@yeaft/webchat-agent 1.0.526 → 1.0.527

package/repo-workflow.js

@@ -4,15 +4,8 @@ import { existsSync } from 'node:fs';
 import { mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promises';
 import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
 import { promisify } from 'node:util';
-import {
-  consumeRepoApprovalCapability,
-  isRepoApprovalCapability,
-} from './yeaft/routing/router.js';
-
 const execFile = promisify(execFileCallback);
 const DEFAULT_REMOTE = 'origin';
-const DEFAULT_WAIT_TIMEOUT_MS = 30 * 60 * 1000;
-const DEFAULT_POLL_INTERVAL_MS = 15_000;
 const MAX_ERROR_OUTPUT = 4_000;
 const WORKTREE_OWNERSHIP_FILE = 'yeaft-repo-workflow-owner.json';
 const WORKTREE_OWNERSHIP_VERSION = 1;
@@ -292,34 +285,6 @@ function githubRepository(repository) {
   return parseGithubRemoteUrl(repository.remoteUrl);
 }
 
-async function assertPushTarget(run, repository) {
-  const github = githubRepository(repository);
-  const pushUrls = (await gitOutput(run, repository.repoRoot, [
-    'remote', 'get-url', '--push', '--all', repository.remote,
-  ])).split(/\r?\n/).filter(Boolean);
-  if (pushUrls.length === 0) {
-    throw new RepoWorkflowError('GITHUB_PUSH_URL_UNKNOWN', `Git remote "${repository.remote}" has no push URL`);
-  }
-  const targets = pushUrls.map(pushUrl => {
-    try {
-      return parseGithubRemoteUrl(pushUrl);
-    } catch {
-      return null;
-    }
-  });
-  const valid = targets.every(target => target
-    && target.host === github.host
-    && target.nameWithOwner.toLowerCase() === github.nameWithOwner.toLowerCase());
-  if (!valid) {
-    throw new RepoWorkflowError('GITHUB_PUSH_URL_MISMATCH', 'Selected remote fetch and push URLs do not identify the same GitHub repository', {
-      remote: repository.remote,
-      expected: github.selector,
-      pushTargets: targets.map(target => target?.selector || 'unsupported'),
-    });
-  }
-  return pushUrls[0];
-}
-
 function worktreeOwnershipKey(path) {
   return createHash('sha256').update(resolve(path)).digest('hex');
 }
@@ -668,750 +633,6 @@ export async function prepareRepoReview(options = {}, dependencies = {}) {
   };
 }
 
-function validateTagPrefix(prefix) {
-  if (typeof prefix !== 'string' || !/^v\d+\.\d+\.$/.test(prefix)) {
-    throw new RepoWorkflowError('INVALID_TAG_PREFIX', 'tagPrefix must match v<digits>.<digits>.');
-  }
-  return prefix;
-}
-
-export function nextNumericTag(tagNames, prefix, start = 0) {
-  validateTagPrefix(prefix);
-  const suffixes = tagNames
-    .filter(name => name.startsWith(prefix))
-    .map(name => name.slice(prefix.length))
-    .filter(suffix => /^\d+$/.test(suffix))
-    .map(Number)
-    .filter(Number.isSafeInteger);
-  const next = suffixes.length === 0 ? Number(start) : Math.max(...suffixes) + 1;
-  if (!Number.isSafeInteger(next) || next < 0) {
-    throw new RepoWorkflowError('INVALID_TAG_SEQUENCE', `Could not calculate the next tag for prefix ${prefix}`);
-  }
-  return `${prefix}${next}`;
-}
-
-function parseRemoteTags(output) {
-  const refs = new Map();
-  for (const line of String(output || '').split(/\r?\n/)) {
-    const match = line.match(/^([0-9a-f]{40})\s+refs\/tags\/(.+?)(\^\{\})?$/i);
-    if (!match) continue;
-    const [, sha, name, peeled] = match;
-    const current = refs.get(name) || { name, directSha: null, commitSha: null };
-    if (peeled) current.commitSha = sha;
-    else current.directSha = sha;
-    refs.set(name, current);
-  }
-  return [...refs.values()].map(ref => ({
-    name: ref.name,
-    directSha: ref.directSha,
-    commitSha: ref.commitSha || ref.directSha,
-  }));
-}
-
-function numericTagSuffix(name, prefix) {
-  if (!name.startsWith(prefix)) return null;
-  const suffix = name.slice(prefix.length);
-  if (!/^\d+$/.test(suffix)) return null;
-  const number = Number(suffix);
-  return Number.isSafeInteger(number) ? number : null;
-}
-
-async function resolveRemoteTag(run, repository, tag) {
-  const result = await runGit(run, repository.repoRoot, [
-    'ls-remote',
-    '--tags',
-    repository.remote,
-    `refs/tags/${tag}`,
-    `refs/tags/${tag}^{}`,
-  ]);
-  return parseRemoteTags(result.stdout).find(ref => ref.name === tag) || null;
-}
-
-async function resolveRemoteRefSha(run, repository, ref, remote = repository.remote) {
-  const output = await gitOutput(run, repository.repoRoot, ['ls-remote', remote, ref]);
-  const line = output.split(/\r?\n/).find(candidate => candidate.endsWith(`\t${ref}`));
-  return line?.split(/\s+/)[0] || null;
-}
-
-async function rollbackRemoteTag(run, repository, pushUrl, tag, directSha, targetSha, onStage) {
-  const ref = `refs/tags/${tag}`;
-  onStage({ stage: 'rollback-started', status: 'unknown', name: tag, sha: targetSha });
-  let rollbackError = null;
-  try {
-    await runGit(run, repository.repoRoot, [
-      'push',
-      '--porcelain',
-      `--force-with-lease=${ref}:${directSha}`,
-      pushUrl,
-      `:${ref}`,
-    ]);
-  } catch (error) {
-    rollbackError = error;
-  }
-  let remaining;
-  try {
-    remaining = await resolveRemoteTag(run, repository, tag);
-  } catch (verifyError) {
-    onStage({ stage: 'rollback-verify-failed', status: 'unknown', name: tag, sha: targetSha });
-    throw new RepoWorkflowError('TAG_ROLLBACK_VERIFY_FAILED', `Remote tag ${tag} rollback could not be verified after the base advanced`, {
-      tag,
-      expected: null,
-      actual: 'unknown',
-      rollbackError: rollbackError ? formatRepoWorkflowError(rollbackError) : null,
-      verifyError: formatRepoWorkflowError(verifyError),
-      transientTagMayHaveTriggeredAutomation: true,
-    });
-  }
-  if (remaining !== null) {
-    onStage({ stage: 'rollback-failed', status: 'unknown', name: tag, sha: targetSha });
-    throw new RepoWorkflowError('TAG_ROLLBACK_FAILED', `Remote tag ${tag} could not be rolled back after the base advanced`, {
-      tag,
-      expected: null,
-      actual: remaining,
-      rollbackError: rollbackError ? formatRepoWorkflowError(rollbackError) : null,
-      transientTagMayHaveTriggeredAutomation: true,
-    });
-  }
-  onStage({
-    stage: 'rolled-back',
-    status: 'unknown',
-    name: tag,
-    sha: targetSha,
-    transientTagMayHaveTriggeredAutomation: true,
-  });
-}
-
-async function assertTagBaseGuard(run, repository, baseGuard, tag) {
-  if (!baseGuard) return;
-  const currentBase = await resolveRemoteRefSha(run, repository, baseGuard.ref);
-  if (currentBase !== baseGuard.sha) {
-    throw new RepoWorkflowError('BASE_ADVANCED_DURING_TAG_PUSH', `Remote base advanced while tag ${tag} was being reused`, {
-      tag,
-      expected: baseGuard.sha,
-      actual: currentBase,
-      tagRolledBack: false,
-      transientTagMayHaveTriggeredAutomation: false,
-    });
-  }
-}
-
-async function createAndPushNextTag(run, repository, pushUrl, targetSha, prefix, start = 0, callbacks = {}) {
-  const onStage = callbacks.onStage || (() => {});
-  const beforePush = callbacks.beforePush || (async () => {});
-  const baseGuard = callbacks.baseGuard || null;
-  onStage({ stage: 'validate', status: 'not-attempted', prefix, sha: targetSha });
-  validateTagPrefix(prefix);
-  const initialTag = nextNumericTag([], prefix, start);
-  const refCheck = await runGit(run, repository.repoRoot, ['check-ref-format', `refs/tags/${initialTag}`], {
-    allowExitCodes: [1],
-  });
-  if (refCheck.exitCode !== 0) {
-    throw new RepoWorkflowError('INVALID_TAG_PREFIX', `tagPrefix does not form a valid Git tag: ${prefix}`);
-  }
-  onStage({ stage: 'scan-remote', status: 'not-attempted', prefix, sha: targetSha });
-  const remoteTags = await runGit(run, repository.repoRoot, [
-    'ls-remote',
-    '--tags',
-    repository.remote,
-    `refs/tags/${prefix}*`,
-  ]);
-  const matchingTags = parseRemoteTags(remoteTags.stdout)
-    .map(ref => ({ ...ref, suffix: numericTagSuffix(ref.name, prefix) }))
-    .filter(ref => ref.suffix !== null)
-    .sort((a, b) => b.suffix - a.suffix);
-  const existingTarget = matchingTags.find(ref => ref.commitSha === targetSha);
-  if (existingTarget) {
-    await assertTagBaseGuard(run, repository, baseGuard, existingTarget.name);
-    onStage({ stage: 'verified-preexisting', status: 'preexisting', name: existingTarget.name, sha: targetSha });
-    return { name: existingTarget.name, sha: targetSha, reused: true };
-  }
-
-  const tag = nextNumericTag(matchingTags.map(ref => ref.name), prefix, start);
-  const tagRef = `refs/tags/${tag}`;
-  onStage({ stage: 'selected', status: 'not-attempted', name: tag, sha: targetSha });
-  const remoteExisting = await resolveRemoteTag(run, repository, tag);
-  if (remoteExisting) {
-    if (remoteExisting.commitSha !== targetSha) {
-      throw new RepoWorkflowError('TAG_CONFLICT', `Remote tag ${tag} already points to another commit`, {
-        tag,
-        expected: targetSha,
-        actual: remoteExisting,
-      });
-    }
-    await assertTagBaseGuard(run, repository, baseGuard, tag);
-    onStage({ stage: 'verified-preexisting', status: 'preexisting', name: tag, sha: targetSha });
-    return { name: tag, sha: targetSha, reused: true };
-  }
-
-  await beforePush();
-  onStage({ stage: 'push-started', status: 'unknown', name: tag, sha: targetSha });
-  let reused = false;
-  try {
-    // Push the commit object directly. This deliberately leaves the local tag
-    // namespace untouched and makes the empty-ref lease the creation fence.
-    const pushed = await runGit(run, repository.repoRoot, [
-      'push',
-      '--porcelain',
-      `--force-with-lease=${tagRef}:`,
-      pushUrl,
-      `${targetSha}:${tagRef}`,
-    ]);
-    const porcelain = `${pushed.stdout}\n${pushed.stderr}`;
-    reused = porcelain.split(/\r?\n/).some(line => line.startsWith('=') && line.includes(tagRef));
-    onStage({ stage: 'push-returned', status: 'unknown', name: tag, sha: targetSha });
-  } catch (pushError) {
-    let observedTag;
-    let currentBase;
-    try {
-      [observedTag, currentBase] = await Promise.all([
-        resolveRemoteTag(run, repository, tag),
-        baseGuard ? resolveRemoteRefSha(run, repository, baseGuard.ref) : Promise.resolve(null),
-      ]);
-    } catch (verifyError) {
-      const effect = {
-        stage: 'push-outcome-unknown',
-        status: 'unknown',
-        name: tag,
-        sha: targetSha,
-        transientTagMayHaveTriggeredAutomation: true,
-      };
-      onStage(effect);
-      throw new RepoWorkflowError('TAG_PUSH_OUTCOME_UNKNOWN', `Remote tag ${tag} state is unknown after push failed`, {
-        tag,
-        directSha: 'unknown',
-        commitSha: 'unknown',
-        currentBase: 'unknown',
-        pushError: formatRepoWorkflowError(pushError),
-        verifyError: formatRepoWorkflowError(verifyError),
-        transientTagMayHaveTriggeredAutomation: true,
-      });
-    }
-    const effect = {
-      stage: 'push-outcome-unknown',
-      status: 'unknown',
-      name: tag,
-      sha: targetSha,
-      transientTagMayHaveTriggeredAutomation: true,
-    };
-    onStage(effect);
-    throw new RepoWorkflowError('TAG_PUSH_OUTCOME_UNKNOWN', `Remote tag ${tag} outcome is unknown after push failed`, {
-      tag,
-      directSha: observedTag?.directSha || null,
-      commitSha: observedTag?.commitSha || null,
-      currentBase,
-      pushError: formatRepoWorkflowError(pushError),
-      transientTagMayHaveTriggeredAutomation: true,
-    });
-  }
-
-  const remoteTag = await resolveRemoteTag(run, repository, tag);
-  const currentBase = baseGuard
-    ? await resolveRemoteRefSha(run, repository, baseGuard.ref)
-    : null;
-  if (remoteTag?.commitSha !== targetSha || (!reused && remoteTag.directSha !== targetSha)) {
-    throw new RepoWorkflowError('TAG_VERIFY_FAILED', `Remote tag ${tag} could not be verified`, {
-      tag,
-      expected: { directSha: reused ? 'preexisting' : targetSha, commitSha: targetSha },
-      actual: remoteTag,
-    });
-  }
-  if (baseGuard && currentBase !== baseGuard.sha) {
-    if (!reused) await rollbackRemoteTag(run, repository, pushUrl, tag, remoteTag.directSha, targetSha, onStage);
-    throw new RepoWorkflowError('BASE_ADVANCED_DURING_TAG_PUSH', `Remote base advanced while tag ${tag} was being created`, {
-      tag,
-      expected: baseGuard.sha,
-      actual: currentBase,
-      tagRolledBack: !reused,
-      transientTagMayHaveTriggeredAutomation: !reused,
-    });
-  }
-  const effect = { stage: reused ? 'verified-preexisting' : 'verified-created', status: reused ? 'preexisting' : 'created', name: tag, sha: targetSha };
-  onStage(effect);
-  return { name: tag, sha: targetSha, reused };
-}
-
-function abortedError() {
-  return new RepoWorkflowError('ABORTED', 'Repository workflow aborted');
-}
-
-function sleep(ms, signal) {
-  return new Promise((resolvePromise, reject) => {
-    if (signal?.aborted) {
-      reject(abortedError());
-      return;
-    }
-    const onAbort = () => {
-      clearTimeout(timer);
-      reject(abortedError());
-    };
-    const timer = setTimeout(() => {
-      signal?.removeEventListener('abort', onAbort);
-      resolvePromise();
-    }, ms);
-    signal?.addEventListener('abort', onAbort, { once: true });
-  });
-}
-
-async function captureWorkflowIdentity(run, repository, workflow) {
-  const github = githubRepository(repository);
-  const response = await ghJson(run, repository.repoRoot, [
-    'api',
-    '--hostname',
-    github.host,
-    '--paginate',
-    '--slurp',
-    `repos/${github.nameWithOwner}/actions/workflows?per_page=100`,
-  ]);
-  const pages = Array.isArray(response) ? response : [response];
-  const workflows = pages.flatMap(page => Array.isArray(page?.workflows) ? page.workflows : []);
-  const selector = String(workflow || '').trim();
-  const matches = workflows.filter(item => {
-    const id = Number(item?.id);
-    const path = String(item?.path || '');
-    return (Number.isSafeInteger(id) && String(id) === selector)
-      || path === selector
-      || basename(path) === selector
-      || String(item?.name || '') === selector;
-  });
-  if (matches.length > 1) {
-    throw new RepoWorkflowError('WORKFLOW_AMBIGUOUS', `Workflow "${selector}" matches multiple GitHub workflows`, {
-      matches: matches.map(item => ({ id: item.id, name: item.name, path: item.path })),
-    });
-  }
-  const info = matches[0];
-  const workflowId = Number(info?.id);
-  if (!Number.isSafeInteger(workflowId) || workflowId <= 0) {
-    throw new RepoWorkflowError('WORKFLOW_ID_UNKNOWN', `Workflow "${selector}" has no immutable GitHub workflow ID`);
-  }
-  return { id: workflowId, name: String(info.name || selector), path: String(info.path || '') };
-}
-
-async function listWorkflowRuns(run, repository, workflowIdentity) {
-  const github = githubRepository(repository);
-  const response = await ghJson(run, repository.repoRoot, [
-    'api',
-    '--hostname',
-    github.host,
-    `repos/${github.nameWithOwner}/actions/workflows/${workflowIdentity.id}/runs?per_page=100`,
-  ]);
-  return Array.isArray(response?.workflow_runs) ? response.workflow_runs : [];
-}
-
-async function captureWorkflowBaseline(run, repository, workflowIdentity) {
-  const runs = await listWorkflowRuns(run, repository, workflowIdentity);
-  const baselineRunId = runs.reduce((maximum, item) => {
-    const id = Number(item?.databaseId ?? item?.id);
-    return Number.isSafeInteger(id) ? Math.max(maximum, id) : maximum;
-  }, 0);
-  return { ...workflowIdentity, baselineRunId };
-}
-
-function workflowRunTimestamp(runInfo) {
-  const value = Date.parse(runInfo?.createdAt
-    || runInfo?.startedAt
-    || runInfo?.created_at
-    || runInfo?.run_started_at
-    || '');
-  return Number.isFinite(value) ? value : null;
-}
-
-function matchesWorkflowRun(runInfo, options, { requireWorkflowId = false } = {}) {
-  const id = Number(runInfo?.databaseId ?? runInfo?.id);
-  const workflowId = Number(runInfo?.workflowDatabaseId ?? runInfo?.workflow_id);
-  const timestamp = workflowRunTimestamp(runInfo);
-  return Number.isSafeInteger(id)
-    && id > options.workflowFence.baselineRunId
-    && (!requireWorkflowId || workflowId === options.workflowFence.id)
-    && runInfo.event === 'push'
-    && (runInfo.headSha ?? runInfo.head_sha) === options.targetSha
-    && (runInfo.headBranch ?? runInfo.head_branch) === options.ref
-    && timestamp !== null
-    && timestamp >= Math.floor(options.notBeforeMs / 1000) * 1000;
-}
-
-async function loadWorkflowRunDetail(run, repository, runId) {
-  const github = githubRepository(repository);
-  return ghJson(run, repository.repoRoot, [
-    'api',
-    '--hostname',
-    github.host,
-    `repos/${github.nameWithOwner}/actions/runs/${runId}`,
-  ]);
-}
-
-async function waitForWorkflow(run, repository, options, dependencies = {}) {
-  const sleepImpl = dependencies.sleep || sleep;
-  const signal = dependencies.signal;
-  const now = dependencies.now || (() => Date.now());
-  const github = githubRepository(repository);
-  const timeoutMs = Number(options.waitTimeoutMs || DEFAULT_WAIT_TIMEOUT_MS);
-  const pollIntervalMs = Number(options.pollIntervalMs || DEFAULT_POLL_INTERVAL_MS);
-  const waitStartedAt = now();
-  let runInfo = null;
-
-  while (now() - waitStartedAt <= timeoutMs) {
-    const runs = await listWorkflowRuns(run, repository, options.workflowFence);
-    runInfo = runs
-      .filter(item => matchesWorkflowRun(item, options, { requireWorkflowId: true }))
-      .sort((a, b) => Number(b.id ?? b.databaseId) - Number(a.id ?? a.databaseId))[0] || null;
-    if (runInfo) break;
-    await sleepImpl(pollIntervalMs, signal);
-  }
-
-  if (!runInfo) {
-    throw new RepoWorkflowError('WORKFLOW_NOT_FOUND', `Workflow "${options.workflowFence.name}" did not produce a new matching push run before timeout`, {
-      effect: 'merge-and-tag-completed',
-      workflow: options.workflowFence,
-      targetSha: options.targetSha,
-      ref: options.ref,
-      notBefore: new Date(options.notBeforeMs).toISOString(),
-    });
-  }
-
-  const selectedRunId = Number(runInfo.id ?? runInfo.databaseId);
-  while (now() - waitStartedAt <= timeoutMs) {
-    const detail = await loadWorkflowRunDetail(run, repository, selectedRunId);
-    const detailRunId = Number(detail.id ?? detail.databaseId);
-    if (!matchesWorkflowRun(detail, options, { requireWorkflowId: true })
-      || detailRunId !== selectedRunId) {
-      throw new RepoWorkflowError('WORKFLOW_IDENTITY_MISMATCH', 'GitHub workflow run details do not match the fenced push run', {
-        expected: {
-          runId: selectedRunId,
-          workflowId: options.workflowFence.id,
-          targetSha: options.targetSha,
-          ref: options.ref,
-          event: 'push',
-        },
-        actual: {
-          runId: detailRunId || null,
-          workflowId: Number(detail.workflow_id ?? detail.workflowDatabaseId) || null,
-          targetSha: detail.head_sha ?? detail.headSha ?? null,
-          ref: detail.head_branch ?? detail.headBranch ?? null,
-          event: detail.event || null,
-        },
-      });
-    }
-    if (detail.status === 'completed') {
-      const jobsResponse = await ghJson(run, repository.repoRoot, [
-        'run',
-        'view',
-        String(selectedRunId),
-        '--repo',
-        github.selector,
-        '--json',
-        'jobs',
-      ]);
-      const jobs = (jobsResponse.jobs || []).map(job => ({
-        name: job.name,
-        status: job.status,
-        conclusion: job.conclusion || null,
-      }));
-      if (detail.conclusion !== 'success') {
-        throw new RepoWorkflowError('WORKFLOW_FAILED', `Workflow "${options.workflowFence.name}" completed with ${detail.conclusion}`, {
-          effect: 'merge-and-tag-completed',
-          run: { id: detailRunId, url: detail.html_url || detail.url, conclusion: detail.conclusion, jobs },
-        });
-      }
-      return {
-        id: detailRunId,
-        workflowId: options.workflowFence.id,
-        url: detail.html_url || detail.url,
-        conclusion: detail.conclusion,
-        jobs,
-      };
-    }
-    await sleepImpl(pollIntervalMs, signal);
-  }
-
-  throw new RepoWorkflowError('WORKFLOW_TIMEOUT', `Workflow "${options.workflowFence.name}" did not finish before timeout`, {
-    effect: 'merge-and-tag-completed',
-    run: { id: selectedRunId, url: runInfo.html_url || runInfo.url },
-  });
-}
-
-function attachRemoteEffects(error, remoteEffects) {
-  if (error instanceof RepoWorkflowError) {
-    error.details = { ...error.details, remoteEffects };
-    return error;
-  }
-  return new RepoWorkflowError('POST_LANDING_FAILED', error?.message || String(error), {
-    remoteEffects,
-  });
-}
-
-function rejectLegacyLandingOptions(options) {
-  if (Object.hasOwn(options, 'mergeMethod')) {
-    throw new RepoWorkflowError('MERGE_METHOD_UNSUPPORTED', 'land always installs the exact reviewed merge snapshot; mergeMethod is not supported');
-  }
-  if (Object.hasOwn(options, 'worktreePaths') || Object.hasOwn(options, 'cleanupWorktree')) {
-    throw new RepoWorkflowError('LANDING_CLEANUP_UNSUPPORTED', 'land never removes worktrees; cleanup must be requested separately after landing');
-  }
-}
-
-async function pushReviewedSnapshot(run, repository, pushUrl, baseRef, frozenBase, reviewedSnapshot) {
-  let pushFailure = null;
-  let pushRejected = false;
-  try {
-    const pushed = await runGit(run, repository.repoRoot, [
-      'push',
-      '--porcelain',
-      `--force-with-lease=${baseRef}:${frozenBase}`,
-      pushUrl,
-      `${reviewedSnapshot}:${baseRef}`,
-    ], { allowExitCodes: [1] });
-    if (pushed.exitCode !== 0) {
-      pushFailure = pushed;
-      // A non-zero exit can follow remote acceptance (for example a lost
-      // connection). Only a porcelain rejection for this exact destination
-      // proves that Git rejected the write; stderr/exit status alone cannot.
-      pushRejected = String(pushed.stdout || '').split('\n').some(line => {
-        const [flag, refspec, summary] = line.split('\t');
-        return flag === '!'
-          && refspec === `${reviewedSnapshot}:${baseRef}`
-          && /^\[(?:rejected|remote rejected)\](?: |$)/.test(summary || '');
-      });
-    }
-  } catch (error) {
-    pushFailure = error;
-  }
-
-  let actual;
-  try {
-    actual = await resolveRemoteRefSha(run, repository, baseRef, pushUrl);
-  } catch (error) {
-    throw new RepoWorkflowError('BASE_UPDATE_OUTCOME_UNKNOWN', 'Could not verify the remote base after the atomic update attempt', {
-      ref: baseRef,
-      expectedOld: frozenBase,
-      expectedNew: reviewedSnapshot,
-      cause: error?.message || String(error),
-    });
-  }
-  if (actual === reviewedSnapshot) return;
-  if (pushFailure) {
-    if (pushRejected && actual === frozenBase) {
-      throw new RepoWorkflowError('BASE_LEASE_REJECTED', 'Remote base did not accept the exact reviewed snapshot with the frozen-base lease', {
-        ref: baseRef,
-        expectedOld: frozenBase,
-        expectedNew: reviewedSnapshot,
-        actual,
-      });
-    }
-    throw new RepoWorkflowError('BASE_UPDATE_OUTCOME_UNKNOWN', 'Remote base outcome is unknown after the atomic update attempt failed', {
-      ref: baseRef,
-      expectedOld: frozenBase,
-      expectedNew: reviewedSnapshot,
-      actual,
-      pushError: formatRepoWorkflowError(pushFailure),
-    });
-  }
-  throw new RepoWorkflowError('BASE_UPDATE_VERIFY_FAILED', 'Remote base does not point at the exact reviewed snapshot after push', {
-    ref: baseRef,
-    expected: reviewedSnapshot,
-    actual,
-  });
-}
-
-export async function landRepoWorkflow(options = {}, dependencies = {}) {
-  const run = dependencies.run || createRepoCommandRunner({ signal: dependencies.signal });
-  const pr = assertPositiveInteger(options.pr, 'pr');
-  if (!isRepoApprovalCapability(dependencies.approvalCapability)) {
-    throw new RepoWorkflowError('APPROVAL_REQUIRED', 'Landing requires a host-issued repository approval capability');
-  }
-  if (typeof options.baseBranch !== 'string' || !options.baseBranch.trim()) {
-    throw new RepoWorkflowError('INVALID_INPUT', 'baseBranch must be the exact reviewed destination branch');
-  }
-  if (!/^[0-9a-f]{40}$/i.test(options.baseSha || '')) {
-    throw new RepoWorkflowError('INVALID_INPUT', 'baseSha must be the exact 40-character reviewed base commit SHA');
-  }
-  if (!/^[0-9a-f]{40}$/i.test(options.reviewedHead || '')) {
-    throw new RepoWorkflowError('INVALID_INPUT', 'reviewedHead must be the exact 40-character reviewed commit SHA');
-  }
-  if (!/^[0-9a-f]{40}$/i.test(options.reviewedSnapshot || '')) {
-    throw new RepoWorkflowError('INVALID_INPUT', 'reviewedSnapshot must be the exact 40-character reviewed merge snapshot SHA');
-  }
-  rejectLegacyLandingOptions(options);
-  const approvedBaseBranch = options.baseBranch.trim();
-  const approvedBaseSha = options.baseSha.toLowerCase();
-  if (options.tagPrefix !== undefined) validateTagPrefix(options.tagPrefix);
-
-  const repository = await resolveRepository(run, options.cwd || process.cwd(), options);
-  const github = githubRepository(repository);
-  const approval = consumeRepoApprovalCapability(dependencies.approvalCapability, {
-    ...dependencies.approvalContext,
-    repository: `${github.host}/${github.nameWithOwner}`,
-    pr,
-    baseBranch: approvedBaseBranch,
-    baseSha: approvedBaseSha,
-    reviewedHead: options.reviewedHead,
-    reviewedSnapshot: options.reviewedSnapshot,
-  }, { now: dependencies.now || Date.now });
-  if (!approval) {
-    throw new RepoWorkflowError('APPROVAL_REQUIRED', 'Repository approval capability is missing, invalid, stale, or already consumed');
-  }
-
-  // The push URL and workflow identity are frozen before the first write. The
-  // base update itself is one receive-pack ref transaction guarded by the exact
-  // base observed together with the reviewed PR head and merge snapshot.
-  const pushUrl = await assertPushTarget(run, repository);
-  const workflowIdentity = options.workflow
-    ? await captureWorkflowIdentity(run, repository, options.workflow)
-    : null;
-  const now = dependencies.now || (() => Date.now());
-  let workflowFence = null;
-  let workflowNotBeforeMs = null;
-  const info = await loadPullRequest(run, repository, pr);
-  if (info.baseRefName !== approvedBaseBranch) {
-    throw new RepoWorkflowError('REVIEW_STALE', 'PR destination branch changed after review', {
-      reviewed: { baseBranch: approvedBaseBranch, baseSha: approvedBaseSha },
-      current: { baseBranch: info.baseRefName },
-    });
-  }
-  let checks = null;
-  let frozenBase = null;
-  let alreadyMerged = false;
-  let tag = null;
-
-  if (info.state === 'OPEN') {
-    checks = validateOpenPullRequest(info, { requireChecksComplete: true });
-    const frozen = await fetchPullRequestSnapshot(run, repository, info);
-    if (frozen.headSha !== options.reviewedHead || frozen.snapshotSha !== options.reviewedSnapshot) {
-      throw new RepoWorkflowError('REVIEW_STALE', 'PR head or merge snapshot changed after review', {
-        reviewed: { headSha: options.reviewedHead, snapshotSha: options.reviewedSnapshot },
-        current: { headSha: frozen.headSha, snapshotSha: frozen.snapshotSha, baseSha: frozen.baseSha },
-      });
-    }
-    if (frozen.baseSha !== approvedBaseSha) {
-      throw new RepoWorkflowError('REVIEW_STALE', 'PR base changed after review', {
-        reviewed: { baseBranch: approvedBaseBranch, baseSha: approvedBaseSha },
-        current: { baseBranch: info.baseRefName, baseSha: frozen.baseSha },
-      });
-    }
-    frozenBase = approvedBaseSha;
-  } else if (info.state === 'MERGED') {
-    const mergeSha = info.mergeCommit?.oid || null;
-    if (info.headRefOid !== options.reviewedHead || mergeSha !== options.reviewedSnapshot) {
-      throw new RepoWorkflowError('REVIEW_STALE', 'Merged pull request does not match the exact reviewed head and snapshot', {
-        reviewed: { headSha: options.reviewedHead, snapshotSha: options.reviewedSnapshot },
-        current: { headSha: info.headRefOid, mergeSha },
-      });
-    }
-    const parentLine = await gitOutput(run, repository.repoRoot, ['rev-list', '--parents', '-n', '1', options.reviewedSnapshot]);
-    const [, ...parents] = parentLine.split(/\s+/);
-    if (parents.length !== 2 || parents[0] !== approvedBaseSha || parents[1] !== options.reviewedHead) {
-      throw new RepoWorkflowError('SNAPSHOT_INCONSISTENT', 'Reviewed snapshot does not have the approved base and reviewed head as its parents', {
-        baseSha: approvedBaseSha,
-        headSha: options.reviewedHead,
-        snapshotSha: options.reviewedSnapshot,
-        parents,
-      });
-    }
-    const currentBase = await fetchBase(run, repository, approvedBaseBranch);
-    if (currentBase !== options.reviewedSnapshot) {
-      throw new RepoWorkflowError('BASE_NOT_EXACT_REVIEWED_SNAPSHOT', 'Remote base no longer points at the exact reviewed snapshot', {
-        expected: options.reviewedSnapshot,
-        actual: currentBase,
-      });
-    }
-    frozenBase = parents[0];
-    alreadyMerged = true;
-  } else {
-    throw new RepoWorkflowError('PR_NOT_LANDABLE', `PR #${pr} is ${String(info.state).toLowerCase()}`);
-  }
-
-  if (workflowIdentity && !options.tagPrefix) {
-    if (alreadyMerged) {
-      throw new RepoWorkflowError('WORKFLOW_NOT_TRIGGERED', 'The exact reviewed snapshot is already landed, so this call cannot fence a new branch workflow run');
-    }
-    workflowFence = await captureWorkflowBaseline(run, repository, workflowIdentity);
-    workflowNotBeforeMs = now();
-  }
-
-  const baseRef = `refs/heads/${approvedBaseBranch}`;
-  const remoteEffects = {
-    base: {
-      status: alreadyMerged ? 'preexisting' : 'not-attempted',
-      ref: baseRef,
-      before: frozenBase,
-      sha: options.reviewedSnapshot,
-    },
-  };
-  try {
-    if (!alreadyMerged) {
-      remoteEffects.base.status = 'unknown';
-      try {
-        await pushReviewedSnapshot(
-          run,
-          repository,
-          pushUrl,
-          baseRef,
-          frozenBase,
-          options.reviewedSnapshot,
-        );
-      } catch (error) {
-        if (error instanceof RepoWorkflowError && error.code === 'BASE_LEASE_REJECTED') {
-          remoteEffects.base.status = 'rejected';
-        }
-        throw error;
-      }
-      remoteEffects.base.status = 'created';
-    }
-
-    if (options.tagPrefix) {
-      tag = await createAndPushNextTag(
-        run,
-        repository,
-        pushUrl,
-        options.reviewedSnapshot,
-        options.tagPrefix,
-        options.tagStart ?? 0,
-        {
-          baseGuard: { ref: baseRef, sha: options.reviewedSnapshot },
-          onStage: effect => { remoteEffects.tag = effect; },
-          beforePush: async () => {
-            if (!workflowIdentity) return;
-            workflowFence = await captureWorkflowBaseline(run, repository, workflowIdentity);
-            workflowNotBeforeMs = now();
-          },
-        },
-      );
-      if (workflowIdentity && !workflowFence) {
-        throw new RepoWorkflowError('WORKFLOW_NOT_TRIGGERED', 'The target tag already existed, so this landing did not trigger a new workflow run', {
-          tag,
-        });
-      }
-    }
-    const workflow = workflowFence
-      ? await waitForWorkflow(run, repository, {
-        workflowFence,
-        targetSha: options.reviewedSnapshot,
-        ref: tag?.name || approvedBaseBranch,
-        notBeforeMs: workflowNotBeforeMs,
-        waitTimeoutMs: options.waitTimeoutMs,
-        pollIntervalMs: options.pollIntervalMs,
-      }, dependencies)
-      : null;
-
-    return {
-      ok: true,
-      phase: 'land',
-      repository: compactRepository(repository),
-      approval: {
-        by: approval.issuerVpId,
-        baseBranch: approvedBaseBranch,
-        baseSha: approvedBaseSha,
-        headSha: options.reviewedHead,
-        snapshotSha: options.reviewedSnapshot,
-      },
-      pullRequest: { number: info.number, url: info.url, baseBranch: approvedBaseBranch, checks },
-      merge: { sha: options.reviewedSnapshot, alreadyMerged },
-      tag,
-      workflow,
-    };
-  } catch (error) {
-    throw attachRemoteEffects(error, remoteEffects);
-  }
-}
-
 export function formatRepoWorkflowError(error) {
   const payload = error instanceof RepoWorkflowError
     ? (() => {