@overdeck/desktop 0.45.24 → 0.46.0

package/server/forge-CZbSg6Ds.js

@@ -0,0 +1,383 @@
+import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
+import { S as parsePullRequestRef, d as getPullRequestState, f as init_github_app, p as isGitHubAppConfigured, v as listPullRequestsForHead, x as mergePullRequestWithApp } from "./github-app-CQ1Lo6LA.js";
+import { join } from "node:path";
+import { Data, Effect } from "effect";
+import { tmpdir } from "node:os";
+import { unlink, writeFile } from "node:fs/promises";
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+//#region ../../lib/forge.ts
+/**
+* Parse a review-artifact URL into its forge type and numeric identifier.
+* Detection is by path pattern (not host) so self-hosted GitLab is supported.
+* Returns `null` for unrecognised input.
+*/
+function parseArtifactRef(url) {
+	if (!url) return null;
+	const gitlabMatch = url.match(/\/-\/merge_requests\/(\d+)(?:$|[/?#])/);
+	if (gitlabMatch) return {
+		forge: "gitlab",
+		number: Number.parseInt(gitlabMatch[1], 10)
+	};
+	const githubMatch = url.match(/\/pull\/(\d+)(?:$|[/?#])/);
+	if (githubMatch) return {
+		forge: "github",
+		number: Number.parseInt(githubMatch[1], 10)
+	};
+	return null;
+}
+async function withBodyFile(body, prefix, fn) {
+	if (!body) return fn(void 0);
+	const bodyFile = join(tmpdir(), `${prefix}-${Date.now()}.md`);
+	await writeFile(bodyFile, body, "utf-8");
+	try {
+		return await fn(bodyFile);
+	} finally {
+		await unlink(bodyFile).catch(() => {});
+	}
+}
+function buildRepositoryFlag(repository) {
+	return repository ? ` --repo ${repository}` : "";
+}
+function buildGitHubReviewTarget(input) {
+	return input.url || input.id || "";
+}
+function buildGitLabReviewTarget(input) {
+	return input.id || input.url || "";
+}
+function parseRepository(repository) {
+	const [owner, repo] = (repository ?? "").split("/");
+	return owner && repo ? {
+		owner,
+		repo
+	} : null;
+}
+async function getExistingGitHubArtifact(branchName, cwd, repository) {
+	const parsedRepo = parseRepository(repository);
+	if (isGitHubAppConfigured() && parsedRepo) {
+		const pr = (await Effect.runPromise(listPullRequestsForHead(parsedRepo.owner, parsedRepo.repo, branchName, "all")))[0];
+		if (!pr) return null;
+		return {
+			forge: "github",
+			created: false,
+			url: pr.url ?? `https://github.com/${parsedRepo.owner}/${parsedRepo.repo}/pull/${pr.number}`,
+			id: String(pr.number)
+		};
+	}
+	const { stdout } = await execAsync(`gh pr view ${branchName}${buildRepositoryFlag(repository)} --json url,number 2>/dev/null || true`, {
+		cwd,
+		encoding: "utf-8"
+	});
+	const trimmed = stdout.trim();
+	if (!trimmed) return null;
+	const parsed = JSON.parse(trimmed);
+	return {
+		forge: "github",
+		created: false,
+		url: parsed.url,
+		id: parsed.number ? String(parsed.number) : void 0
+	};
+}
+async function getExistingGitLabArtifact(branchName, cwd, repository) {
+	const { stdout } = await execAsync(`glab mr list --source-branch ${branchName}${buildRepositoryFlag(repository)} --output json 2>/dev/null || true`, {
+		cwd,
+		encoding: "utf-8"
+	});
+	const trimmed = stdout.trim();
+	if (!trimmed) return null;
+	const existing = JSON.parse(trimmed)[0];
+	if (!existing) return null;
+	return {
+		forge: "gitlab",
+		created: false,
+		url: existing.web_url,
+		id: existing.iid ? String(existing.iid) : void 0
+	};
+}
+function matchesCurrentArtifact(input, artifact) {
+	return artifact.sourceBranch === void 0 || artifact.sourceBranch === input.sourceBranch ? (input.targetBranch === void 0 || artifact.targetBranch === input.targetBranch) && (input.headSha === void 0 || artifact.headSha === input.headSha) : false;
+}
+async function findMergedGitHubArtifact(input) {
+	const parsedRepo = parseRepository(input.repository);
+	const parsedId = input.artifactId ? Number.parseInt(input.artifactId, 10) : NaN;
+	const parsedUrl = parseArtifactRef(input.artifactUrl);
+	const exactNumber = Number.isFinite(parsedId) ? parsedId : parsedUrl?.forge === "github" ? parsedUrl.number : void 0;
+	if (isGitHubAppConfigured() && parsedRepo) {
+		if (Number.isFinite(exactNumber)) {
+			const state = await Effect.runPromise(getPullRequestState(parsedRepo.owner, parsedRepo.repo, exactNumber));
+			if (!state.merged || !matchesCurrentArtifact(input, {
+				sourceBranch: input.sourceBranch,
+				targetBranch: state.baseBranch,
+				headSha: state.headSha
+			})) return null;
+			return {
+				forge: "github",
+				created: false,
+				url: state.url ?? input.artifactUrl,
+				id: String(state.number)
+			};
+		}
+		const prs = await Effect.runPromise(listPullRequestsForHead(parsedRepo.owner, parsedRepo.repo, input.sourceBranch, "all"));
+		for (const pr of prs.filter((candidate) => candidate.merged === true || candidate.mergedAt != null)) {
+			if (input.targetBranch === void 0 && input.headSha === void 0) return {
+				forge: "github",
+				created: false,
+				url: pr.url ?? `https://github.com/${parsedRepo.owner}/${parsedRepo.repo}/pull/${pr.number}`,
+				id: String(pr.number)
+			};
+			const state = await Effect.runPromise(getPullRequestState(parsedRepo.owner, parsedRepo.repo, pr.number));
+			if (state.merged && matchesCurrentArtifact(input, {
+				sourceBranch: input.sourceBranch,
+				targetBranch: state.baseBranch,
+				headSha: state.headSha
+			})) return {
+				forge: "github",
+				created: false,
+				url: state.url ?? pr.url,
+				id: String(pr.number)
+			};
+		}
+		return null;
+	}
+	if (Number.isFinite(exactNumber)) {
+		const { stdout } = await execAsync(`gh pr view ${input.artifactUrl || input.artifactId}${buildRepositoryFlag(input.repository)} --json url,number,state,mergedAt,headRefOid,baseRefName,headRefName`, {
+			cwd: input.cwd,
+			encoding: "utf-8",
+			timeout: FORGE_OBSERVATION_TIMEOUT_MS
+		});
+		const pr = JSON.parse(stdout.trim());
+		if (!pr.mergedAt || !matchesCurrentArtifact(input, {
+			sourceBranch: pr.headRefName,
+			targetBranch: pr.baseRefName,
+			headSha: pr.headRefOid
+		})) return null;
+		return {
+			forge: "github",
+			created: false,
+			url: pr.url,
+			id: pr.number ? String(pr.number) : input.artifactId
+		};
+	}
+	const { stdout } = await execAsync(`gh pr list --state merged --head ${input.sourceBranch}${buildRepositoryFlag(input.repository)} --json url,number,mergedAt,headRefOid,baseRefName,headRefName`, {
+		cwd: input.cwd,
+		encoding: "utf-8",
+		timeout: FORGE_OBSERVATION_TIMEOUT_MS
+	});
+	const merged = JSON.parse(stdout.trim() || "[]").find((pr) => pr.mergedAt && matchesCurrentArtifact(input, {
+		sourceBranch: pr.headRefName,
+		targetBranch: pr.baseRefName,
+		headSha: pr.headRefOid
+	}));
+	return merged ? {
+		forge: "github",
+		created: false,
+		url: merged.url,
+		id: merged.number ? String(merged.number) : void 0
+	} : null;
+}
+async function findMergedGitLabArtifact(input) {
+	const parsedId = input.artifactId ? Number.parseInt(input.artifactId, 10) : NaN;
+	const parsedUrl = parseArtifactRef(input.artifactUrl);
+	const target = Number.isFinite(parsedId) ? String(parsedId) : parsedUrl?.forge === "gitlab" ? String(parsedUrl.number) : void 0;
+	const { stdout } = await execAsync(target ? `glab mr view ${target}${buildRepositoryFlag(input.repository)} --output json` : `glab mr list --source-branch ${input.sourceBranch}${buildRepositoryFlag(input.repository)} --all --output json`, {
+		cwd: input.cwd,
+		encoding: "utf-8",
+		timeout: FORGE_OBSERVATION_TIMEOUT_MS
+	});
+	const merged = (target ? [JSON.parse(stdout.trim())] : JSON.parse(stdout.trim() || "[]")).find((artifact) => artifact.state === "merged" && matchesCurrentArtifact(input, {
+		sourceBranch: artifact.source_branch,
+		targetBranch: artifact.target_branch,
+		headSha: artifact.sha
+	}));
+	return merged ? {
+		forge: "gitlab",
+		created: false,
+		url: merged.web_url,
+		id: merged.iid ? String(merged.iid) : input.artifactId
+	} : null;
+}
+function delay(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function isTransientGitHubMergeState(state) {
+	if (state.merged) return false;
+	if (state.draft) return false;
+	if (state.checksFailed) return false;
+	if (state.checksPending) return true;
+	if (state.mergeable === null) return true;
+	return [
+		"unknown",
+		"blocked",
+		"behind",
+		"unstable",
+		"has_hooks"
+	].includes(state.mergeableState || "");
+}
+function getForgeAdapter(forge) {
+	return forge === "gitlab" ? gitlabForgeAdapter : githubForgeAdapter;
+}
+var execAsync, GITHUB_MERGE_POLL_INTERVAL_MS, FORGE_OBSERVATION_TIMEOUT_MS, GITHUB_MERGE_TIMEOUT_MS, githubForgeAdapter, gitlabForgeAdapter;
+var init_forge = __esmMin((() => {
+	init_github_app();
+	Data.TaggedError("ForgeError");
+	execAsync = promisify(exec);
+	GITHUB_MERGE_POLL_INTERVAL_MS = 5e3;
+	FORGE_OBSERVATION_TIMEOUT_MS = 3e4;
+	GITHUB_MERGE_TIMEOUT_MS = 900 * 1e3;
+	githubForgeAdapter = {
+		forge: "github",
+		async createReviewArtifact(input) {
+			const existing = await getExistingGitHubArtifact(input.sourceBranch, input.cwd, input.repository);
+			if (existing) return existing;
+			return withBodyFile(input.body, "pan-gh-pr-body", async (bodyFile) => {
+				const bodyFlag = bodyFile ? ` --body-file "${bodyFile}"` : "";
+				const { stdout } = await execAsync(`gh pr create --head ${input.sourceBranch} --base ${input.targetBranch} --title "${input.title}"${bodyFlag}${buildRepositoryFlag(input.repository)}`, {
+					cwd: input.cwd,
+					encoding: "utf-8"
+				});
+				return {
+					forge: "github",
+					created: true,
+					url: stdout.trim().split("\n").pop()?.trim() || stdout.trim(),
+					id: (await getExistingGitHubArtifact(input.sourceBranch, input.cwd, input.repository))?.id
+				};
+			});
+		},
+		async mergeReviewArtifact(input) {
+			const target = buildGitHubReviewTarget(input);
+			const method = input.method || "squash";
+			console.log(`[forge] mergeReviewArtifact: ${input.forge} ${target} method=${method} repo=${input.repository ?? "default"}`);
+			if (!isGitHubAppConfigured()) try {
+				console.log(`[forge] gh pr merge: executing ${method} merge for ${target}`);
+				await execAsync(`gh pr merge ${target}${buildRepositoryFlag(input.repository)} --${method}`, {
+					cwd: input.cwd,
+					encoding: "utf-8"
+				});
+				console.log(`[forge] gh pr merge: completed successfully for ${target}`);
+				return;
+			} catch (err) {
+				console.error(`[forge] gh pr merge: failed for ${target}: exitCode=${err.code} message=${err.message}`);
+				throw err;
+			}
+			const ref = parsePullRequestRef(input);
+			const deadline = Date.now() + GITHUB_MERGE_TIMEOUT_MS;
+			console.log(`[forge] mergeReviewArtifact: GitHub App path for ${ref.owner}/${ref.repo}#${ref.number}, timeout=${GITHUB_MERGE_TIMEOUT_MS}ms`);
+			while (Date.now() < deadline) {
+				const state = await Effect.runPromise(getPullRequestState(ref.owner, ref.repo, ref.number));
+				console.log(`[forge] mergeReviewArtifact: PR #${ref.number} state=${state.state} merged=${state.merged} draft=${state.draft} checksFailed=${state.checksFailed}`);
+				if (state.merged) return;
+				if (state.state !== "OPEN") throw new Error(`GitHub PR #${ref.number} is closed but not merged`);
+				if (state.draft) throw new Error(`GitHub PR #${ref.number} is still marked as draft`);
+				if (state.checksFailed) throw new Error(`GitHub PR #${ref.number} has failing required checks`);
+				if (isTransientGitHubMergeState(state)) {
+					await delay(GITHUB_MERGE_POLL_INTERVAL_MS);
+					continue;
+				}
+				try {
+					const mergeResult = await Effect.runPromise(mergePullRequestWithApp(ref.owner, ref.repo, ref.number, method, state.headSha || void 0));
+					console.log(`[forge] mergePullRequestWithApp: result merged=${mergeResult.merged} for ${ref.owner}/${ref.repo}#${ref.number}`);
+					if (mergeResult.merged) return;
+				} catch (err) {
+					const message = String(err?.message || err);
+					console.error(`[forge] mergePullRequestWithApp: threw for ${ref.number}: ${message}`);
+					if (message.includes("405") || message.includes("409") || message.includes("422") || message.includes("not mergeable") || message.includes("Base branch was modified") || message.includes("required status check") || message.includes("Head branch was modified")) {
+						await delay(GITHUB_MERGE_POLL_INTERVAL_MS);
+						continue;
+					}
+					throw err;
+				}
+			}
+			throw new Error(`Timed out waiting for GitHub PR #${ref.number} to become mergeable`);
+		},
+		async commentOnArtifact(input) {
+			const target = buildGitHubReviewTarget(input);
+			await withBodyFile(input.body, "pan-gh-pr-comment", async (bodyFile) => {
+				const bodyFlag = bodyFile ? ` --body-file "${bodyFile}"` : ` --body "${input.body.replace(/"/g, "\\\"")}"`;
+				await execAsync(`gh pr comment ${target}${buildRepositoryFlag(input.repository)}${bodyFlag}`, {
+					cwd: input.cwd,
+					encoding: "utf-8"
+				});
+			});
+		},
+		async approveReviewArtifact(input) {
+			await execAsync(`gh pr review ${buildGitHubReviewTarget(input)} --approve${buildRepositoryFlag(input.repository)}`, {
+				cwd: input.cwd,
+				encoding: "utf-8"
+			});
+		},
+		async discoverArtifact(input) {
+			return getExistingGitHubArtifact(input.sourceBranch, input.cwd, input.repository);
+		},
+		async findMergedArtifact(input) {
+			return findMergedGitHubArtifact(input);
+		}
+	};
+	gitlabForgeAdapter = {
+		forge: "gitlab",
+		async createReviewArtifact(input) {
+			const existing = await getExistingGitLabArtifact(input.sourceBranch, input.cwd, input.repository);
+			if (existing) return existing;
+			const bodyEnv = input.body ? { PAN_MR_BODY: input.body } : {};
+			const bodyFlag = input.body ? " --description \"$PAN_MR_BODY\"" : "";
+			let stdout;
+			try {
+				({stdout} = await execAsync(`glab mr create --source-branch ${input.sourceBranch} --target-branch ${input.targetBranch} --title "${input.title}"${bodyFlag}${buildRepositoryFlag(input.repository)}`, {
+					cwd: input.cwd,
+					encoding: "utf-8",
+					env: {
+						...process.env,
+						...bodyEnv
+					},
+					shell: "/bin/bash"
+				}));
+			} catch (error) {
+				const message = String(error?.message ?? error);
+				if (message.includes("409") && message.includes("open merge request already exists")) {
+					const existingAfterConflict = await getExistingGitLabArtifact(input.sourceBranch, input.cwd, input.repository);
+					if (existingAfterConflict) return existingAfterConflict;
+				}
+				throw error;
+			}
+			return {
+				forge: "gitlab",
+				created: true,
+				url: stdout.trim().split("\n").pop()?.trim() || stdout.trim(),
+				id: (await getExistingGitLabArtifact(input.sourceBranch, input.cwd, input.repository))?.id
+			};
+		},
+		async mergeReviewArtifact(input) {
+			const target = buildGitLabReviewTarget(input);
+			const squashFlag = input.method === "squash" || !input.method ? " --squash" : "";
+			await execAsync(`glab mr merge ${target}${buildRepositoryFlag(input.repository)}${squashFlag}`, {
+				cwd: input.cwd,
+				encoding: "utf-8"
+			});
+		},
+		async commentOnArtifact(input) {
+			const target = buildGitLabReviewTarget(input);
+			await withBodyFile(input.body, "pan-gl-mr-comment", async (bodyFile) => {
+				const bodyFlag = bodyFile ? ` --message-file "${bodyFile}"` : ` --message "${input.body.replace(/"/g, "\\\"")}"`;
+				await execAsync(`glab mr note ${target}${buildRepositoryFlag(input.repository)}${bodyFlag}`, {
+					cwd: input.cwd,
+					encoding: "utf-8"
+				});
+			});
+		},
+		async approveReviewArtifact(input) {
+			await execAsync(`glab mr approve ${buildGitLabReviewTarget(input)}${buildRepositoryFlag(input.repository)}`, {
+				cwd: input.cwd,
+				encoding: "utf-8"
+			});
+		},
+		async discoverArtifact(input) {
+			return getExistingGitLabArtifact(input.sourceBranch, input.cwd, input.repository);
+		},
+		async findMergedArtifact(input) {
+			return findMergedGitLabArtifact(input);
+		}
+	};
+}));
+//#endregion
+export { parseArtifactRef as i, getForgeAdapter as n, init_forge as r, GITHUB_MERGE_TIMEOUT_MS as t };
+
+//# sourceMappingURL=forge-CZbSg6Ds.js.map

package/server/forge-DK3blQb_.js

@@ -0,0 +1,3 @@
+import { n as getForgeAdapter, r as init_forge } from "./forge-CZbSg6Ds.js";
+init_forge();
+export { getForgeAdapter };

package/server/{from-kNxT0bZC.js → from-D_4_dk7i.js}

@@ -3841,4 +3841,4 @@ var init_from = __esmMin((() => {
 //#endregion
 export { File as a, init_esm_min as i, FormData as n, Blob as o, formDataToBlob as r, init_fetch_blob as s, init_from as t };
 
-//# sourceMappingURL=from-kNxT0bZC.js.map
+//# sourceMappingURL=from-D_4_dk7i.js.map

package/server/{fts-db-CE46vDkZ.js → fts-db-BeOomFa-.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { a as runMemoryFtsTransactionSync, i as runMemoryFtsStatementSync, n as getMemoryFtsDatabaseSync, r as init_fts_operations, t as closeMemoryFtsDatabasesInProcess } from "./fts-operations-CqY6zl-i.js";
+import { a as runMemoryFtsTransactionSync, i as runMemoryFtsStatementSync, n as getMemoryFtsDatabaseSync, r as init_fts_operations, t as closeMemoryFtsDatabasesInProcess } from "./fts-operations-BdewJ_g9.js";
 import { Worker } from "node:worker_threads";
 //#region ../../lib/memory/fts-db.ts
 async function getMemoryFtsDatabase(projectId) {
@@ -143,4 +143,4 @@ var init_fts_db = __esmMin((() => {
 //#endregion
 export { withMemoryFtsDatabase as a, runMemoryFtsTransaction as i, init_fts_db as n, runMemoryFtsStatement as r, closeMemoryFtsDatabases as t };
 
-//# sourceMappingURL=fts-db-CE46vDkZ.js.map
+//# sourceMappingURL=fts-db-BeOomFa-.js.map

package/server/{fts-operations-CqY6zl-i.js → fts-operations-BdewJ_g9.js}

@@ -1,6 +1,6 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
 import { n as openDatabase, t as init_driver } from "./driver-CKVGi51s.js";
-import { i as init_paths, o as resolveFtsDbPath } from "./paths-D-xWGHdh.js";
+import { i as init_paths, o as resolveFtsDbPath } from "./paths-cXmOwSbh.js";
 import { dirname } from "node:path";
 import { mkdirSync } from "node:fs";
 //#region ../../lib/memory/fts-operations.ts
@@ -131,4 +131,4 @@ var init_fts_operations = __esmMin((() => {
 //#endregion
 export { runMemoryFtsTransactionSync as a, runMemoryFtsStatementSync as i, getMemoryFtsDatabaseSync as n, init_fts_operations as r, closeMemoryFtsDatabasesInProcess as t };
 
-//# sourceMappingURL=fts-operations-CqY6zl-i.js.map
+//# sourceMappingURL=fts-operations-BdewJ_g9.js.map

package/server/git-utils-CI6cwyyC.js

@@ -0,0 +1,3 @@
+import { a as init_git_utils, c as rehydrateHeadAnchor, i as hasStaleLocks, l as renderWorkspaceGitShowPromise, n as formatAnchorShort, o as parseCompositeSnapshot, r as getWorkspaceGitInfo, s as parseWorkspaceHeadAnchor, t as cleanupStaleLocks, u as snapshotWorkspaceHeadsPromise } from "./git-utils-ameCgDdy.js";
+init_git_utils();
+export { cleanupStaleLocks, formatAnchorShort, getWorkspaceGitInfo, hasStaleLocks, parseCompositeSnapshot, parseWorkspaceHeadAnchor, rehydrateHeadAnchor, renderWorkspaceGitShowPromise, snapshotWorkspaceHeadsPromise };

package/server/{git-utils-CRw2zLPC.js → git-utils-ameCgDdy.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { ar as GitError, ir as FsError, mr as init_errors } from "./config-yaml-DySPNmKN.js";
+import { Er as GitError, Fr as init_errors, Tr as FsError } from "./config-yaml-CmOPzmBb.js";
 import { Effect } from "effect";
 import { existsSync, readdirSync, unlinkSync } from "fs";
 import { join } from "path";
@@ -171,7 +171,7 @@ async function renderWorkspaceGitShowPromise(issueId, workspacePath, anchor, arg
 	const entries = parseWorkspaceHeadAnchor(anchor);
 	if (!entries) return gitShow(workspacePath, anchor.trim(), args);
 	if (!issueId) throw new Error(`Cannot resolve composite workspace head anchor '${anchor}' without an issue id`);
-	const { resolveWorkspaceRepoRootsSync } = await import("./project-repos-DXKQsc_m.js");
+	const { resolveWorkspaceRepoRootsSync } = await import("./project-repos-CRE6Ykow.js");
 	const rootsByKey = new Map(resolveWorkspaceRepoRootsSync(issueId, workspacePath).map((root) => [root.repoKey, root]));
 	return (await Promise.all(entries.map(async ({ repoKey, sha }) => {
 		const root = rootsByKey.get(repoKey);
@@ -191,6 +191,27 @@ async function getWorkspaceGitInfoPromise(workspacePath) {
 		throw new Error(`getWorkspaceGitInfo failed for ${workspacePath}: ${msg}`);
 	}
 }
+/** Rehydrate a persisted anchor after it crosses an unbranded storage boundary. */
+function rehydrateHeadAnchor(anchor) {
+	return anchor;
+}
+function parseCompositeSnapshot(snapshot) {
+	const heads = /* @__PURE__ */ new Map();
+	if (!snapshot) return heads;
+	for (const token of snapshot.split(/\s+/)) {
+		const separator = token.lastIndexOf("@");
+		if (separator <= 0 || separator === token.length - 1) continue;
+		heads.set(token.slice(0, separator), token.slice(separator + 1));
+	}
+	return heads;
+}
+function formatAnchorShort(anchor) {
+	return anchor.split(/\s+/).map((token) => {
+		const separator = token.lastIndexOf("@");
+		if (separator <= 0 || separator === token.length - 1) return token.substring(0, 8);
+		return `${token.slice(0, separator)}@${token.slice(separator + 1, separator + 9)}`;
+	}).join(" ");
+}
 /**
 * Snapshot the code HEAD(s) of a workspace for drift comparison (PAN-2948).
 *
@@ -202,9 +223,13 @@ async function getWorkspaceGitInfoPromise(workspacePath) {
 * "no drift" forever. Composite snapshots compare equal iff every sub-repo
 * head is unchanged; consumers that try to use the anchor as a git ref fail
 * the ref lookup and fall back to their conservative full-rerun path.
+*
+* Its branded return value is the only legitimate source for reviewedAtCommit,
+* lastVerifiedCommit, and roleRunHead. Persisted values regain that brand only
+* through rehydrateHeadAnchor at an explicitly documented storage boundary.
 */
 async function snapshotWorkspaceHeadsPromise(issueId, workspacePath) {
-	const { resolveWorkspaceRepoRootsSync } = await import("./project-repos-DXKQsc_m.js");
+	const { resolveWorkspaceRepoRootsSync } = await import("./project-repos-CRE6Ykow.js");
 	const roots = resolveWorkspaceRepoRootsSync(issueId, workspacePath);
 	const isPolyrepo = roots.some((root) => root.isPolyrepo);
 	const heads = [];
@@ -258,6 +283,6 @@ var init_git_utils = __esmMin((() => {
 	hasStaleLocks = (repoPath) => Effect.promise(() => hasStaleLocksPromise(repoPath));
 }));
 //#endregion
-export { parseWorkspaceHeadAnchor as a, init_git_utils as i, getWorkspaceGitInfo as n, renderWorkspaceGitShowPromise as o, hasStaleLocks as r, snapshotWorkspaceHeadsPromise as s, cleanupStaleLocks as t };
+export { init_git_utils as a, rehydrateHeadAnchor as c, hasStaleLocks as i, renderWorkspaceGitShowPromise as l, formatAnchorShort as n, parseCompositeSnapshot as o, getWorkspaceGitInfo as r, parseWorkspaceHeadAnchor as s, cleanupStaleLocks as t, snapshotWorkspaceHeadsPromise as u };
 
-//# sourceMappingURL=git-utils-CRw2zLPC.js.map
+//# sourceMappingURL=git-utils-ameCgDdy.js.map

package/server/{github-app-C3QrAUd0.js → github-app-CQ1Lo6LA.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { ir as FsError, mr as init_errors, or as GitHubApiError, rr as ConfigError } from "./config-yaml-DySPNmKN.js";
+import { Dr as GitHubApiError, Fr as init_errors, Tr as FsError, wr as ConfigError } from "./config-yaml-CmOPzmBb.js";
 import { Effect } from "effect";
 import { existsSync, readFileSync } from "fs";
 import { join } from "path";
@@ -200,7 +200,7 @@ function generateJWT(appId, privateKey) {
 	})).toString("base64url");
 	const payload = Buffer.from(JSON.stringify({
 		iat: now - 60,
-		exp: now + 600,
+		exp: now + 540,
 		iss: appId
 	})).toString("base64url");
 	const signer = createSign("SHA256");
@@ -664,4 +664,4 @@ var init_github_app = __esmMin((() => {
 //#endregion
 export { createSettledTtlPromiseCache as A, postOverdeckTestsStatus as C, init_advisory_checks as D, verifyAppCanMerge as E, withConcurrencyLimit as M, withConcurrencyLimitPromise as N, isAdvisoryCheckName as O, parsePullRequestRef as S, reportCommitStatus as T, listOpenIssuesWithLabelsPromise as _, getCiCheckRunsState as a, loadGitHubAppConfig as b, getIssueStatePromise as c, getPullRequestState as d, init_github_app as f, listOpenIssuesWithLabels as g, listIssuesWithAnyLabelPromise as h, getBotIdentity as i, init_concurrency as j, createPromiseConcurrencyLimiter as k, getMergeBackendStatus as l, isIntegrationPermissionError as m, generateInstallationToken as n, getCiCheckRunsStatePromise as o, isGitHubAppConfigured as p, getAppStatus as r, getIssueState as s, configureWorkspaceForBot as t, getPullRequestHeadState as u, listPullRequestsForHead as v, refreshWorkspaceToken as w, mergePullRequestWithApp as x, listPullRequestsForHeadPromise as y };
 
-//# sourceMappingURL=github-app-C3QrAUd0.js.map
+//# sourceMappingURL=github-app-CQ1Lo6LA.js.map

package/server/{github-app-ClZ2lk8D.js → github-app-DtAsvwzK.js}

@@ -1,3 +1,3 @@
-import { C as postOverdeckTestsStatus, E as verifyAppCanMerge, S as parsePullRequestRef, T as reportCommitStatus, _ as listOpenIssuesWithLabelsPromise, a as getCiCheckRunsState, b as loadGitHubAppConfig, c as getIssueStatePromise, d as getPullRequestState, f as init_github_app, g as listOpenIssuesWithLabels, h as listIssuesWithAnyLabelPromise, i as getBotIdentity, l as getMergeBackendStatus, m as isIntegrationPermissionError, n as generateInstallationToken, o as getCiCheckRunsStatePromise, p as isGitHubAppConfigured, r as getAppStatus, s as getIssueState, t as configureWorkspaceForBot, u as getPullRequestHeadState, v as listPullRequestsForHead, w as refreshWorkspaceToken, x as mergePullRequestWithApp, y as listPullRequestsForHeadPromise } from "./github-app-C3QrAUd0.js";
+import { C as postOverdeckTestsStatus, E as verifyAppCanMerge, S as parsePullRequestRef, T as reportCommitStatus, _ as listOpenIssuesWithLabelsPromise, a as getCiCheckRunsState, b as loadGitHubAppConfig, c as getIssueStatePromise, d as getPullRequestState, f as init_github_app, g as listOpenIssuesWithLabels, h as listIssuesWithAnyLabelPromise, i as getBotIdentity, l as getMergeBackendStatus, m as isIntegrationPermissionError, n as generateInstallationToken, o as getCiCheckRunsStatePromise, p as isGitHubAppConfigured, r as getAppStatus, s as getIssueState, t as configureWorkspaceForBot, u as getPullRequestHeadState, v as listPullRequestsForHead, w as refreshWorkspaceToken, x as mergePullRequestWithApp, y as listPullRequestsForHeadPromise } from "./github-app-CQ1Lo6LA.js";
 init_github_app();
 export { configureWorkspaceForBot, generateInstallationToken, getAppStatus, getBotIdentity, getCiCheckRunsState, getCiCheckRunsStatePromise, getIssueState, getIssueStatePromise, getMergeBackendStatus, getPullRequestHeadState, getPullRequestState, isGitHubAppConfigured, isIntegrationPermissionError, listIssuesWithAnyLabelPromise, listOpenIssuesWithLabels, listOpenIssuesWithLabelsPromise, listPullRequestsForHead, listPullRequestsForHeadPromise, loadGitHubAppConfig, mergePullRequestWithApp, parsePullRequestRef, postOverdeckTestsStatus, refreshWorkspaceToken, reportCommitStatus, verifyAppCanMerge };

package/server/{github-client-BnIsSrEN.js → github-client-BfyDxuRN.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { a as init_tracker_config, t as getGitHubConfig } from "./tracker-config-G6latr8C.js";
+import { a as init_tracker_config, t as getGitHubConfig } from "./tracker-config-DZ8Zn2nQ.js";
 import { a as RateLimited, c as TrackerNotConfigured, d as init_typed_errors, r as IssueNotFound, s as TrackerApiError } from "./typed-errors-2BTMxkZq.js";
 import { Context, Effect, Layer } from "effect";
 //#region services/github-client.ts
@@ -241,4 +241,4 @@ var init_github_client = __esmMin((() => {
 //#endregion
 export { init_github_client as i, GitHubClientLive as n, GitHubClientOptionalLive as r, GitHubClient as t };
 
-//# sourceMappingURL=github-client-BnIsSrEN.js.map
+//# sourceMappingURL=github-client-BfyDxuRN.js.map

package/server/{github-client-DfQYVUaw.js → github-client-Cj0yl_07.js}

@@ -1,3 +1,3 @@
-import { i as init_github_client, n as GitHubClientLive, r as GitHubClientOptionalLive, t as GitHubClient } from "./github-client-BnIsSrEN.js";
+import { i as init_github_client, n as GitHubClientLive, r as GitHubClientOptionalLive, t as GitHubClient } from "./github-client-BfyDxuRN.js";
 init_github_client();
 export { GitHubClient, GitHubClientLive, GitHubClientOptionalLive };

package/server/github-pr-lookup-BDq6Wznz.js

@@ -0,0 +1,58 @@
+import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
+import { f as init_github_app, p as isGitHubAppConfigured, v as listPullRequestsForHead } from "./github-app-CQ1Lo6LA.js";
+import { Effect } from "effect";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+//#region ../../lib/github-pr-lookup.ts
+function githubPrLookupSource() {
+	return isGitHubAppConfigured() ? "GitHub App PR lookup" : "gh pr list";
+}
+async function lookupPullRequestForBranch(owner, repo, branchName) {
+	if (isGitHubAppConfigured()) {
+		const pr = (await Effect.runPromise(listPullRequestsForHead(owner, repo, branchName, "all")))[0];
+		if (!pr) return null;
+		return {
+			number: pr.number,
+			state: pr.merged ? "MERGED" : pr.state.toUpperCase(),
+			mergedAt: pr.mergedAt
+		};
+	}
+	const { stdout } = await execFileAsync("gh", [
+		"pr",
+		"list",
+		"--repo",
+		`${owner}/${repo}`,
+		"--head",
+		branchName,
+		"--state",
+		"all",
+		"--json",
+		"number,state,mergedAt",
+		"--limit",
+		"1"
+	], {
+		encoding: "utf-8",
+		timeout: 15e3
+	});
+	const trimmed = stdout.trim();
+	if (!trimmed) return null;
+	const [pr] = JSON.parse(trimmed);
+	if (!pr || !Number.isFinite(pr.number)) return null;
+	return {
+		number: pr.number,
+		state: typeof pr.state === "string" ? pr.state.toUpperCase() : "CLOSED",
+		mergedAt: typeof pr.mergedAt === "string" ? pr.mergedAt : null
+	};
+}
+async function lookupPullRequestNumberForBranch(owner, repo, branchName) {
+	return (await lookupPullRequestForBranch(owner, repo, branchName))?.number ?? null;
+}
+var execFileAsync;
+var init_github_pr_lookup = __esmMin((() => {
+	init_github_app();
+	execFileAsync = promisify(execFile);
+}));
+//#endregion
+export { lookupPullRequestNumberForBranch as i, init_github_pr_lookup as n, lookupPullRequestForBranch as r, githubPrLookupSource as t };
+
+//# sourceMappingURL=github-pr-lookup-BDq6Wznz.js.map

package/server/{harness-binary-DPUi-Pv8.js → harness-binary-DqkftwTb.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { f as loadConfigSync, t as init_config_yaml } from "./config-yaml-DySPNmKN.js";
+import { f as loadConfigSync, t as init_config_yaml } from "./config-yaml-CmOPzmBb.js";
 import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
 import { homedir } from "node:os";
 import { constants } from "node:fs";
@@ -129,4 +129,4 @@ var init_harness_binary = __esmMin((() => {
 //#endregion
 export { resolveExecutable as a, prepareHarnessLaunch as i, harnessBinaryName as n, resolveHarnessBinary as o, init_harness_binary as r, configuredHarnessBinaryPath as t };
 
-//# sourceMappingURL=harness-binary-DPUi-Pv8.js.map
+//# sourceMappingURL=harness-binary-DqkftwTb.js.map

package/server/{harness-resolve-3lNZkyT4.js → harness-resolve-CqMqM1Mb.js}

@@ -1,9 +1,9 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { A as canUseHarnessSync, H as init_providers, M as init_harness_policy, R as getBuiltInDefaultHarness, V as getProviderForModelSync, f as loadConfigSync, j as canUseModelWithAuthSync, t as init_config_yaml } from "./config-yaml-DySPNmKN.js";
-import { n as harnessBinaryName, o as resolveHarnessBinary, r as init_harness_binary, t as configuredHarnessBinaryPath } from "./harness-binary-DPUi-Pv8.js";
+import { A as canUseHarnessSync, H as init_providers, M as init_harness_policy, R as getBuiltInDefaultHarness, V as getProviderForModelSync, f as loadConfigSync, j as canUseModelWithAuthSync, t as init_config_yaml } from "./config-yaml-CmOPzmBb.js";
+import { n as harnessBinaryName, o as resolveHarnessBinary, r as init_harness_binary, t as configuredHarnessBinaryPath } from "./harness-binary-DqkftwTb.js";
 //#region ../../lib/harness-resolve.ts
 async function getProviderAuthModeForModel(model) {
-	const { getProviderAuthMode } = await import("./agents-wi9NWzs2.js");
+	const { getProviderAuthMode } = await import("./agents-BKKkxKgK.js");
 	return getProviderAuthMode(model);
 }
 function assertHarnessProviderSupported(harness, provider) {
@@ -72,4 +72,4 @@ var init_harness_resolve = __esmMin((() => {
 //#endregion
 export { resolveHarness as n, init_harness_resolve as t };
 
-//# sourceMappingURL=harness-resolve-3lNZkyT4.js.map
+//# sourceMappingURL=harness-resolve-CqMqM1Mb.js.map

package/server/{health-events-BBcTYQKU.js → health-events-CazRxJUS.js}

@@ -1,4 +1,4 @@
-import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-BEqFxlJc.js";
+import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-BjuxvjdS.js";
 //#region ../../lib/overdeck/health-events.ts
 init_infra();
 function parseMetadata(row) {
@@ -66,4 +66,4 @@ function getHealthHistory(agentId, startTime, endTime) {
 //#endregion
 export { getLatestHealthEvent as n, writeHealthEvent as r, getHealthHistory as t };
 
-//# sourceMappingURL=health-events-BBcTYQKU.js.map
+//# sourceMappingURL=health-events-CazRxJUS.js.map

package/server/{health-events-BDOHby5Q.js → health-events-_xfTaOUs.js}

@@ -1,2 +1,2 @@
-import { n as getLatestHealthEvent, r as writeHealthEvent, t as getHealthHistory } from "./health-events-BBcTYQKU.js";
+import { n as getLatestHealthEvent, r as writeHealthEvent, t as getHealthHistory } from "./health-events-CazRxJUS.js";
 export { getHealthHistory, getLatestHealthEvent, writeHealthEvent };