patchrelay 0.74.0 → 0.74.1

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
   "service": "patchrelay",
-  "version": "0.74.0",
-  "commit": "d04d91223dec",
-  "builtAt": "2026-05-28T18:16:54.428Z"
+  "version": "0.74.1",
+  "commit": "7763c9d8b14a",
+  "builtAt": "2026-05-28T19:52:29.055Z"
 }

package/dist/cli/data.js

@@ -98,6 +98,9 @@ export class CliDataAccess extends CliOperatorApiClient {
         super(config);
         this.config = config;
         this.db = options?.db ?? new PatchRelayDatabase(config.database.path, config.database.wal);
+        if (!options?.db) {
+            this.db.assertSchemaReady();
+        }
         this.codex = options?.codex;
     }
     close() {

package/dist/db/schema-guard.js

@@ -0,0 +1,17 @@
+const REQUIRED_PATCHRELAY_TABLES = [
+    "issues",
+    "runs",
+    "issue_sessions",
+    "issue_session_events",
+];
+export function assertPatchRelaySchemaReady(connection, databasePath) {
+    const rows = connection
+        .prepare("SELECT name FROM sqlite_master WHERE type = 'table'")
+        .all();
+    const tables = new Set(rows.map((row) => String(row.name)));
+    const missing = REQUIRED_PATCHRELAY_TABLES.filter((table) => !tables.has(table));
+    if (missing.length === 0) {
+        return;
+    }
+    throw new Error(`PatchRelay database is uninitialized or points at the wrong path: ${databasePath}. Missing required table(s): ${missing.join(", ")}`);
+}

package/dist/db.js

@@ -7,6 +7,7 @@ import { RepositoryLinkStore } from "./db/repository-link-store.js";
 import { RunStore } from "./db/run-store.js";
 import { WebhookEventStore } from "./db/webhook-event-store.js";
 import { runPatchRelayMigrations } from "./db/migrations.js";
+import { assertPatchRelaySchemaReady } from "./db/schema-guard.js";
 import { SqliteConnection } from "./db/shared.js";
 import { syncIssueSessionFromIssue } from "./issue-session-projector.js";
 import { TrackedIssueQuery } from "./tracked-issue-query.js";
@@ -23,6 +24,7 @@ export class PatchRelayDatabase {
     runs;
     trackedIssues;
     constructor(databasePath, wal) {
+        this.databasePath = databasePath;
         this.connection = new SqliteConnection(databasePath);
         this.connection.pragma("foreign_keys = ON");
         if (wal) {
@@ -45,8 +47,13 @@ export class PatchRelayDatabase {
         this.workflowWakes = new WorkflowWakeResolver(this.issues, this.issueSessions);
         this.trackedIssues = new TrackedIssueQuery(this.issues, this.issueSessions, this.workflowWakes, this.runs);
     }
+    databasePath;
     runMigrations() {
         runPatchRelayMigrations(this.connection);
+        this.assertSchemaReady();
+    }
+    assertSchemaReady() {
+        assertPatchRelaySchemaReady(this.connection, this.databasePath);
     }
     transaction(fn) {
         return this.connection.transaction(fn)();

package/dist/github-cli-auth.js

@@ -1,5 +1,6 @@
 import { existsSync } from "node:fs";
 import { mkdir, writeFile } from "node:fs/promises";
+import { spawn } from "node:child_process";
 import path from "node:path";
 /**
  * Unified GitHub App credential delivery for `git` and the `gh` CLI.
@@ -88,3 +89,45 @@ export function buildAgentChildEnv(parentEnv = process.env) {
     delete env.GITHUB_TOKEN;
     return env;
 }
+export async function verifyGitHubCliAuthEnv(env = process.env, options = {}) {
+    const timeoutMs = options.timeoutMs ?? 10_000;
+    await new Promise((resolve, reject) => {
+        const child = spawn("git", ["credential", "fill"], {
+            env,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        let stderr = "";
+        let settled = false;
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            child.kill("SIGTERM");
+            reject(new Error(`GitHub git credential check timed out after ${timeoutMs}ms`));
+        }, timeoutMs);
+        timer.unref?.();
+        child.stderr.on("data", (chunk) => {
+            stderr += String(chunk);
+        });
+        child.on("error", (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            reject(error);
+        });
+        child.on("close", (code) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (code === 0) {
+                resolve();
+                return;
+            }
+            const detail = stderr.trim();
+            reject(new Error(`GitHub git credential check failed${detail ? `: ${detail}` : ""}`));
+        });
+        child.stdin.end(`protocol=https\nhost=${GITHUB_HOST}\n\n`);
+    });
+}

package/dist/preflight.js

@@ -1,6 +1,7 @@
 import { accessSync, constants, existsSync, mkdirSync, statSync } from "node:fs";
 import path from "node:path";
 import { runPatchRelayMigrations } from "./db/migrations.js";
+import { assertPatchRelaySchemaReady } from "./db/schema-guard.js";
 import { resolveMergeQueueProtocol } from "./merge-queue-protocol.js";
 import { SqliteConnection } from "./db/shared.js";
 import { execCommand } from "./utils.js";
@@ -132,6 +133,7 @@ function checkDatabaseHealth(config) {
             connection.pragma("journal_mode = WAL");
         }
         runPatchRelayMigrations(connection);
+        assertPatchRelaySchemaReady(connection, config.database.path);
         const quickCheck = connection.prepare("PRAGMA quick_check").get();
         const quickCheckResult = quickCheck ? Object.values(quickCheck)[0] : undefined;
         if (quickCheckResult !== "ok") {

package/dist/run-notification-handler.js

@@ -4,6 +4,7 @@ import { resolveRecoverablePostRunState } from "./interrupted-run-recovery.js";
 function isRequestedChangesRunType(runType) {
     return runType === "review_fix" || runType === "branch_upkeep";
 }
+const DEFAULT_PUBLISH_COMMAND_TIMEOUT_MS = 10 * 60 * 1000;
 export class RunNotificationHandler {
     config;
     db;
@@ -15,8 +16,10 @@ export class RunNotificationHandler {
     heartbeatIssueSessionLease;
     releaseIssueSessionLease;
     feed;
+    options;
     activeThreadId;
-    constructor(config, db, logger, linearSync, runFinalizer, readThreadWithRetry, withHeldIssueSessionLease, heartbeatIssueSessionLease, releaseIssueSessionLease, feed) {
+    publishCommandWatchdogs = new Map();
+    constructor(config, db, logger, linearSync, runFinalizer, readThreadWithRetry, withHeldIssueSessionLease, heartbeatIssueSessionLease, releaseIssueSessionLease, feed, options = {}) {
         this.config = config;
         this.db = db;
         this.logger = logger;
@@ -27,6 +30,7 @@ export class RunNotificationHandler {
         this.heartbeatIssueSessionLease = heartbeatIssueSessionLease;
         this.releaseIssueSessionLease = releaseIssueSessionLease;
         this.feed = feed;
+        this.options = options;
     }
     async handle(notification) {
         let threadId = typeof notification.params.threadId === "string" ? notification.params.threadId : undefined;
@@ -50,6 +54,7 @@ export class RunNotificationHandler {
             return;
         }
         const turnId = typeof notification.params.turnId === "string" ? notification.params.turnId : undefined;
+        this.observePublishCommand(notification, run, threadId, turnId ?? run.turnId);
         if (this.config.runner.codex.persistExtendedHistory) {
             this.db.runs.saveThreadEvent({
                 runId: run.id,
@@ -59,15 +64,13 @@ export class RunNotificationHandler {
                 eventJson: JSON.stringify(notification.params),
             });
         }
-        this.linearSync.maybeEmitProgress(notification, run);
+        this.maybeEmitProgress(notification, run);
         if (notification.method === "turn/plan/updated") {
-            const issue = this.db.issues.getIssue(run.projectId, run.linearIssueId);
-            if (issue) {
-                void this.linearSync.syncCodexPlan(issue, notification.params);
-            }
+            this.syncCodexPlan(notification, run);
         }
         if (notification.method !== "turn/completed")
             return;
+        this.clearPublishWatchdogsForThread(threadId);
         const thread = await this.readThreadWithRetry(threadId);
         const issue = this.db.issues.getIssue(run.projectId, run.linearIssueId);
         if (!issue)
@@ -137,4 +140,120 @@ export class RunNotificationHandler {
         });
         this.activeThreadId = undefined;
     }
+    observePublishCommand(notification, run, threadId, turnId) {
+        const item = notification.params.item;
+        if (!item || typeof item !== "object") {
+            return;
+        }
+        const itemRecord = item;
+        const itemId = typeof itemRecord.id === "string" ? itemRecord.id : undefined;
+        if (!itemId) {
+            return;
+        }
+        if (notification.method === "item/completed" || isTerminalItemUpdate(notification.method, itemRecord)) {
+            this.clearPublishWatchdog(threadId, itemId);
+            return;
+        }
+        if (notification.method !== "item/started" || itemRecord.type !== "commandExecution" || !turnId || !this.options.interruptTurn) {
+            return;
+        }
+        const command = extractCommandText(itemRecord.command);
+        if (!command || !isGitPushCommand(command)) {
+            return;
+        }
+        const key = publishWatchdogKey(threadId, itemId);
+        if (this.publishCommandWatchdogs.has(key)) {
+            return;
+        }
+        const timeoutMs = this.options.publishCommandTimeoutMs ?? DEFAULT_PUBLISH_COMMAND_TIMEOUT_MS;
+        const timer = setTimeout(() => {
+            this.publishCommandWatchdogs.delete(key);
+            this.logger.warn({ runId: run.id, projectId: run.projectId, issueId: run.linearIssueId, threadId, turnId, timeoutMs }, "Interrupting stuck git push command");
+            this.feed?.publish({
+                level: "error",
+                kind: "turn",
+                projectId: run.projectId,
+                stage: run.runType,
+                status: "interrupted",
+                summary: `Interrupted stuck publish command after ${Math.round(timeoutMs / 1000)}s`,
+            });
+            void this.options.interruptTurn?.({ threadId, turnId }).catch((error) => {
+                this.logger.warn({ runId: run.id, projectId: run.projectId, issueId: run.linearIssueId, threadId, turnId, error: formatError(error) }, "Failed to interrupt stuck git push command");
+            });
+        }, timeoutMs);
+        timer.unref?.();
+        this.publishCommandWatchdogs.set(key, timer);
+    }
+    clearPublishWatchdog(threadId, itemId) {
+        const key = publishWatchdogKey(threadId, itemId);
+        const timer = this.publishCommandWatchdogs.get(key);
+        if (!timer) {
+            return;
+        }
+        clearTimeout(timer);
+        this.publishCommandWatchdogs.delete(key);
+    }
+    clearPublishWatchdogsForThread(threadId) {
+        for (const [key, timer] of this.publishCommandWatchdogs) {
+            if (!key.startsWith(`${threadId}:`)) {
+                continue;
+            }
+            clearTimeout(timer);
+            this.publishCommandWatchdogs.delete(key);
+        }
+    }
+    maybeEmitProgress(notification, run) {
+        try {
+            this.linearSync.maybeEmitProgress(notification, run);
+        }
+        catch (error) {
+            this.logger.warn({ runId: run.id, projectId: run.projectId, issueId: run.linearIssueId, method: notification.method, error: formatError(error) }, "Linear progress reporting failed");
+        }
+    }
+    syncCodexPlan(notification, run) {
+        let issue;
+        try {
+            issue = this.db.issues.getIssue(run.projectId, run.linearIssueId);
+        }
+        catch (error) {
+            this.logger.warn({ runId: run.id, projectId: run.projectId, issueId: run.linearIssueId, method: notification.method, error: formatError(error) }, "Linear plan sync lookup failed");
+            return;
+        }
+        if (!issue)
+            return;
+        try {
+            void this.linearSync.syncCodexPlan(issue, notification.params).catch((error) => {
+                this.logger.warn({ runId: run.id, issueKey: issue.issueKey, projectId: run.projectId, issueId: run.linearIssueId, method: notification.method, error: formatError(error) }, "Linear plan sync failed");
+            });
+        }
+        catch (error) {
+            this.logger.warn({ runId: run.id, issueKey: issue.issueKey, projectId: run.projectId, issueId: run.linearIssueId, method: notification.method, error: formatError(error) }, "Linear plan sync failed");
+        }
+    }
+}
+function formatError(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function publishWatchdogKey(threadId, itemId) {
+    return `${threadId}:${itemId}`;
+}
+function extractCommandText(command) {
+    if (typeof command === "string") {
+        return command;
+    }
+    if (Array.isArray(command)) {
+        return command.map((entry) => String(entry)).join(" ");
+    }
+    return undefined;
+}
+function isGitPushCommand(command) {
+    const normalized = command.replace(/\s+/g, " ").trim();
+    return /(?:^|[;&|({\s])git(?:\s+-C\s+\S+)?\s+push(?:\s|$)/.test(normalized);
+}
+function isTerminalItemUpdate(method, item) {
+    if (method !== "item/updated") {
+        return false;
+    }
+    const status = typeof item.status === "string" ? item.status.toLowerCase() : "";
+    return status === "completed" || status === "failed" || status === "cancelled" || status === "canceled";
 }

package/dist/run-orchestrator.js

@@ -129,7 +129,7 @@ export class RunOrchestrator {
         this.issueTriage = new IssueTriageService(codex, logger);
         this.runFinalizer = new RunFinalizer(db, logger, this.linearSync, this.wakeDispatcher, this.leasePorts.withHeldLease, this.leasePorts.releaseLease, (lease, issue, runType, context, dedupeScope) => this.appendWakeEventWithLease(lease, issue, runType, context, dedupeScope), this.recoveryPorts.failRunAndClear, this.runCompletionPolicy, this.completionCheck, this.publicationRecap, feed);
         this.runLauncher = new RunLauncher(config, db, codex, logger, this.worktreeManager);
-        this.runNotificationHandler = new RunNotificationHandler(config, db, logger, this.linearSync, this.runFinalizer, this.threadPorts.readThreadWithRetry, this.leasePorts.withHeldLease, this.leasePorts.heartbeatLease, this.leasePorts.releaseLease, feed);
+        this.runNotificationHandler = new RunNotificationHandler(config, db, logger, this.linearSync, this.runFinalizer, this.threadPorts.readThreadWithRetry, this.leasePorts.withHeldLease, this.leasePorts.heartbeatLease, this.leasePorts.releaseLease, feed, { interruptTurn: (options) => codex.interruptTurn(options) });
         this.runRecovery = new RunRecoveryService(db, logger, this.linearSync, this.leasePorts.withHeldLease, this.leasePorts.getHeldLease, (lease, issue, runType, context, dedupeScope) => this.appendWakeEventWithLease(lease, issue, runType, context, dedupeScope), this.leasePorts.releaseLease, (projectId, issueId) => this.enqueueIssue(projectId, issueId), feed);
         this.interruptedRunRecovery = new InterruptedRunRecovery(db, logger, this.linearSync, this.leasePorts.withHeldLease, this.leasePorts.releaseLease, this.recoveryPorts.failRunAndClear, this.recoveryPorts.restoreIdleWorktree, this.runCompletionPolicy, (projectId, issueId) => this.enqueueIssue(projectId, issueId), feed);
         this.runReconciler = new RunReconciler(db, logger, linearProvider, this.linearSync, this.interruptedRunRecovery, this.runFinalizer, this.leasePorts.withHeldLease, this.leasePorts.releaseLease, this.threadPorts.readThreadWithRetry, this.recoveryPorts.recoverOrEscalate, (projectId) => this.config.projects.find((project) => project.id === projectId)?.github?.repoFullName, feed);

package/dist/service-runtime.js

@@ -65,7 +65,7 @@ export class ServiceRuntime {
     }
     getReadiness() {
         return {
-            ready: this.ready && this.codex.isStarted() && this.linearConnected,
+            ready: this.ready && this.codex.isStarted() && this.linearConnected && this.githubAppAuthHealthy,
             codexStarted: this.codex.isStarted(),
             linearConnected: this.linearConnected,
             githubAppAuthHealthy: this.githubAppAuthHealthy,

package/dist/service.js

@@ -1,5 +1,5 @@
 import { resolveGitHubAppCredentials, createGitHubAppTokenManager, getGitHubAppPaths, } from "./github-app-token.js";
-import { applyGitHubCliAuthEnv, resolveGhBin } from "./github-cli-auth.js";
+import { applyGitHubCliAuthEnv, resolveGhBin, verifyGitHubCliAuthEnv } from "./github-cli-auth.js";
 import { remediateLeakedBotAuth } from "./github-auth-remediation.js";
 import { GitHubWebhookHandler } from "./github-webhook-handler.js";
 import { IssueQueryService } from "./issue-query-service.js";
@@ -149,8 +149,18 @@ export class PatchRelayService {
             this.runtime.setGithubAppAuthHealthy(ghAuthStatus.healthy, ghAuthStatus.lastRefreshError ?? undefined);
             if (!ghAuthStatus.healthy) {
                 this.logger.error({ ghAuthStatus }, "GitHub App auth is NOT healthy at startup — git/gh operations will fail until a token is minted");
+                throw new Error(`GitHub App auth is not healthy at startup: ${ghAuthStatus.lastRefreshError ?? "no fresh installation token"}`);
             }
             else {
+                try {
+                    await verifyGitHubCliAuthEnv(process.env);
+                }
+                catch (error) {
+                    const msg = error instanceof Error ? error.message : String(error);
+                    this.runtime.setGithubAppAuthHealthy(false, msg);
+                    this.logger.error({ error: msg, ghConfigDir }, "GitHub App auth smoke test failed — service will not accept work");
+                    throw error;
+                }
                 this.logger.info({ installationId: ghAuthStatus.installationId, expiresAt: ghAuthStatus.expiresAt }, "GitHub App auth ready — gh + git authenticate as the bot");
             }
             // Clean up credentials older versions persisted into managed repo configs.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchrelay",
-  "version": "0.74.0",
+  "version": "0.74.1",
   "license": "MIT",
   "type": "module",
   "repository": {