agent-dealer 1.3.3 → 1.3.5

package/bundle/server/dist/coordinator/commands.js

@@ -32,7 +32,7 @@ import { routeDeveloperOutcome, routeReviewerOutcome, } from "./routing.js";
 import { projectDeveloperRoute, projectReviewerRoute } from "./projection.js";
 import { MERGE_CONFLICT_FILES_EVIDENCE_KEY, MERGE_FAILURE_EVIDENCE_KEY, MERGE_FAILURE_RESPONSE_OPTIONS, PUSH_DIVERGENCE_EVIDENCE_KEY, PUSH_DIVERGENCE_RESPONSE_OPTIONS, WORKTREE_BLOCKER_EVIDENCE_KEY, normalizeResolutionNote, parseHumanResolution, resolveHumanActionOutcome, } from "./human-resolution.js";
 import { AUTH_TRANSIENT_RETRY_PAYLOAD_KEY, RUNTIME_AUTH_PARK_EVIDENCE_KEY, authProbeConfirmsFailure, defaultRemediationForRuntime, gateRuntimeAuthParkResume, parseRuntimeAuthParkEvidence, remediationFromProbe, } from "./runtime-auth-park.js";
-import { AUTO_MERGE_INTENT, finalizeAutoMerge } from "./auto-merge.js";
+import { AUTO_MERGE_INTENT, OPERATOR_VERIFICATION_INTENT, finalizeAutoMerge } from "./auto-merge.js";
 import { triggerLinearPostMerge } from "./linear-merge-verify.js";
 import { conflictRepairSpent, queueConflictRepairRound } from "./merge-conflict-sync.js";
 import { OPERATOR_VERIFICATION_ARTIFACT_KIND, OPERATOR_VERIFICATION_RESPONSE_OPTIONS, } from "./operator-criteria.js";
@@ -261,6 +261,84 @@ export function applyParkedEdit(issueId, patch) {
         throw err;
     }
 }
+export function autoMergePolicyEditability(issue) {
+    switch (issue.status) {
+        case "ready":
+            return { editable: true, reason: null };
+        case "developing":
+        case "reviewing":
+        case "repairing":
+            return getActiveWorkflowInstance(issue.id)
+                ? { editable: true, reason: null }
+                : { editable: false, reason: "No active workflow is running for this issue." };
+        case "needs_human": {
+            const open = listHumanActionsForIssue(issue.id).filter((a) => a.status === "open");
+            // The operator-verification gate runs after approval routing: resolving it continues
+            // the already-committed merge path, so the policy is locked while it is open.
+            if (issue.currentIntent === OPERATOR_VERIFICATION_INTENT ||
+                open.some((a) => a.actionType === "operator_verification")) {
+                return {
+                    editable: false,
+                    reason: "The reviewer approved and the merge decision is committed — it waits only on operator verification.",
+                };
+            }
+            // Merge-failure parks, including the no-head operator-verification escalation.
+            if (open.some((a) => a.actionType === "policy_escalation" && isMergeFailureAction(a))) {
+                return {
+                    editable: false,
+                    reason: "The reviewer approved and the merge was already attempted — use the merge-failure action instead.",
+                };
+            }
+            return { editable: true, reason: null };
+        }
+        case "final_review":
+            return {
+                editable: false,
+                reason: issue.currentOwner === "system" && issue.currentIntent === AUTO_MERGE_INTENT
+                    ? "The reviewer approved and auto-merge is already in flight."
+                    : "The reviewer approved and the merge decision is committed — use Merge on the final review action.",
+            };
+        case "done":
+        case "closed":
+            return { editable: false, reason: `The issue is ${issue.status}.` };
+    }
+}
+/**
+ * NOT-490: an `autoMerge`-only update — the one input that may change during a live
+ * round, because nothing reads it until approved-review routing. Guard re-check, row
+ * write and audit run in one SQLite transaction, which serializes against the
+ * reviewer-completion transaction: an update committed first is the value
+ * `applyReviewer` routes on; a reviewer decision committed first moves the issue to
+ * `final_review` and this answers 409, so one approval can never yield both an
+ * auto-merge and a `final_review` action. Queue entry, frozen snapshot, agents,
+ * budgets, branch and PR are untouched (`updateIssue` writes only the policy column
+ * here). A real change appends one `issue.reassigned` event with before/after values
+ * and the actor; a no-op appends nothing.
+ */
+export function applyAutoMergePolicyUpdate(issueId, autoMerge, actor) {
+    return getDb().transaction(() => {
+        const fresh = getIssue(issueId);
+        if (!fresh)
+            return { ok: false, code: 404, error: "Not found" };
+        const editability = autoMergePolicyEditability(fresh);
+        if (!editability.editable) {
+            return { ok: false, code: 409, error: `Auto-merge can no longer be changed: ${editability.reason}` };
+        }
+        if (fresh.autoMerge === autoMerge)
+            return { ok: true, issue: fresh, changed: false };
+        const next = updateIssue(issueId, { autoMerge });
+        appendWorkflowEvent({
+            issueId,
+            workflowInstanceId: getActiveWorkflowInstance(issueId)?.id ?? null,
+            type: "issue.reassigned",
+            actorType: "human",
+            stage: next.status,
+            round: next.currentRound,
+            payload: { fromAutoMerge: fresh.autoMerge, toAutoMerge: next.autoMerge, actor },
+        });
+        return { ok: true, issue: next, changed: true };
+    })();
+}
 /**
  * Stable identity-plus-bytes key for one attachment manifest entry. blobPath is
  * excluded: it is content-addressed from the compared fields under an

package/bundle/server/dist/coordinator/commands.test.js

@@ -42,6 +42,8 @@ function newIssue(opts = {}) {
         baseBranch: "main",
         maxReviewRounds: opts.maxReviewRounds ?? 3,
         maxInfraAttempts: opts.maxInfraAttempts ?? 3,
+        // NOT-489: omitted now means auto-merge; this suite exercises final human review.
+        autoMerge: false,
         source: "manual"
     }).id;
 }

package/bundle/server/dist/coordinator/developer-effect.test.js

@@ -89,6 +89,8 @@ async function makeIssue(opts = {}) {
         reviewerAgentId: rev.id,
         maxReviewRounds: 3,
         maxInfraAttempts: opts.maxInfraAttempts ?? 3,
+        // NOT-489: omitted now means auto-merge; this suite exercises final human review.
+        autoMerge: false,
         source: "manual"
     }).id;
 }

package/bundle/server/dist/coordinator/operator-verification.integration.test.js

@@ -358,13 +358,15 @@ function recordVisualEvidence(issueId, opts) {
             baseSha: "base1",
             uiAffecting: true,
             state: opts.state,
-            runId: opts.state === "missing" ? null : 42,
+            runId: opts.state === "available" || opts.state === "failed" ? 42 : null,
             artifactNames: opts.state === "available" ? ["ui-screenshots", "ui-baseline", "ui-diff"] : [],
             reason: opts.state === "available"
                 ? null
                 : opts.state === "failed"
                     ? "Visual run 42 for this head concluded failure — its captures are unusable"
-                    : "no Visual workflow run found for head abc123",
+                    : opts.state === "not_applicable"
+                        ? "repository has no Visual workflow (workflow visual.yml not found on the default branch) — nothing to capture"
+                        : "no Visual workflow run found for head abc123",
         },
         author: "system",
     });
@@ -420,6 +422,22 @@ test("NOT-384: available visual evidence on a UI head merges normally", async ()
     assert.deepEqual(calls, [{ cwd: managedCwd, number: 42 }]);
     assert.equal(getIssue(issueId).status, "done");
 });
+test("NOT-538: not_applicable visual evidence (no Visual workflow) on a UI head merges normally", async () => {
+    const calls = [];
+    setMergePrForTests(async (opts) => {
+        calls.push(opts);
+        return { ok: true };
+    });
+    const issueId = newIssue("It works");
+    startWorkflow(issueId);
+    recordVisualEvidence(issueId, { headSha: "abc123", state: "not_applicable" });
+    const result = await approve(issueId);
+    assert.equal(result.applied, true);
+    if (result.applied)
+        assert.equal(result.issueStatus, "done");
+    assert.deepEqual(calls, [{ cwd: managedCwd, number: 42 }]);
+    assert.equal(getIssue(issueId).status, "done");
+});
 test("NOT-384: [operator] criteria plus a visual hold raise one action naming both", async () => {
     let merges = 0;
     setMergePrForTests(async () => {

package/bundle/server/dist/coordinator/repair-cycle.integration.test.js

@@ -84,6 +84,8 @@ async function makeIssue() {
         reviewerAgentId: rev.id,
         maxReviewRounds: 3,
         maxInfraAttempts: 3,
+        // NOT-489: omitted now means auto-merge; this suite exercises final human review.
+        autoMerge: false,
         source: "manual"
     }).id;
 }

package/bundle/server/dist/coordinator/reviewer-effect.test.js

@@ -104,6 +104,8 @@ async function makeIssue(opts = {}) {
         reviewerAgentId: rev.id,
         maxReviewRounds: 3,
         maxInfraAttempts: opts.maxInfraAttempts ?? 3,
+        // NOT-489: omitted now means auto-merge; this suite exercises final human review.
+        autoMerge: false,
         source: "manual"
     }).id;
 }

package/bundle/server/dist/coordinator/reviewer-visual-evidence.js

@@ -22,8 +22,10 @@
 //     Dealer's issue-artifact storage, stage a read-only copy inside the
 //     reviewer's worktree (outside tracked paths, ignored by `isWorktreeClean`),
 //     and record one `visual_evidence` artifact row. It never throws: every
-//     failure mode resolves to `missing` with a reason, and a missing or
-//     failed capture never counts as a visual pass.
+//     failure mode resolves to `missing` with a reason — except a lookup 404
+//     proving the repository has no `visual.yml`, which resolves to
+//     `not_applicable` (nothing to capture) — and a missing or failed capture
+//     never counts as a visual pass.
 //  4. `readVisualEvidenceHold` — the merge-gate reader (auto-merge.ts): a
 //     UI-affecting head whose recorded evidence is `missing` or `failed` holds
 //     for `operator_verification` instead of merging or queuing a repair round.
@@ -334,6 +336,24 @@ function truncateReason(text, maxChars = 300) {
     const oneLine = text.replace(/\s+/g, " ").trim();
     return oneLine.length > maxChars ? `${oneLine.slice(0, maxChars).trimEnd()}…` : oneLine;
 }
+/**
+ * NOT-538: true when a Visual run lookup failure means the repository's
+ * default branch has no `visual.yml` (`gh run list --workflow visual.yml`
+ * answers HTTP 404: "workflow visual.yml not found on the default branch"),
+ * rather than a transient or auth failure. Deliberately narrow — all three
+ * markers must be present — so auth, network, 5xx, and rate-limit failures
+ * keep failing closed to `missing`.
+ */
+export function isVisualWorkflowNotFoundError(message) {
+    const text = message.toLowerCase();
+    return text.includes("404") && text.includes("visual.yml") && text.includes("not found");
+}
+/**
+ * NOT-538: the recorded reason when the lookup proves the repository has no
+ * Visual workflow. The head still matches the UI paths (`uiAffecting: true`),
+ * but there is nothing to capture, so the merge gate must not hold.
+ */
+export const VISUAL_WORKFLOW_ABSENT_REASON = "repository has no Visual workflow (workflow visual.yml not found on the default branch) — nothing to capture";
 function noEvidence(uiAffecting, base, reason) {
     return {
         ...base,
@@ -357,7 +377,9 @@ function noEvidence(uiAffecting, base, reason) {
  *
  * Never throws and never returns usable evidence it does not have: unknown
  * changed files fail closed to UI-affecting + `missing`, and every lookup,
- * download, stage, or record failure degrades to `missing` with a reason.
+ * download, stage, or record failure degrades to `missing` with a reason —
+ * except a lookup 404 proving the repository has no Visual workflow, which
+ * records `not_applicable` instead (NOT-538).
  */
 export async function resolveReviewerVisualEvidence(opts) {
     const base = { headSha: opts.headSha, baseSha: opts.baseSha };
@@ -411,7 +433,25 @@ export async function resolveReviewerVisualEvidence(opts) {
             run = await fetcher.findRunForHead({ cwd: opts.worktreePath, headSha: opts.headSha });
         }
         catch (err) {
-            const resolved = noEvidence(true, base, `Visual run lookup failed: ${truncateReason(err instanceof Error ? err.message : String(err))}`);
+            const message = err instanceof Error ? err.message : String(err);
+            if (isVisualWorkflowNotFoundError(message)) {
+                const resolved = {
+                    ...base,
+                    uiAffecting: true,
+                    state: "not_applicable",
+                    runId: null,
+                    artifactNames: [],
+                    stagedDir: null,
+                    summaryChars: null,
+                    reason: VISUAL_WORKFLOW_ABSENT_REASON,
+                    staged: null,
+                    summary: null,
+                    files: null,
+                };
+                record(resolved, null);
+                return resolved;
+            }
+            const resolved = noEvidence(true, base, `Visual run lookup failed: ${truncateReason(message)}`);
             record(resolved, null);
             return resolved;
         }

package/bundle/server/dist/coordinator/reviewer-visual-evidence.test.js

@@ -17,7 +17,7 @@ const { createIssue } = await import("../repository/issues.js");
 const { createIssueArtifact } = await import("../repository/artifacts.js");
 const { listArtifactsForIssueByKind } = await import("../repository/artifacts-for-issue.js");
 const { isWorktreeClean, REVIEWER_VISUAL_STAGING_DIR_NAME } = await import("../adapters/git-worktree.js");
-const { VISUAL_WORKFLOW_PATHS, VISUAL_ARTIFACT_NAMES, VISUAL_EVIDENCE_ARTIFACT_KIND, isUiAffectingChange, classifyVisualEvidence, githubVisualEvidenceFetcher, resolveReviewerVisualEvidence, stageVisualArtifacts, cleanupStagedVisualArtifacts, readVisualDiffSummary, reviewerVisualStagingDir, toReviewerVisualEvidenceInput, readVisualEvidenceHold, } = await import("./reviewer-visual-evidence.js");
+const { VISUAL_WORKFLOW_PATHS, VISUAL_ARTIFACT_NAMES, VISUAL_EVIDENCE_ARTIFACT_KIND, VISUAL_WORKFLOW_ABSENT_REASON, isUiAffectingChange, classifyVisualEvidence, githubVisualEvidenceFetcher, resolveReviewerVisualEvidence, stageVisualArtifacts, cleanupStagedVisualArtifacts, readVisualDiffSummary, reviewerVisualStagingDir, toReviewerVisualEvidenceInput, readVisualEvidenceHold, } = await import("./reviewer-visual-evidence.js");
 before(() => migrate());
 beforeEach(() => {
     getDb().exec(`
@@ -285,6 +285,8 @@ function fixtureFetcher(opts) {
     return {
         calls,
         async findRunForHead() {
+            if (opts.failLookupError !== undefined)
+                throw new Error(opts.failLookupError);
             if (opts.failLookup)
                 throw new Error("gh exploded");
             return opts.run === undefined
@@ -494,3 +496,129 @@ test("NOT-384: gate reader holds only UI heads with missing/failed evidence at t
     });
     assert.equal(readVisualEvidenceHold(nonUiIssue, HEAD), null);
 });
+// NOT-538: a repository whose default branch has no visual.yml has nothing to
+// capture — the lookup's "workflow not found" 404 resolves to not_applicable
+// (the head still matches the UI paths) instead of holding the PR.
+test("NOT-538: workflow-not-found 404 records not_applicable, never missing", async () => {
+    const issueId = makeIssue();
+    const worktree = initRepo();
+    try {
+        const resolved = await resolveReviewerVisualEvidence({
+            issueId,
+            worktreePath: worktree,
+            baseSha: "c".repeat(40),
+            headSha: HEAD,
+            changedFiles: ["packages/shared/src/types.ts"],
+            github: {},
+            fetcher: fixtureFetcher({
+                failLookupError: "gh run list failed: HTTP 404: workflow visual.yml not found on the default branch",
+            }),
+        });
+        assert.equal(resolved.state, "not_applicable");
+        assert.equal(resolved.uiAffecting, true);
+        assert.equal(resolved.runId, null);
+        assert.equal(resolved.staged, null);
+        assert.equal(resolved.reason, VISUAL_WORKFLOW_ABSENT_REASON);
+        assert.match(resolved.reason, /repository has no Visual workflow/);
+        assert.equal(toReviewerVisualEvidenceInput(resolved), undefined);
+        const rows = listArtifactsForIssueByKind(issueId, VISUAL_EVIDENCE_ARTIFACT_KIND);
+        assert.equal(rows.length, 1);
+        const content = JSON.parse(rows[0].contentJson);
+        assert.equal(content.state, "not_applicable");
+        assert.equal(content.uiAffecting, true);
+        // The recorded workflow-absent record releases the merge gate.
+        assert.equal(readVisualEvidenceHold(issueId, HEAD), null);
+    }
+    finally {
+        fs.rmSync(worktree, { recursive: true, force: true });
+    }
+});
+// NOT-538: every other lookup failure still fails closed to missing with the
+// existing reason — only the workflow-not-found 404 skips the gate.
+test("NOT-538: auth, network, 5xx, and rate-limit lookup failures still record missing", async () => {
+    const worktree = initRepo();
+    try {
+        const failures = {
+            auth: "gh run list failed: HTTP 401: Bad credentials",
+            network: "gh run list failed: Could not resolve host: api.github.com",
+            server: "gh run list failed: HTTP 502: Bad Gateway",
+            rateLimit: "gh run list failed: HTTP 403: API rate limit exceeded for user ID 123",
+        };
+        for (const [kind, message] of Object.entries(failures)) {
+            const resolved = await resolveReviewerVisualEvidence({
+                issueId: makeIssue(),
+                worktreePath: worktree,
+                baseSha: "c".repeat(40),
+                headSha: HEAD,
+                changedFiles: ["packages/shared/src/types.ts"],
+                github: {},
+                fetcher: fixtureFetcher({ failLookupError: message }),
+            });
+            assert.equal(resolved.state, "missing", `${kind} failure must stay missing`);
+            assert.equal(resolved.uiAffecting, true);
+            assert.match(resolved.reason, /^Visual run lookup failed: /, `${kind} failure keeps the lookup-failed reason`);
+        }
+        // Near-miss 404s that do not name the missing workflow also stay missing.
+        for (const message of [
+            "gh run list failed: HTTP 404: Not Found",
+            "gh run list failed: HTTP 404: repository not found",
+        ]) {
+            const resolved = await resolveReviewerVisualEvidence({
+                issueId: makeIssue(),
+                worktreePath: worktree,
+                baseSha: "c".repeat(40),
+                headSha: HEAD,
+                changedFiles: ["packages/shared/src/types.ts"],
+                github: {},
+                fetcher: fixtureFetcher({ failLookupError: message }),
+            });
+            assert.equal(resolved.state, "missing", `${message} must stay missing`);
+        }
+    }
+    finally {
+        fs.rmSync(worktree, { recursive: true, force: true });
+    }
+});
+// NOT-538: the gate reader releases a UI-affecting head whose record is
+// not_applicable because the repository has no Visual workflow, and still
+// holds missing and failed.
+test("NOT-538: gate reader releases workflow-absent not_applicable, holds missing and failed", () => {
+    const absentIssue = makeIssue();
+    createIssueArtifact({
+        issueId: absentIssue,
+        kind: VISUAL_EVIDENCE_ARTIFACT_KIND,
+        content: {
+            headSha: HEAD,
+            uiAffecting: true,
+            state: "not_applicable",
+            reason: VISUAL_WORKFLOW_ABSENT_REASON,
+            runId: null,
+            artifactNames: [],
+        },
+        author: "system",
+    });
+    assert.equal(readVisualEvidenceHold(absentIssue, HEAD), null);
+    const missingIssue = makeIssue();
+    createIssueArtifact({
+        issueId: missingIssue,
+        kind: VISUAL_EVIDENCE_ARTIFACT_KIND,
+        content: {
+            headSha: HEAD,
+            uiAffecting: true,
+            state: "missing",
+            reason: "Visual run lookup failed: HTTP 502: Bad Gateway",
+            runId: null,
+            artifactNames: [],
+        },
+        author: "system",
+    });
+    assert.equal(readVisualEvidenceHold(missingIssue, HEAD).state, "missing");
+    const failedIssue = makeIssue();
+    createIssueArtifact({
+        issueId: failedIssue,
+        kind: VISUAL_EVIDENCE_ARTIFACT_KIND,
+        content: { headSha: HEAD, uiAffecting: true, state: "failed", reason: "boom", runId: 9, artifactNames: [] },
+        author: "system",
+    });
+    assert.equal(readVisualEvidenceHold(failedIssue, HEAD).state, "failed");
+});

package/bundle/server/dist/coordinator/worker-loop.test.js

@@ -51,6 +51,8 @@ function newIssue(maxReviewRounds = 3) {
         baseBranch: "main",
         maxReviewRounds,
         maxInfraAttempts: 3,
+        // NOT-489: omitted now means auto-merge; this suite exercises final human review.
+        autoMerge: false,
         source: "manual"
     }).id;
 }

package/bundle/server/dist/db/auto-merge-default-migration.test.js

@@ -0,0 +1,52 @@
+// NOT-489: a clean install's `issues.auto_merge` column defaults on, while an upgrade
+// never rewrites an existing issue's stored choice — and new creates on the upgraded
+// database still take the shared `CreateIssueInput` default (true), not the column's.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import Database from "better-sqlite3";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-auto-merge-migrate-"));
+const { migrate, getDb } = await import("./index.js");
+const { BUILTIN_AGENT_CLAUDE_ID, BUILTIN_AGENT_CURSOR_ID } = await import("@agent-dealer/shared");
+const { createIssue, getIssue } = await import("../repository/issues.js");
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const autoMergeDefault = (db) => db.prepare("PRAGMA table_info(issues)").all().find((c) => c.name === "auto_merge").dflt_value;
+const storedAutoMerge = (id) => getDb().prepare("SELECT auto_merge FROM issues WHERE id = ?").get(id).auto_merge;
+function newIssueId(autoMerge) {
+    return createIssue({
+        title: "T",
+        repo: "github.com/acme/app",
+        baseBranch: "main",
+        developerAgentId: BUILTIN_AGENT_CLAUDE_ID,
+        reviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+        maxReviewRounds: 3,
+        maxInfraAttempts: 3,
+        source: "manual",
+        ...(autoMerge === undefined ? {} : { autoMerge }),
+    }).id;
+}
+test("a clean schema defaults auto_merge on", () => {
+    const db = new Database(":memory:");
+    db.exec(fs.readFileSync(path.join(__dirname, "schema.sql"), "utf8"));
+    assert.equal(autoMergeDefault(db), "1");
+});
+test("upgrading preserves every stored auto_merge value; post-upgrade omitted-field creates still get true", () => {
+    migrate();
+    const optedOut = newIssueId(false);
+    const optedIn = newIssueId(true);
+    // An upgraded database whose column predates NOT-489 (still DEFAULT 0).
+    getDb().exec("ALTER TABLE issues DROP COLUMN auto_merge");
+    getDb().exec("ALTER TABLE issues ADD COLUMN auto_merge INTEGER NOT NULL DEFAULT 0");
+    getDb().prepare("UPDATE issues SET auto_merge = 1 WHERE id = ?").run(optedIn);
+    assert.equal(autoMergeDefault(getDb()), "0");
+    migrate();
+    assert.equal(storedAutoMerge(optedOut), 0, "a pre-existing false row is not rewritten");
+    assert.equal(getIssue(optedOut).autoMerge, false);
+    assert.equal(storedAutoMerge(optedIn), 1);
+    const fresh = newIssueId();
+    assert.equal(storedAutoMerge(fresh), 1, "an omitted-field create on the upgraded DB stores true");
+    assert.equal(getIssue(fresh).autoMerge, true);
+});

package/bundle/server/dist/db/index.js

@@ -264,8 +264,10 @@ export function migrate() {
     if (!issueColsForCi.some((c) => c.name === "ci_attempts")) {
         db.exec("ALTER TABLE issues ADD COLUMN ci_attempts INTEGER NOT NULL DEFAULT 0");
     }
-    // NOT-102: per-issue auto-merge after reviewer approve (kick UI defaults on; existing
-    // rows stay off so in-flight workflows keep the human final_review path).
+    // NOT-102: per-issue auto-merge after reviewer approve. Rows that predate the column
+    // backfill off so in-flight workflows keep the human final_review path. NOT-489: new
+    // creates write the shared `CreateIssueInput` default (true) explicitly, so this
+    // backfill DEFAULT never decides a new issue's policy and stays 0 to preserve old rows.
     const issueColsForAutoMerge = db.prepare("PRAGMA table_info(issues)").all();
     if (!issueColsForAutoMerge.some((c) => c.name === "auto_merge")) {
         db.exec("ALTER TABLE issues ADD COLUMN auto_merge INTEGER NOT NULL DEFAULT 0");

package/bundle/server/dist/db/schema.sql

@@ -121,7 +121,7 @@ CREATE TABLE IF NOT EXISTS issues (
   head_sha TEXT,
   pr_number INTEGER,
   pr_url TEXT,
-  auto_merge INTEGER NOT NULL DEFAULT 0,
+  auto_merge INTEGER NOT NULL DEFAULT 1,
   created_at TEXT NOT NULL,
   updated_at TEXT NOT NULL
 );

package/bundle/server/dist/dev-review-cli-happy-path.integration.test.js

@@ -280,6 +280,8 @@ test("agent-operated CLI: discover profiles, create + start a Dev-review issue,
         "Widget renders.",
         "--base-branch",
         "main",
+        // NOT-489: auto-merge is the default; this walk drives the final-review action.
+        "--no-auto-merge",
     ]));
     const issueId = created.id;
     assert.equal(created.status, "ready");