@overdeck/desktop 0.45.24 → 0.46.0

package/server/node_modules/undici/lib/web/cookies/util.js

@@ -114,16 +114,80 @@ function validateCookiePath (path) {
 }
 
 /**
- * I have no idea why these values aren't allowed to be honest,
- * but Deno tests these. - Khafra
+ * <let-dig> ::= <letter> | <digit>
+ *
+ * <letter> ::= any one of the 52 alphabetic characters A through Z in
+ * upper case and a through z in lower case
+ *
+ * <digit> ::= any one of the ten digits 0 through 9r
+ *
+ * @see https://www.rfc-editor.org/rfc/rfc1034#section-3.5
+ * @param {number} code
+ */
+function isLetterOrDigit (code) {
+  return (
+    (code >= 0x30 && code <= 0x39) || // 0-9
+    (code >= 0x41 && code <= 0x5A) || // A-Z
+    (code >= 0x61 && code <= 0x7A) // a-z
+  )
+}
+
+/**
+ * Validates a cookie domain against the "preferred name syntax".
+ *
+ * <domain>      ::= <subdomain> | " "
+ * <subdomain>   ::= <label> | <subdomain> "." <label>
+ * <label>       ::= <let-dig> [ [ <ldh-str> ] <let-dig> ]
+ * <ldh-str>     ::= <let-dig-hyp> | <let-dig-hyp> <ldh-str>
+ * <let-dig-hyp> ::= <let-dig> | "-"
+ *
+ * @see https://www.rfc-editor.org/rfc/rfc1034#section-3.5
+ * @see https://www.rfc-editor.org/rfc/rfc1123#section-2.1
+ * @see https://www.rfc-editor.org/rfc/rfc1035#section-2.3.4
  * @param {string} domain
  */
 function validateCookieDomain (domain) {
-  if (
-    domain.startsWith('-') ||
-    domain.endsWith('.') ||
-    domain.endsWith('-')
-  ) {
+  // <domain> ::= <subdomain> | " "
+  if (domain === ' ') {
+    return
+  }
+
+  if (domain.length > 255) {
+    throw new Error('Invalid cookie domain')
+  }
+
+  let labelLength = 0
+
+  for (let i = 0; i < domain.length; ++i) {
+    const code = domain.charCodeAt(i)
+
+    if (code === 0x2E) {
+      if (labelLength === 0) {
+        throw new Error('Invalid cookie domain')
+      }
+
+      if (domain.charCodeAt(i - 1) === 0x2D) { // "-"
+        throw new Error('Invalid cookie domain')
+      }
+
+      labelLength = 0
+      continue
+    }
+
+    if (labelLength === 0 && !isLetterOrDigit(code)) {
+      throw new Error('Invalid cookie domain')
+    }
+
+    if (!isLetterOrDigit(code) && code !== 0x2D) { // "-"
+      throw new Error('Invalid cookie domain')
+    }
+
+    if (++labelLength > 63) {
+      throw new Error('Invalid cookie domain')
+    }
+  }
+
+  if (labelLength === 0 || domain.charCodeAt(domain.length - 1) === 0x2D) { // "-"
     throw new Error('Invalid cookie domain')
   }
 }
@@ -266,7 +330,13 @@ function stringify (cookie) {
 
     const [key, ...value] = part.split('=')
 
-    out.push(`${key.trim()}=${value.join('=')}`)
+    const trimmedKey = key.trim()
+    const joinedValue = value.join('=')
+
+    validateCookieName(trimmedKey)
+    validateCookieValue(joinedValue)
+
+    out.push(`${trimmedKey}=${joinedValue}`)
   }
 
   return out.join('; ')

package/server/node_modules/undici/package.json

@@ -1,6 +1,6 @@
 {
   "name": "undici",
-  "version": "8.8.0",
+  "version": "8.9.0",
   "description": "An HTTP/1.1 client, written from scratch for Node.js",
   "homepage": "https://undici.nodejs.org",
   "bugs": {

package/server/{orphan-proposed-reconciler-CTSGcK8p.js → orphan-proposed-reconciler-CWmOdM9-.js}

@@ -1,2 +1,2 @@
-import { n as handleOrphanProposedSpec } from "./orphan-proposed-reconciler-BvKkWMJQ.js";
+import { n as handleOrphanProposedSpec } from "./orphan-proposed-reconciler-Dg6U4ADZ.js";
 export { handleOrphanProposedSpec };

package/server/{orphan-proposed-reconciler-BvKkWMJQ.js → orphan-proposed-reconciler-Dg6U4ADZ.js}

@@ -1,15 +1,15 @@
-import { On as listProjects, Tn as init_projects, zn as resolveProjectFromIssueSync } from "./config-yaml-DySPNmKN.js";
-import { a as init_activity_logger, n as emitActivityEntrySync } from "./activity-logger-DDlOIAML.js";
-import { M as listSessionNames, w as init_tmux } from "./tmux-R7N7y-Mh.js";
-import { c as getReviewStatusSync, l as init_review_status } from "./review-status-kZj_KyCk.js";
-import { b as init_agents, qn as getAgentState } from "./queries-CjNIf-Ub.js";
-import { i as resolveGitHubIssueSync, n as init_tracker_utils } from "./tracker-utils-DHv5pSDT.js";
-import { o as getInternalTokenSync, s as init_internal_token, t as INTERNAL_TOKEN_HEADER } from "./internal-token-s0-oKybJ.js";
-import { o as init_lifecycle, s as isXBriefFilename } from "./lifecycle-yPd___5E.js";
-import { d as readPlanSync, i as findPlanSync, o as init_io } from "./io-C9kF1wtJ.js";
-import { i as loadCloisterConfig, r as init_config } from "./config-CKxYiCmX.js";
-import { f as init_github_app, p as isGitHubAppConfigured, v as listPullRequestsForHead } from "./github-app-C3QrAUd0.js";
-import { n as init_issue_closed, r as isIssueClosed } from "./issue-closed-CDJk4pIp.js";
+import { Gn as init_projects, Jn as listProjects, ar as resolveProjectFromIssueSync } from "./config-yaml-CmOPzmBb.js";
+import { o as init_activity_logger, r as emitActivityEntrySync } from "./activity-logger-CyteR4JO.js";
+import { M as listSessionNames, w as init_tmux } from "./tmux-B1Wbxz5o.js";
+import { f as init_review_status, u as getReviewStatusSync } from "./review-status-yljtTd-q.js";
+import { b as init_agents, tr as getAgentState } from "./queries-DHJm7bTd.js";
+import { n as resolveGitHubIssueSync, t as init_tracker_utils } from "./tracker-utils-L0FKtjq2.js";
+import { o as getInternalTokenSync, s as init_internal_token, t as INTERNAL_TOKEN_HEADER } from "./internal-token-DvMTQSOS.js";
+import { o as init_lifecycle, s as isXBriefFilename } from "./lifecycle-CTdOWYMi.js";
+import { d as readPlanSync, i as findPlanSync, o as init_io } from "./io-VHvc0Ssp.js";
+import { i as loadCloisterConfig, r as init_config } from "./config-B2IMcBxx.js";
+import { f as init_github_app, p as isGitHubAppConfigured, v as listPullRequestsForHead } from "./github-app-CQ1Lo6LA.js";
+import { n as init_issue_closed, r as isIssueClosed } from "./issue-closed-B6KJkmHZ.js";
 import { Effect } from "effect";
 import { existsSync, readdirSync } from "fs";
 import { join } from "path";
@@ -90,8 +90,17 @@ async function defaultHasOpenPrForBranch(projectPath, issueId) {
 	const branch = `feature/${issueId.toLowerCase()}`;
 	try {
 		const resolved = resolveGitHubIssueSync(issueId);
-		if (isGitHubAppConfigured() && resolved.isGitHub) return (await Effect.runPromise(listPullRequestsForHead(resolved.owner, resolved.repo, branch, "open"))).length > 0;
-		const result = await execAsync(`gh pr list --head ${branch} --state open --json number --limit 1`, { cwd: projectPath });
+		if (!resolved.isGitHub) {
+			logReconcilerDiagnostic("open-pr-check-skipped", {
+				projectPath,
+				issueId,
+				branch,
+				reason: "non-github-tracker"
+			});
+			return false;
+		}
+		if (isGitHubAppConfigured()) return (await Effect.runPromise(listPullRequestsForHead(resolved.owner, resolved.repo, branch, "open"))).length > 0;
+		const result = await execAsync(`gh pr list --repo ${resolved.owner}/${resolved.repo} --head ${branch} --state open --json number --limit 1`, { cwd: projectPath });
 		const stdout = typeof result === "string" ? result : result.stdout;
 		const prs = JSON.parse(stdout ?? "[]");
 		return Array.isArray(prs) && prs.length > 0;
@@ -482,4 +491,4 @@ async function reconcileOrphanProposedSpecs(options = {}) {
 //#endregion
 export { spawnWorkAgentThroughAgentsEndpoint as a, reconcileOrphanProposedSpecs as i, handleOrphanProposedSpec as n, triggerRebuildAndStart as o, hasReviewPipelinePresence as r, findOrphanProposedSpecsForReconciler as t };
 
-//# sourceMappingURL=orphan-proposed-reconciler-BvKkWMJQ.js.map
+//# sourceMappingURL=orphan-proposed-reconciler-Dg6U4ADZ.js.map

package/server/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@overdeck/desktop-server",
-  "version": "0.45.24",
+  "version": "0.46.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@overdeck/desktop-server",
-      "version": "0.45.24",
+      "version": "0.46.0",
       "dependencies": {
         "@effect/platform-node": "4.0.0-beta.73",
         "@google-cloud/speech": "7.3.1",
@@ -37,9 +37,9 @@
       }
     },
     "node_modules/@effect/platform-node/node_modules/@effect/platform-node-shared": {
-      "version": "4.0.0-beta.101",
-      "resolved": "https://registry.npmjs.org/@effect/platform-node-shared/-/platform-node-shared-4.0.0-beta.101.tgz",
-      "integrity": "sha512-g4L7XiyJSNJLJVhlslyg2zBCQsoKQf1y1gd+Yfd+3wD9ymC+m7ymbd/5FGqnT1aXV6E2AwRr4D/R1eyRUikvWQ==",
+      "version": "4.0.0-beta.102",
+      "resolved": "https://registry.npmjs.org/@effect/platform-node-shared/-/platform-node-shared-4.0.0-beta.102.tgz",
+      "integrity": "sha512-gVd793I72MrkX4dXo7eYtRKfNj0RW4eMRfVEKEJI16h2+mBDCzQ+gqMrog2hSTHQnaIbvbYShNQ4TVGuRCYZeQ==",
       "license": "MIT",
       "dependencies": {
         "@types/ws": "^8.18.1",
@@ -49,13 +49,13 @@
         "node": ">=18.0.0"
       },
       "peerDependencies": {
-        "effect": "^4.0.0-beta.101"
+        "effect": "^4.0.0-beta.102"
       }
     },
     "node_modules/@google-cloud/common": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/@google-cloud/common/-/common-6.0.1.tgz",
-      "integrity": "sha512-1uvKzbmAWUdchIYRsg0f4rUmezOamWuVBSWAPAhnYoUE5OiPEx6v6JOxFIdr3MsrqV+6fyLV3EI1vMPlHoeRvw==",
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/@google-cloud/common/-/common-6.1.0.tgz",
+      "integrity": "sha512-Ohjxjvusr65+SiEVBrilpyn1ir9CM8ZqWjcf7bA8ph1GCunxI6bbwtcl7iGl67A7Lr4Nz7WpNzITNETwggc7pw==",
       "license": "Apache-2.0",
       "dependencies": {
         "@google-cloud/projectify": "^4.0.0",
@@ -63,7 +63,7 @@
         "arrify": "^2.0.0",
         "duplexify": "^4.1.3",
         "extend": "^3.0.2",
-        "google-auth-library": "^10.0.0-rc.1",
+        "google-auth-library": "^10.6.2",
         "html-entities": "^2.5.2",
         "retry-request": "^8.0.0",
         "teeny-request": "^10.0.0"
@@ -1033,9 +1033,9 @@
       }
     },
     "node_modules/gaxios": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/gaxios/-/gaxios-7.2.0.tgz",
-      "integrity": "sha512-CUVb4wcYe+771XevyH6HtGmXFAGGKkIC3kswAP8Z1JCe0j80JMaTPZH930DWFrvo0atjh18Arc0pEyUCWa5bfg==",
+      "version": "7.3.0",
+      "resolved": "https://registry.npmjs.org/gaxios/-/gaxios-7.3.0.tgz",
+      "integrity": "sha512-RB5vLV+vvQeoFPCX4QMK6/hjVkbIamPp1QSUD0CiZcnj12qbpiL+pLbYtgD+oZkWl0tl9z+o2Utp+MpM3QRhBA==",
       "license": "Apache-2.0",
       "dependencies": {
         "extend": "^3.0.2",
@@ -1091,9 +1091,9 @@
       }
     },
     "node_modules/google-auth-library": {
-      "version": "10.9.0",
-      "resolved": "https://registry.npmjs.org/google-auth-library/-/google-auth-library-10.9.0.tgz",
-      "integrity": "sha512-xtvUqvINPhTaBm7nXqlYPcrMHJPm1lCNdSovxnKKhTm+4JsvQ+KGVYJViLoH9Yxu8w+T0Qv5HubzYT9BLrppJg==",
+      "version": "10.9.1",
+      "resolved": "https://registry.npmjs.org/google-auth-library/-/google-auth-library-10.9.1.tgz",
+      "integrity": "sha512-i1ydyHrqcIxXkWh/uBmVkzCvIuq5yiK2ATndIe5XxKholrG/MTYP9xGYka4sQhrbIAgGjL2B6NOE7rFaiF3fXw==",
       "license": "Apache-2.0",
       "dependencies": {
         "base64-js": "^1.3.0",
@@ -1108,9 +1108,9 @@
       }
     },
     "node_modules/google-gax": {
-      "version": "5.0.7",
-      "resolved": "https://registry.npmjs.org/google-gax/-/google-gax-5.0.7.tgz",
-      "integrity": "sha512-EhiqaWWJ+9h7sCcKJTsoo6tMcjokVHhWsbSuWCnZJT4vIBP3y4mAoFLnt9SzgkVZeq24ZsFaArr06nnYYku2yA==",
+      "version": "5.0.8",
+      "resolved": "https://registry.npmjs.org/google-gax/-/google-gax-5.0.8.tgz",
+      "integrity": "sha512-M4vpZcXQIC1gqIVGQ7eaU3jXQA6zecStyTXu514TYfThlgSurYJOxHZo9fzU6hAgwPWvuEynAVHWyaIk80VeEA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@grpc/grpc-js": "^1.12.6",
@@ -1646,9 +1646,9 @@
       }
     },
     "node_modules/retry-request": {
-      "version": "8.0.3",
-      "resolved": "https://registry.npmjs.org/retry-request/-/retry-request-8.0.3.tgz",
-      "integrity": "sha512-qqoc4kkGgP9cmQDWELlOpAmfgJOg0Yi7MT82ZjiPWu451ayju4itwomjM4/dBEliify8C1b3tSaeCOldugtwPQ==",
+      "version": "8.0.4",
+      "resolved": "https://registry.npmjs.org/retry-request/-/retry-request-8.0.4.tgz",
+      "integrity": "sha512-pI6/7eabUYkZxamkOq0g0uMxKLLGnjzhefY+vL8bVXag5rto4OU2YBTPytWLuHH7aEKD6fn7kJycQfid0Mwnkw==",
       "license": "MIT",
       "dependencies": {
         "extend": "^3.0.2",
@@ -1938,9 +1938,9 @@
       "license": "MIT"
     },
     "node_modules/teeny-request": {
-      "version": "10.1.3",
-      "resolved": "https://registry.npmjs.org/teeny-request/-/teeny-request-10.1.3.tgz",
-      "integrity": "sha512-5yDliI1uWkYPo7W+Zvrxg6YmoWuj5iC5EydewqrRTvc68nyMTZhlPPlLg6cptUGfbQAb+N9XDPDPzF6N081lug==",
+      "version": "10.1.4",
+      "resolved": "https://registry.npmjs.org/teeny-request/-/teeny-request-10.1.4.tgz",
+      "integrity": "sha512-R1Cg4Vu0UULeDfHL/kjABLaTW++9yD/B6n2g48y5dJ04hsEaxcfmAqbNDzNsbqAYJyIpZafjklLG9YxRu9uzOg==",
       "license": "Apache-2.0",
       "dependencies": {
         "http-proxy-agent": "^7.0.0",
@@ -1962,9 +1962,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "8.8.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-8.8.0.tgz",
-      "integrity": "sha512-ubshXMXwF3MQIMF1y/WxZdNBnjEKeSg2wF5mcGUtU55YTw34tnVVpKRlLf7ruDXZ5344KokPVX4RBx1wJm64Bw==",
+      "version": "8.9.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-8.9.0.tgz",
+      "integrity": "sha512-aWZpUj7XoGonMClx4gdDRfgBjqeA+F473aDmROQQbM9n6PRfK/u1q/a0X4wMTgcHfT8H6fpbt98PFuDUwFg2YA==",
       "license": "MIT",
       "engines": {
         "node": ">=22.19.0"

package/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overdeck/desktop-server",
-  "version": "0.45.24",
+  "version": "0.46.0",
   "private": true,
   "type": "module",
   "dependencies": {

package/server/{pan-dir-B0c3w0Ya.js → pan-dir-ubraCiUg.js}

@@ -1,10 +1,10 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Ht as flushAutoCommits, Ut as init_auto_commit, Wt as queueAutoCommit, ir as FsError, mr as init_errors } from "./config-yaml-DySPNmKN.js";
+import { Fr as init_errors, Tr as FsError, cn as flushAutoCommits, ln as init_auto_commit, un as queueAutoCommit } from "./config-yaml-CmOPzmBb.js";
 import { p as init_types } from "./types-hraoaQIp.js";
-import { C as init_specs, F as getReadableWorkspacePanPaths, I as getWorkspacePanPaths, L as init_continue, N as ensureWorkspacePanDir, P as getLegacyWorkspacePanPaths, S as getProjectPanPaths, b as ensurePanDirs } from "./io-C9kF1wtJ.js";
+import { F as getReadableWorkspacePanPaths, I as getWorkspacePanPaths, L as init_continue, M as getProjectPanPaths, N as ensureWorkspacePanDir, P as getLegacyWorkspacePanPaths, S as init_specs, b as ensurePanDirs } from "./io-VHvc0Ssp.js";
 import { Effect, FileSystem } from "effect";
 import { join } from "path";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, rmSync } from "node:fs";
 import * as NodeFileSystem from "@effect/platform-node/NodeFileSystem";
 //#region ../../lib/pan-dir/sessions.ts
 var init_sessions = __esmMin((() => {
@@ -184,6 +184,12 @@ function checkPrdGateSync(args) {
 *
 * No-loss rule: an existing canonical draft is never overwritten — the
 * canonical copy may carry operator edits the workspace copy predates.
+*
+* A successful promotion also removes the workspace copy: the identical content
+* is committed and pushed on the state plane, and the leftover untracked file
+* tripped the spawn-time dirty-workspace gate, stranding the planning→work
+* auto-handoff with `planning_auto_handoff_failed` (PAN-3042). Removal is
+* best-effort — the spawn gate exempts Overdeck-owned `.pan/` paths anyway.
 */
 function promoteWorkspacePrdDraft(args) {
 	return Effect.suspend(() => {
@@ -212,12 +218,20 @@ function promoteWorkspacePrdDraft(args) {
 				cause
 			}));
 		}
-		return writeIssueDraft(projectRoot, issueId, content).pipe(Effect.map((path) => ({
-			promoted: true,
-			reason: "promoted",
-			path,
-			source
-		})));
+		return writeIssueDraft(projectRoot, issueId, content).pipe(Effect.map((path) => {
+			let sourceRemoved = false;
+			try {
+				rmSync(source);
+				sourceRemoved = true;
+			} catch {}
+			return {
+				promoted: true,
+				reason: "promoted",
+				path,
+				source,
+				sourceRemoved
+			};
+		}));
 	});
 }
 var init_drafts = __esmMin((() => {
@@ -277,4 +291,4 @@ var init_pan_dir = __esmMin((() => {
 //#endregion
 export { getDraftPath as a, clearFeedback as c, checkPrdGateSync as i, readFeedback as l, readWorkspaceContext as n, getIssueDraftPath as o, writeWorkspaceContext as r, promoteWorkspacePrdDraft as s, init_pan_dir as t, writeFeedback as u };
 
-//# sourceMappingURL=pan-dir-B0c3w0Ya.js.map
+//# sourceMappingURL=pan-dir-ubraCiUg.js.map

package/server/{paths-D-xWGHdh.js → paths-cXmOwSbh.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Br as getOverdeckHome, Vr as init_paths$1 } from "./config-yaml-DySPNmKN.js";
+import { ci as init_paths$1, si as getOverdeckHome } from "./config-yaml-CmOPzmBb.js";
 import { dirname, isAbsolute, join, relative, resolve } from "path";
 import { mkdir } from "fs/promises";
 //#region ../../lib/memory/paths.ts
@@ -62,4 +62,4 @@ var init_paths = __esmMin((() => {
 //#endregion
 export { resolveArchiveDir as a, resolveMemoryRoot as c, resolveRagRunsFile as d, resolveStatusFile as f, init_paths as i, resolveObservationsFile as l, ensureDir as n, resolveFtsDbPath as o, resolveSummariesDir as p, ensureParentDir as r, resolveIssueMemoryRoot as s, assertMemorySafeSegment as t, resolvePendingDir as u };
 
-//# sourceMappingURL=paths-D-xWGHdh.js.map
+//# sourceMappingURL=paths-cXmOwSbh.js.map

package/server/pending-lifecycle-claim-DEteYdS9.js

@@ -0,0 +1,110 @@
+import { n as init_review_status_source, s as resolveCanonicalReviewStatus } from "./review-status-source-CpvJnvnQ.js";
+import { basename, dirname, join } from "node:path";
+import { readFile, readdir, rename, unlink } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+//#region ../../lib/cloister/pending-lifecycle-claim.ts
+init_review_status_source();
+function isMissing(error) {
+	return error?.code === "ENOENT";
+}
+function isProcessAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function findRecoverableLifecycleFiles(pendingFile) {
+	const directory = dirname(pendingFile);
+	const name = basename(pendingFile);
+	let entries;
+	try {
+		entries = await readdir(directory);
+	} catch (error) {
+		if (isMissing(error)) return [];
+		throw error;
+	}
+	const queuedPrefix = `${name}.queued-`;
+	const claimedPrefix = `${name}.claimed-`;
+	const queued = [];
+	const abandoned = [];
+	for (const entry of entries.sort()) {
+		if (entry.startsWith(queuedPrefix)) {
+			queued.push(join(directory, entry));
+			continue;
+		}
+		if (!entry.startsWith(claimedPrefix)) continue;
+		const ownerPid = Number.parseInt(entry.slice(claimedPrefix.length).split("-")[0], 10);
+		if (Number.isInteger(ownerPid) && ownerPid > 0 && !isProcessAlive(ownerPid)) abandoned.push(join(directory, entry));
+	}
+	return [...queued, ...abandoned];
+}
+async function acquireClaimPath(pendingFile, claimPath) {
+	try {
+		await rename(pendingFile, claimPath);
+		return true;
+	} catch (error) {
+		if (!isMissing(error)) throw error;
+	}
+	for (const recoverablePath of await findRecoverableLifecycleFiles(pendingFile)) try {
+		await rename(recoverablePath, claimPath);
+		return true;
+	} catch (error) {
+		if (!isMissing(error)) throw error;
+	}
+	return false;
+}
+async function claimPendingLifecycleFile(pendingFile) {
+	const claimPath = `${pendingFile}.claimed-${process.pid}-${randomUUID()}`;
+	if (!await acquireClaimPath(pendingFile, claimPath)) return null;
+	let settled = false;
+	const removeClaim = async () => {
+		try {
+			await unlink(claimPath);
+		} catch (error) {
+			if (!isMissing(error)) throw error;
+		}
+		settled = true;
+	};
+	const queueClaim = async () => {
+		await rename(claimPath, `${pendingFile}.queued-${randomUUID()}`);
+		settled = true;
+	};
+	try {
+		return {
+			path: claimPath,
+			raw: await readFile(claimPath, "utf-8"),
+			discard: async () => {
+				if (settled) return;
+				await removeClaim();
+			},
+			restore: async () => {
+				if (settled) return;
+				await queueClaim();
+			}
+		};
+	} catch (error) {
+		try {
+			await queueClaim();
+		} catch {}
+		throw error;
+	}
+}
+async function settlePendingLifecycleClaim(claim, issueId, succeeded) {
+	if (succeeded) {
+		await claim.discard();
+		return "discarded";
+	}
+	const canonical = resolveCanonicalReviewStatus(issueId);
+	if (canonical.available && canonical.status?.mergeStatus === "merged" && (canonical.status.mergeStep === "post-merge-cleanup" || canonical.status.mergeStep === "merged")) {
+		await claim.discard();
+		return "discarded";
+	}
+	await claim.restore();
+	return "queued";
+}
+//#endregion
+export { settlePendingLifecycleClaim as n, claimPendingLifecycleFile as t };
+
+//# sourceMappingURL=pending-lifecycle-claim-DEteYdS9.js.map

package/server/{pickup-DUCLWrJY.js → pickup-D8xtG1J2.js}

@@ -186,4 +186,4 @@ var init_pickup = __esmMin((() => {
 //#endregion
 export { selectNeedsPlanning as _, READY_LABEL as a, classifyIssue as c, computeLanes as d, computeStats as f, normalizeGate as g, isAutoPickable as h, PARKED_LABEL as i, computeCohort as l, init_pickup as m, LEGACY_PARKED_LABELS as n, RELEASED_LABEL as o, computeWaves as p, OBJECTION_LABEL as r, VETOED_LABEL as s, BLOCKS_MAIN_LABEL as t, computeEpicGroups as u };
 
-//# sourceMappingURL=pickup-DUCLWrJY.js.map
+//# sourceMappingURL=pickup-D8xtG1J2.js.map

package/server/pipeline-membership-BGSvkT2M.js

@@ -0,0 +1,3 @@
+import { n as init_pipeline_membership, r as resolvePipelineMembership, t as PLANNED_BACKLOG_SPEC_ONLY_REASON } from "./pipeline-membership-CrAPLYtf.js";
+init_pipeline_membership();
+export { PLANNED_BACKLOG_SPEC_ONLY_REASON, resolvePipelineMembership };

package/server/pipeline-membership-CrAPLYtf.js

@@ -0,0 +1,57 @@
+import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
+//#region ../../lib/pipeline-membership.ts
+/**
+* Classify a single issue's pipeline membership from its durable lens signals.
+*
+* Decisions (see PAN-1980):
+*  - A closed issue is subtracted from the pipeline regardless of lingering
+*    branch/label/agent/workspace state (§2d), EXCEPT a still-open PR — a live,
+*    mergeable artifact that must be closed (`zombie_pr`).
+*  - L1-merged is the merge oracle; a squash-merged branch that L2 still calls
+*    "unmerged" is treated as merged.
+*  - An open issue with a branch but no PR is `planned_backlog` (in the pipeline,
+*    needs a PR or disposition) — distinct from `in_flight` so it does not
+*    inflate throughput.
+*/
+function resolvePipelineMembership(s) {
+	const branchLive = s.hasConventionBranch && s.branchUnmerged && !s.hasMergedPr;
+	const lenses = {
+		L1_openPr: s.hasOpenPr,
+		L2_unmergedBranch: branchLive,
+		L3_issueOpen: s.issueOpen,
+		L4_phaseLabel: s.phaseLabel
+	};
+	const result = (bucket, reason) => {
+		const labelDrift = s.phaseLabel !== null && (bucket === "clean_terminal" || !s.issueOpen) ? "stale_present" : s.issueOpen && s.hasOpenPr && s.phaseLabel === null ? "stale_absent" : null;
+		return {
+			issueId: s.issueId,
+			inPipeline: bucket !== "clean_terminal",
+			bucket,
+			reasons: [reason],
+			labelDrift,
+			lenses
+		};
+	};
+	if (!s.issueOpen) {
+		if (s.hasOpenPr) return result("zombie_pr", "issue is closed but a PR is still open — close/reconcile the PR");
+		return result("clean_terminal", "issue closed; no open PR — terminal (any leftover branch/label/agent is cleanup, not pipeline)");
+	}
+	if (s.hasOpenPr) return result("in_flight", "open issue with an open PR — active work");
+	if (s.hasMergedPr) return result("post_merge_limbo", "open issue with a merged PR — merged but never closed out; run close-out");
+	if (branchLive) return result("planned_backlog", "open issue with an unmerged convention branch (feature/ or strike/) but no PR — needs a PR or disposition");
+	if (s.hasConventionBranch) {
+		if (s.hasMergedBranchWork) return result("post_merge_limbo", "open issue whose branch work is contained in main but with no merged PR — landed via a non-PR path; run close-out");
+		return result("planned_backlog", "open issue with a convention branch but no unique commits — created, work not yet landed; needs work or disposition");
+	}
+	if (s.hasXbriefSpec) return result("planned_backlog", PLANNED_BACKLOG_SPEC_ONLY_REASON);
+	if (s.explicitlyReady) return result("planned_backlog", "open issue carries the explicit ready label — ready to start");
+	return result("clean_terminal", "open issue with no branch and no PR — backlog, never started");
+}
+var PLANNED_BACKLOG_SPEC_ONLY_REASON;
+var init_pipeline_membership = __esmMin((() => {
+	PLANNED_BACKLOG_SPEC_ONLY_REASON = "open issue with an xBRIEF spec but no branch/PR — planned work whose plan encodes code paths that age; needs starting or re-planning";
+}));
+//#endregion
+export { init_pipeline_membership as n, resolvePipelineMembership as r, PLANNED_BACKLOG_SPEC_ONLY_REASON as t };
+
+//# sourceMappingURL=pipeline-membership-CrAPLYtf.js.map