p-dev-harness 0.3.1 → 0.4.0

package/dist/setup/workflow-install-branch-recovery.js

@@ -0,0 +1,385 @@
+import { createHash } from "node:crypto";
+import { GitHubApiError } from "../github/client.js";
+import { buildTargetWorkflowBranchName, buildTargetWorkflowPrTitle, compareTargetWorkflowContent, } from "./target-workflow-setup.js";
+export function validateInstallBranchRecoveryProof(input) {
+    const expectedBranch = buildTargetWorkflowBranchName(input.configuredRepoConfigId);
+    if (input.configuredTargetRepoSlug !== input.observedTargetRepoSlug) {
+        return {
+            ok: false,
+            reason: "Install branch recovery target repository mismatch.",
+        };
+    }
+    if (input.reservedBranchName !== expectedBranch) {
+        return {
+            ok: false,
+            reason: "Install branch recovery reserved branch name mismatch.",
+        };
+    }
+    if (input.observedBranchName !== expectedBranch) {
+        return {
+            ok: false,
+            reason: "Install branch recovery PR head branch mismatch.",
+        };
+    }
+    if (input.observedProductionBranch !== input.configuredProductionBranch) {
+        return {
+            ok: false,
+            reason: "Install branch recovery PR base branch mismatch.",
+        };
+    }
+    if (`${input.pullRequestOwner}/${input.pullRequestRepo}` !==
+        input.configuredTargetRepoSlug) {
+        return {
+            ok: false,
+            reason: "Install branch recovery PR repository mismatch.",
+        };
+    }
+    const maxOpen = 1;
+    const minOpen = input.allowZeroOpenPullRequests ? 0 : 1;
+    if (input.openPullRequestsOnBranch < minOpen ||
+        input.openPullRequestsOnBranch > maxOpen) {
+        return {
+            ok: false,
+            reason: "Install branch recovery requires at most one open PR on the reserved branch.",
+        };
+    }
+    return { ok: true };
+}
+/**
+ * Determines whether a harness-owned install branch is stale enough to warrant
+ * force-reset recovery. An empty PR changed-files list alone is not sufficient.
+ */
+export function isStaleHarnessInstallBranch(input) {
+    if (!input.headWorkflowMatchesIntended) {
+        return true;
+    }
+    if (input.filesValidationPassed) {
+        return false;
+    }
+    const mergeState = input.mergeableState?.toLowerCase() ?? "";
+    const compareState = input.compareStatus?.toLowerCase() ?? "";
+    const behindOrDiverged = mergeState === "behind" ||
+        compareState === "behind" ||
+        compareState === "diverged";
+    if (behindOrDiverged) {
+        return true;
+    }
+    if (input.changedFiles.length === 1 &&
+        input.changedFiles[0]?.path !== input.workflowPath) {
+        return true;
+    }
+    if (input.changedFiles.length > 1) {
+        return true;
+    }
+    return false;
+}
+export function buildWorkflowInstallPrMarker(repoConfigId) {
+    return `<!-- p-dev-workflow-install:${repoConfigId} -->`;
+}
+export function workflowInstallPrBodyContainsMarker(body, repoConfigId) {
+    if (!body) {
+        return false;
+    }
+    return body.includes(buildWorkflowInstallPrMarker(repoConfigId));
+}
+export function hashWorkflowContentSha256(content) {
+    return createHash("sha256").update(content, "utf8").digest("hex");
+}
+export async function isInstallBranchAlreadyClean(input) {
+    const [owner, repo] = input.targetRepoSlug.split("/");
+    let branchRef;
+    try {
+        branchRef = await input.client.getBranchRef(owner, repo, input.branchName);
+    }
+    catch (error) {
+        if (error instanceof GitHubApiError && error.status === 404) {
+            return false;
+        }
+        throw error;
+    }
+    const productionRef = await input.client.getBranchRef(owner, repo, input.productionBranch);
+    if (branchRef.object.sha === productionRef.object.sha) {
+        return false;
+    }
+    const compare = await input.client.compareCommits(owner, repo, input.productionBranch, input.branchName);
+    if (compare.status !== "ahead" || compare.ahead_by !== 1) {
+        return false;
+    }
+    const files = compare.files ?? [];
+    if (files.length !== 1 || files[0]?.filename !== input.workflowPath) {
+        return false;
+    }
+    const headContent = await input.client.getRepositoryContent(owner, repo, input.workflowPath, input.branchName);
+    if (!headContent) {
+        return false;
+    }
+    const decoded = input.client.decodeRepositoryContent(headContent);
+    return (compareTargetWorkflowContent(decoded, input.intendedWorkflowContent) ===
+        "present");
+}
+async function readReservedBranchHeadSha(client, owner, repo, branchName) {
+    try {
+        const ref = await client.getBranchRef(owner, repo, branchName);
+        return ref.object.sha;
+    }
+    catch (error) {
+        if (error instanceof GitHubApiError && error.status === 404) {
+            return null;
+        }
+        throw error;
+    }
+}
+async function buildVerifiedWorkflowCommit(input) {
+    const parentCommit = await input.client.getGitCommit(input.owner, input.repo, input.productionSha);
+    const blob = await input.client.createGitBlob({
+        owner: input.owner,
+        repo: input.repo,
+        content: Buffer.from(input.workflowContent, "utf8"),
+    });
+    const tree = await input.client.createGitTree({
+        owner: input.owner,
+        repo: input.repo,
+        baseTree: parentCommit.tree.sha,
+        tree: [
+            {
+                path: input.workflowPath,
+                mode: "100644",
+                type: "blob",
+                sha: blob.sha,
+            },
+        ],
+    });
+    const commit = await input.client.createGitCommit({
+        owner: input.owner,
+        repo: input.repo,
+        message: input.commitMessage,
+        tree: tree.sha,
+        parents: [input.productionSha],
+    });
+    if (commit.parents[0]?.sha !== input.productionSha) {
+        throw new Error("Install branch recovery commit parent does not match production head.");
+    }
+    if (commit.tree.sha !== tree.sha) {
+        throw new Error("Install branch recovery commit tree does not match constructed tree.");
+    }
+    const compare = await input.client.compareCommits(input.owner, input.repo, input.productionSha, commit.sha);
+    const files = compare.files ?? [];
+    if (files.length !== 1 || files[0]?.filename !== input.workflowPath) {
+        throw new Error("Install branch recovery commit must change exactly the workflow path.");
+    }
+    return { commitSha: commit.sha, treeSha: tree.sha };
+}
+async function verifyBranchPostconditions(input) {
+    const branchRef = await input.client.getBranchRef(input.owner, input.repo, input.branchName);
+    if (branchRef.object.sha !== input.expectedHeadSha) {
+        throw new Error(`Install branch head mismatch after update (expected ${input.expectedHeadSha}, got ${branchRef.object.sha}).`);
+    }
+    if (branchRef.object.sha === input.productionSha) {
+        throw new Error("Install branch head must differ from production after recovery.");
+    }
+    const commit = await input.client.getGitCommit(input.owner, input.repo, branchRef.object.sha);
+    if (commit.parents[0]?.sha !== input.productionSha) {
+        throw new Error("Install branch commit parent must be current production head.");
+    }
+    const compare = await input.client.compareCommits(input.owner, input.repo, input.productionBranch, input.branchName);
+    const files = compare.files ?? [];
+    if (files.length !== 1 || files[0]?.filename !== input.workflowPath) {
+        throw new Error("Install branch must differ from production by exactly the workflow path.");
+    }
+    const headContent = await input.client.getRepositoryContent(input.owner, input.repo, input.workflowPath, input.branchName);
+    if (!headContent) {
+        throw new Error("Install branch is missing the intended workflow file.");
+    }
+    const decoded = input.client.decodeRepositoryContent(headContent);
+    if (compareTargetWorkflowContent(decoded, input.workflowContent) !== "present") {
+        throw new Error("Install branch workflow content does not match the intended workflow.");
+    }
+}
+/**
+ * Commit-first reserved-branch recovery.
+ *
+ * Never points the reserved branch at production. Builds a verified commit on
+ * current production, race-checks the reserved branch head, then force-updates
+ * only that reserved branch to the verified commit.
+ */
+export async function recoverHarnessInstallBranch(input) {
+    const [owner, repo] = input.targetRepoSlug.split("/");
+    if (!input.branchName.startsWith("harness/setup-production-sync-")) {
+        return {
+            recovered: false,
+            reason: "Force update refused: branch is not a reserved install branch.",
+        };
+    }
+    const productionRef = await input.client.getBranchRef(owner, repo, input.productionBranch);
+    const productionSha = productionRef.object.sha;
+    const observedHeadBefore = input.expectedReservedBranchHeadSha !== undefined
+        ? input.expectedReservedBranchHeadSha
+        : await readReservedBranchHeadSha(input.client, owner, repo, input.branchName);
+    const commitMessage = input.commitMessage ?? buildTargetWorkflowPrTitle();
+    let commitSha;
+    try {
+        const built = await buildVerifiedWorkflowCommit({
+            client: input.client,
+            owner,
+            repo,
+            productionSha,
+            workflowPath: input.workflowPath,
+            workflowContent: input.workflowContent,
+            commitMessage,
+        });
+        commitSha = built.commitSha;
+    }
+    catch (error) {
+        return {
+            recovered: false,
+            reason: error instanceof Error
+                ? error.message
+                : "Failed to build verified workflow install commit.",
+        };
+    }
+    // Race guard: re-read immediately before mutation.
+    const observedHeadAtMutation = await readReservedBranchHeadSha(input.client, owner, repo, input.branchName);
+    if (observedHeadAtMutation !== observedHeadBefore) {
+        return {
+            recovered: false,
+            needsReconciliation: true,
+            reason: "Reserved install branch head changed during recovery; reconciling instead of overwriting.",
+            observedHeadSha: observedHeadAtMutation ?? undefined,
+        };
+    }
+    if (observedHeadAtMutation === null) {
+        await input.client.createGitRef(owner, repo, input.branchName, commitSha);
+    }
+    else {
+        await input.client.updateGitRef({
+            owner,
+            repo,
+            ref: input.branchName,
+            sha: commitSha,
+            force: true,
+        });
+    }
+    try {
+        await verifyBranchPostconditions({
+            client: input.client,
+            owner,
+            repo,
+            productionBranch: input.productionBranch,
+            productionSha,
+            branchName: input.branchName,
+            expectedHeadSha: commitSha,
+            workflowPath: input.workflowPath,
+            workflowContent: input.workflowContent,
+        });
+    }
+    catch (error) {
+        return {
+            recovered: false,
+            reason: error instanceof Error
+                ? error.message
+                : "Install branch postcondition verification failed.",
+        };
+    }
+    return {
+        recovered: true,
+        headSha: commitSha,
+        productionSha,
+        commitSha,
+    };
+}
+export async function countOpenPullRequestsOnBranch(client, input) {
+    const [owner, repo] = input.targetRepoSlug.split("/");
+    const pulls = await client.listPullRequests(owner, repo, {
+        state: "open",
+        base: input.productionBranch,
+        head: `${owner}:${input.branchName}`,
+    });
+    return pulls.length;
+}
+export async function findInstallPullRequestByMarker(input) {
+    const [owner, repo] = input.targetRepoSlug.split("/");
+    const pulls = await input.client.listPullRequests(owner, repo, {
+        state: input.state ?? "open",
+        base: input.productionBranch,
+        head: `${owner}:${input.branchName}`,
+        sort: "updated",
+        direction: "desc",
+    });
+    const marker = buildWorkflowInstallPrMarker(input.repoConfigId);
+    for (const pull of pulls) {
+        const body = pull.body ?? "";
+        if (!body.includes(marker)) {
+            continue;
+        }
+        if (pull.head.ref !== input.branchName) {
+            continue;
+        }
+        if (pull.base.ref !== input.productionBranch) {
+            continue;
+        }
+        return {
+            number: pull.number,
+            html_url: pull.html_url,
+            headSha: pull.head.sha,
+            state: pull.state,
+            body: pull.body,
+        };
+    }
+    return null;
+}
+export async function ensureOpenInstallPullRequest(input) {
+    const [owner, repo] = input.targetRepoSlug.split("/");
+    const openByHead = await input.client.listPullRequests(owner, repo, {
+        state: "open",
+        base: input.productionBranch,
+        head: `${owner}:${input.branchName}`,
+    });
+    const openMatch = openByHead.find((pull) => pull.head.ref === input.branchName &&
+        pull.base.ref === input.productionBranch &&
+        pull.head.sha === input.verifiedHeadSha &&
+        workflowInstallPrBodyContainsMarker(pull.body, input.repoConfigId));
+    if (openMatch) {
+        return {
+            prNumber: openMatch.number,
+            prUrl: openMatch.html_url,
+            created: false,
+        };
+    }
+    // Any open PR on the reserved branch with matching head — reuse if body has marker or add via recreate path.
+    const openAny = openByHead.find((pull) => pull.head.ref === input.branchName &&
+        pull.base.ref === input.productionBranch &&
+        pull.head.sha === input.verifiedHeadSha);
+    if (openAny) {
+        return {
+            prNumber: openAny.number,
+            prUrl: openAny.html_url,
+            created: false,
+        };
+    }
+    const closedMatch = await findInstallPullRequestByMarker({
+        client: input.client,
+        targetRepoSlug: input.targetRepoSlug,
+        productionBranch: input.productionBranch,
+        branchName: input.branchName,
+        repoConfigId: input.repoConfigId,
+        state: "closed",
+    });
+    const bodyWithMarker = input.prBody.includes(buildWorkflowInstallPrMarker(input.repoConfigId))
+        ? input.prBody
+        : `${input.prBody}\n\n${buildWorkflowInstallPrMarker(input.repoConfigId)}\n`;
+    const created = await input.client.createPullRequest({
+        owner,
+        repo,
+        title: input.prTitle,
+        head: input.branchName,
+        base: input.productionBranch,
+        body: bodyWithMarker,
+    });
+    return {
+        prNumber: created.number,
+        prUrl: created.html_url,
+        created: true,
+        supersededPrNumber: closedMatch?.number,
+    };
+}
+//# sourceMappingURL=workflow-install-branch-recovery.js.map

package/dist/setup/workflow-install-branch-recovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-install-branch-recovery.js","sourceRoot":"","sources":["../../src/setup/workflow-install-branch-recovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAqB,MAAM,qBAAqB,CAAC;AACxE,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,4BAA4B,CAAC;AAsBpC,MAAM,UAAU,kCAAkC,CAChD,KAAsC;IAEtC,MAAM,cAAc,GAAG,6BAA6B,CAClD,KAAK,CAAC,sBAAsB,CAC7B,CAAC;IAEF,IAAI,KAAK,CAAC,wBAAwB,KAAK,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACpE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qDAAqD;SAC9D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,KAAK,cAAc,EAAE,CAAC;QAChD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,wDAAwD;SACjE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,KAAK,cAAc,EAAE,CAAC;QAChD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,kDAAkD;SAC3D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,wBAAwB,KAAK,KAAK,CAAC,0BAA0B,EAAE,CAAC;QACxE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,kDAAkD;SAC3D,CAAC;IACJ,CAAC;IACD,IACE,GAAG,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,eAAe,EAAE;QACpD,KAAK,CAAC,wBAAwB,EAC9B,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iDAAiD;SAC1D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IACE,KAAK,CAAC,wBAAwB,GAAG,OAAO;QACxC,KAAK,CAAC,wBAAwB,GAAG,OAAO,EACxC,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,8EAA8E;SACjF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAWD;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAkC;IAElC,IAAI,CAAC,KAAK,CAAC,2BAA2B,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC7D,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC9D,MAAM,gBAAgB,GACpB,UAAU,KAAK,QAAQ;QACvB,YAAY,KAAK,QAAQ;QACzB,YAAY,KAAK,UAAU,CAAC;IAE9B,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IACE,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAC/B,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,KAAK,CAAC,YAAY,EAClD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,YAAoB;IAC/D,OAAO,+BAA+B,YAAY,MAAM,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,IAA+B,EAC/B,YAAoB;IAEpB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AA6BD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAOjD;IACC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,SAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,YAAY,CACzC,KAAK,EACL,IAAI,EACJ,KAAK,CAAC,UAAU,CACjB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,cAAc,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,YAAY,CACnD,KAAK,EACL,IAAI,EACJ,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,CAC/C,KAAK,EACL,IAAI,EACJ,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,oBAAoB,CACzD,KAAK,EACL,IAAI,EACJ,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAClE,OAAO,CACL,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC,uBAAuB,CAAC;QACpE,SAAS,CACV,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,MAAoB,EACpB,KAAa,EACb,IAAY,EACZ,UAAkB;IAElB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,cAAc,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAQ1C;IACC,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,YAAY,CAClD,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,aAAa,CACpB,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC;QAC5C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC;KACpD,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC;QAC5C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG;QAC/B,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE,KAAK,CAAC,YAAY;gBACxB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,MAAM;gBACZ,GAAG,EAAE,IAAI,CAAC,GAAG;aACd;SACF;KACF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC;QAChD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,aAAa;QAC5B,IAAI,EAAE,IAAI,CAAC,GAAG;QACd,OAAO,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;KAC/B,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,CAC/C,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,aAAa,EACnB,MAAM,CAAC,GAAG,CACX,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAUzC;IACC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,YAAY,CAC/C,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,uDAAuD,KAAK,CAAC,eAAe,SAAS,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAC9G,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,YAAY,CAC5C,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,EACV,SAAS,CAAC,MAAM,CAAC,GAAG,CACrB,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,CAC/C,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,oBAAoB,CACzD,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAClE,IACE,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC,eAAe,CAAC,KAAK,SAAS,EAC1E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAuC;IAEvC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,gCAAgC,CAAC,EAAE,CAAC;QACnE,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,gEAAgE;SACzE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,YAAY,CACnD,KAAK,EACL,IAAI,EACJ,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC;IAE/C,MAAM,kBAAkB,GACtB,KAAK,CAAC,6BAA6B,KAAK,SAAS;QAC/C,CAAC,CAAC,KAAK,CAAC,6BAA6B;QACrC,CAAC,CAAC,MAAM,yBAAyB,CAC7B,KAAK,CAAC,MAAM,EACZ,KAAK,EACL,IAAI,EACJ,KAAK,CAAC,UAAU,CACjB,CAAC;IAER,MAAM,aAAa,GACjB,KAAK,CAAC,aAAa,IAAI,0BAA0B,EAAE,CAAC;IAEtD,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC;YAC9C,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK;YACL,IAAI;YACJ,aAAa;YACb,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,aAAa;SACd,CAAC,CAAC;QACH,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EACJ,KAAK,YAAY,KAAK;gBACpB,CAAC,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC,mDAAmD;SAC1D,CAAC;IACJ,CAAC;IAED,mDAAmD;IACnD,MAAM,sBAAsB,GAAG,MAAM,yBAAyB,CAC5D,KAAK,CAAC,MAAM,EACZ,KAAK,EACL,IAAI,EACJ,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,IAAI,sBAAsB,KAAK,kBAAkB,EAAE,CAAC;QAClD,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,mBAAmB,EAAE,IAAI;YACzB,MAAM,EACJ,2FAA2F;YAC7F,eAAe,EAAE,sBAAsB,IAAI,SAAS;SACrD,CAAC;IACJ,CAAC;IAED,IAAI,sBAAsB,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC5E,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;YAC9B,KAAK;YACL,IAAI;YACJ,GAAG,EAAE,KAAK,CAAC,UAAU;YACrB,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,MAAM,0BAA0B,CAAC;YAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK;YACL,IAAI;YACJ,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,aAAa;YACb,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,eAAe,EAAE,SAAS;YAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,eAAe,EAAE,KAAK,CAAC,eAAe;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EACJ,KAAK,YAAY,KAAK;gBACpB,CAAC,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC,mDAAmD;SAC1D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,SAAS;QAClB,aAAa;QACb,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,MAAoB,EACpB,KAIC;IAED,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE;QACvD,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,KAAK,CAAC,gBAAgB;QAC5B,IAAI,EAAE,GAAG,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE;KACrC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAOpD;IAOC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE;QAC7D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,MAAM;QAC5B,IAAI,EAAE,KAAK,CAAC,gBAAgB;QAC5B,IAAI,EAAE,GAAG,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE;QACpC,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAChE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;YACvC,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;YACtB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAUlD;IAMC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEtD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE;QAClE,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,KAAK,CAAC,gBAAgB;QAC5B,IAAI,EAAE,GAAG,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE;KACrC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAC/B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,UAAU;QAClC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,gBAAgB;QACxC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,eAAe;QACvC,mCAAmC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CACrE,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;YACL,QAAQ,EAAE,SAAS,CAAC,MAAM;YAC1B,KAAK,EAAE,SAAS,CAAC,QAAQ;YACzB,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IAED,6GAA6G;IAC7G,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAC7B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,UAAU;QAClC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,gBAAgB;QACxC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,eAAe,CAC1C,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,QAAQ,EAAE,OAAO,CAAC,MAAM;YACxB,KAAK,EAAE,OAAO,CAAC,QAAQ;YACvB,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,8BAA8B,CAAC;QACvD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAC1C,4BAA4B,CAAC,KAAK,CAAC,YAAY,CAAC,CACjD;QACC,CAAC,CAAC,KAAK,CAAC,MAAM;QACd,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,OAAO,4BAA4B,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;IAE/E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACnD,KAAK;QACL,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,OAAO;QACpB,IAAI,EAAE,KAAK,CAAC,UAAU;QACtB,IAAI,EAAE,KAAK,CAAC,gBAAgB;QAC5B,IAAI,EAAE,cAAc;KACrB,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,MAAM;QACxB,KAAK,EAAE,OAAO,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI;QACb,kBAAkB,EAAE,WAAW,EAAE,MAAM;KACxC,CAAC;AACJ,CAAC"}

package/dist/setup/workflow-install-merge-errors.d.ts

@@ -1,9 +1,12 @@
+import type { CheckPolicyResult } from "../github/check-policy.js";
 import type { WorkflowInstallBlockedCategory } from "./target-workflow-finalization-types.js";
-export declare function classifyWorkflowInstallMergeRejection(input: {
+export interface ClassifyWorkflowInstallMergeRejectionInput {
     error: unknown;
     mergeableState?: string | null;
     message?: string;
-}): {
+    checkPolicy?: CheckPolicyResult;
+}
+export declare function classifyWorkflowInstallMergeRejection(input: ClassifyWorkflowInstallMergeRejectionInput): {
     category: WorkflowInstallBlockedCategory;
     waiting: boolean;
     message: string;

package/dist/setup/workflow-install-merge-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-install-merge-errors.d.ts","sourceRoot":"","sources":["../../src/setup/workflow-install-merge-errors.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AAE9F,wBAAgB,qCAAqC,CAAC,KAAK,EAAE;IAC3D,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG;IACF,QAAQ,EAAE,8BAA8B,CAAC;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,CA0HA;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,8BAA8B,GACvC,MAAM,CA2BR"}
+{"version":3,"file":"workflow-install-merge-errors.d.ts","sourceRoot":"","sources":["../../src/setup/workflow-install-merge-errors.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AAE9F,MAAM,WAAW,0CAA0C;IACzD,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC;AAED,wBAAgB,qCAAqC,CACnD,KAAK,EAAE,0CAA0C,GAChD;IACD,QAAQ,EAAE,8BAA8B,CAAC;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,CAsKA;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,8BAA8B,GACvC,MAAM,CA2BR"}

package/dist/setup/workflow-install-merge-errors.js

@@ -3,6 +3,20 @@ import { classifyMergeError } from "../github/merge-result.js";
 export function classifyWorkflowInstallMergeRejection(input) {
     const apiMessage = (input.message ??
         (input.error instanceof Error ? input.error.message : String(input.error))).toLowerCase();
+    if (input.checkPolicy?.decision === "block") {
+        if (input.checkPolicy.classification === "checks_failing") {
+            return {
+                category: "checks-failing",
+                waiting: false,
+                message: input.checkPolicy.reason,
+            };
+        }
+        return {
+            category: "checks-pending",
+            waiting: true,
+            message: input.checkPolicy.reason,
+        };
+    }
     if (input.error instanceof GitHubApiError) {
         if (input.error.status === 401 || input.error.status === 403) {
             if (apiMessage.includes("review") ||
@@ -14,6 +28,15 @@ export function classifyWorkflowInstallMergeRejection(input) {
                     message: "GitHub requires human review before this workflow install PR can merge.",
                 };
             }
+            if (apiMessage.includes("bypass") ||
+                apiMessage.includes("not permitted") ||
+                apiMessage.includes("insufficient")) {
+                return {
+                    category: "permission-denied",
+                    waiting: false,
+                    message: "The setup token cannot bypass repository rules to merge this workflow install PR.",
+                };
+            }
             return {
                 category: "permission-denied",
                 waiting: false,
@@ -53,20 +76,38 @@ export function classifyWorkflowInstallMergeRejection(input) {
                     message: "The workflow install PR head changed during finalization. Revalidating before merge.",
                 };
             }
-            if (apiMessage.includes("required status") ||
-                apiMessage.includes("not mergeable") ||
-                apiMessage.includes("checks")) {
+            if (apiMessage.includes("review") ||
+                apiMessage.includes("approval") ||
+                apiMessage.includes("required reviewers")) {
                 return {
-                    category: "checks-pending",
-                    waiting: true,
-                    message: "GitHub is still waiting for required checks on the workflow install PR.",
+                    category: "review-required",
+                    waiting: false,
+                    message: "GitHub requires human review before this workflow install PR can merge.",
                 };
             }
-            if (apiMessage.includes("review")) {
+            if (apiMessage.includes("bypass") ||
+                apiMessage.includes("not permitted") ||
+                apiMessage.includes("insufficient")) {
                 return {
-                    category: "review-required",
+                    category: "permission-denied",
                     waiting: false,
-                    message: "GitHub requires human review before this workflow install PR can merge.",
+                    message: "The setup token cannot bypass repository rules to merge this workflow install PR.",
+                };
+            }
+            if (apiMessage.includes("conversation") ||
+                apiMessage.includes("thread resolution") ||
+                apiMessage.includes("unresolved")) {
+                return {
+                    category: "merge-api-failure",
+                    waiting: false,
+                    message: "GitHub requires unresolved review conversations to be resolved before merge.",
+                };
+            }
+            if (apiMessage.includes("deployment")) {
+                return {
+                    category: "merge-api-failure",
+                    waiting: false,
+                    message: "GitHub requires a deployment requirement before this workflow install PR can merge.",
                 };
             }
         }
@@ -86,13 +127,6 @@ export function classifyWorkflowInstallMergeRejection(input) {
             message: "The workflow install branch is behind the production branch.",
         };
     }
-    if (state === "blocked") {
-        return {
-            category: "review-required",
-            waiting: false,
-            message: "Branch protection or review rules are blocking automatic merge of the workflow install PR.",
-        };
-    }
     return {
         category: "merge-api-failure",
         waiting: false,
@@ -108,7 +142,7 @@ export function blockedCategoryMessage(category) {
         case "mergeability-pending":
             return "GitHub is still computing mergeability for the workflow install PR.";
         case "branch-behind":
-            return "Updating the workflow install branch to match production.";
+            return "Refreshing the workflow install branch…";
         case "review-required":
             return "Human review is required before the workflow install PR can merge.";
         case "permission-denied":

package/dist/setup/workflow-install-merge-errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-install-merge-errors.js","sourceRoot":"","sources":["../../src/setup/workflow-install-merge-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAG/D,MAAM,UAAU,qCAAqC,CAAC,KAIrD;IAKC,MAAM,UAAU,GAAG,CACjB,KAAK,CAAC,OAAO;QACb,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAC3E,CAAC,WAAW,EAAE,CAAC;IAEhB,IAAI,KAAK,CAAC,KAAK,YAAY,cAAc,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7D,IACE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC7B,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC/B,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EACzC,CAAC;gBACD,OAAO;oBACL,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,KAAK;oBACd,OAAO,EACL,yEAAyE;iBAC5E,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,mBAAmB;gBAC7B,OAAO,EAAE,KAAK;gBACd,OAAO,EACL,6EAA6E;aAChF,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC/B,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,mBAAmB,EAAE,CAAC;gBAC5D,OAAO;oBACL,QAAQ,EAAE,mBAAmB;oBAC7B,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,yCAAyC;iBACnD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC/B,OAAO;gBACL,QAAQ,EAAE,gBAAgB;gBAC1B,OAAO,EAAE,KAAK;gBACd,OAAO,EACL,6EAA6E;aAChF,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC/B,IACE,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAClC,UAAU,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EACvC,CAAC;gBACD,OAAO;oBACL,QAAQ,EAAE,sBAAsB;oBAChC,OAAO,EAAE,KAAK;oBACd,OAAO,EACL,+FAA+F;iBAClG,CAAC;YACJ,CAAC;YACD,IACE,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC/B,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,EACpC,CAAC;gBACD,OAAO;oBACL,QAAQ,EAAE,sBAAsB;oBAChC,OAAO,EAAE,IAAI;oBACb,OAAO,EACL,sFAAsF;iBACzF,CAAC;YACJ,CAAC;YACD,IACE,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBACtC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC;gBACpC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAC7B,CAAC;gBACD,OAAO;oBACL,QAAQ,EAAE,gBAAgB;oBAC1B,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,yEAAyE;iBACnF,CAAC;YACJ,CAAC;YACD,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClC,OAAO;oBACL,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,KAAK;oBACd,OAAO,EACL,yEAAyE;iBAC5E,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO;YACL,QAAQ,EAAE,gBAAgB;YAC1B,OAAO,EAAE,KAAK;YACd,OAAO,EACL,6EAA6E;SAChF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO;YACL,QAAQ,EAAE,eAAe;YACzB,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,8DAA8D;SACxE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO;YACL,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE,KAAK;YACd,OAAO,EACL,4FAA4F;SAC/F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,wDAAwD;KAClE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,QAAwC;IAExC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,gBAAgB;YACnB,OAAO,uDAAuD,CAAC;QACjE,KAAK,gBAAgB;YACnB,OAAO,oDAAoD,CAAC;QAC9D,KAAK,sBAAsB;YACzB,OAAO,qEAAqE,CAAC;QAC/E,KAAK,eAAe;YAClB,OAAO,2DAA2D,CAAC;QACrE,KAAK,iBAAiB;YACpB,OAAO,oEAAoE,CAAC;QAC9E,KAAK,mBAAmB;YACtB,OAAO,uDAAuD,CAAC;QACjE,KAAK,gBAAgB;YACnB,OAAO,8CAA8C,CAAC;QACxD,KAAK,uBAAuB;YAC1B,OAAO,sDAAsD,CAAC;QAChE,KAAK,sBAAsB;YACzB,OAAO,gDAAgD,CAAC;QAC1D,KAAK,mBAAmB;YACtB,OAAO,qDAAqD,CAAC;QAC/D,KAAK,qBAAqB;YACxB,OAAO,4EAA4E,CAAC;QACtF;YACE,OAAO,2CAA2C,CAAC;IACvD,CAAC;AACH,CAAC"}
+{"version":3,"file":"workflow-install-merge-errors.js","sourceRoot":"","sources":["../../src/setup/workflow-install-merge-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAU/D,MAAM,UAAU,qCAAqC,CACnD,KAAiD;IAMjD,MAAM,UAAU,GAAG,CACjB,KAAK,CAAC,OAAO;QACb,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAC3E,CAAC,WAAW,EAAE,CAAC;IAEhB,IAAI,KAAK,CAAC,WAAW,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,WAAW,CAAC,cAAc,KAAK,gBAAgB,EAAE,CAAC;YAC1D,OAAO;gBACL,QAAQ,EAAE,gBAAgB;gBAC1B,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM;aAClC,CAAC;QACJ,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,gBAAgB;YAC1B,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM;SAClC,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,YAAY,cAAc,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7D,IACE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC7B,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC/B,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EACzC,CAAC;gBACD,OAAO;oBACL,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,KAAK;oBACd,OAAO,EACL,yEAAyE;iBAC5E,CAAC;YACJ,CAAC;YACD,IACE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC7B,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC;gBACpC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,EACnC,CAAC;gBACD,OAAO;oBACL,QAAQ,EAAE,mBAAmB;oBAC7B,OAAO,EAAE,KAAK;oBACd,OAAO,EACL,mFAAmF;iBACtF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,mBAAmB;gBAC7B,OAAO,EAAE,KAAK;gBACd,OAAO,EACL,6EAA6E;aAChF,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC/B,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,mBAAmB,EAAE,CAAC;gBAC5D,OAAO;oBACL,QAAQ,EAAE,mBAAmB;oBAC7B,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,yCAAyC;iBACnD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC/B,OAAO;gBACL,QAAQ,EAAE,gBAAgB;gBAC1B,OAAO,EAAE,KAAK;gBACd,OAAO,EACL,6EAA6E;aAChF,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC/B,IACE,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAClC,UAAU,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EACvC,CAAC;gBACD,OAAO;oBACL,QAAQ,EAAE,sBAAsB;oBAChC,OAAO,EAAE,KAAK;oBACd,OAAO,EACL,+FAA+F;iBAClG,CAAC;YACJ,CAAC;YACD,IACE,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC/B,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,EACpC,CAAC;gBACD,OAAO;oBACL,QAAQ,EAAE,sBAAsB;oBAChC,OAAO,EAAE,IAAI;oBACb,OAAO,EACL,sFAAsF;iBACzF,CAAC;YACJ,CAAC;YACD,IACE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC7B,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC/B,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EACzC,CAAC;gBACD,OAAO;oBACL,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,KAAK;oBACd,OAAO,EACL,yEAAyE;iBAC5E,CAAC;YACJ,CAAC;YACD,IACE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC7B,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC;gBACpC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,EACnC,CAAC;gBACD,OAAO;oBACL,QAAQ,EAAE,mBAAmB;oBAC7B,OAAO,EAAE,KAAK;oBACd,OAAO,EACL,mFAAmF;iBACtF,CAAC;YACJ,CAAC;YACD,IACE,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC;gBACnC,UAAU,CAAC,QAAQ,CAAC,mBAAmB,CAAC;gBACxC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EACjC,CAAC;gBACD,OAAO;oBACL,QAAQ,EAAE,mBAAmB;oBAC7B,OAAO,EAAE,KAAK;oBACd,OAAO,EACL,8EAA8E;iBACjF,CAAC;YACJ,CAAC;YACD,IAAI,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBACtC,OAAO;oBACL,QAAQ,EAAE,mBAAmB;oBAC7B,OAAO,EAAE,KAAK;oBACd,OAAO,EACL,qFAAqF;iBACxF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO;YACL,QAAQ,EAAE,gBAAgB;YAC1B,OAAO,EAAE,KAAK;YACd,OAAO,EACL,6EAA6E;SAChF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO;YACL,QAAQ,EAAE,eAAe;YACzB,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,8DAA8D;SACxE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,wDAAwD;KAClE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,QAAwC;IAExC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,gBAAgB;YACnB,OAAO,uDAAuD,CAAC;QACjE,KAAK,gBAAgB;YACnB,OAAO,oDAAoD,CAAC;QAC9D,KAAK,sBAAsB;YACzB,OAAO,qEAAqE,CAAC;QAC/E,KAAK,eAAe;YAClB,OAAO,yCAAyC,CAAC;QACnD,KAAK,iBAAiB;YACpB,OAAO,oEAAoE,CAAC;QAC9E,KAAK,mBAAmB;YACtB,OAAO,uDAAuD,CAAC;QACjE,KAAK,gBAAgB;YACnB,OAAO,8CAA8C,CAAC;QACxD,KAAK,uBAAuB;YAC1B,OAAO,sDAAsD,CAAC;QAChE,KAAK,sBAAsB;YACzB,OAAO,gDAAgD,CAAC;QAC1D,KAAK,mBAAmB;YACtB,OAAO,qDAAqD,CAAC;QAC/D,KAAK,qBAAqB;YACxB,OAAO,4EAA4E,CAAC;QACtF;YACE,OAAO,2CAA2C,CAAC;IACvD,CAAC;AACH,CAAC"}

package/dist/setup/workflow-install-merge-gate.d.ts

@@ -0,0 +1,10 @@
+export interface WorkflowInstallMergeGateInput {
+    mergeableState: string | null;
+    mergeable: boolean | null;
+}
+/**
+ * Whether workflow-install finalization should call the GitHub merge API after
+ * harness safety checks pass. Branch-behind handling stays upstream.
+ */
+export declare function shouldAttemptMerge(input: WorkflowInstallMergeGateInput): boolean;
+//# sourceMappingURL=workflow-install-merge-gate.d.ts.map

package/dist/setup/workflow-install-merge-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-install-merge-gate.d.ts","sourceRoot":"","sources":["../../src/setup/workflow-install-merge-gate.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,6BAA6B;IAC5C,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAehF"}

package/dist/setup/workflow-install-merge-gate.js

@@ -0,0 +1,21 @@
+/**
+ * Whether workflow-install finalization should call the GitHub merge API after
+ * harness safety checks pass. Branch-behind handling stays upstream.
+ */
+export function shouldAttemptMerge(input) {
+    const state = input.mergeableState?.toLowerCase() ?? null;
+    if (input.mergeable === false) {
+        return false;
+    }
+    if (state === "dirty") {
+        return false;
+    }
+    if (input.mergeable === null || state === "unknown") {
+        return false;
+    }
+    if (state === "behind") {
+        return false;
+    }
+    return true;
+}
+//# sourceMappingURL=workflow-install-merge-gate.js.map

package/dist/setup/workflow-install-merge-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-install-merge-gate.js","sourceRoot":"","sources":["../../src/setup/workflow-install-merge-gate.ts"],"names":[],"mappings":"AAKA;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAoC;IACrE,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC;IAC1D,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/setup/workflow-model-save-queue.d.ts

@@ -0,0 +1,16 @@
+import type { GitHubRemoteSetupProvider } from "./github-remote-provider.js";
+import { type WorkflowModelSaveRequest, type WorkflowModelSaveResult } from "./workflow-model-sync.js";
+export type WorkflowModelSaveQueueOutcome = {
+    kind: "committed";
+    result: WorkflowModelSaveResult;
+} | {
+    kind: "superseded";
+    result: WorkflowModelSaveResult;
+};
+export declare function enqueueWorkflowModelSave(input: {
+    cwd: string;
+    request: WorkflowModelSaveRequest;
+    provider?: GitHubRemoteSetupProvider;
+}): Promise<WorkflowModelSaveQueueOutcome>;
+export declare function resetWorkflowModelSaveQueueForTests(): void;
+//# sourceMappingURL=workflow-model-save-queue.d.ts.map

package/dist/setup/workflow-model-save-queue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-model-save-queue.d.ts","sourceRoot":"","sources":["../../src/setup/workflow-model-save-queue.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAGL,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC7B,MAAM,0BAA0B,CAAC;AAKlC,MAAM,MAAM,6BAA6B,GACrC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,CAAC;AA2M5D,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,wBAAwB,CAAC;IAClC,QAAQ,CAAC,EAAE,yBAAyB,CAAC;CACtC,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAmBzC;AAED,wBAAgB,mCAAmC,IAAI,IAAI,CAQ1D"}