forgedock 1.29.0 → 1.30.0

package/bin/lean/prefilter.mjs

@@ -4,7 +4,9 @@
  * Already-fixed pre-filter (#4123): cheap checks before any lane starts, so an issue that a merged PR or a later green
  * CI run already resolved does not cost a worktree, a lease and a builder session.
  *   1. merged PRs (and lane commits) that claim to fix #N  -> candidate
- *   2. auto-filed CI-failure issue whose workflow is green again on the failing branch -> closed with the run link
+ *   2. auto-filed CI-failure issue whose workflow is green again on the failing branch -> closed with the run link,
+ *      unless it is flaky (#4305): flaky wording or label, a reopen after an earlier pre-filter close, or a failed run
+ *      of the workflow at the green run's SHA. Then the shortcut is skipped and the issue goes on as normal.
  *   3. every repo path the issue names is gone from origin/<lane> -> candidate
  * A candidate gets ONE read-only, single-turn validation on a small model in the main checkout (no worktree). Only an
  * ALREADY-FIXED/INVALID verdict with evidence closes the issue; everything else, and every error, goes to the normal lane.
@@ -12,6 +14,8 @@
  */
 import { capComment, sanitizeMd, noComments } from "./render.mjs";
 import { PREFILTER_SYSTEM, prefilterPrompt, parsePrefilterVerdict } from "./prompts.mjs";
+import { isTrustedComment } from "../engine/phases.mjs";
+import { APP_SLUG } from "../init-repo.mjs";
 
 export const DEFAULT_PREFILTER_MODEL = "claude-haiku-5-5";
 export const PREFILTER_MARKER = "FORGE:PREFILTER";
@@ -35,6 +39,51 @@ export function ciFailureRun(iss) {
   return m && CI_FAIL_RE.test(text) ? { repo: m[1], id: Number(m[2]) } : null;
 }
 
+// #4316: a bare "sometimes" is ordinary prose; only "fails sometimes" / "sometimes fails" says the failure is intermittent
+const FLAKY_RE = /\b(?:intermittent\w*|flaky|flak(?:e|es|iness)|fail(?:s|ed|ing)?\s+sometimes|sometimes\s+fail(?:s|ed|ing)?|non-?deterministic\w*)\b/i;
+const loginOf = (c) => String(c?.author?.login ?? c?.user?.login ?? "");
+const trusted = (c) => {
+  const login = loginOf(c);
+  return isTrustedComment({ author_association: c?.authorAssociation ?? c?.author_association, user: { login, type: c?.user?.type ?? (/\[bot\]$|^app\//.test(login) ? "Bot" : "User") } });
+};
+/** #4315: a login compared as the engine posts it: lowercased, without `app/` or a `[bot]` suffix (`gh issue view` drops both). */
+const bareLogin = (l) => String(l ?? "").trim().toLowerCase().replace(/^app\//, "").replace(/\[bot\]$/, "");
+const isMarked = (c) => String(c?.body ?? "").trimStart().startsWith(`<!-- ${PREFILTER_MARKER} -->`);
+/**
+ * #4315: the logins the engine posts as: the ForgeDock App (`gh issue view` reports it as `rapiercraft-forgedock` with
+ * CONTRIBUTOR, never `[bot]`) plus the token's own user (`gh api user`; an App installation token cannot read it).
+ */
+export async function ownLogins(gh) {
+  return (await resolveOwnLogins(gh)).logins;
+}
+/**
+ * #4318: {logins, resolved}. When `gh api user` fails (an App installation token), the App's own slug from `gh api app`
+ * (a differently named App); `resolved` is false when neither lookup answered, so the batch memo may ask once more.
+ */
+export async function resolveOwnLogins(gh) {
+  const out = new Set([bareLogin(APP_SLUG)]);
+  let resolved = false;
+  try { const me = bareLogin(await gh(["api", "user", "--jq", ".login"])); if (me) { out.add(me); resolved = true; } } catch { /* installation token */ }
+  if (!resolved) {
+    try { const slug = bareLogin(await gh(["api", "app", "--jq", ".slug"])); if (slug) { out.add(slug); resolved = true; } } catch { /* the App slug only */ }
+  }
+  return { logins: [...out], resolved };
+}
+/**
+ * #4305: why one green run is no proof for this issue, without an API call: flaky wording or a `flaky` label, or an
+ * earlier pre-filter close by the pipeline (the issue is open again, so an operator reopened it). {reason, why} or null.
+ * #4315: a marker comment is the pipeline's own when it is trusted or written by one of `own` (bare logins).
+ */
+export function flakyReason(iss, own = [bareLogin(APP_SLUG)]) {
+  if (FLAKY_RE.test(`${iss.title ?? ""}\n${noComments(String(iss.body ?? ""), " ")}`)) return { reason: "flaky", why: "issue says the failure is intermittent" };
+  if ((iss.labels ?? []).some((l) => String(l?.name ?? l).toLowerCase() === "flaky")) return { reason: "flaky", why: "flaky label" };
+  const mine = new Set((own ?? []).map(bareLogin));
+  if ((iss.comments ?? []).some((c) => isMarked(c) && (trusted(c) || mine.has(bareLogin(loginOf(c)))))) return { reason: "reopened", why: "reopened after a pre-filter close" };
+  return null;
+}
+/** The own logins, looked up only when an otherwise-untrusted marker comment needs them (no call for most issues). */
+const ownFor = async (iss, resolve) => ((iss.comments ?? []).some((c) => isMarked(c) && !trusted(c)) ? resolve() : undefined);
+
 const PATH_RE = /(?:^|[\s`'"(\[])((?:\.{0,2}\/)?(?:[\w@.-]+\/)+[\w@.-]+\.[A-Za-z0-9]{1,8})(?::\d+(?:-\d+)?)?(?=$|[\s`'"),.:;\]])/gm;
 /** Repo-relative file paths the issue names (`dir/file.ext`, optionally `:line`); URLs and HTML comments are ignored. */
 export function namedPaths(text) {
@@ -43,9 +92,9 @@ export function namedPaths(text) {
 }
 
 /**
- * @returns {Promise<{prs:object[], commits:object[], ci:?object, missingPaths:string[], namedPaths:string[]}>}
+ * @returns {Promise<{prs:object[], commits:object[], ci:?object, ciSkip?:{reason:string, why:string}, missingPaths:string[], namedPaths:string[]}>}
  */
-export async function collectSignals({ iss, repo, lane, io, cwd }) {
+export async function collectSignals({ iss, repo, lane, io, cwd, selfLogins = null }) {
   const n = iss.number;
   const sig = { prs: [], commits: [], ci: null, missingPaths: [], namedPaths: [] };
   try {
@@ -63,7 +112,19 @@ export async function collectSignals({ iss, repo, lane, io, cwd }) {
       const branch = failed.head_branch || lane;
       const latest = JSON.parse(String(await io.gh(["api", `repos/${repo}/actions/workflows/${failed.workflow_id}/runs?branch=${encodeURIComponent(branch)}&status=completed&per_page=1`])))?.workflow_runs?.[0];
       if (latest && latest.id !== failed.id && latest.conclusion === "success" && Date.parse(latest.created_at) > Date.parse(failed.created_at)) {
-        sig.ci = { workflow: failed.name ?? latest.name ?? String(failed.workflow_id), branch, failedUrl: failed.html_url, greenUrl: latest.html_url, greenSha: latest.head_sha ?? "" };
+        const sha = latest.head_sha ?? "";
+        // #4305: a workflow that failed and passed at the same SHA is flaky; the lookup is any branch (PR run vs push)
+        // and only made when the issue itself gave no reason. An unreadable lookup throws: no CI signal.
+        const own = await ownFor(iss, typeof selfLogins === "function" ? selfLogins : selfLogins ? async () => selfLogins : () => ownLogins(io.gh));
+        let skip = flakyReason(iss, own);
+        const same = { reason: "same-sha", why: `failed and passed at ${sha.slice(0, 12)}` };
+        if (!skip && sha && failed.head_sha === sha) skip = same;
+        if (!skip && sha) {
+          const atSha = JSON.parse(String(await io.gh(["api", `repos/${repo}/actions/workflows/${failed.workflow_id}/runs?head_sha=${sha}&status=completed&per_page=100`])))?.workflow_runs ?? [];
+          if (atSha.some((r) => r?.conclusion === "failure")) skip = same;
+        }
+        if (skip) sig.ciSkip = skip;
+        else sig.ci = { workflow: failed.name ?? latest.name ?? String(failed.workflow_id), branch, failedUrl: failed.html_url, greenUrl: latest.html_url, greenSha: sha };
       }
     } catch { /* run unreadable: no CI signal */ }
   }
@@ -82,10 +143,10 @@ export async function collectSignals({ iss, repo, lane, io, cwd }) {
  * Pre-filter one issue. Never throws.
  * @returns {Promise<{issue:number, closed:boolean, kind:?string, candidate:boolean, verdict:?string, cost_usd:number, detail:string}>}
  */
-export async function prefilterIssue({ issue, repo, lane, cwd, io, model = DEFAULT_PREFILTER_MODEL, dryRun = false, agentId = null, maxMinutes = 5 }) {
+export async function prefilterIssue({ issue, repo, lane, cwd, io, model = DEFAULT_PREFILTER_MODEL, dryRun = false, agentId = null, maxMinutes = 5, selfLogins = null }) {
   const out = { issue, closed: false, kind: null, candidate: false, verdict: null, cost_usd: 0, detail: "" };
   try {
-    const iss = JSON.parse(String(await io.gh(["issue", "view", String(issue), "-R", repo, "--json", "number,title,body,state,labels"])));
+    const iss = JSON.parse(String(await io.gh(["issue", "view", String(issue), "-R", repo, "--json", "number,title,body,state,labels,comments"])));
     if (String(iss.state).toUpperCase() !== "OPEN") return { ...out, detail: "not open" };
     if ((iss.labels ?? []).some((l) => ["needs-human", "workflow:merged"].includes(l?.name ?? l))) return { ...out, detail: "labelled, left to the lane" };
     if (io.projector) {
@@ -93,35 +154,48 @@ export async function prefilterIssue({ issue, repo, lane, cwd, io, model = DEFAU
       try { st = await io.projector.readState(issue); } catch { /* unreadable: proceed */ }
       if (st?.lease && st.lease.until > Date.now() && st.lease.by !== agentId) return { ...out, detail: `leased by ${st.lease.by}` };
     }
-    const sig = await collectSignals({ iss, repo, lane, io, cwd });
+    const sig = await collectSignals({ iss, repo, lane, io, cwd, selfLogins });
     const close = async (kind, body, detail) => {
+      let note = "";
       if (!dryRun) {
-        await io.gh(["issue", "comment", String(issue), "-R", repo, "--body", capComment(`<!-- ${PREFILTER_MARKER} -->\n<!-- FORGE:VALIDATE -->\n${body}`)]);
+        // #4315: close first: the marker is posted only on an issue that was closed, so it always means "reopened" later
         await io.gh(["issue", "close", String(issue), "-R", repo, "--reason", "not planned"]);
+        // #4314: the issue IS closed from here on: the result is closed:true whatever the comment does, so no lane starts on it.
+        // The comment is retried once, then a marker-only comment (a second, tiny payload) keeps the #4305 reopen guard working.
+        const comment = (text) => io.gh(["issue", "comment", String(issue), "-R", repo, "--body", text]);
+        const full = capComment(`<!-- ${PREFILTER_MARKER} -->\n<!-- FORGE:VALIDATE -->\n${body}`);
+        const minimal = `<!-- ${PREFILTER_MARKER} -->\nClosed by the pre-filter (${kind}); the explanation comment could not be posted. Reopen if this is wrong.`;
+        let posted = false;
+        for (const text of [full, full, minimal]) {
+          try { await comment(text); posted = true; break; } catch { /* next attempt */ }
+        }
+        if (!posted) note = " (closed, but no marker comment could be posted: a reopen is not recognised)";
         try { await io.transitionLabel?.(issue, "invalid"); } catch { /* labels are best effort */ }
       }
-      return { ...out, closed: !dryRun, kind, detail };
+      return { ...out, closed: !dryRun, kind, detail: `${detail}${note}` };
     };
 
+    // #4305: a skipped CI-green shortcut is named in every non-closing detail line that follows (#4316: with its reason).
+    const keep = (detail) => ({ ...out, detail: sig.ciSkip ? `skipped CI-green shortcut: ${sig.ciSkip.reason} (${sig.ciSkip.why}); ${detail}` : detail });
     if (sig.ci) {
       out.candidate = true;
       const c = sig.ci;
       return await close("ci-green", `## Pre-filter: CI failure no longer reproduces\n**Workflow:** ${c.workflow} on \`${c.branch}\`\n**Failing run:** ${c.failedUrl}\n**Latest run (green):** ${c.greenUrl}${c.greenSha ? ` at \`${c.greenSha.slice(0, 12)}\`` : ""}\n\nClosed without a lane. Reopen if the failure comes back.`,
         `CI green again: ${c.greenUrl}`);
     }
-    if (!sig.prs.length && !sig.commits.length && !sig.missingPaths.length) return { ...out, detail: "no already-fixed signal" };
+    if (!sig.prs.length && !sig.commits.length && !sig.missingPaths.length) return keep("no already-fixed signal");
     out.candidate = true;
     const why = [...sig.prs.map((p) => `PR #${p.number}`), ...sig.commits.map((c) => c.sha.slice(0, 12)), ...(sig.missingPaths.length ? ["named paths missing"] : [])].join(", ");
-    if (dryRun) return { ...out, detail: `candidate: ${why}` };
+    if (dryRun) return keep(`candidate: ${why}`);
     let r;
     try {
       r = await io.runner({ role: "prefilter", issue, cwd, model, resume: null, system: PREFILTER_SYSTEM, readOnly: true,
         prompt: prefilterPrompt({ issue: iss, lane, signals: sig }), maxMs: Math.round(maxMinutes * 60000) });
-    } catch (e) { return { ...out, detail: `validation failed (${String(e?.message ?? e).slice(0, 120)}): lane` }; }
+    } catch (e) { return keep(`validation failed (${String(e?.message ?? e).slice(0, 120)}): lane`); }
     out.cost_usd = Number.isFinite(r?.costUsd) ? r.costUsd : 0;
     const v = parsePrefilterVerdict(r?.text);
     out.verdict = v?.verdict ?? null;
-    if (!v || v.verdict === "CONFIRMED" || !v.evidence.length) return { ...out, detail: `candidate (${why}) ${v ? (v.verdict === "CONFIRMED" ? "confirmed" : "without evidence") : "unparseable verdict"}: lane` };
+    if (!v || v.verdict === "CONFIRMED" || !v.evidence.length) return keep(`candidate (${why}) ${v ? (v.verdict === "CONFIRMED" ? "confirmed" : "without evidence") : "unparseable verdict"}: lane`);
     const ev = v.evidence.map((x) => `- ${sanitizeMd(x).replace(/\s+/g, " ").slice(0, 400)}`).join("\n");
     return await close("validated", `## Pre-filter: ${v.verdict}\n**Signal:** ${why}\n**Summary:** ${sanitizeMd(v.summary).replace(/\s+/g, " ").slice(0, 600) || "not reported"}\n\n**Evidence:**\n${ev}\n\nValidated by a single read-only check (${model}), without a lane. Reopen if this is wrong.`,
       `${v.verdict.toLowerCase()} (${why})`);
@@ -132,7 +206,15 @@ export async function prefilterIssue({ issue, repo, lane, cwd, io, model = DEFAU
 
 /** Per-issue hook for `orchestrate({ prefilter })`; `lane` is the issue's own resolved lane (#4125). */
 export function makePrefilter(opts) {
-  return (issue, lane) => prefilterIssue({ ...opts, issue, ...(lane ? { lane } : {}) });
+  // #4315: one identity lookup per batch, and only when a marker comment needs it; #4318: an unresolved one is retried once
+  let own = null, tries = 0;
+  const selfLogins = opts.selfLogins ?? (() => (own ??= (async () => {
+    tries++;
+    const r = await resolveOwnLogins(opts.io.gh);
+    if (!r.resolved && tries < 2) own = null;
+    return r.logins;
+  })()));
+  return (issue, lane) => prefilterIssue({ ...opts, selfLogins, issue, ...(lane ? { lane } : {}) });
 }
 
 /** One report line: how many the pre-filter checked, flagged and closed, what validation cost, and the spend avoided. */

package/bin/lean/prefilter.test.mjs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
-import { prefilterIssue, makePrefilter, formatPrefilterSummary, claimsFix, ciFailureRun, namedPaths, DEFAULT_PREFILTER_MODEL } from "./prefilter.mjs";
+import { prefilterIssue, flakyReason, makePrefilter, ownLogins, resolveOwnLogins, formatPrefilterSummary, claimsFix, ciFailureRun, namedPaths, DEFAULT_PREFILTER_MODEL } from "./prefilter.mjs";
 import { parsePrefilterVerdict, prefilterPrompt } from "./prompts.mjs";
 import { orchestrate, formatTable } from "./orchestrate.mjs";
 import { triageFromCli } from "../engine-cli.mjs";
@@ -12,7 +12,7 @@ const fence = (o) => "```json\n" + JSON.stringify(o) + "\n```";
 /** Fake GitHub + git for one repo `o/r`, lane `staging`. */
 function world(o = {}) {
   const w = { comments: [], closed: [], labels: [], runner: [], lanes: [], gitCalls: [],
-    issues: o.issues ?? {}, prs: o.prs ?? [], commits: o.commits ?? "", paths: new Set(o.paths ?? []), runs: o.runs ?? {}, workflowRuns: o.workflowRuns ?? {},
+    issues: o.issues ?? {}, prs: o.prs ?? [], commits: o.commits ?? "", paths: new Set(o.paths ?? []), runs: o.runs ?? {}, workflowRuns: o.workflowRuns ?? {}, shaRuns: o.shaRuns ?? {},
     verdict: o.verdict ?? null };
   w.io = {
     gh: async (a) => {
@@ -25,6 +25,8 @@ function world(o = {}) {
         if (m) return JSON.stringify(w.runs[m[1]]);
         const wf = /actions\/workflows\/(\d+)\/runs\?branch=([^&]+)/.exec(a[1]);
         if (wf) return JSON.stringify({ workflow_runs: w.workflowRuns[`${wf[1]}:${decodeURIComponent(wf[2])}`] ?? [] });
+        const at = /actions\/workflows\/\d+\/runs\?head_sha=([^&]+)/.exec(a[1]);
+        if (at) { w.shaQueries = (w.shaQueries ?? 0) + 1; return JSON.stringify({ workflow_runs: w.shaRuns[at[1]] ?? [] }); }
       }
       if (k === "issue comment") { w.comments.push([Number(a[2]), a[a.indexOf("--body") + 1]]); return ""; }
       if (k === "issue close") { w.closed.push([Number(a[2]), a[a.indexOf("--reason") + 1]]); return ""; }
@@ -100,6 +102,90 @@ describe("pre-filter (#4123)", () => {
     assert.deepEqual(w.closed, [[34, "not planned"]]);
   });
 
+  it("#4305 the CI-green shortcut is skipped for intermittent, reopened and same-SHA-flaky CI failures", async () => {
+    const link = "Run: https://github.com/o/r/actions/runs/500";
+    const green = (issue, extra = {}) => world({ issues: { 34: { title: "shell-compat failed on staging", body: `Workflow failed.\n${link}`, ...issue } },
+      runs: { 500: { id: 500, workflow_id: 7, name: "shell-compat", head_branch: "staging", head_sha: "1111111111111111", created_at: "2026-10-10T00:00:00Z", html_url: "https://github.com/o/r/actions/runs/500" } },
+      workflowRuns: { "7:staging": [{ id: 600, conclusion: "success", created_at: "2026-10-12T00:00:00Z", html_url: "https://github.com/o/r/actions/runs/600", head_sha: "8d9f6ba0aaaaaaaa" }] }, ...extra });
+    const bot = { author: { login: "rapiercraft-forgedock[bot]" }, authorAssociation: "NONE", body: "<!-- FORGE:PREFILTER -->\n<!-- FORGE:VALIDATE -->\n## Pre-filter: CI failure no longer reproduces" };
+    const stranger = { author: { login: "someone" }, authorAssociation: "NONE", body: bot.body };
+    const cases = [
+      ["intermittent wording", green({ body: `\`a.test.sh\` fails intermittently on macOS.\n${link}` }), /issue says the failure is intermittent/, "flaky"],
+      ["flaky label", green({ labels: [{ name: "flaky" }] }), /flaky label/, "flaky"],
+      ["reopened after a pre-filter close", green({ comments: [bot] }), /reopened after a pre-filter close/, "reopened"],
+      ["failed and passed at the same SHA", green({}, { shaRuns: { "8d9f6ba0aaaaaaaa": [{ id: 601, conclusion: "failure" }, { id: 600, conclusion: "success" }] } }), /failed and passed at 8d9f6ba0aaaa/, "same-sha"],
+    ];
+    for (const [name, w, why, reason] of cases) {
+      const r = await pf(w, 34);
+      assert.equal(r.closed, false, name); assert.notEqual(r.kind, "ci-green", name);
+      assert.deepEqual(w.closed, [], name); assert.deepEqual(w.comments, [], name); assert.equal(w.runner.length, 0, name);
+      assert.ok(r.detail.startsWith(`skipped CI-green shortcut: ${reason} (`), `${name}: ${r.detail}`); assert.match(r.detail, why, name);
+      assert.match(r.detail, /no already-fixed signal$/, name);
+    }
+    // wording and the reopen marker need no runs lookup; an untrusted marker comment is no reopen, and a green-only SHA still closes
+    const quiet = green({ body: `fails intermittently ${link}` });
+    await pf(quiet, 34); assert.equal(quiet.shaQueries ?? 0, 0);
+    const forged = green({ comments: [stranger] }, { shaRuns: { "8d9f6ba0aaaaaaaa": [{ id: 600, conclusion: "success" }] } });
+    const r = await pf(forged, 34);
+    assert.equal(r.kind, "ci-green"); assert.equal(forged.shaQueries, 1);
+    // an unreadable same-SHA lookup is no proof either: no shortcut
+    const down = green();
+    const gh0 = down.io.gh; down.io.gh = async (a) => (/head_sha=/.test(a[1] ?? "") ? (() => { throw new Error("HTTP 502"); })() : gh0(a));
+    assert.equal((await pf(down, 34)).closed, false);
+  });
+
+  it("#4316 a bare \"sometimes\" is prose, not flaky wording; \"fails sometimes\" and \"sometimes fails\" are", () => {
+    assert.equal(flakyReason({ title: "deploy check failed", body: "This sometimes happens after a deploy." }), null);
+    assert.equal(flakyReason({ title: "x", body: "Sometimes we rerun it by hand." }), null);
+    for (const body of ["the job fails sometimes on macOS", "it sometimes fails on macOS", "shell-compat failed sometimes", "intermittent timeout", "a flaky test"]) {
+      assert.equal(flakyReason({ title: "ci failed", body })?.reason, "flaky", body);
+    }
+  });
+  it("#4315 a comment shaped like #4235's real pre-filter comment is the pipeline's own: a reopened CI-failure issue is kept for a lane", async () => {
+    const link = "Run: https://github.com/o/r/actions/runs/500";
+    const green = (issue, extra = {}) => world({ issues: { 34: { title: "shell-compat failed on staging", body: `Workflow failed.\n${link}`, ...issue } },
+      runs: { 500: { id: 500, workflow_id: 7, name: "shell-compat", head_branch: "staging", head_sha: "1111111111111111", created_at: "2026-10-10T00:00:00Z", html_url: "https://github.com/o/r/actions/runs/500" } },
+      workflowRuns: { "7:staging": [{ id: 600, conclusion: "success", created_at: "2026-10-12T00:00:00Z", html_url: "https://github.com/o/r/actions/runs/600", head_sha: "8d9f6ba0aaaaaaaa" }] },
+      shaRuns: { "8d9f6ba0aaaaaaaa": [{ id: 600, conclusion: "success" }] }, ...extra });
+    // the shape `gh issue view --json comments` returns for the ForgeDock App on #4235: no `[bot]`, CONTRIBUTOR, marker first
+    const body = "<!-- FORGE:PREFILTER -->\n<!-- FORGE:VALIDATE -->\n## Pre-filter: CI failure no longer reproduces\n**Workflow:** shell-compat on `staging`";
+    const real = { author: { login: "rapiercraft-forgedock" }, authorAssociation: "CONTRIBUTOR", body };
+    const w = green({ comments: [real] });
+    const r = await pf(w, 34);
+    assert.equal(r.closed, false); assert.notEqual(r.kind, "ci-green");
+    assert.match(r.detail, /reopened after a pre-filter close/);
+    assert.deepEqual(w.closed, []); assert.deepEqual(w.comments, []);
+    // the token's own user (`gh api user`) counts too, cached once per makePrefilter batch; a CONTRIBUTOR stranger does not
+    const mine = green({ comments: [{ ...real, author: { login: "Op-User" } }] });
+    let userCalls = 0; const gh0 = mine.io.gh;
+    mine.io.gh = async (a) => (a[0] === "api" && a[1] === "user" ? (userCalls++, "op-user\n") : gh0(a));
+    const run = makePrefilter({ repo: "o/r", cwd: "/repo", io: mine.io });
+    assert.match((await run(34, "staging")).detail, /reopened after a pre-filter close/);
+    await run(34, "staging"); assert.equal(userCalls, 1);
+    const stranger = green({ comments: [{ ...real, author: { login: "someone" } }] });
+    assert.equal((await pf(stranger, 34)).kind, "ci-green");
+    // BUG-4: the marker is posted only after a successful close; a failed close posts no marker
+    const order = [];
+    const ok = green(); const g2 = ok.io.gh;
+    ok.io.gh = async (a) => { if (["issue close", "issue comment"].includes(a.slice(0, 2).join(" "))) order.push(a[1]); return g2(a); };
+    assert.equal((await pf(ok, 34)).closed, true); assert.deepEqual(order, ["close", "comment"]);
+    const fails = green(); const g3 = fails.io.gh;
+    fails.io.gh = async (a) => (a.slice(0, 2).join(" ") === "issue close" ? (() => { throw new Error("HTTP 403"); })() : g3(a));
+    const f = await pf(fails, 34);
+    assert.equal(f.closed, false); assert.deepEqual(fails.comments, []); assert.match(f.detail, /pre-filter error/);
+    // #4314: a failing comment after a successful close still counts as closed (no lane), via retry, then a marker-only comment
+    const flaky = (n, big) => { const x = green(); const g = x.io.gh; let calls = 0;
+      x.io.gh = async (a) => { if (a.slice(0, 2).join(" ") === "issue comment") { calls++; if (calls <= n || (big && a[a.indexOf("--body") + 1].includes("## Pre-filter"))) throw new Error("HTTP 502"); } return g(a); };
+      return x; };
+    const once = flaky(1); const r1 = await pf(once, 34);
+    assert.equal(r1.closed, true); assert.equal(once.comments.length, 1); assert.doesNotMatch(r1.detail, /no marker/);
+    const tiny = flaky(0, true); const r2 = await pf(tiny, 34);
+    assert.equal(r2.closed, true); assert.equal(tiny.comments.length, 1); assert.match(tiny.comments[0][1], /^<!-- FORGE:PREFILTER -->/);
+    assert.match(flakyReason({ comments: [{ body: tiny.comments[0][1], author: { login: "forgedock-app[bot]" }, authorAssociation: "NONE" }] }, ["forgedock-app"])?.reason ?? "", /reopened/);
+    const dead = flaky(99); const r3 = await pf(dead, 34);
+    assert.equal(r3.closed, true); assert.equal(dead.runner.length, 0); assert.deepEqual(dead.closed, [[34, "not planned"]]); assert.match(r3.detail, /no marker comment/);
+  });
+
   it("a CI-failure issue whose workflow is still red (or whose latest run is the failing one) goes to a lane", async () => {
     const base = { issues: { 34: { title: "ci failed", body: "https://github.com/o/r/actions/runs/500" } },
       runs: { 500: { id: 500, workflow_id: 7, head_branch: "staging", created_at: "2026-10-10T00:00:00Z" } } };
@@ -229,3 +315,26 @@ describe("orchestrate with the pre-filter (#4123)", () => {
     assert.ok(logs.some((s) => /^#12 → lane-refused \(lane\.default_branch/.test(s)));
   });
 });
+
+describe("#4318: the engine's own identity under an installation token or a differently named App", () => {
+  it("ownLogins falls back to the App slug from `gh api app` when `gh api user` fails", async () => {
+    const gh = async (a) => { if (a[1] === "user") throw new Error("Resource not accessible by integration"); if (a[1] === "app") return "Other-Forge\n"; return ""; };
+    assert.deepEqual((await resolveOwnLogins(gh)), { logins: ["rapiercraft-forgedock", "other-forge"], resolved: true });
+    assert.deepEqual(await ownLogins(gh), ["rapiercraft-forgedock", "other-forge"]);
+    const both = async () => { throw new Error("401"); };
+    assert.deepEqual(await resolveOwnLogins(both), { logins: ["rapiercraft-forgedock"], resolved: false });
+  });
+  it("an unresolved lookup is retried once in the batch, then the App-slug-only set is kept", async () => {
+    const link = "Run: https://github.com/o/r/actions/runs/500";
+    const real = { author: { login: "Other-Forge" }, authorAssociation: "CONTRIBUTOR", body: "<!-- FORGE:PREFILTER -->\n## Pre-filter" };
+    const w = world({ issues: { 34: { title: "shell-compat failed on staging", body: `Workflow failed.\n${link}`, comments: [real] } },
+      runs: { 500: { id: 500, workflow_id: 7, name: "shell-compat", head_branch: "staging", head_sha: "1111111111111111", created_at: "2026-10-10T00:00:00Z", html_url: "https://github.com/o/r/actions/runs/500" } },
+      workflowRuns: { "7:staging": [{ id: 600, conclusion: "success", created_at: "2026-10-12T00:00:00Z", html_url: "https://github.com/o/r/actions/runs/600", head_sha: "8d9f6ba0aaaaaaaa" }] },
+      shaRuns: { "8d9f6ba0aaaaaaaa": [{ id: 600, conclusion: "success" }] } });
+    let lookups = 0; const g0 = w.io.gh;
+    w.io.gh = async (a) => (a[0] === "api" && (a[1] === "user" || a[1] === "app") ? (lookups++, (() => { throw new Error("401"); })()) : g0(a));
+    const run = makePrefilter({ repo: "o/r", cwd: "/repo", io: w.io });
+    await run(34, "staging"); await run(34, "staging"); await run(34, "staging");
+    assert.equal(lookups, 4, "user + app, twice: one retry, then cached");
+  });
+});

package/bin/lean/preflight.mjs

@@ -0,0 +1,133 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+/**
+ * forge#4328: freeze-time preflight of a contract's validate commands. Pure: derives the host tools a command needs
+ * (each segment's bare executable, Python modules a bare python imports via -c/-m, Node packages `node -e` code imports)
+ * and a read-only bash probe for each. The engine runs the probes (lean.mjs) before the implement session, so a validate
+ * command the host cannot run is corrected in the plan instead of found after the build (#4323 env.tool_missing).
+ */
+import { builtinModules } from "node:module";
+
+export const PREFLIGHT_CAP = 20;
+const KIND_NAME = { command: "command", "python-module": "Python module", "node-module": "Node package" };
+const PY_RE = /^python(\d+(\.\d+)?)?$/;
+const PY_ARG_FLAGS = new Set(["-W", "-X", "-Q"]);
+const sq = (s) => `'${String(s).replace(/'/g, `'\\''`)}'`;
+
+/** Quote-aware split of a bash command into segments (on &&, ||, |, ;, newline) of unquoted words; `$(...)` stays one word. */
+export function shellSegments(command) {
+  const segs = [];
+  let words = [], word = "", has = false, q = null, depth = 0;
+  const endWord = () => { if (has) words.push(word); word = ""; has = false; };
+  const endSeg = () => { endWord(); if (words.length) segs.push(words); words = []; };
+  const s = String(command ?? "");
+  for (let i = 0; i < s.length; i++) {
+    const ch = s[i];
+    if (q === "'") { if (ch === "'") q = null; else word += ch; continue; }
+    if (ch === "\\" && i + 1 < s.length) { word += s[++i]; has = true; continue; }
+    if (q === '"') { if (ch === '"') q = null; else word += ch; continue; }
+    if (depth) { word += ch; if (ch === "(") depth++; else if (ch === ")") depth--; continue; }
+    if (ch === "'" || ch === '"') { q = ch; has = true; continue; }
+    if (ch === "$" && s[i + 1] === "(") { word += "$("; i++; depth = 1; has = true; continue; }
+    if (ch === " " || ch === "\t") { endWord(); continue; }
+    if (ch === "\n" || ch === ";" || ch === "|" || ch === "&") { if (ch === "&" && s[i + 1] !== "&") { endWord(); continue; } endSeg(); if (s[i + 1] === ch) i++; continue; }
+    if ((ch === "(" || ch === ")" || ch === "{" || ch === "}") && !has) continue;
+    word += ch; has = true;
+  }
+  endSeg();
+  return segs;
+}
+
+/** Top-level module names a Python `-c` program imports (absolute imports only). */
+export function pythonImports(code) {
+  const out = [];
+  for (const line of String(code ?? "").split(/[;\n]/)) {
+    const imp = /^\s*import\s+(.+)$/.exec(line), from = /^\s*from\s+([\w.]+)\s+import\b/.exec(line);
+    if (imp) for (const part of imp[1].split(",")) { const m = /^\s*([A-Za-z_]\w*)/.exec(part); if (m) out.push(m[1]); }
+    else if (from && !from[1].startsWith(".")) out.push(from[1].split(".")[0]);
+  }
+  for (const m of String(code ?? "").matchAll(/(?:__import__|import_module)\(\s*['"]([A-Za-z_][\w.]*)['"]/g)) out.push(m[1].split(".")[0]);
+  return [...new Set(out)].filter((x) => x !== "__future__");
+}
+
+/** Package names (bare specifiers, cut to the package) a `node -e` program imports; builtins, node:, relative and absolute are not packages. */
+export function nodeImports(code) {
+  const specs = [], c = String(code ?? "");
+  for (const re of [/\brequire\(\s*['"]([^'"]+)['"]\s*\)/g, /\bimport\s*\(\s*['"]([^'"]+)['"]/g, /\bfrom\s*['"]([^'"]+)['"]/g, /(?:^|[;\n])\s*import\s*['"]([^'"]+)['"]/g]) for (const m of c.matchAll(re)) specs.push(m[1]);
+  const out = [];
+  for (const spec of specs) {
+    if (/^(\.|\/|node:|file:|data:)/.test(spec)) continue;
+    const parts = spec.split("/"), pkg = spec.startsWith("@") ? (parts.length > 1 ? parts.slice(0, 2).join("/") : null) : parts[0];
+    if (pkg && !builtinModules.includes(pkg)) out.push(pkg);
+  }
+  return [...new Set(out)];
+}
+
+const PY_PROBE = "import importlib.util,sys;sys.exit(0 if importlib.util.find_spec(sys.argv[1]) else 3)";
+const NODE_PROBE = "const m=require('module'),p=require('path'),f=require('fs'),n=process.argv[1];if(m.builtinModules.includes(n))process.exit(0);for(let d=process.cwd();;){if(f.existsSync(p.join(d,'node_modules',n,'package.json')))process.exit(0);const u=p.dirname(d);if(u===d)process.exit(3);d=u}";
+
+/** The program text and modules of one python/node segment's arguments. */
+function moduleNeeds(exe, args) {
+  if (PY_RE.test(exe)) {
+    for (let i = 0; i < args.length; i++) {
+      const a = args[i];
+      if (a === "-c") return pythonImports(args[i + 1]);
+      if (a.startsWith("-c") && a.length > 2) return pythonImports(a.slice(2));
+      if (a === "-m") return args[i + 1] ? [args[i + 1].split(".")[0]] : [];
+      if (a.startsWith("-m") && a.length > 2) return [a.slice(2).split(".")[0]];
+      if (PY_ARG_FLAGS.has(a)) { i++; continue; }
+      if (!a.startsWith("-")) return [];
+    }
+    return [];
+  }
+  if (exe === "node") {
+    for (let i = 0; i < args.length; i++) {
+      const a = args[i];
+      if (["-e", "--eval", "-p", "--print"].includes(a)) return nodeImports(args[i + 1]);
+      const eq = /^--(?:eval|print)=(.*)$/s.exec(a);
+      if (eq) return nodeImports(eq[1]);
+      if (!a.startsWith("-")) return [];
+    }
+  }
+  return [];
+}
+
+/**
+ * The probes for `contract.validate[]`: {probes: [{ids, tool, kind, interp, needs, probe}], dropped}. `needs` is the command
+ * probe (tool) a module probe depends on: skip the module probe when its interpreter is missing. A name `repoHas(name)` holds
+ * or a deliverable's change text names (the change adds it) is not probed; paths and `$...` words are never probed.
+ */
+export function preflightProbes(contract, { repoHas = () => false, cap = PREFLIGHT_CAP } = {}) {
+  const changes = (Array.isArray(contract?.deliverables) ? contract.deliverables : []).map((d) => String(d?.change ?? "")).join("\n");
+  const named = (name) => new RegExp(`(^|[^\\w@/.-])${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![\\w/-])`).test(changes);
+  const skip = (name) => !name || name.includes("/") && !name.startsWith("@") || name.startsWith("$") || repoHas(name) || named(name);
+  const byKey = new Map();
+  const add = (id, kind, tool, interp = null) => {
+    const key = `${kind}|${tool}|${interp ?? ""}`;
+    const p = byKey.get(key);
+    if (p) { if (!p.ids.includes(id)) p.ids.push(id); return; }
+    const probe = kind === "command" ? `command -v -- ${sq(tool)} >/dev/null 2>&1`
+      : kind === "python-module" ? `${sq(interp)} -c ${sq(PY_PROBE)} ${sq(tool)} >/dev/null 2>&1`
+      : `node -e ${sq(NODE_PROBE)} ${sq(tool)} >/dev/null 2>&1`;
+    byKey.set(key, { ids: [id], tool, kind, interp, needs: kind === "command" ? null : interp, probe });
+  };
+  for (const v of Array.isArray(contract?.validate) ? contract.validate : []) {
+    if (!v?.id || typeof v.command !== "string") continue;
+    for (const seg of shellSegments(v.command)) {
+      let i = 0;
+      while (i < seg.length && (/^[A-Za-z_]\w*=/.test(seg[i]) || ["!", "time", "exec", "command", "env"].includes(seg[i]))) i++;
+      const exe = seg[i];
+      if (!exe || exe.includes("/") || exe.startsWith("$") || exe.startsWith("-")) continue;
+      if (!skip(exe)) add(v.id, "command", exe);
+      const kind = exe === "node" ? "node-module" : "python-module";
+      for (const mod of moduleNeeds(exe, seg.slice(i + 1))) if (!skip(mod)) add(v.id, kind, mod, exe);
+    }
+  }
+  const all = [...byKey.values()];
+  return { probes: all.slice(0, cap), dropped: Math.max(0, all.length - cap) };
+}
+
+/** One contract problem per missed probe: names the validate ids and the tool, and how to fix the plan (never a global install). */
+export function preflightProblems(misses) {
+  return (misses ?? []).map((m) => `${m.ids.join(", ")}: needs ${KIND_NAME[m.kind] ?? m.kind} '${m.tool}'${m.interp ? ` (for ${m.interp})` : ""}, which this host lacks, so the validate command cannot run here; run the check through the repo's own toolchain (its virtualenv, lockfile-pinned runner or package scripts) or use a check that does not need it, never a global install`);
+}

package/bin/lean/preflight.test.mjs

@@ -0,0 +1,61 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { shellSegments, pythonImports, nodeImports, preflightProbes, preflightProblems } from "./preflight.mjs";
+import { runCheckCommand } from "./effects.mjs";
+import { repoTracks } from "./conformance.mjs";
+import { tmpDir } from "../tests/_tmp.mjs";
+
+const C = (...commands) => ({ deliverables: [], validate: commands.map((command, i) => ({ id: `V${i + 1}`, command })) });
+const needs = (c, o) => preflightProbes(c, o).probes.map((p) => [p.kind, p.tool, p.interp ?? null, p.ids.join(",")]);
+
+describe("#4328 validate preflight: what a command needs", () => {
+  it("splits on && || | ; and newlines, keeps quotes and $(...) whole", () => {
+    assert.deepEqual(shellSegments(`cd a && python3 -c "import yaml; print('x | y')" | tee "$TMPDIR/o" ; git diff $(git merge-base HEAD origin/x) -- a || true`),
+      [["cd", "a"], ["python3", "-c", "import yaml; print('x | y')"], ["tee", "$TMPDIR/o"], ["git", "diff", "$(git merge-base HEAD origin/x)", "--", "a"], ["true"]]);
+  });
+  it("python -c imports and -m modules (top-level, absolute only); node -e bare packages", () => {
+    assert.deepEqual(pythonImports("import yaml, os.path as p\nfrom jsonschema.validators import x; from . import y; from __future__ import annotations; __import__('toml')"), ["yaml", "os", "jsonschema", "toml"]);
+    assert.deepEqual(nodeImports(`const z=require("zod"); import("@scope/pkg/sub"); import fs from "node:fs"; require("./x"); require("path")`), ["zod", "@scope/pkg"]);
+  });
+  it("probes each bare executable, a bare python's modules and node -e packages, deduped across validate ids", () => {
+    assert.deepEqual(needs(C(`FOO=1 python3 -c "import yaml,json"`, "python3 -m pytest -q tests/x.py && jq . a.json", `node -e "require('zod')"`, "python3 -c 'import yaml'")), [
+      ["command", "python3", null, "V1,V2,V4"], ["python-module", "yaml", "python3", "V1,V4"], ["python-module", "json", "python3", "V1"],
+      ["python-module", "pytest", "python3", "V2"], ["command", "jq", null, "V2"], ["command", "node", null, "V3"], ["node-module", "zod", "node", "V3"]]);
+  });
+  it("wrappers and paths: only the wrapper is probed; ./script and .venv/bin/python and $VAR never are", () => {
+    assert.deepEqual(needs(C(`uv run python -c "import yaml"`, "./scripts/check.sh", `.venv/bin/python -c "import yaml"`, "$PY -m x", "npx vitest run a.test.ts")),
+      [["command", "uv", null, "V1"], ["command", "npx", null, "V5"]]);
+  });
+  it("skips names the repo tracks and names a deliverable's change adds", () => {
+    const c = { ...C(`python3 -c "import app, yaml"`, `node -e "require('left-pad')"`), deliverables: [{ id: "D1", path: "package.json", change: "add devDependency left-pad for the check" }] };
+    assert.deepEqual(needs(c, { repoHas: repoTracks(["app/__init__.py"]) }).map((x) => x[1]), ["python3", "yaml", "node"]);
+  });
+  it("caps the probes and reports the dropped count", () => {
+    const r = preflightProbes(C(Array.from({ length: 25 }, (_, i) => `tool${i}`).join(" && ")), { cap: 20 });
+    assert.equal(r.probes.length, 20); assert.equal(r.dropped, 5);
+  });
+  it("a problem line names the ids, the kind and the tool and forbids a global install", () => {
+    const [p] = preflightProblems([{ ids: ["V5"], tool: "yaml", kind: "python-module", interp: "python3" }]);
+    assert.match(p, /^V5: needs Python module 'yaml' \(for python3\), which this host lacks/);
+    assert.match(p, /repo's own toolchain .*never a global install/);
+  });
+  it("the probes are real read-only shell checks: present tools pass, absent ones fail", async () => {
+    const dir = tmpDir("preflight-");
+    mkdirSync(join(dir, "node_modules", "here"), { recursive: true }); writeFileSync(join(dir, "node_modules", "here", "package.json"), "{}");
+    mkdirSync(join(dir, "sub"));
+    const probes = preflightProbes(C("bash -c true", "no-such-tool-4328 --x", `node -e "require('here'); require('fs'); require('absent-pkg-4328')"`)).probes;
+    const rc = {};
+    for (const p of probes) rc[`${p.kind}:${p.tool}`] = (await runCheckCommand({ command: p.probe, cwd: join(dir, "sub"), timeoutMs: 15000 })).rc;
+    assert.equal(rc["command:bash"], 0); assert.notEqual(rc["command:no-such-tool-4328"], 0);
+    assert.equal(rc["command:node"], 0); assert.equal(rc["node-module:here"], 0, "found in an ancestor node_modules");
+    assert.notEqual(rc["node-module:absent-pkg-4328"], 0);
+    const py = preflightProbes(C(`python3 -c "import json, no_such_mod_4328"`)).probes.filter((p) => p.kind === "python-module");
+    if ((await runCheckCommand({ command: "command -v python3", cwd: dir })).rc === 0) {
+      assert.deepEqual(await Promise.all(py.map(async (p) => (await runCheckCommand({ command: p.probe, cwd: dir })).rc !== 0)), [false, true]);
+    }
+  });
+});