patchrelay 0.35.11 → 0.35.13

package/dist/github-webhook-handler.js

@@ -4,8 +4,9 @@ import { normalizeGitHubWebhook, verifyGitHubWebhookSignature } from "./github-w
 import { buildAgentSessionPlanForIssue } from "./agent-session-plan.js";
 import { buildAgentSessionExternalUrls } from "./agent-session-presentation.js";
 import { buildGitHubStateActivity } from "./linear-session-reporting.js";
-import { requestMergeQueueAdmission, resolveMergeQueueProtocol, } from "./merge-queue-protocol.js";
+import { resolveMergeQueueProtocol, } from "./merge-queue-protocol.js";
 import { buildQueueRepairContextFromEvent } from "./merge-queue-incident.js";
+import { resolvePreferredCompletedLinearState } from "./linear-workflow.js";
 import { resolveSecret } from "./resolve-secret.js";
 import { safeJsonParse } from "./utils.js";
 /**
@@ -20,6 +21,7 @@ function isMetadataOnlyCheckEvent(event) {
     return event.eventSource === "check_run"
         && (event.triggerEvent === "check_passed" || event.triggerEvent === "check_failed");
 }
+const DEFAULT_GATE_CHECK_NAMES = ["verify", "tests"];
 export class GitHubWebhookHandler {
     config;
     db;
@@ -30,7 +32,9 @@ export class GitHubWebhookHandler {
     feed;
     failureContextResolver;
     ciSnapshotResolver;
-    constructor(config, db, linearProvider, enqueueIssue, logger, codex, feed, failureContextResolver = createGitHubFailureContextResolver(), ciSnapshotResolver = createGitHubCiSnapshotResolver()) {
+    fetchImpl;
+    patchRelayAuthorLogins = new Set();
+    constructor(config, db, linearProvider, enqueueIssue, logger, codex, feed, failureContextResolver = createGitHubFailureContextResolver(), ciSnapshotResolver = createGitHubCiSnapshotResolver(), fetchImpl = fetch) {
         this.config = config;
         this.db = db;
         this.linearProvider = linearProvider;
@@ -40,6 +44,19 @@ export class GitHubWebhookHandler {
         this.feed = feed;
         this.failureContextResolver = failureContextResolver;
         this.ciSnapshotResolver = ciSnapshotResolver;
+        this.fetchImpl = fetchImpl;
+        for (const login of resolvePatchRelayAuthorLoginsFromEnv()) {
+            this.patchRelayAuthorLogins.add(login);
+        }
+    }
+    setPatchRelayAuthorLogins(logins) {
+        this.patchRelayAuthorLogins.clear();
+        for (const login of logins) {
+            const normalized = normalizeAuthorLogin(login);
+            if (normalized) {
+                this.patchRelayAuthorLogins.add(normalized);
+            }
+        }
     }
     async acceptGitHubWebhook(params) {
         // Deduplicate
@@ -126,44 +143,30 @@ export class GitHubWebhookHandler {
             ...(event.prNumber !== undefined ? { prNumber: event.prNumber } : {}),
             ...(event.prUrl !== undefined ? { prUrl: event.prUrl } : {}),
             ...(event.prState !== undefined ? { prState: event.prState } : {}),
+            ...(event.headSha !== undefined ? { prHeadSha: event.headSha } : {}),
+            ...(event.prAuthorLogin !== undefined ? { prAuthorLogin: event.prAuthorLogin } : {}),
             ...(event.reviewState !== undefined ? { prReviewState: event.reviewState } : {}),
             ...(event.checkStatus !== undefined ? { prCheckStatus: event.checkStatus } : {}),
         });
         await this.updateCiSnapshot(issue, event, project);
         await this.updateFailureProvenance(issue, event, project);
-        if (!isMetadataOnlyCheckEvent(event)) {
+        const queueEvictionCheck = this.isQueueEvictionFailure(issue, event, project);
+        if (!isMetadataOnlyCheckEvent(event) || queueEvictionCheck) {
             // Re-read issue after PR metadata upsert so guards see fresh prReviewState
             const afterMetadata = this.db.getIssue(issue.projectId, issue.linearIssueId) ?? issue;
-            const newState = resolveFactoryStateFromGitHub(event.triggerEvent, afterMetadata.factoryState, {
-                prReviewState: afterMetadata.prReviewState,
-                activeRunId: afterMetadata.activeRunId,
-            });
+            const newState = this.resolveFactoryStateForEvent(afterMetadata, event, project);
             // Only transition and notify when the state actually changes.
             // Multiple check_suite events can arrive for the same outcome.
             if (newState && newState !== afterMetadata.factoryState) {
-                this.db.upsertIssue({
+                this.db.upsertIssueRespectingActiveLease(issue.projectId, issue.linearIssueId, {
                     projectId: issue.projectId,
                     linearIssueId: issue.linearIssueId,
                     factoryState: newState,
                 });
-                if (newState === "awaiting_queue") {
-                    this.db.setBranchOwner(issue.projectId, issue.linearIssueId, "merge_steward");
-                }
                 this.logger.info({ issueKey: issue.issueKey, from: afterMetadata.factoryState, to: newState, trigger: event.triggerEvent }, "Factory state transition from GitHub event");
                 const transitionedIssue = this.db.getIssue(issue.projectId, issue.linearIssueId) ?? issue;
                 void this.emitLinearActivity(transitionedIssue, newState, event);
                 void this.syncLinearSession(transitionedIssue);
-                // Schedule merge prep when entering awaiting_queue
-                if (newState === "awaiting_queue") {
-                    const proj = this.config.projects.find((p) => p.id === issue.projectId);
-                    const protocol = resolveMergeQueueProtocol(proj);
-                    void requestMergeQueueAdmission({
-                        issue: transitionedIssue,
-                        protocol,
-                        logger: this.logger,
-                        feed: this.feed,
-                    });
-                }
             }
         }
         // Re-read issue after all upserts so reactive run logic sees current state
@@ -171,7 +174,7 @@ export class GitHubWebhookHandler {
         // Reset repair counters on new push — but only when no repair run is active,
         // since Codex pushes during repair and resetting mid-run would bypass budgets.
         if (event.triggerEvent === "pr_synchronize" && !freshIssue.activeRunId) {
-            this.db.upsertIssue({
+            this.db.upsertIssueRespectingActiveLease(issue.projectId, issue.linearIssueId, {
                 projectId: issue.projectId,
                 linearIssueId: issue.linearIssueId,
                 ciRepairAttempts: 0,
@@ -192,6 +195,7 @@ export class GitHubWebhookHandler {
                 lastAttemptedFailureHeadSha: null,
                 lastAttemptedFailureSignature: null,
             });
+            await this.maybeRequestRereviewAfterPush(freshIssue, event, project);
         }
         this.logger.info({ issueKey: issue.issueKey, branchName: event.branchName, triggerEvent: event.triggerEvent, prNumber: event.prNumber }, "GitHub webhook: updated issue PR state");
         this.feed?.publish({
@@ -207,12 +211,28 @@ export class GitHubWebhookHandler {
         // Queue eviction check runs bypass the metadata-only filter because
         // they're individual check_run events (not check_suite), but they
         // must drive state transitions.
-        if (this.isQueueEvictionFailure(freshIssue, event, project) || this.isGateCheckEvent(event, project)) {
+        if (queueEvictionCheck || this.isGateCheckEvent(event, project)) {
             await this.maybeEnqueueReactiveRun(freshIssue, event, project);
         }
         else if (!isMetadataOnlyCheckEvent(event)) {
             await this.maybeEnqueueReactiveRun(freshIssue, event, project);
         }
+        if (event.triggerEvent === "pr_merged" || event.triggerEvent === "pr_closed") {
+            await this.handleTerminalPrEvent(freshIssue, event);
+        }
+    }
+    resolveFactoryStateForEvent(issue, event, project) {
+        if (event.triggerEvent === "check_failed"
+            && this.isQueueEvictionFailure(issue, event, project)
+            && issue.prState === "open"
+            && issue.activeRunId === undefined
+            && !TERMINAL_STATES.has(issue.factoryState)) {
+            return "repairing_queue";
+        }
+        return resolveFactoryStateFromGitHub(event.triggerEvent, issue.factoryState, {
+            prReviewState: issue.prReviewState,
+            activeRunId: issue.activeRunId,
+        });
     }
     async updateCiSnapshot(issue, event, project) {
         if (event.triggerEvent === "pr_merged") {
@@ -279,6 +299,7 @@ export class GitHubWebhookHandler {
         this.db.upsertIssue({
             projectId: issue.projectId,
             linearIssueId: issue.linearIssueId,
+            prCheckStatus: snapshot.gateCheckStatus,
             lastGitHubCiSnapshotHeadSha: snapshot.headSha,
             lastGitHubCiSnapshotGateCheckName: snapshot.gateCheckName ?? this.getPrimaryGateCheckName(project),
             lastGitHubCiSnapshotGateCheckStatus: snapshot.gateCheckStatus,
@@ -294,6 +315,18 @@ export class GitHubWebhookHandler {
         // merge_group_failed after pr_merged) must not resurrect done issues.
         if (TERMINAL_STATES.has(issue.factoryState))
             return;
+        if (!this.isPatchRelayOwnedPr(issue)) {
+            this.feed?.publish({
+                level: "info",
+                kind: "github",
+                issueKey: issue.issueKey,
+                projectId: issue.projectId,
+                stage: issue.factoryState,
+                status: "ignored_non_patchrelay_pr",
+                summary: `Ignored ${event.triggerEvent} on non-PatchRelay-owned PR`,
+            });
+            return;
+        }
         if (event.triggerEvent === "check_failed" && issue.prState === "open") {
             // External merge queue eviction: react only to the configured check
             // name, not to any CI failure. Regular CI failures still get ci_repair.
@@ -303,14 +336,10 @@ export class GitHubWebhookHandler {
                 if (this.hasDuplicatePendingReactiveRun(issue, "queue_repair", failureContext)) {
                     return;
                 }
+                const hadPendingWake = this.db.hasPendingIssueSessionEvents(issue.projectId, issue.linearIssueId);
                 this.db.upsertIssue({
                     projectId: issue.projectId,
                     linearIssueId: issue.linearIssueId,
-                    pendingRunType: "queue_repair",
-                    pendingRunContextJson: JSON.stringify({
-                        ...queueRepairContext,
-                        ...failureContext,
-                    }),
                     lastGitHubFailureSource: "queue_eviction",
                     lastGitHubFailureHeadSha: failureContext.failureHeadSha ?? null,
                     lastGitHubFailureSignature: failureContext.failureSignature ?? null,
@@ -321,8 +350,20 @@ export class GitHubWebhookHandler {
                     lastQueueSignalAt: new Date().toISOString(),
                     lastQueueIncidentJson: JSON.stringify(queueRepairContext),
                 });
-                this.db.setBranchOwner(issue.projectId, issue.linearIssueId, "patchrelay");
-                this.enqueueIssue(issue.projectId, issue.linearIssueId);
+                this.db.appendIssueSessionEventRespectingActiveLease(issue.projectId, issue.linearIssueId, {
+                    projectId: issue.projectId,
+                    linearIssueId: issue.linearIssueId,
+                    eventType: "merge_steward_incident",
+                    eventJson: JSON.stringify({
+                        ...queueRepairContext,
+                        ...failureContext,
+                    }),
+                    dedupeKey: failureContext.failureSignature,
+                });
+                this.db.setBranchOwnerRespectingActiveLease(issue.projectId, issue.linearIssueId, "patchrelay");
+                const queuedRunType = hadPendingWake
+                    ? this.peekPendingSessionWakeRunType(issue.projectId, issue.linearIssueId)
+                    : this.enqueuePendingSessionWake(issue.projectId, issue.linearIssueId);
                 this.logger.info({ issueKey: issue.issueKey, checkName: event.checkName }, "Queue eviction detected, enqueued queue repair");
                 this.feed?.publish({
                     level: "warn",
@@ -331,7 +372,7 @@ export class GitHubWebhookHandler {
                     projectId: issue.projectId,
                     stage: "repairing_queue",
                     status: "queue_repair_queued",
-                    summary: `Queue repair queued after external failure from ${event.checkName}`,
+                    summary: `${queuedRunType ?? "queue_repair"} queued after external failure from ${event.checkName}`,
                     detail: queueRepairContext.incidentSummary ?? queueRepairContext.incidentUrl ?? event.checkUrl,
                 });
             }
@@ -352,16 +393,11 @@ export class GitHubWebhookHandler {
                 if (this.hasDuplicatePendingReactiveRun(issue, "ci_repair", failureContext)) {
                     return;
                 }
+                const hadPendingWake = this.db.hasPendingIssueSessionEvents(issue.projectId, issue.linearIssueId);
                 const snapshot = this.getRelevantCiSnapshot(issue, event);
                 this.db.upsertIssue({
                     projectId: issue.projectId,
                     linearIssueId: issue.linearIssueId,
-                    pendingRunType: "ci_repair",
-                    pendingRunContextJson: JSON.stringify({
-                        ...failureContext,
-                        checkClass: resolveCheckClass(failureContext.checkName ?? event.checkName, project),
-                        ...(snapshot ? { ciSnapshot: snapshot } : {}),
-                    }),
                     lastGitHubFailureSource: "branch_ci",
                     lastGitHubFailureHeadSha: failureContext.failureHeadSha ?? null,
                     lastGitHubFailureSignature: failureContext.failureSignature ?? null,
@@ -371,8 +407,21 @@ export class GitHubWebhookHandler {
                     lastGitHubFailureAt: new Date().toISOString(),
                     lastQueueIncidentJson: null,
                 });
-                this.db.setBranchOwner(issue.projectId, issue.linearIssueId, "patchrelay");
-                this.enqueueIssue(issue.projectId, issue.linearIssueId);
+                this.db.appendIssueSessionEventRespectingActiveLease(issue.projectId, issue.linearIssueId, {
+                    projectId: issue.projectId,
+                    linearIssueId: issue.linearIssueId,
+                    eventType: "settled_red_ci",
+                    eventJson: JSON.stringify({
+                        ...failureContext,
+                        checkClass: resolveCheckClass(failureContext.checkName ?? event.checkName, project),
+                        ...(snapshot ? { ciSnapshot: snapshot } : {}),
+                    }),
+                    dedupeKey: failureContext.failureSignature,
+                });
+                this.db.setBranchOwnerRespectingActiveLease(issue.projectId, issue.linearIssueId, "patchrelay");
+                const queuedRunType = hadPendingWake
+                    ? this.peekPendingSessionWakeRunType(issue.projectId, issue.linearIssueId)
+                    : this.enqueuePendingSessionWake(issue.projectId, issue.linearIssueId);
                 this.logger.info({ issueKey: issue.issueKey, checkName: failureContext.checkName ?? event.checkName }, "Enqueued CI repair run");
                 this.feed?.publish({
                     level: "warn",
@@ -381,24 +430,145 @@ export class GitHubWebhookHandler {
                     projectId: issue.projectId,
                     stage: "repairing_ci",
                     status: "ci_repair_queued",
-                    summary: `CI repair queued for ${failureContext.jobName ?? failureContext.checkName ?? "failed check"}`,
+                    summary: `${queuedRunType ?? "ci_repair"} queued for ${failureContext.jobName ?? failureContext.checkName ?? "failed check"}`,
                     detail: summarizeGitHubFailureContext(failureContext),
                 });
             }
         }
         if (event.triggerEvent === "review_changes_requested") {
-            this.db.upsertIssue({
+            const hadPendingWake = this.db.hasPendingIssueSessionEvents(issue.projectId, issue.linearIssueId);
+            const reviewComments = await this.fetchReviewCommentsForEvent(event).catch((error) => {
+                this.logger.warn({
+                    issueKey: issue.issueKey,
+                    prNumber: event.prNumber,
+                    reviewId: event.reviewId,
+                    error: error instanceof Error ? error.message : String(error),
+                }, "Failed to fetch inline review comments for requested-changes event");
+                return undefined;
+            });
+            this.db.appendIssueSessionEventRespectingActiveLease(issue.projectId, issue.linearIssueId, {
                 projectId: issue.projectId,
                 linearIssueId: issue.linearIssueId,
-                pendingRunType: "review_fix",
-                pendingRunContextJson: JSON.stringify({
+                eventType: "review_changes_requested",
+                eventJson: JSON.stringify({
                     reviewBody: event.reviewBody,
+                    reviewCommitId: event.reviewCommitId,
+                    reviewId: event.reviewId,
+                    reviewUrl: buildGitHubReviewUrl(event.repoFullName, event.prNumber, event.reviewId),
                     reviewerName: event.reviewerName,
+                    ...(reviewComments && reviewComments.length > 0 ? { reviewComments } : {}),
                 }),
+                dedupeKey: [
+                    "review_changes_requested",
+                    issue.prHeadSha ?? event.headSha ?? "unknown-sha",
+                    event.reviewerName ?? "unknown-reviewer",
+                ].join("::"),
             });
-            this.db.setBranchOwner(issue.projectId, issue.linearIssueId, "patchrelay");
-            this.enqueueIssue(issue.projectId, issue.linearIssueId);
+            this.db.setBranchOwnerRespectingActiveLease(issue.projectId, issue.linearIssueId, "patchrelay");
+            const queuedRunType = hadPendingWake
+                ? this.peekPendingSessionWakeRunType(issue.projectId, issue.linearIssueId)
+                : this.enqueuePendingSessionWake(issue.projectId, issue.linearIssueId);
             this.logger.info({ issueKey: issue.issueKey, reviewerName: event.reviewerName }, "Enqueued review fix run");
+            this.feed?.publish({
+                level: "warn",
+                kind: "github",
+                issueKey: issue.issueKey,
+                projectId: issue.projectId,
+                stage: "changes_requested",
+                status: "review_fix_queued",
+                summary: `${queuedRunType ?? "review_fix"} queued after requested changes`,
+                detail: reviewComments && reviewComments.length > 0
+                    ? `${reviewComments.length} inline review comment${reviewComments.length === 1 ? "" : "s"} captured`
+                    : event.reviewBody?.slice(0, 200) ?? event.reviewerName,
+            });
+        }
+    }
+    async handleTerminalPrEvent(issue, event) {
+        const eventType = event.triggerEvent === "pr_merged" ? "pr_merged" : "pr_closed";
+        this.db.appendIssueSessionEvent({
+            projectId: issue.projectId,
+            linearIssueId: issue.linearIssueId,
+            eventType,
+            dedupeKey: [eventType, issue.prNumber ?? event.prNumber ?? "unknown-pr", issue.prHeadSha ?? event.headSha ?? "unknown-sha"].join("::"),
+        });
+        this.db.clearPendingIssueSessionEventsRespectingActiveLease(issue.projectId, issue.linearIssueId);
+        const run = issue.activeRunId ? this.db.getRun(issue.activeRunId) : undefined;
+        if (run?.threadId && run.turnId) {
+            try {
+                await this.codex.steerTurn({
+                    threadId: run.threadId,
+                    turnId: run.turnId,
+                    input: event.triggerEvent === "pr_merged"
+                        ? "STOP: The pull request has already merged. Stop working immediately and exit without making further changes."
+                        : "STOP: The pull request was closed. Stop working immediately and exit without making further changes.",
+                });
+            }
+            catch (error) {
+                this.logger.warn({ issueKey: issue.issueKey, runId: run.id, error: error instanceof Error ? error.message : String(error) }, "Failed to steer active run after terminal PR event");
+            }
+        }
+        const commitTerminalUpdate = () => {
+            if (run) {
+                this.db.finishRun(run.id, {
+                    status: "released",
+                    failureReason: event.triggerEvent === "pr_merged"
+                        ? "Pull request merged during active run"
+                        : "Pull request closed during active run",
+                });
+            }
+            this.db.upsertIssue({
+                projectId: issue.projectId,
+                linearIssueId: issue.linearIssueId,
+                activeRunId: null,
+                factoryState: event.triggerEvent === "pr_merged" ? "done" : "failed",
+            });
+        };
+        const activeLease = this.db.getActiveIssueSessionLease(issue.projectId, issue.linearIssueId);
+        if (activeLease) {
+            this.db.withIssueSessionLease(issue.projectId, issue.linearIssueId, activeLease.leaseId, commitTerminalUpdate);
+        }
+        else {
+            this.db.transaction(commitTerminalUpdate);
+        }
+        this.db.releaseIssueSessionLeaseRespectingActiveLease(issue.projectId, issue.linearIssueId);
+        const updatedIssue = this.db.getIssue(issue.projectId, issue.linearIssueId) ?? issue;
+        if (event.triggerEvent === "pr_merged") {
+            await this.completeLinearIssueAfterMerge(updatedIssue);
+        }
+        void this.syncLinearSession(updatedIssue);
+    }
+    async completeLinearIssueAfterMerge(issue) {
+        const linear = await this.linearProvider.forProject(issue.projectId).catch(() => undefined);
+        if (!linear)
+            return;
+        try {
+            const liveIssue = await linear.getIssue(issue.linearIssueId);
+            const targetState = resolvePreferredCompletedLinearState(liveIssue);
+            if (!targetState) {
+                this.logger.warn({ issueKey: issue.issueKey }, "Could not find a completed Linear workflow state after merge");
+                return;
+            }
+            const normalizedCurrent = liveIssue.stateName?.trim().toLowerCase();
+            if (normalizedCurrent === targetState.trim().toLowerCase()) {
+                this.db.upsertIssue({
+                    projectId: issue.projectId,
+                    linearIssueId: issue.linearIssueId,
+                    ...(liveIssue.stateName ? { currentLinearState: liveIssue.stateName } : {}),
+                    ...(liveIssue.stateType ? { currentLinearStateType: liveIssue.stateType } : {}),
+                });
+                return;
+            }
+            const updated = await linear.setIssueState(issue.linearIssueId, targetState);
+            this.db.upsertIssue({
+                projectId: issue.projectId,
+                linearIssueId: issue.linearIssueId,
+                ...(updated.stateName ? { currentLinearState: updated.stateName } : {}),
+                ...(updated.stateType ? { currentLinearStateType: updated.stateType } : {}),
+            });
+        }
+        catch (error) {
+            const msg = error instanceof Error ? error.message : String(error);
+            this.logger.warn({ issueKey: issue.issueKey, error: msg }, "Failed to move merged issue to a completed Linear state");
         }
     }
     async updateFailureProvenance(issue, event, project) {
@@ -511,8 +681,9 @@ export class GitHubWebhookHandler {
             : typeof failureContext.headSha === "string" ? failureContext.headSha : undefined;
         if (!signature)
             return false;
-        if (issue.pendingRunType === runType && issue.pendingRunContextJson) {
-            const existing = safeJsonParse(issue.pendingRunContextJson);
+        const pendingWake = this.db.peekIssueSessionWake(issue.projectId, issue.linearIssueId);
+        if (pendingWake?.runType === runType) {
+            const existing = pendingWake.context;
             if (existing?.failureSignature === signature
                 && (headSha === undefined || existing.failureHeadSha === headSha || existing.headSha === headSha)) {
                 this.feed?.publish({
@@ -544,10 +715,10 @@ export class GitHubWebhookHandler {
     }
     getGateCheckNames(project) {
         const configured = (project?.gateChecks ?? []).map((entry) => entry.trim()).filter(Boolean);
-        return configured.length > 0 ? configured : ["Tests"];
+        return configured.length > 0 ? configured : DEFAULT_GATE_CHECK_NAMES;
     }
     getPrimaryGateCheckName(project) {
-        return this.getGateCheckNames(project)[0] ?? "Tests";
+        return this.getGateCheckNames(project)[0] ?? "verify";
     }
     isGateCheckEvent(event, project) {
         if (event.eventSource !== "check_run" || !event.checkName)
@@ -562,8 +733,7 @@ export class GitHubWebhookHandler {
     }
     isQueueEvictionFailure(issue, event, project) {
         const protocol = resolveMergeQueueProtocol(project);
-        return issue.factoryState === "awaiting_queue"
-            && event.eventSource === "check_run"
+        return event.eventSource === "check_run"
             && event.checkName === protocol.evictionCheckName;
     }
     isSettledBranchFailure(issue, event, project) {
@@ -653,6 +823,64 @@ export class GitHubWebhookHandler {
             this.logger.warn({ issueKey: issue.issueKey, error: msg }, "Failed to sync Linear session from GitHub webhook");
         }
     }
+    async fetchReviewCommentsForEvent(event) {
+        if (event.triggerEvent !== "review_changes_requested") {
+            return undefined;
+        }
+        if (!event.repoFullName || event.prNumber === undefined || event.reviewId === undefined) {
+            return undefined;
+        }
+        const token = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN;
+        if (!token) {
+            this.logger.debug({ prNumber: event.prNumber, reviewId: event.reviewId }, "Skipping inline review comment fetch because no GitHub API token is available");
+            return undefined;
+        }
+        const [owner, repo] = event.repoFullName.split("/", 2);
+        if (!owner || !repo) {
+            return undefined;
+        }
+        const response = await this.fetchImpl(`https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/pulls/${event.prNumber}/reviews/${event.reviewId}/comments?per_page=100`, {
+            headers: {
+                Authorization: `Bearer ${token}`,
+                Accept: "application/vnd.github+json",
+                "User-Agent": "patchrelay",
+                "X-GitHub-Api-Version": "2022-11-28",
+            },
+        });
+        if (!response.ok) {
+            throw new Error(`GitHub review comment fetch failed (${response.status})`);
+        }
+        const payload = await response.json();
+        if (!Array.isArray(payload)) {
+            return undefined;
+        }
+        const comments = [];
+        for (const entry of payload) {
+            if (!entry || typeof entry !== "object")
+                continue;
+            const record = entry;
+            const body = typeof record.body === "string" ? record.body.trim() : "";
+            const id = typeof record.id === "number" ? record.id : undefined;
+            if (!body || id === undefined)
+                continue;
+            comments.push({
+                id,
+                body,
+                ...(typeof record.path === "string" ? { path: record.path } : {}),
+                ...(typeof record.line === "number" ? { line: record.line } : {}),
+                ...(typeof record.side === "string" ? { side: record.side } : {}),
+                ...(typeof record.start_line === "number" ? { startLine: record.start_line } : {}),
+                ...(typeof record.start_side === "string" ? { startSide: record.start_side } : {}),
+                ...(typeof record.commit_id === "string" ? { commitId: record.commit_id } : {}),
+                ...(typeof record.html_url === "string" ? { url: record.html_url } : {}),
+                ...(typeof record.diff_hunk === "string" ? { diffHunk: record.diff_hunk } : {}),
+                ...(typeof record.user?.login === "string"
+                    ? { authorLogin: String(record.user.login) }
+                    : {}),
+            });
+        }
+        return comments;
+    }
     async handlePrComment(payload) {
         if (payload.action !== "created")
             return;
@@ -675,6 +903,8 @@ export class GitHubWebhookHandler {
         const issue = this.db.getIssueByPrNumber(prNumber);
         if (!issue)
             return;
+        if (!this.isPatchRelayOwnedPr(issue))
+            return;
         this.feed?.publish({
             level: "info",
             kind: "comment",
@@ -695,6 +925,7 @@ export class GitHubWebhookHandler {
                         input: `GitHub PR comment from ${author}:\n\n${body}`,
                     });
                     this.logger.info({ issueKey: issue.issueKey, author }, "Forwarded GitHub PR comment to active run");
+                    return;
                 }
                 catch (error) {
                     const msg = error instanceof Error ? error.message : String(error);
@@ -702,7 +933,147 @@ export class GitHubWebhookHandler {
                 }
             }
         }
+        this.db.appendIssueSessionEvent({
+            projectId: issue.projectId,
+            linearIssueId: issue.linearIssueId,
+            eventType: "followup_comment",
+            eventJson: JSON.stringify({ body, author }),
+        });
+        this.enqueuePendingSessionWake(issue.projectId, issue.linearIssueId);
+    }
+    async maybeRequestRereviewAfterPush(issue, event, project) {
+        if (event.triggerEvent !== "pr_synchronize")
+            return;
+        if (issue.activeRunId !== undefined)
+            return;
+        if (issue.prState !== "open" || issue.prReviewState !== "changes_requested" || issue.prNumber === undefined)
+            return;
+        if (!this.isPatchRelayOwnedPr(issue))
+            return;
+        const reviewerName = this.findLatestRequestedChangesReviewer(issue.projectId, issue.linearIssueId);
+        if (!reviewerName) {
+            this.logger.info({ issueKey: issue.issueKey, prNumber: issue.prNumber }, "Skipping auto re-review request because no prior reviewer was recorded");
+            return;
+        }
+        const repoFullName = project?.github?.repoFullName ?? event.repoFullName;
+        const token = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN;
+        if (!token) {
+            this.logger.warn({ issueKey: issue.issueKey, prNumber: issue.prNumber }, "Skipping auto re-review request because no GitHub token is available");
+            this.feed?.publish({
+                level: "warn",
+                kind: "github",
+                issueKey: issue.issueKey,
+                projectId: issue.projectId,
+                stage: issue.factoryState,
+                status: "rereview_request_skipped",
+                summary: `Skipped auto re-review request for PR #${issue.prNumber}`,
+                detail: "No GitHub token available for requested_reviewers API call",
+            });
+            return;
+        }
+        const response = await this.fetchImpl(`https://api.github.com/repos/${repoFullName}/pulls/${issue.prNumber}/requested_reviewers`, {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${token}`,
+                accept: "application/vnd.github+json",
+                "content-type": "application/json",
+                "user-agent": "patchrelay",
+            },
+            body: JSON.stringify({ reviewers: [reviewerName] }),
+        });
+        if (!response.ok) {
+            const detail = await this.readGitHubErrorResponse(response);
+            this.logger.warn({ issueKey: issue.issueKey, prNumber: issue.prNumber, reviewerName, status: response.status, detail }, "Failed to auto request re-review after push");
+            this.feed?.publish({
+                level: "warn",
+                kind: "github",
+                issueKey: issue.issueKey,
+                projectId: issue.projectId,
+                stage: issue.factoryState,
+                status: "rereview_request_failed",
+                summary: `Failed to auto request re-review from ${reviewerName}`,
+                detail,
+            });
+            return;
+        }
+        this.logger.info({ issueKey: issue.issueKey, prNumber: issue.prNumber, reviewerName }, "Auto requested re-review after push");
+        this.feed?.publish({
+            level: "info",
+            kind: "github",
+            issueKey: issue.issueKey,
+            projectId: issue.projectId,
+            stage: issue.factoryState,
+            status: "rereview_requested",
+            summary: `Requested re-review from ${reviewerName} on PR #${issue.prNumber}`,
+        });
+    }
+    findLatestRequestedChangesReviewer(projectId, linearIssueId) {
+        const event = this.db
+            .listIssueSessionEvents(projectId, linearIssueId)
+            .findLast((candidate) => candidate.eventType === "review_changes_requested");
+        if (!event?.eventJson)
+            return undefined;
+        const payload = safeJsonParse(event.eventJson);
+        return typeof payload?.reviewerName === "string" && payload.reviewerName.trim()
+            ? payload.reviewerName.trim()
+            : undefined;
+    }
+    async readGitHubErrorResponse(response) {
+        try {
+            const payload = await response.json();
+            if (typeof payload?.message === "string" && payload.message.trim()) {
+                return payload.message.trim();
+            }
+            if (payload?.errors !== undefined) {
+                return JSON.stringify(payload.errors);
+            }
+        }
+        catch {
+            // Fall through to status text.
+        }
+        return response.statusText || `GitHub API responded with ${response.status}`;
+    }
+    peekPendingSessionWakeRunType(projectId, issueId) {
+        return this.db.peekIssueSessionWake(projectId, issueId)?.runType;
+    }
+    enqueuePendingSessionWake(projectId, issueId) {
+        const wake = this.db.peekIssueSessionWake(projectId, issueId);
+        if (!wake) {
+            return undefined;
+        }
+        this.enqueueIssue(projectId, issueId);
+        return wake.runType;
+    }
+    isPatchRelayOwnedPr(issue) {
+        const author = normalizeAuthorLogin(issue.prAuthorLogin);
+        if (author) {
+            if (this.patchRelayAuthorLogins.size > 0) {
+                return this.patchRelayAuthorLogins.has(author);
+            }
+            return author.includes("patchrelay");
+        }
+        // Transitional fallback for rows written before author tracking existed.
+        return issue.prNumber !== undefined && issue.branchOwner === "patchrelay";
+    }
+}
+function normalizeAuthorLogin(login) {
+    const normalized = login?.trim().toLowerCase();
+    return normalized ? normalized : undefined;
+}
+function resolvePatchRelayAuthorLoginsFromEnv() {
+    return [
+        process.env.PATCHRELAY_GITHUB_BOT_LOGIN,
+        process.env.PATCHRELAY_GITHUB_BOT_NAME,
+    ]
+        .flatMap((value) => (value ?? "").split(","))
+        .map((value) => normalizeAuthorLogin(value))
+        .filter((value) => Boolean(value));
+}
+function buildGitHubReviewUrl(repoFullName, prNumber, reviewId) {
+    if (!repoFullName || prNumber === undefined || reviewId === undefined) {
+        return undefined;
     }
+    return `https://github.com/${repoFullName}/pull/${prNumber}#pullrequestreview-${reviewId}`;
 }
 function resolveCheckClass(checkName, project) {
     if (!checkName || !project)