canopycms-cdk 0.0.59 → 0.0.60

package/lambda/asset-transform/dist/handler.js

@@ -4380,7 +4380,7 @@ var init_media = __esm({
 });
 
 // ../canopycms/src/config/schemas/config.ts
-var defaultBranchAccessSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, CanopyConfigSchema;
+var defaultBranchAccessSchema, defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, CanopyConfigSchema;
 var init_config = __esm({
   "../canopycms/src/config/schemas/config.ts"() {
     "use strict";
@@ -4388,7 +4388,13 @@ var init_config = __esm({
     init_collection();
     init_media();
     defaultBranchAccessSchema = external_exports.enum(["allow", "deny"]).default("deny");
-    defaultPathAccessSchema = external_exports.enum(["allow", "deny"]).default("deny");
+    defaultPathAccessLevelSchema = external_exports.enum(["allow", "deny"]);
+    defaultPathAccessLevelsSchema = external_exports.object({
+      read: defaultPathAccessLevelSchema.optional(),
+      edit: defaultPathAccessLevelSchema.optional(),
+      review: defaultPathAccessLevelSchema.optional()
+    }).strict();
+    defaultPathAccessSchema = external_exports.union([defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema]).default("deny");
     defaultBaseBranchSchema = external_exports.string().default("main");
     defaultRemoteNameSchema = external_exports.string().default("origin");
     defaultRemoteUrlSchema = external_exports.string().min(1);
@@ -4421,6 +4427,10 @@ var init_config = __esm({
       // have .default('deny'), so the field is optional on input but always resolves to
       // 'allow'/'deny' (never undefined) on output. An outer .optional() would short-circuit
       // before the inner default runs, defeating the fail-closed default (SCH-M1).
+      // defaultPathAccessSchema's union keeps the same rule: the .default('deny') sits on the
+      // OUTER union, not inside defaultPathAccessLevelsSchema, so an omitted top-level field
+      // still resolves to 'deny' and an omitted level inside the object form stays undefined
+      // (resolved to 'deny' at read time by resolveDefaultPathAccess).
       defaultBranchAccess: defaultBranchAccessSchema,
       defaultPathAccess: defaultPathAccessSchema,
       // .optional() deliberately defeats defaultBaseBranchSchema's .default('main'):
@@ -6727,7 +6737,7 @@ var require_node = __commonJS({
     var tty = require("tty");
     var util2 = require("util");
     exports2.init = init;
-    exports2.log = log9;
+    exports2.log = log10;
     exports2.formatArgs = formatArgs;
     exports2.save = save;
     exports2.load = load;
@@ -6862,7 +6872,7 @@ var require_node = __commonJS({
       }
       return (/* @__PURE__ */ new Date()).toISOString() + " ";
     }
-    function log9(...args) {
+    function log10(...args) {
       return process.stderr.write(util2.formatWithOptions(exports2.inspectOpts, ...args) + "\n");
     }
     function save(namespaces) {
@@ -6916,27 +6926,27 @@ var require_src2 = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     var fs_1 = require("fs");
     var debug_1 = __importDefault(require_src());
-    var log9 = debug_1.default("@kwsites/file-exists");
+    var log10 = debug_1.default("@kwsites/file-exists");
     function check(path3, isFile, isDirectory) {
-      log9(`checking %s`, path3);
+      log10(`checking %s`, path3);
       try {
         const stat = fs_1.statSync(path3);
         if (stat.isFile() && isFile) {
-          log9(`[OK] path represents a file`);
+          log10(`[OK] path represents a file`);
           return true;
         }
         if (stat.isDirectory() && isDirectory) {
-          log9(`[OK] path represents a directory`);
+          log10(`[OK] path represents a directory`);
           return true;
         }
-        log9(`[FAIL] path represents something other than a file or directory`);
+        log10(`[FAIL] path represents something other than a file or directory`);
         return false;
       } catch (e) {
         if (e.code === "ENOENT") {
-          log9(`[FAIL] path is not accessible: %o`, e);
+          log10(`[FAIL] path is not accessible: %o`, e);
           return false;
         }
-        log9(`[FATAL] %o`, e);
+        log10(`[FATAL] %o`, e);
         throw e;
       }
     }
@@ -12528,7 +12538,7 @@ var require_merge2 = __commonJS({
 var require_addPairToJSMap = __commonJS({
   "../../node_modules/.pnpm/yaml@2.8.3/node_modules/yaml/dist/nodes/addPairToJSMap.js"(exports2) {
     "use strict";
-    var log9 = require_log();
+    var log10 = require_log();
     var merge = require_merge2();
     var stringify = require_stringify2();
     var identity = require_identity();
@@ -12577,7 +12587,7 @@ var require_addPairToJSMap = __commonJS({
           let jsonStr = JSON.stringify(strKey);
           if (jsonStr.length > 40)
             jsonStr = jsonStr.substring(0, 36) + '..."';
-          log9.warn(ctx.doc.options.logLevel, `Keys with collection values will be stringified due to JS Object restrictions: ${jsonStr}. Set mapAsMap: true to use object keys.`);
+          log10.warn(ctx.doc.options.logLevel, `Keys with collection values will be stringified due to JS Object restrictions: ${jsonStr}. Set mapAsMap: true to use object keys.`);
           ctx.mapKeyWarned = true;
         }
         return strKey;
@@ -17973,7 +17983,7 @@ var require_public_api = __commonJS({
     var composer = require_composer();
     var Document = require_Document();
     var errors = require_errors();
-    var log9 = require_log();
+    var log10 = require_log();
     var identity = require_identity();
     var lineCounter = require_line_counter();
     var parser4 = require_parser();
@@ -18025,7 +18035,7 @@ var require_public_api = __commonJS({
       const doc = parseDocument(src, options2);
       if (!doc)
         return null;
-      doc.warnings.forEach((warning) => log9.warn(doc.options.logLevel, warning));
+      doc.warnings.forEach((warning) => log10.warn(doc.options.logLevel, warning));
       if (doc.errors.length > 0) {
         if (doc.options.logLevel !== "silent")
           throw doc.errors[0];
@@ -19062,7 +19072,7 @@ var require_dist_node5 = __commonJS({
     }
     function fetchWrapper(requestOptions) {
       var _a3, _b, _c, _d;
-      const log9 = requestOptions.request && requestOptions.request.log ? requestOptions.request.log : console;
+      const log10 = requestOptions.request && requestOptions.request.log ? requestOptions.request.log : console;
       const parseSuccessResponseBody = ((_a3 = requestOptions.request) == null ? void 0 : _a3.parseSuccessResponseBody) !== false;
       if (isPlainObject(requestOptions.body) || Array.isArray(requestOptions.body)) {
         requestOptions.body = JSON.stringify(requestOptions.body);
@@ -19097,7 +19107,7 @@ var require_dist_node5 = __commonJS({
         if ("deprecation" in headers) {
           const matches = headers.link && headers.link.match(/<([^<>]+)>; rel="deprecation"/);
           const deprecationLink = matches && matches.pop();
-          log9.warn(
+          log10.warn(
             `[@octokit/request] "${requestOptions.method} ${requestOptions.url}" is deprecated. It is scheduled to be removed on ${headers.sunset}${deprecationLink ? `. See ${deprecationLink}` : ""}`
           );
         }
@@ -25585,11 +25595,11 @@ function taskCallback(task, response, callback = NOOP) {
   response.then(onSuccess, onError2);
 }
 function addDeprecationNoticeToError(err2) {
-  let log9 = (name) => {
+  let log10 = (name) => {
     console.warn(
       `simple-git deprecation notice: accessing GitResponseError.${name} should be GitResponseError.git.${name}, this will no longer be available in version 3`
     );
-    log9 = NOOP;
+    log10 = NOOP;
   };
   return Object.create(err2, Object.getOwnPropertyNames(err2.git).reduce(descriptorReducer, {}));
   function descriptorReducer(all, name) {
@@ -25600,7 +25610,7 @@ function addDeprecationNoticeToError(err2) {
       enumerable: false,
       configurable: false,
       get() {
-        log9(name);
+        log10(name);
         return err2.git[name];
       }
     };
@@ -29882,9 +29892,12 @@ var permissionPathSchema = external_exports.string().min(1).transform((val, ctx)
   return result.path;
 });
 var PermissionsFileSchema = external_exports.object({
-  version: external_exports.literal(1),
-  contentVersion: external_exports.number().optional(),
-  // For optimistic locking
+  // Managed by writeOccJsonFile (see authorization/settings-file-store.ts) —
+  // the single OCC counter for this file. Optional so a hand-written file
+  // with no version field parses as version 0. A legacy `contentVersion`
+  // field (if present) is silently stripped by this non-strict zod parse.
+  version: external_exports.number().int().nonnegative().optional(),
+  writeId: external_exports.string().optional(),
   updatedAt: external_exports.string().datetime(),
   updatedBy: external_exports.string(),
   pathPermissions: external_exports.array(
@@ -29900,12 +29913,18 @@ var PermissionsFileSchema = external_exports.object({
 // ../canopycms/src/authorization/permissions/loader.ts
 init_operating_mode();
 
+// ../canopycms/src/authorization/settings-file-store.ts
+init_error();
+
 // ../canopycms/src/authorization/groups/schema.ts
 init_zod();
 var GroupsFileSchema = external_exports.object({
-  version: external_exports.literal(1),
-  contentVersion: external_exports.number().optional(),
-  // For optimistic locking
+  // Managed by writeOccJsonFile (see authorization/settings-file-store.ts) —
+  // the single OCC counter for this file. Optional so a hand-written file
+  // with no version field parses as version 0. A legacy `contentVersion`
+  // field (if present) is silently stripped by this non-strict zod parse.
+  version: external_exports.number().int().nonnegative().optional(),
+  writeId: external_exports.string().optional(),
   updatedAt: external_exports.string().datetime(),
   updatedBy: external_exports.string(),
   groups: external_exports.array(
@@ -29952,6 +29971,9 @@ init_error();
 init_id();
 var log8 = createDebugLogger({ prefix: "ContentListing" });
 
+// ../canopycms/src/context.ts
+var log9 = createDebugLogger({ prefix: "Context" });
+
 // ../canopycms/src/server.ts
 init_operating_mode();
 init_schema();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "canopycms-cdk",
-  "version": "0.0.59",
+  "version": "0.0.60",
   "description": "AWS CDK constructs and EC2 worker for CanopyCMS deployment",
   "license": "MIT",
   "repository": {
@@ -53,8 +53,8 @@
     "tsx": "^4.19.0",
     "typescript": "^5.6.3",
     "vitest": "^4.1.0",
-    "canopycms": "0.0.59",
-    "canopycms-auth-clerk": "0.0.59"
+    "canopycms-auth-clerk": "0.0.60",
+    "canopycms": "0.0.60"
   },
   "scripts": {
     "build": "tsc",

package/worker/dist/index.js

@@ -41488,7 +41488,13 @@ var mediaSchema = external_exports.discriminatedUnion("adapter", [
 
 // ../canopycms/src/config/schemas/config.ts
 var defaultBranchAccessSchema = external_exports.enum(["allow", "deny"]).default("deny");
-var defaultPathAccessSchema = external_exports.enum(["allow", "deny"]).default("deny");
+var defaultPathAccessLevelSchema = external_exports.enum(["allow", "deny"]);
+var defaultPathAccessLevelsSchema = external_exports.object({
+  read: defaultPathAccessLevelSchema.optional(),
+  edit: defaultPathAccessLevelSchema.optional(),
+  review: defaultPathAccessLevelSchema.optional()
+}).strict();
+var defaultPathAccessSchema = external_exports.union([defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema]).default("deny");
 var defaultBaseBranchSchema = external_exports.string().default("main");
 var defaultRemoteNameSchema = external_exports.string().default("origin");
 var defaultRemoteUrlSchema = external_exports.string().min(1);
@@ -41521,6 +41527,10 @@ var CanopyConfigSchema = external_exports.object({
   // have .default('deny'), so the field is optional on input but always resolves to
   // 'allow'/'deny' (never undefined) on output. An outer .optional() would short-circuit
   // before the inner default runs, defeating the fail-closed default (SCH-M1).
+  // defaultPathAccessSchema's union keeps the same rule: the .default('deny') sits on the
+  // OUTER union, not inside defaultPathAccessLevelsSchema, so an omitted top-level field
+  // still resolves to 'deny' and an omitted level inside the object form stays undefined
+  // (resolved to 'deny' at read time by resolveDefaultPathAccess).
   defaultBranchAccess: defaultBranchAccessSchema,
   defaultPathAccess: defaultPathAccessSchema,
   // .optional() deliberately defeats defaultBaseBranchSchema's .default('main'):
@@ -41898,6 +41908,14 @@ function isValidContentId(id) {
   return CONTENT_ID_PATTERN.test(id);
 }
 
+// ../canopycms/src/paths/branch.ts
+function sanitizeBranchName(branchName) {
+  const replaced = branchName.replace(/[^a-zA-Z0-9._-]/g, "-");
+  const squashed = replaced.replace(/-+/g, "-");
+  const trimmedDots = squashed.replace(/^\.+/, "").replace(/(?<!\.)\.+$/, "");
+  return trimmedDots || "branch";
+}
+
 // ../canopycms/src/utils/async-mutex.ts
 var locks = /* @__PURE__ */ new Map();
 async function withLock(key, fn) {
@@ -42184,7 +42202,11 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
                 createdBy: existing?.branch.createdBy ?? incoming.branch?.createdBy ?? defaults.createdBy,
                 createdAt: existing?.branch.createdAt ?? defaults.createdAt,
                 // Fork point is recorded once at creation; later saves must not move it
-                baseBranch: existing?.branch.baseBranch ?? incoming.branch?.baseBranch
+                baseBranch: existing?.branch.baseBranch ?? incoming.branch?.baseBranch,
+                // Always stamped fresh — the spreads above would otherwise let
+                // the existing (creation-time) value win forever, freezing the
+                // timestamp the editor's Branches panel sorts and displays by
+                updatedAt: now
               }
             };
             const written = await this.write(merged, version);
@@ -42211,6 +42233,14 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
     await registry2.invalidate();
   }
 };
+function buildMergedBranchUpdate(branchName, now = /* @__PURE__ */ new Date()) {
+  return {
+    name: branchName,
+    status: "archived",
+    pullRequestState: "merged",
+    mergedAt: now.toISOString()
+  };
+}
 var getBranchMetadataFileManager = (branchRoot, baseRoot, options) => {
   return BranchMetadataFileManager.get(branchRoot, baseRoot, options);
 };
@@ -42380,6 +42410,7 @@ var CmsWorker = class {
     this.remoteGitPath = path9.join(config.workspacePath, "remote.git");
     this.contentBranchesPath = path9.join(config.workspacePath, "content-branches");
     this.baseBranch = config.baseBranch ?? "main";
+    this.sanitizedBaseBranch = sanitizeBranchName(this.baseBranch);
     this.maxTasksPerCycle = config.maxTasksPerCycle ?? 10;
     this.taskTimeoutMs = config.taskTimeoutMs ?? DEFAULT_TASK_TIMEOUT;
     this.maxRetries = config.maxRetries ?? DEFAULT_MAX_RETRIES;
@@ -42773,7 +42804,14 @@ var CmsWorker = class {
         syncStatus: "synced"
       };
       if (result.prUrl) updates.pullRequestUrl = result.prUrl;
-      if (result.prNumber) updates.pullRequestNumber = result.prNumber;
+      if (result.prNumber) {
+        updates.pullRequestNumber = result.prNumber;
+        const current = await BranchMetadataFileManager.loadOnly(branchPath);
+        const terminal = current?.branch.status === "archived" || current?.branch.pullRequestState === "merged" || current?.branch.pullRequestState === "closed";
+        if (!terminal) {
+          updates.pullRequestState = "open";
+        }
+      }
       await meta.save({ branch: updates });
     } catch (err) {
       console.error(
@@ -42855,9 +42893,154 @@ var CmsWorker = class {
     await git.raw(["fetch", this.buildGitHubUrl(), "--prune", "+refs/heads/*:refs/heads/*"]);
     console.log("Fetched from GitHub");
     await this.pushSettingsBranches(git);
+    await this.refreshBaseBranchWorkspace();
     await this.rebaseActiveBranches();
     await cleanupOldTasks(this.taskDir, void 0, this.log);
   }
+  /**
+   * Fast-forward the base branch's own working-tree clone
+   * (content-branches/<baseBranch>) to match origin/<baseBranch>.
+   *
+   * Previously this clone was refreshed only incidentally, by the generic
+   * rebase loop below (rebaseActiveBranches): for a branch with status
+   * 'editing', rebasing onto origin/<baseBranch> degenerates to a
+   * fast-forward when the clone IS the base branch. But that loop's skip
+   * paths -- a dirty tree, a missing .git -- are silent, which is the
+   * suspected live failure mode: a wedged base clone with no diagnosable
+   * signal in the logs. This dedicated step makes the refresh explicit,
+   * ff-only, and loud, so a stuck base view (an editor forking a new branch
+   * "from base" that's actually a stale snapshot) is diagnosable from logs.
+   * This runs every sync cycle so the drift window is bounded by
+   * gitSyncInterval.
+   *
+   * ff-only on purpose: this clone must stay a linear mirror of
+   * origin/<baseBranch>, so a merge that isn't a fast-forward (diverged
+   * local history) is treated as a should-never-happen condition and left
+   * untouched rather than force-resolved.
+   */
+  async refreshBaseBranchWorkspace() {
+    const basePath32 = path9.join(this.contentBranchesPath, this.sanitizedBaseBranch);
+    const gitDir = path9.join(basePath32, ".git");
+    try {
+      let gitDirStat;
+      try {
+        gitDirStat = await fs7.stat(gitDir);
+      } catch {
+        gitDirStat = null;
+      }
+      if (!gitDirStat || !gitDirStat.isDirectory()) {
+        console.log(
+          `Base branch workspace (${this.baseBranch}): not yet provisioned, skipping refresh`
+        );
+        return;
+      }
+      const baseGit = simpleGit({
+        baseDir: basePath32,
+        // Keep git non-interactive during the merge so it never blocks on an
+        // editor. simple-git >=3.32 blocks setting core.editor unless
+        // explicitly opted in; the value here is a hardcoded literal
+        // ("true", the shell no-op), not user input, so enabling
+        // allowUnsafeEditor carries no injection risk (same as the rebase
+        // loop's git config below).
+        config: ["core.editor=true"],
+        unsafe: { allowUnsafeEditor: true },
+        // DEP-H1: a hung fetch/merge against this EFS-backed clone would
+        // stall the sync loop forever (scheduleLoop only reschedules after
+        // completion). The block timeout is inactivity-based, so a
+        // slow-but-flowing transfer is unaffected -- same as syncGit()'s
+        // remote handle.
+        timeout: { block: this.taskTimeoutMs }
+      });
+      const status = await baseGit.status();
+      const trackedDirty = status.files.filter((f5) => f5.index !== "?" || f5.working_dir !== "?");
+      if (trackedDirty.length > 0) {
+        console.error(
+          `Base branch workspace (${this.baseBranch}) has uncommitted changes -- skipping refresh. Dirty files: ${trackedDirty.map((f5) => f5.path).join(", ")}`
+        );
+        return;
+      }
+      await baseGit.fetch("origin", this.baseBranch);
+      const behindCount = parseInt(
+        (await baseGit.raw(["rev-list", "--count", `HEAD..origin/${this.baseBranch}`])).trim(),
+        10
+      );
+      if (behindCount > 0) {
+        try {
+          await baseGit.merge(["--ff-only", `origin/${this.baseBranch}`]);
+        } catch (err) {
+          console.error(
+            `Base branch workspace (${this.baseBranch}) failed to fast-forward (diverged local history?): ${getErrorMessage2(err)}`
+          );
+          return;
+        }
+        await invalidateBranchContentCaches(basePath32);
+      }
+      const currentMeta = await BranchMetadataFileManager.loadOnly(basePath32);
+      const conflictStatus = currentMeta?.branch.conflictStatus;
+      const conflictFiles = currentMeta?.branch.conflictFiles;
+      const alreadyClean = (conflictStatus === void 0 || conflictStatus === "clean") && (conflictFiles === void 0 || conflictFiles.length === 0);
+      if (!alreadyClean) {
+        const meta = getBranchMetadataFileManager(basePath32, this.contentBranchesPath);
+        await meta.save({
+          branch: { name: this.baseBranch, conflictStatus: "clean", conflictFiles: [] }
+        });
+      }
+      console.log(
+        behindCount > 0 ? `Base branch workspace (${this.baseBranch}): fast-forwarded ${behindCount} commit(s)` : `Base branch workspace (${this.baseBranch}): up to date`
+      );
+    } catch (err) {
+      console.error(
+        `Base branch workspace (${this.baseBranch}) refresh failed: ${getErrorMessage2(err)}`
+      );
+    }
+  }
+  /**
+   * Poll GitHub for a submitted/approved branch's PR resolution.
+   *
+   * submitted/approved branches sit outside the rebase loop and get no
+   * other signal that their PR resolved on GitHub -- nothing pushes a
+   * merge/close webhook back into the branch workspace. merged ->
+   * auto-archive via buildMergedBranchUpdate (shared with the manual
+   * markAsMerged API so both paths produce identical archived-branch
+   * metadata). closed-without-merge -> record pullRequestState only; an
+   * admin decides the workflow transition from there. Best-effort: any
+   * failure here is logged and swallowed, retried next sync cycle.
+   */
+  async pollMergeState(branchDir, branchPath, metaFile) {
+    const prNumber = metaFile?.branch.pullRequestNumber;
+    if (!prNumber) return;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.taskTimeoutMs);
+    try {
+      const { data: data2 } = await this.octokit.pulls.get({
+        owner: this.config.githubOwner,
+        repo: this.config.githubRepo,
+        pull_number: prNumber,
+        request: { signal: controller.signal }
+      });
+      if (data2.merged) {
+        const meta2 = getBranchMetadataFileManager(branchPath, this.contentBranchesPath);
+        await meta2.save({
+          branch: buildMergedBranchUpdate(
+            branchDir,
+            data2.merged_at ? new Date(data2.merged_at) : void 0
+          )
+        });
+        console.log(`  PR #${prNumber} for ${branchDir} is merged -> archived`);
+        return;
+      }
+      const newState = data2.state === "closed" ? "closed" : "open";
+      const currentMeta = await BranchMetadataFileManager.loadOnly(branchPath);
+      if (currentMeta?.branch.pullRequestState === newState) return;
+      const meta = getBranchMetadataFileManager(branchPath, this.contentBranchesPath);
+      await meta.save({ branch: { name: branchDir, pullRequestState: newState } });
+      console.log(`  PR #${prNumber} for ${branchDir}: pullRequestState -> ${newState}`);
+    } catch (err) {
+      console.warn(`  Failed to poll PR #${prNumber} for ${branchDir}: ${getErrorMessage2(err)}`);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
   async rebaseActiveBranches() {
     let branchDirs;
     try {
@@ -42866,18 +43049,34 @@ var CmsWorker = class {
       return;
     }
     for (const branchDir of branchDirs) {
+      if (branchDir.startsWith(".") || branchDir === "branches.json") {
+        continue;
+      }
       const branchPath = path9.join(this.contentBranchesPath, branchDir);
       const gitDir = path9.join(branchPath, ".git");
       try {
         const stat = await fs7.stat(gitDir);
-        if (!stat.isDirectory()) continue;
+        if (!stat.isDirectory()) {
+          console.log(`  Skipping ${branchDir}: .git is not a directory`);
+          continue;
+        }
       } catch {
+        console.log(`  Skipping ${branchDir}: no .git directory (not a branch workspace)`);
+        continue;
+      }
+      if (branchDir === this.sanitizedBaseBranch) {
+        console.log(`  Skipping ${branchDir}: base branch (refreshed separately)`);
         continue;
       }
       try {
         const metaFile = await BranchMetadataFileManager.loadOnly(branchPath);
         const branchStatus2 = metaFile?.branch.status;
-        if (branchStatus2 === "submitted" || branchStatus2 === "approved" || branchStatus2 === "archived") {
+        if (branchStatus2 === "submitted" || branchStatus2 === "approved") {
+          console.log(`  Skipping ${branchDir} (${branchStatus2})`);
+          await this.pollMergeState(branchDir, branchPath, metaFile);
+          continue;
+        }
+        if (branchStatus2 === "archived") {
           console.log(`  Skipping ${branchDir} (${branchStatus2})`);
           continue;
         }