@vantran-se/openchamber-web 2.1.1 → 2.2.0

package/server/lib/git/worktree-creation.test.js

@@ -0,0 +1,155 @@
+import { describe, expect, it, vi } from 'vitest';
+import { WorktreeCreationError, createWorktreeCreation } from './worktree-creation.js';
+
+const sourceRequest = {
+  context: {
+    provider: 'github', instance: 'github.com', directory: '/repo', repositoryId: 'repo_one',
+    accountId: 'account_one', bindingRevision: 2, primaryRemote: 'origin',
+  },
+  project: { id: 'acme/app', owner: 'acme', name: 'app' }, number: 42,
+  expectedHeadSha: 'a'.repeat(40), requestedRemoteName: 'pr-alice',
+};
+const resolvedSource = {
+  context: sourceRequest.context,
+  targetProject: sourceRequest.project,
+  sourceProject: { id: 'Alice/app', owner: 'Alice', name: 'app' },
+  number: 42, headRef: 'refs/heads/feature', headSha: 'a'.repeat(40),
+  requestedRemoteName: 'pr-alice', endpoint: 'https://github.com/Alice/app.git',
+  classification: 'contributor-fork',
+};
+const validAccount = {
+  credentialId: 'account_one', credentialRevision: 3, providerUserId: 'github.com#42', status: 'valid',
+};
+
+const setup = (overrides = {}) => {
+  const libraries = {
+    createWorktree: vi.fn(async () => ({ path: '/worktrees/feature', branch: 'feature' })),
+    validateWorktreeCreate: vi.fn(async () => ({ ok: false, errors: [{ code: 'contributor_transfer_unavailable', message: 'transfer first' }] })),
+    getRepositoryRemoteUrls: vi.fn(async () => []),
+    ...overrides.libraries,
+  };
+  const dependencies = {
+    getGitLibraries: async () => libraries,
+    networkOperations: {
+      hydrateBoundCheckout: vi.fn(),
+      transferContributorHead: vi.fn(async () => ({ state: 'succeeded' })),
+    },
+    getSourceControlBinding: vi.fn(async () => ({ revision: 0, repository: { repositoryId: 'repo_one' }, binding: null })),
+    contributorProvenance: { compareAndSwap: vi.fn() },
+    resolveChangeRequestSource: vi.fn(async () => resolvedSource),
+    createHttpsCredentialReference: vi.fn(() => 'credential_reference'),
+    resolveSourceControlAccount: vi.fn(async () => validAccount),
+    worktreeBootstrapStore: { read: vi.fn(), write: vi.fn() },
+    ...overrides.dependencies,
+  };
+  return { libraries, dependencies, creation: createWorktreeCreation(dependencies) };
+};
+
+const request = { mode: 'existing', branchName: 'feature', worktreeName: 'feature', changeRequestSource: sourceRequest };
+
+describe('worktree creation from a change request', () => {
+  it('creates a contributor worktree from the server-resolved head only', async () => {
+    const { libraries, dependencies, creation } = setup();
+
+    await expect(creation.create('/repo', request)).resolves.toEqual({ path: '/worktrees/feature', branch: 'feature' });
+
+    expect(dependencies.resolveChangeRequestSource).toHaveBeenCalledExactlyOnceWith(sourceRequest);
+    expect(dependencies.networkOperations.transferContributorHead).toHaveBeenCalledExactlyOnceWith({
+      directory: '/repo', sourceRequest, source: { ...resolvedSource, requestedRemoteName: 'pr-alice' },
+      destinationRef: 'refs/remotes/pr-alice/feature', credentialId: 'credential_reference',
+    });
+    const [, input, options] = libraries.createWorktree.mock.calls[0];
+    expect(input).toMatchObject({
+      mode: 'existing', branchName: 'feature', worktreeName: 'feature',
+      contributorFork: true, changeRequestTransfer: true, contributorTransferComplete: true,
+      ensureRemoteName: 'pr-alice', ensureRemoteUrl: 'https://github.com/Alice/app.git',
+      existingBranch: 'remotes/pr-alice/feature', expectedRevision: 'a'.repeat(40), setUpstream: false,
+    });
+    expect(input.changeRequestSource).toBeUndefined();
+    expect(options).toMatchObject({
+      contributorProvenance: dependencies.contributorProvenance,
+      contributorSource: { ...resolvedSource, requestedRemoteName: 'pr-alice' },
+      bootstrapStore: dependencies.worktreeBootstrapStore,
+    });
+  });
+
+  it('refuses contributor authority supplied by the caller before reading anything', async () => {
+    const { libraries, dependencies, creation } = setup();
+
+    await expect(creation.create('/repo', { ...request, ensureRemoteUrl: 'https://attacker.example/app.git' }))
+      .rejects.toMatchObject({ status: 400, code: 'INVALID_CONTRIBUTOR_WORKTREE' });
+    expect(dependencies.resolveChangeRequestSource).not.toHaveBeenCalled();
+    expect(libraries.createWorktree).not.toHaveBeenCalled();
+  });
+
+  it('refuses a remote name that already points elsewhere, before any transfer', async () => {
+    const { libraries, dependencies, creation } = setup({ libraries: {
+      validateWorktreeCreate: vi.fn(async () => ({
+        ok: false,
+        errors: [{ code: 'remote_name_collision', message: 'Remote pr-alice already exists with a different endpoint' }],
+      })),
+    } });
+
+    const error = await creation.create('/repo', request).catch((caught) => caught);
+    expect(error).toBeInstanceOf(WorktreeCreationError);
+    expect(error).toMatchObject({
+      status: 409, code: 'CONTRIBUTOR_REMOTE_COLLISION', remoteName: 'pr-alice',
+      message: 'Remote pr-alice already exists with a different endpoint',
+    });
+    expect(dependencies.networkOperations.transferContributorHead).not.toHaveBeenCalled();
+    expect(libraries.createWorktree).not.toHaveBeenCalled();
+  });
+
+  it('refuses when the account that would fetch the head is not the context\'s exact one', async () => {
+    const { libraries, dependencies, creation } = setup({ dependencies: {
+      resolveSourceControlAccount: vi.fn(async () => ({ ...validAccount, credentialId: 'other_account' })),
+    } });
+
+    await expect(creation.create('/repo', request)).rejects.toMatchObject({ status: 409, code: 'AUTHENTICATION_REQUIRED' });
+    expect(dependencies.networkOperations.transferContributorHead).not.toHaveBeenCalled();
+    expect(libraries.createWorktree).not.toHaveBeenCalled();
+  });
+
+  it('reports a failed transfer and creates nothing', async () => {
+    const { libraries, creation } = setup({ dependencies: {
+      networkOperations: {
+        hydrateBoundCheckout: vi.fn(),
+        transferContributorHead: vi.fn(async () => ({ state: 'failed', error: { code: 'TIMEOUT', message: 'Git network operation timed out' } })),
+      },
+    } });
+
+    await expect(creation.create('/repo', request))
+      .rejects.toMatchObject({ status: 409, code: 'TIMEOUT', message: 'Git network operation timed out' });
+    expect(libraries.createWorktree).not.toHaveBeenCalled();
+  });
+
+  it('passes a provider refusal through and creates nothing', async () => {
+    const stale = Object.assign(new Error('Change request head changed'), { status: 409, code: 'SOURCE_CONTROL_CHANGE_REQUEST_STALE' });
+    const { libraries, dependencies, creation } = setup({ dependencies: {
+      resolveChangeRequestSource: vi.fn(async () => { throw stale; }),
+    } });
+
+    await expect(creation.create('/repo', request)).rejects.toBe(stale);
+    expect(dependencies.networkOperations.transferContributorHead).not.toHaveBeenCalled();
+    expect(libraries.createWorktree).not.toHaveBeenCalled();
+  });
+
+  it('refuses where contributor transfer is not served, with no plain worktree instead', async () => {
+    const { libraries, creation } = setup({ dependencies: { resolveChangeRequestSource: undefined } });
+
+    await expect(creation.create('/repo', request)).rejects.toMatchObject({ status: 501, code: 'RUNTIME_UNSUPPORTED' });
+    expect(libraries.createWorktree).not.toHaveBeenCalled();
+  });
+
+  it('turns a remote collision found while creating into the route\'s collision answer', async () => {
+    const collision = Object.assign(new Error('Remote pr-alice already exists with a different endpoint'), {
+      code: 'CONTRIBUTOR_REMOTE_COLLISION', status: 409, remoteName: 'pr-alice',
+    });
+    const { creation } = setup({ libraries: { createWorktree: vi.fn(async () => { throw collision; }) } });
+
+    await expect(creation.create('/repo', request)).rejects.toMatchObject({
+      status: 409, code: 'CONTRIBUTOR_REMOTE_COLLISION', remoteName: 'pr-alice',
+      message: 'Contributor remote name is already used by a different endpoint',
+    });
+  });
+});

package/server/lib/github/DOCUMENTATION.md

@@ -44,6 +44,7 @@
 
 - `getOctokitOrNull()`: current Octokit or `null`.
 - `getOctokitForAccountId(accountId)`: exact persisted or verified CLI Octokit context with credential revision and provider-user identity. It never falls back to another account. A `github.com#cli:` id resolves only while the user has switched to the gh account (`isGhCliActive()`); the gh token is otherwise read only to list the gh account in Settings.
+- `getGitHubCliCredential(accountId, revision?)`: the same gh account as a credential record shaped like a persisted one (`credentialId`, `credentialRevision: 1`, `providerUserId`, `accessToken`, `status: 'valid'`), under the same consent rule plus a check that gh is still signed in as that user. The server's source-control account resolver falls back to it after `getGitHubAuthByAccountId`, so Git transport (fork PR worktrees, managed clones, the credential helper) accepts the gh account that reads already use.
 
 ### Repo
 
@@ -70,6 +71,9 @@
 - Canonical reads use the exact account and primary remote returned by validation. A GitHub `401` invalidates only that account. `403` and network failures remain read errors and do not change account state.
 - Route, PR discovery, and repository metadata caches use an opaque digest of both account ID and credential. Canonical status cache keys also include the trusted repository ID and binding revision, so path replacement and rebinding cannot reuse a warm response. Exact accounts and repository bindings are resolved before cache reads, and bound repository validation always precedes fork metadata cache reads.
 - Canonical PR create, update, merge, and ready routes validate the complete mutation context before credential, Git, cache, or provider access. They use only the validated account and trusted primary remote, require the target and source to belong to the provider-reported fork network, and return durable mutation receipts. Retired `/api/github/pr/*` mutations never enter this flow.
+- Comments and reviews take the same path: `/pr/comment` (a pull request's conversation, through the issues comments API), `/pr/review` (`approve` or `request-changes` for the target's `headSha`, the commit the user read, so a push since refuses it as a changed target; requesting changes needs text, which GitHub posts as the review body) and `/issues/comment` (refuses a number GitHub reports as a pull request). Record kinds are `change-request-comment`, `change-request-review` and `issue-comment`. A comment or review interrupted after dispatch stays `outcome-unknown`: nothing but its private text would tell a lost write from one never sent, and that text is not persisted. A `403`/`404`/`422` refusal answers with GitHub's own reason (`SOURCE_CONTROL_MUTATION_REJECTED`), such as a review of the user's own pull request; it is not stored.
+- `/pr/state` and `/issues/state` close or reopen (`state: 'open' | 'closed'`; record kinds `change-request-state`, `issue-state`). The issue route refuses a pull request number. Restart reconciliation reads the item: the asked state is success, the other open/closed state a definite not-applied failure. A merged pull request reads `closed` and GitHub refuses to reopen it with its own reason.
+- `/pr/labels`, `/issues/labels` and `/pr/reviewers` set the whole set, deduplicated and sorted so a repeat digests the same (record kinds `change-request-labels`, `issue-labels`, `change-request-reviewers`). Labels go through `issues.setLabels`; reviewers are compared with the requested ones and added, then removed, in two calls: asking again for the same set repairs a failure between them. Reconciliation succeeds only when the current set matches; anything else stays `outcome-unknown`, since another edit may have moved it. `GET /references/labels` and `/references/reviewers` (repository labels, assignable users, one page of 100 each) check the repository against the bound network like `/references/detail`. The detail's `pull.reviewers` lists requested users; team requests are left out. `pull.checks` summarizes the head commit's check contexts with `summarizeCheckContexts`, the same counting as the list statuses, and is null for a closed or merged PR.
 - Canonical mutations resolve the exact local credential and its revision before inspecting durable state. The exact credential ID and revision remain in authorization and digest input, while the route derives the provider-user ID from that resolved credential and passes it separately as receipt actor `providerAccountId` and audit identity. A client-supplied provider-user ID is never accepted as authority and cannot affect either value. Terminal records replay their compact result or stored error without provider repository preflight, but only after exact credential resolution. Running records lazily read only the provider state needed for reconciliation and never repeat a write. New keys retain the full strict preflight before claim and the single provider write. Changed credential, revision, input, or binding authority conflicts. Provider `4xx` rejections are definite failures; `5xx` and statusless transport failures after dispatch remain `outcome-unknown`.
 - Cross-process execution exclusion, lock errors, and stopped-writer orphan recovery follow the [source-control lock contract](../source-control/DOCUMENTATION.md#cross-process-locks-and-manual-recovery). A live or crashed owner's execution lock blocks reconciliation; restarting alone does not remove it.
 - Durable mutation records keep the exact credential account actor used for replay authorization, binding authority, server-resolved project and PR coordinates, an input digest, and compact public results only. Receipt and audit actor metadata use the separately verified provider-user ID. PR title/body text and raw provider payloads are not persisted or logged.
@@ -113,14 +117,15 @@ that page, so callers cannot mistake a partial page for a complete one.
 - It reads local git status and remotes first.
 - It ranks remotes in this order: explicit remote, tracking remote, `origin`, `upstream`, then the rest.
 - It resolves those remotes into GitHub repos.
+- The ranked-first remote is the branch's source unless the worktree was checked out from a contributor's fork PR. Such a worktree deliberately has no upstream, so `/pr/status` reads its contributor provenance (`readContributorProvenance`, supplied by the server runtime) and, when the provenance's source ref is this branch, passes the fork remote as `sourceRemoteName`. That remote, not the primary one, is then the only source, so the open PR from the fork is found. Unreadable provenance resolves as for any other branch.
 - It expands each repo through `parent` and `source` so PRs in upstream repos can still be found.
 - It skips PR lookup when the current branch matches that repo's default branch.
 - It first searches for **open** PRs by likely source owner plus exact head branch.
 - If that fails, it falls back to broader GitHub search for open PRs on the branch name.
 - An **open PR from any candidate repo always wins** over a closed/merged one, so a merged fork PR can never hide an open upstream PR for the same head.
-- Only when no target has an open PR does it return the branch's newest closed/merged PR, as history — and only when that PR's head commit is an ancestor of the checkout's `HEAD`. History is matched by branch name, and names get reused: a fresh worktree cut from the default branch under a name that was merged before must not inherit the old PR.
-- History is looked up **only for the ranked-first remote and the branch's own name** — the repo it actually pushes to. Live status is worth searching the whole fork network for; history is not, and asking every target for it multiplies serial GitHub calls until the route hits its `12s` resolve timeout and returns no status at all.
-- The history answer is remembered per repo+branch so discovery polls do not re-query it: a found closed/merged record for `6h`, and "no history yet" for `10m`. A found record only changes if a second PR appears on the same head, and while that one is open the open-PR path wins without ever reading this cache.
+- Only when no target has an open PR does it return the branch's newest closed/merged PR, as history. Its head commit must be an ancestor of the checkout's `HEAD`, or have a patch-equivalent commit there after a rebase. Missing old objects cannot prove that association. History is matched by branch name, and names get reused: a fresh worktree cut from the default branch under a name that was merged before must not inherit the old PR.
+- History is looked up only for a non-default branch's own name and the ranked-first remote's fork network: its repository plus its `parent` and `source` targets. This restores merged fork PRs hosted by an upstream repository without querying unrelated contributor remotes, while terminal history never attaches to a target's default branch. A contributor fork PR worktree also asks its ranked-first remote, where that PR merges. The primary network has at most three targets, so history remains bounded instead of fanning out across every configured remote.
+- The history answer is remembered per repo, branch, and ordered primary source-owner set so discovery polls do not re-query it: a found closed/merged record for `6h`, and "no history yet" for `10m`. Scoping by ordered source owners prevents cache misses and result confusion when searching the same fork branch from different direct-upstream or fork-origin remotes. A found record only changes if a second PR appears on the same head, and while that one is open the open-PR path wins without ever reading this cache.
 - Creating, merging, or closing a PR invalidates both the shared repo pull list and that remembered history.
 - The route skips the checks summary and the merge-permission lookup for a closed/merged PR: neither is actionable, and both cost extra GitHub calls.
 - `403` and `404` during repo lookups are treated as expected gaps, not hard errors.
@@ -136,11 +141,11 @@ that page, so callers cannot mistake a partial page for a complete one.
 
 ## Reference picker lists
 
-- `GET /api/source-control/github/references?<read context>&kind=issue|pull&filter=&query=&cursor=` takes the same bound read context as every canonical read and answers one page (30) of the project's issues or PRs across its repo network, read with that context's account (origin plus fork parent/source): `{ connected, repo, items, cursor, hasMore, total }`. `repo: null` means the project has no GitHub remote.
-- One GraphQL `search` document per page, open items newest-activity first. `filter` adds `assignee:@me` (`assigned`), `author:@me` (`created`) or `review-requested:@me` (`reviewRequested`); anything else is `open`. User text is appended as is, so GitHub qualifiers work; state and sort are added only when the text sets none.
+- `GET /api/source-control/github/references?<read context>&kind=issue|pull&state=&people=&query=&cursor=` takes the same bound read context as every canonical read and answers one page (30) of the project's issues or PRs across its repo network, read with that context's account (origin plus fork parent/source): `{ connected, repo, items, cursor, hasMore, total }`. `repo: null` means the project has no GitHub remote.
+- One GraphQL `search` document per page, newest activity first. `state` (`open`, the default, `closed`, `merged`, `all`) and `people` (`any`, the default, `assigned` → `assignee:@me`, `created` → `author:@me`, `reviewRequested` → `review-requested:@me`) combine; an issue list reads `merged` as closed and ignores review requests. User text is appended as is, so GitHub qualifiers work; state and sort are added only when the text sets none.
 - A pasted `#123`, `123` or github.com issue/PR link skips search and reads that number with `issueOrPullRequest` in every network repo (a link: only its own repo), whatever the tab's kind.
 - Each item carries what a row and the preview show: state (issues `open` / `completed` / `not_planned`, PRs `open` / `closed` / `merged`), author, labels, comment count, the body cut at 20 000 characters (`bodyTruncated`), and for a PR draft, head/base and head repo (with `cloneUrl` for fork worktrees).
-- `GET /api/source-control/github/references/detail?<read context>&owner=&repo=&number=` answers what the preview adds for one item: the newest 50 comments, oldest first, plus for a PR its reviews (a review's text or verdict, and each line comment with `path`/`line`), size and review decision. Its checks come from `references/status`, the same answer that colours it. The repo must be in the project's network. These fields stay off the page query: on a 30-PR page size, review decision and checks together ran past GitHub's 10 s search timeout (measured 2026-10-01), while one item answers in about a second.
+- `GET /api/source-control/github/references/detail?<read context>&owner=&repo=&number=` answers what the preview adds for one item: the newest 50 comments, oldest first, plus for a PR its reviews (a review's text or verdict, and each line comment with `path`/`line`), its newest 50 commits with `commitTotal`, size and review decision. Its checks come from `references/status`, the same answer that colours it. The repo must be in the project's network. These fields stay off the page query: on a 30-PR page size, review decision and checks together ran past GitHub's 10 s search timeout (measured 2026-10-01), while one item answers in about a second.
 - `GET /api/source-control/github/references/status?<read context>&pulls=owner/repo#n,...` answers what colours the PRs a picker page shows, at most 30: `{ connected, statuses: [{ owner, repo, number, checks, mergeable, mergeableState }] }` from `fetchPrSummaries`, the sidebar's summaries, so the picker and the sidebar colour a PR the same way. Every repo must be in the project's network. A PR GitHub could not resolve is left out. Mergeability is most of its cost (30 PRs: about 2 s with checks only, 4 to 7 s with mergeability, measured 2026-10-06), so it is a request after the page, not part of it.
 - Failures are errors, never an empty page; GraphQL `RATE_LIMITED` records the shared cooldown and answers `503`. The client cache lives in `packages/ui/src/components/references/`.
 - Attaching still reads full context through the canonical `issues/get` + `issues/comments` and `pulls/context`.

package/server/lib/github/auth.js

@@ -1,3 +1,4 @@
+import { isPlainObject, isString } from '../shared/guards.js';
 import fs from 'node:fs/promises';
 import fsSync from 'node:fs';
 import path from 'node:path';
@@ -18,10 +19,6 @@ const DEFAULT_GITHUB_CLIENT_ID = 'Ov23lizomPOC3eFYo56r';
 const DEFAULT_GITHUB_SCOPES = 'repo read:org workflow read:user user:email';
 export const GH_CLI_ACCOUNT_ID = 'gh-cli';
 
-const isString = (value) => Object.prototype.toString.call(value) === '[object String]';
-const isPlainObject = (value) => value === Object(value)
-  && !Array.isArray(value)
-  && Object.getPrototypeOf(value) === Object.prototype;
 const exactKeys = (value, required, optional = []) => {
   const allowed = new Set([...required, ...optional]);
   return required.every((key) => Object.hasOwn(value, key))
@@ -177,6 +174,7 @@ function publicCredential(credential, state) {
   };
 }
 
+/** @public Exposed to integration tests that dynamically import the auth module. */
 export function createGitHubAuthStore({ filePath, fsImpl = fs, lockWaitMs = 2_000 } = {}) {
   if (!validText(filePath)) throw new TypeError('GitHub auth file path is required');
   let transactions = Promise.resolve();

package/server/lib/github/device-flow.js

@@ -1,3 +1,5 @@
+import { isString } from '../shared/guards.js';
+
 const DEVICE_CODE_URL = 'https://github.com/login/device/code';
 const ACCESS_TOKEN_URL = 'https://github.com/login/oauth/access_token';
 const DEVICE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
@@ -11,8 +13,6 @@ const encodeForm = (params) => {
   return body.toString();
 };
 
-const isString = (value) => Object.prototype.toString.call(value) === '[object String]';
-
 async function postForm(url, params, { fetch: fetchImpl = fetch, timeoutMs = 10_000 } = {}) {
   const response = await fetchImpl(url, {
     method: 'POST',

package/server/lib/github/gh-cli-credential.js

@@ -17,3 +17,4 @@ function fetchGhCliToken() {
 export function getGhCliToken() {
   return fetchGhCliToken();
 }
+

package/server/lib/github/octokit.js

@@ -108,6 +108,37 @@ export async function getOctokitOrNull() {
   return createOctokit(token, accountId);
 }
 
+/**
+ * The gh CLI account as a credential record shaped like a persisted one, for
+ * Git transport. Same consent rule as getOctokitForAccountId: only while the
+ * user has switched to the gh account, and only when gh is still signed in
+ * as that same GitHub user. The CLI credential has no revisions beyond 1.
+ */
+export async function getGitHubCliCredential(accountId, revision) {
+  if (!accountId.startsWith('github.com#cli:') || !isGhCliActive() || isGhCliDisabled()) return null;
+  if (revision !== undefined && revision !== 1) return null;
+  const token = getGhCliToken();
+  if (!token) return null;
+  let response;
+  try {
+    response = await createOctokit(token, accountId).rest.users.getAuthenticated();
+  } catch (error) {
+    if (error?.status === 401) return null;
+    throw error;
+  }
+  if (githubCliAccountId(response.data.id) !== accountId) return null;
+  return {
+    credentialId: accountId,
+    accountId,
+    credentialRevision: 1,
+    providerUserId: githubAccountId(response.data.id),
+    accessToken: token,
+    source: 'cli',
+    status: 'valid',
+    user: response.data,
+  };
+}
+
 export async function getOctokitForAccountId(accountId, options = {}) {
   const auth = await getGitHubAuthByAccountId(accountId);
   if (auth) {

package/server/lib/github/pr-status.js

@@ -1,5 +1,5 @@
 import { stat } from 'node:fs/promises';
-import { getRemotes, getTrackingBranch, isAncestorOfHead } from '../git/index.js';
+import { getRemotes, getTrackingBranch, isAncestorOfHead, isPatchEquivalentOfHead } from '../git/index.js';
 import { resolveGitHubRepoFromDirectory } from './repo/index.js';
 import { noteIfGitHubRateLimit } from './rate-limit.js';
 import { getOctokitCacheIdentity } from './octokit.js';
@@ -596,14 +596,25 @@ const isTerminalPr = (pr) => Boolean(pr) && (pr.state === 'closed' || Boolean(pr
 // fresh worktree called `feature` cut from the default branch would inherit
 // the merged PR of last month's `feature`. The PR only belongs to this checkout
 // when the commit it was merged or closed at is part of the checkout's history.
-// `isAncestor` is the git check, replaceable so the tests need no git repository.
-const isHistoricalPrOfCheckout = async (directory, pr, { isAncestor = isAncestorOfHead } = {}) => {
+// A rebase can preserve its patch while replacing its commit. Both checks are
+// injectable so focused tests need no git repository.
+const isHistoricalPrOfCheckout = async (directory, pr, {
+  isAncestor = isAncestorOfHead,
+  isPatchEquivalent = isPatchEquivalentOfHead,
+} = {}) => {
   const headSha = normalizeText(pr?.head?.sha);
   if (!headSha) {
     return false;
   }
   try {
-    return await isAncestor(directory, headSha);
+    if (await isAncestor(directory, headSha)) {
+      return true;
+    }
+  } catch {
+    return false;
+  }
+  try {
+    return await isPatchEquivalent(directory, headSha);
   } catch {
     return false;
   }
@@ -620,10 +631,10 @@ export { isHistoricalPrOfCheckout };
  * the same head. The caller must prefer an open PR from ANY target over a
  * historical one — otherwise a merged fork PR hides an open upstream PR.
  *
- * `includeHistory` is off by default and must stay that way for secondary
- * targets. Live status is worth searching the whole fork network for; history
- * is not, and doing it per target multiplied the serial GitHub calls until the
- * route hit its resolve timeout and reported no status at all.
+ * `includeHistory` is off by default and is only enabled for primary-source
+ * targets. Live status is worth searching every configured remote; history is
+ * limited to the branch's primary fork network so unrelated remotes cannot
+ * multiply serial GitHub calls until the route hits its resolve timeout.
  */
 const findBranchPrCandidates = async ({ octokit, target, branch, sourceCandidates, force = false, coverage = null, includeHistory = false }) => {
   const matcher = buildSourceMatcher(sourceCandidates);
@@ -659,7 +670,7 @@ const findBranchPrCandidates = async ({ octokit, target, branch, sourceCandidate
     return { open: null, historical: null };
   }
 
-  const historicalKey = scopedCacheKey(octokit, `${normalizeRepoKey(target.repo?.owner, target.repo?.repo)}::${branch}`);
+  const historicalKey = scopedCacheKey(octokit, `${normalizeRepoKey(target.repo?.owner, target.repo?.repo)}::${branch}::${sourceOwners.map(normalizeLower).filter(Boolean).join(',')}`);
   if (historicalKey && includeHistory && !force && openListWasComplete) {
     const cached = _historicalPrCache.get(historicalKey);
     if (isHistoricalPrCacheFresh(cached)) {
@@ -707,7 +718,7 @@ const findBranchPrCandidates = async ({ octokit, target, branch, sourceCandidate
 // Exported for focused unit tests of open-versus-historical branch matching.
 export { findBranchPrCandidates };
 
-export async function resolveGitHubPrStatus({ octokit, directory, branch, remoteName, force = false }) {
+export async function resolveGitHubPrStatus({ octokit, directory, branch, remoteName, sourceRemoteName = null, force = false }) {
   // A deleted worktree can still have a session in the sidebar that keeps
   // requesting its PR status. Bail before touching git or GitHub for a
   // directory that no longer exists — otherwise every poll spends a git call
@@ -755,10 +766,15 @@ export async function resolveGitHubPrStatus({ octokit, directory, branch, remote
   // forks — are places to look for an open PR, but their `owner:branch`
   // heads are unrelated branches that merely share a name; treating them as
   // sources made a fork's closed `main` PR show up on the local main.
+  // A branch checked out from a contributor's fork PR comes from that fork's
+  // remote, which the caller knows from the worktree's provenance.
   const primaryRemoteName = resolvedTargets[0]?.remoteName ?? null;
-  const sourceCandidates = resolvedTargets.filter(
-    (target) => target.remoteName === primaryRemoteName,
-  );
+  const contributorSources = sourceRemoteName
+    ? resolvedTargets.filter((target) => target.remoteName === sourceRemoteName)
+    : [];
+  const sourceCandidates = contributorSources.length > 0
+    ? contributorSources
+    : resolvedTargets.filter((target) => target.remoteName === primaryRemoteName);
   // When every consulted repo list was complete, a no-PR result is
   // authoritative and the expensive Search API fallback is pointless.
   const coverage = { authoritative: true };
@@ -786,11 +802,12 @@ export async function resolveGitHubPrStatus({ octokit, directory, branch, remote
         continue;
       }
 
-      // History is only asked of the branch's own repo and its own name: the
-      // ranked-first target is the remote this branch actually pushes to.
-      // Searching the rest of the fork network for history would multiply
-      // serial GitHub calls for no additional user-visible information.
-      const isPrimaryAssociation = target === resolvedTargets[0] && candidateBranch === branchCandidates[0];
+      // History is only asked for the branch's own name and its primary remote
+      // network. That includes a fork's parent/source, where a fork-owned PR
+      // may have been merged, while excluding unrelated contributor remotes.
+      // A contributor fork checkout's PR merges into the primary remote, which
+      // is not among its source candidates.
+      const isPrimaryAssociation = (target === resolvedTargets[0] || sourceCandidates.includes(target)) && candidateBranch === branchCandidates[0] && candidateBranch !== defaultBranch;
 
       const { open, historical } = await findBranchPrCandidates({
         octokit,