@wascartech/devbot 0.0.0-stage → 2.1.1

package/dist/webhook.js

@@ -0,0 +1,1106 @@
+import { config } from "./config.js";
+import { log } from "./logger.js";
+import { enqueue, isFinalRunOutcome } from "./queue.js";
+import { acquireGlobalSlot, releaseGlobalSlot, globalQueueDepth, globalQueueMax, globalQueuePosition } from "./global-queue.js";
+import { run, runForcePushOnly, runPushOnly, runMrOnly, runFixConflictsOnly, ERROR_REPLY, destroyWorkItemVolume } from "./runner.js";
+import { getPlatform } from "./platform/index.js";
+import { redact } from "./redact.js";
+import { recordErrorLog } from "./error-log-store.js";
+import { recordRunHistory } from "./run-history-store.js";
+import { beginRunLog, finishRunLogFor } from "./run-log.js";
+import { drainUsage } from "./run-usage.js";
+import { zeroUsage } from "./opencode.js";
+import { getToken } from "./token-store.js";
+import { isDuplicateWebhook } from "./idempotency.js";
+import { parseMention, resolveSubagent } from "./mention.js";
+import { handleResetNote } from "./agents.js";
+import { handleStopNote } from "./stop.js";
+import { handleHelpNote } from "./help.js";
+import { handleAutoCommands } from "./auto-commands.js";
+import { hasUsableConfig } from "./global-settings-store.js";
+import { resolveMinRole, resolveRequireAuthorOrAssignee, resolveModelForMode, resolveVariantForMode } from "./settings-store.js";
+import { autoFeatureEnabled } from "./work-item-auto-store.js";
+import { AUTO_FEATURES } from "./auto-features.js";
+import { buildStatusBody, buildStartNote, taskLabel } from "./status.js";
+import { resolveWorkBranch } from "./git.js";
+import { resolveAccessRule } from "./access-rule-store.js";
+import { permissionAtLeast, roleLabel } from "./types/access.js";
+import { appendPending, countPendingForWorkItem, deletePending, countQueuedGlobal, getTask, listInFlight } from "./queue-store.js";
+import { emitRunOutcome, emitRunStarted, shouldEmitRunStarted } from "./outbound-webhook.js";
+import { deleteVolumeRow } from "./volume-store.js";
+import { deleteBaseBranch } from "./base-branch-store.js";
+import { getWorkBranch } from "./work-item-branch-store.js";
+import { getChangeRequestBySourceBranch, markCiReported } from "./change-request-store.js";
+import { runtime } from "./runtime-state.js";
+// The baseline trigger policy has two configurable gates (global default +
+// per-project override, see settings-store.ts):
+//   1. requireAuthorOrAssignee (default true) — the actor must be the work
+//      item's author or assignee.
+//   2. minRole (default "write") — the actor's normalized project permission
+//      must be at least this role. Each driver normalizes its role to
+//      write/admin/owner (GitLab access_level >= 30, Gitea/ForgeJo collaborator
+//      role, GitHub push/maintain/admin).
+// The denial note is built from the resolved policy so it always matches.
+const UNCONFIGURED_MSG = "⚠️ Bot not configured — an admin must set up an AI provider and build/plan models in the WebUI.";
+function toAccessRole(p) {
+    return p === "read" || p === "write" || p === "admin" || p === "owner" ? p : "none";
+}
+// Build the denial note from the resolved policy so it names the actual rule.
+function buildDenyMsg(requireAuthorOrAssignee, minRole) {
+    const rolePart = minRole === "none" ? "" : `a project ${roleLabel(minRole)} (or higher)`;
+    if (requireAuthorOrAssignee && rolePart) {
+        return `🚫 Only the work item's author/assignee who is ${rolePart} can trigger this bot.`;
+    }
+    if (requireAuthorOrAssignee) {
+        return "🚫 Only the work item's author/assignee can trigger this bot.";
+    }
+    if (rolePart) {
+        return `🚫 Only ${rolePart} can trigger this bot.`;
+    }
+    // Both gates disabled: nobody is denied by the baseline; keep a generic note
+    // in case this is ever reached via a different path.
+    return "🚫 You are not authorized to trigger this bot in this project.";
+}
+// Trigger-authorization gate. Baseline, in order:
+//   1. getMemberPermission — normalized project role (throw → deny)
+//   2. author/assignee gate (when enabled) — getWorkItem (throw → deny)
+// Then a per-project access rule (matching the actor's numeric id, then their
+// normalized role) may replace the role gate for that subject with
+// full/plan/denied. A rule cannot bypass the author/assignee gate.
+// Denial posts an error comment (in-thread when a triggering comment exists,
+// top-level otherwise — e.g. work-item-creation mentions). "ignore" posts
+// nothing. Policy and rules are read live, so changes take effect immediately.
+async function ensureCanTrigger(repoId, workItemNumber, actor, triggeringCommentId, actorPermissionHint) {
+    const p = getPlatform();
+    let permission;
+    if (actorPermissionHint) {
+        // The forge already computed the actor's permission for the signed payload
+        // (Gitea/ForgeJo). Those forges restrict the per-user permission endpoint to
+        // site admins, repo admins, and the user themselves, so a bot PAT would get
+        // 403 for anyone else; trusting the payload hint avoids a false deny.
+        permission = actorPermissionHint;
+    }
+    else {
+        try {
+            permission = await p.workItems.getMemberPermission(repoId, actor);
+        }
+        catch (e) {
+            log.warn("trigger-auth member lookup failed", { repoId, userId: actor.id, err: e });
+            await p.workItems.postErrorReply(repoId, workItemNumber, triggeringCommentId, buildDenyMsg(true, "write"));
+            return "deny";
+        }
+    }
+    const requireAuthorOrAssignee = resolveRequireAuthorOrAssignee(repoId);
+    const minRole = resolveMinRole(repoId);
+    const denyMsg = buildDenyMsg(requireAuthorOrAssignee, minRole);
+    // Gate 1: author/assignee (skipped when disabled).
+    if (requireAuthorOrAssignee) {
+        try {
+            const issue = await p.workItems.getWorkItem(repoId, workItemNumber);
+            const isAuthorOrAssignee = actor.id === issue.author?.id || (issue.assignees ?? []).some((a) => a.id === actor.id);
+            if (!isAuthorOrAssignee) {
+                await p.workItems.postErrorReply(repoId, workItemNumber, triggeringCommentId, denyMsg);
+                return "deny";
+            }
+        }
+        catch (e) {
+            log.warn("trigger-auth issue lookup failed", { repoId, workItemNumber, err: e });
+            await p.workItems.postErrorReply(repoId, workItemNumber, triggeringCommentId, denyMsg);
+            return "deny";
+        }
+    }
+    // A matching per-project rule replaces the role gate for that subject. An
+    // exact user rule beats a role rule.
+    const rule = resolveAccessRule(repoId, { userId: actor.id, permission: toAccessRole(permission) });
+    if (rule) {
+        if (rule.level === "denied") {
+            log.info("trigger ignored: denied by access rule", {
+                repoId, userId: actor.id, subjectType: rule.subjectType, subjectId: rule.subjectId,
+            });
+            return "ignore";
+        }
+        log.debug("trigger allowed by access rule", {
+            repoId, userId: actor.id, subjectType: rule.subjectType, subjectId: rule.subjectId, level: rule.level,
+        });
+        return rule.level;
+    }
+    // Gate 2: minimum role.
+    if (!permissionAtLeast(toAccessRole(permission), minRole)) {
+        await p.workItems.postErrorReply(repoId, workItemNumber, triggeringCommentId, denyMsg);
+        return "deny";
+    }
+    return "full";
+}
+// True when a mention asks for a build-level action (build mode or any
+// force-push / push / mr / fix-conflicts). A plan-only subject is dropped
+// silently for these.
+function wantsBuild(parsed) {
+    return parsed.mode === "build" || parsed.forcePush || parsed.push || parsed.mr || parsed.fixConflicts;
+}
+// True when the mention requests any run at all (even a bare /base or /branch
+// mention dispatches a plan run today). A mention carrying only auto-* commands
+// is handled and dispatches nothing.
+function hasRunIntent(parsed) {
+    return (parsed.mode === "build" ||
+        parsed.prompt.length > 0 ||
+        parsed.agents.length > 0 ||
+        parsed.forcePush ||
+        parsed.push ||
+        parsed.mr ||
+        parsed.fixConflicts ||
+        parsed.baseBranch !== undefined ||
+        parsed.workBranch !== undefined);
+}
+// Drain accumulated token usage only when this attempt makes the run final; a
+// retry keeps the accumulator intact so all attempts sum onto the one history
+// row. Reading zero (no usage recorded) is harmless.
+function drainFinalUsage(workItemId, outcome, seq) {
+    const attempts = getTask(seq)?.attempts ?? 0;
+    if (!isFinalRunOutcome(outcome.kind, attempts, runtime().maxRetries))
+        return zeroUsage();
+    return drainUsage(workItemId);
+}
+// Persist a settled run to the run-history store (work item #61), but only when
+// it is final (terminal/ok/cancelled, or a transient with retries exhausted or
+// disabled) — retries collapse to one row. Returns the new row id (for the
+// error-log cross-reference), or undefined when nothing was recorded. Never
+// throws — a history write failure must not affect the run outcome.
+function persistRunHistory(input, seq, outcome, runLog, usage) {
+    const attempts = getTask(seq)?.attempts ?? 0;
+    if (!isFinalRunOutcome(outcome.kind, attempts, runtime().maxRetries))
+        return undefined;
+    const status = outcome.kind === "ok" ? "ok" : outcome.kind === "cancelled" ? "cancelled" : "failed";
+    const detail = outcome.kind === "transient" || outcome.kind === "terminal" ? outcome.failure : undefined;
+    const fallbackMessage = outcome.kind === "ok" || outcome.kind === "cancelled" ? "" : outcome.reason;
+    const task = getTask(seq);
+    try {
+        return recordRunHistory({
+            taskSeq: seq,
+            projectId: input.projectId,
+            workItemId: input.workItemId,
+            workItemNumber: input.workItemNumber,
+            workItemTitle: input.workItemTitle,
+            mode: input.mode,
+            model: detail?.model || resolveModelForMode(input.projectId, input.mode),
+            variant: detail?.variant || resolveVariantForMode(input.projectId, input.mode),
+            status,
+            phase: detail?.phase ?? "",
+            kind: detail?.kind ?? outcome.kind,
+            exitCode: detail?.exitCode ?? null,
+            message: detail?.message ?? fallbackMessage,
+            attempts,
+            enqueuedAt: task?.enqueued_at ?? 0,
+            startedAt: task?.claimed_at ?? 0,
+            logFile: runLog.logFile,
+            logTruncated: runLog.truncated,
+            inputTokens: usage.input,
+            outputTokens: usage.output,
+            reasoningTokens: usage.reasoning,
+            cacheReadTokens: usage.cacheRead,
+            cacheWriteTokens: usage.cacheWrite,
+            costUsd: usage.costUsd,
+        });
+    }
+    catch (e) {
+        log.warn("run history persist failed", { workItemId: input.workItemId, seq, err: e });
+        return undefined;
+    }
+}
+// Persist a failed run to the error-log store, but only when the failure is
+// final: a terminal outcome, or a transient one with retries exhausted (or
+// retries disabled). Retries that will run again are not recorded. Never
+// throws — an error-log write failure must not affect the run outcome.
+// `runLog`/`historyId` connect the row to the shared per-run log file (work item
+// #61): when a file was captured the row carries only the reference, and the
+// detail view reads the full multi-phase run from it.
+function persistFinalFailure(input, seq, outcome, fallbackMessage, runLog, historyId) {
+    if (outcome.kind === "ok" || outcome.kind === "cancelled")
+        return;
+    if (outcome.kind === "transient") {
+        const attempts = getTask(seq)?.attempts ?? 0;
+        if (!isFinalRunOutcome("transient", attempts, runtime().maxRetries))
+            return;
+    }
+    const detail = outcome.failure ?? {
+        phase: "run",
+        kind: outcome.kind,
+        exitCode: null,
+        message: fallbackMessage ?? outcome.reason,
+        logs: "",
+        model: "",
+        variant: "",
+    };
+    const logFile = runLog?.logFile ?? "";
+    try {
+        recordErrorLog({
+            taskSeq: seq,
+            workItemId: input.workItemId,
+            // The error-log store (and its `work_item_iid` column) predates the
+            // platform abstraction's `iid`→`number` rename; the value is the same
+            // project-internal work item number.
+            workItemNumber: input.workItemNumber,
+            projectId: input.projectId,
+            mode: input.mode,
+            phase: detail.phase,
+            kind: detail.kind,
+            exitCode: detail.exitCode,
+            message: detail.message,
+            // When a shared run-log file exists it carries the full run, so the row
+            // stores no inline body (the detail view prefers the file). A run with no
+            // captured file keeps the redacted detail body as a fallback.
+            logs: logFile ? "" : detail.logs,
+            truncated: false,
+            model: detail.model,
+            variant: detail.variant,
+            workItemTitle: input.workItemTitle,
+            logFile,
+            ...(historyId !== undefined ? { runHistoryId: historyId } : {}),
+        });
+    }
+    catch (e) {
+        log.warn("error log persist failed", { workItemId: input.workItemId, err: e });
+    }
+}
+// The `EmitRunInput` shared by the started and terminal events. The exact
+// model/variant resolved for the run's mode is captured here so both events
+// report the same values (a mid-run settings edit can't make them disagree).
+function emitInputFor(input) {
+    const mode = input.mode;
+    return {
+        projectId: input.projectId,
+        workItemId: input.workItemId,
+        workItemNumber: input.workItemNumber,
+        mode,
+        model: resolveModelForMode(input.projectId, mode),
+        variant: resolveVariantForMode(input.projectId, mode),
+    };
+}
+// Emit an outbound webhook event for a settled run, but only once it is final
+// (terminal/ok/cancelled, or a transient with retries exhausted). Mirrors the
+// error-log finality rule so retries never produce duplicate notifications.
+// Never throws — a webhook problem must not affect the run outcome.
+function emitFinalOutcome(input, seq, outcome) {
+    const attempts = getTask(seq)?.attempts ?? 0;
+    if (!isFinalRunOutcome(outcome.kind, attempts, runtime().maxRetries))
+        return;
+    const detail = outcome.kind === "ok" || outcome.kind === "cancelled" ? undefined : outcome.failure;
+    const based = emitInputFor(input);
+    emitRunOutcome({
+        ...based,
+        model: detail?.model || based.model,
+        variant: detail?.variant || based.variant,
+    }, {
+        kind: outcome.kind,
+        ...(detail
+            ? { failure: { phase: detail.phase, kind: detail.kind, message: detail.message } }
+            : {}),
+    });
+}
+// Emit `run.started` once per task lifecycle, immediately before the task
+// executes (after global-gate admission). A transient retry bumps the row's
+// attempts and is skipped here; the terminal event already covers the retry
+// outcome. Never throws.
+function emitStartedIfFirstAttempt(input, seq) {
+    if (!shouldEmitRunStarted(getTask(seq)?.attempts ?? 0))
+        return;
+    emitRunStarted(emitInputFor(input));
+}
+function comment(repoId, number, body) {
+    getPlatform()
+        .workItems.postComment(repoId, number, body)
+        .catch((e) => log.warn("note failed", { repoId, number, err: e }));
+}
+// Project a durable queue row into the pure status renderer's shape. The
+// payload is parsed defensively: a corrupt row still renders (plan / empty
+// prompt) instead of failing the whole status note.
+function toStatusTask(row) {
+    let input = {};
+    try {
+        const parsed = JSON.parse(row.payload);
+        if (parsed !== null && typeof parsed === "object") {
+            input = parsed;
+        }
+    }
+    catch {
+        /* corrupt payload — keep the defaults */
+    }
+    return {
+        seq: row.seq,
+        label: taskLabel({
+            mode: input.mode === "build" ? "build" : "plan",
+            pushOnly: input.pushOnly === true,
+            mrOnly: input.mrOnly === true,
+            forcePushOnly: input.forcePushOnly === true,
+            fixConflictsOnly: input.fixConflictsOnly === true,
+        }),
+        prompt: typeof input.prompt === "string" ? input.prompt : "",
+        attempts: row.attempts,
+        enqueuedAt: row.enqueued_at,
+        claimedAt: row.claimed_at,
+        globalPosition: row.position,
+    };
+}
+// /status (work item #103): post one local snapshot and dispatch nothing. The
+// collector reads only SQLite stores and in-memory gate state; no forge data
+// calls are made beyond the trigger gate and the reply itself.
+async function handleStatusNote(projectId, workItemNumber, workItemId, triggeringNoteId) {
+    try {
+        const rows = listInFlight().filter((r) => r.work_item_id === workItemId);
+        const runningRow = rows.find((r) => r.status === "running") ?? null;
+        const branch = resolveWorkBranch(getWorkBranch(workItemId), workItemNumber);
+        const changeRequest = getChangeRequestBySourceBranch(projectId, branch);
+        const depth = globalQueueDepth();
+        const autoFeatures = Object.fromEntries(AUTO_FEATURES.map((f) => [f, autoFeatureEnabled(projectId, workItemId, f)]));
+        const body = buildStatusBody({
+            workItemNumber,
+            branch,
+            changeRequestNumber: changeRequest?.cr_number ?? null,
+            running: runningRow ? toStatusTask(runningRow) : null,
+            runningGatePosition: runningRow ? globalQueuePosition(runningRow.seq) : null,
+            queued: rows.filter((r) => r.status === "queued").map(toStatusTask),
+            gate: { active: depth.active, waiting: depth.waiting, max: globalQueueMax() },
+            maxQueuePerWorkItem: runtime().maxQueuePerWorkItem,
+            maxRetries: runtime().maxRetries,
+            autoFeatures,
+        });
+        await getPlatform().workItems.postErrorReply(projectId, workItemNumber, triggeringNoteId, body);
+    }
+    catch (e) {
+        log.warn("status reply failed", { projectId, workItemNumber, err: e });
+    }
+}
+export function dispatch(d) {
+    const workItemId = d.workItemId;
+    const queuedBehind = countPendingForWorkItem(workItemId) > 0;
+    const seq = appendPending(workItemId, JSON.stringify({ ...d, queuedBehind }));
+    // Global queue overflow cap (MAX_GLOBAL_QUEUE). 0 = unbounded (legacy).
+    if (runtime().maxGlobalQueue > 0) {
+        const queued = countQueuedGlobal();
+        if (queued > runtime().maxGlobalQueue) {
+            deletePending(seq);
+            log.warn("global queue overflow", { workItemId, queued, cap: runtime().maxGlobalQueue });
+            if (runtime().queueFeedback)
+                comment(d.projectId, d.workItemNumber, "⚠️ Global queue full, retry later.");
+            return;
+        }
+    }
+    if (runtime().queueFeedback) {
+        if (d.source === "ci-failure" && d.ciFailure) {
+            const mr = d.ciFailure.changeRequestNumber;
+            comment(d.projectId, d.workItemNumber, `⚙️ CI failed${mr ? ` on MR !${mr}` : ""} — analyzing the logs.`);
+        }
+        else {
+            comment(d.projectId, d.workItemNumber, `📨 Got it — ${taskLabel(d)} task queued.`);
+        }
+    }
+    // The handler is a single function per work item, reused for all rows of
+    // that key. It decodes the payload to get the DispatchInput, acquires the
+    // global gate, runs, and returns a RunOutcome.
+    const handler = (claimedSeq, payload) => {
+        let input;
+        try {
+            input = JSON.parse(payload);
+        }
+        catch {
+            log.error("dispatch handler: payload parse failed", { seq: claimedSeq });
+            return Promise.resolve({ kind: "terminal", reason: "payload parse failed" });
+        }
+        // Run-log sink result for this attempt. Declared outside the .then so the
+        // .catch (unexpected runner error) can still record the captured file: the
+        // inner finally closes the sink, and a second finish is a no-op.
+        let runLog = { logFile: "", truncated: false };
+        // Guard so a throw after the terminal persist (e.g. in emitFinalOutcome)
+        // cannot make the catch record a second history/error row for the same seq.
+        let finalRecorded = false;
+        // "Waited" is measured from the row's enqueue time, not from gate claim.
+        const row = getTask(claimedSeq);
+        const enqueuedAt = row?.enqueued_at ?? Date.now();
+        const attempts = row?.attempts ?? 0;
+        const slot = acquireGlobalSlot({
+            seq: claimedSeq,
+            enqueuedAt,
+            onAdvance: (_pos, isNext) => {
+                if (!isNext || !runtime().queueFeedback)
+                    return;
+                comment(input.projectId, input.workItemNumber, "⏳ You're next.");
+            },
+        });
+        if (slot.queued && runtime().queueFeedback) {
+            comment(input.projectId, input.workItemNumber, `⏳ Queued globally (position ${slot.position}).`);
+        }
+        return slot.ready
+            .then(async () => {
+            // Reset per attempt: the handler closure is reused across rows of the
+            // same work item, so a stale reference must not leak into this attempt.
+            runLog = { logFile: "", truncated: false };
+            finalRecorded = false;
+            if (runtime().queueFeedback) {
+                const remaining = listInFlight()
+                    .filter((r) => r.work_item_id === input.workItemId && r.status === "queued")
+                    .map(toStatusTask);
+                const note = buildStartNote({
+                    label: taskLabel(input),
+                    prompt: input.prompt,
+                    enqueuedAt,
+                    startedAt: Date.now(),
+                    queuedBehind: input.queuedBehind === true,
+                    gateQueued: slot.queued,
+                    attempts,
+                    remaining,
+                });
+                if (note)
+                    comment(input.projectId, input.workItemNumber, note);
+            }
+            // Outbound webhook: one `run.started` per task lifecycle, emitted just
+            // before the task executes (first attempt only — retries are covered by
+            // the terminal event).
+            emitStartedIfFirstAttempt(input, claimedSeq);
+            // Open this attempt's run-log file (a retry appends an attempt header to
+            // the same per-seq file). The sink captures every phase container's
+            // output until finishRunLogFor closes it below.
+            beginRunLog(input.workItemId, claimedSeq);
+            let outcome;
+            try {
+                outcome = input.mrOnly
+                    ? await runMrOnly(input)
+                    : input.fixConflictsOnly
+                        ? await runFixConflictsOnly(input)
+                        : input.pushOnly
+                            ? await runPushOnly(input)
+                            : input.forcePushOnly
+                                ? await runForcePushOnly(input)
+                                : await run(input);
+            }
+            finally {
+                // Close the sink on every exit path (including a thrown runner error)
+                // so the file reference is available to the catch below.
+                runLog = finishRunLogFor(input.workItemId);
+            }
+            // Post a retry note if the outcome was transient and retries remain.
+            if (outcome.kind === "transient" && runtime().maxRetries > 0) {
+                const attempts = getTask(claimedSeq)?.attempts ?? 0;
+                if (attempts < runtime().maxRetries) {
+                    comment(input.projectId, input.workItemNumber, `🔁 Retrying (attempt ${attempts + 1}/${runtime().maxRetries}, transient: ${outcome.reason}).`);
+                }
+                else {
+                    comment(input.projectId, input.workItemNumber, `⚠️ Gave up after ${runtime().maxRetries} attempts: ${outcome.reason}.`);
+                }
+            }
+            // Persist run history + the error (when final) with the shared log-file
+            // reference, so retries don't create duplicate rows. Token usage is
+            // drained only when this attempt settles the run for good: a retry keeps
+            // accumulating in the per-work-item accumulator.
+            const usage = drainFinalUsage(input.workItemId, outcome, claimedSeq);
+            const historyId = persistRunHistory(input, claimedSeq, outcome, runLog, usage);
+            persistFinalFailure(input, claimedSeq, outcome, undefined, runLog, historyId);
+            finalRecorded = true;
+            // Outbound webhook: same finality rule, one notification per run.
+            emitFinalOutcome(input, claimedSeq, outcome);
+            return outcome;
+        })
+            .catch((e) => {
+            log.error("runner error", e);
+            comment(input.projectId, input.workItemNumber, ERROR_REPLY);
+            const outcome = { kind: "terminal", reason: "unexpected runner error" };
+            // The inner finally may already have closed the sink; a second call is a
+            // no-op. Keep whichever result exists.
+            if (!runLog.logFile)
+                runLog = finishRunLogFor(input.workItemId);
+            // If the .then already recorded this seq as final, do not record again —
+            // a throw in a best-effort step after the persist must not duplicate the
+            // history/error rows.
+            if (!finalRecorded) {
+                const historyId = persistRunHistory(input, claimedSeq, outcome, runLog, drainFinalUsage(input.workItemId, outcome, claimedSeq));
+                persistFinalFailure(input, claimedSeq, outcome, e instanceof Error ? e.message : String(e), runLog, historyId);
+                emitFinalOutcome(input, claimedSeq, outcome);
+            }
+            return outcome;
+        })
+            .finally(() => {
+            releaseGlobalSlot();
+        });
+    };
+    const result = enqueue(workItemId, handler, { maxPending: runtime().maxQueuePerWorkItem });
+    if (!result.accepted) {
+        deletePending(seq);
+        log.warn("queue overflow", { workItemId });
+        if (runtime().queueFeedback)
+            comment(d.projectId, d.workItemNumber, "⚠️ Queue full, retry later.");
+        return;
+    }
+    if (result.position > 0 && runtime().queueFeedback) {
+        comment(d.projectId, d.workItemNumber, `⏳ Queued (position ${result.position}).`);
+    }
+}
+function mentionRegex() {
+    return new RegExp(`@${config.BOT_USERNAME}\\b`);
+}
+function resolveSubagentFor(parsed) {
+    const r = resolveSubagent(parsed);
+    return { ...r, agentNames: parsed.agents.map((a) => a.name) };
+}
+// /base Step-0 gate: validate the parsed /base <branch> before dispatch.
+async function checkBaseBranch(repoId, workItemNumber, triggeringCommentId, parsed) {
+    const p = getPlatform();
+    if (parsed.baseError) {
+        await p.workItems.postErrorReply(repoId, workItemNumber, triggeringCommentId, parsed.baseError).catch((e) => log.warn("base-error reply failed", e));
+        return false;
+    }
+    if (parsed.baseBranch) {
+        try {
+            const exists = await p.repository.branchExists(repoId, parsed.baseBranch);
+            if (!exists) {
+                await p.workItems.postErrorReply(repoId, workItemNumber, triggeringCommentId, `⚠️ Branch \`${parsed.baseBranch}\` not found in this project.`).catch((e) => log.warn("base-missing reply failed", e));
+                return false;
+            }
+        }
+        catch (e) {
+            log.warn("base branch existence check failed", { repoId, branch: parsed.baseBranch, err: e });
+            await p.workItems.postErrorReply(repoId, workItemNumber, triggeringCommentId, `⚠️ Could not verify branch \`${parsed.baseBranch}\`; please retry.`).catch((e) => log.warn("base-verify reply failed", e));
+            return false;
+        }
+    }
+    return true;
+}
+// /branch Step-0 gate: validate and collision-check the parsed /branch <name>
+//   before dispatch. Order is load-bearing:
+//     1. charset error (parseMention set branchError) → reject in-thread.
+//     2. no /branch → allow.
+//     3. a name is already stored for this work item → allow. The store is
+//        authoritative (first-write-wins) and the runner posts the ignored-note;
+//        checking the remote here would reject against the branch we pushed.
+//     4. first naming → reject if the branch already exists remotely (fail
+//        closed on a forge error) so we never clobber an unknown branch.
+async function checkWorkBranch(repoId, workItemNumber, workItemId, triggeringCommentId, parsed) {
+    const p = getPlatform();
+    if (parsed.branchError) {
+        await p.workItems.postErrorReply(repoId, workItemNumber, triggeringCommentId, parsed.branchError).catch((e) => log.warn("branch-error reply failed", e));
+        return false;
+    }
+    if (!parsed.workBranch)
+        return true;
+    if (getWorkBranch(workItemId))
+        return true;
+    try {
+        const exists = await p.repository.branchExists(repoId, parsed.workBranch);
+        if (exists) {
+            await p.workItems.postErrorReply(repoId, workItemNumber, triggeringCommentId, `⚠️ /branch '${parsed.workBranch}' — this branch already exists. Pick another name, or omit /branch to use the default wi-${workItemNumber}.`).catch((e) => log.warn("branch-collision reply failed", e));
+            return false;
+        }
+    }
+    catch (e) {
+        log.warn("work branch existence check failed", { repoId, branch: parsed.workBranch, err: e });
+        await p.workItems.postErrorReply(repoId, workItemNumber, triggeringCommentId, `⚠️ Could not verify branch \`${parsed.workBranch}\`; please retry.`).catch((e) => log.warn("branch-verify reply failed", e));
+        return false;
+    }
+    return true;
+}
+function repoCloneUrl(ev) {
+    return ev.repo.cloneUrl;
+}
+async function handleCommentEvent(ev) {
+    if (ev.kind !== "comment" || !ev.workItem || !ev.actor || ev.body === undefined)
+        return false;
+    // Self-loop guard: ignore comments authored by the bot.
+    if (ev.actor.id === config.BOT_USER_ID)
+        return false;
+    if (!mentionRegex().test(ev.body))
+        return false;
+    const commentId = ev.commentId;
+    const repoId = ev.repo.id;
+    const number = ev.workItem.number;
+    // Trigger-authorization gate runs before /reset, /agent, and dispatch —
+    //   "general rule for all mentions". Fail-closed; denial posted in-thread.
+    //   An "ignore" (rule: denied) returns handled=false → 204, no note.
+    const auth = await ensureCanTrigger(repoId, number, ev.actor, commentId, ev.actorPermission);
+    if (auth === "deny")
+        return true;
+    if (auth === "ignore")
+        return false;
+    const parsed = parseMention(ev.body);
+    // A plan-only subject may not run build-level tasks. The mention is dropped
+    // silently (like denied) — the gate already matched them deliberately.
+    if (auth === "plan" && wantsBuild(parsed)) {
+        log.info("trigger ignored: plan-only subject requested build", { repoId, userId: ev.actor.id, workItemNumber: number });
+        return false;
+    }
+    if (parsed.reset) {
+        handleResetNote(repoId, number, ev.workItem.id, commentId);
+        return true;
+    }
+    // /stop short-circuits after /reset (which parseMention already prioritizes):
+    //   cancel this work item's in-flight/queued runs. Authorization is already
+    //   enforced by ensureCanTrigger; no provider/config gate — you can always stop.
+    if (parsed.stop) {
+        handleStopNote(repoId, number, ev.workItem.id, commentId);
+        return true;
+    }
+    // /help (work item #95) short-circuits after /stop: reply with the command
+    //   list and dispatch no run. Authorization is already enforced by
+    //   ensureCanTrigger; no provider/config gate — the list is static text.
+    if (parsed.help) {
+        await handleHelpNote(repoId, number, commentId);
+        return true;
+    }
+    // /status (work item #103) short-circuits after /help: post the local status
+    //   snapshot and dispatch no run. Authorization is already enforced by
+    //   ensureCanTrigger; no provider/config gate — every field is local.
+    if (parsed.status) {
+        await handleStatusNote(repoId, number, ev.workItem.id, commentId);
+        return true;
+    }
+    // Contextual auto-* commands (#58) are applied and acknowledged before any
+    //   run in this mention is dispatched, so /build /auto-push off builds with
+    //   auto-push off. A mention with only auto commands returns here and
+    //   dispatches nothing. Admin enable (project-off) is checked in the handler.
+    if (parsed.autoCommands.length > 0) {
+        await handleAutoCommands({
+            projectId: repoId,
+            workItemNumber: number,
+            workItemId: ev.workItem.id,
+            ...(commentId !== undefined ? { triggeringNoteId: commentId } : {}),
+            commands: parsed.autoCommands,
+            ...(ev.actor.username ? { actorUsername: ev.actor.username } : {}),
+        });
+        if (!hasRunIntent(parsed))
+            return true;
+    }
+    // /fix-conflicts standalone (no /build): re-run the conflict resolver on the
+    //   existing work branch against its MR's current target, then re-push the
+    //   resolved branch — no publish-first and no MR create/update. Checked before
+    //   /mr so an explicit fix wins a combined mention. Needs no base branch,
+    //   agent, or provider/model config at dispatch; the runner mints MCP context
+    //   and requires a build model only when conflicts are actually found.
+    if (parsed.fixConflicts && parsed.mode !== "build") {
+        dispatch({
+            projectId: repoId,
+            workItemNumber: number,
+            workItemId: ev.workItem.id,
+            repoHttpUrl: repoCloneUrl(ev),
+            mode: "build",
+            prompt: "",
+            workItemTitle: ev.workItem.title,
+            workItemDescription: ev.workItem.description,
+            ...(commentId !== undefined ? { triggeringNoteId: commentId } : {}),
+            fixConflictsOnly: true,
+        });
+        return true;
+    }
+    // /mr standalone (no /build): publish-and-open task. Push the work item's
+    //   existing branch (if ahead) then create/update the merge request. Takes
+    //   precedence over a bare /push (an MR needs the branch) and carries
+    //   /force-push through when combined (/mr /force-push). Needs no base branch,
+    //   agent, or provider/model config.
+    if (parsed.mr && parsed.mode !== "build") {
+        dispatch({
+            projectId: repoId,
+            workItemNumber: number,
+            workItemId: ev.workItem.id,
+            repoHttpUrl: repoCloneUrl(ev),
+            mode: "build",
+            prompt: "",
+            workItemTitle: ev.workItem.title,
+            workItemDescription: ev.workItem.description,
+            ...(commentId !== undefined ? { triggeringNoteId: commentId } : {}),
+            mrOnly: true,
+            ...(parsed.forcePush ? { forcePush: true } : {}),
+        });
+        return true;
+    }
+    // /force-push standalone (no /build): a push-only task. It needs no base
+    //   branch, subagents, or provider/model config — dispatch and return before
+    //   those gates (a force-push must not be blocked by an unconfigured model).
+    if (parsed.forcePush && parsed.mode !== "build") {
+        dispatch({
+            projectId: repoId,
+            workItemNumber: number,
+            workItemId: ev.workItem.id,
+            repoHttpUrl: repoCloneUrl(ev),
+            mode: "build",
+            prompt: "",
+            workItemTitle: ev.workItem.title,
+            workItemDescription: ev.workItem.description,
+            ...(commentId !== undefined ? { triggeringNoteId: commentId } : {}),
+            forcePushOnly: true,
+        });
+        return true;
+    }
+    // /push standalone (no /build): a push-only task (no force). Same rationale as
+    //   /force-push — publish the existing local branch and return before the
+    //   /base + provider/model gates.
+    if (parsed.push && parsed.mode !== "build") {
+        dispatch({
+            projectId: repoId,
+            workItemNumber: number,
+            workItemId: ev.workItem.id,
+            repoHttpUrl: repoCloneUrl(ev),
+            mode: "build",
+            prompt: "",
+            workItemTitle: ev.workItem.title,
+            workItemDescription: ev.workItem.description,
+            ...(commentId !== undefined ? { triggeringNoteId: commentId } : {}),
+            pushOnly: true,
+        });
+        return true;
+    }
+    // /base Step-0 gate: charset already validated in parseMention; verify the
+    //   branch exists on the remote before dispatch. Rejects the whole mention
+    //   (in-thread) on invalid/missing/unverifiable — no run is dispatched.
+    if (!(await checkBaseBranch(repoId, number, commentId, parsed)))
+        return true;
+    // /branch Step-0 gate: charset + remote collision check before dispatch.
+    if (!(await checkWorkBranch(repoId, number, ev.workItem.id, commentId, parsed)))
+        return true;
+    const { prompt, error, agentNames } = resolveSubagentFor(parsed);
+    if (error) {
+        getPlatform().workItems.postErrorReply(repoId, number, commentId, error).catch((e) => log.warn("unknown-agent reply failed", e));
+        return true;
+    }
+    if (!hasUsableConfig()) {
+        getPlatform().workItems.postErrorReply(repoId, number, commentId, UNCONFIGURED_MSG).catch((e) => log.warn("unconfigured reply failed", e));
+        return true;
+    }
+    dispatch({
+        projectId: repoId,
+        workItemNumber: number,
+        workItemId: ev.workItem.id,
+        repoHttpUrl: repoCloneUrl(ev),
+        mode: parsed.mode,
+        prompt,
+        workItemTitle: ev.workItem.title,
+        workItemDescription: ev.workItem.description,
+        ...(agentNames.length > 0 ? { agentNames } : {}),
+        ...(commentId !== undefined ? { triggeringNoteId: commentId } : {}),
+        ...(parsed.baseBranch ? { baseBranch: parsed.baseBranch } : {}),
+        ...(parsed.workBranch ? { workBranch: parsed.workBranch } : {}),
+        ...(parsed.forcePush ? { forcePush: true } : {}),
+        ...(parsed.push ? { pushRequested: true } : {}),
+        ...(parsed.mr ? { mrRequested: true } : {}),
+        ...(parsed.fixConflicts ? { fixConflictsRequested: true } : {}),
+    });
+    return true;
+}
+async function handleWorkItemOpenEvent(ev) {
+    if (ev.kind !== "workitem-open" || !ev.workItem || !ev.actor)
+        return false;
+    const desc = ev.workItem.description ?? "";
+    if (!mentionRegex().test(desc))
+        return false;
+    const repoId = ev.repo.id;
+    const number = ev.workItem.number;
+    // Trigger-authorization gate. No triggering note on the open path (the
+    //   mention is the work item description itself), so triggeringCommentId is
+    //   undefined → denial posts top-level (there's no thread to reply to).
+    //   A denied rule drops the mention silently (handled=false → 204).
+    const auth = await ensureCanTrigger(repoId, number, ev.actor, undefined, ev.actorPermission);
+    if (auth === "deny")
+        return true;
+    if (auth === "ignore")
+        return false;
+    const parsed = parseMention(desc);
+    // A plan-only subject may not run build-level tasks (silent drop).
+    if (auth === "plan" && wantsBuild(parsed)) {
+        log.info("trigger ignored: plan-only subject requested build", { repoId, userId: ev.actor.id, workItemNumber: number });
+        return false;
+    }
+    if (parsed.reset) {
+        handleResetNote(repoId, number, ev.workItem.id, undefined);
+        return true;
+    }
+    // /stop short-circuits after /reset: cancel this work item's in-flight/queued
+    //   runs. No triggering note on the open path → handleStopNote posts top-level.
+    if (parsed.stop) {
+        handleStopNote(repoId, number, ev.workItem.id, undefined);
+        return true;
+    }
+    // /help short-circuits after /stop on the open path too: reply with the
+    //   command list and dispatch no run. No triggering note → reply top-level.
+    if (parsed.help) {
+        await handleHelpNote(repoId, number, undefined);
+        return true;
+    }
+    // /status short-circuits after /help on the open path too: local snapshot,
+    //   no run. No triggering note → reply top-level.
+    if (parsed.status) {
+        await handleStatusNote(repoId, number, ev.workItem.id, undefined);
+        return true;
+    }
+    // Contextual auto-* commands (#58): applied and acknowledged before any run in
+    //   the description is dispatched; a description with only auto commands
+    //   dispatches nothing. No triggering note on the open path.
+    if (parsed.autoCommands.length > 0) {
+        await handleAutoCommands({
+            projectId: repoId,
+            workItemNumber: number,
+            workItemId: ev.workItem.id,
+            commands: parsed.autoCommands,
+            ...(ev.actor.username ? { actorUsername: ev.actor.username } : {}),
+        });
+        if (!hasRunIntent(parsed))
+            return true;
+    }
+    // /fix-conflicts standalone (no /build): fix-only task. Same rationale as the
+    //   note path — dispatch before the /base + provider/model gates. Checked
+    //   before /mr so an explicit fix wins a combined mention.
+    if (parsed.fixConflicts && parsed.mode !== "build") {
+        dispatch({
+            projectId: repoId,
+            workItemNumber: number,
+            workItemId: ev.workItem.id,
+            repoHttpUrl: repoCloneUrl(ev),
+            mode: "build",
+            prompt: "",
+            workItemTitle: ev.workItem.title,
+            workItemDescription: "",
+            fixConflictsOnly: true,
+        });
+        return true;
+    }
+    // /mr standalone (no /build): publish-and-open task. Same rationale as the
+    //   note path — dispatch before the /base + provider/model gates. Precedence:
+    //   /mr wins over /push; /force-push combined is carried through.
+    if (parsed.mr && parsed.mode !== "build") {
+        dispatch({
+            projectId: repoId,
+            workItemNumber: number,
+            workItemId: ev.workItem.id,
+            repoHttpUrl: repoCloneUrl(ev),
+            mode: "build",
+            prompt: "",
+            workItemTitle: ev.workItem.title,
+            workItemDescription: "",
+            mrOnly: true,
+            ...(parsed.forcePush ? { forcePush: true } : {}),
+        });
+        return true;
+    }
+    // /force-push standalone (no /build): push-only task. Same rationale as the
+    //   note path — dispatch before the /base + provider/model gates.
+    if (parsed.forcePush && parsed.mode !== "build") {
+        dispatch({
+            projectId: repoId,
+            workItemNumber: number,
+            workItemId: ev.workItem.id,
+            repoHttpUrl: repoCloneUrl(ev),
+            mode: "build",
+            prompt: "",
+            workItemTitle: ev.workItem.title,
+            workItemDescription: "",
+            forcePushOnly: true,
+        });
+        return true;
+    }
+    // /push standalone (no /build): push-only task (no force). Same rationale as
+    //   /force-push — dispatch before the /base + provider/model gates.
+    if (parsed.push && parsed.mode !== "build") {
+        dispatch({
+            projectId: repoId,
+            workItemNumber: number,
+            workItemId: ev.workItem.id,
+            repoHttpUrl: repoCloneUrl(ev),
+            mode: "build",
+            prompt: "",
+            workItemTitle: ev.workItem.title,
+            workItemDescription: "",
+            pushOnly: true,
+        });
+        return true;
+    }
+    // /base Step-0 gate (no triggering note on the open path → denial posts
+    //   top-level). Validates charset + remote existence before dispatch.
+    if (!(await checkBaseBranch(repoId, number, undefined, parsed)))
+        return true;
+    // /branch Step-0 gate (no triggering note on the open path → denial posts
+    //   top-level). Charset + remote collision check before dispatch.
+    if (!(await checkWorkBranch(repoId, number, ev.workItem.id, undefined, parsed)))
+        return true;
+    const { prompt, error, agentNames } = resolveSubagentFor(parsed);
+    if (error) {
+        getPlatform().workItems.postErrorReply(repoId, number, undefined, error).catch((e) => log.warn("work-item-hook unknown-agent reply failed", e));
+        return true;
+    }
+    if (!hasUsableConfig()) {
+        getPlatform().workItems.postErrorReply(repoId, number, undefined, UNCONFIGURED_MSG).catch((e) => log.warn("unconfigured reply failed", e));
+        return true;
+    }
+    dispatch({
+        projectId: repoId,
+        workItemNumber: number,
+        workItemId: ev.workItem.id,
+        repoHttpUrl: repoCloneUrl(ev),
+        mode: parsed.mode,
+        prompt,
+        workItemTitle: ev.workItem.title,
+        workItemDescription: "",
+        ...(agentNames.length > 0 ? { agentNames } : {}),
+        ...(parsed.baseBranch ? { baseBranch: parsed.baseBranch } : {}),
+        ...(parsed.workBranch ? { workBranch: parsed.workBranch } : {}),
+        ...(parsed.forcePush ? { forcePush: true } : {}),
+        ...(parsed.push ? { pushRequested: true } : {}),
+        ...(parsed.mr ? { mrRequested: true } : {}),
+        ...(parsed.fixConflicts ? { fixConflictsRequested: true } : {}),
+    });
+    return true;
+}
+async function handleWorkItemCloseEvent(ev) {
+    if (ev.kind !== "workitem-close" || !ev.workItem)
+        return false;
+    const workItemId = ev.workItem.id;
+    destroyWorkItemVolume(workItemId)
+        .then((r) => {
+        log.debug("work-item-close volume destroy", { workItemId, ok: r.ok });
+        deleteVolumeRow(workItemId);
+    })
+        .catch((e) => log.warn("work-item-close volume destroy failed", { workItemId, err: e }));
+    try {
+        deleteBaseBranch(workItemId);
+    }
+    catch (e) {
+        log.warn("work-item-close base-branch delete failed", { workItemId, err: e });
+    }
+    return true;
+}
+// CI-failure auto report (work item #57). A failed pipeline webhook on a
+// merge/pull request DevBot created starts a plan run seeded with the failing
+// job logs. This handler is deliberately quiet on every no-op path: an unknown
+// branch, a disabled toggle, or an unresolvable work item must not spam the
+// thread. When it does dispatch, it marks the pipeline reported first so a
+// redelivery cannot start a second run.
+export async function handlePipelineFailureEvent(ev) {
+    const projectId = ev.repo.id;
+    if (!ev.sourceBranch)
+        return false;
+    const registered = getChangeRequestBySourceBranch(projectId, ev.sourceBranch);
+    if (!registered)
+        return false;
+    // Effective gate: project/global resolution with the work-item override on
+    // top (#58). An admin may have enabled it for this one work item.
+    if (!autoFeatureEnabled(projectId, registered.work_item_id, "ciFailAutoReport"))
+        return false;
+    if (ev.pipelineId !== undefined && registered.last_pipeline_id === ev.pipelineId)
+        return false;
+    if (ev.commitSha && registered.last_pipeline_sha === ev.commitSha)
+        return false;
+    const p = getPlatform();
+    if (!hasUsableConfig()) {
+        log.info("ci-failure event ignored: bot not configured", { projectId });
+        return false;
+    }
+    let workItem;
+    try {
+        workItem = await p.workItems.getWorkItem(projectId, registered.work_item_number);
+    }
+    catch (e) {
+        log.warn("ci-failure work item lookup failed", { projectId, workItemNumber: registered.work_item_number, err: e });
+        return false;
+    }
+    if (workItem.state !== "open") {
+        log.info("ci-failure event ignored: work item not open", { projectId, workItemNumber: registered.work_item_number });
+        return false;
+    }
+    // Claim the pipeline before dispatching. If markCiReported reports no row the
+    // registry vanished mid-flight; skip rather than risk a duplicate.
+    if (ev.pipelineId !== undefined) {
+        const claimed = markCiReported({
+            projectId,
+            sourceBranch: ev.sourceBranch,
+            pipelineId: ev.pipelineId,
+            sha: ev.commitSha ?? null,
+        });
+        if (!claimed)
+            return false;
+    }
+    const repoPath = registered.work_item_number;
+    const pipelineRef = ev.sourceBranch;
+    dispatch({
+        projectId,
+        workItemNumber: repoPath,
+        workItemId: registered.work_item_id,
+        repoHttpUrl: ev.repo.cloneUrl,
+        mode: "plan",
+        prompt: "CI failed on the merge/pull request. Analyze the failing job logs and propose a fix.",
+        workItemTitle: workItem.title,
+        workItemDescription: workItem.description,
+        ...(ev.pipelineId !== undefined
+            ? {
+                ciFailure: {
+                    pipelineId: ev.pipelineId,
+                    ref: pipelineRef,
+                    ...(ev.commitSha ? { sha: ev.commitSha } : {}),
+                    ...(ev.changeRequestNumber !== undefined ? { changeRequestNumber: ev.changeRequestNumber } : {}),
+                },
+            }
+            : {}),
+        source: "ci-failure",
+    });
+    return true;
+}
+function logWebhook(event, status, ctx = {}) {
+    const level = status >= 400 ? "warn" : "info";
+    log[level]("webhook", { event, status, ...ctx });
+}
+export function mountWebhook(app) {
+    app.post("/webhook", async (req, res) => {
+        const p = getPlatform();
+        const event = p.ingress.eventName(req.headers);
+        const projectId = p.ingress.projectIdFromBody(req.body);
+        if (projectId === undefined) {
+            logWebhook(event, 401, { reason: "missing project id" });
+            return res.status(401).end();
+        }
+        const stored = getToken(projectId);
+        if (!stored) {
+            logWebhook(event, 401, { reason: "no stored token", projectId });
+            return res.status(401).end();
+        }
+        if (!p.ingress.verifySignature(stored.signingToken, req.headers, req.rawBody, Date.now())) {
+            logWebhook(event, 401, { reason: "signature mismatch", projectId });
+            return res.status(401).end();
+        }
+        // Idempotency: dedupe delivery id within the TTL window so a forge retry
+        // (after a restart mid-run) doesn't double-dispatch the same work.
+        const webhookId = p.ingress.deliveryId(req.headers);
+        if (webhookId && isDuplicateWebhook(webhookId)) {
+            logWebhook(event, 204, { reason: "duplicate delivery" });
+            return res.status(204).end();
+        }
+        if (!event) {
+            logWebhook(undefined, 400);
+            return res.status(400).end();
+        }
+        log.debug("webhook received", {
+            event,
+            tokenReceived: true,
+            body: redact(JSON.stringify(req.body)),
+        });
+        const normalized = p.ingress.parseWebhook(req.headers, req.body);
+        if (!normalized) {
+            logWebhook(event, 204, { reason: "unhandled event" });
+            return res.status(204).end();
+        }
+        let handled = false;
+        switch (normalized.kind) {
+            case "comment":
+                handled = await handleCommentEvent(normalized);
+                break;
+            case "workitem-open":
+                handled = await handleWorkItemOpenEvent(normalized);
+                break;
+            case "workitem-close":
+                handled = await handleWorkItemCloseEvent(normalized);
+                break;
+            case "pipeline-failed":
+                handled = await handlePipelineFailureEvent(normalized);
+                break;
+            default:
+                handled = false;
+        }
+        const status = handled ? 202 : 204;
+        logWebhook(event, status, {
+            workItemNumber: normalized.workItem?.number,
+            ...(!handled && { reason: "filtered" }),
+        });
+        return res.status(status).end();
+    });
+}
+//# sourceMappingURL=webhook.js.map