@vypdev/copilot 3.9.0 → 3.9.2

package/build/github_action/index.js

@@ -40545,6 +40545,11 @@ const SPANISH_CONTENT = Object.freeze({
         action: 'Corrige la entrada y reinténtalo.',
         retainedState: UNCHANGED_STATE_ES,
     }),
+    'validation.evidence-unavailable': Object.freeze({
+        impact: 'No se evaluó el progreso porque GitHub omitió un patch necesario.',
+        action: 'Inspecciona manualmente la comparación entre los commits base y head exactos o divide el trabajo en cambios revisados más pequeños con patches completos antes de otra evaluación. Reintentar los mismos commits no recuperará la evidencia omitida.',
+        retainedState: 'Se conservaron las etiquetas de progreso y las evaluaciones publicadas; no se realizó ninguna evaluación del modelo.',
+    }),
     'validation.evidence-too-large': Object.freeze({
         impact: 'No se pudo evaluar el progreso dentro de los límites fijos de evidencia.',
         action: 'Reduce el tamaño de la comparación o divide el trabajo en cambios revisados más pequeños antes de iniciar otra evaluación.',
@@ -47336,6 +47341,34 @@ function verifiedReadinessLink(snapshot, number) {
 }
 
 
+/***/ }),
+
+/***/ 59756:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.hasConventionalPullRequestTitle = hasConventionalPullRequestTitle;
+exports.generatedPullRequestTitle = generatedPullRequestTitle;
+/** Recognizes the conventional header shape; the consumer's CI owns its allowed types and subject rules. */
+function hasConventionalPullRequestTitle(title) {
+    return !title.includes('\n') && !title.includes('\r')
+        && /^\p{L}[\p{L}\p{N}_-]*(?:\([^()\r\n]+\))?!?: +\S[^\r\n]*$/u.test(title);
+}
+function generatedPullRequestTitle(sourceTitle, sanitizedSubject, issueNumber, labels) {
+    if (hasConventionalPullRequestTitle(sourceTitle))
+        return sourceTitle;
+    const type = labels.isHotfix || labels.isBugfix || labels.isBug ? 'fix'
+        : labels.isFeature || labels.isEnhancement ? 'feat'
+            : labels.isDocs || labels.isDocumentation ? 'docs' : 'chore';
+    const prefix = `${type}: `;
+    const suffix = ` (#${issueNumber})`;
+    const subject = (sanitizedSubject || 'Update linked issue').slice(0, 256 - prefix.length - suffix.length).trimEnd();
+    return `${prefix}${subject}${suffix}`;
+}
+
+
 /***/ }),
 
 /***/ 39410:
@@ -47527,6 +47560,12 @@ Do not add the \`${profile.deployment.launcherLabel}\` label, dispatch a deploym
 
 Never expose credentials, tokens, private keys, or other secrets in issues, commits, pull requests, logs, or diagnostic comments.
 
+## Repository verification prerequisites
+
+The setup runner profile selects placement; it does not install the project's language runtimes. An operator must provision the project's required runtimes and dependencies in every job that runs file-changing or branch-sync verification, before the Copilot step. A separate application CI job does not prepare this job.
+
+Declare reviewed version prefixes in \`.copilot/verification-prerequisites.json\` (schemaVersion 1, runtimes such as java 17, node 24, pnpm 10). Copilot checks declared versions in the credential-free verification environment before each configured verification command; a missing or incompatible runtime blocks publication. Without this optional declaration, existing verification behavior remains and no language is inferred. Java provisioning may use \`actions/setup-java\`; \`JAVA_HOME\` and \`PATH\` survive isolation, while agent credentials and tool-option injection variables do not. Do not add an unreviewed bootstrap or weaken verification to work around a missing runtime. Read [verification prerequisites and same-job setup](https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-verification-prerequisites).
+
 For the full contributor flow, read [repository collaboration](https://github.com/vypdev/copilot/blob/master/docs/agents/repository-collaboration.mdx). For drift and recovery, read [guidance troubleshooting](https://github.com/vypdev/copilot/blob/master/docs/agents/repository-guidance-troubleshooting.mdx).
 `;
 }
@@ -50733,6 +50772,87 @@ function projectCurrentNativeStatus(status, facts) {
 }
 
 
+/***/ }),
+
+/***/ 89347:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.VerificationPrerequisiteError = exports.VERIFICATION_RUNTIME_SPECS = exports.VERIFICATION_RUNTIME_HELP = exports.VERIFICATION_RUNTIME_MANIFEST = void 0;
+exports.parseVerificationRuntimeManifest = parseVerificationRuntimeManifest;
+exports.verificationRuntimeVersion = verificationRuntimeVersion;
+exports.verificationRuntimeMatches = verificationRuntimeMatches;
+exports.VERIFICATION_RUNTIME_MANIFEST = '.copilot/verification-prerequisites.json';
+exports.VERIFICATION_RUNTIME_HELP = 'https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-verification-prerequisites';
+exports.VERIFICATION_RUNTIME_SPECS = {
+    java: { label: 'Java', program: 'java', args: ['-version'] },
+    node: { label: 'Node.js', program: 'node', args: ['--version'] },
+    pnpm: { label: 'pnpm', program: 'pnpm', args: ['--version'] },
+    python: { label: 'Python', program: 'python3', args: ['--version'] },
+    go: { label: 'Go', program: 'go', args: ['version'] },
+    dotnet: { label: '.NET SDK', program: 'dotnet', args: ['--version'] },
+    ruby: { label: 'Ruby', program: 'ruby', args: ['--version'] },
+    rust: { label: 'Rust', program: 'rustc', args: ['--version'] },
+};
+const VERSION_PREFIX = /^[1-9]\d{0,2}(?:\.(?:0|[1-9]\d{0,2})){0,2}$/u;
+/** Only reviewed, closed runtime/version facts enter user-visible diagnostics. Raw tool output never does. */
+class VerificationPrerequisiteError extends Error {
+    constructor(reason, requirement, observed, job) {
+        const jobLabel = job && /^[A-Za-z_][A-Za-z0-9_-]{0,99}$/u.test(job) ? ` in job ${job}` : ' in this job';
+        const runtime = requirement && Object.prototype.hasOwnProperty.call(exports.VERIFICATION_RUNTIME_SPECS, requirement.runtime)
+            ? exports.VERIFICATION_RUNTIME_SPECS[requirement.runtime].label : 'Required runtime';
+        const version = requirement && VERSION_PREFIX.test(requirement.version) ? requirement.version : 'declared version';
+        const actual = observed && /^[1-9]\d{0,2}(?:\.(?:0|[1-9]\d{0,2})){0,3}$/u.test(observed) ? observed : 'unavailable';
+        const cause = reason === 'manifest-invalid' ? `${exports.VERIFICATION_RUNTIME_MANIFEST} is invalid or unsafe`
+            : reason === 'version-mismatch' ? `${runtime} ${version} is required; observed ${actual}`
+                : reason === 'unreadable-version' ? `${runtime} ${version} could not be verified`
+                    : `${runtime} ${version} is unavailable`;
+        const action = reason === 'manifest-invalid' ? 'Correct the reviewed runtime declaration.'
+            : `Provision the declared runtime in the same job before Copilot, then retry.${requirement?.runtime === 'java' ? ' For Java, configure actions/setup-java or a managed JAVA_HOME.' : ''}`;
+        super(`Repository verification is blocked${jobLabel}: ${cause}. ${action} The repository verification command was not run. Help: ${exports.VERIFICATION_RUNTIME_HELP}`);
+        this.name = 'VerificationPrerequisiteError';
+    }
+}
+exports.VerificationPrerequisiteError = VerificationPrerequisiteError;
+function parseVerificationRuntimeManifest(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new VerificationPrerequisiteError('manifest-invalid');
+    const object = value;
+    if (object.schemaVersion !== 1 || Object.keys(object).some(key => !['schemaVersion', 'runtimes'].includes(key))
+        || !object.runtimes || typeof object.runtimes !== 'object' || Array.isArray(object.runtimes)) {
+        throw new VerificationPrerequisiteError('manifest-invalid');
+    }
+    const runtimes = object.runtimes;
+    if (Object.keys(runtimes).length > 8)
+        throw new VerificationPrerequisiteError('manifest-invalid');
+    return Object.entries(runtimes).map(([runtime, version]) => {
+        if (!Object.prototype.hasOwnProperty.call(exports.VERIFICATION_RUNTIME_SPECS, runtime) || typeof version !== 'string' || !VERSION_PREFIX.test(version)) {
+            throw new VerificationPrerequisiteError('manifest-invalid');
+        }
+        return Object.freeze({ runtime: runtime, version });
+    });
+}
+function verificationRuntimeVersion(runtime, output) {
+    const patterns = {
+        java: /^(?:openjdk|java) (?:version )?["']?(\d+(?:\.\d+){0,3})/imu,
+        node: /^v(\d+\.\d+\.\d+)/mu,
+        pnpm: /^(\d+\.\d+\.\d+)/mu,
+        python: /^Python (\d+\.\d+\.\d+)/mu,
+        go: /^go version go(\d+\.\d+(?:\.\d+)?)/mu,
+        dotnet: /^(\d+\.\d+\.\d+)/mu,
+        ruby: /^ruby (\d+\.\d+\.\d+)/mu,
+        rust: /^rustc (\d+\.\d+\.\d+)/mu,
+    };
+    const version = patterns[runtime].exec(output)?.[1];
+    return runtime === 'java' && version?.startsWith('1.') ? version.slice(2) : version;
+}
+function verificationRuntimeMatches(required, observed) {
+    return observed === required || observed.startsWith(`${required}.`);
+}
+
+
 /***/ }),
 
 /***/ 43193:
@@ -54960,7 +55080,7 @@ class SyncBranchUseCase {
         const commands = (0, verify_command_policy_1.limitVerifyCommands)([...context.verifyCommands]);
         if (commands.length === verify_command_policy_1.MAX_VERIFY_COMMANDS)
             (0, logging_ports_1.logInfo)(`Branch sync verification is capped at ${verify_command_policy_1.MAX_VERIFY_COMMANDS} commands.`);
-        const verification = await (0, verify_command_runner_1.runVerifyCommands)(commands, (program, args) => this.git.execute(program, args, { untrusted: true }));
+        const verification = await (0, verify_command_runner_1.runVerifyCommands)(commands, (program, args) => this.git.execute(program, args, { untrusted: true, verifyRuntimePrerequisites: true }));
         if (!verification.success) {
             return {
                 commandCount: commands.length,
@@ -60801,7 +60921,7 @@ async function runVerification(context, gitCommitPort) {
     if (verifyCommands.length === 0)
         return undefined;
     (0, logging_ports_1.logInfo)(`Running ${verifyCommands.length} verify ${verifyCommands.length === 1 ? 'command' : 'commands'}...`);
-    const verify = await (0, verify_command_runner_1.runVerifyCommands)(verifyCommands, (program, args) => gitCommitPort.execute(program, args, { untrusted: true }));
+    const verify = await (0, verify_command_runner_1.runVerifyCommands)(verifyCommands, (program, args) => gitCommitPort.execute(program, args, { untrusted: true, verifyRuntimePrerequisites: true }));
     return verify.success
         ? undefined
         : verify.error ?? `Verify command failed: ${verify.failedCommand ?? "unknown"}.`;
@@ -63024,6 +63144,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.runVerifyCommands = runVerifyCommands;
 const logging_ports_1 = __nccwpck_require__(6152);
 const verify_command_policy_1 = __nccwpck_require__(96031);
+const verification_runtime_policy_1 = __nccwpck_require__(89347);
 async function runVerifyCommands(commands, execute) {
     for (const command of commands) {
         const result = await executeVerifyCommand(command, execute);
@@ -63042,7 +63163,11 @@ async function executeVerifyCommand(command, execute) {
             ? { success: true }
             : { success: false, failedCommand: formatCommandForDiagnostics(parsed) };
     }
-    catch {
+    catch (error) {
+        if (error instanceof verification_runtime_policy_1.VerificationPrerequisiteError) {
+            return { success: false, failedCommand: formatCommandForDiagnostics(parsed),
+                error: `${error.message} Verification command: ${formatCommandForDiagnostics(parsed)}.` };
+        }
         (0, logging_ports_1.logError)('Verify command failed.');
         return { success: false, failedCommand: formatCommandForDiagnostics(parsed) };
     }
@@ -65759,6 +65884,7 @@ exports.titleUpdateFailure = titleUpdateFailure;
 const result_1 = __nccwpck_require__(73817);
 const application_error_1 = __nccwpck_require__(75999);
 const positive_integer_policy_1 = __nccwpck_require__(19879);
+const pull_request_title_policy_1 = __nccwpck_require__(59756);
 function projectUpdateTitleContext(source) {
     if (source.isIssue) {
         return Object.freeze({
@@ -65809,19 +65935,27 @@ async function runPullRequestTitleUpdate(param, taskId, issueRepository) {
     if (!linkedIssueNumber || linkedIssueNumber === param.pullRequestNumber) {
         return [skippedResult(taskId)];
     }
+    const currentTitle = await issueRepository.getTitle(param.pullRequestNumber);
+    if (currentTitle === undefined) {
+        return [new result_1.Result({ id: taskId, success: false, executed: true,
+                steps: ['The current pull request title could not be read. No title change was attempted.'],
+                errors: [new application_error_1.ApplicationError('provider.unavailable', 'Unable to read the current pull request title.')] })];
+    }
+    if ((0, pull_request_title_policy_1.hasConventionalPullRequestTitle)(currentTitle))
+        return [skippedResult(taskId)];
     const issueTitle = await issueRepository.getTitle(linkedIssueNumber);
     if (issueTitle === undefined) {
         return [new result_1.Result({ id: taskId, success: false, executed: true, steps: ['Tried to update title, but there was a problem.'] })];
     }
     const title = await issueRepository.updatePullRequestTitle({
-        pullRequestTitle: param.pullRequestTitle,
+        pullRequestTitle: currentTitle,
         issueTitle,
         issueNumber: linkedIssueNumber,
         pullRequestNumber: param.pullRequestNumber,
         labelFacts: param.labelFacts,
     });
     return title
-        ? [updatedResult(taskId, `The pull request's title was updated from \`${param.pullRequestTitle}\` to \`${title}\`.`)]
+        ? [updatedResult(taskId, `The pull request's title was updated from \`${currentTitle}\` to \`${title}\`.`)]
         : [skippedResult(taskId)];
 }
 function titleUpdateFailure(taskId, error) {
@@ -67599,13 +67733,13 @@ async function runLinkPullRequestIssue(param, taskId, port, delay) {
     let retainedIssueReference = false;
     let alreadyLinked = false;
     if (!hasOwnedPendingOperation) {
-        alreadyLinked = await port.isLinked(param.pullRequestNumber);
+        alreadyLinked = await port.isLinked(param.pullRequestNumber, param.issueNumber);
         if (alreadyLinked)
             return [];
     }
     else {
         try {
-            alreadyLinked = await port.isLinked(param.pullRequestNumber);
+            alreadyLinked = await port.isLinked(param.pullRequestNumber, param.issueNumber);
         }
         catch (error) {
             primaryError = error;
@@ -68461,6 +68595,12 @@ exports.APPLICATION_ERROR_METADATA = {
         action: 'Correct the input and retry.',
         retainedState: UNCHANGED_STATE,
     },
+    'validation.evidence-unavailable': {
+        kind: 'validation', retryable: false,
+        impact: 'Progress was not assessed because GitHub omitted a required file patch.',
+        action: 'Inspect the exact base/head comparison manually or split the work into smaller reviewed changes with complete patches before a new assessment. Retrying the same commits cannot restore omitted evidence.',
+        retainedState: 'Existing progress labels and published assessments were preserved; no model assessment was made.',
+    },
     'validation.evidence-too-large': {
         kind: 'validation', retryable: false,
         impact: 'Progress could not be assessed within the fixed evidence limits.',
@@ -75217,6 +75357,7 @@ exports.IssueProgressTrackingRepository = IssueProgressTrackingRepository;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.IssueTitleRepository = void 0;
 const issue_emoji_policy_1 = __nccwpck_require__(81201);
+const pull_request_title_policy_1 = __nccwpck_require__(59756);
 const issue_title_policy_1 = __nccwpck_require__(83179);
 const issue_title_update_1 = __nccwpck_require__(9229);
 class IssueTitleRepository {
@@ -75234,10 +75375,12 @@ class IssueTitleRepository {
                 return (0, issue_title_update_1.updateIssueTitle)(this.issueTitleClient, owner, repository, issueTitle, formattedTitle, issueNumber, token);
             });
         };
-        this.updateTitlePullRequestFormat = async (owner, repository, pullRequestTitle, issueTitle, issueNumber, pullRequestNumber, branchManagementEmoji, labels, token) => {
+        this.updateTitlePullRequestFormat = async (owner, repository, pullRequestTitle, issueTitle, issueNumber, pullRequestNumber, _branchManagementEmoji, labels, token) => {
             return (0, issue_title_update_1.withTitleUpdateLogging)(() => {
-                const emoji = (0, issue_emoji_policy_1.resolvePullRequestTitleEmoji)(labels, branchManagementEmoji);
-                const formattedTitle = `[#${issueNumber}] ${emoji} - ${(0, issue_title_policy_1.sanitizePullRequestTitle)((0, issue_title_policy_1.normalizePullRequestSourceTitle)(issueTitle, issueNumber))}`;
+                if ((0, pull_request_title_policy_1.hasConventionalPullRequestTitle)(pullRequestTitle))
+                    return Promise.resolve(undefined);
+                const sourceTitle = (0, issue_title_policy_1.normalizePullRequestSourceTitle)(issueTitle, issueNumber);
+                const formattedTitle = (0, pull_request_title_policy_1.generatedPullRequestTitle)(sourceTitle, (0, issue_title_policy_1.sanitizePullRequestTitle)(sourceTitle), issueNumber, labels);
                 return (0, issue_title_update_1.updateIssueTitle)(this.issueTitleClient, owner, repository, pullRequestTitle, formattedTitle, pullRequestNumber, token);
             });
         };
@@ -75906,8 +76049,10 @@ class ProgressDiffRepository {
                 throw unavailable();
             paths.add(path);
             const generated = path.startsWith('build/') || path === 'specs/CATALOG.md';
-            if (!generated && (file.additions > 0 || file.deletions > 0) && (typeof file.patch !== 'string' || !file.patch))
-                throw unavailable();
+            const unchanged = file.status === 'unchanged' && file.additions === 0 && file.deletions === 0;
+            if (!generated && !unchanged && (typeof file.patch !== 'string' || !file.patch)) {
+                throw new application_error_1.ApplicationError('validation.evidence-unavailable', 'GitHub omitted a required file patch from the pinned comparison. Progress was not assessed and existing state was retained.');
+            }
             return { path, status: file.status, additions: file.additions, deletions: file.deletions,
                 ...(generated ? { evidence: 'generated-metadata-only' } : { patch: file.patch ?? '' }) };
         });
@@ -77193,6 +77338,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.PullRequestLifecycleRepository = void 0;
 const logger_1 = __nccwpck_require__(91151);
 const application_error_1 = __nccwpck_require__(75999);
+const github_error_policy_1 = __nccwpck_require__(58791);
 class PullRequestLifecycleRepository {
     constructor(githubClient) {
         this.githubClient = githubClient;
@@ -77254,26 +77400,69 @@ class PullRequestLifecycleRepository {
                 throw semanticError;
             }
         };
-        this.isLinked = async (owner, repository, pullRequestNumber, _token) => {
-            const pullRequestUrl = `https://github.com/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/pull/${pullRequestNumber}`;
-            const controller = new AbortController();
-            const timeoutId = setTimeout(() => controller.abort(), PullRequestLifecycleRepository.IS_LINKED_FETCH_TIMEOUT_MS);
+        /** Reads at most 200 closing references through the credential-bound API. */
+        this.isLinked = async (owner, repository, pullRequestNumber, issueNumber, token) => {
             try {
-                const res = await fetch(pullRequestUrl, { signal: controller.signal });
-                if (!res.ok) {
-                    throw new Error(`Pull-request linkage query returned HTTP ${res.status}.`);
+                if (![pullRequestNumber, issueNumber].every(number => Number.isSafeInteger(number) && number > 0)) {
+                    throw new application_error_1.ApplicationError('validation.invalid-input', 'Linkage requires positive PR and issue numbers.');
+                }
+                const client = this.githubClient.getClient(token);
+                if (!client.graphql)
+                    throw new application_error_1.ApplicationError('configuration.unsupported', 'Authenticated PR linkage queries are not supported by this installation.');
+                const expectedRepository = `${owner}/${repository}`.toLowerCase();
+                let cursor = null;
+                for (let page = 0; page < 2; page += 1) {
+                    const result = await client.graphql(`
+                    query PullRequestIssueLinkage($owner: String!, $repo: String!, $number: Int!, $cursor: String) {
+                        repository(owner: $owner, name: $repo) {
+                            nameWithOwner
+                            pullRequest(number: $number) {
+                                number
+                                closingIssuesReferences(first: 100, after: $cursor) {
+                                    nodes { number repository { nameWithOwner } }
+                                    pageInfo { hasNextPage endCursor }
+                                }
+                            }
+                        }
+                    }`, { owner, repo: repository, number: pullRequestNumber, cursor });
+                    const resource = result?.repository;
+                    if (resource === null || resource?.pullRequest === null) {
+                        throw new application_error_1.ApplicationError('provider.not-found', 'The requested pull request is unavailable to the configured credential.');
+                    }
+                    const pr = resource?.pullRequest;
+                    const references = pr?.closingIssuesReferences;
+                    if (typeof resource?.nameWithOwner !== 'string' || resource.nameWithOwner.toLowerCase() !== expectedRepository || pr?.number !== pullRequestNumber
+                        || !Array.isArray(references?.nodes) || references.nodes.length > 100
+                        || typeof references.pageInfo?.hasNextPage !== 'boolean'
+                        || references.nodes.some(node => !node || !Number.isSafeInteger(node.number) || node.number <= 0
+                            || typeof node.repository?.nameWithOwner !== 'string' || !node.repository.nameWithOwner)) {
+                        throw new application_error_1.ApplicationError('provider.contract-invalid', 'GitHub did not return verifiable PR linkage evidence.');
+                    }
+                    if (references.nodes.some(node => node.number === issueNumber
+                        && node.repository.nameWithOwner.toLowerCase() === expectedRepository))
+                        return true;
+                    if (!references.pageInfo.hasNextPage)
+                        return false;
+                    const nextCursor = references.pageInfo.endCursor;
+                    if (typeof nextCursor !== 'string' || !nextCursor || nextCursor === cursor) {
+                        throw new application_error_1.ApplicationError('provider.contract-invalid', 'GitHub returned incomplete linkage pagination.');
+                    }
+                    cursor = nextCursor;
                 }
-                const htmlContent = await res.text();
-                return !htmlContent.includes('has_github_issues=false');
+                throw new application_error_1.ApplicationError('provider.contract-invalid', 'PR linkage exceeds the fixed 200-reference inspection bound.');
             }
             catch (error) {
-                const semanticError = (0, application_error_1.toApplicationError)(error, 'provider.unavailable', `Unable to inspect issue linkage for pull request #${pullRequestNumber}.`);
+                const status = (0, github_error_policy_1.getGithubErrorStatus)(error);
+                const types = typeof error === 'object' && error !== null && 'errors' in error && Array.isArray(error.errors)
+                    ? error.errors.map((entry) => entry?.type) : [];
+                const code = (0, github_error_policy_1.isGithubRateLimited)(error) || types.includes('RATE_LIMITED') ? 'provider.rate-limited'
+                    : status === 401 ? 'authorization.credential-invalid'
+                        : status === 403 || types.includes('FORBIDDEN') || types.includes('UNAUTHORIZED') ? 'authorization.denied'
+                            : status === 404 || types.includes('NOT_FOUND') ? 'provider.not-found' : 'provider.unavailable';
+                const semanticError = (0, application_error_1.toApplicationError)(error, code, `Unable to inspect issue linkage for pull request #${pullRequestNumber}.`);
                 (0, logger_1.logError)(semanticError);
                 throw semanticError;
             }
-            finally {
-                clearTimeout(timeoutId);
-            }
         };
         this.updateBaseBranch = async (owner, repository, pullRequestNumber, branch, token) => {
             const octokit = this.githubClient.getClient(token);
@@ -77342,8 +77531,6 @@ class PullRequestLifecycleRepository {
     }
 }
 exports.PullRequestLifecycleRepository = PullRequestLifecycleRepository;
-/** Default timeout (ms) for isLinked fetch. */
-PullRequestLifecycleRepository.IS_LINKED_FETCH_TIMEOUT_MS = 10000;
 function toBugbotPullRequestIdentity(value) {
     const number = value.number;
     const state = value.state;
@@ -85470,7 +85657,7 @@ function bindBranchWorkflow(port, binding) {
 }
 function bindPullRequestIssueLink(port, binding) {
     return Object.freeze({
-        isLinked: (pullRequestNumber) => port.isLinked(binding.owner, binding.repository, pullRequestNumber, binding.token),
+        isLinked: (pullRequestNumber, issueNumber) => port.isLinked(binding.owner, binding.repository, pullRequestNumber, issueNumber, binding.token),
         getDetails: (pullRequestNumber) => port.getDetails(binding.owner, binding.repository, pullRequestNumber, binding.token),
         updateBaseBranch: (pullRequestNumber, baseBranch) => port.updateBaseBranch(binding.owner, binding.repository, pullRequestNumber, baseBranch, binding.token),
         updateDescription: (pullRequestNumber, description) => port.updateDescription(binding.owner, binding.repository, pullRequestNumber, description, binding.token),
@@ -86656,6 +86843,7 @@ const exec = __importStar(__nccwpck_require__(18538));
 const git_authentication_environment_1 = __nccwpck_require__(16535);
 const untrusted_command_environment_1 = __nccwpck_require__(2304);
 const git_hook_isolation_1 = __nccwpck_require__(39764);
+const verification_runtime_preflight_1 = __nccwpck_require__(23100);
 class GitCommitAdapter {
     constructor(executeCommand = (program, args, options) => options
         ? exec.exec(program, args, {
@@ -86665,16 +86853,21 @@ class GitCommitAdapter {
             ...(options.stdout ? { listeners: { stdout: options.stdout } } : {}),
             ...(options.env ? { env: options.env } : {}),
         })
-        : exec.exec(program, args)) {
+        : exec.exec(program, args), checkPrerequisites = verification_runtime_preflight_1.assertVerificationRuntimePrerequisites) {
         this.executeCommand = executeCommand;
+        this.checkPrerequisites = checkPrerequisites;
     }
     async execute(program, args, options) {
+        if (options?.verifyRuntimePrerequisites && !options.untrusted)
+            throw new Error('Runtime preflight requires credential-free verification.');
         if (!options?.untrusted)
             return options ? this.executeCommand(program, args, options) : this.executeCommand(program, args);
         if (options.env)
             throw new Error('Untrusted command execution does not accept a caller-supplied environment.');
         const runtime = (0, untrusted_command_environment_1.prepareUntrustedCommandEnvironment)();
         try {
+            if (options.verifyRuntimePrerequisites)
+                this.checkPrerequisites(runtime.environment);
             return await this.executeCommand(program, args, {
                 ...(options.stdout ? { stdout: options.stdout } : {}),
                 env: runtime.environment,
@@ -87989,6 +88182,7 @@ const node_path_1 = __nccwpck_require__(49411);
 const agent_private_install_root_1 = __nccwpck_require__(44640);
 const ALLOWED_VARIABLES = [
     'PATH',
+    'JAVA_HOME',
     'LANG',
     'LANGUAGE',
     'LC_ALL',
@@ -88048,6 +88242,132 @@ function prepareUntrustedCommandEnvironment(source = process.env, platform = pro
 }
 
 
+/***/ }),
+
+/***/ 91053:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.readVerificationRuntimeManifest = readVerificationRuntimeManifest;
+const node_fs_1 = __nccwpck_require__(87561);
+const node_path_1 = __nccwpck_require__(49411);
+const verification_runtime_policy_1 = __nccwpck_require__(89347);
+const MAX_MANIFEST_BYTES = 16 * 1024;
+function readVerificationRuntimeManifest(root) {
+    const path = (0, node_path_1.resolve)(root, verification_runtime_policy_1.VERIFICATION_RUNTIME_MANIFEST);
+    let descriptor;
+    try {
+        let directory;
+        try {
+            directory = (0, node_fs_1.lstatSync)((0, node_path_1.join)(root, '.copilot'));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return [];
+            throw error;
+        }
+        if (!directory.isDirectory() || directory.isSymbolicLink()
+            || (0, node_fs_1.realpathSync)((0, node_path_1.join)(root, '.copilot')) !== (0, node_path_1.join)((0, node_fs_1.realpathSync)(root), '.copilot'))
+            throw new Error('Unsafe manifest parent');
+        let entry;
+        try {
+            entry = (0, node_fs_1.lstatSync)(path, { bigint: true });
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return [];
+            throw error;
+        }
+        if (!entry.isFile() || entry.isSymbolicLink() || entry.nlink !== 1n || entry.size > BigInt(MAX_MANIFEST_BYTES))
+            throw new Error('Unsafe manifest');
+        descriptor = (0, node_fs_1.openSync)(path, node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NOFOLLOW ?? 0));
+        const opened = (0, node_fs_1.fstatSync)(descriptor, { bigint: true });
+        if (!opened.isFile() || opened.nlink !== 1n || opened.dev !== entry.dev || opened.ino !== entry.ino
+            || opened.size > BigInt(MAX_MANIFEST_BYTES))
+            throw new Error('Manifest changed');
+        const bytes = Buffer.alloc(MAX_MANIFEST_BYTES + 1);
+        const size = (0, node_fs_1.readSync)(descriptor, bytes, 0, bytes.length, 0);
+        if (size > MAX_MANIFEST_BYTES)
+            throw new Error('Oversized manifest');
+        return (0, verification_runtime_policy_1.parseVerificationRuntimeManifest)(JSON.parse(bytes.subarray(0, size).toString('utf8')));
+    }
+    catch {
+        throw new verification_runtime_policy_1.VerificationPrerequisiteError('manifest-invalid');
+    }
+    finally {
+        if (descriptor !== undefined)
+            (0, node_fs_1.closeSync)(descriptor);
+    }
+}
+
+
+/***/ }),
+
+/***/ 23100:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.assertVerificationRuntimePrerequisites = assertVerificationRuntimePrerequisites;
+const node_child_process_1 = __nccwpck_require__(17718);
+const node_path_1 = __nccwpck_require__(49411);
+const verification_runtime_manifest_1 = __nccwpck_require__(91053);
+const verification_runtime_policy_1 = __nccwpck_require__(89347);
+const probe = (program, args, environment) => {
+    const result = (0, node_child_process_1.spawnSync)(program, [...args], { env: environment, encoding: 'utf8', shell: false,
+        windowsHide: true, timeout: 5000, maxBuffer: 8192, stdio: ['ignore', 'pipe', 'pipe'] });
+    return { status: result.status, output: `${result.stdout ?? ''}\n${result.stderr ?? ''}`, failed: !!result.error };
+};
+const hasControlCharacter = (value) => [...value].some(character => character.charCodeAt(0) < 32);
+/** Fixed version probes only; never installs a runtime or executes a repository-provided bootstrap. */
+function assertVerificationRuntimePrerequisites(environment, root = process.cwd(), run = probe, platform = process.platform, job = process.env.GITHUB_JOB) {
+    for (const requirement of (0, verification_runtime_manifest_1.readVerificationRuntimeManifest)(root)) {
+        checkRuntime(requirement, environment, run, platform, job);
+    }
+}
+function checkRuntime(requirement, environment, run, platform, job) {
+    const spec = verification_runtime_policy_1.VERIFICATION_RUNTIME_SPECS[requirement.runtime];
+    let program = spec.program;
+    let args = spec.args;
+    if (requirement.runtime === 'java' && environment.JAVA_HOME) {
+        const paths = platform === 'win32' ? node_path_1.win32 : node_path_1.posix;
+        if (!paths.isAbsolute(environment.JAVA_HOME) || hasControlCharacter(environment.JAVA_HOME)) {
+            throw new verification_runtime_policy_1.VerificationPrerequisiteError('unavailable', requirement, undefined, job);
+        }
+        program = paths.join(environment.JAVA_HOME, 'bin', platform === 'win32' ? 'java.exe' : 'java');
+    }
+    else if (requirement.runtime === 'python' && platform === 'win32')
+        program = 'python';
+    else if (requirement.runtime === 'pnpm' && platform === 'win32') {
+        const systemRoot = environment.SystemRoot;
+        if (!systemRoot || !node_path_1.win32.isAbsolute(systemRoot) || hasControlCharacter(systemRoot)) {
+            throw new verification_runtime_policy_1.VerificationPrerequisiteError('unavailable', requirement, undefined, job);
+        }
+        program = node_path_1.win32.join(systemRoot, 'System32', 'cmd.exe');
+        args = ['/d', '/s', '/c', 'pnpm --version'];
+    }
+    let result;
+    try {
+        result = run(program, args, environment);
+    }
+    catch {
+        throw new verification_runtime_policy_1.VerificationPrerequisiteError('unavailable', requirement, undefined, job);
+    }
+    if (result.failed || result.status !== 0 || result.output.length > 8192) {
+        throw new verification_runtime_policy_1.VerificationPrerequisiteError('unavailable', requirement, undefined, job);
+    }
+    const observed = (0, verification_runtime_policy_1.verificationRuntimeVersion)(requirement.runtime, result.output);
+    if (!observed)
+        throw new verification_runtime_policy_1.VerificationPrerequisiteError('unreadable-version', requirement, undefined, job);
+    if (!(0, verification_runtime_policy_1.verificationRuntimeMatches)(requirement.version, observed)) {
+        throw new verification_runtime_policy_1.VerificationPrerequisiteError('version-mismatch', requirement, observed, job);
+    }
+}
+
+
 /***/ }),
 
 /***/ 92540:

package/build/web/assets/index-CfyclPC5.css

@@ -0,0 +1 @@
+.setup-help.svelte-1fzpnf1{margin-bottom:1.5rem}.help-links.svelte-1fzpnf1{flex-wrap:wrap;gap:.5rem 1.25rem;display:flex}a.svelte-1fzpnf1{text-underline-offset:.2em;font-size:.875rem}p.svelte-1fzpnf1{margin:.4rem 0 0;font-size:.8rem}code.svelte-1spw6vv,bdi.svelte-1spw6vv{overflow-wrap:anywhere}.runner-details.svelte-1spw6vv{margin-block:1rem}.installation-review.svelte-44ckab{min-width:0;margin-block:1.25rem}.routes.svelte-44ckab{padding-inline-start:1.25rem}.routes.svelte-44ckab li:where(.svelte-44ckab){padding-block:.5rem}code.svelte-44ckab,pre.svelte-44ckab,bdi.svelte-44ckab{white-space:pre-wrap;overflow-wrap:anywhere}pre.svelte-44ckab{max-height:28rem;padding:.75rem;font-size:.8rem;overflow:auto}details.svelte-44ckab{margin-block:.75rem}.batch-targets.svelte-17t72gm{gap:1rem;margin-block:1rem;display:grid}.batch-target.svelte-17t72gm{border:1px solid var(--line);border-radius:.8rem;min-width:0;padding:1rem}h3.svelte-17t72gm{overflow-wrap:anywhere;margin-top:0}.target-status.svelte-17t72gm{font-weight:600}pre.svelte-17t72gm{max-height:24rem;padding:.75rem;font-size:.78rem;overflow:auto}code.svelte-17t72gm{overflow-wrap:anywhere}details.svelte-17t72gm{margin-block:.75rem}.batch-buttons.svelte-17t72gm{flex-wrap:wrap;gap:.75rem;display:flex}.batch-technical.svelte-17t72gm{margin-top:1.25rem}fieldset.svelte-1qngno{border:0;min-width:0;margin:1rem 0;padding:0}legend.svelte-1qngno{margin-bottom:.5rem;font-weight:600}.repository-list.svelte-1qngno{gap:.5rem;display:grid}.repository-row.svelte-1qngno{border:1px solid var(--line);border-radius:.75rem;align-items:start;gap:.75rem;padding:.75rem;display:flex}.repository-row.svelte-1qngno input:where(.svelte-1qngno){flex:none;width:auto;margin-top:.25rem}.repository-row.svelte-1qngno span:where(.svelte-1qngno){overflow-wrap:anywhere;min-width:0}.repository-row.svelte-1qngno small:where(.svelte-1qngno){margin-top:.25rem;display:block}.batch-actions.svelte-1qngno{flex-wrap:wrap;align-items:center;gap:.5rem;margin:.75rem 0;display:flex}details.svelte-1qngno{margin:1rem 0}:root{--lightningcss-light:initial;--lightningcss-dark: ;color-scheme:light dark;--page:#f6f8f7;--side:#102423;--side-line:#31504b;--side-text:#e8f5f0;--surface:#fff;--surface-soft:#f3f7f5;--line:#d7e3df;--control-line:#748b82;--text:#18312c;--muted:#58736b;--accent:#176e5e;--accent-strong:#075743;--accent-tint:#dff4e9;--focus:#966000;--warn:#76510d;--warn-bg:#fff6df;--error:#a73434;--error-bg:#fff0ec;--shadow:0 18px 50px #1e403414;font-family:Inter,ui-sans-serif,-apple-system,BlinkMacSystemFont,Segoe UI,sans-serif}@media (prefers-color-scheme:dark){:root{--lightningcss-light: ;--lightningcss-dark:initial}:root:not([data-theme=light]){--page:#0d1716;--side:#10201d;--side-line:#294a41;--side-text:#eaf7f1;--surface:#182722;--surface-soft:#20342d;--line:#355247;--control-line:#688f7f;--text:#eaf5ee;--muted:#adccbc;--accent:#7ed6ac;--accent-strong:#a4edc2;--accent-tint:#234b38;--focus:#ffca6a;--warn:#ffdd8a;--warn-bg:#463b21;--error:#ffc0b7;--error-bg:#4a2b2a;--shadow:0 18px 50px #00000024}}:root[data-theme=dark]{--page:#0d1716;--side:#10201d;--side-line:#294a41;--side-text:#eaf7f1;--surface:#182722;--surface-soft:#20342d;--line:#355247;--control-line:#688f7f;--text:#eaf5ee;--muted:#adccbc;--accent:#7ed6ac;--accent-strong:#a4edc2;--accent-tint:#234b38;--focus:#ffca6a;--warn:#ffdd8a;--warn-bg:#463b21;--error:#ffc0b7;--error-bg:#4a2b2a;--shadow:0 18px 50px #00000024}:root[data-theme=light]{--lightningcss-light:initial;--lightningcss-dark: ;color-scheme:light}:root[data-theme=dark]{--lightningcss-light: ;--lightningcss-dark:initial;color-scheme:dark}*{box-sizing:border-box}body{background:var(--page);color:var(--text);margin:0}button,input,select{font:inherit}button{cursor:pointer}button:disabled{cursor:not-allowed;opacity:.5}:focus-visible{outline:3px solid var(--focus);outline-offset:3px}.visually-hidden{clip:rect(0, 0, 0, 0);white-space:nowrap;border:0;width:1px;height:1px;margin:-1px;padding:0;position:absolute;overflow:hidden}a{color:var(--accent-strong);text-underline-offset:3px}.card,.context-card{background:var(--surface);border:1px solid var(--line);box-shadow:var(--shadow);border-radius:15px}.primary{border:1px solid var(--accent-strong);background:var(--accent-strong);color:var(--side);border-radius:8px;min-height:43px;padding:12px 18px;font-size:12px;font-weight:800}:root[data-theme=light] .primary,:root:not([data-theme=dark]) .primary{color:#fff}@media (prefers-color-scheme:dark){:root:not([data-theme=light]) .primary{color:#0d2419}}.primary span{margin-left:18px}.primary:hover:not(:disabled){filter:brightness(1.1)}.secondary{border:1px solid var(--control-line);color:var(--text);background:var(--surface-soft);border-radius:8px;padding:11px 16px;font-size:12px;font-weight:700}@media (prefers-reduced-motion:reduce){*,:before,:after{scroll-behavior:auto!important;transition-duration:.01ms!important;animation-duration:.01ms!important}}.shell{grid-template-columns:minmax(250px,288px) minmax(0,1fr);min-height:100vh;display:grid}.sidebar{background:var(--side);color:var(--side-text);flex-direction:column;min-height:100vh;padding:34px 28px;display:flex;position:sticky;top:0}.brand{letter-spacing:-.035em;align-items:center;gap:13px;display:flex}.brand-mark{color:#0c3021;background:#75d9a0;border-radius:11px;place-items:center;width:37px;height:37px;font-size:26px;line-height:1;display:grid}.brand strong{font-size:23px;line-height:1;display:block}.brand small{letter-spacing:.23em;color:#aac8bd;margin-top:5px;font-size:9px;font-weight:800;display:block}.rail-caption{color:#9dbab0;letter-spacing:.18em;margin-block:78px 22px;margin-inline-start:7px;font-size:10px;font-weight:800}.sidebar .description{color:#afcabe}.steps{margin:0;padding:0;list-style:none;position:relative}.steps:before{content:"";top:22px;bottom:22px;background:var(--side-line);width:1px;position:absolute;inset-inline-start:19px}.steps li{color:#a6c2b7;border-radius:10px;align-items:center;gap:16px;min-height:55px;padding-block:8px;padding-inline:1px 12px;font-size:13px;font-weight:600;display:flex;position:relative}.steps li.current{color:#fff;background:#25443b}.steps li.completed{color:#dbf2e4}.step-index{border:1px solid var(--side-line);background:var(--side);letter-spacing:.04em;border-radius:50%;flex:0 0 37px;place-items:center;height:37px;font-size:11px;font-weight:800;display:grid}.steps .current .step-index{color:#102b1d;background:#80dba8;border-color:#80dba8}.steps .completed .step-index{color:#b9f8c9;background:#204c37;border-color:#45966b;font-size:15px}.sidebar-note{border:1px solid var(--side-line);background:#ffffff09;border-radius:13px;gap:13px;margin-top:auto;padding:19px 16px;display:flex}.sidebar-note>span{color:#8fe1ae;font-size:20px}.sidebar-note strong{font-size:12px}.sidebar-note p{color:#afcabe;margin:6px 0 0;font-size:11px;line-height:1.6}.main{min-width:0}.topbar{border-bottom:1px solid var(--line);background:var(--surface);flex-wrap:wrap;justify-content:space-between;align-items:center;gap:16px;min-height:80px;padding:20px clamp(24px,4vw,70px);display:flex}.breadcrumb{flex:240px;align-items:center;gap:12px;min-width:0;font-size:12px;display:flex}.breadcrumb span:first-child{color:var(--muted);letter-spacing:.14em;font-size:10px;font-weight:800}.breadcrumb span:nth-child(2){color:var(--muted)}.breadcrumb strong{white-space:normal;overflow-wrap:anywhere;min-width:0;line-height:1.5}.top-actions{flex-shrink:0;align-items:center;gap:18px;display:flex}.local-pill{color:var(--accent-strong);background:var(--accent-tint);letter-spacing:.08em;white-space:nowrap;border-radius:6px;padding:8px 11px;font-size:10px;font-weight:800}.pulse-dot{background:currentColor;border-radius:50%;width:6px;height:6px;margin-right:5px;display:inline-block}.theme-switch{border:1px solid var(--line);background:var(--surface-soft);border-radius:8px;padding:3px;display:flex}.theme-switch button{color:var(--muted);background:0 0;border:0;border-radius:5px;min-width:31px;height:27px;font-size:11px}.theme-switch button.active{background:var(--surface);color:var(--text);font-weight:800;box-shadow:0 1px 4px #0000001f}.content{max-width:1320px;margin:0 auto;padding:52px clamp(24px,4vw,70px) 35px}.eyebrow{color:var(--accent-strong);letter-spacing:.18em;align-items:center;gap:10px;font-size:10px;font-weight:900;display:flex}.eyebrow-line{background:var(--accent);width:21px;height:2px}.eyebrow-count{color:var(--muted);letter-spacing:.09em;margin-inline-start:8px}h1{letter-spacing:-.045em;max-width:860px;margin:15px 0 13px;font-size:clamp(30px,3vw,45px);line-height:1.15}.lede{color:var(--muted);max-width:700px;margin:0 0 30px;font-size:14px;line-height:1.65}.workspace-grid{grid-template-columns:minmax(0,1.65fr) minmax(230px,.8fr);align-items:start;gap:19px;display:grid}.workspace-grid:has(.plan-review){grid-template-columns:1fr}.workspace-grid:has(.plan-review) .context-column{grid-template-columns:repeat(2,minmax(0,1fr))}.context-column{gap:17px;display:grid}.context-card{box-shadow:none;padding:25px}.context-icon{background:var(--accent-tint);width:32px;height:32px;color:var(--accent-strong);border-radius:8px;place-items:center;font-size:19px;display:grid}.context-card h2{letter-spacing:-.015em;margin:17px 0 7px;font-size:14px}.context-card p,.context-card>small{color:var(--muted);margin:0 0 12px;font-size:12px;line-height:1.65;display:block}.context-card code{background:var(--surface-soft);overflow-wrap:anywhere;border-radius:6px;padding:10px;font-size:11px;display:block}.permissions ul{margin:8px 0 13px;padding:0;list-style:none}.permissions li{border-bottom:1px solid var(--line);justify-content:space-between;gap:10px;padding:9px 0;font-size:11px;display:flex}.permissions li small{color:var(--muted);margin-top:3px;display:block}.permissions li strong{color:var(--accent-strong);text-transform:uppercase;font-size:9px}.permission-progress{padding:clamp(20px,4vw,38px)}.permission-progress h2{margin:0 0 8px}.permission-progress p{color:var(--muted);line-height:1.5}.permission-progress ol{margin:20px 0 0;padding:0;list-style:none}.permission-progress li{border-top:1px solid var(--line);align-items:center;gap:14px;padding:12px 0;display:flex}.permission-progress li>span:nth-child(2){flex:1;min-width:0}.permission-progress li small{color:var(--muted);overflow-wrap:anywhere;display:block}.permission-progress-symbol{background:var(--surface-soft);border-radius:50%;flex:none;place-items:center;width:30px;height:30px;display:grid}.permission-progress-done .permission-progress-symbol{color:var(--accent-strong)}.permission-progress-failed .permission-progress-symbol{color:var(--danger,#a33)}.permission-progress-state{text-align:right;max-width:35%;font-size:.8rem;font-weight:600}@media (width<=600px){.permission-progress li{flex-wrap:wrap;align-items:flex-start}.permission-progress-state{text-align:left;max-width:none;margin-left:44px}}footer{color:var(--muted);opacity:.85;letter-spacing:.11em;margin-top:40px;font-size:9px;font-weight:700}footer span{margin:0 8px}[dir=rtl] .context-card code,[dir=rtl] .result-links code,[dir=rtl] .producer-option strong,[dir=rtl] .producer-option small,[dir=rtl] input[type=password]{direction:ltr;unicode-bidi:isolate}.decision-card{min-height:360px;padding:clamp(25px,3vw,40px)}.card-header{justify-content:space-between;align-items:center;gap:12px;margin-bottom:29px;display:flex}.card-kicker{color:var(--accent-strong);letter-spacing:.17em;font-size:10px;font-weight:900}.revision{color:var(--muted);letter-spacing:.08em;font-size:10px}.description{white-space:pre-line;color:var(--muted);margin-top:0;font-size:13px;line-height:1.65}.question-heading{flex-wrap:wrap;justify-content:space-between;align-items:center;gap:10px;margin-bottom:15px;display:flex}.question-heading h2,.decision-card>label{margin:0 0 10px;font-size:15px;font-weight:700;line-height:1.4;display:block}.phase-tag{color:var(--accent-strong);background:var(--accent-tint);letter-spacing:.07em;border-radius:5px;padding:6px 8px;font-size:9px;font-weight:900}input[type=text],input[type=password],input[type=number],select{border:1px solid var(--control-line);background:var(--surface-soft);width:100%;min-height:46px;color:var(--text);border-radius:8px;padding:10px 13px}textarea{resize:vertical;border:1px solid var(--control-line);background:var(--surface-soft);width:100%;min-height:120px;color:var(--text);font:inherit;border-radius:8px;padding:12px 13px;line-height:1.5}.language-switch{color:var(--muted);white-space:nowrap;align-items:center;gap:7px;font-size:11px;font-weight:700;display:flex}.language-switch select{width:auto;max-width:140px;min-height:32px;padding:5px 8px;font-size:11px}.question-details{border:1px solid var(--line);background:var(--surface-soft);border-radius:8px;margin-bottom:20px;padding:13px 15px;font-size:12px}.question-details summary{cursor:pointer;color:var(--accent-strong);font-weight:800}.question-details dl{grid-template-columns:minmax(90px,130px) minmax(0,1fr);gap:10px 14px;margin:14px 0 0;line-height:1.55;display:grid}.question-details dt{color:var(--text);font-weight:750}.question-details dd{color:var(--muted);margin:0}.question-help-link{margin:-12px 0 18px;font-size:12px;font-weight:700}.discovery-actions{flex-wrap:wrap;align-items:center;gap:8px 14px;margin:4px 0 16px;display:flex}.discovery-actions .field-help{margin:0}.secondary-button{border:1px solid var(--control-line);background:var(--surface-soft);color:var(--accent-strong);font:inherit;border-radius:8px;padding:9px 13px;font-size:12px;font-weight:750}.secondary-button:hover:not(:disabled),.secondary-button:focus-visible{border-color:var(--accent);background:var(--accent-tint)}.secondary-button:disabled{opacity:.55;cursor:not-allowed}.status-review-list{color:var(--muted);margin:6px 0 18px;padding-inline-start:20px;font-size:12px;line-height:1.7}.status-review-list strong{color:var(--text)}.producer-grid{margin-bottom:20px;padding:6px}.check-option.producer-option{grid-template-columns:minmax(0,1fr) auto;align-items:start;gap:16px;padding:14px 16px;display:grid}.producer-option>label{cursor:pointer;align-items:flex-start;gap:12px;min-width:0;display:flex}.producer-option>label>input{flex:0 0 17px;margin:3px 0 0}.producer-option>label>span{overflow-wrap:anywhere;gap:5px;min-width:0;display:grid}.producer-option small{color:var(--muted);font-size:10px;line-height:1.5}.producer-option a{font-size:11px;line-height:1.5}.producer-option>a{max-width:140px}.producer-links{gap:8px;max-width:140px;display:grid}.producer-manual-fields{grid-template-columns:repeat(2,minmax(0,1fr));gap:16px;display:grid}.producer-manual-fields>label,.project-manual-field{gap:8px;font-size:12px;font-weight:700;line-height:1.5;display:grid}.producer-manual-fields>label:last-child{grid-column:1/-1}.producer-add{margin-top:16px}.project-manual-field{margin-top:20px}input[type=checkbox]{accent-color:var(--accent);width:17px;height:17px}.field-help{color:var(--muted);margin:14px 0 24px;font-size:12px;line-height:1.6}.segmented{gap:9px;display:flex}.segmented button{border:1px solid var(--control-line);color:var(--text);background:var(--surface-soft);border-radius:8px;flex:1;padding:13px;font-weight:700}.segmented button.selected{border-color:var(--accent);background:var(--accent-tint);color:var(--accent-strong)}.check-grid{gap:10px;display:grid}.check-option{background:var(--surface-soft);border:1px solid var(--control-line);border-radius:7px;align-items:center;gap:10px;padding:10px 13px;font-size:12px;display:flex}.choice-list{gap:9px;display:grid}.choice-card{text-align:left;background:var(--surface-soft);width:100%;min-height:52px;color:var(--text);border:1px solid var(--control-line);border-radius:8px;justify-content:space-between;align-items:center;padding:13px 15px;font-size:13px;font-weight:650;display:flex}.choice-card:hover:not(:disabled){border-color:var(--accent);background:var(--accent-tint)}.github-link{background:var(--accent-tint);border:1px solid var(--accent);border-radius:8px;margin:0 0 12px;padding:14px;font-size:13px;font-weight:800;text-decoration:none;display:block}.github-link span{float:right}.plan-review{gap:24px;font-size:12px;line-height:1.65;display:grid}.plan-review>.description,.plan-review .field-help{margin:0}.plan-sections{grid-template-columns:repeat(2,minmax(0,1fr));align-items:start;gap:16px;display:grid}.plan-decisions,.plan-inventory,.plan-warnings{background:var(--surface-soft);border:1px solid var(--line);border-radius:8px;min-width:0;padding:20px}.plan-decisions h3,.plan-warnings h3{margin:0 0 14px;font-size:13px;line-height:1.5}.plan-decisions p{margin:0 0 16px}.plan-decisions>:last-child{margin-bottom:0}.plan-decisions dl{gap:0;margin:0;display:grid}.plan-decisions dl>div{border-bottom:1px solid var(--line);grid-template-columns:minmax(130px,35%) minmax(0,1fr);gap:20px;padding:12px 0;display:grid}.plan-decisions dl>div:first-child{padding-top:0}.plan-decisions dl>div:last-child{border-bottom:0;padding-bottom:0}.plan-decisions dt{color:var(--muted)}.plan-decisions dd{overflow-wrap:anywhere;min-width:0;margin:0}.plan-decisions .field-help{margin-top:20px}.plan-decisions ul,.plan-inventory ul,.plan-warnings ul{overflow-wrap:anywhere;margin:0;padding-inline-start:20px;font-size:12px;line-height:1.7}.plan-decisions li+li,.plan-inventory li+li,.plan-warnings li+li{margin-top:6px}.plan-inventory summary{cursor:pointer;font-size:13px;font-weight:750}.plan-inventory summary span:last-child{float:right;color:var(--accent-strong);margin-inline-start:12px}.plan-inventory[open] summary{margin-bottom:16px}.plan-warnings{color:var(--warn);background:var(--warn-bg)}.plan-edit{border-top:1px solid var(--line);padding-top:24px}.plan-edit h3{margin:0 0 4px;font-size:14px}.plan-edit-actions{flex-wrap:wrap;gap:10px;margin-top:16px;display:flex}.button-row{flex-wrap:wrap;align-items:center;gap:12px;margin-top:24px;display:flex}.button-row>.primary{margin-left:auto}.plan-review>.button-row{border-top:1px solid var(--line);margin-top:0;padding-top:24px}.review-pass,.banner{white-space:pre-line;border-radius:8px;margin:0 0 20px;padding:14px 18px;font-size:12px;line-height:1.5}.review-pass{color:var(--accent-strong);background:var(--accent-tint);border:1px solid var(--accent)}.review-pass span{margin-inline-end:8px;font-weight:800}.banner{background:var(--surface-soft);border:1px solid var(--line)}.banner p{margin:5px 0 0}.banner.warning{color:var(--warn);background:var(--warn-bg);border-color:var(--warn)}.banner.error{color:var(--error);background:var(--error-bg);border-color:var(--error)}.banner.success{color:var(--accent-strong);background:var(--accent-tint);border-color:var(--accent)}.banner button{margin-top:12px}.cancel-link{color:var(--muted);background:0 0;border:0;margin-top:18px;padding:5px 0;font-size:12px;text-decoration:underline}.result-card,.waiting-card{max-width:750px;padding:36px}.result-icon{background:var(--accent-tint);width:43px;height:43px;color:var(--accent-strong);border-radius:50%;place-items:center;font-size:22px;display:grid}.result-card h2,.waiting-card h2{margin:18px 0 10px;font-size:21px}.result-card p,.waiting-card p{color:var(--muted);font-size:13px;line-height:1.6}.result-facts{border:1px solid var(--line);background:var(--surface-soft);border-radius:8px;margin:24px 0;padding:20px}.result-facts p{margin:8px 0}.result-facts strong{color:var(--text)}.result-effects{border:1px solid var(--line);background:var(--surface-soft);border-radius:8px;margin:20px 0;padding:14px 17px}.result-effects h3{color:var(--text);margin:0 0 10px;font-size:13px}.result-effects ul{margin:0;padding-left:20px}.result-effects li{overflow-wrap:anywhere;padding:3px 0;font-size:12px}.result-links{flex-wrap:wrap;align-items:center;gap:20px;margin:22px 0;font-size:12px;display:flex}.result-links code{background:var(--surface-soft);border-radius:5px;padding:8px}.spinner{border:3px solid var(--line);border-top-color:var(--accent);border-radius:50%;width:25px;height:25px;animation:1s linear infinite spin}@keyframes spin{to{transform:rotate(360deg)}}.result-facts h3{margin:0 0 16px;font-size:15px;line-height:1.5}.result-permissions{margin:20px 0 0;padding-inline-start:20px;font-size:13px;line-height:1.65}.result-permissions li+li{margin-top:16px}.result-permissions p{margin:6px 0 0}@media (width<=1100px){.workspace-grid{grid-template-columns:1fr}.context-column{grid-template-columns:repeat(2,minmax(0,1fr))}}@media (width<=780px){.shell{display:block}.sidebar{min-height:0;padding:16px 20px;position:static}.rail-caption,.sidebar-note{display:none}.steps{flex-wrap:wrap;gap:4px;margin-top:18px;display:flex}.steps:before{display:none}.steps li{flex:none;gap:6px;min-height:37px;padding:4px 7px;font-size:11px}.step-index{flex-basis:26px;width:26px;height:26px}.topbar{flex-wrap:wrap;height:auto;min-height:65px;padding:12px 20px}.content{padding:28px 20px}}@media (width<=540px){.context-column,.plan-sections{grid-template-columns:1fr}.workspace-grid:has(.plan-review) .context-column{grid-template-columns:1fr}.top-actions{flex-wrap:wrap;justify-content:space-between;gap:12px;width:100%;min-width:0}.decision-card{padding:22px}.breadcrumb{max-width:100%}h1{font-size:29px}.plan-decisions dl>div{grid-template-columns:1fr;gap:2px}.question-details dl{grid-template-columns:1fr;gap:3px}.question-details dd{margin-bottom:9px}.language-switch{margin-inline-start:auto}}@media (width<=640px){.check-option.producer-option{grid-template-columns:minmax(0,1fr);gap:12px}.producer-option>a,.producer-links{max-width:none;margin-inline-start:29px}.producer-manual-fields{grid-template-columns:minmax(0,1fr)}}.management-status{color:var(--accent-strong);font-weight:750}.management-actions{flex-wrap:wrap;gap:12px;margin-block:24px 32px;display:flex}.management-section{border-top:1px solid var(--line);padding-block:26px}.management-section h2{margin-top:0}.management-section summary{cursor:pointer;color:var(--accent-strong);font-weight:700}.management-settings{grid-template-columns:repeat(2,minmax(0,1fr));gap:16px;display:grid}.management-setting{border:1px solid var(--line);background:var(--surface-soft);border-radius:10px;justify-content:space-between;align-items:center;gap:16px;padding:18px;display:flex}.management-setting h3{margin:0 0 8px;font-size:14px}.management-setting p{color:var(--muted);overflow-wrap:anywhere;margin:0}.management-setting .button{flex-shrink:0}.management-values{gap:8px;display:grid}.management-values dt{overflow-wrap:anywhere;margin-top:12px;font-weight:650}.management-values dd{white-space:pre-wrap;overflow-wrap:anywhere;color:var(--muted);margin:0;line-height:1.6}.management-workflow{padding-block:16px}:is(.workspace-grid:has(.management-settings),.workspace-grid:has(.management-status)){grid-template-columns:1fr}.workspace-grid:has(.management-status) .context-column{display:none}@media (width<=800px){.management-settings{grid-template-columns:1fr}}@media (width<=420px){.management-setting{flex-direction:column;align-items:stretch}.management-setting .button{align-self:flex-end}}