@overdeck/desktop 0.65.0 → 0.66.0

package/server/{ensure-devcontainer-HQ3fQD5V.js → ensure-devcontainer-CollbMTo.js}

@@ -1,6 +1,6 @@
 import { d as getProjectSync, p as init_projects, w as resolveProjectFromIssueSync } from "./projects-CvLJPQjr.js";
 import { i as renderDevcontainer } from "./devcontainer-renderer-D6-4M4Z9.js";
-import { i as stepSkipped, n as stepFailed, r as stepOk } from "./types-D4H9A_IK.js";
+import { i as stepSkipped, n as stepFailed, r as stepOk } from "./types-8Bdo_m9Z.js";
 import { existsSync } from "fs";
 import { basename, join } from "path";
 //#region ../../lib/workspace/ensure-devcontainer.ts
@@ -99,4 +99,4 @@ function pathLeaf(p) {
 //#endregion
 export { ensureDevcontainer as t };
 
-//# sourceMappingURL=ensure-devcontainer-HQ3fQD5V.js.map
+//# sourceMappingURL=ensure-devcontainer-CollbMTo.js.map

package/server/ensure-devcontainer-bvZTPcBb.js

@@ -0,0 +1,2 @@
+import { t as ensureDevcontainer } from "./ensure-devcontainer-CollbMTo.js";
+export { ensureDevcontainer };

package/server/evict-LT5Wbo6F.js

@@ -0,0 +1,2 @@
+import { u as scanEligible } from "./evict-l0JJZ11s.js";
+export { scanEligible };

package/server/{evict-Dhzce_bB.js → evict-l0JJZ11s.js}

@@ -2,7 +2,7 @@ import { ci as init_paths, si as getOverdeckHome } from "./config-yaml-IYiKufOR.
 import { t as claudeProjectDir } from "./claude-code-D1t9sdHM.js";
 import { t as findSecretMatches } from "./secret-redaction-3Sf-Mq8_.js";
 import { t as removeTranscriptFile } from "./transcript-deletion-door-CXDQAdUg.js";
-import { A as vaultDir, D as withFileLock, E as setOwnedTail, S as listOwned, _ as checkContinuity, b as tailOf, c as encryptRef, g as splitIntoChunks, h as refName, k as readVaultConfig, l as isTombstone, o as encodeChunk, p as readSessionRecord, r as decodeChunk, s as encodeWipParts, v as lineHash, x as getOwned, y as splitSettleableLines } from "./format-QXO0qqJo.js";
+import { A as vaultDir, D as withFileLock, E as setOwnedTail, S as listOwned, _ as checkContinuity, b as tailOf, c as encryptRef, g as splitIntoChunks, h as refName, k as readVaultConfig, l as isTombstone, o as encodeChunk, p as readSessionRecord, r as decodeChunk, s as encodeWipParts, v as lineHash, x as getOwned, y as splitSettleableLines } from "./format-3trt48Iz.js";
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { homedir, hostname, tmpdir } from "node:os";
 import { copyFile, link, mkdir, mkdtemp, readFile, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
@@ -1766,4 +1766,4 @@ async function confirmEviction(fingerprint, options) {
 //#endregion
 export { assertRefName as A, writeMaterialization as C, VaultOfflineError as D, VAULT_FORMAT_MARKER_FILE as E, objectRelativePath as M, ensureEnvironmentIdentity as N, assertDistinctRefNames as O, planMaterialization as S, VAULT_FORMAT_MARKER as T, isPathUnder as _, confirmEviction as a, nativeFileContent as b, readEvictionBatch as c, writeEvictionBatch as d, settle as f, runWipGit as g, latestWipEntry as h, clearBatch as i, assertSlotName as j, assertNotSlotName as k, reofferEntry as l, buildWipCommit as m, batchFingerprint as n, declineEntry as o, WipGitError as p, checkEligibility as r, evictionBatchPath as s, EVICTION_BATCH_FILENAME as t, scanEligible as u, compareCwdState as v, KEYWRAP_OBJECT_NAME as w, planCodexMaterialization as x, readCwdState as y };
 
-//# sourceMappingURL=evict-Dhzce_bB.js.map
+//# sourceMappingURL=evict-l0JJZ11s.js.map

package/server/{feedback-target-C6lpafxM.js → feedback-target-B0XBJvkz.js}

@@ -1,2 +1,2 @@
-import { n as surfaceIssueFeedbackNeedsYou } from "./feedback-target-DmQ249DE.js";
+import { n as surfaceIssueFeedbackNeedsYou } from "./feedback-target-BYLtF8vX.js";
 export { surfaceIssueFeedbackNeedsYou };

package/server/{feedback-target-DmQ249DE.js → feedback-target-BYLtF8vX.js}

@@ -4,7 +4,7 @@ import { N as init_agent_state_source, P as readFeedbackAgentStates } from "./ag
 import { p as init_projects, w as resolveProjectFromIssueSync } from "./projects-CvLJPQjr.js";
 import { a as init_continue, r as getReadableWorkspacePanPaths } from "./continue-1NfoMIyq.js";
 import { i as isAlive, o as isConfirmedDead, r as init_liveness } from "./liveness-tAwIFT67.js";
-import { t as readSwarmSlotAssignments } from "./deacon-swarm-record-4FGgybnL.js";
+import { t as readSwarmSlotAssignments } from "./deacon-swarm-record-BenMf1-5.js";
 import { Effect } from "effect";
 import { existsSync } from "fs";
 import { join } from "path";
@@ -177,7 +177,7 @@ async function resurrectAgentForFeedback(agentId, issueId, workspacePath, keepPa
 			console.warn(`[feedback-target] ${agentId} is gated (troubled=${state.troubled === true}, failures=${state.consecutiveFailures ?? 0}) — clearing for one resurrection attempt to deliver ${issueId} feedback; failure tracking re-trips the gate on another crash`);
 			await Effect.runPromise(clearAgentTroubled(agentId));
 		}
-		const { resumeAgent } = await import("./resume-BRxpAyj3.js");
+		const { resumeAgent } = await import("./resume-BvqNBf96.js");
 		const result = await resumeAgent(agentId);
 		if (!result.success) {
 			console.warn(`[feedback-target] Failed to resume ${agentId} for ${issueId} feedback: ${result.error}; trying the start path`);
@@ -217,4 +217,4 @@ async function surfaceIssueFeedbackNeedsYou(issueId, reason, details = {}) {
 //#endregion
 export { surfaceIssueFeedbackNeedsYou as n, resolveIssueFeedbackTarget as t };
 
-//# sourceMappingURL=feedback-target-DmQ249DE.js.map
+//# sourceMappingURL=feedback-target-BYLtF8vX.js.map

package/server/{feedback-writer-pF7pA9Ei.js → feedback-writer-XmR1ZtVC.js}

@@ -1,2 +1,2 @@
-import { n as writeFeedbackFile, t as clearFeedbackFiles } from "./feedback-writer-DSEPHMwz.js";
+import { n as writeFeedbackFile, t as clearFeedbackFiles } from "./feedback-writer-g9cmlhQU.js";
 export { clearFeedbackFiles, writeFeedbackFile };

package/server/{feedback-writer-DSEPHMwz.js → feedback-writer-g9cmlhQU.js}

@@ -129,4 +129,4 @@ async function writeFeedbackFile(opts) {
 //#endregion
 export { writeFeedbackFile as n, clearFeedbackFiles as t };
 
-//# sourceMappingURL=feedback-writer-DSEPHMwz.js.map
+//# sourceMappingURL=feedback-writer-g9cmlhQU.js.map

package/server/{flywheel-Ib4Qp5x6.js → flywheel-C-t-XYUt.js}

@@ -1,5 +1,5 @@
-import { t as FLYWHEEL_CONVERSATION_SESSION } from "./constants-ZsF6FhcR.js";
-import { o as startFlywheel, u as FlywheelAlreadyRunning } from "./substrate-stats-DuuksQHp.js";
+import { t as FLYWHEEL_CONVERSATION_SESSION } from "./constants-DEItMRn6.js";
+import { o as startFlywheel, u as FlywheelAlreadyRunning } from "./substrate-stats-0PCKLsMv.js";
 //#region ../../cli/commands/flywheel.ts
 /**
 * `pan orders start <book>` — the order book is an input to the flywheel, so
@@ -18,4 +18,4 @@ async function startFlywheelRun(options = {}) {
 //#endregion
 export { startFlywheelRun };
 
-//# sourceMappingURL=flywheel-Ib4Qp5x6.js.map
+//# sourceMappingURL=flywheel-C-t-XYUt.js.map

package/server/{flywheel-merge-order-BjbLhtpF.js → flywheel-merge-order-qRslbYK3.js}

@@ -1,6 +1,6 @@
 import { a as findProjectByPath, p as init_projects, u as getProjectSwarmHotspots } from "./projects-CvLJPQjr.js";
 import { r as resolveGitHubIssue, t as init_tracker_utils } from "./tracker-utils-vzr-2-12.js";
-import { n as compileGlob } from "./dag-DC0niH7i.js";
+import { n as compileGlob } from "./dag-PPL-MAx0.js";
 import { Effect } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
 //#region ../../lib/flywheel-merge-order.ts
@@ -328,4 +328,4 @@ const computePolyrepoMergeQueueFromCandidates = (candidates, reposByIssue, proje
 //#endregion
 export { computeMergeQueueFromCandidates, computePolyrepoMergeQueueFromCandidates, resolveMergeQueuePrUrl };
 
-//# sourceMappingURL=flywheel-merge-order-BjbLhtpF.js.map
+//# sourceMappingURL=flywheel-merge-order-qRslbYK3.js.map

package/server/{format-QXO0qqJo.js → format-3trt48Iz.js}

@@ -582,4 +582,4 @@ function isTombstone(value) {
 //#endregion
 export { vaultDir as A, readListCache as C, withFileLock as D, setOwnedTail as E, VAULT_OFF_MESSAGE as O, listOwned as S, replaceListCache as T, checkContinuity as _, decryptRef as a, tailOf as b, encryptRef as c, parseKeyRing as d, readMachineRecord as f, splitIntoChunks as g, refName as h, decodeWipParts as i, writeVaultConfig as j, readVaultConfig as k, isTombstone as l, readVaultHeader as m, VaultAuthenticationError as n, encodeChunk as o, readSessionRecord as p, decodeChunk as r, encodeWipParts as s, HEADER_REF_NAME as t, newVaultHeader as u, lineHash as v, readLocalIndex as w, getOwned as x, splitSettleableLines as y };
 
-//# sourceMappingURL=format-QXO0qqJo.js.map
+//# sourceMappingURL=format-3trt48Iz.js.map

package/server/{from-ufsGrQUf.js → from-Cdjxc_Sy.js}

@@ -3841,4 +3841,4 @@ var init_from = __esmMin((() => {
 //#endregion
 export { File as a, init_esm_min as i, FormData as n, Blob as o, formDataToBlob as r, init_fetch_blob as s, init_from as t };
 
-//# sourceMappingURL=from-ufsGrQUf.js.map
+//# sourceMappingURL=from-Cdjxc_Sy.js.map

package/server/{generation-ship-a14Tkc5B.js → generation-ship-BTyy05vO.js}

@@ -907,4 +907,4 @@ async function shipPromotedBatch(args, deps = defaultPromotedBatchDeps) {
 //#endregion
 export { ShipPromotedBatchError, shipPromotedBatch };
 
-//# sourceMappingURL=generation-ship-a14Tkc5B.js.map
+//# sourceMappingURL=generation-ship-BTyy05vO.js.map

package/server/{harness-binary-DtPw6bEJ.js → harness-binary-BaN9N-sG.js}

@@ -211,7 +211,7 @@ async function prepareHarnessLaunch(harness, options) {
 	const { model, ...resolution } = options ?? {};
 	const binaryPath = await requireHarnessBinary(harness, resolution);
 	if (harness === "claude-code") {
-		const { assertClaudeCodeSupportsModel } = await import("./requirements-tNHrKKgl.js");
+		const { assertClaudeCodeSupportsModel } = await import("./requirements-DM6TvCsN.js");
 		await assertClaudeCodeSupportsModel(binaryPath, model);
 	}
 	return {
@@ -222,4 +222,4 @@ async function prepareHarnessLaunch(harness, options) {
 //#endregion
 export { prepareHarnessLaunch as a, resolveHarnessBinary as c, isWindowsInteropPath as i, resolveHarnessBinaryDetailed as l, harnessBinaryName as n, requireHarnessBinary as o, harnessPathExport as r, resolveExecutableDetailed as s, configuredHarnessBinaryPath as t };
 
-//# sourceMappingURL=harness-binary-DtPw6bEJ.js.map
+//# sourceMappingURL=harness-binary-BaN9N-sG.js.map

package/server/harness-binary-DFBkr1Wg.js

@@ -0,0 +1,2 @@
+import { c as resolveHarnessBinary } from "./harness-binary-BaN9N-sG.js";
+export { resolveHarnessBinary };

package/server/{harness-resolve-BfOivkUY.js → harness-resolve-CimEYcpG.js}

@@ -1,6 +1,6 @@
 import { Mt as init_providers, Ot as getBuiltInDefaultHarness, _t as canUseHarness, jt as getProviderForModel, m as loadConfigSync, t as init_config_yaml, vt as canUseModelWithAuth, yt as init_harness_policy } from "./config-yaml-IYiKufOR.js";
-import { c as resolveHarnessBinary, n as harnessBinaryName, t as configuredHarnessBinaryPath } from "./harness-binary-DtPw6bEJ.js";
-import { t as resolveCodexPolicyContext } from "./policy-context-DlF2pBlT.js";
+import { c as resolveHarnessBinary, n as harnessBinaryName, t as configuredHarnessBinaryPath } from "./harness-binary-BaN9N-sG.js";
+import { t as resolveCodexPolicyContext } from "./policy-context-CebkQTkr.js";
 //#region ../../lib/harness-resolve.ts
 init_harness_policy();
 init_providers();
@@ -19,7 +19,7 @@ var HarnessResolutionError = class extends Error {
 	}
 };
 async function getProviderAuthModeForModel(model) {
-	const { getProviderAuthMode } = await import("./agents-DfEYd_I0.js");
+	const { getProviderAuthMode } = await import("./agents-C9oho7kE.js");
 	return getProviderAuthMode(model);
 }
 function assertHarnessProviderSupported(harness, provider) {
@@ -76,4 +76,4 @@ async function resolveHarness(input) {
 //#endregion
 export { resolveHarness as n, resetHarnessResolveCachesForTests as t };
 
-//# sourceMappingURL=harness-resolve-BfOivkUY.js.map
+//# sourceMappingURL=harness-resolve-CimEYcpG.js.map

package/server/{harness-resolve-PDc4GGnM.js → harness-resolve-DclBRYRh.js}

@@ -1,2 +1,2 @@
-import { n as resolveHarness, t as resetHarnessResolveCachesForTests } from "./harness-resolve-BfOivkUY.js";
+import { n as resolveHarness, t as resetHarnessResolveCachesForTests } from "./harness-resolve-CimEYcpG.js";
 export { resetHarnessResolveCachesForTests, resolveHarness };

package/server/{herdr-agent-terminals-ffj8Zg3X.js → herdr-agent-terminals-Dm4HnKF7.js}

@@ -50,4 +50,4 @@ __esmMin((() => {
 }))();
 export { findHerdrAgentTerminals };
 
-//# sourceMappingURL=herdr-agent-terminals-ffj8Zg3X.js.map
+//# sourceMappingURL=herdr-agent-terminals-Dm4HnKF7.js.map

package/server/infer-tracker-BJR_ATzw.js

@@ -0,0 +1,2 @@
+import { r as inferMissingProjectTrackers } from "./infer-tracker-CwOO7_gU.js";
+export { inferMissingProjectTrackers };

package/server/infer-tracker-CwOO7_gU.js

@@ -0,0 +1,237 @@
+import { M as updateProjectsConfigAsync, g as listProjectsAsync, p as init_projects } from "./projects-CvLJPQjr.js";
+import { n as tryResolveProjectTrackerType, t as init_project_tracker_type } from "./project-tracker-type-BZBJgHlr.js";
+import { execFile } from "child_process";
+import { promisify } from "util";
+//#region ../../lib/projects/repo-url.ts
+init_projects();
+init_project_tracker_type();
+/** Schemes we are willing to hand to `git clone` from a dashboard request. */
+const SUPPORTED_SCHEMES = new Set([
+	"https:",
+	"http:",
+	"ssh:"
+]);
+/** Control characters and NUL, which have no business in a URL we spawn with. */
+const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+/**
+* `user@host:path/repo.git` — SCP syntax, not a URL.
+*
+* The host group excludes `:` and `/` so a scheme URL can never reach here, and
+* the path must be non-empty. Any user is accepted, not just `git`: deploy keys
+* routinely use another account.
+*/
+const SCP_SOURCE = /^([^\s@/:]+)@([^\s@/:]+):(.+)$/;
+/** Bare `owner/repo`, the only form we are allowed to invent a URL for. */
+const GITHUB_SHORTHAND = /^([A-Za-z0-9._-]+)\/([A-Za-z0-9._-]+)$/;
+/** Detect provider by host name. */
+function providerForHostname(hostname) {
+	const host = hostname.toLowerCase();
+	if (host === "github.com" || host === "www.github.com") return "github";
+	if (host === "gitlab.com" || host === "www.gitlab.com") return "gitlab";
+	return null;
+}
+/**
+* Strip the decoration that is metadata-only: surrounding slashes and one
+* trailing `.git`. Exactly one, so `repo.git.git` keeps its odd-but-real name.
+*/
+function normalizeRepoPath(rawPath) {
+	return rawPath.replace(/^\/+/, "").replace(/\/+$/, "").replace(/\.git$/, "");
+}
+/**
+* The last path segment, decoded, or null when it cannot safely name a folder.
+*
+* Decoding matters because `%2F` and `%2E%2E` survive the segment split and
+* would otherwise become a path separator or a traversal in a directory name.
+*/
+function folderNameFor(repoPath) {
+	const segments = repoPath.split("/").filter(Boolean);
+	const last = segments[segments.length - 1];
+	if (!last) return null;
+	let decoded;
+	try {
+		decoded = decodeURIComponent(last);
+	} catch {
+		return null;
+	}
+	if (!decoded || decoded === "." || decoded === "..") return null;
+	if (decoded.includes("/") || decoded.includes("\\")) return null;
+	if (CONTROL_CHARS.test(decoded)) return null;
+	return decoded;
+}
+/** A repo path is usable when it names at least one non-empty, non-dot segment. */
+function isUsableRepoPath(repoPath) {
+	const segments = repoPath.split("/").filter(Boolean);
+	if (segments.length === 0) return false;
+	const last = segments[segments.length - 1];
+	return last !== "." && last !== "..";
+}
+/** Parse an explicit scheme URL (`https://…`, `ssh://…`). */
+function parseSchemeSource(source) {
+	let url;
+	try {
+		url = new URL(source);
+	} catch {
+		return null;
+	}
+	if (!SUPPORTED_SCHEMES.has(url.protocol)) return null;
+	if (!url.hostname) return null;
+	const repoPath = normalizeRepoPath(url.pathname);
+	if (!isUsableRepoPath(repoPath)) return null;
+	return {
+		hostname: url.hostname,
+		repoPath
+	};
+}
+/** Parse SCP syntax (`git@github.com:acme/private.git`). */
+function parseScpSource(source) {
+	const match = SCP_SOURCE.exec(source);
+	if (!match) return null;
+	const hostname = match[2];
+	const repoPath = normalizeRepoPath(match[3]);
+	if (!isUsableRepoPath(repoPath)) return null;
+	return {
+		hostname,
+		repoPath
+	};
+}
+/**
+* Parse a repository source into a transport URL plus best-effort metadata.
+*
+* Returns null when the input cannot become a clone source at all, which the
+* caller renders as a `url-invalid` finding against the field.
+*/
+function parseRepoUrl(raw) {
+	const source = raw.trim();
+	if (!source) return null;
+	if (CONTROL_CHARS.test(source)) return null;
+	if (source.startsWith("-")) return null;
+	const shorthand = GITHUB_SHORTHAND.exec(source);
+	if (shorthand) {
+		const owner = shorthand[1];
+		const repo = normalizeRepoPath(shorthand[2]);
+		if (!repo || repo === "." || repo === "..") return null;
+		return {
+			provider: "github",
+			slug: `${owner}/${repo}`,
+			folderName: repo,
+			cloneUrl: `https://github.com/${owner}/${repo}.git`
+		};
+	}
+	const parts = parseSchemeSource(source) ?? parseScpSource(source);
+	if (!parts) return null;
+	const provider = providerForHostname(parts.hostname);
+	if (provider && parts.repoPath.split("/").filter(Boolean).length < 2) return null;
+	return {
+		provider,
+		slug: provider ? parts.repoPath : null,
+		folderName: folderNameFor(parts.repoPath),
+		cloneUrl: source
+	};
+}
+//#endregion
+//#region ../../lib/projects/infer-tracker.ts
+/**
+* Infer a project's tracker from its git origin remote.
+*
+* A project registered without `tracker`, `github_repo`, `issue_prefix`,
+* `rally_project` or `gitlab_repo` resolves no tracker, so pipeline membership
+* skips it and the Issues panel lists nothing. When the project's origin is a
+* GitHub repository, Overdeck writes `github_repo: owner/repo` itself rather
+* than asking the operator to edit projects.yaml. Callers: dashboard boot,
+* `pan sync`, `finishProjectSetup`, and context-layer project discovery.
+*
+* `tryResolveProjectTrackerType` stays pure and sync; this module is the async
+* side that reads git and writes the config.
+*/
+const execFileAsync = promisify(execFile);
+const ORIGIN_READ_TIMEOUT_MS = 5e3;
+/** A `github.com` host followed by the SSH (`:`) or URL (`/`) separator. */
+const GITHUB_HOST = /(^|[@/])(www\.)?github\.com[:/]/i;
+/**
+* The `owner/repo` slug of a GitHub remote URL, or null for any other remote.
+*
+* Accepts SSH (`git@github.com:o/r.git`, `ssh://git@github.com/o/r`) and HTTPS
+* (`https://github.com/o/r.git`). The explicit host check matters: the shared
+* parser reads a bare `a/b` as GitHub shorthand, and a remote like `../repo` is
+* a filesystem path, not a GitHub repository.
+*/
+function githubRepoFromRemoteUrl(url) {
+	const trimmed = url.trim();
+	if (!GITHUB_HOST.test(trimmed)) return null;
+	const parsed = parseRepoUrl(trimmed);
+	if (!parsed || parsed.provider !== "github" || !parsed.slug) return null;
+	return parsed.slug;
+}
+async function readOriginUrl(path) {
+	try {
+		const { stdout } = await execFileAsync("git", [
+			"-C",
+			path,
+			"remote",
+			"get-url",
+			"origin"
+		], { timeout: ORIGIN_READ_TIMEOUT_MS });
+		return stdout.trim() || null;
+	} catch {
+		return null;
+	}
+}
+async function writeGithubRepo(key, githubRepo) {
+	return updateProjectsConfigAsync((config) => {
+		const project = config.projects[key];
+		if (!project || tryResolveProjectTrackerType(project) !== null) return {
+			config,
+			result: false,
+			changed: false
+		};
+		config.projects[key] = {
+			...project,
+			github_repo: githubRepo
+		};
+		return {
+			config,
+			result: true,
+			changed: true
+		};
+	});
+}
+const defaultInferProjectTrackerDeps = {
+	readOriginUrl,
+	writeGithubRepo
+};
+/**
+* For a project that resolves no tracker, detect a GitHub origin and record it
+* as `github_repo`. Returns the slug it wrote, or null when it changed nothing
+* (tracker already resolvable, multi-repo root, no origin, non-GitHub origin).
+*/
+async function inferProjectGithubRepo(key, project, deps = defaultInferProjectTrackerDeps) {
+	if (tryResolveProjectTrackerType(project) !== null) return null;
+	if (project.workspace?.type === "polyrepo") return null;
+	const originUrl = await deps.readOriginUrl(project.path);
+	if (!originUrl) return null;
+	const githubRepo = githubRepoFromRemoteUrl(originUrl);
+	if (!githubRepo) return null;
+	return await deps.writeGithubRepo(key, githubRepo) ? githubRepo : null;
+}
+/**
+* Run `inferProjectGithubRepo` over every registered project that resolves no
+* tracker. Sequential: each write takes the projects.yaml lock anyway.
+*/
+async function inferMissingProjectTrackers(deps = defaultInferProjectTrackerDeps, listProjects = listProjectsAsync) {
+	const configured = [];
+	for (const { key, config } of await listProjects()) {
+		if (tryResolveProjectTrackerType(config) !== null) continue;
+		const githubRepo = await inferProjectGithubRepo(key, config, deps);
+		if (githubRepo) configured.push({
+			key,
+			name: config.name ?? key,
+			path: config.path,
+			githubRepo
+		});
+	}
+	return configured;
+}
+//#endregion
+export { parseRepoUrl as a, inferProjectGithubRepo as i, githubRepoFromRemoteUrl as n, inferMissingProjectTrackers as r, defaultInferProjectTrackerDeps as t };
+
+//# sourceMappingURL=infer-tracker-CwOO7_gU.js.map

package/server/{issue-lifecycle-BlE7L0r7.js → issue-lifecycle-CmbQlAqW.js}

@@ -6,7 +6,7 @@ import { a as init_event_store, i as initEventStore } from "./event-store-C2bwt7
 import { f as resolveStatusFile, i as init_paths } from "./paths-UQlhEw_i.js";
 import { o as init_feature_registry_storage, s as listFeatureRegistryEntries } from "./pipeline-agent-reader-Dq_UQbJ0.js";
 import { _ as listProjectsSync, p as init_projects } from "./projects-CvLJPQjr.js";
-import { t as AgentsResolver } from "./agents-DNkpVGda.js";
+import { t as AgentsResolver } from "./agents-dwMmsEQT.js";
 import { i as resolveSessionContextBriefingPath } from "./briefing-freshness-DGGAxLgu.js";
 import { n as resolveDefaultBranchHead, t as projectCiGhApi } from "./project-ci-github-BayNFfOs.js";
 import { m as listCheckpoints, o as diffCheckpointFiles, p as isCheckpointTargetDisabled, t as captureCheckpoint } from "./checkpoint-manager-dExYj5iP.js";
@@ -14,7 +14,7 @@ import { r as LinearClientOptionalLive, t as LinearClient } from "./linear-clien
 import { r as GitHubClientOptionalLive, t as GitHubClient } from "./github-client-Cal2eOrK.js";
 import { r as RallyClientOptionalLive, t as RallyClient } from "./rally-client-CPk3PfRQ.js";
 import { i as resolveTrackerType, r as resolveGitHubIssue, t as init_tracker_utils } from "./tracker-utils-vzr-2-12.js";
-import { n as init_issue_service_singleton, t as getSharedIssueService } from "./issue-service-singleton-QPDr49TB.js";
+import { n as init_issue_service_singleton, t as getSharedIssueService } from "./issue-service-singleton-DwYi9Oie.js";
 import { dirname } from "node:path";
 import { Context, Effect, Layer, Option, Queue, Stream } from "effect";
 import { basename as basename$1, dirname as dirname$1, join as join$1, resolve as resolve$1 } from "path";
@@ -349,7 +349,7 @@ const ReadModelServiceLive = Layer.effect(ReadModelService, Effect.gen(function*
 	};
 	const getSnapshot = Effect.gen(function* () {
 		try {
-			const { getSharedIssueService } = yield* Effect.promise(() => import("./issue-service-singleton-DxTRf-RV.js"));
+			const { getSharedIssueService } = yield* Effect.promise(() => import("./issue-service-singleton-BbERjqoV.js"));
 			const currentIssues = cleanIssues(getSharedIssueService().getIssues());
 			if (currentIssues.length > 0 || state.issuesRaw.length === 0) state = {
 				...state,
@@ -359,7 +359,7 @@ const ReadModelServiceLive = Layer.effect(ReadModelService, Effect.gen(function*
 			console.error("[ReadModel] Failed to refresh issues for snapshot:", err);
 		}
 		try {
-			const [{ getSharedIssueService }, { getBackendPanes, isBackendInventoryDegraded }] = yield* Effect.promise(() => Promise.all([import("./issue-service-singleton-DxTRf-RV.js"), import("./backend-inventory-HZnm8K3m.js")]));
+			const [{ getSharedIssueService }, { getBackendPanes, isBackendInventoryDegraded }] = yield* Effect.promise(() => Promise.all([import("./issue-service-singleton-BbERjqoV.js"), import("./backend-inventory-tUXKfgL_.js")]));
 			const derivedIssueStateByIssueId = {};
 			for (const derived of getSharedIssueService().listDerivedStates()) derivedIssueStateByIssueId[derived.issueId] = derived;
 			const backendPanesById = {};
@@ -470,7 +470,7 @@ const ReadModelServiceLive = Layer.effect(ReadModelService, Effect.gen(function*
 			}
 		})();
 		try {
-			const { getSharedIssueService } = yield* Effect.promise(() => import("./issue-service-singleton-DxTRf-RV.js"));
+			const { getSharedIssueService } = yield* Effect.promise(() => import("./issue-service-singleton-BbERjqoV.js"));
 			const issueService = getSharedIssueService();
 			const mergeT0 = performance.now();
 			const currentIssues = cleanIssues(issueService.getIssues());
@@ -512,7 +512,7 @@ const ReadModelServiceLive = Layer.effect(ReadModelService, Effect.gen(function*
 						payload: delta
 					});
 				} catch {}
-				import("./backlog-auto-trigger-BZ9HqOh5.js").then(({ triggerDebouncedIncrementalPass }) => {
+				import("./backlog-auto-trigger-EIBVGK3_.js").then(({ triggerDebouncedIncrementalPass }) => {
 					triggerDebouncedIncrementalPass(process.cwd());
 				}).catch(() => {});
 			});
@@ -536,7 +536,7 @@ const ReadModelServiceLive = Layer.effect(ReadModelService, Effect.gen(function*
 	});
 	yield* Effect.promise(async () => {
 		try {
-			const inventory = await import("./backend-inventory-HZnm8K3m.js");
+			const inventory = await import("./backend-inventory-tUXKfgL_.js");
 			inventory.onBackendPanesChanged(({ changed, removed }) => {
 				const next = { ...state.backendPanesById };
 				for (const pane of changed) next[pane.id] = pane;
@@ -1646,4 +1646,4 @@ const IssueLifecycleWithClientLive = IssueLifecycleLive.pipe(Layer.provide(Linea
 //#endregion
 export { EventStoreServiceLive as a, ReadModelServiceLive as c, toAgentStatus as d, toRole as f, EventStoreService as i, activityEntriesFromStoredEvents as l, IssueLifecycleLive as n, startProjectCiRefillAfterProjectionReady as o, IssueLifecycleWithClientLive as r, ReadModelService as s, IssueLifecycle as t, toAgentResolution as u };
 
-//# sourceMappingURL=issue-lifecycle-BlE7L0r7.js.map
+//# sourceMappingURL=issue-lifecycle-CmbQlAqW.js.map

package/server/{issue-lifecycle-Y8IGkADf.js → issue-lifecycle-Dt9AFW70.js}

@@ -1,2 +1,2 @@
-import { n as IssueLifecycleLive, r as IssueLifecycleWithClientLive, t as IssueLifecycle } from "./issue-lifecycle-BlE7L0r7.js";
+import { n as IssueLifecycleLive, r as IssueLifecycleWithClientLive, t as IssueLifecycle } from "./issue-lifecycle-CmbQlAqW.js";
 export { IssueLifecycle, IssueLifecycleLive, IssueLifecycleWithClientLive };

package/server/{issue-pause-9vXZZkOc.js → issue-pause-kvPBItCx.js}

@@ -63,10 +63,10 @@ async function stopIssueSpecialistAgents(issueId, roles = SPECIALIST_ROLES) {
 	let closeIssuePanes;
 	let stopAgent;
 	try {
-		const { listAgentStates } = await import("./queries-XNzQnDjP.js");
+		const { listAgentStates } = await import("./queries-qqOXiaNr.js");
 		({isAlive} = await import("./liveness-BYz_qdjp.js"));
-		({closeIssuePanes} = await import("./launch-DCAI36Nq.js"));
-		({stopAgent} = await import("./termination-DTOwIt3S.js"));
+		({closeIssuePanes} = await import("./launch-DlClnoCc.js"));
+		({stopAgent} = await import("./termination-DYiDx_bB.js"));
 		agents = listAgentStates();
 	} catch (err) {
 		sweep.unknown.push({
@@ -194,7 +194,7 @@ function reviewRequestOutcomeFromRoute(ok, status, body) {
 	};
 }
 async function dispatchTestDefault(issueId, workspace) {
-	const { dispatchTestAgentAndNotify } = await import("./test-agent-queue-D3koTErW.js");
+	const { dispatchTestAgentAndNotify } = await import("./test-agent-queue-BZ57BL-z.js");
 	const result = await Effect.runPromise(dispatchTestAgentAndNotify(issueId, workspace, `feature/${issueId.toLowerCase()}`));
 	return result.delivered ? { dispatched: true } : {
 		dispatched: false,
@@ -255,4 +255,4 @@ function describeSweepProblems(sweep) {
 //#endregion
 export { reviewRequestOutcomeFromRoute as a, restartIssueAfterUnpause as i, describeUnpauseRestartProblems as n, haltIssueSpecialistsForPause as r, describeSweepProblems as t };
 
-//# sourceMappingURL=issue-pause-9vXZZkOc.js.map
+//# sourceMappingURL=issue-pause-kvPBItCx.js.map

package/server/{issue-service-singleton-DxTRf-RV.js → issue-service-singleton-BbERjqoV.js}

@@ -1,3 +1,3 @@
-import { a as startSharedIssueService, n as init_issue_service_singleton, r as isSharedIssueServiceStarted, t as getSharedIssueService } from "./issue-service-singleton-QPDr49TB.js";
+import { a as startSharedIssueService, n as init_issue_service_singleton, r as isSharedIssueServiceStarted, t as getSharedIssueService } from "./issue-service-singleton-DwYi9Oie.js";
 init_issue_service_singleton();
 export { getSharedIssueService, isSharedIssueServiceStarted, startSharedIssueService };

package/server/{issue-service-singleton-QPDr49TB.js → issue-service-singleton-DwYi9Oie.js}

@@ -4,8 +4,8 @@ import { n as openDatabase, t as init_driver } from "./driver-CdxC1Wqp.js";
 import { p as init_projects, w as resolveProjectFromIssueSync } from "./projects-CvLJPQjr.js";
 import { m as withGitHubCaller, p as init_caller_context } from "./pause-gate-D_9Vdcz5.js";
 import { n as findPlan, o as init_io, p as readWorkspacePlan } from "./io-hEUwWRo5.js";
-import { h as loadIssueStatesForProject, s as init_derived_issue_state } from "./derived-issue-state-QLhfZgf5.js";
-import { f as init_backend_inventory, l as getBackendPanes } from "./backend-inventory-CjCALqY9.js";
+import { h as loadIssueStatesForProject, s as init_derived_issue_state } from "./derived-issue-state-Dz7ti1og.js";
+import { f as init_backend_inventory, l as getBackendPanes } from "./backend-inventory-DsbeKiYY.js";
 import { a as init_tracker_config, n as getLinearApiKey, o as validateRallyConfig, r as getRallyConfig, t as getGitHubConfig } from "./tracker-config-CSqqOWAc.js";
 import { a as recordOctokitFailure, i as patRestPauseDelayMs, o as recordOctokitPage, r as init_rest_meter } from "./rest-meter-9NPF5TBI.js";
 import { i as resolveTrackerType, r as resolveGitHubIssue, t as init_tracker_utils } from "./tracker-utils-vzr-2-12.js";
@@ -1897,4 +1897,4 @@ var init_issue_service_singleton = __esmMin((() => {
 //#endregion
 export { startSharedIssueService as a, issue_service_singleton_exports as i, init_issue_service_singleton as n, init_issue_title_fallback as o, isSharedIssueServiceStarted as r, resolveMissingIssueTitles as s, getSharedIssueService as t };
 
-//# sourceMappingURL=issue-service-singleton-QPDr49TB.js.map
+//# sourceMappingURL=issue-service-singleton-DwYi9Oie.js.map

package/server/{kimi-code-AcOc8X0U.js → kimi-code-DNNwP6FT.js}

@@ -1,2 +1,2 @@
-import { B as recordKimiSessionCapture, H as withKimiSessionCaptureLock, V as waitForNewKimiSessionAsync } from "./agents-CKFhKqJp.js";
+import { B as recordKimiSessionCapture, H as withKimiSessionCaptureLock, V as waitForNewKimiSessionAsync } from "./agents-DebP6rx9.js";
 export { recordKimiSessionCapture, waitForNewKimiSessionAsync, withKimiSessionCaptureLock };

package/server/{label-cleanup-CIoPmmbd.js → label-cleanup-C7weaJlZ.js}

@@ -1,5 +1,5 @@
 import { n as extractPrefix, r as init_issue_id, t as extractNumber } from "./issue-id-BDTO4wUV.js";
-import { i as stepSkipped, n as stepFailed, r as stepOk, t as getLinearApiKey } from "./types-D4H9A_IK.js";
+import { i as stepSkipped, n as stepFailed, r as stepOk, t as getLinearApiKey } from "./types-8Bdo_m9Z.js";
 import { Effect } from "effect";
 import { exec } from "child_process";
 import { promisify } from "util";
@@ -101,4 +101,4 @@ async function cleanupLabelsLinear(ctx, apiKey) {
 //#endregion
 export { cleanupMergedLabels };
 
-//# sourceMappingURL=label-cleanup-CIoPmmbd.js.map
+//# sourceMappingURL=label-cleanup-C7weaJlZ.js.map

package/server/{launch-DSEY_mt2.js → launch-DF_WD2-a.js}

@@ -283,17 +283,20 @@ async function closeBackendPane(pane) {
 	await Effect.runPromise(resolve(pane.backend).close(pane)).catch(() => {});
 }
 /**
-* Mark an issue pane's cwd trusted in Claude Code before the launch (PAN-3905).
+* Mark a Claude Code pane's cwd trusted before the launch (PAN-3905).
 * Only workspace creation used to do this, so an agent launched into a
 * workspace some other path made (the planner, a slot or item worktree, a
 * resume into an older workspace) stopped at Claude Code's trust dialog and
-* died with `ready-signal-timeout`. Idempotent; a failure is non-fatal, as it
-* is in `createWorkspace`: the agent still starts and the prompt is visible.
+* died with `ready-signal-timeout`. Conversations are included: their cwd is
+* the operator's explicit choice, and an untrusted one left the pane at the
+* dialog, where Herdr refuses the first message with `agent_blocked`.
+* Idempotent; a failure is non-fatal, as it is in `createWorkspace`: the agent
+* still starts and the prompt is visible.
 */
 async function preTrustClaudeCodeCwd(request) {
-	if (!request.issueId || request.tokens.harness !== "claude-code") return;
+	if (request.tokens.harness !== "claude-code") return;
 	try {
-		const { preTrustDirectory } = await import("./worktree-ops-BvwkJJ--.js");
+		const { preTrustDirectory } = await import("./worktree-ops-Cenxxhk2.js");
 		await preTrustDirectory(request.cwd);
 	} catch {}
 }
@@ -470,7 +473,7 @@ async function closeAgentPaneDetailed(agentId, backend, options = {}) {
 	}
 	const failures = [];
 	let closed = false;
-	const { findHerdrAgentTerminals } = await import("./herdr-agent-terminals-ffj8Zg3X.js");
+	const { findHerdrAgentTerminals } = await import("./herdr-agent-terminals-Dm4HnKF7.js");
 	const found = await findHerdrAgentTerminals(agentId, { recordedPaneId: options.recordedPaneId ?? await recordedHerdrPaneId(agentId) });
 	const closedWorkspaces = /* @__PURE__ */ new Set();
 	for (const workspaceId of found.workspaceIds) if (await closeThrough(resolved, {
@@ -594,4 +597,4 @@ var init_launch = __esmMin((() => {
 //#endregion
 export { closeIssuePanes as a, keepTmuxSessionOpen as c, resolveLaunchBackend as d, init_tmux as f, closeBackendPane as i, launchAgentPane as l, init_cpu_class as m, closeAgentPane as n, detectionPolicyFor as o, cpuClassForConversation as p, closeAgentPaneDetailed as r, init_launch as s, agentPaneExists as t, prepareTmuxServer as u };
 
-//# sourceMappingURL=launch-DSEY_mt2.js.map
+//# sourceMappingURL=launch-DF_WD2-a.js.map

package/server/{launch-DCAI36Nq.js → launch-DlClnoCc.js}

@@ -1,3 +1,3 @@
-import { a as closeIssuePanes, c as keepTmuxSessionOpen, d as resolveLaunchBackend, i as closeBackendPane, l as launchAgentPane, n as closeAgentPane, o as detectionPolicyFor, r as closeAgentPaneDetailed, s as init_launch, t as agentPaneExists, u as prepareTmuxServer } from "./launch-DSEY_mt2.js";
+import { a as closeIssuePanes, c as keepTmuxSessionOpen, d as resolveLaunchBackend, i as closeBackendPane, l as launchAgentPane, n as closeAgentPane, o as detectionPolicyFor, r as closeAgentPaneDetailed, s as init_launch, t as agentPaneExists, u as prepareTmuxServer } from "./launch-DF_WD2-a.js";
 init_launch();
 export { agentPaneExists, closeAgentPane, closeAgentPaneDetailed, closeBackendPane, closeIssuePanes, detectionPolicyFor, keepTmuxSessionOpen, launchAgentPane, prepareTmuxServer, resolveLaunchBackend };