@wardby/cli 0.5.2 → 0.6.0

package/dist/core/related-pull-requests.d.ts

@@ -3,9 +3,18 @@
  * request opened by a coding run in the same top-level run tree (a lead that
  * fanned out to several repositories), plus any recorded for the same tracker
  * issue (IssuePullRequest). Control-plane rows only.
- * Ordered by when each pull request's coding run was dispatched: the lead's
- * delegation order (for a lead with parallelDelegations, the order its
- * concurrent delegations were admitted, ties broken by repository#number).
+ * Ordered by the delegating agent's declared merge order when any entry has
+ * one (CodingRun.mergeOrder; nulls last), then by when each pull request's
+ * coding run was dispatched: the lead's delegation order (for a lead with
+ * parallelDelegations, the order its concurrent delegations were admitted,
+ * ties broken by repository#number). A pull request's mergeOrder is the
+ * newest non-null value set by its opener run or any later continuation
+ * that acted on it, so a lead that re-delegates with a different order
+ * after the fact is reflected here. When mergeOrder is set on any entry,
+ * every truncation cap below this collector (MAX_RELATED_GROUP here,
+ * MAX_SIBLING_HINTS on openSiblingsOf, MAX_RELATED_PULL_REQUESTS on
+ * renderRelatedSection) drops entries with no order first, since they sort
+ * last.
  * A PR opened while siblings were still running lists only the PRs opened
  * before it; updateRelatedPullRequests rewrites every open PR of the set
  * with the full list when the lead run ends. Continuations join
@@ -13,7 +22,7 @@
  * pull requests brings the original request's tree, and the original request
  * brings every later follow-up tree that continued one of its pull requests.
  */
-import { type PrismaClient, type Run } from "#prisma";
+import { type PrismaClient, type Run, type RunStatus } from "#prisma";
 import { type IssueTrackerRegistry } from "../providers/issue-tracker/types.js";
 import type { ReviewHostRegistry } from "../providers/review-host/types.js";
 /** Most pull requests a group holds; the description shows fewer (MAX_RELATED_PULL_REQUESTS). */
@@ -28,6 +37,13 @@ export interface RelatedPullRequest {
     openedByRunId: string;
     /** Only when stored (IssuePullRequest.state, kept current by pr_closed); otherwise unknown. */
     state?: StoredPullRequestState;
+    /**
+     * Step in the delegating agent's merge order (CodingRun.mergeOrder, 1-99):
+     * the newest non-null value among the coding run that opened it and its
+     * continuations. Absent when none of them set one, or when the entry only
+     * came from IssuePullRequest (no CodingRun to read it from).
+     */
+    mergeOrder?: number;
 }
 export interface RelatedPullRequestGroup {
     pullRequests: RelatedPullRequest[];
@@ -36,7 +52,35 @@ export interface RelatedPullRequestGroup {
         provider: string;
         key: string;
     };
+    /**
+     * The top-level run of every run tree the walk visited (the original
+     * request and each follow-up tree that continued one of its pull
+     * requests), with its status; absent when none was read. `codingRun` is
+     * true when the root is itself a coding run (a top-level follow-up such
+     * as a review fix round or an @mention picked up by a coding link), not a
+     * native lead agent's run.
+     */
+    roots?: Array<{
+        id: string;
+        status: RunStatus;
+        codingRun: boolean;
+    }>;
 }
+/**
+ * The top-level run of the tree a pull request's marker run belongs to,
+ * whatever its status: the marker's coding run (a continuation resolves to
+ * its root coding run first), then up its parents. Null when the marker
+ * names no coding run, or one recorded for a different repository than
+ * `repository` (compared case-insensitively; omit it to skip the check).
+ * `isOpener` is true when that root is the opening coding run itself (the
+ * pull request was not delegated). The single place this walk and its
+ * repository guard live (requestLeadRunId, the merge order check).
+ */
+export declare function runTreeRoot(db: Pick<PrismaClient, "$queryRaw">, markerRunId: string, repository?: string): Promise<{
+    id: string;
+    status: RunStatus;
+    isOpener: boolean;
+} | null>;
 export declare function collectRelatedPullRequests(db: RelatedPullRequestsDb, runId: string, 
 /**
  * Scopes the issue join (and any tree row explicitly tagged for a

package/dist/core/related-pull-requests.js

@@ -3,9 +3,18 @@
  * request opened by a coding run in the same top-level run tree (a lead that
  * fanned out to several repositories), plus any recorded for the same tracker
  * issue (IssuePullRequest). Control-plane rows only.
- * Ordered by when each pull request's coding run was dispatched: the lead's
- * delegation order (for a lead with parallelDelegations, the order its
- * concurrent delegations were admitted, ties broken by repository#number).
+ * Ordered by the delegating agent's declared merge order when any entry has
+ * one (CodingRun.mergeOrder; nulls last), then by when each pull request's
+ * coding run was dispatched: the lead's delegation order (for a lead with
+ * parallelDelegations, the order its concurrent delegations were admitted,
+ * ties broken by repository#number). A pull request's mergeOrder is the
+ * newest non-null value set by its opener run or any later continuation
+ * that acted on it, so a lead that re-delegates with a different order
+ * after the fact is reflected here. When mergeOrder is set on any entry,
+ * every truncation cap below this collector (MAX_RELATED_GROUP here,
+ * MAX_SIBLING_HINTS on openSiblingsOf, MAX_RELATED_PULL_REQUESTS on
+ * renderRelatedSection) drops entries with no order first, since they sort
+ * last.
  * A PR opened while siblings were still running lists only the PRs opened
  * before it; updateRelatedPullRequests rewrites every open PR of the set
  * with the full list when the lead run ends. Continuations join
@@ -36,17 +45,50 @@ async function treeCodingRuns(db, seeds) {
       UNION
       SELECT p."id", p."parentRunId" FROM "Run" p JOIN up u ON p."id" = u."parentRunId"
     ), down AS (
-      SELECT u."id" FROM up u WHERE u."parentRunId" IS NULL
+      SELECT u."id", u."id" AS "rootId" FROM up u WHERE u."parentRunId" IS NULL
       UNION
-      SELECT c."id" FROM "Run" c JOIN down d ON c."parentRunId" = d."id"
+      SELECT c."id", d."rootId" FROM "Run" c JOIN down d ON c."parentRunId" = d."id"
     )
-    SELECT cr."runId", cr."result", cr."rootCodingRunId", cr."issueProvider", cr."issueKey", r."startedAt"
+    SELECT cr."runId", cr."result", cr."rootCodingRunId", cr."issueProvider", cr."issueKey", cr."mergeOrder", r."startedAt",
+      d."rootId" AS "treeRootId", root."status"::text AS "treeRootStatus",
+      EXISTS (SELECT 1 FROM "CodingRun" rc WHERE rc."runId" = d."rootId") AS "treeRootIsCodingRun"
     FROM "CodingRun" cr
     JOIN down d ON cr."runId" = d."id"
     JOIN "Run" r ON r."id" = cr."runId"
+    JOIN "Run" root ON root."id" = d."rootId"
     ORDER BY r."startedAt" ASC, cr."runId" ASC
     LIMIT ${MAX_TREE_CODING_RUNS}`;
 }
+/**
+ * The top-level run of the tree a pull request's marker run belongs to,
+ * whatever its status: the marker's coding run (a continuation resolves to
+ * its root coding run first), then up its parents. Null when the marker
+ * names no coding run, or one recorded for a different repository than
+ * `repository` (compared case-insensitively; omit it to skip the check).
+ * `isOpener` is true when that root is the opening coding run itself (the
+ * pull request was not delegated). The single place this walk and its
+ * repository guard live (requestLeadRunId, the merge order check).
+ */
+export async function runTreeRoot(db, markerRunId, repository) {
+    const repo = repository ?? null;
+    // UNION, not UNION ALL: a parentRunId cycle (never written, but not a constraint) can't recurse forever.
+    const rows = await db.$queryRaw `
+    WITH RECURSIVE opener AS (
+      SELECT COALESCE(cr."rootCodingRunId", cr."runId") AS "id"
+      FROM "CodingRun" cr
+      WHERE cr."runId" = ${markerRunId}
+        AND (${repo}::text IS NULL OR lower(cr."repository") = lower(${repo}::text))
+    ), up AS (
+      SELECT r."id", r."parentRunId", r."status"::text AS "status" FROM "Run" r JOIN opener o ON r."id" = o."id"
+      UNION
+      SELECT p."id", p."parentRunId", p."status"::text FROM "Run" p JOIN up u ON p."id" = u."parentRunId"
+    )
+    SELECT u."id", u."status", u."id" IN (SELECT "id" FROM opener) AS "isOpener"
+    FROM up u
+    WHERE u."parentRunId" IS NULL
+    LIMIT 1`;
+    return rows[0] ?? null;
+}
 function safeRepository(value) {
     try {
         return normalizeGitHubRepository(value);
@@ -139,9 +181,40 @@ onlyIssueKey) {
                 number: pr.pullRequestNumber,
                 openedAt: new Date(r.startedAt),
                 openedByRunId: r.runId,
+                ...(r.mergeOrder != null ? { mergeOrder: r.mergeOrder } : {}),
             });
         }
     }
+    // A continuation dispatched with its own mergeOrder overrides the opener's
+    // (one that omits it stores the value it inherited), and it starts after
+    // the opener; the entry's mergeOrder is the newest non-null
+    // value among the opener row and every continuation row (same PR key,
+    // "pull_request_opened" or "pull_request_updated") found in the tree walk.
+    const newestMergeOrder = new Map();
+    for (const r of rows) {
+        if (r.mergeOrder == null)
+            continue;
+        const pr = pullRequestOutcome(r.result);
+        if (pr?.outcome !== "pull_request_opened" && pr?.outcome !== "pull_request_updated")
+            continue;
+        if (onlyIssueKey && r.issueKey && (r.issueProvider !== onlyIssueKey.provider || r.issueKey !== onlyIssueKey.key)) {
+            continue;
+        }
+        const repository = safeRepository(pr.repository);
+        if (!repository)
+            continue;
+        const key = keyOf(repository, pr.pullRequestNumber);
+        const startedAt = new Date(r.startedAt);
+        const current = newestMergeOrder.get(key);
+        if (!current || startedAt.getTime() >= current.startedAt.getTime()) {
+            newestMergeOrder.set(key, { startedAt, mergeOrder: r.mergeOrder });
+        }
+    }
+    for (const [key, entry] of byKey) {
+        const newest = newestMergeOrder.get(key);
+        if (newest)
+            entry.mergeOrder = newest.mergeOrder;
+    }
     const issueFilter = onlyIssueKey
         ? new Map([[`${onlyIssueKey.provider}\0${onlyIssueKey.key}`, onlyIssueKey]])
         : issues;
@@ -177,11 +250,23 @@ onlyIssueKey) {
             });
         }
     }
+    const order = (e) => e.mergeOrder ?? Number.POSITIVE_INFINITY;
     const pullRequests = [...byKey.values()]
-        .sort((a, b) => a.openedAt.getTime() - b.openedAt.getTime() ||
+        .sort((a, b) => order(a) - order(b) ||
+        a.openedAt.getTime() - b.openedAt.getTime() ||
         `${a.repository}#${a.number}`.localeCompare(`${b.repository}#${b.number}`))
         .slice(0, MAX_RELATED_GROUP);
-    return { pullRequests, ...(issue ? { issue } : {}) };
+    const roots = new Map();
+    for (const r of rows) {
+        if (r.treeRootId && r.treeRootStatus) {
+            roots.set(r.treeRootId, { status: r.treeRootStatus, codingRun: r.treeRootIsCodingRun === true });
+        }
+    }
+    return {
+        pullRequests,
+        ...(issue ? { issue } : {}),
+        ...(roots.size > 0 ? { roots: [...roots].map(([id, root]) => ({ id, ...root })) } : {}),
+    };
 }
 function issueFor(group, trackers) {
     if (!group.issue)
@@ -219,7 +304,12 @@ export async function updateRelatedPullRequests(db, run, hosts, trackers) {
         for (const pr of group.pullRequests) {
             // A stored merged/closed state is final and such a PR is never edited: no host read.
             if (pr.state === "merged" || pr.state === "closed") {
-                live.push({ repository: pr.repository, number: pr.number, state: pr.state });
+                live.push({
+                    repository: pr.repository,
+                    number: pr.number,
+                    state: pr.state,
+                    ...(pr.mergeOrder !== undefined ? { mergeOrder: pr.mergeOrder } : {}),
+                });
                 continue;
             }
             try {
@@ -240,12 +330,23 @@ export async function updateRelatedPullRequests(db, run, hosts, trackers) {
                     if (opener && opener.repository.toLowerCase() === pr.repository)
                         markerRunId = origin.markerRunId;
                 }
-                live.push({ repository: pr.repository, number: pr.number, state, ...(markerRunId ? { markerRunId } : {}) });
+                live.push({
+                    repository: pr.repository,
+                    number: pr.number,
+                    state,
+                    ...(markerRunId ? { markerRunId } : {}),
+                    ...(pr.mergeOrder !== undefined ? { mergeOrder: pr.mergeOrder } : {}),
+                });
             }
             catch (err) {
                 log.warn({ err, runId: run.id, repository: pr.repository, number: pr.number }, "could not read a related pull request");
                 // The stored state (issue-recorded PRs) is better than none; never edited without a live read.
-                live.push({ repository: pr.repository, number: pr.number, ...(pr.state ? { state: pr.state } : {}) });
+                live.push({
+                    repository: pr.repository,
+                    number: pr.number,
+                    ...(pr.state ? { state: pr.state } : {}),
+                    ...(pr.mergeOrder !== undefined ? { mergeOrder: pr.mergeOrder } : {}),
+                });
             }
         }
         const issue = issueFor(group, trackers);
@@ -258,6 +359,7 @@ export async function updateRelatedPullRequests(db, run, hosts, trackers) {
                     number: pr.number,
                     ...(pr.state ? { state: pr.state } : {}),
                     ...(pr === target ? { self: true } : {}),
+                    ...(pr.mergeOrder !== undefined ? { mergeOrder: pr.mergeOrder } : {}),
                 })),
                 ...(issue ? { issue } : {}),
             });

package/dist/core/repo-access.d.ts

@@ -23,6 +23,8 @@ export declare const AUTHORIZED_VIA: readonly AuthorizedVia[];
 export type RepoAccessDenial = "owner_required" | "not_authorized" | "identity_not_linked" | "insufficient_permission" | "check_failed"
 /** A `local:` repository that is not inside the current trusted roots (LOCAL_REPO_ROOTS). */
  | "local_repo_not_allowed"
+/** A GitHub repository whose owner is neither the App's owner nor in WARDBY_GITHUB_ALLOWED_ACCOUNTS. */
+ | "github_account_not_allowed"
 /** In-flight use only: the host was unreachable or rate-limited, even after one retry. */
  | "check_unavailable";
 export type RepoAccessDecision = {
@@ -78,6 +80,8 @@ export interface RepoAccessGate {
         required: HostPermission;
         fresh?: boolean;
     }): Promise<RepoAccessDecision>;
+    /** Is this repository's account served by the GitHub App? undefined = yes (or not a GitHub repository). */
+    checkAccount?(provider: string, repository: string): Promise<RepoAccessDecision | undefined>;
 }
 export interface RepoAccessGateOptions {
     db: Pick<PrismaClient, "hostIdentity">;
@@ -92,9 +96,20 @@ export interface RepoAccessGateOptions {
     /** Delay before the one retry of a transient error (default 1s). */
     retryDelayMs?: number;
     sleep?: (ms: number) => Promise<void>;
+    /**
+     * The served GitHub accounts (default: the App owner from hosts.github plus
+     * WARDBY_GITHUB_ALLOWED_ACCOUNTS). undefined = no GitHub App, nothing to guard.
+     * Throwing = fail closed.
+     */
+    trustedAccounts?: () => Promise<ReadonlySet<string> | undefined>;
 }
 /** 5xx, rate limits (403/429), and transport failures: worth one retry for a run already under way. */
 export declare function isTransientHostError(err: unknown): boolean;
+/**
+ * Why the trusted GitHub accounts could not be read, as a fixed string: every
+ * branch returns a literal, so nothing from the error itself reaches a log.
+ */
+export declare function trustedAccountsFailure(err: unknown): string;
 export declare const DEFAULT_REPO_ACCESS_TTL_MS: number;
 export declare function createRepoAccessGate(options: RepoAccessGateOptions): RepoAccessGate;
 /** Actionable, non-leaking text for a denial, for tool results and run errors. */

package/dist/core/repo-access.js

@@ -1,5 +1,6 @@
 import { HOST_PERMISSION_RANK, ReviewHostError, } from "../providers/review-host/types.js";
 import { LocalRepoError, isLocalRepository, loadLocalRepoRoots, resolveLocalRepository } from "../coding/local-repo.js";
+import { githubAccountOf, isGitHubAccountAllowed, loadGitHubAllowedAccounts, trustedAccounts as trustedAccountSet, } from "../config/github-allowed-accounts.js";
 import { logger } from "./logger.js";
 const log = logger.child({ module: "repo-access" });
 export const AUTHORIZED_VIA = ["host_permission", "admin", "grandfathered", "local_root"];
@@ -20,6 +21,24 @@ export function isTransientHostError(err) {
         return false;
     return err.message === "github_api_unavailable" || /^github_api_error:(5\d\d|429|403)(:|$)/.test(err.message);
 }
+/**
+ * Why the trusted GitHub accounts could not be read, as a fixed string: every
+ * branch returns a literal, so nothing from the error itself reaches a log.
+ */
+export function trustedAccountsFailure(err) {
+    const message = err instanceof Error ? err.message : "";
+    if (message === "github_allowed_accounts_invalid")
+        return "github_allowed_accounts_invalid";
+    if (message === "github_api_unavailable")
+        return "github_api_unavailable";
+    if (message === "github_api_invalid_response")
+        return "github_api_invalid_response";
+    if (message === "github_app_private_key_invalid")
+        return "github_app_private_key_invalid";
+    if (message.startsWith("github_api_error:"))
+        return "github_api_error";
+    return "unexpected_error";
+}
 const defaultLocalRoots = () => loadLocalRepoRoots(process.env).roots;
 export const DEFAULT_REPO_ACCESS_TTL_MS = 5 * 60_000;
 export function createRepoAccessGate(options) {
@@ -29,6 +48,41 @@ export function createRepoAccessGate(options) {
     const retryDelayMs = options.retryDelayMs ?? 1000;
     const sleep = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     const cache = new Map();
+    const readTrusted = options.trustedAccounts ??
+        (async () => {
+            const host = options.hosts.github;
+            if (!host?.appOwnerLogin)
+                return undefined;
+            let extra;
+            try {
+                extra = loadGitHubAllowedAccounts();
+            }
+            catch {
+                // A fixed code: the parse error quotes the raw value, which must not reach the log.
+                throw new Error("github_allowed_accounts_invalid");
+            }
+            return trustedAccountSet(await host.appOwnerLogin(), extra);
+        });
+    /** A server-wide boundary, checked before any stamp, owner, or host call. Local repositories are exempt. */
+    async function checkAccount(provider, repository) {
+        if (provider !== "github" || isLocalRepository(repository))
+            return undefined;
+        let trusted;
+        try {
+            trusted = await readTrusted();
+        }
+        catch (err) {
+            // Only a fixed code is logged, never the error: its message may carry
+            // WARDBY_GITHUB_ALLOWED_ACCOUNTS's value (CodeQL js/clear-text-logging).
+            log.warn({ code: trustedAccountsFailure(err) }, "could not read the GitHub App's trusted accounts; denying");
+            return { ok: false, reason: "check_failed" };
+        }
+        if (trusted === undefined)
+            return undefined;
+        return isGitHubAccountAllowed(trusted, githubAccountOf(repository))
+            ? undefined
+            : { ok: false, reason: "github_account_not_allowed" };
+    }
     /** The user's level, or why it could not be determined (host missing or failing). */
     async function levelOf(provider, repository, user, fresh, retryTransient) {
         const key = `${provider}\u0000${repository}\u0000${user.id}`;
@@ -69,6 +123,9 @@ export function createRepoAccessGate(options) {
         return atLeast(level, required) ? { ok: true, level } : { ok: false, reason: "insufficient_permission", level };
     }
     async function authorizePrincipal(input) {
+        const denied = await checkAccount(input.provider, input.repository);
+        if (denied)
+            return denied;
         let identity;
         try {
             identity = await options.db.hostIdentity.findUnique({
@@ -108,6 +165,9 @@ export function createRepoAccessGate(options) {
                     return { ok: false, reason: "local_repo_not_allowed" };
                 }
             }
+            const denied = await checkAccount(input.provider, input.repository);
+            if (denied)
+                return denied;
             if (!input.ownerId)
                 return { ok: false, reason: "owner_required" };
             if (input.authorizedVia === "admin" || input.authorizedVia === "grandfathered")
@@ -124,11 +184,15 @@ export function createRepoAccessGate(options) {
         },
         authorizePrincipal,
         async authorizeHostUser(input) {
+            const denied = await checkAccount(input.provider, input.repository);
+            if (denied)
+                return denied;
             const answer = await levelOf(input.provider, input.repository, input.user, input.fresh === true, false);
             if (!answer.ok)
                 return unavailable(answer);
             return decide(answer.level, input.required);
         },
+        checkAccount,
     };
 }
 /** Actionable, non-leaking text for a denial, for tool results and run errors. */
@@ -144,6 +208,8 @@ export function describeDenial(decision, repository) {
             return `The agent owner's GitHub account has ${decision.level ?? "no"} access to ${repository}, which is not enough.`;
         case "local_repo_not_allowed":
             return `local_repo_not_allowed: ${repository} is not a git repository inside the configured local roots (LOCAL_REPO_ROOTS).`;
+        case "github_account_not_allowed":
+            return `github_account_not_allowed: ${repository} belongs to a GitHub account this server does not serve (the App's owner and WARDBY_GITHUB_ALLOWED_ACCOUNTS).`;
         case "check_failed":
             return `Could not verify access to ${repository} right now; try again later.`;
         case "check_unavailable":

package/dist/core/review-fix.d.ts

@@ -6,12 +6,18 @@
  * (startReviewFixAfterReview), once per run. What the agent does with the
  * review is up to its own instructions; this module only decides whether a
  * round may start. See docs/private/2026-10-03-review-fix-rounds-design.md.
+ *
+ * A round whose coding run ends with no change (the agent concluded the
+ * finding is wrong) gets one fresh review instead, which counts as a round
+ * (reReviewAfterNoChangeFix, from the coding run's terminal path): no push
+ * means no new review would otherwise replace the failed check.
  */
 import type { PrismaClient } from "#prisma";
 import type { Executor } from "../providers/executor/types.js";
 import type { IssueTrackerRegistry } from "../providers/issue-tracker/types.js";
 import type { ReviewHostProvider, ReviewHostRegistry } from "../providers/review-host/types.js";
 import { type DispatchDb } from "./dispatch.js";
+import { type ReviewStartDeps } from "./host-events.js";
 import { type RepoAccessGate } from "./repo-access.js";
 export declare const DEFAULT_MAX_FIX_ROUNDS = 2;
 export type ReviewFixDb = DispatchDb & Pick<PrismaClient, "agentRepository" | "codingRun" | "runHostStatus" | "runHostCheck" | "agentIssueProject" | "issuePullRequest" | "workItem">;
@@ -40,6 +46,14 @@ export type ReviewFixResult = {
     reason: ReviewFixSkip;
 };
 export declare function capBody(maxRounds: number): string;
+/**
+ * Whether a run's stored task is an automatic fix round's for this pull
+ * request: the continuation hint, then exactly the fix header, then the fix
+ * request. Every one of those sections is written by wardby, and a mention's
+ * header (the first section after the hint a person could influence) names
+ * its author instead, so a comment cannot pass for a fix round.
+ */
+export declare function isReviewFixTask(taskOverride: string | null, repository: string, prNumber: number): boolean;
 /**
  * The fix round's task. The trusted part (what the runner puts in the system
  * prompt) is only what wardby itself wrote: the continuation hint, the header
@@ -58,3 +72,26 @@ export declare function reviewFixTaskText(input: {
 export declare function startReviewFixRound(req: ReviewFixRequest, deps: ReviewFixDeps): Promise<ReviewFixResult>;
 /** The finalizer's entry point: a fix round for the review this run published, if it requested changes. Never throws. */
 export declare function startReviewFixAfterReview(runId: string, deps: ReviewFixDeps): Promise<void>;
+/** Most of a no-change fix run's summary (model output, already redacted by the protocol) put in the re-review's context. */
+export declare const MAX_NO_CHANGE_SUMMARY_CHARS = 4000;
+export type ReReviewDeps = ReviewStartDeps;
+export type ReReviewSkip = "not_no_change" | "not_fix_round" | "no_host" | "no_request" | "not_current" | "opted_out" | "no_reviewer" | "not_authorized" | "claimed" | "capped" | "record_failed";
+export type ReReviewResult = {
+    kind: "started";
+    runIds: string[];
+    round: number;
+} | {
+    kind: "skipped";
+    reason: ReReviewSkip;
+};
+/** The re-review's extra context: a fixed, trusted pointer, and the fix run's summary as untrusted data. */
+export declare function noChangeReviewContext(summary: string): {
+    task: string;
+    untrustedContext: string;
+};
+/**
+ * The coding-run terminal hook: a fix round's coding run that ended with no change starts one
+ * fresh review of the PR's unchanged head by the reviewer that requested changes, counted as a
+ * round. Does nothing for any other run. Never throws.
+ */
+export declare function reReviewAfterNoChangeFix(runId: string, deps: ReReviewDeps): Promise<void>;