@overdeck/desktop 0.45.23 → 0.45.24

package/server/{workflows-C9WmILql.js → workflows-mbQzh6mQ.js}

@@ -1,16 +1,16 @@
-import { Dt as getProjectConfigFromWorkspacePath, Ft as resolveProjectForIssue, Jn as extractPrefixSync, Lt as writeCloseOutDodGate, Ot as init_record, Vr as init_paths, Yn as init_issue_id, jt as readIssueRecord, kt as markRecordPipelineClosedOutSync, qn as extractNumberSync, wr as OVERDECK_HOME } from "./config-yaml-DvyMuOle.js";
-import { l as init_review_status, s as getReviewStatus } from "./review-status-A7quS5KJ.js";
-import { b as init_agents, i as listRunningAgents } from "./queries-6d7Cdtm7.js";
-import { n as recordFeatureRegistryLifecycle, t as init_feature_registry_population } from "./feature-registry-population-B0pmAz0a.js";
-import { f as init_config, s as getDashboardApiUrlSync } from "./config-CCvjQf27.js";
-import { i as loadCloisterConfig, r as init_config$1 } from "./config-DjLOdbgT.js";
-import { r as getAutoCloseOutCanonicalState, t as pruneStoppedAgentsForIssue } from "./agent-gc-BV1q_2EV.js";
-import { i as findWorkspacePath, o as init_archive_planning, t as archivePlanning } from "./archive-planning-DYrYojxl.js";
-import { a as stepSkipped, i as stepOk, n as init_types, r as stepFailed, t as getLinearApiKey } from "./types-BBNjPcqU.js";
-import { t as closeIssue } from "./close-issue-Dn_4c4G8.js";
-import { o as init_pull_requests, r as fetchIssuePullRequest, t as fetchCommitCheckRuns } from "./pull-requests-CXIhdCYD.js";
-import { n as acceptFlagFor, t as DOD_ROWS } from "./dod-BrSfUHm0.js";
-import { t as teardownWorkspace } from "./teardown-workspace-CEgauF4U.js";
+import { Dt as getProjectConfigFromWorkspacePath, Ft as resolveProjectForIssue, Jn as extractPrefixSync, Lt as writeCloseOutDodGate, Ot as init_record, Vr as init_paths, Yn as init_issue_id, jt as readIssueRecord, kt as markRecordPipelineClosedOutSync, qn as extractNumberSync, wr as OVERDECK_HOME } from "./config-yaml-DySPNmKN.js";
+import { l as init_review_status, s as getReviewStatus } from "./review-status-kZj_KyCk.js";
+import { b as init_agents, i as listRunningAgents } from "./queries-CjNIf-Ub.js";
+import { n as recordFeatureRegistryLifecycle, t as init_feature_registry_population } from "./feature-registry-population-DKZFMbFt.js";
+import { f as init_config, s as getDashboardApiUrlSync } from "./config-BZ0sHTju.js";
+import { i as loadCloisterConfig, r as init_config$1 } from "./config-CKxYiCmX.js";
+import { r as getAutoCloseOutCanonicalState, t as pruneStoppedAgentsForIssue } from "./agent-gc-CHcnvonI.js";
+import { i as findWorkspacePath, o as init_archive_planning, t as archivePlanning } from "./archive-planning-Du25Jtst.js";
+import { a as stepSkipped, i as stepOk, n as init_types, r as stepFailed, t as getLinearApiKey } from "./types-5M0lupud.js";
+import { t as closeIssue } from "./close-issue-DoOifFIK.js";
+import { o as init_pull_requests, r as fetchIssuePullRequest, t as fetchCommitCheckRuns } from "./pull-requests-_lHueOHW.js";
+import { n as acceptFlagFor, t as DOD_ROWS } from "./dod-C6n9RV3G.js";
+import { t as teardownWorkspace } from "./teardown-workspace-DeTTImn-.js";
 import { resolve } from "node:path";
 import { Effect } from "effect";
 import { existsSync } from "fs";
@@ -542,7 +542,7 @@ function cancelIssueWorkflow(ctx, opts = {}) {
 async function completeXBriefStep(ctx) {
 	const step = "close-out:vbrief-completed";
 	try {
-		const { transitionXBriefOnMain } = await import("./lifecycle-io-Bsnr2K4F.js");
+		const { transitionXBriefOnMain } = await import("./lifecycle-io-DPo7x11I.js");
 		const result = await Effect.runPromise(transitionXBriefOnMain(ctx.projectPath, ctx.issueId, "completed", "completed", `scope: complete ${ctx.issueId.toUpperCase()} xBRIEF`));
 		const details = [result.moved ? "Updated xBRIEF lifecycle to completed" : "xBRIEF lifecycle already completed", result.statusUpdated ? "Updated plan.status to completed" : "plan.status already completed"];
 		if (result.committed) details.push("Committed xBRIEF completion on main");
@@ -559,7 +559,7 @@ async function verifyBranchMergedImpl(ctx) {
 	const branchName = `feature/${ctx.issueId.toLowerCase()}`;
 	try {
 		try {
-			const { loadReviewStatuses } = await import("./review-status-C6n6-9f_.js");
+			const { loadReviewStatuses } = await import("./review-status-btEYlaxA.js");
 			if (loadReviewStatuses()[ctx.issueId.toUpperCase()]?.mergeStatus === "merged") return stepOk(step, ["Merge specialist confirmed merge completed"]);
 		} catch {}
 		const { stdout: branchExists } = await execAsync(`git branch --list "${branchName}" 2>/dev/null || true`, {
@@ -783,7 +783,7 @@ async function resetIssueToTodoImpl(ctx) {
 */
 async function resetPostMergeStateForIssue(issueId) {
 	try {
-		const { resetPostMergeState } = await import("./merge-agent-BQM3a8z5.js");
+		const { resetPostMergeState } = await import("./merge-agent-CKkgIBPB.js");
 		resetPostMergeState(issueId);
 		resetPostMergeState(issueId.toUpperCase());
 	} catch {
@@ -799,7 +799,7 @@ function clearReviewStatusStep(issueId) {
 async function clearReviewStatusStepImpl(issueId) {
 	const step = "clear-review-status";
 	try {
-		const { clearReviewStatus } = await import("./review-status-C6n6-9f_.js");
+		const { clearReviewStatus } = await import("./review-status-btEYlaxA.js");
 		clearReviewStatus(issueId.toUpperCase());
 		return stepOk(step, ["Review status cleared"]);
 	} catch {
@@ -866,4 +866,4 @@ async function resetIssueToCanceledImpl(ctx) {
 //#endregion
 export { deepWipe as a, closeOut as i, cancelIssueWorkflow as n, resetToTodo as o, close as r, verifyBranchMergedImpl as s, approve as t };
 
-//# sourceMappingURL=workflows-C9WmILql.js.map
+//# sourceMappingURL=workflows-mbQzh6mQ.js.map

package/server/{workspace-DuUdndHe.js → workspace--8tnhDI0.js}

@@ -1,3 +1,3 @@
-import { i as injectMemoryHookSettings, n as init_workspace, r as injectCavemanSettings, t as determineCavemanVariant } from "./workspace-BVl4rihN.js";
+import { i as injectMemoryHookSettings, n as init_workspace, r as injectCavemanSettings, t as determineCavemanVariant } from "./workspace-BPUws1-_.js";
 init_workspace();
 export { determineCavemanVariant, injectCavemanSettings, injectMemoryHookSettings };

package/server/{workspace-BVl4rihN.js → workspace-BPUws1-_.js}

@@ -1,6 +1,6 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { ir as FsError, mr as init_errors } from "./config-yaml-DvyMuOle.js";
-import { i as init_settings, t as areMemoryObservationsEnabled } from "./settings-BZ5m1UCl.js";
+import { ir as FsError, mr as init_errors } from "./config-yaml-DySPNmKN.js";
+import { i as init_settings, t as areMemoryObservationsEnabled } from "./settings-BTMvpNFU.js";
 import { Effect } from "effect";
 import { existsSync } from "fs";
 import { join } from "path";
@@ -238,4 +238,4 @@ var init_workspace = __esmMin((() => {
 //#endregion
 export { readCavemanVariant as a, injectMemoryHookSettings as i, init_workspace as n, injectCavemanSettings as r, determineCavemanVariant as t };
 
-//# sourceMappingURL=workspace-BVl4rihN.js.map
+//# sourceMappingURL=workspace-BPUws1-_.js.map

package/server/{workspace-config-cEGcO6UT.js → workspace-config-CIVWZOQr.js}

@@ -25,4 +25,4 @@ var init_workspace_config = __esmMin((() => {}));
 //#endregion
 export { init_workspace_config as n, replacePlaceholdersSync as r, getDefaultWorkspaceConfigSync as t };
 
-//# sourceMappingURL=workspace-config-cEGcO6UT.js.map
+//# sourceMappingURL=workspace-config-CIVWZOQr.js.map

package/server/{workspace-manager-hLUv3ADC.js → workspace-manager-CBhNdzE4.js}

@@ -1,14 +1,14 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Ar as SKILLS_DIR, Vr as init_paths, f as loadConfigSync, ir as FsError, mr as init_errors, t as init_config_yaml, ur as ProcessSpawnError, vr as CACHE_AGENTS_DIR, yr as CACHE_RULES_DIR } from "./config-yaml-DvyMuOle.js";
+import { Ar as SKILLS_DIR, Vr as init_paths, f as loadConfigSync, ir as FsError, mr as init_errors, t as init_config_yaml, ur as ProcessSpawnError, vr as CACHE_AGENTS_DIR, yr as CACHE_RULES_DIR } from "./config-yaml-DySPNmKN.js";
 import { a as PAN_DIRNAME, c as PAN_SESSIONS_FILENAME, i as PAN_CONTINUE_FILENAME, n as PAN_CONTEXT_FILENAME, s as PAN_FEEDBACK_DIRNAME } from "./types-hraoaQIp.js";
-import { t as init_pan_dir } from "./pan-dir-DeVUgwA7.js";
-import { n as init_workspace_config, r as replacePlaceholdersSync, t as getDefaultWorkspaceConfigSync } from "./workspace-config-cEGcO6UT.js";
-import { n as init_tunnel, r as removeTunnelIngress, t as addTunnelIngress } from "./tunnel-B2vxjx_b.js";
-import { i as init_hume, n as createHumeConfig, r as deleteHumeConfig } from "./hume-BEq0bUDg.js";
-import { a as renderDevcontainerSync, i as processTemplatesSync, n as createWorkspacePlaceholdersSync, o as sanitizeComposeFileSync, r as init_devcontainer_renderer, t as DEVCONTAINER_DIRNAME } from "./devcontainer-renderer-CtUgrVKW.js";
-import { n as init_docker, r as stopWorkspaceDockerPromise, t as getContainersReferencingWorkspacePathPromise } from "./docker-BK7HIcBj.js";
+import { t as init_pan_dir } from "./pan-dir-B0c3w0Ya.js";
+import { n as init_workspace_config, r as replacePlaceholdersSync, t as getDefaultWorkspaceConfigSync } from "./workspace-config-CIVWZOQr.js";
+import { n as init_tunnel, r as removeTunnelIngress, t as addTunnelIngress } from "./tunnel-CDVKJpRv.js";
+import { i as init_hume, n as createHumeConfig, r as deleteHumeConfig } from "./hume-Cz8igP9E.js";
+import { a as renderDevcontainerSync, i as processTemplatesSync, n as createWorkspacePlaceholdersSync, o as sanitizeComposeFileSync, r as init_devcontainer_renderer, t as DEVCONTAINER_DIRNAME } from "./devcontainer-renderer-_d6XhyND.js";
+import { n as init_docker, r as stopWorkspaceDockerPromise, t as getContainersReferencingWorkspacePathPromise } from "./docker-DcMTFTUC.js";
 import { Effect } from "effect";
-import { copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "fs";
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "fs";
 import { basename, dirname, extname, join, relative, resolve } from "path";
 import { homedir, platform } from "os";
 import { createHash } from "crypto";
@@ -587,6 +587,37 @@ function relocateVenvScripts(sourceVenv, destVenv) {
 		} catch {}
 	}
 }
+/** Install the agent-only rebase guard in Git's configured hooks directory. */
+async function installPreRebaseHook(targetPath) {
+	const { stdout } = await execAsync$2("git rev-parse --git-path hooks", {
+		cwd: targetPath,
+		encoding: "utf-8"
+	});
+	const hooksDir = resolve(targetPath, stdout.trim());
+	const hookPath = join(hooksDir, "pre-rebase");
+	mkdirSync(hooksDir, { recursive: true });
+	const originalHookPath = `${hookPath}${PRE_REBASE_ORIGINAL_SUFFIX}`;
+	const existingHook = existsSync(hookPath) ? readFileSync(hookPath, "utf-8") : "";
+	if (!existingHook.includes(PRE_REBASE_HOOK_MARKER)) {
+		if (existingHook) {
+			rmSync(originalHookPath, { force: true });
+			renameSync(hookPath, originalHookPath);
+		}
+		writeFileSync(hookPath, [
+			PRE_REBASE_HOOK_PREFIX,
+			`if [ -x "\${0}${PRE_REBASE_ORIGINAL_SUFFIX}" ]; then`,
+			`  exec "\${0}${PRE_REBASE_ORIGINAL_SUFFIX}" "$@"`,
+			"fi",
+			"exit 0",
+			""
+		].join("\n"), {
+			encoding: "utf-8",
+			mode: 493
+		});
+	}
+	chmodSync(hookPath, 493);
+	return hookPath;
+}
 /**
 * Create a git worktree
 * @param repoPath Path to the source git repository
@@ -604,6 +635,7 @@ async function createWorktree(repoPath, targetPath, branchName, defaultBranch =
 		const remoteList = remoteBranches.split("\n").map((b) => b.trim()).filter(Boolean);
 		if (localList.includes(branchName) || remoteList.includes(`origin/${branchName}`)) await execAsync$2(`git worktree add "${targetPath}" "${branchName}"`, { cwd: repoPath });
 		else await execAsync$2(`git worktree add "${targetPath}" -b "${branchName}" "${defaultBranch}"`, { cwd: repoPath });
+		await installPreRebaseHook(targetPath);
 		await execAsync$2("git restore .", { cwd: targetPath }).catch(() => {});
 		return {
 			success: true,
@@ -778,11 +810,23 @@ function preTrustDirectorySync(dirPath) {
 	}
 	if (dirty) writeFileSync(claudeJsonPath, JSON.stringify(data, null, 2), "utf8");
 }
-var execAsync$2, TEXT_EXTENSIONS;
+var execAsync$2, PRE_REBASE_HOOK_MARKER, PRE_REBASE_ORIGINAL_SUFFIX, PRE_REBASE_HOOK_PREFIX, TEXT_EXTENSIONS;
 var init_worktree_ops = __esmMin((() => {
 	init_workspace_config();
 	init_types();
 	execAsync$2 = promisify(exec);
+	PRE_REBASE_HOOK_MARKER = "# OVERDECK MANAGED PRE-REBASE GUARD";
+	PRE_REBASE_ORIGINAL_SUFFIX = ".overdeck-original";
+	PRE_REBASE_HOOK_PREFIX = [
+		"#!/bin/sh",
+		PRE_REBASE_HOOK_MARKER,
+		"if [ \"$OVERDECK_PAN_GIT_OP\" != \"1\" ] && [ -n \"$OVERDECK_AGENT_ID\" ]; then",
+		"  echo \"Overdeck agents must not run git rebase directly.\" >&2",
+		"  echo \"Use pan sync-main <ISSUE-ID> to sync main or pan done <ISSUE-ID> to submit.\" >&2",
+		"  exit 1",
+		"fi",
+		""
+	].join("\n");
 	TEXT_EXTENSIONS = new Set([
 		".md",
 		".sh",
@@ -1021,6 +1065,13 @@ async function createWorkspacePromise(options) {
 		progress("Installing dependencies", "Failed — workspace creation aborted", "complete");
 		return result;
 	}
+	const hookTargets = workspaceConfig.type === "polyrepo" && workspaceConfig.repos ? workspaceConfig.repos.filter((repo) => repo.link_type !== "symlink").map((repo) => join(workspacePath, repo.name)).filter((path) => existsSync(join(path, ".git"))) : [workspacePath];
+	try {
+		for (const hookTarget of hookTargets) await installPreRebaseHook(hookTarget);
+	} catch (hookErr) {
+		result.errors.push(`Pre-rebase guard install failed: ${hookErr.message?.slice(0, 200)}`);
+		return result;
+	}
 	const workspacePackages = projectConfig.workspace_packages;
 	if (workspacePackages && workspacePackages.length > 0) {
 		progress("Building workspace packages", workspacePackages.map((p) => p.path).join(", "));
@@ -1068,7 +1119,7 @@ async function createWorkspacePromise(options) {
 				await execAsync$1(`cp -r "${mainTldrDir}" "${workspaceTldrDir}"`);
 				result.steps.push("Copied TLDR index from main branch");
 			}
-			const { getTldrDaemonServiceSync } = await import("./tldr-daemon-DL566HbH.js");
+			const { getTldrDaemonServiceSync } = await import("./tldr-daemon-BYFkts95.js");
 			const tldrService = getTldrDaemonServiceSync(workspacePath, venvPath);
 			await tldrService.start(true);
 			result.steps.push("Started TLDR daemon");
@@ -1189,7 +1240,7 @@ async function createWorkspacePromise(options) {
 		result.steps.push("Pre-trusted workspace in Claude Code");
 	} catch {}
 	try {
-		const { determineCavemanVariant, injectCavemanSettings } = await import("./workspace-DuUdndHe.js");
+		const { determineCavemanVariant, injectCavemanSettings } = await import("./workspace--8tnhDI0.js");
 		const cavemanConfig = loadConfigSync().config.caveman;
 		const variant = determineCavemanVariant(cavemanConfig);
 		await Effect.runPromise(injectCavemanSettings(workspacePath, variant));
@@ -1205,7 +1256,7 @@ async function createWorkspacePromise(options) {
 		result.steps.push(`Overdeck settings copy skipped: ${settingsErr instanceof Error ? settingsErr.message : String(settingsErr)}`);
 	}
 	try {
-		const { injectMemoryHookSettings } = await import("./workspace-DuUdndHe.js");
+		const { injectMemoryHookSettings } = await import("./workspace--8tnhDI0.js");
 		await injectMemoryHookSettings(workspacePath);
 		result.steps.push("Injected memory hooks into .claude/settings.json");
 	} catch (memoryHookErr) {
@@ -1257,7 +1308,7 @@ async function removeWorkspacePromise(options) {
 	}
 	const venvPath = join(workspacePath, ".venv");
 	if (existsSync(venvPath)) try {
-		const { getTldrDaemonServiceSync } = await import("./tldr-daemon-DL566HbH.js");
+		const { getTldrDaemonServiceSync } = await import("./tldr-daemon-BYFkts95.js");
 		await getTldrDaemonServiceSync(workspacePath, venvPath).stop();
 		result.steps.push("Stopped TLDR daemon");
 	} catch (error) {
@@ -1377,6 +1428,6 @@ var init_workspace_manager = __esmMin((() => {
 	});
 }));
 //#endregion
-export { removeWorkspace as a, relocateVenvScripts as c, copyOverdeckSettingsToWorkspaceSync as d, ensurePanGitignoreSync as f, preTrustDirectory as i, detectPlatform as l, getContainersReferencingWorkspacePath as n, stopWorkspaceDocker as o, init_workspace_manager as r, preTrustDirectorySync as s, createWorkspace as t, init_platform as u };
+export { removeWorkspace as a, preTrustDirectorySync as c, init_platform as d, copyOverdeckSettingsToWorkspaceSync as f, preTrustDirectory as i, relocateVenvScripts as l, getContainersReferencingWorkspacePath as n, stopWorkspaceDocker as o, ensurePanGitignoreSync as p, init_workspace_manager as r, installPreRebaseHook as s, createWorkspace as t, detectPlatform as u };
 
-//# sourceMappingURL=workspace-manager-hLUv3ADC.js.map
+//# sourceMappingURL=workspace-manager-CBhNdzE4.js.map

package/server/workspace-manager-CWT55qeI.js

@@ -0,0 +1,3 @@
+import { a as removeWorkspace, c as preTrustDirectorySync, f as copyOverdeckSettingsToWorkspaceSync, i as preTrustDirectory, o as stopWorkspaceDocker, r as init_workspace_manager, t as createWorkspace } from "./workspace-manager-CBhNdzE4.js";
+init_workspace_manager();
+export { copyOverdeckSettingsToWorkspaceSync, createWorkspace, preTrustDirectory, preTrustDirectorySync, removeWorkspace, stopWorkspaceDocker };

package/server/{workspace-metadata-DNpMixRq.js → workspace-metadata-BzHnwwX4.js}

@@ -1,2 +1,2 @@
-import { n as deleteWorkspaceMetadataSync } from "./workspace-metadata-CskwzzhL.js";
+import { n as deleteWorkspaceMetadataSync } from "./workspace-metadata-_WygnyoX.js";
 export { deleteWorkspaceMetadataSync };

package/server/{workspace-metadata-CskwzzhL.js → workspace-metadata-_WygnyoX.js}

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM } from "./rolldown-runtime-DNCzzKnI.js";
-import { er as require_dist, mr as init_errors } from "./config-yaml-DvyMuOle.js";
+import { er as require_dist, mr as init_errors } from "./config-yaml-DySPNmKN.js";
 import "effect";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "fs";
 import { join } from "path";
@@ -70,4 +70,4 @@ function deleteWorkspaceMetadataSync(issueId) {
 //#endregion
 export { loadWorkspaceMetadataSync as a, listWorkspaceMetadataSync as i, deleteWorkspaceMetadataSync as n, saveWorkspaceMetadataSync as o, findRemoteWorkspaceMetadataSync as r, WORKSPACES_DIR as t };
 
-//# sourceMappingURL=workspace-metadata-CskwzzhL.js.map
+//# sourceMappingURL=workspace-metadata-_WygnyoX.js.map