@overdeck/desktop 0.50.0 → 0.50.3

package/server/rebuild-stack-xdGFthJn.js

@@ -0,0 +1,370 @@
+import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
+import { On as resolveProjectFromIssueSync, fn as init_projects, on as getProjectSync } from "./config-yaml-Dce9VUd6.js";
+import { c as init_stack_health, m as recordDockerContainerLifecycleSnapshot, n as collectDockerContainerLifecycleSnapshot, p as init_docker_stats, r as composeProjectNameForWorkspace, s as hasIssueToken, u as requireComposeProjectNameForWorkspace } from "./stack-health-Y8O3UuPe.js";
+import { n as init_issue_closed, r as isIssueClosed } from "./issue-closed-D7aMUeMq.js";
+import { n as reconcileTraefikNetworks, t as init_traefik_connect } from "./traefik-connect-BZWNRHOd.js";
+import { n as ensureDevcontainerSync, r as init_ensure_devcontainer } from "./ensure-devcontainer-C2rKQXgr.js";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { Effect } from "effect";
+import { homedir } from "node:os";
+import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync, rmSync } from "node:fs";
+import { lstat, readdir, realpath, rm } from "node:fs/promises";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+//#region ../../lib/workspace-manager/remove-directory.ts
+async function defaultDockerClean(path) {
+	await execFileAsync$2("docker", [
+		"run",
+		"--rm",
+		"-v",
+		`${path}:/cleanup`,
+		"alpine",
+		"sh",
+		"-c",
+		"rm -rf /cleanup/* /cleanup/.[!.]* /cleanup/..?* 2>/dev/null || true"
+	], {
+		timeout: DOCKER_CLEAN_TIMEOUT_MS,
+		maxBuffer: 10 * 1024 * 1024
+	});
+}
+async function removeWorkspaceDirectory(path, deps = {}) {
+	const resolved = resolve(path);
+	const lstatFn = deps.lstat ?? lstat;
+	let stat;
+	try {
+		stat = await lstatFn(resolved);
+	} catch (error) {
+		if (error?.code === "ENOENT") return;
+		throw error;
+	}
+	const real = stat.isSymbolicLink() ? null : await realpath(resolved);
+	if (!isAbsolute(path) || stat.isSymbolicLink() || !stat.isDirectory() || real === null || real === "/" || real === homedir() || !real.includes("/workspaces/")) throw new Error(`refusing to remove ${JSON.stringify(path)}: removeWorkspaceDirectory only removes real directories resolved inside a workspaces/ tree (never a symlink, /, or the home directory)`);
+	const rmDir = deps.rm ?? ((target) => rm(target, {
+		recursive: true,
+		force: true
+	}));
+	try {
+		await rmDir(resolved);
+		return;
+	} catch (firstError) {
+		const dockerClean = deps.dockerClean ?? defaultDockerClean;
+		try {
+			await dockerClean(resolved);
+		} catch (dockerError) {
+			throw new Error(`removing ${resolved} failed (${firstError instanceof Error ? firstError.message : String(firstError)}) and the Docker fallback for root-owned container artifacts also failed (${dockerError instanceof Error ? dockerError.message : String(dockerError)})`);
+		}
+		await rmDir(resolved);
+	}
+}
+var execFileAsync$2, DOCKER_CLEAN_TIMEOUT_MS;
+var init_remove_directory = __esmMin((() => {
+	execFileAsync$2 = promisify(execFile);
+	DOCKER_CLEAN_TIMEOUT_MS = 12e4;
+}));
+//#endregion
+//#region ../../lib/workspace/rebuild-bind-mounts.ts
+/**
+* Repair host paths that a rendered workspace Compose stack bind-mounts.
+*
+* Docker creates a missing bind source as root before the service user starts.
+* In a polyrepo workspace that turns an already-merged/removed repo checkout
+* into an unwritable empty directory. Containers can also leave root-owned
+* dependency caches inside an otherwise valid checkout. Rebuild repairs both
+* forms before `docker compose up` gets a chance to preserve or recreate them.
+*/
+function composeReferencesRepo(composeContent, workspacePath, repo) {
+	return [`../${repo.name}`, join(workspacePath, repo.name)].some((candidate) => {
+		const escaped = candidate.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+		return new RegExp(`${escaped}(?=[:/\\s'"]|$)`).test(composeContent);
+	});
+}
+async function findOwnershipMismatch(path, expectedUid, expectedGid) {
+	const stat = await lstat(path);
+	if (stat.uid !== expectedUid || stat.gid !== expectedGid) return {
+		path,
+		uid: stat.uid,
+		gid: stat.gid
+	};
+	if (!stat.isDirectory() || stat.isSymbolicLink()) return null;
+	for (const entry of await readdir(path)) {
+		const mismatch = await findOwnershipMismatch(join(path, entry), expectedUid, expectedGid);
+		if (mismatch) return mismatch;
+	}
+	return null;
+}
+function repoBranch(repo, issueId) {
+	return `${repo.branch_prefix || "feature/"}${issueId.toLowerCase()}`;
+}
+function repoSourcePath(projectConfig, repo) {
+	const rawPath = join(projectConfig.path, repo.path);
+	return existsSync(rawPath) ? realpathSync(rawPath) : rawPath;
+}
+function assertOnlyDisposableResidue(targetPath) {
+	const unsafe = readdirSync(targetPath).filter((entry) => !DISPOSABLE_CACHE_DIRS.has(entry));
+	if (unsafe.length > 0) throw new Error(`Cannot restore missing workspace repo at ${targetPath}: the unregistered directory contains ${unsafe.join(", ")}. Preserve or remove those files, then retry the rebuild.`);
+}
+async function repairRepoCaches(targetPath, repairOwnership, progress, findMismatch) {
+	const owner = lstatSync(targetPath);
+	for (const cacheName of DISPOSABLE_CACHE_DIRS) {
+		const cachePath = join(targetPath, cacheName);
+		if (!existsSync(cachePath) || lstatSync(cachePath).isSymbolicLink()) continue;
+		const mismatch = await findMismatch(cachePath, owner.uid, owner.gid);
+		if (!mismatch) continue;
+		progress(`Repairing ownership for ${relative(targetPath, cachePath)} cache (found uid:gid ${mismatch.uid}:${mismatch.gid} at ${mismatch.path})...`);
+		try {
+			await repairOwnership(cachePath, owner.uid, owner.gid);
+		} catch (error) {
+			throw new Error(`Could not repair ownership at ${mismatch.path} (uid:gid ${mismatch.uid}:${mismatch.gid}); the workspace checkout expects ${owner.uid}:${owner.gid}. Restore that cache's ownership with chown or remove the disposable ${cacheName} directory, then retry. ${error instanceof Error ? error.message : String(error)}`);
+		}
+	}
+}
+async function repairCacheOwnership(path, uid, gid) {
+	const real = realpathSync(path);
+	const stat = lstatSync(path);
+	if (stat.isSymbolicLink() || !stat.isDirectory() || !real.includes("/workspaces/") || !DISPOSABLE_CACHE_DIRS.has(basename(real))) throw new Error(`Refusing ownership repair outside a real workspace dependency-cache directory: ${path}`);
+	await execFileAsync$1("docker", [
+		"run",
+		"--rm",
+		"-v",
+		`${real}:/repair`,
+		"alpine",
+		"chown",
+		"-R",
+		`${uid}:${gid}`,
+		"/repair"
+	], {
+		timeout: 12e4,
+		maxBuffer: 10 * 1024 * 1024
+	});
+}
+/** Restore referenced polyrepo checkouts and heal their disposable caches. */
+async function repairWorkspaceBindMounts(options, deps = {}) {
+	const repos = options.projectConfig.workspace?.repos;
+	if (options.projectConfig.workspace?.type !== "polyrepo" || !repos?.length) return;
+	const composeContent = readFileSync(options.composeFile, "utf-8");
+	const progress = options.onProgress ?? (() => {});
+	const removeDirectory = deps.removeDirectory ?? removeWorkspaceDirectory;
+	const createRepoWorktree = deps.createRepoWorktree ?? (async (...args) => {
+		const { createWorktree } = await import("./worktree-ops-CV-pRvyW.js");
+		return createWorktree(...args);
+	});
+	const findMismatch = deps.findOwnershipMismatch ?? findOwnershipMismatch;
+	const repairOwnership = deps.repairOwnership ?? repairCacheOwnership;
+	for (const repo of repos.filter((repo) => composeReferencesRepo(composeContent, options.workspacePath, repo))) {
+		const targetPath = join(options.workspacePath, repo.name);
+		if (repo.link_type === "symlink") continue;
+		if (!existsSync(join(targetPath, ".git"))) {
+			if (existsSync(targetPath)) {
+				if (lstatSync(targetPath).isSymbolicLink()) throw new Error(`Cannot restore missing workspace repo at ${targetPath}: the path is a symlink.`);
+				assertOnlyDisposableResidue(targetPath);
+				await removeDirectory(targetPath);
+			}
+			progress(`Restoring missing ${repo.name} workspace checkout before Docker bind-mounts it...`);
+			const result = await createRepoWorktree(repoSourcePath(options.projectConfig, repo), targetPath, repoBranch(repo, options.issueId), repo.default_branch || options.projectConfig.workspace?.default_branch || "main");
+			if (!result.success) throw new Error(`Could not restore ${repo.name} workspace checkout: ${result.message}`);
+		}
+		await repairRepoCaches(targetPath, repairOwnership, progress, findMismatch);
+	}
+}
+var DISPOSABLE_CACHE_DIRS, execFileAsync$1;
+var init_rebuild_bind_mounts = __esmMin((() => {
+	init_remove_directory();
+	DISPOSABLE_CACHE_DIRS = new Set(["node_modules", ".pnpm-store"]);
+	execFileAsync$1 = promisify(execFile);
+}));
+//#endregion
+//#region ../../lib/workspace/rebuild-stack.ts
+/**
+* Workspace docker-stack rebuild — the library primitive behind
+* `pan workspace rebuild` and the deacon's orphan-test self-heal.
+*
+* Tears the stack down (`docker compose down -v --remove-orphans`), re-renders
+* `<workspace>/.devcontainer/` from the project compose template, and brings
+* the stack back up (`docker compose up -d --build`).
+*
+* This module is host/CLI-safe: it never calls `process.exit` and never writes
+* to a terminal. The CLI command wraps it for spinner/exit handling; the deacon
+* calls it directly during patrol recovery.
+*
+* PAN-1249: migrated to Effect. External entry point `rebuildWorkspaceStack`
+* returns `Effect.Effect<RebuildWorkspaceStackResult>` (errors are encoded in
+* the result, not the error channel, to preserve the existing API contract
+* where callers branch on `success`).
+*/
+function findDevcontainerComposeFile(workspacePath) {
+	const devcontainerDir = join(workspacePath, ".devcontainer");
+	for (const file of COMPOSE_FILES) {
+		const fullPath = join(devcontainerDir, file);
+		if (existsSync(fullPath)) return fullPath;
+	}
+	return null;
+}
+var execFileAsync, COMPOSE_FILES, dockerCompose, EXTERNAL_WORKSPACE_NETWORK, ensureExternalNetwork, removeStaleIssueContainers, rebuildWorkspaceStack;
+var init_rebuild_stack = __esmMin((() => {
+	init_docker_stats();
+	init_projects();
+	init_issue_closed();
+	init_ensure_devcontainer();
+	init_stack_health();
+	init_traefik_connect();
+	init_rebuild_bind_mounts();
+	execFileAsync = promisify(execFile);
+	COMPOSE_FILES = [
+		"docker-compose.devcontainer.yml",
+		"docker-compose.yml",
+		"docker-compose.yaml",
+		"compose.yml",
+		"compose.yaml"
+	];
+	dockerCompose = (args, cwd) => Effect.tryPromise({
+		try: () => execFileAsync("docker", ["compose", ...args], {
+			cwd,
+			encoding: "utf-8",
+			timeout: 3e5,
+			maxBuffer: 10 * 1024 * 1024
+		}).then(() => void 0),
+		catch: (err) => err instanceof Error ? err : new Error(String(err))
+	});
+	EXTERNAL_WORKSPACE_NETWORK = "overdeck";
+	ensureExternalNetwork = () => Effect.promise(() => execFileAsync("docker", [
+		"network",
+		"create",
+		EXTERNAL_WORKSPACE_NETWORK
+	], { timeout: 3e4 }).then(() => void 0).catch(() => void 0));
+	removeStaleIssueContainers = (issueId, composeProjectName) => Effect.promise(async () => {
+		const containers = await Effect.runPromise(collectDockerContainerLifecycleSnapshot());
+		let removed = 0;
+		for (const container of containers) {
+			if (container.composeProject === composeProjectName) continue;
+			if (!hasIssueToken(container.name, issueId)) continue;
+			if (container.state?.toLowerCase() === "running" || /^up\b/i.test(container.status)) continue;
+			if (await execFileAsync("docker", [
+				"rm",
+				"-f",
+				container.id
+			], { timeout: 3e4 }).then(() => true).catch(() => false)) removed += 1;
+		}
+		return removed;
+	});
+	rebuildWorkspaceStack = (issueId, options = {}) => {
+		const progress = options.onProgress ?? (() => {});
+		const normalizedIssueId = issueId.toLowerCase();
+		const resolvedProject = resolveProjectFromIssueSync(issueId);
+		const projectConfig = resolvedProject ? getProjectSync(resolvedProject.projectKey) : null;
+		if (!resolvedProject || !projectConfig) return Effect.succeed({
+			success: false,
+			error: `No project found for issue ${issueId}`
+		});
+		if (!projectConfig.workspace?.docker?.compose_template) return Effect.succeed({
+			success: false,
+			error: `Project ${projectConfig.name} has no workspace docker compose_template configured`
+		});
+		const workspacePath = join(resolvedProject.projectPath, projectConfig.workspace?.workspaces_dir ?? "workspaces", `feature-${normalizedIssueId}`);
+		if (!existsSync(workspacePath)) return Effect.succeed({
+			success: false,
+			error: `Workspace not found: ${workspacePath}`
+		});
+		return Effect.gen(function* () {
+			const closed = yield* Effect.promise(() => isIssueClosed(issueId));
+			const reviewStatus = closed ? null : yield* Effect.promise(async () => {
+				const { resolveCanonicalReviewStatus } = await import("./review-status-source-D2PCWS6E.js");
+				return resolveCanonicalReviewStatus(issueId);
+			});
+			if (closed || reviewStatus?.status?.mergeStatus === "merged") return {
+				success: false,
+				error: "Issue is terminal (closed/merged) — skipping stack rebuild"
+			};
+			if (!reviewStatus?.available) return {
+				success: false,
+				error: "Issue terminal status is unavailable — skipping stack rebuild"
+			};
+			let preRenderComposeProjectName = null;
+			try {
+				preRenderComposeProjectName = composeProjectNameForWorkspace(workspacePath, normalizedIssueId);
+			} catch {
+				progress("Current devcontainer state has a conflicting declaration — skipping pre-render teardown.");
+			}
+			const existingComposeFile = findDevcontainerComposeFile(workspacePath);
+			if (existingComposeFile && preRenderComposeProjectName) {
+				progress("Tearing down existing workspace stack...");
+				yield* dockerCompose([
+					"-f",
+					existingComposeFile,
+					"-p",
+					preRenderComposeProjectName,
+					"down",
+					"-v",
+					"--remove-orphans"
+				], dirname(existingComposeFile));
+			}
+			progress("Re-rendering .devcontainer/ from template...");
+			const devcontainerDir = join(workspacePath, ".devcontainer");
+			if (existsSync(devcontainerDir)) rmSync(devcontainerDir, {
+				recursive: true,
+				force: true
+			});
+			const ensured = ensureDevcontainerSync({
+				workspacePath,
+				issueId: normalizedIssueId
+			});
+			if (!ensured.step.success) return {
+				success: false,
+				error: ensured.step.error ?? "Failed to render .devcontainer/",
+				workspacePath
+			};
+			const composeFile = findDevcontainerComposeFile(workspacePath);
+			if (!composeFile) return {
+				success: false,
+				error: `No devcontainer compose file found in ${devcontainerDir}`,
+				workspacePath
+			};
+			progress("Repairing workspace bind mounts...");
+			yield* Effect.promise(() => repairWorkspaceBindMounts({
+				workspacePath,
+				issueId: normalizedIssueId,
+				projectConfig,
+				composeFile,
+				onProgress: progress
+			}));
+			const composeProjectName = yield* Effect.try({
+				try: () => requireComposeProjectNameForWorkspace(workspacePath, normalizedIssueId),
+				catch: (cause) => cause instanceof Error ? cause : new Error(String(cause))
+			});
+			if (preRenderComposeProjectName && preRenderComposeProjectName !== composeProjectName) progress(`Devcontainer now declares ${composeProjectName}, previously ${preRenderComposeProjectName} — any leftover stack under the old name is left for the stale-container sweep or \`pan doctor\`.`);
+			progress("Ensuring shared docker network...");
+			yield* ensureExternalNetwork();
+			progress("Starting workspace stack...");
+			yield* dockerCompose([
+				"-f",
+				composeFile,
+				"-p",
+				composeProjectName,
+				"up",
+				"-d",
+				"--build"
+			], dirname(composeFile));
+			recordDockerContainerLifecycleSnapshot(yield* collectDockerContainerLifecycleSnapshot());
+			progress("Removing stale containers from previous stack projects...");
+			yield* removeStaleIssueContainers(normalizedIssueId, composeProjectName);
+			progress("Connecting traefik to workspace network...");
+			yield* Effect.promise(() => reconcileTraefikNetworks());
+			return {
+				success: true,
+				workspacePath,
+				composeFile,
+				composeProjectName
+			};
+		}).pipe(Effect.catch((error) => {
+			const message = error instanceof Error && error.message ? error.message : String(error);
+			return Effect.succeed({
+				success: false,
+				error: message,
+				workspacePath
+			});
+		}));
+	};
+}));
+//#endregion
+export { rebuildWorkspaceStack as n, removeStaleIssueContainers as r, init_rebuild_stack as t };
+
+//# sourceMappingURL=rebuild-stack-xdGFthJn.js.map

package/server/{reconciler-caYiRnPy.js → reconciler-xH7d13Wo.js}

@@ -1,8 +1,8 @@
-import { Qr as FsError, li as init_errors } from "./config-yaml-D60AnTIu.js";
-import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-CJRi_5Wu.js";
-import { o as getPricingSync, s as init_cost, t as calculateCostSync } from "./cost-DTuIRE4y.js";
-import { i as CostWriter, o as lookupSkipVerdict, s as recordSkipVerdict, t as CostDoorLive } from "./cost-3FyqKK56.js";
-import { A as init_conversations, st as findConversationForCostSessionSync } from "./conversations-nS6QgYpD.js";
+import { $r as FsError, ui as init_errors } from "./config-yaml-Dce9VUd6.js";
+import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-B05o-e2g.js";
+import { o as getPricingSync, s as init_cost, t as calculateCostSync } from "./cost-ShD-G0cS.js";
+import { i as CostWriter, o as lookupSkipVerdict, s as recordSkipVerdict, t as CostDoorLive } from "./cost-PJXEAirJ.js";
+import { A as init_conversations, st as findConversationForCostSessionSync } from "./conversations-CPXMv_JQ.js";
 import { Effect } from "effect";
 import { closeSync, existsSync, fstatSync, openSync, readFileSync, readSync, readdirSync, statSync } from "fs";
 import { basename, join } from "path";
@@ -654,4 +654,4 @@ const reconcile = (opts = {}) => Effect.tryPromise({
 //#endregion
 export { reclassifyUnknownCostEventsSync as i, reconcile as n, recordCostEventsThroughOverdeck as r, collectPiCostEvents as t };
 
-//# sourceMappingURL=reconciler-caYiRnPy.js.map
+//# sourceMappingURL=reconciler-xH7d13Wo.js.map

package/server/{reconstruct-cache-3JzPOune.js → reconstruct-cache-Bb2Jg2DZ.js}

@@ -1,8 +1,8 @@
-import { $ as readIssueRecord, Y as init_record, fn as init_projects, rt as resolveProjectForIssue, vn as listProjectsSync } from "./config-yaml-D60AnTIu.js";
-import { c as init_agents, i as backfillAgentsSync, u as listAllAgentsSync } from "./agents-DzpQidT8.js";
-import { q as init_agents$1, vn as listRunningAgents } from "./agent-state-FABw8neJ.js";
-import { a as gatherProjectLensSignals, o as gatherProjectLensSignalsForProjects, s as init_pipeline_membership_gather } from "./pipeline-membership-gather-Ba0wJNCR.js";
-import { n as init_pipeline_membership, r as resolvePipelineMembership } from "./pipeline-membership-BV4hdkHm.js";
+import { $ as readIssueRecord, Y as init_record, fn as init_projects, rt as resolveProjectForIssue, vn as listProjectsSync } from "./config-yaml-Dce9VUd6.js";
+import { c as init_agents, i as backfillAgentsSync, u as listAllAgentsSync } from "./agents-CkngXhQr.js";
+import { Ln as listRunningAgents, q as init_agents$1 } from "./agent-state-Ci6PhjOE.js";
+import { a as gatherProjectLensSignals, o as gatherProjectLensSignalsForProjects, s as init_pipeline_membership_gather } from "./pipeline-membership-gather-QYMqf_Wf.js";
+import { n as init_pipeline_membership, r as resolvePipelineMembership } from "./pipeline-membership-DxJOJOjn.js";
 import { Effect } from "effect";
 //#region ../../lib/reconstruct/enumerate-in-flight.ts
 init_projects();
@@ -139,7 +139,7 @@ async function loadInFlightIssueIds(projects) {
 	return enumerateInFlightIssuesFromSources(projects);
 }
 async function fetchPrState(issueId) {
-	const { fetchIssuePullRequest } = await import("./pull-requests-CmlandI7.js");
+	const { fetchIssuePullRequest } = await import("./pull-requests-DLiyKC8q.js");
 	const result = await fetchIssuePullRequest(issueId);
 	if (!result.pr) return {
 		hasPr: false,
@@ -263,4 +263,4 @@ function reconstructCacheAuto(opts) {
 //#endregion
 export { reconstructCache, reconstructCacheAuto };
 
-//# sourceMappingURL=reconstruct-cache-3JzPOune.js.map
+//# sourceMappingURL=reconstruct-cache-Bb2Jg2DZ.js.map

package/server/{record-DYOg97Iv.js → record-Dsceq536.js}

@@ -1,3 +1,3 @@
-import { $ as readIssueRecord, B as clearIssueOwner, F as appendSessionEntry, G as getIssueRecordPath, H as ensureIssueRecord, I as appendSessionEntrySync, J as getProjectConfigFromWorkspacePath, K as getIssueRecordPathForWorkspace, L as batchReadIssueRecords, M as RECORD_SCHEMA_VERSION, N as appendFeedbackEntry, P as appendFeedbackEntrySync, Q as queueIssueRecordCommit, R as buildOwnUri, U as ensureIssueRecordSync, V as clearRecordFeedbackSync, W as getIssueRecordBasePath, X as markRecordPipelineClosedOutSync, Y as init_record, Z as markRecordPipelineResidueClosedOutSync, _t as writeRecordTieredExecutionOverride, at as writeAgentHarnessModelSync, bt as writeStatusOverrideSync, ct as writeIssueRecordForWorkspaceSync, dt as writeRecordDecisionsSync, et as readIssueRecordForWorkspaceSync, ft as writeRecordHazards, gt as writeRecordScopeDriftSync, ht as writeRecordResumePointSync, it as writeAgentHarnessModel, j as RECORD_DIRNAME, lt as writeIssueRecordSync, mt as writeRecordResumePoint, nt as readRecordContinueViewSync, ot as writeCloseOutDodGate, pt as writeRecordHazardsSync, q as getIssueWorkspacePath, rt as resolveProjectForIssue, st as writeCloseOutDodGateSync, tt as readIssueRecordSync, ut as writeRecordDecisions, vt as writeRecordTieredExecutionOverrideSync, xt as writeStatusOverridesSync, yt as writeStatusOverride, z as claimIssueOwner } from "./config-yaml-D60AnTIu.js";
+import { $ as readIssueRecord, B as clearIssueOwner, F as appendSessionEntry, G as getIssueRecordPath, H as ensureIssueRecord, I as appendSessionEntrySync, J as getProjectConfigFromWorkspacePath, K as getIssueRecordPathForWorkspace, L as batchReadIssueRecords, M as RECORD_SCHEMA_VERSION, N as appendFeedbackEntry, P as appendFeedbackEntrySync, Q as queueIssueRecordCommit, R as buildOwnUri, U as ensureIssueRecordSync, V as clearRecordFeedbackSync, W as getIssueRecordBasePath, X as markRecordPipelineClosedOutSync, Y as init_record, Z as markRecordPipelineResidueClosedOutSync, _t as writeRecordTieredExecutionOverride, at as writeAgentHarnessModelSync, bt as writeStatusOverrideSync, ct as writeIssueRecordForWorkspaceSync, dt as writeRecordDecisionsSync, et as readIssueRecordForWorkspaceSync, ft as writeRecordHazards, gt as writeRecordScopeDriftSync, ht as writeRecordResumePointSync, it as writeAgentHarnessModel, j as RECORD_DIRNAME, lt as writeIssueRecordSync, mt as writeRecordResumePoint, nt as readRecordContinueViewSync, ot as writeCloseOutDodGate, pt as writeRecordHazardsSync, q as getIssueWorkspacePath, rt as resolveProjectForIssue, st as writeCloseOutDodGateSync, tt as readIssueRecordSync, ut as writeRecordDecisions, vt as writeRecordTieredExecutionOverrideSync, xt as writeStatusOverridesSync, yt as writeStatusOverride, z as claimIssueOwner } from "./config-yaml-Dce9VUd6.js";
 init_record();
 export { RECORD_DIRNAME, RECORD_SCHEMA_VERSION, appendFeedbackEntry, appendFeedbackEntrySync, appendSessionEntry, appendSessionEntrySync, batchReadIssueRecords, buildOwnUri, claimIssueOwner, clearIssueOwner, clearRecordFeedbackSync, ensureIssueRecord, ensureIssueRecordSync, getIssueRecordBasePath, getIssueRecordPath, getIssueRecordPathForWorkspace, getIssueWorkspacePath, getProjectConfigFromWorkspacePath, markRecordPipelineClosedOutSync, markRecordPipelineResidueClosedOutSync, queueIssueRecordCommit, readIssueRecord, readIssueRecordForWorkspaceSync, readIssueRecordSync, readRecordContinueViewSync, resolveProjectForIssue, writeAgentHarnessModel, writeAgentHarnessModelSync, writeCloseOutDodGate, writeCloseOutDodGateSync, writeIssueRecordForWorkspaceSync, writeIssueRecordSync, writeRecordDecisions, writeRecordDecisionsSync, writeRecordHazards, writeRecordHazardsSync, writeRecordResumePoint, writeRecordResumePointSync, writeRecordScopeDriftSync, writeRecordTieredExecutionOverride, writeRecordTieredExecutionOverrideSync, writeStatusOverride, writeStatusOverrideSync, writeStatusOverridesSync };

package/server/{record-update-CDPEX7BH.js → record-update-CLtgirnZ.js}

@@ -1,3 +1,3 @@
-import { a as updateIssueRecord, i as init_record_update } from "./record-update-BPqpBu3O.js";
+import { a as updateIssueRecord, i as init_record_update } from "./record-update-T3PMrwE-.js";
 init_record_update();
 export { updateIssueRecord };

package/server/{record-update-BPqpBu3O.js → record-update-T3PMrwE-.js}

@@ -1,7 +1,7 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { G as getIssueRecordPath, Ht as init_state_read_home, J as getProjectConfigFromWorkspacePath, Mt as init_state_plane, Q as queueIssueRecordCommit, Ri as getOverdeckHome, Tt as init_auto_commit, U as ensureIssueRecordSync, Vt as STATE_BRANCH, Wt as resolveStateReadHomeSync, Y as init_record, kt as STATE_BRANCH_PATHS, lt as writeIssueRecordSync, rt as resolveProjectForIssue, tt as readIssueRecordSync, wt as flushAutoCommits, zi as init_paths } from "./config-yaml-D60AnTIu.js";
-import { a as emitActivityEntryOncePortable, l as init_activity_logger } from "./activity-logger-SlTXYCVf.js";
-import { n as init_fs_lock, o as releaseRecordLock, s as withRecordFsLock, t as acquireRecordLock } from "./fs-lock-DQ_gUxfq.js";
+import { G as getIssueRecordPath, Ht as init_state_read_home, J as getProjectConfigFromWorkspacePath, Li as getOverdeckHome, Mt as init_state_plane, Q as queueIssueRecordCommit, Ri as init_paths, Tt as init_auto_commit, U as ensureIssueRecordSync, Vt as STATE_BRANCH, Wt as resolveStateReadHomeSync, Y as init_record, kt as STATE_BRANCH_PATHS, lt as writeIssueRecordSync, rt as resolveProjectForIssue, tt as readIssueRecordSync, wt as flushAutoCommits } from "./config-yaml-Dce9VUd6.js";
+import { a as emitActivityEntryOncePortable, l as init_activity_logger } from "./activity-logger-DNYDzAOU.js";
+import { n as init_fs_lock, o as releaseRecordLock, s as withRecordFsLock, t as acquireRecordLock } from "./fs-lock-VCGoXZI5.js";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { Effect } from "effect";
 import { hostname } from "node:os";
@@ -626,4 +626,4 @@ var init_record_update = __esmMin((() => {
 //#endregion
 export { updateIssueRecord as a, withStateGitLock as c, init_record_update as i, clearRecordPipelineClosedOut as n, updateIssueRecordForWorkspace as o, clearRecordPipelineClosedOutSync as r, init_state_git_lock as s, RecordDurabilityTimeoutError as t };
 
-//# sourceMappingURL=record-update-BPqpBu3O.js.map
+//# sourceMappingURL=record-update-T3PMrwE-.js.map

package/server/{recovery-trip-CpfW6LCJ.js → recovery-trip-7JFHFjeo.js}

@@ -1,6 +1,6 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { $ as readIssueRecord, On as resolveProjectFromIssueSync, Y as init_record, fn as init_projects, on as getProjectSync } from "./config-yaml-D60AnTIu.js";
-import { i as init_record_update, o as updateIssueRecordForWorkspace } from "./record-update-BPqpBu3O.js";
+import { $ as readIssueRecord, On as resolveProjectFromIssueSync, Y as init_record, fn as init_projects, on as getProjectSync } from "./config-yaml-Dce9VUd6.js";
+import { i as init_record_update, o as updateIssueRecordForWorkspace } from "./record-update-T3PMrwE-.js";
 //#region ../../lib/cloister/recovery-trip.ts
 /**
 * PAN-3092: read an existing trip without taking the per-issue record lock.
@@ -107,4 +107,4 @@ var init_recovery_trip = __esmMin((() => {
 //#endregion
 export { recordRecoveryFailure as i, findRecoveryTrip as n, init_recovery_trip as r, acknowledgeAllOpenRecoveryTrips as t };
 
-//# sourceMappingURL=recovery-trip-CpfW6LCJ.js.map
+//# sourceMappingURL=recovery-trip-7JFHFjeo.js.map

package/server/{recovery-trip-xqKC07Gy.js → recovery-trip-B7UdNXjP.js}

@@ -1,3 +1,3 @@
-import { i as recordRecoveryFailure, r as init_recovery_trip } from "./recovery-trip-CpfW6LCJ.js";
+import { i as recordRecoveryFailure, r as init_recovery_trip } from "./recovery-trip-7JFHFjeo.js";
 init_recovery_trip();
 export { recordRecoveryFailure };

package/server/{release-engine-C_OOhCaK.js → release-engine-78iCajIc.js}

@@ -1,7 +1,7 @@
-import { $t as findProjectByPathSync, fn as init_projects, on as getProjectSync } from "./config-yaml-D60AnTIu.js";
-import { i as init_merge_set, r as getMergeSetSync } from "./merge-set-CyW-xSn4.js";
-import { p as init_review_status, w as setReviewStatusSync } from "./review-status-DpniqzPT.js";
-import { n as upsertReleaseSetSync, r as withComponentStateSync } from "./release-set-DOIDz2vw.js";
+import { $t as findProjectByPathSync, fn as init_projects, on as getProjectSync } from "./config-yaml-Dce9VUd6.js";
+import { i as init_merge_set, r as getMergeSetSync } from "./merge-set-DRPWriK9.js";
+import { p as init_review_status, w as setReviewStatusSync } from "./review-status-BegAr86G.js";
+import { n as upsertReleaseSetSync, r as withComponentStateSync } from "./release-set-B_sH_Mud.js";
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
 //#region ../../lib/release/release-plan.ts
@@ -296,4 +296,4 @@ function appendNote(existing, note) {
 //#endregion
 export { runRelease };
 
-//# sourceMappingURL=release-engine-C_OOhCaK.js.map
+//# sourceMappingURL=release-engine-78iCajIc.js.map

package/server/{release-set-DOIDz2vw.js → release-set-B_sH_Mud.js}

@@ -1,5 +1,5 @@
-import { Zn as resolveIssueIdSync, qn as init_issue_id } from "./config-yaml-D60AnTIu.js";
-import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-CJRi_5Wu.js";
+import { Zn as resolveIssueIdSync, qn as init_issue_id } from "./config-yaml-Dce9VUd6.js";
+import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-B05o-e2g.js";
 import "effect";
 //#region ../../lib/overdeck/release-sync.ts
 init_infra();
@@ -116,4 +116,4 @@ function withComponentStateSync(releaseSet, componentKey, patch) {
 //#endregion
 export { upsertReleaseSetSync as n, withComponentStateSync as r, getReleaseSetSync as t };
 
-//# sourceMappingURL=release-set-DOIDz2vw.js.map
+//# sourceMappingURL=release-set-B_sH_Mud.js.map

package/server/{remote-xY0B43Ho.js → remote-C9eYHTqn.js}

@@ -1,5 +1,5 @@
-import "./workspace-metadata-Cu6yfxBS.js";
-import { C as createFlyProvider, s as init_remote_agents, w as init_fly_provider } from "./remote-agents-DbbN7vSm.js";
+import "./workspace-metadata-Copcoih9.js";
+import { C as createFlyProvider, s as init_remote_agents, w as init_fly_provider } from "./remote-agents-CthcZHnO.js";
 import { Effect } from "effect";
 //#region ../../lib/remote/index.ts
 init_fly_provider();
@@ -52,4 +52,4 @@ function createFlyProviderFromConfig(remoteConfig, tierOverride) {
 //#endregion
 export { getRemoteProvider as n, isRemoteAvailable as r, createFlyProviderFromConfig as t };
 
-//# sourceMappingURL=remote-xY0B43Ho.js.map
+//# sourceMappingURL=remote-C9eYHTqn.js.map

package/server/{remote-agents-MuXx2gWm.js → remote-agents-CEOvYsvK.js}

@@ -1,3 +1,3 @@
-import { _ as saveRemoteAgentState, a as generatePushDaemonScript, b as writeRemoteFile, c as installEphemeralWatchdog, d as killRemoteAgent, f as listActiveRemoteAgentStates, g as refreshHostHeartbeatForEphemeralVms, h as pollRemoteAgentStatus, i as generateEphemeralWatchdogScript, l as installPushDaemon, m as loadRemoteAgentState, n as checkRemoteDurabilityPreflight, o as getRemoteAgentOutput, p as listRemoteAgents, r as checkRemoteSpendCap, s as init_remote_agents, t as assertFlyRemoteStateSupported, u as isRemoteAgentRunning, v as sendToRemoteAgent, x as sendToRemoteAgentKeyed, y as spawnRemoteAgent } from "./remote-agents-DbbN7vSm.js";
+import { _ as saveRemoteAgentState, a as generatePushDaemonScript, b as writeRemoteFile, c as installEphemeralWatchdog, d as killRemoteAgent, f as listActiveRemoteAgentStates, g as refreshHostHeartbeatForEphemeralVms, h as pollRemoteAgentStatus, i as generateEphemeralWatchdogScript, l as installPushDaemon, m as loadRemoteAgentState, n as checkRemoteDurabilityPreflight, o as getRemoteAgentOutput, p as listRemoteAgents, r as checkRemoteSpendCap, s as init_remote_agents, t as assertFlyRemoteStateSupported, u as isRemoteAgentRunning, v as sendToRemoteAgent, x as sendToRemoteAgentKeyed, y as spawnRemoteAgent } from "./remote-agents-CthcZHnO.js";
 init_remote_agents();
 export { assertFlyRemoteStateSupported, checkRemoteDurabilityPreflight, checkRemoteSpendCap, generateEphemeralWatchdogScript, generatePushDaemonScript, getRemoteAgentOutput, installEphemeralWatchdog, installPushDaemon, isRemoteAgentRunning, killRemoteAgent, listActiveRemoteAgentStates, listRemoteAgents, loadRemoteAgentState, pollRemoteAgentStatus, refreshHostHeartbeatForEphemeralVms, saveRemoteAgentState, sendToRemoteAgent, sendToRemoteAgentKeyed, spawnRemoteAgent, writeRemoteFile };

package/server/{remote-agents-DbbN7vSm.js → remote-agents-CthcZHnO.js}

@@ -1,9 +1,9 @@
 import { n as __esmMin, o as __toESM } from "./rolldown-runtime-DNCzzKnI.js";
-import { Y as init_record, er as require_dist, li as init_errors, rt as resolveProjectForIssue } from "./config-yaml-D60AnTIu.js";
-import { C as init_tmux, v as getManagedTmuxSocketName } from "./tmux-wnT_hg-s.js";
-import { C as generateLauncherScriptSync, _ as init_tmux_dedup, b as init_provenance, d as assertValidDedupKey, g as dedupTerminalOptionName, h as dedupTargetOptionName, i as init_auto_spawn_consent, l as KeyedMarkerVerificationError, m as dedupPoisonOptionName, p as dedupPendingOptionName, s as withAutoSpawnConsentClaim, u as KeyedSubmitTargetDeadError, w as init_launcher_generator, x as isOperatorStartedBy } from "./auto-spawn-consent-BesWchEi.js";
-import { a as init_claude_permissions, i as getClaudePermissionFlagsSync, r as getClaudePermissionFlagsStringSync, t as buildClaudeUserSettingsSync } from "./claude-permissions-DLrb9ovz.js";
-import { a as init_state_home, c as isStateMigrated } from "./state-home-DhsMqg8W.js";
+import { Y as init_record, er as require_dist, rt as resolveProjectForIssue, ui as init_errors } from "./config-yaml-Dce9VUd6.js";
+import { C as init_tmux, v as getManagedTmuxSocketName } from "./tmux-l-yvNWhg.js";
+import { C as generateLauncherScriptSync, _ as init_tmux_dedup, b as init_provenance, d as assertValidDedupKey, g as dedupTerminalOptionName, h as dedupTargetOptionName, i as init_auto_spawn_consent, l as KeyedMarkerVerificationError, m as dedupPoisonOptionName, p as dedupPendingOptionName, s as withAutoSpawnConsentClaim, u as KeyedSubmitTargetDeadError, w as init_launcher_generator, x as isOperatorStartedBy } from "./auto-spawn-consent-CJeQM5e0.js";
+import { a as init_claude_permissions, i as getClaudePermissionFlagsSync, r as getClaudePermissionFlagsStringSync, t as buildClaudeUserSettingsSync } from "./claude-permissions-DX5BSnMH.js";
+import { a as init_state_home, c as isStateMigrated } from "./state-home-CWu1dx9L.js";
 import { Data, Effect, Stream } from "effect";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "fs";
 import { join } from "path";
@@ -1495,4 +1495,4 @@ var init_remote_agents = __esmMin((() => {
 //#endregion
 export { createFlyProvider as C, FlyProvider as S, saveRemoteAgentState as _, generatePushDaemonScript as a, writeRemoteFile as b, installEphemeralWatchdog as c, killRemoteAgent as d, listActiveRemoteAgentStates as f, refreshHostHeartbeatForEphemeralVms as g, pollRemoteAgentStatus as h, generateEphemeralWatchdogScript as i, installPushDaemon as l, loadRemoteAgentState as m, checkRemoteDurabilityPreflight as n, getRemoteAgentOutput as o, listRemoteAgents as p, checkRemoteSpendCap as r, init_remote_agents as s, assertFlyRemoteStateSupported as t, isRemoteAgentRunning as u, sendToRemoteAgent as v, init_fly_provider as w, sendToRemoteAgentKeyed as x, spawnRemoteAgent as y };
 
-//# sourceMappingURL=remote-agents-DbbN7vSm.js.map
+//# sourceMappingURL=remote-agents-CthcZHnO.js.map

package/server/{remote-completion-LcWCpAm2.js → remote-completion-D5wzZCte.js}

@@ -1,10 +1,10 @@
-import { On as resolveProjectFromIssueSync, Zt as extractTeamPrefix, fn as init_projects, tn as findProjectByTeamSync } from "./config-yaml-D60AnTIu.js";
-import { h as loadConfigSync, p as init_config } from "./config-NxI9Yl2f.js";
+import { On as resolveProjectFromIssueSync, Zt as extractTeamPrefix, fn as init_projects, tn as findProjectByTeamSync } from "./config-yaml-Dce9VUd6.js";
+import { h as loadConfigSync, p as init_config } from "./config-BUjU7GZQ.js";
 import { a as PAN_DIRNAME, i as PAN_CONTINUE_FILENAME } from "./types-pLpbsNto.js";
-import { t as init_pan_dir } from "./pan-dir-B4NfzOf3.js";
-import { r as init_workspace_manager, t as createWorkspace } from "./workspace-manager-CM8RCrSc.js";
-import { _ as saveRemoteAgentState, f as listActiveRemoteAgentStates, m as loadRemoteAgentState, o as getRemoteAgentOutput, s as init_remote_agents, u as isRemoteAgentRunning, v as sendToRemoteAgent } from "./remote-agents-DbbN7vSm.js";
-import { t as createFlyProviderFromConfig } from "./remote-xY0B43Ho.js";
+import { t as init_pan_dir } from "./pan-dir-Bs9fme2I.js";
+import { r as init_workspace_manager, t as createWorkspace } from "./workspace-manager-CnAyRh3v.js";
+import { _ as saveRemoteAgentState, f as listActiveRemoteAgentStates, m as loadRemoteAgentState, o as getRemoteAgentOutput, s as init_remote_agents, u as isRemoteAgentRunning, v as sendToRemoteAgent } from "./remote-agents-CthcZHnO.js";
+import { t as createFlyProviderFromConfig } from "./remote-C9eYHTqn.js";
 import { Effect } from "effect";
 import { existsSync, mkdirSync, statSync, unlinkSync, writeFileSync } from "fs";
 import { basename, join } from "path";
@@ -309,7 +309,7 @@ async function reapCompletedRemoteAgents(opts = {}) {
 			} catch {
 				details.push("No continue.json retrieved from VM (skipped)");
 			}
-			const { getAgentStateSync, saveAgentStateSync } = await import("./agents-DixZjXWm.js");
+			const { getAgentStateSync, saveAgentStateSync } = await import("./agents-BVvL4o_4.js");
 			const existing = getAgentStateSync(agentId);
 			if (existing) {
 				existing.workspace = existing.workspace || workspacePath;
@@ -327,8 +327,8 @@ async function reapCompletedRemoteAgents(opts = {}) {
 				startedAt: remoteState.startedAt,
 				lastActivity: (/* @__PURE__ */ new Date()).toISOString()
 			});
-			const { createReviewArtifactsForIssue } = await import("./review-artifacts-DgaDlbO4.js");
-			const { setReviewStatusSync } = await import("./review-status-Bge_3XTR.js");
+			const { createReviewArtifactsForIssue } = await import("./review-artifacts-DExSp5Lh.js");
+			const { setReviewStatusSync } = await import("./review-status-DXTFzCmR.js");
 			const primaryArtifact = (await Effect.runPromise(createReviewArtifactsForIssue(issueId, workspacePath))).mergeSet?.repos.find((repo) => !!repo.artifactUrl);
 			if (primaryArtifact?.artifactUrl) {
 				setReviewStatusSync(issueId, { prUrl: primaryArtifact.artifactUrl });
@@ -349,7 +349,7 @@ async function reapCompletedRemoteAgents(opts = {}) {
 			try {
 				const fly = createFlyProviderFromConfig(loadConfigSync().remote);
 				if (sessionAlive) {
-					const { killRemoteAgent } = await import("./remote-agents-MuXx2gWm.js");
+					const { killRemoteAgent } = await import("./remote-agents-CEOvYsvK.js");
 					await killRemoteAgent(agentId, vmName).catch(() => void 0);
 				}
 				await Effect.runPromise(fly.deleteVm(vmName));
@@ -357,7 +357,7 @@ async function reapCompletedRemoteAgents(opts = {}) {
 			} catch (err) {
 				details.push(`Warning: could not destroy machine: ${err.message}`);
 			}
-			const { deleteWorkspaceMetadataSync } = await import("./workspace-metadata-BEOwJSdK.js");
+			const { deleteWorkspaceMetadataSync } = await import("./workspace-metadata-ILlbk8AX.js");
 			deleteWorkspaceMetadataSync(issueId);
 			details.push("Removed remote workspace metadata (pipeline is local from here)");
 			saveRemoteAgentState({
@@ -386,4 +386,4 @@ async function reapCompletedRemoteAgents(opts = {}) {
 //#endregion
 export { reapCompletedRemoteAgents, refreshClaudeCredentialsForActiveRemoteAgents };
 
-//# sourceMappingURL=remote-completion-LcWCpAm2.js.map
+//# sourceMappingURL=remote-completion-D5wzZCte.js.map

package/server/{remote-BTh-sjpX.js → remote-gWXJyhJK.js}

@@ -1,4 +1,4 @@
-import { a as loadWorkspaceMetadataSync, i as listWorkspaceMetadataSync, n as deleteWorkspaceMetadataSync, o as saveWorkspaceMetadataSync, r as findRemoteWorkspaceMetadataSync, t as WORKSPACES_DIR } from "./workspace-metadata-Cu6yfxBS.js";
-import { C as createFlyProvider, S as FlyProvider, d as killRemoteAgent, g as refreshHostHeartbeatForEphemeralVms, h as pollRemoteAgentStatus, m as loadRemoteAgentState, o as getRemoteAgentOutput, p as listRemoteAgents, r as checkRemoteSpendCap, u as isRemoteAgentRunning, v as sendToRemoteAgent, y as spawnRemoteAgent } from "./remote-agents-DbbN7vSm.js";
-import { n as getRemoteProvider, r as isRemoteAvailable, t as createFlyProviderFromConfig } from "./remote-xY0B43Ho.js";
+import { a as loadWorkspaceMetadataSync, i as listWorkspaceMetadataSync, n as deleteWorkspaceMetadataSync, o as saveWorkspaceMetadataSync, r as findRemoteWorkspaceMetadataSync, t as WORKSPACES_DIR } from "./workspace-metadata-Copcoih9.js";
+import { C as createFlyProvider, S as FlyProvider, d as killRemoteAgent, g as refreshHostHeartbeatForEphemeralVms, h as pollRemoteAgentStatus, m as loadRemoteAgentState, o as getRemoteAgentOutput, p as listRemoteAgents, r as checkRemoteSpendCap, u as isRemoteAgentRunning, v as sendToRemoteAgent, y as spawnRemoteAgent } from "./remote-agents-CthcZHnO.js";
+import { n as getRemoteProvider, r as isRemoteAvailable, t as createFlyProviderFromConfig } from "./remote-C9eYHTqn.js";
 export { FlyProvider, WORKSPACES_DIR, checkRemoteSpendCap, createFlyProvider, createFlyProviderFromConfig, deleteWorkspaceMetadataSync, findRemoteWorkspaceMetadataSync, getRemoteAgentOutput, getRemoteProvider, isRemoteAgentRunning, isRemoteAvailable, killRemoteAgent, listRemoteAgents, listWorkspaceMetadataSync, loadRemoteAgentState, loadWorkspaceMetadataSync, pollRemoteAgentStatus, refreshHostHeartbeatForEphemeralVms, saveWorkspaceMetadataSync, sendToRemoteAgent, spawnRemoteAgent };