pierre-review 0.1.47 → 0.1.49

package/dist/api/routes/activity.js

@@ -1,4 +1,4 @@
-import { getActivity, getConsolidatedFeed, listClaudeReviewsByRepo } from '../../db/queries.js';
+import { getActivity, getConsolidatedFeed, listClaudeReviewsByRepo, markFeedSeen, } from '../../db/queries.js';
 import { accountIdOf } from '../plugins/auth.js';
 function parseIntList(raw) {
     if (!raw)
@@ -35,6 +35,13 @@ export async function activityRoutes(app) {
             allowBotIds: parseIntList(q.allowBotIds),
         });
     });
+    // Mark the Activity Feed as seen (bumps the account's server-side "seen" marker to
+    // now). Called when the user views the feed; resets the "new FYI since last here"
+    // count that drives the Welcome-back banner. Account-scoped; no body.
+    app.post('/api/activity/feed/mark-seen', async (req) => {
+        const at = await markFeedSeen(accountIdOf(req));
+        return { feedLastSeenAt: at.toISOString() };
+    });
     // Repo-scoped Claude-review history for the Activity single-repo console. Ownership +
     // feature-gating are handled inside the query (an unowned repo / disabled feature
     // both return an empty list), so the caller never leaks another account's data.

package/dist/api/routes/me.js

@@ -2,7 +2,7 @@ import { config } from '../../config.js';
 import { accountToLocalUser } from '../../auth/account.js';
 import { accountIdOf } from '../plugins/auth.js';
 import { getProCapabilities } from '../../pro/contract.js';
-import { dismissMyTurn, getCompletedDismissals, getMyTurn, undismissMyTurn, } from '../../db/queries.js';
+import { countNewMyTurnFeedItems, dismissMyTurn, getCompletedDismissals, getFeedLastSeenAt, getMyTurn, markFeedSeen, undismissMyTurn, } from '../../db/queries.js';
 const dismissSchema = {
     body: {
         type: 'object',
@@ -19,8 +19,16 @@ const dismissSchema = {
 };
 export async function meRoutes(app) {
     app.get('/api/me', async (req) => {
+        const accountId = accountIdOf(req);
         const user = accountToLocalUser(req.account);
-        const myTurn = await getMyTurn(accountIdOf(req));
+        const myTurn = await getMyTurn(accountId);
+        // Feed "seen" marker + how many FYI items are new since. Only counted once a
+        // baseline exists (feedLastSeenAt set by the first feed view) so a fresh account
+        // never sees a scary first-load number.
+        const feedLastSeen = await getFeedLastSeenAt(accountId);
+        const newFeedItems = feedLastSeen
+            ? await countNewMyTurnFeedItems(accountId, feedLastSeen)
+            : 0;
         return {
             user,
             counts: {
@@ -31,6 +39,8 @@ export async function meRoutes(app) {
                 watchedRepoPrs: myTurn.watchedRepoPrs.length,
                 claudeReviewsToAction: myTurn.claudeReviewsToAction.length,
             },
+            feedLastSeenAt: feedLastSeen ? feedLastSeen.toISOString() : null,
+            newFeedItems,
             claudeReviewEnabled: config.claudeReviewEnabled,
             deploymentMode: config.deploymentMode,
             pro: getProCapabilities(),

package/dist/api/routes/prs.js

@@ -1,9 +1,9 @@
 import { createHash } from 'node:crypto';
 import { getAccessToken, getAccountUserId } from '../../auth/account.js';
-import { ghRestGetText } from '../../github/client.js';
+import { fetchActionsJobLog } from '../../github/actions-logs.js';
 import { getMentionCandidates, getPrDetail, getPrFilesContext, getPrWriteContext, markAllViewed, markPrViewed, upsertLocalPrComment, upsertLocalReview, } from '../../db/queries.js';
 import { buildFileAnchors, fallbackAnchor, isFindingAnchored, } from '../../github/diff-anchor.js';
-import { addIssueComment, fetchHeadShaFor, fetchPrFilesWithPatch, postInlineComment, submitPrReview, } from '../../github/mutations.js';
+import { addIssueComment, fetchHeadShaFor, fetchPrFilesWithPatch, postInlineComment, rerunWorkflowRun, submitPrReview, } from '../../github/mutations.js';
 import { hydratePrDetail } from '../../sync/hydrate-detail.js';
 import { accountIdOf } from '../plugins/auth.js';
 // GitHub anchors a file in the PR "Files changed" diff by the SHA-256 of its
@@ -56,6 +56,18 @@ const markViewedSchema = {
         properties: { sha: { type: 'string' } },
     },
 };
+const ciRerunSchema = {
+    ...idParamSchema,
+    body: {
+        type: 'object',
+        required: ['runId', 'mode'],
+        additionalProperties: false,
+        properties: {
+            runId: { type: 'integer', minimum: 1 },
+            mode: { type: 'string', enum: ['failed', 'all'] },
+        },
+    },
+};
 const markAllViewedSchema = {
     body: {
         type: 'object',
@@ -353,41 +365,44 @@ export async function prRoutes(app) {
             reply.status(404);
             return { error: 'NotFound', message: `PR ${id} not found` };
         }
-        const tailLines = Math.min(Math.max(tail ?? 200, 1), 1000);
-        const unavailable = (reason) => ({
-            available: false,
-            reason,
-            text: '',
-            totalLines: 0,
-            returnedLines: 0,
-        });
+        const token = await getAccessToken(accountId);
+        const result = await fetchActionsJobLog(token, ctx.owner, ctx.name, jobId, tail ?? 200);
+        return result;
+    });
+    // Re-trigger a GitHub Actions workflow run for this PR. The `runId` comes from
+    // CheckRun.runId (Actions checks only). Server re-checks write access (WRITE/
+    // MAINTAIN/ADMIN, matching viewerCanPush — no author exclusion, unlike approve),
+    // then queues the rerun via the per-account token (local + cloud). GitHub runs it
+    // asynchronously; the refreshed check states arrive on the next sync.
+    app.post('/api/prs/:id/ci/rerun', { schema: ciRerunSchema }, async (req, reply) => {
+        const { id } = req.params;
+        const { runId, mode } = req.body;
+        const accountId = accountIdOf(req);
+        const ctx = await getPrWriteContext(id, accountId);
+        if (!ctx) {
+            reply.status(404);
+            return { error: 'NotFound', message: `PR ${id} not found` };
+        }
+        const canRerun = ['WRITE', 'MAINTAIN', 'ADMIN'].includes(ctx.viewerPermission ?? '');
+        if (!canRerun) {
+            reply.status(403);
+            return {
+                error: 'NotPermitted',
+                message: 'You need write access to this repo to re-run CI.',
+            };
+        }
         try {
             const token = await getAccessToken(accountId);
-            const res = await ghRestGetText(token, `/repos/${ctx.owner}/${ctx.name}/actions/jobs/${jobId}/logs`);
-            if (!res.ok) {
-                const reason = res.status === 404 || res.status === 410
-                    ? 'Logs are no longer available (expired, or the job was re-run).'
-                    : res.status === 403
-                        ? 'No permission to read GitHub Actions logs for this repo.'
-                        : `Couldn't fetch logs (GitHub returned ${res.status}).`;
-                return unavailable(reason);
-            }
-            // A job log can be many MB — normalise line endings, drop a trailing blank,
-            // and tail server-side so only the last N lines reach the browser. Guard the
-            // empty/blank body so it reports 0 lines (not [''] → a misleading "1 of 1").
-            const trimmed = res.text.replace(/\r\n/g, '\n').replace(/\n+$/, '');
-            const lines = trimmed === '' ? [] : trimmed.split('\n');
-            const tailed = lines.slice(-tailLines);
-            const result = {
-                available: true,
-                text: tailed.join('\n'),
-                totalLines: lines.length,
-                returnedLines: tailed.length,
-            };
+            await rerunWorkflowRun(token, ctx.owner, ctx.name, runId, mode);
+            const result = { status: 'queued', runId, mode };
             return result;
         }
-        catch {
-            return unavailable("Couldn't reach GitHub to fetch the logs.");
+        catch (err) {
+            reply.status(502);
+            return {
+                error: 'GitHubError',
+                message: err instanceof Error ? err.message : String(err),
+            };
         }
     });
 }

package/dist/coding/activity.js

@@ -0,0 +1,78 @@
+// Live progress derivation for the coding agent — turns each assistant turn into a
+// few short, human-readable lines (tool labels + clipped text). Mirrors the private
+// helpers in review/agent.ts but understands the WRITE tools (Write/Edit/MultiEdit)
+// the fixer uses. Defensive throughout: the SDK content/tool-input shapes vary, so
+// every access is guarded and this never throws.
+const TEXT_SNIPPET_CAP = 120;
+const ARG_CAP = 80;
+export function describeAssistantBlocks(message) {
+    const lines = [];
+    const content = message?.message
+        ?.content;
+    if (!Array.isArray(content))
+        return lines;
+    for (const raw of content) {
+        if (!raw || typeof raw !== 'object')
+            continue;
+        const block = raw;
+        if (block.type === 'tool_use') {
+            const name = typeof block.name === 'string' ? block.name : 'Tool';
+            const input = block.input && typeof block.input === 'object'
+                ? block.input
+                : {};
+            lines.push(labelToolUse(name, input));
+        }
+        else if (block.type === 'text' && typeof block.text === 'string') {
+            const snippet = clip(block.text.replace(/\s+/g, ' ').trim(), TEXT_SNIPPET_CAP);
+            if (snippet)
+                lines.push(snippet);
+        }
+    }
+    return lines;
+}
+function labelToolUse(name, input) {
+    const str = (v) => typeof v === 'string' && v.trim().length > 0 ? v.trim() : null;
+    switch (name) {
+        case 'Read': {
+            const p = str(input.file_path) ?? str(input.path);
+            return p ? `Read ${p}` : 'Read …';
+        }
+        case 'Write': {
+            const p = str(input.file_path) ?? str(input.path);
+            return p ? `Write ${p}` : 'Write …';
+        }
+        case 'Edit':
+        case 'MultiEdit': {
+            const p = str(input.file_path) ?? str(input.path);
+            return p ? `Edit ${p}` : 'Edit …';
+        }
+        case 'Glob': {
+            const p = str(input.pattern);
+            return p ? `Glob ${p}` : 'Glob …';
+        }
+        case 'Grep': {
+            const p = str(input.pattern);
+            return p ? `Grep "${clip(p, ARG_CAP)}"` : 'Grep …';
+        }
+        case 'Bash': {
+            const c = str(input.command);
+            return c ? `Bash ${clip(c, ARG_CAP)}` : 'Bash …';
+        }
+        case 'mcp__fix__submit_fix':
+            return 'Recording fix summary…';
+        case 'mcp__resolve__submit_resolution':
+            return 'Recording resolution…';
+        default: {
+            for (const key of Object.keys(input)) {
+                const v = str(input[key]);
+                if (v)
+                    return `${name} ${clip(v, ARG_CAP)}`;
+            }
+            return `${name} …`;
+        }
+    }
+}
+function clip(s, max) {
+    return s.length > max ? `${s.slice(0, max)}…` : s;
+}
+//# sourceMappingURL=activity.js.map

package/dist/coding/agent.js

@@ -0,0 +1,310 @@
+import { createSdkMcpServer, query, tool, } from '@anthropic-ai/claude-agent-sdk';
+import { config } from '../config.js';
+import { getAccessToken } from '../auth/account.js';
+import { cleanupCloneCache, prepWorktree, removeWorktreeLocked, } from '../review/clone-manager.js';
+import { estimateCostUsd } from '../review/pricing.js';
+import { recordUsage, sumModelUsage, sumUsageMap, } from '../review/usage.js';
+import { submitFixShape, submitResolutionShape, } from './schema.js';
+import { captureWorktreeDiff } from './git.js';
+import { describeAssistantBlocks } from './activity.js';
+// The WRITE tool surface for the fixer: the read tools PLUS Write/Edit/MultiEdit, and
+// the submit_fix MCP tool for the prose summary. The agent NEVER runs git writes — the
+// host commits/pushes — so git commit/push/config stay denied (as do rm/sudo).
+const FIX_TOOLS = [
+    'Read',
+    'Glob',
+    'Grep',
+    'Bash',
+    'Write',
+    'Edit',
+    'MultiEdit',
+    'mcp__fix__submit_fix',
+];
+const DISALLOWED_TOOLS = [
+    'NotebookEdit',
+    'Bash(rm *)',
+    'Bash(sudo *)',
+    'Bash(git push *)',
+    'Bash(git commit *)',
+    'Bash(git config *)',
+];
+// The conflict-resolver's tool surface is deliberately NARROWER: no Bash at all, so it
+// cannot tamper with the in-progress merge/rebase (no `git add`/`--continue`/`--abort`).
+// It only reads + edits the conflicted files and reports via submit_resolution; the
+// host stages and continues the operation.
+const RESOLVE_TOOLS = [
+    'Read',
+    'Glob',
+    'Grep',
+    'Write',
+    'Edit',
+    'MultiEdit',
+    'mcp__resolve__submit_resolution',
+];
+const RESOLVE_DISALLOWED_TOOLS = ['Bash', 'NotebookEdit'];
+// Models that accept the `effort` option (Haiku 4.5 rejects it — the API 400s).
+const EFFORT_CAPABLE_MODELS = new Set([
+    'claude-opus-4-8',
+    'claude-sonnet-4-6',
+]);
+const ACTIVITY_LOG_CAP = 25;
+function emptyUsage() {
+    return {
+        inputTokens: 0,
+        outputTokens: 0,
+        cacheReadTokens: 0,
+        cacheCreationTokens: 0,
+    };
+}
+/**
+ * The shared Claude Agent SDK run core used by BOTH the fixer and the conflict
+ * resolver: it OWNS the sandbox config (`permissionMode:'bypassPermissions'`,
+ * `settingSources:[]`, budget/turn caps, whitelisted tools) and streams activity, but
+ * knows nothing about worktree prep, diff capture, or git — the callers own those.
+ *
+ * Auth: runs on the AMBIENT Claude env WITHOUT mutating process.env (unlike Claude
+ * Review's applyClaudeReviewAuth) — the AI-Fix jobs are concurrency 1, and mutating
+ * env would race a concurrent review manager. Whatever credential is ambient is used.
+ */
+export async function runAgentInWorktree(opts) {
+    const model = opts.model;
+    const usageByUuid = new Map();
+    let result = null;
+    let maxTurns = opts.maxTurns;
+    if (model === 'claude-haiku-4-5') {
+        maxTurns = Math.ceil(maxTurns * config.reviewHaikuTurnMultiplier);
+    }
+    const effort = EFFORT_CAPABLE_MODELS.has(model)
+        ? config.reviewEffort
+        : undefined;
+    const q = query({
+        prompt: opts.prompt,
+        options: {
+            model,
+            ...(effort ? { effort } : {}),
+            ...(opts.systemPrompt ? { systemPrompt: opts.systemPrompt } : {}),
+            cwd: opts.worktreePath,
+            permissionMode: 'bypassPermissions',
+            allowedTools: opts.allowedTools,
+            disallowedTools: opts.disallowedTools,
+            maxTurns,
+            maxBudgetUsd: opts.maxBudgetUsd,
+            settingSources: [],
+            mcpServers: opts.mcpServers,
+            abortController: opts.abortController,
+        },
+    });
+    const activity = [];
+    const pushActivity = (line) => {
+        const trimmed = line.trim();
+        if (!trimmed)
+            return;
+        activity.push(trimmed);
+        if (activity.length > ACTIVITY_LOG_CAP)
+            activity.shift();
+    };
+    for await (const message of q) {
+        if (message.type === 'assistant') {
+            try {
+                recordUsage(usageByUuid, message);
+            }
+            catch {
+                /* usage shape varies — never let it break the run */
+            }
+            try {
+                for (const line of describeAssistantBlocks(message))
+                    pushActivity(line);
+            }
+            catch {
+                /* never let progress derivation break the run */
+            }
+            const live = sumUsageMap(usageByUuid);
+            opts.onActivity?.([...activity], {
+                ...live,
+                estCostUsd: estimateCostUsd(model, live),
+            });
+        }
+        else if (message.type === 'result') {
+            result = message;
+        }
+    }
+    if (opts.abortController.signal.aborted) {
+        return {
+            result,
+            usage: emptyUsage(),
+            costUsd: null,
+            numTurns: null,
+            aborted: true,
+        };
+    }
+    const usage = sumModelUsage(result) ?? sumUsageMap(usageByUuid);
+    const hasUsage = usage.inputTokens + usage.outputTokens + usage.cacheReadTokens > 0;
+    const costUsd = result?.total_cost_usd ?? (hasUsage ? estimateCostUsd(model, usage) : null);
+    return {
+        result,
+        usage: {
+            inputTokens: usage.inputTokens,
+            outputTokens: usage.outputTokens,
+            cacheReadTokens: usage.cacheReadTokens,
+            cacheCreationTokens: usage.cacheCreationTokens,
+        },
+        costUsd,
+        numTurns: result?.num_turns ?? null,
+        aborted: false,
+    };
+}
+/**
+ * Run the write-capable coding agent against a PR's head in an ephemeral worktree and
+ * return the captured changeset (a binary-safe unified diff) + a prose summary. This
+ * is the implementation behind ctx.coding.generateFix; it owns the worktree prep +
+ * diff capture + teardown, and delegates the sandboxed SDK run to runAgentInWorktree.
+ * Never commits or pushes — the host's git-ops does that later from the STORED patch.
+ */
+export async function runCodingAgent(args) {
+    const { owner, name, prNumber, baseSha, abortController, onProgress } = args;
+    const model = args.model;
+    const token = await getAccessToken(args.accountId);
+    let repoCloneDir = null;
+    let worktreePath = null;
+    try {
+        onProgress({ phase: 'cloning' });
+        ({ repoCloneDir, worktreePath } = await prepWorktree(owner, name, prNumber, baseSha, token));
+        let captured = null;
+        const server = createSdkMcpServer({
+            name: 'fix',
+            version: '1.0.0',
+            tools: [
+                tool('submit_fix', 'Report the fix you applied. Call this EXACTLY once, at the very end, after editing files.', submitFixShape, async (a) => {
+                    const p = a;
+                    captured = { summary: p.summary, commitMessage: p.commitMessage };
+                    return { content: [{ type: 'text', text: 'Fix recorded.' }] };
+                }),
+            ],
+        });
+        onProgress({ phase: 'fixing' });
+        const outcome = await runAgentInWorktree({
+            worktreePath,
+            model,
+            systemPrompt: args.systemPrompt,
+            prompt: args.prompt,
+            allowedTools: FIX_TOOLS,
+            disallowedTools: DISALLOWED_TOOLS,
+            mcpServers: { fix: server },
+            maxTurns: args.maxTurns ?? config.aiFixMaxTurns,
+            maxBudgetUsd: args.maxBudgetUsd ?? config.aiFixBudgetUsd,
+            abortController,
+            onActivity: (activity, usage) => onProgress({ phase: 'fixing', recentActivity: activity, usage }),
+        });
+        // A user cancel aborts the SDK iterator; surface a clean aborted result (the
+        // manager marks the row cancelled — no worktree changes are captured).
+        if (outcome.aborted || abortController.signal.aborted) {
+            return {
+                summary: '',
+                commitMessage: '',
+                patch: '',
+                filesChanged: [],
+                baseSha,
+                usage: emptyUsage(),
+                costUsd: null,
+                numTurns: null,
+                aborted: true,
+            };
+        }
+        onProgress({ phase: 'capturing' });
+        const { patch, filesChanged } = await captureWorktreeDiff(worktreePath);
+        if (patch.length > config.aiFixPatchMaxBytes) {
+            throw new Error(`fix patch too large (${patch.length} bytes > ${config.aiFixPatchMaxBytes})`);
+        }
+        // A cast so the closure-assigned `captured` reads back as its declared union.
+        // (TS flow-narrows it to `null` because its only assignment is inside the tool
+        // callback, which it can't prove ran — a plain annotation wouldn't break that.)
+        const fix = captured;
+        return {
+            summary: fix?.summary ??
+                (filesChanged.length
+                    ? `Applied changes to ${filesChanged.length} file(s).`
+                    : 'The agent made no changes.'),
+            commitMessage: fix?.commitMessage ?? 'AI fix',
+            patch,
+            filesChanged,
+            baseSha,
+            usage: outcome.usage,
+            costUsd: outcome.costUsd,
+            numTurns: outcome.numTurns,
+            aborted: false,
+        };
+    }
+    finally {
+        if (repoCloneDir && worktreePath) {
+            await removeWorktreeLocked(owner, name, repoCloneDir, worktreePath).catch(() => { });
+        }
+        if (repoCloneDir) {
+            setImmediate(() => {
+                try {
+                    cleanupCloneCache();
+                }
+                catch {
+                    /* advisory cleanup — never surface */
+                }
+            });
+        }
+    }
+}
+/**
+ * Run the conflict-resolution agent in an already-prepared, mid-merge/rebase worktree.
+ * The agent edits the conflicted files to remove every marker (preserving both sides'
+ * intent) and reports via submit_resolution. It has NO Bash/git access, so it cannot
+ * touch the in-progress operation — the host stages + continues + verifies afterward.
+ */
+export async function runConflictResolver(args) {
+    let captured = null;
+    const server = createSdkMcpServer({
+        name: 'resolve',
+        version: '1.0.0',
+        tools: [
+            tool('submit_resolution', 'Report how you resolved the conflicts. Call this EXACTLY once, at the very end, after every conflict marker is gone.', submitResolutionShape, async (a) => {
+                const p = a;
+                captured = { summary: p.summary };
+                return { content: [{ type: 'text', text: 'Resolution recorded.' }] };
+            }),
+        ],
+    });
+    const fileList = args.conflictFiles.map((f) => `- ${f}`).join('\n');
+    const prompt = [
+        'You are resolving Git merge/rebase conflicts in this repository.',
+        'The working tree has conflict markers (<<<<<<<, =======, >>>>>>>) in these files:',
+        fileList || '(git reports conflicted files)',
+        '',
+        args.contextNote ? `Context: ${args.contextNote}` : '',
+        '',
+        'For EACH conflicted file: open it, resolve every conflict by preserving the',
+        'intent of BOTH sides (combine them correctly — do not just pick one blindly',
+        'unless one side is clearly obsolete), and remove ALL conflict markers. Do not',
+        'change code outside the conflict regions. Do not run any git commands.',
+        'When every marker in every file is gone, call submit_resolution with a short',
+        'summary of how you reconciled them.',
+    ]
+        .filter((l) => l !== '')
+        .join('\n');
+    const outcome = await runAgentInWorktree({
+        worktreePath: args.worktreePath,
+        model: args.model,
+        systemPrompt: args.systemPrompt,
+        prompt,
+        allowedTools: RESOLVE_TOOLS,
+        disallowedTools: RESOLVE_DISALLOWED_TOOLS,
+        mcpServers: { resolve: server },
+        maxTurns: args.maxTurns ?? config.aiFixMaxTurns,
+        maxBudgetUsd: args.maxBudgetUsd ?? config.aiFixBudgetUsd,
+        abortController: args.abortController,
+        onActivity: (activity) => args.onActivity?.(activity),
+    });
+    const res = captured;
+    return {
+        summary: res?.summary ?? 'Resolved merge conflicts.',
+        usage: outcome.usage,
+        costUsd: outcome.costUsd,
+        aborted: outcome.aborted || args.abortController.signal.aborted,
+    };
+}
+//# sourceMappingURL=agent.js.map

package/dist/coding/git-ops.js

@@ -0,0 +1,76 @@
+import { getAccessToken, getAccountById } from '../auth/account.js';
+import { cleanupCloneCache, prepWorktree, removeWorktreeLocked, } from '../review/clone-manager.js';
+import { createPullRequest, fetchPrHeadInfo, } from '../github/mutations.js';
+import { applyPatchToWorktree, codedError, commitAll, pushRef, } from './git.js';
+// The implementation behind ctx.coding.applyAndPush. STATELESS: it re-preps a fresh
+// worktree at the patch's exact base commit and `git apply`s the stored patch, so a
+// fix survives a restart and works on ephemeral cloud disk. Owns the head-moved guard
+// (existing-branch only) and does all git writes (the agent never can).
+export async function applyAndPush(args) {
+    const { accountId, owner, name, prNumber, baseSha, patch, commitMessage, target } = args;
+    const token = await getAccessToken(accountId);
+    const account = await getAccountById(accountId);
+    const authorName = account?.displayName || account?.githubLogin || 'pierre-review';
+    const authorEmail = account?.githubLogin
+        ? `${account.githubLogin}@users.noreply.github.com`
+        : 'pierre-review@users.noreply.github.com';
+    // Head-moved / un-pushable-fork guard applies ONLY to the existing-branch path
+    // (pushing onto the PR's own head). A new branch is self-contained off baseSha and
+    // is immune to the head having advanced.
+    if (target.kind === 'existing') {
+        const info = await fetchPrHeadInfo(token, owner, name, prNumber);
+        if (info.headSha !== baseSha) {
+            throw codedError('HEAD_MOVED', `the PR head advanced (now ${info.headSha.slice(0, 7)}, fix was built on ${baseSha.slice(0, 7)})`);
+        }
+        if (info.isFork && !info.maintainerCanModify) {
+            throw codedError('PUSH_DENIED', 'the PR head is a fork this account cannot push to — push to a new branch instead');
+        }
+    }
+    let repoCloneDir = null;
+    let worktreePath = null;
+    try {
+        ({ repoCloneDir, worktreePath } = await prepWorktree(owner, name, prNumber, baseSha, token));
+        await applyPatchToWorktree(worktreePath, patch);
+        const commitSha = await commitAll(worktreePath, {
+            message: commitMessage,
+            authorName,
+            authorEmail,
+        });
+        if (target.kind === 'existing') {
+            await pushRef(worktreePath, owner, name, token, 'HEAD', target.headRef);
+            return { pushedBranch: target.headRef, commitSha };
+        }
+        // New branch → push then open a PR against the base.
+        await pushRef(worktreePath, owner, name, token, 'HEAD', target.branch);
+        const pr = await createPullRequest(token, {
+            owner,
+            name,
+            head: target.branch,
+            base: target.base,
+            title: target.title,
+            body: target.body,
+        });
+        return {
+            pushedBranch: target.branch,
+            commitSha,
+            prNumber: pr.number,
+            prUrl: pr.url,
+        };
+    }
+    finally {
+        if (repoCloneDir && worktreePath) {
+            await removeWorktreeLocked(owner, name, repoCloneDir, worktreePath).catch(() => { });
+        }
+        if (repoCloneDir) {
+            setImmediate(() => {
+                try {
+                    cleanupCloneCache();
+                }
+                catch {
+                    /* advisory cleanup — never surface */
+                }
+            });
+        }
+    }
+}
+//# sourceMappingURL=git-ops.js.map