@skitterbyte/skitterspec-jira 1.0.0 → 2.0.0

package/src/env/hotfix.js

@@ -21,7 +21,7 @@
  */
 
 const path = require('node:path')
-const { afterLandFor } = require('./integrate.js')
+const { afterLandFor, rangeOf } = require('./integrate.js')
 
 /**
  * Parse a semver-ish tag and return it with its PATCH bumped by one. Preserves any
@@ -114,12 +114,38 @@ const BUMPS = ['patch', 'hotfix-suffix']
 // The tag `hotfix.bump` asks for. An unknown strategy throws rather than
 // falling back to `patch`: a typo there would otherwise cut the wrong release
 // line and say nothing.
+//
+// Under `patch`, a base that is ITSELF a `-hotfix.N` tag continues that line.
+// Bumping its patch takes X.Y.(Z+1), a number the mainline owns: refused when
+// the mainline already cut it, and minted silently when it had not. Only a
+// parsed hotfix suffix routes here; an rc or any other suffix keeps the patch
+// bump, so a base we cannot read as a hotfix line is never treated as one.
 function nextTag(baseTag, existingTags, bump = 'patch') {
-  if (bump === 'patch') return bumpPatch(baseTag)
+  if (bump === 'patch') {
+    const base = parseTag(baseTag)
+    if (base && base.hotfix !== null) return nextHotfixTag(baseTag, existingTags)
+    return bumpPatch(baseTag)
+  }
   if (bump === 'hotfix-suffix') return nextHotfixTag(baseTag, existingTags)
   throw new Error(`unknown hotfix.bump "${bump}" — use one of: ${BUMPS.join(', ')}`)
 }
 
+// What a collision refusal offers: the free tag on the same base's hotfix
+// line, which is never taken by a mainline release. Never a deletion and never
+// another base — the first destroys a released tag, the second forks from a
+// version prod is not running. Empty where the suffix line cannot be derived
+// (an rc base) or is already the strategy, so the refusal just names the tag.
+function freeTagHint(baseTag, existingTags, bump) {
+  if (bump !== 'patch') return ''
+  let free
+  try {
+    free = nextHotfixTag(baseTag, existingTags)
+  } catch {
+    return ''
+  }
+  return ` — set hotfix.bump "hotfix-suffix" in env.config.json to cut ${free} instead`
+}
+
 // A filesystem/branch-safe slug derived from a tag (`v30.2.1` → `v30-2-1`).
 function tagSlug(tag) {
   return String(tag)
@@ -206,7 +232,7 @@ function planHotfixLand(spec, config, ctx) {
   } else {
     prodTag = nextTag(baseRef, c.existingTags, bump)
     if (taken.has(prodTag)) {
-      return block(`tag ${prodTag} already exists — bump the base version or delete the stale tag`)
+      return block(`tag ${prodTag} already exists${freeTagHint(baseRef, c.existingTags, bump)}`)
     }
     taken.add(prodTag)
     commands.push(`git -C ${spec.worktreePath} tag ${prodTag}`)
@@ -248,7 +274,7 @@ function planHotfixLand(spec, config, ctx) {
     // hotfix numbers rather than colliding on the same one.
     const tag = nextTag(t, [...taken], bump)
     if (taken.has(tag)) {
-      return block(`tag ${tag} (for target ${t}) already exists — resolve it before landing`)
+      return block(`tag ${tag} (for target ${t}) already exists${freeTagHint(t, [...taken], bump)}`)
     }
     taken.add(tag)
     const slug = `${spec.slug}-onto-${tagSlug(t)}`
@@ -307,7 +333,9 @@ function planHotfixLand(spec, config, ctx) {
       commits: picks,
     })
     targets.push({ kind: 'main', base: c.base })
-    afterLand = afterLandFor(config, c.mainRepoPath)
+    // The range is the files the carried fix touches — `carry.files`, read by
+    // the caller from the fix commits; absent or unreadable → unknown → run.
+    afterLand = afterLandFor(config, c.mainRepoPath, rangeOf({ changedFiles: carry.files }))
   }
 
   return { ...result, commands, steps, afterLand, prodTag, targets, fixRange }

package/src/env/integrate.js

@@ -1,5 +1,7 @@
 'use strict'
 
+const { globToRegExp } = require('./glob.js')
+
 /**
  * Pure integrate planner for `spec-env integrate`.
  *
@@ -21,7 +23,9 @@
  * fast-forward. `planIntegrateCheckout` below covers that; the shape of what it
  * returns is identical so callers need no second code path.
  *
- * @param {object} ctx   { worktreeState: { dirty }, base, aheadOfBase, mainRepoPath }
+ * @param {object} ctx   { worktreeState: { dirty }, base, aheadOfBase, mainRepoPath,
+ *                        changedFiles } — `changedFiles` is what the land brings
+ *                        in (`base...branch`), or null when it could not be read
  * @returns {object} { blocked, noop, reason, commands, afterLand, base, branch }
  */
 function planIntegrate(spec, config, ctx) {
@@ -39,8 +43,9 @@ function planIntegrate(spec, config, ctx) {
   // Nothing on the branch that isn't already on base → already landed. The
   // after-land commands still apply: the land may have happened on another
   // machine or in an earlier session, leaving them pending in THIS checkout.
+  // That earlier land's range is unknown here, so the range is null.
   if (!aheadOfBase) {
-    return { ...result, noop: true, afterLand: afterLandFor(config, mainRepoPath) }
+    return { ...result, noop: true, afterLand: afterLandFor(config, mainRepoPath, null) }
   }
 
   return {
@@ -49,7 +54,7 @@ function planIntegrate(spec, config, ctx) {
       `git -C ${spec.worktreePath} rebase ${base}`,
       `git -C ${mainRepoPath} merge --ff-only ${branch}`,
     ],
-    afterLand: afterLandFor(config, mainRepoPath),
+    afterLand: afterLandFor(config, mainRepoPath, rangeOf(ctx)),
   }
 }
 
@@ -65,7 +70,7 @@ function planIntegrate(spec, config, ctx) {
  * another spec's branch") for a spec that is finished, and the operator would
  * have to know to switch back by hand.
  *
- * ctx: { dirty, base, aheadOfBase, checkoutPath, onBranch }
+ * ctx: { dirty, base, aheadOfBase, checkoutPath, onBranch, changedFiles }
  */
 function planIntegrateCheckout(spec, config, ctx) {
   const { dirty, base, aheadOfBase, checkoutPath, onBranch } = ctx || {}
@@ -80,7 +85,7 @@ function planIntegrateCheckout(spec, config, ctx) {
   // would refuse the very spec this just finished landing. /spec-complete calls
   // integrate again on exactly that state.
   if (!aheadOfBase) {
-    return { ...result, noop: true, afterLand: afterLandFor(config, checkoutPath) }
+    return { ...result, noop: true, afterLand: afterLandFor(config, checkoutPath, null) }
   }
   if (dirty) {
     return {
@@ -107,20 +112,56 @@ function planIntegrateCheckout(spec, config, ctx) {
       `git -C ${checkoutPath} switch ${base}`,
       `git -C ${checkoutPath} merge --ff-only ${branch}`,
     ],
-    afterLand: afterLandFor(config, checkoutPath),
+    afterLand: afterLandFor(config, checkoutPath, rangeOf(ctx)),
   }
 }
 
 // The after-land half of a plan: `config.afterLand`, to run in `cwd` (the
 // primary checkout, standing on base) once the land commands have succeeded.
 // A blocked plan carries the empty form — nothing landed, so nothing follows.
-function afterLandFor(config, cwd) {
-  const commands = (config && Array.isArray(config.afterLand)) ? [...config.afterLand] : []
-  return { cwd: commands.length ? cwd : null, commands }
+//
+// `range` is the files the land changes: a list (possibly empty) when known,
+// null when it is not. Each entry gets a decision — `always` (no `when`),
+// `matched` (with the first path that hit), `skipped`, or `unknown` — and
+// `commands` is every entry but the skipped ones, in config order.
+//
+// AN UNKNOWN RANGE RUNS THE CONDITIONAL ENTRIES. A land made elsewhere, or a
+// diff git would not answer, says nothing about what changed, and only one
+// reading is harmless: a redundant generate costs seconds, a skipped one leaves
+// the base red with nothing pointing at why (`.claude/rules/negative-checks.md`
+// rule 4). An EMPTY known range is not unknown — a land whose commits touch no
+// files is healthy, and it skips them.
+function afterLandFor(config, cwd, range = null) {
+  const raw = (config && Array.isArray(config.afterLand)) ? config.afterLand : []
+  const entries = raw.map((e) => decide(asEntry(e), range))
+  const commands = entries.filter((e) => e.decision !== 'skipped').map((e) => e.run)
+  return { cwd: entries.length ? cwd : null, commands, entries, range }
+}
+
+function decide(entry, range) {
+  if (!entry.when) return { ...entry, decision: 'always', matched: null }
+  if (range === null) return { ...entry, decision: 'unknown', matched: null }
+  const res = entry.when.map(globToRegExp)
+  const matched = range.find((f) => res.some((r) => r.test(f)))
+  return matched === undefined
+    ? { ...entry, decision: 'skipped', matched: null }
+    : { ...entry, decision: 'matched', matched }
+}
+
+// Normalised config holds `{ run, when }`; a pure caller may still hand over
+// the plain string an entry is written as.
+function asEntry(entry) {
+  return typeof entry === 'string' ? { run: entry, when: null } : { run: entry.run, when: entry.when || null }
+}
+
+// `changedFiles` from a planner's ctx, with anything that is not a list read as
+// unknown — a caller that did not supply it said nothing about the range.
+function rangeOf(ctx) {
+  return Array.isArray(ctx && ctx.changedFiles) ? ctx.changedFiles : null
 }
 
 function noAfterLand() {
-  return { cwd: null, commands: [] }
+  return { cwd: null, commands: [], entries: [], range: null }
 }
 
-module.exports = { planIntegrate, planIntegrateCheckout, afterLandFor }
+module.exports = { planIntegrate, planIntegrateCheckout, afterLandFor, rangeOf }

package/src/env/live.js

@@ -18,6 +18,7 @@
 
 const fs = require('node:fs')
 const path = require('node:path')
+const { globToRegExp } = require('./glob.js')
 
 const REQUIRED = ['spec', 'branch', 'holder', 'heldSince', 'baseMainCommit']
 
@@ -179,32 +180,6 @@ function liveStateLine(live) {
 
 // --- stateful detection (glob matching) -----------------------------------
 
-// Translate a restricted glob into an anchored RegExp: `**` matches across path
-// separators (with an optional trailing `/`), `*` matches within a segment, `?`
-// a single non-separator char. Enough for migration-path globs, no dependency.
-function globToRegExp(glob) {
-  let re = ''
-  for (let i = 0; i < glob.length; i++) {
-    const ch = glob[i]
-    if (ch === '*') {
-      if (glob[i + 1] === '*') {
-        re += '.*'
-        i++
-        if (glob[i + 1] === '/') i++ // consume the `/` in `**/`
-      } else {
-        re += '[^/]*'
-      }
-    } else if (ch === '?') {
-      re += '[^/]'
-    } else if ('.+^${}()|[]\\/'.includes(ch)) {
-      re += '\\' + ch
-    } else {
-      re += ch
-    }
-  }
-  return new RegExp('^' + re + '$')
-}
-
 // True when any file path matches any of the migration globs. Empty patterns or
 // no files → false (nothing configured / nothing changed).
 function migrationsHit(files, patterns) {

package/src/env/proxy.js

@@ -167,12 +167,45 @@ async function portsInUseOn(port, hosts, probe = portsInUse) {
   return [...new Set(busy)]
 }
 
+/**
+ * Which of `ports` accept a connection on `host` — "is a dev server running?".
+ *
+ * CONNECTS, never binds. A bind probe on 127.0.0.1 SUCCEEDS on macOS beside a
+ * server listening on every address (Vite `host: true`, Fastify `0.0.0.0`),
+ * because BSD lets the two coexist, so it read a running phone-on-wifi dev
+ * server as absent. Linux refuses the second bind, which is why CI never saw
+ * it. A server that answers is running on any OS. What could still fool it: a
+ * server bound only to a non-loopback address, which `host` does not reach.
+ */
+async function portsAnswering(ports, host = '127.0.0.1') {
+  const results = await Promise.all(ports.map((p) => checkListening(p, host)))
+  return ports.filter((_, i) => results[i])
+}
+
+/**
+ * Which of `ports` are taken for a new listener on `host` — "may the proxy
+ * have these?". Busy when the bind fails OR something already answers.
+ *
+ * The bind alone is not enough on macOS: beside a wildcard listener it
+ * succeeds, and the proxy would then own `localhost` while LAN clients still
+ * reach the old server — two apps behind one port number. The connect catches
+ * that. SEQUENTIAL, bind first: the bind probe's own listener is closed before
+ * the connect runs, so the connect can never find the probe itself.
+ */
+async function portsHeld(ports, host = '127.0.0.1') {
+  const bound = await portsInUse(ports, host)
+  const answering = await portsAnswering(ports, host)
+  return ports.filter((p) => bound.includes(p) || answering.includes(p))
+}
+
 module.exports = {
   renderRoutes,
   createRouteServer,
   startProxy,
   portsInUse,
   portsInUseOn,
+  portsAnswering,
+  portsHeld,
   waitListening,
 }
 

package/src/env/review.js

@@ -715,7 +715,21 @@ function reviewTierStack({ served, fileUrl, publishedUrl, config }) {
   if (!config.review.allowNetwork) {
     tiers.push({ tier: 'network', off: true, enable: 'skitterspec spec-env review allow network' })
   } else if (served && !served.loopback && served.url) {
-    tiers.push({ tier: 'network', url: served.url, alternates: served.alternates || [] })
+    // LABELLED HERE, not by the renderer: `--json`'s `tiers` is the stack a
+    // skill copies, and an unlabelled alternate made the `(tailnet)` suffix a
+    // fact only the text render knew — so the one link a reader off the wifi
+    // could open reached the JSON indistinguishable from a second LAN address.
+    tiers.push({
+      tier: 'network',
+      url: served.url,
+      alternates: (served.alternates || []).map((u) => {
+        let host = ''
+        try {
+          host = new URL(u).hostname
+        } catch {}
+        return isTailnetAddress(host) ? { url: u, label: 'tailnet' } : { url: u }
+      }),
+    })
   } else {
     // Permitted, but there is no address to offer — a machine with no network,
     // or a server that could not take one. Not a problem to report as an error.
@@ -738,13 +752,42 @@ function reviewTierStack({ served, fileUrl, publishedUrl, config }) {
 }
 
 // One tier as a line, padded so the labels form a column the eye can run down.
+// A tier with alternates renders them as indented `also:` lines of its own —
+// they are PART of the tier, which is what puts them under `network:` rather
+// than dangling after the stack (they used to print below `remote:`, against
+// the comment that placed them).
 function reviewTierLine(t) {
   const label = `  ${t.tier}:`.padEnd(11)
-  if (t.url) return `${label}${t.url}${t.note ? `   (${t.note})` : ''}`
+  if (t.url) {
+    return [
+      `${label}${t.url}${t.note ? `   (${t.note})` : ''}`,
+      ...(t.alternates || []).map((a) => `    also:  ${a.url}${a.label ? ` (${a.label})` : ''}`),
+    ].join('\n')
+  }
   if (t.off) return `${label}off — turn on with: ${t.enable}`
   return `${label}—   (${t.note})`
 }
 
+// 100.64.0.0/10 — the CGNAT range Tailscale assigns from.
+//
+// WHAT WOULD FOOL THIS: a carrier-grade NAT or another overlay network using
+// the same range on a utun adapter is offered too. That costs one dud `also:`
+// line, where filtering it hides the only link a reader off the wifi can open.
+function isTailnetAddress(address) {
+  const m = /^100\.(\d+)\./.exec(address)
+  return !!m && Number(m[1]) >= 64 && Number(m[1]) <= 127
+}
+
+// The suffix on an `also:` line whose host is a tailnet address, so it reads
+// apart from the LAN one — a reader off the wifi needs to know which to tap.
+function tailnetLabel(url) {
+  let host = ''
+  try {
+    host = new URL(url).hostname
+  } catch {}
+  return isTailnetAddress(host) ? ' (tailnet)' : ''
+}
+
 
 // The verdicts that COMMIT, and are therefore blocked by an open comment. One
 // list, so a fifth verdict cannot become a way around the single refusal this
@@ -2482,6 +2525,8 @@ module.exports = {
   surfacesFor,
   reviewTierStack,
   reviewTierLine,
+  isTailnetAddress,
+  tailnetLabel,
   COMMITTING,
   BUTTON_SETS,
   DEFAULT_BUTTON_SET,

package/src/init.js

@@ -125,7 +125,7 @@ function detectPackageManager(dir) {
 
 // The bin names a distribution may expose. A provider superset ships its own
 // name alongside `skitterspec`, and either proves the engine is reachable.
-const ENGINE_BINS = ['skitterspec', 'skitterspec-linear', 'skitterspec-jira']
+const ENGINE_BINS = ['skitterspec', 'skitterspec-linear', 'skitterspec-jira', 'skitterspec-github', 'skitterspec-azure-boards']
 
 function binNames() {
   return process.platform === 'win32'
@@ -914,8 +914,8 @@ function resync(dir, { force = false, claudeMd = true, diff = false } = {}) {
 // never delete spec content or active config (defense-in-depth — the manifest
 // never lists these, but a tampered/foreign entry must still be refused).
 const PROTECTED_SPEC_BUCKETS = ['backlog', 'in-progress', 'complete', 'cancelled']
-const PROTECTED_CONFIG = ['env.config.json', 'linear.config.json', 'jira.config.json']
-const PROTECTED_DIRS = ['linear-base', 'linear-backups', 'jira-base', 'jira-backups']
+const PROTECTED_CONFIG = ['env.config.json', 'linear.config.json', 'jira.config.json', 'github.config.json', 'azure-boards.config.json']
+const PROTECTED_DIRS = ['linear-base', 'linear-backups', 'jira-base', 'jira-backups', 'github-base', 'github-backups', 'azure-base', 'azure-backups']
 
 function assertSafeToDelete(relPath, managedSet) {
   const norm = relPath.split(path.sep).join('/')

package/src/vendor/jira/cli-sync.js

@@ -26,7 +26,6 @@ const {
   isEmptyPlan,
   validateStates,
   stateSuggestions,
-  remoteWorkflowState,
   remoteDescriptionEdited,
   writeFrontmatter,
   stampSubIssueId,
@@ -410,13 +409,9 @@ function specSyncStatus(dir, config, specArg, flags, out, err) {
       out.write(`${PROGRAM} status: cannot read --remote: ${error.message}\n`)
       return 1
     }
-    const bucket = remoteWorkflowState(remote, config)
-    const local = r.projection.status
-    if (bucket && local && bucket !== local) {
-      lines.push(`  drift: Jira says "${bucket}", the repo says "${local}" (repo wins on next push)`)
-    } else if (bucket) {
-      lines.push('  drift: none — Jira agrees with the repo')
-    }
+    // NO STATE LINE, deliberately: skitterspec tells the tracker about its own
+    // transitions and never reads a status back. A ticket someone moved there
+    // is theirs to have moved, and push resends State only when the spec does.
     // SILENT ON EVERYTHING EXCEPT A POSITIVE ANSWER: `remoteDescriptionEdited`
     // returns null for every cannot-tell, and none of those is evidence.
     if (remoteDescriptionEdited(readBase(dir, identifier, config), remote, config) === true) {
@@ -675,12 +670,13 @@ function specSyncReleased(dir, config, rangeArg, flags, out) {
   const report = kit.ticketsInRange(read.commits, {
     ignorePaths: (config.release && config.release.ignorePaths) || [],
   })
+  report.tickets = kit.nameTickets(report.tickets, listSpecs(dir, config, { urls: true }))
   if (flags.json) {
     out.write(JSON.stringify(report, null, 2) + '\n')
     return 0
   }
   const lines = [`${PROGRAM} released: ${range} — ${report.total} commit(s)`]
-  for (const t of report.tickets) lines.push(`  ${t.ref}  (${t.commits} commit(s))`)
+  for (const t of report.tickets) lines.push(`  ${t.ref}  (${t.commits} commit(s))${t.spec ? `  ${t.spec}` : ''}`)
   if (!report.tickets.length) lines.push('  no referenced tickets')
   if (report.unreferenced) lines.push(`  ${report.unreferenced} commit(s) carry no Refs: trailer`)
   if (report.ignored) lines.push(`  ${report.ignored} bookkeeping commit(s) ignored`)

package/src/vendor/jira/config.js

@@ -63,7 +63,7 @@ const DEFAULT_CONFIG = Object.freeze({
     assigneeId: 'jira_assignee_id',
     assigneeName: 'jira_assignee_name',
   }),
-  release: Object.freeze({ stages: Object.freeze([]), ignorePaths: Object.freeze(['specs/', 'CHANGELOG.md', 'RELEASES.md']) }),
+  release: Object.freeze({ ignorePaths: Object.freeze(['specs/', 'CHANGELOG.md', 'RELEASES.md']) }),
   branch: Object.freeze({ pattern: '{type}/{slug}' }),
   // Env-var NAMES, not values: Jira Cloud authenticates with an email + API
   // token pair (basic auth), so there are two of them.
@@ -102,10 +102,10 @@ function defaults() {
     jira: { ...DEFAULT_CONFIG.jira },
     mapping: { ...DEFAULT_CONFIG.mapping },
     states: { ...DEFAULT_CONFIG.states },
+    stateAliases: {},
     snapshot: { ...DEFAULT_CONFIG.snapshot },
     fields: { ...DEFAULT_CONFIG.fields },
     release: {
-      stages: DEFAULT_CONFIG.release.stages.map((s) => ({ ...s })),
       ignorePaths: [...DEFAULT_CONFIG.release.ignorePaths],
     },
     branch: { ...DEFAULT_CONFIG.branch },
@@ -122,7 +122,7 @@ function defaults() {
 }
 
 const { isObject, stringList, assign } = kitConfig
-const { mergeFieldOwnership, mergePhaseMapping, mergeReleaseStages, mergeReleaseIgnorePaths, mergeKeyedFields } =
+const { mergeStates, mergeFieldOwnership, mergePhaseMapping, mergeReleaseIgnorePaths, mergeKeyedFields } =
   kitConfig.makeMergeHelpers({
     configFile: CONFIG_FILE,
     ownership: OWNERSHIP,
@@ -158,18 +158,13 @@ function mergeConfig(base, parsed) {
     mergePhaseMapping(base.mapping, parsed.mapping)
   }
 
-  if (isObject(parsed.states)) {
-    for (const key of Object.keys(base.states)) {
-      assign(base.states, parsed.states, key, 'string')
-    }
-  }
+  mergeStates(base, parsed)
 
   if (isObject(parsed.snapshot)) {
     assign(base.snapshot, parsed.snapshot, 'overviewFile', 'string')
   }
 
   if (isObject(parsed.release)) {
-    mergeReleaseStages(base.release, parsed.release)
     mergeReleaseIgnorePaths(base.release, parsed.release)
   }
 
@@ -269,18 +264,13 @@ function loadJiraConfig(dir = process.cwd()) {
   return { config: withRuntime(mergeConfig(base, parsed)), present: true }
 }
 
-// The declared deployment ladder (possibly empty) and its rungs — same
-// accessors the Linear provider exposes, reading this provider's config.
-const releaseStages = (config) => (config.release && config.release.stages) || []
-const stageFor = (config, key) => releaseStages(config).find((s) => s.key === key) || null
+// The bookkeeping path prefixes `released` ignores.
 const releaseIgnorePaths = (config) => (config.release && config.release.ignorePaths) || []
 
 module.exports = {
   loadJiraConfig,
   mergeConfig,
   defaults,
-  releaseStages,
-  stageFor,
   releaseIgnorePaths,
   DEFAULT_CONFIG,
   CONFIG_FILE,

package/src/vendor/provider-kit/src/apply.js

@@ -49,6 +49,7 @@ const {
   stampSubIssueId,
   fieldsOf,
   remoteDescriptionEdited,
+  remoteSubIssueEdited,
   listPhaseFiles,
 } = require('../../sync-core')
 const { makeSpecHelpers } = require('./specs.js')
@@ -162,7 +163,16 @@ async function applyInner({ dir, config, snapshotDir, plan, adapter, ops, progre
   for (const s of projectionOf(snapshotDir, config).subIssues || []) {
     if (s.id != null) refById.set(String(s.id), s.ref)
   }
+  // A phase body edited on the tracker gets the same warning as the spec
+  // issue. The read is spent only where the snapshot recorded something to
+  // compare against, so an old snapshot costs no extra calls.
+  const base = readBase(dir, identifier, config)
   for (const sub of (plan.subIssues && plan.subIssues.update) || []) {
+    const streams = base && base.subIssueStreams
+    if (sub.goal != null && streams && streams[String(sub.id)]) {
+      const before = await adapter.readIssue(sub.id)
+      if (remoteSubIssueEdited(base, sub.id, before, config) === true) lines.push(ops.remoteEditedLine(sub.id))
+    }
     await ops.updateSubIssue(sub)
     result.subIssues[sub.ref || refById.get(String(sub.id)) || sub.id] = sub.id
     lines.push(`  sub-issue updated: ${sub.id}`)