@overdeck/desktop 0.45.23 → 0.46.0

package/server/forge-CZbSg6Ds.js

@@ -0,0 +1,383 @@
+import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
+import { S as parsePullRequestRef, d as getPullRequestState, f as init_github_app, p as isGitHubAppConfigured, v as listPullRequestsForHead, x as mergePullRequestWithApp } from "./github-app-CQ1Lo6LA.js";
+import { join } from "node:path";
+import { Data, Effect } from "effect";
+import { tmpdir } from "node:os";
+import { unlink, writeFile } from "node:fs/promises";
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+//#region ../../lib/forge.ts
+/**
+* Parse a review-artifact URL into its forge type and numeric identifier.
+* Detection is by path pattern (not host) so self-hosted GitLab is supported.
+* Returns `null` for unrecognised input.
+*/
+function parseArtifactRef(url) {
+	if (!url) return null;
+	const gitlabMatch = url.match(/\/-\/merge_requests\/(\d+)(?:$|[/?#])/);
+	if (gitlabMatch) return {
+		forge: "gitlab",
+		number: Number.parseInt(gitlabMatch[1], 10)
+	};
+	const githubMatch = url.match(/\/pull\/(\d+)(?:$|[/?#])/);
+	if (githubMatch) return {
+		forge: "github",
+		number: Number.parseInt(githubMatch[1], 10)
+	};
+	return null;
+}
+async function withBodyFile(body, prefix, fn) {
+	if (!body) return fn(void 0);
+	const bodyFile = join(tmpdir(), `${prefix}-${Date.now()}.md`);
+	await writeFile(bodyFile, body, "utf-8");
+	try {
+		return await fn(bodyFile);
+	} finally {
+		await unlink(bodyFile).catch(() => {});
+	}
+}
+function buildRepositoryFlag(repository) {
+	return repository ? ` --repo ${repository}` : "";
+}
+function buildGitHubReviewTarget(input) {
+	return input.url || input.id || "";
+}
+function buildGitLabReviewTarget(input) {
+	return input.id || input.url || "";
+}
+function parseRepository(repository) {
+	const [owner, repo] = (repository ?? "").split("/");
+	return owner && repo ? {
+		owner,
+		repo
+	} : null;
+}
+async function getExistingGitHubArtifact(branchName, cwd, repository) {
+	const parsedRepo = parseRepository(repository);
+	if (isGitHubAppConfigured() && parsedRepo) {
+		const pr = (await Effect.runPromise(listPullRequestsForHead(parsedRepo.owner, parsedRepo.repo, branchName, "all")))[0];
+		if (!pr) return null;
+		return {
+			forge: "github",
+			created: false,
+			url: pr.url ?? `https://github.com/${parsedRepo.owner}/${parsedRepo.repo}/pull/${pr.number}`,
+			id: String(pr.number)
+		};
+	}
+	const { stdout } = await execAsync(`gh pr view ${branchName}${buildRepositoryFlag(repository)} --json url,number 2>/dev/null || true`, {
+		cwd,
+		encoding: "utf-8"
+	});
+	const trimmed = stdout.trim();
+	if (!trimmed) return null;
+	const parsed = JSON.parse(trimmed);
+	return {
+		forge: "github",
+		created: false,
+		url: parsed.url,
+		id: parsed.number ? String(parsed.number) : void 0
+	};
+}
+async function getExistingGitLabArtifact(branchName, cwd, repository) {
+	const { stdout } = await execAsync(`glab mr list --source-branch ${branchName}${buildRepositoryFlag(repository)} --output json 2>/dev/null || true`, {
+		cwd,
+		encoding: "utf-8"
+	});
+	const trimmed = stdout.trim();
+	if (!trimmed) return null;
+	const existing = JSON.parse(trimmed)[0];
+	if (!existing) return null;
+	return {
+		forge: "gitlab",
+		created: false,
+		url: existing.web_url,
+		id: existing.iid ? String(existing.iid) : void 0
+	};
+}
+function matchesCurrentArtifact(input, artifact) {
+	return artifact.sourceBranch === void 0 || artifact.sourceBranch === input.sourceBranch ? (input.targetBranch === void 0 || artifact.targetBranch === input.targetBranch) && (input.headSha === void 0 || artifact.headSha === input.headSha) : false;
+}
+async function findMergedGitHubArtifact(input) {
+	const parsedRepo = parseRepository(input.repository);
+	const parsedId = input.artifactId ? Number.parseInt(input.artifactId, 10) : NaN;
+	const parsedUrl = parseArtifactRef(input.artifactUrl);
+	const exactNumber = Number.isFinite(parsedId) ? parsedId : parsedUrl?.forge === "github" ? parsedUrl.number : void 0;
+	if (isGitHubAppConfigured() && parsedRepo) {
+		if (Number.isFinite(exactNumber)) {
+			const state = await Effect.runPromise(getPullRequestState(parsedRepo.owner, parsedRepo.repo, exactNumber));
+			if (!state.merged || !matchesCurrentArtifact(input, {
+				sourceBranch: input.sourceBranch,
+				targetBranch: state.baseBranch,
+				headSha: state.headSha
+			})) return null;
+			return {
+				forge: "github",
+				created: false,
+				url: state.url ?? input.artifactUrl,
+				id: String(state.number)
+			};
+		}
+		const prs = await Effect.runPromise(listPullRequestsForHead(parsedRepo.owner, parsedRepo.repo, input.sourceBranch, "all"));
+		for (const pr of prs.filter((candidate) => candidate.merged === true || candidate.mergedAt != null)) {
+			if (input.targetBranch === void 0 && input.headSha === void 0) return {
+				forge: "github",
+				created: false,
+				url: pr.url ?? `https://github.com/${parsedRepo.owner}/${parsedRepo.repo}/pull/${pr.number}`,
+				id: String(pr.number)
+			};
+			const state = await Effect.runPromise(getPullRequestState(parsedRepo.owner, parsedRepo.repo, pr.number));
+			if (state.merged && matchesCurrentArtifact(input, {
+				sourceBranch: input.sourceBranch,
+				targetBranch: state.baseBranch,
+				headSha: state.headSha
+			})) return {
+				forge: "github",
+				created: false,
+				url: state.url ?? pr.url,
+				id: String(pr.number)
+			};
+		}
+		return null;
+	}
+	if (Number.isFinite(exactNumber)) {
+		const { stdout } = await execAsync(`gh pr view ${input.artifactUrl || input.artifactId}${buildRepositoryFlag(input.repository)} --json url,number,state,mergedAt,headRefOid,baseRefName,headRefName`, {
+			cwd: input.cwd,
+			encoding: "utf-8",
+			timeout: FORGE_OBSERVATION_TIMEOUT_MS
+		});
+		const pr = JSON.parse(stdout.trim());
+		if (!pr.mergedAt || !matchesCurrentArtifact(input, {
+			sourceBranch: pr.headRefName,
+			targetBranch: pr.baseRefName,
+			headSha: pr.headRefOid
+		})) return null;
+		return {
+			forge: "github",
+			created: false,
+			url: pr.url,
+			id: pr.number ? String(pr.number) : input.artifactId
+		};
+	}
+	const { stdout } = await execAsync(`gh pr list --state merged --head ${input.sourceBranch}${buildRepositoryFlag(input.repository)} --json url,number,mergedAt,headRefOid,baseRefName,headRefName`, {
+		cwd: input.cwd,
+		encoding: "utf-8",
+		timeout: FORGE_OBSERVATION_TIMEOUT_MS
+	});
+	const merged = JSON.parse(stdout.trim() || "[]").find((pr) => pr.mergedAt && matchesCurrentArtifact(input, {
+		sourceBranch: pr.headRefName,
+		targetBranch: pr.baseRefName,
+		headSha: pr.headRefOid
+	}));
+	return merged ? {
+		forge: "github",
+		created: false,
+		url: merged.url,
+		id: merged.number ? String(merged.number) : void 0
+	} : null;
+}
+async function findMergedGitLabArtifact(input) {
+	const parsedId = input.artifactId ? Number.parseInt(input.artifactId, 10) : NaN;
+	const parsedUrl = parseArtifactRef(input.artifactUrl);
+	const target = Number.isFinite(parsedId) ? String(parsedId) : parsedUrl?.forge === "gitlab" ? String(parsedUrl.number) : void 0;
+	const { stdout } = await execAsync(target ? `glab mr view ${target}${buildRepositoryFlag(input.repository)} --output json` : `glab mr list --source-branch ${input.sourceBranch}${buildRepositoryFlag(input.repository)} --all --output json`, {
+		cwd: input.cwd,
+		encoding: "utf-8",
+		timeout: FORGE_OBSERVATION_TIMEOUT_MS
+	});
+	const merged = (target ? [JSON.parse(stdout.trim())] : JSON.parse(stdout.trim() || "[]")).find((artifact) => artifact.state === "merged" && matchesCurrentArtifact(input, {
+		sourceBranch: artifact.source_branch,
+		targetBranch: artifact.target_branch,
+		headSha: artifact.sha
+	}));
+	return merged ? {
+		forge: "gitlab",
+		created: false,
+		url: merged.web_url,
+		id: merged.iid ? String(merged.iid) : input.artifactId
+	} : null;
+}
+function delay(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function isTransientGitHubMergeState(state) {
+	if (state.merged) return false;
+	if (state.draft) return false;
+	if (state.checksFailed) return false;
+	if (state.checksPending) return true;
+	if (state.mergeable === null) return true;
+	return [
+		"unknown",
+		"blocked",
+		"behind",
+		"unstable",
+		"has_hooks"
+	].includes(state.mergeableState || "");
+}
+function getForgeAdapter(forge) {
+	return forge === "gitlab" ? gitlabForgeAdapter : githubForgeAdapter;
+}
+var execAsync, GITHUB_MERGE_POLL_INTERVAL_MS, FORGE_OBSERVATION_TIMEOUT_MS, GITHUB_MERGE_TIMEOUT_MS, githubForgeAdapter, gitlabForgeAdapter;
+var init_forge = __esmMin((() => {
+	init_github_app();
+	Data.TaggedError("ForgeError");
+	execAsync = promisify(exec);
+	GITHUB_MERGE_POLL_INTERVAL_MS = 5e3;
+	FORGE_OBSERVATION_TIMEOUT_MS = 3e4;
+	GITHUB_MERGE_TIMEOUT_MS = 900 * 1e3;
+	githubForgeAdapter = {
+		forge: "github",
+		async createReviewArtifact(input) {
+			const existing = await getExistingGitHubArtifact(input.sourceBranch, input.cwd, input.repository);
+			if (existing) return existing;
+			return withBodyFile(input.body, "pan-gh-pr-body", async (bodyFile) => {
+				const bodyFlag = bodyFile ? ` --body-file "${bodyFile}"` : "";
+				const { stdout } = await execAsync(`gh pr create --head ${input.sourceBranch} --base ${input.targetBranch} --title "${input.title}"${bodyFlag}${buildRepositoryFlag(input.repository)}`, {
+					cwd: input.cwd,
+					encoding: "utf-8"
+				});
+				return {
+					forge: "github",
+					created: true,
+					url: stdout.trim().split("\n").pop()?.trim() || stdout.trim(),
+					id: (await getExistingGitHubArtifact(input.sourceBranch, input.cwd, input.repository))?.id
+				};
+			});
+		},
+		async mergeReviewArtifact(input) {
+			const target = buildGitHubReviewTarget(input);
+			const method = input.method || "squash";
+			console.log(`[forge] mergeReviewArtifact: ${input.forge} ${target} method=${method} repo=${input.repository ?? "default"}`);
+			if (!isGitHubAppConfigured()) try {
+				console.log(`[forge] gh pr merge: executing ${method} merge for ${target}`);
+				await execAsync(`gh pr merge ${target}${buildRepositoryFlag(input.repository)} --${method}`, {
+					cwd: input.cwd,
+					encoding: "utf-8"
+				});
+				console.log(`[forge] gh pr merge: completed successfully for ${target}`);
+				return;
+			} catch (err) {
+				console.error(`[forge] gh pr merge: failed for ${target}: exitCode=${err.code} message=${err.message}`);
+				throw err;
+			}
+			const ref = parsePullRequestRef(input);
+			const deadline = Date.now() + GITHUB_MERGE_TIMEOUT_MS;
+			console.log(`[forge] mergeReviewArtifact: GitHub App path for ${ref.owner}/${ref.repo}#${ref.number}, timeout=${GITHUB_MERGE_TIMEOUT_MS}ms`);
+			while (Date.now() < deadline) {
+				const state = await Effect.runPromise(getPullRequestState(ref.owner, ref.repo, ref.number));
+				console.log(`[forge] mergeReviewArtifact: PR #${ref.number} state=${state.state} merged=${state.merged} draft=${state.draft} checksFailed=${state.checksFailed}`);
+				if (state.merged) return;
+				if (state.state !== "OPEN") throw new Error(`GitHub PR #${ref.number} is closed but not merged`);
+				if (state.draft) throw new Error(`GitHub PR #${ref.number} is still marked as draft`);
+				if (state.checksFailed) throw new Error(`GitHub PR #${ref.number} has failing required checks`);
+				if (isTransientGitHubMergeState(state)) {
+					await delay(GITHUB_MERGE_POLL_INTERVAL_MS);
+					continue;
+				}
+				try {
+					const mergeResult = await Effect.runPromise(mergePullRequestWithApp(ref.owner, ref.repo, ref.number, method, state.headSha || void 0));
+					console.log(`[forge] mergePullRequestWithApp: result merged=${mergeResult.merged} for ${ref.owner}/${ref.repo}#${ref.number}`);
+					if (mergeResult.merged) return;
+				} catch (err) {
+					const message = String(err?.message || err);
+					console.error(`[forge] mergePullRequestWithApp: threw for ${ref.number}: ${message}`);
+					if (message.includes("405") || message.includes("409") || message.includes("422") || message.includes("not mergeable") || message.includes("Base branch was modified") || message.includes("required status check") || message.includes("Head branch was modified")) {
+						await delay(GITHUB_MERGE_POLL_INTERVAL_MS);
+						continue;
+					}
+					throw err;
+				}
+			}
+			throw new Error(`Timed out waiting for GitHub PR #${ref.number} to become mergeable`);
+		},
+		async commentOnArtifact(input) {
+			const target = buildGitHubReviewTarget(input);
+			await withBodyFile(input.body, "pan-gh-pr-comment", async (bodyFile) => {
+				const bodyFlag = bodyFile ? ` --body-file "${bodyFile}"` : ` --body "${input.body.replace(/"/g, "\\\"")}"`;
+				await execAsync(`gh pr comment ${target}${buildRepositoryFlag(input.repository)}${bodyFlag}`, {
+					cwd: input.cwd,
+					encoding: "utf-8"
+				});
+			});
+		},
+		async approveReviewArtifact(input) {
+			await execAsync(`gh pr review ${buildGitHubReviewTarget(input)} --approve${buildRepositoryFlag(input.repository)}`, {
+				cwd: input.cwd,
+				encoding: "utf-8"
+			});
+		},
+		async discoverArtifact(input) {
+			return getExistingGitHubArtifact(input.sourceBranch, input.cwd, input.repository);
+		},
+		async findMergedArtifact(input) {
+			return findMergedGitHubArtifact(input);
+		}
+	};
+	gitlabForgeAdapter = {
+		forge: "gitlab",
+		async createReviewArtifact(input) {
+			const existing = await getExistingGitLabArtifact(input.sourceBranch, input.cwd, input.repository);
+			if (existing) return existing;
+			const bodyEnv = input.body ? { PAN_MR_BODY: input.body } : {};
+			const bodyFlag = input.body ? " --description \"$PAN_MR_BODY\"" : "";
+			let stdout;
+			try {
+				({stdout} = await execAsync(`glab mr create --source-branch ${input.sourceBranch} --target-branch ${input.targetBranch} --title "${input.title}"${bodyFlag}${buildRepositoryFlag(input.repository)}`, {
+					cwd: input.cwd,
+					encoding: "utf-8",
+					env: {
+						...process.env,
+						...bodyEnv
+					},
+					shell: "/bin/bash"
+				}));
+			} catch (error) {
+				const message = String(error?.message ?? error);
+				if (message.includes("409") && message.includes("open merge request already exists")) {
+					const existingAfterConflict = await getExistingGitLabArtifact(input.sourceBranch, input.cwd, input.repository);
+					if (existingAfterConflict) return existingAfterConflict;
+				}
+				throw error;
+			}
+			return {
+				forge: "gitlab",
+				created: true,
+				url: stdout.trim().split("\n").pop()?.trim() || stdout.trim(),
+				id: (await getExistingGitLabArtifact(input.sourceBranch, input.cwd, input.repository))?.id
+			};
+		},
+		async mergeReviewArtifact(input) {
+			const target = buildGitLabReviewTarget(input);
+			const squashFlag = input.method === "squash" || !input.method ? " --squash" : "";
+			await execAsync(`glab mr merge ${target}${buildRepositoryFlag(input.repository)}${squashFlag}`, {
+				cwd: input.cwd,
+				encoding: "utf-8"
+			});
+		},
+		async commentOnArtifact(input) {
+			const target = buildGitLabReviewTarget(input);
+			await withBodyFile(input.body, "pan-gl-mr-comment", async (bodyFile) => {
+				const bodyFlag = bodyFile ? ` --message-file "${bodyFile}"` : ` --message "${input.body.replace(/"/g, "\\\"")}"`;
+				await execAsync(`glab mr note ${target}${buildRepositoryFlag(input.repository)}${bodyFlag}`, {
+					cwd: input.cwd,
+					encoding: "utf-8"
+				});
+			});
+		},
+		async approveReviewArtifact(input) {
+			await execAsync(`glab mr approve ${buildGitLabReviewTarget(input)}${buildRepositoryFlag(input.repository)}`, {
+				cwd: input.cwd,
+				encoding: "utf-8"
+			});
+		},
+		async discoverArtifact(input) {
+			return getExistingGitLabArtifact(input.sourceBranch, input.cwd, input.repository);
+		},
+		async findMergedArtifact(input) {
+			return findMergedGitLabArtifact(input);
+		}
+	};
+}));
+//#endregion
+export { parseArtifactRef as i, getForgeAdapter as n, init_forge as r, GITHUB_MERGE_TIMEOUT_MS as t };
+
+//# sourceMappingURL=forge-CZbSg6Ds.js.map

package/server/forge-DK3blQb_.js

@@ -0,0 +1,3 @@
+import { n as getForgeAdapter, r as init_forge } from "./forge-CZbSg6Ds.js";
+init_forge();
+export { getForgeAdapter };

package/server/{from-CJ_aH5jD.js → from-D_4_dk7i.js}

@@ -3841,4 +3841,4 @@ var init_from = __esmMin((() => {
 //#endregion
 export { File as a, init_esm_min as i, FormData as n, Blob as o, formDataToBlob as r, init_fetch_blob as s, init_from as t };
 
-//# sourceMappingURL=from-CJ_aH5jD.js.map
+//# sourceMappingURL=from-D_4_dk7i.js.map

package/server/{fts-db-CKgg0VKg.js → fts-db-BeOomFa-.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { a as runMemoryFtsTransactionSync, i as runMemoryFtsStatementSync, n as getMemoryFtsDatabaseSync, r as init_fts_operations, t as closeMemoryFtsDatabasesInProcess } from "./fts-operations-BrL_VTRr.js";
+import { a as runMemoryFtsTransactionSync, i as runMemoryFtsStatementSync, n as getMemoryFtsDatabaseSync, r as init_fts_operations, t as closeMemoryFtsDatabasesInProcess } from "./fts-operations-BdewJ_g9.js";
 import { Worker } from "node:worker_threads";
 //#region ../../lib/memory/fts-db.ts
 async function getMemoryFtsDatabase(projectId) {
@@ -143,4 +143,4 @@ var init_fts_db = __esmMin((() => {
 //#endregion
 export { withMemoryFtsDatabase as a, runMemoryFtsTransaction as i, init_fts_db as n, runMemoryFtsStatement as r, closeMemoryFtsDatabases as t };
 
-//# sourceMappingURL=fts-db-CKgg0VKg.js.map
+//# sourceMappingURL=fts-db-BeOomFa-.js.map

package/server/{fts-operations-BrL_VTRr.js → fts-operations-BdewJ_g9.js}

@@ -1,6 +1,6 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
 import { n as openDatabase, t as init_driver } from "./driver-CKVGi51s.js";
-import { i as init_paths, o as resolveFtsDbPath } from "./paths-_zEts6wc.js";
+import { i as init_paths, o as resolveFtsDbPath } from "./paths-cXmOwSbh.js";
 import { dirname } from "node:path";
 import { mkdirSync } from "node:fs";
 //#region ../../lib/memory/fts-operations.ts
@@ -131,4 +131,4 @@ var init_fts_operations = __esmMin((() => {
 //#endregion
 export { runMemoryFtsTransactionSync as a, runMemoryFtsStatementSync as i, getMemoryFtsDatabaseSync as n, init_fts_operations as r, closeMemoryFtsDatabasesInProcess as t };
 
-//# sourceMappingURL=fts-operations-BrL_VTRr.js.map
+//# sourceMappingURL=fts-operations-BdewJ_g9.js.map

package/server/git-utils-CI6cwyyC.js

@@ -0,0 +1,3 @@
+import { a as init_git_utils, c as rehydrateHeadAnchor, i as hasStaleLocks, l as renderWorkspaceGitShowPromise, n as formatAnchorShort, o as parseCompositeSnapshot, r as getWorkspaceGitInfo, s as parseWorkspaceHeadAnchor, t as cleanupStaleLocks, u as snapshotWorkspaceHeadsPromise } from "./git-utils-ameCgDdy.js";
+init_git_utils();
+export { cleanupStaleLocks, formatAnchorShort, getWorkspaceGitInfo, hasStaleLocks, parseCompositeSnapshot, parseWorkspaceHeadAnchor, rehydrateHeadAnchor, renderWorkspaceGitShowPromise, snapshotWorkspaceHeadsPromise };

package/server/{git-utils-BVa07a4a.js → git-utils-ameCgDdy.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { ar as GitError, ir as FsError, mr as init_errors } from "./config-yaml-DvyMuOle.js";
+import { Er as GitError, Fr as init_errors, Tr as FsError } from "./config-yaml-CmOPzmBb.js";
 import { Effect } from "effect";
 import { existsSync, readdirSync, unlinkSync } from "fs";
 import { join } from "path";
@@ -142,6 +142,43 @@ async function cleanupStaleLocksPromise(repoPath, options) {
 	}
 	return result;
 }
+/**
+* Parse a polyrepo head anchor such as `fe@<sha> api@<sha>`.
+* Plain single-repo refs return null. Malformed composite anchors fail before
+* any caller can accidentally pass the whitespace-containing value to git.
+*/
+function parseWorkspaceHeadAnchor(anchor) {
+	const normalized = anchor.trim();
+	if (!normalized.includes("@")) {
+		if (/\s/.test(normalized)) throw new Error(`Invalid workspace head anchor: ${anchor}`);
+		return null;
+	}
+	return normalized.split(/\s+/).map((token) => {
+		const match = /^([^@\s]+)@([0-9a-fA-F]{40,64})$/.exec(token);
+		if (!match) throw new Error(`Invalid workspace head anchor token '${token}' in '${anchor}'`);
+		return {
+			repoKey: match[1],
+			sha: match[2]
+		};
+	});
+}
+/**
+* Render `git show` for a single-repo ref or every entry in a polyrepo anchor.
+* Composite entries are resolved to their nested worktree and labeled using
+* the same repo-section convention as review and inspect diff summaries.
+*/
+async function renderWorkspaceGitShowPromise(issueId, workspacePath, anchor, args, gitShow) {
+	const entries = parseWorkspaceHeadAnchor(anchor);
+	if (!entries) return gitShow(workspacePath, anchor.trim(), args);
+	if (!issueId) throw new Error(`Cannot resolve composite workspace head anchor '${anchor}' without an issue id`);
+	const { resolveWorkspaceRepoRootsSync } = await import("./project-repos-CRE6Ykow.js");
+	const rootsByKey = new Map(resolveWorkspaceRepoRootsSync(issueId, workspacePath).map((root) => [root.repoKey, root]));
+	return (await Promise.all(entries.map(async ({ repoKey, sha }) => {
+		const root = rootsByKey.get(repoKey);
+		if (!root) throw new Error(`Composite workspace head anchor repo '${repoKey}' was not found in ${workspacePath}`);
+		return `── ${repoKey} ──\n${(await gitShow(root.dir, sha, args)).trimEnd()}`;
+	}))).join("\n");
+}
 async function getWorkspaceGitInfoPromise(workspacePath) {
 	try {
 		const [headResult, branchResult] = await Promise.all([execAsync("git rev-parse HEAD", { cwd: workspacePath }), execAsync("git rev-parse --abbrev-ref HEAD", { cwd: workspacePath })]);
@@ -154,6 +191,59 @@ async function getWorkspaceGitInfoPromise(workspacePath) {
 		throw new Error(`getWorkspaceGitInfo failed for ${workspacePath}: ${msg}`);
 	}
 }
+/** Rehydrate a persisted anchor after it crosses an unbranded storage boundary. */
+function rehydrateHeadAnchor(anchor) {
+	return anchor;
+}
+function parseCompositeSnapshot(snapshot) {
+	const heads = /* @__PURE__ */ new Map();
+	if (!snapshot) return heads;
+	for (const token of snapshot.split(/\s+/)) {
+		const separator = token.lastIndexOf("@");
+		if (separator <= 0 || separator === token.length - 1) continue;
+		heads.set(token.slice(0, separator), token.slice(separator + 1));
+	}
+	return heads;
+}
+function formatAnchorShort(anchor) {
+	return anchor.split(/\s+/).map((token) => {
+		const separator = token.lastIndexOf("@");
+		if (separator <= 0 || separator === token.length - 1) return token.substring(0, 8);
+		return `${token.slice(0, separator)}@${token.slice(separator + 1, separator + 9)}`;
+	}).join(" ");
+}
+/**
+* Snapshot the code HEAD(s) of a workspace for drift comparison (PAN-2948).
+*
+* Monorepo: returns the workspace HEAD SHA (unchanged behavior). Polyrepo:
+* returns a composite `fe@<sha> api@<sha>` over the sub-repo worktrees —
+* the wrapper repo at the workspace root is a one-commit artifacts repo whose
+* SHA never changes, so snapshotting it makes every drift comparison
+* (reviewedAtCommit vs lastVerifiedCommit, reviewer verdict anchors) report
+* "no drift" forever. Composite snapshots compare equal iff every sub-repo
+* head is unchanged; consumers that try to use the anchor as a git ref fail
+* the ref lookup and fall back to their conservative full-rerun path.
+*
+* Its branded return value is the only legitimate source for reviewedAtCommit,
+* lastVerifiedCommit, and roleRunHead. Persisted values regain that brand only
+* through rehydrateHeadAnchor at an explicitly documented storage boundary.
+*/
+async function snapshotWorkspaceHeadsPromise(issueId, workspacePath) {
+	const { resolveWorkspaceRepoRootsSync } = await import("./project-repos-CRE6Ykow.js");
+	const roots = resolveWorkspaceRepoRootsSync(issueId, workspacePath);
+	const isPolyrepo = roots.some((root) => root.isPolyrepo);
+	const heads = [];
+	for (const root of roots) try {
+		const { stdout } = await execAsync("git rev-parse HEAD", {
+			cwd: root.dir,
+			encoding: "utf-8",
+			timeout: 1e4
+		});
+		const sha = stdout.trim();
+		if (sha) heads.push(isPolyrepo ? `${root.repoKey}@${sha}` : sha);
+	} catch {}
+	return heads.length > 0 ? heads.join(" ") : void 0;
+}
 async function hasStaleLocksPromise(repoPath) {
 	if (findGitLockFiles(repoPath).length === 0) return false;
 	return (await hasRunningGitProcesses(repoPath, {})).status === "idle";
@@ -193,6 +283,6 @@ var init_git_utils = __esmMin((() => {
 	hasStaleLocks = (repoPath) => Effect.promise(() => hasStaleLocksPromise(repoPath));
 }));
 //#endregion
-export { init_git_utils as i, getWorkspaceGitInfo as n, hasStaleLocks as r, cleanupStaleLocks as t };
+export { init_git_utils as a, rehydrateHeadAnchor as c, hasStaleLocks as i, renderWorkspaceGitShowPromise as l, formatAnchorShort as n, parseCompositeSnapshot as o, getWorkspaceGitInfo as r, parseWorkspaceHeadAnchor as s, cleanupStaleLocks as t, snapshotWorkspaceHeadsPromise as u };
 
-//# sourceMappingURL=git-utils-BVa07a4a.js.map
+//# sourceMappingURL=git-utils-ameCgDdy.js.map

package/server/{github-app-CMBdIFBQ.js → github-app-CQ1Lo6LA.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { ir as FsError, mr as init_errors, or as GitHubApiError, rr as ConfigError } from "./config-yaml-DvyMuOle.js";
+import { Dr as GitHubApiError, Fr as init_errors, Tr as FsError, wr as ConfigError } from "./config-yaml-CmOPzmBb.js";
 import { Effect } from "effect";
 import { existsSync, readFileSync } from "fs";
 import { join } from "path";
@@ -88,6 +88,16 @@ var init_concurrency = __esmMin((() => {
 	withConcurrencyLimit = (tasks, max) => Effect.all(tasks, { concurrency: max });
 }));
 //#endregion
+//#region ../../lib/advisory-checks.ts
+function isAdvisoryCheckName(name) {
+	const normalized = name?.trim().toLowerCase().replace(/[^a-z0-9]/g, "");
+	return normalized != null && [...ADVISORY_CHECK_NAMES].some((advisory) => normalized.startsWith(advisory));
+}
+var ADVISORY_CHECK_NAMES;
+var init_advisory_checks = __esmMin((() => {
+	ADVISORY_CHECK_NAMES = new Set(["coderabbit"]);
+}));
+//#endregion
 //#region ../../lib/github-app.ts
 /**
 * GitHub App Integration (PAN-536)
@@ -190,7 +200,7 @@ function generateJWT(appId, privateKey) {
 	})).toString("base64url");
 	const payload = Buffer.from(JSON.stringify({
 		iat: now - 60,
-		exp: now + 600,
+		exp: now + 540,
 		iss: appId
 	})).toString("base64url");
 	const signer = createSign("SHA256");
@@ -309,7 +319,7 @@ function parsePullRequestRef(input) {
 	throw new Error("GitHub PR reference requires either a PR URL or repository + numeric id");
 }
 function summarizeCiCheckRuns(runs) {
-	const checkRuns = runs.map((run) => ({
+	const checkRuns = runs.filter((run) => !isAdvisoryCheckName(run.name)).map((run) => ({
 		id: run.id,
 		name: run.name || "GitHub check run",
 		status: run.status || "unknown",
@@ -350,9 +360,9 @@ async function getCiCheckRunsStatePromise(owner, repo, sha) {
 }
 async function getCommitCheckState(owner, repo, sha) {
 	const [combinedStatus, checkRuns] = await Promise.all([githubApi(`/repos/${owner}/${repo}/commits/${sha}/status`), githubApi(`/repos/${owner}/${repo}/commits/${sha}/check-runs`)]);
-	const statusState = combinedStatus.state || "";
-	const pendingStatus = statusState === "pending";
-	const failedStatus = statusState === "failure" || statusState === "error";
+	const statuses = (combinedStatus.statuses ?? []).filter((status) => !isAdvisoryCheckName(status.context));
+	const pendingStatus = statuses.some((status) => status.state === "pending");
+	const failedStatus = statuses.some((status) => status.state === "failure" || status.state === "error");
 	const ciState = summarizeCiCheckRuns(checkRuns.check_runs || []);
 	return {
 		pending: pendingStatus || ciState.pendingRuns.length > 0,
@@ -593,6 +603,7 @@ var execAsync, execFileAsync, APP_DIR, apiCatch, generateInstallationToken, getP
 var init_github_app = __esmMin((() => {
 	init_errors();
 	init_concurrency();
+	init_advisory_checks();
 	execAsync = promisify(exec);
 	execFileAsync = promisify(execFile);
 	APP_DIR = join(homedir(), ".overdeck", "github-app");
@@ -651,6 +662,6 @@ var init_github_app = __esmMin((() => {
 	});
 }));
 //#endregion
-export { withConcurrencyLimit as A, postOverdeckTestsStatus as C, createPromiseConcurrencyLimiter as D, verifyAppCanMerge as E, createSettledTtlPromiseCache as O, parsePullRequestRef as S, reportCommitStatus as T, listOpenIssuesWithLabelsPromise as _, getCiCheckRunsState as a, loadGitHubAppConfig as b, getIssueStatePromise as c, getPullRequestState as d, init_github_app as f, listOpenIssuesWithLabels as g, listIssuesWithAnyLabelPromise as h, getBotIdentity as i, withConcurrencyLimitPromise as j, init_concurrency as k, getMergeBackendStatus as l, isIntegrationPermissionError as m, generateInstallationToken as n, getCiCheckRunsStatePromise as o, isGitHubAppConfigured as p, getAppStatus as r, getIssueState as s, configureWorkspaceForBot as t, getPullRequestHeadState as u, listPullRequestsForHead as v, refreshWorkspaceToken as w, mergePullRequestWithApp as x, listPullRequestsForHeadPromise as y };
+export { createSettledTtlPromiseCache as A, postOverdeckTestsStatus as C, init_advisory_checks as D, verifyAppCanMerge as E, withConcurrencyLimit as M, withConcurrencyLimitPromise as N, isAdvisoryCheckName as O, parsePullRequestRef as S, reportCommitStatus as T, listOpenIssuesWithLabelsPromise as _, getCiCheckRunsState as a, loadGitHubAppConfig as b, getIssueStatePromise as c, getPullRequestState as d, init_github_app as f, listOpenIssuesWithLabels as g, listIssuesWithAnyLabelPromise as h, getBotIdentity as i, init_concurrency as j, createPromiseConcurrencyLimiter as k, getMergeBackendStatus as l, isIntegrationPermissionError as m, generateInstallationToken as n, getCiCheckRunsStatePromise as o, isGitHubAppConfigured as p, getAppStatus as r, getIssueState as s, configureWorkspaceForBot as t, getPullRequestHeadState as u, listPullRequestsForHead as v, refreshWorkspaceToken as w, mergePullRequestWithApp as x, listPullRequestsForHeadPromise as y };
 
-//# sourceMappingURL=github-app-CMBdIFBQ.js.map
+//# sourceMappingURL=github-app-CQ1Lo6LA.js.map

package/server/{github-app-CPfoFAdV.js → github-app-DtAsvwzK.js}

@@ -1,3 +1,3 @@
-import { C as postOverdeckTestsStatus, E as verifyAppCanMerge, S as parsePullRequestRef, T as reportCommitStatus, _ as listOpenIssuesWithLabelsPromise, a as getCiCheckRunsState, b as loadGitHubAppConfig, c as getIssueStatePromise, d as getPullRequestState, f as init_github_app, g as listOpenIssuesWithLabels, h as listIssuesWithAnyLabelPromise, i as getBotIdentity, l as getMergeBackendStatus, m as isIntegrationPermissionError, n as generateInstallationToken, o as getCiCheckRunsStatePromise, p as isGitHubAppConfigured, r as getAppStatus, s as getIssueState, t as configureWorkspaceForBot, u as getPullRequestHeadState, v as listPullRequestsForHead, w as refreshWorkspaceToken, x as mergePullRequestWithApp, y as listPullRequestsForHeadPromise } from "./github-app-CMBdIFBQ.js";
+import { C as postOverdeckTestsStatus, E as verifyAppCanMerge, S as parsePullRequestRef, T as reportCommitStatus, _ as listOpenIssuesWithLabelsPromise, a as getCiCheckRunsState, b as loadGitHubAppConfig, c as getIssueStatePromise, d as getPullRequestState, f as init_github_app, g as listOpenIssuesWithLabels, h as listIssuesWithAnyLabelPromise, i as getBotIdentity, l as getMergeBackendStatus, m as isIntegrationPermissionError, n as generateInstallationToken, o as getCiCheckRunsStatePromise, p as isGitHubAppConfigured, r as getAppStatus, s as getIssueState, t as configureWorkspaceForBot, u as getPullRequestHeadState, v as listPullRequestsForHead, w as refreshWorkspaceToken, x as mergePullRequestWithApp, y as listPullRequestsForHeadPromise } from "./github-app-CQ1Lo6LA.js";
 init_github_app();
 export { configureWorkspaceForBot, generateInstallationToken, getAppStatus, getBotIdentity, getCiCheckRunsState, getCiCheckRunsStatePromise, getIssueState, getIssueStatePromise, getMergeBackendStatus, getPullRequestHeadState, getPullRequestState, isGitHubAppConfigured, isIntegrationPermissionError, listIssuesWithAnyLabelPromise, listOpenIssuesWithLabels, listOpenIssuesWithLabelsPromise, listPullRequestsForHead, listPullRequestsForHeadPromise, loadGitHubAppConfig, mergePullRequestWithApp, parsePullRequestRef, postOverdeckTestsStatus, refreshWorkspaceToken, reportCommitStatus, verifyAppCanMerge };

package/server/{github-client--XVlDpwM.js → github-client-BfyDxuRN.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { a as init_tracker_config, t as getGitHubConfig } from "./tracker-config-B4itFzDo.js";
+import { a as init_tracker_config, t as getGitHubConfig } from "./tracker-config-DZ8Zn2nQ.js";
 import { a as RateLimited, c as TrackerNotConfigured, d as init_typed_errors, r as IssueNotFound, s as TrackerApiError } from "./typed-errors-2BTMxkZq.js";
 import { Context, Effect, Layer } from "effect";
 //#region services/github-client.ts
@@ -241,4 +241,4 @@ var init_github_client = __esmMin((() => {
 //#endregion
 export { init_github_client as i, GitHubClientLive as n, GitHubClientOptionalLive as r, GitHubClient as t };
 
-//# sourceMappingURL=github-client--XVlDpwM.js.map
+//# sourceMappingURL=github-client-BfyDxuRN.js.map

package/server/{github-client-B4QsdE-X.js → github-client-Cj0yl_07.js}

@@ -1,3 +1,3 @@
-import { i as init_github_client, n as GitHubClientLive, r as GitHubClientOptionalLive, t as GitHubClient } from "./github-client--XVlDpwM.js";
+import { i as init_github_client, n as GitHubClientLive, r as GitHubClientOptionalLive, t as GitHubClient } from "./github-client-BfyDxuRN.js";
 init_github_client();
 export { GitHubClient, GitHubClientLive, GitHubClientOptionalLive };