loadWorkspaceMetadataSync as a, listWorkspaceMetadataSync as i, deleteWorkspaceMetadataSync as n, saveWorkspaceMetadataSync as o, findRemoteWorkspaceMetadataSync as r, WORKSPACES_DIR as t };
 
-//# sourceMappingURL=workspace-metadata-tiSRIWJP.js.map
+//# sourceMappingURL=workspace-metadata-_WygnyoX.js.map