relay-ide 0.1.0

package/dist/test/review-poller.test.js

@@ -0,0 +1,349 @@
+import { test, before, after, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { startPolling, stopPolling, isPolling, } from '../server/review-poller.js';
+import { saveConfig, DEFAULTS } from '../server/config.js';
+// ─── Shared fixtures ──────────────────────────────────────────────────────────
+let tmpDir;
+let configPath;
+const WORKSPACE_PATH = '/fake/workspace/my-repo';
+before(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'review-poller-test-'));
+    configPath = path.join(tmpDir, 'config.json');
+});
+after(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+});
+afterEach(async () => {
+    // Guarantee no timer leaks between tests
+    await stopPolling();
+});
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+/** Builds a minimal GhNotification JSON string suitable for mock exec stdout. */
+function makeNotificationLine(overrides) {
+    const { id = 'notif-1', reason = 'review_requested', prNumber = 42, ownerRepo = 'owner/my-repo', updatedAt = new Date().toISOString(), title = 'Test PR', } = overrides;
+    return JSON.stringify({
+        id,
+        reason,
+        subject: {
+            title,
+            url: `https://api.github.com/repos/${ownerRepo}/pulls/${prNumber}`,
+            type: 'PullRequest',
+        },
+        repository: { full_name: ownerRepo },
+        updated_at: updatedAt,
+    });
+}
+/**
+ * Creates a mock execAsync. Routes by command:
+ * - `gh api /notifications` → returns notification lines joined by newline
+ * - `git remote get-url origin` → returns the configured remote URL
+ * - `git fetch ...` → resolves with empty output
+ * - `git worktree add ...` → resolves with empty output (unless worktreeError is set)
+ */
+function makeMockExec(opts) {
+    return async (cmd, args) => {
+        const command = cmd;
+        const argv = args;
+        opts.onExec?.(command, argv);
+        if (command === 'gh' && argv[0] === 'api') {
+            if (opts.ghError)
+                throw opts.ghError;
+            const lines = opts.notificationLines ?? [];
+            return { stdout: lines.join('\n'), stderr: '' };
+        }
+        if (command === 'git' && argv[0] === 'remote') {
+            if (opts.gitRemoteError)
+                throw opts.gitRemoteError;
+            const url = opts.remoteUrl ?? 'https://github.com/owner/my-repo.git';
+            return { stdout: url + '\n', stderr: '' };
+        }
+        if (command === 'git' && argv[0] === 'fetch') {
+            return { stdout: '', stderr: '' };
+        }
+        if (command === 'git' && argv[0] === 'worktree') {
+            if (opts.worktreeError)
+                throw opts.worktreeError;
+            return { stdout: '', stderr: '' };
+        }
+        throw new Error(`Unexpected exec call: ${command} ${argv.join(' ')}`);
+    };
+}
+/** Returns a deps object with sensible defaults. Override individual fields as needed. */
+function makeDeps(overrides = {}) {
+    return {
+        configPath,
+        getWorkspacePaths: () => [WORKSPACE_PATH],
+        getRepoSettings: () => undefined,
+        createSession: async () => { },
+        broadcastEvent: () => { },
+        execAsync: makeMockExec({}),
+        ...overrides,
+    };
+}
+/** Waits for at least one poll cycle to complete given the interval. */
+function waitForCycles(intervalMs, cycles = 1) {
+    return new Promise((resolve) => setTimeout(resolve, intervalMs * cycles + 20));
+}
+// ─── Tests ────────────────────────────────────────────────────────────────────
+test('isPolling() returns false initially', () => {
+    assert.equal(isPolling(), false);
+});
+test('startPolling() sets isPolling() to true', () => {
+    saveConfig(configPath, {
+        ...DEFAULTS,
+        automations: { pollIntervalMs: 60_000 },
+    });
+    startPolling(makeDeps());
+    assert.equal(isPolling(), true);
+});
+test('stopPolling() sets isPolling() to false', async () => {
+    saveConfig(configPath, {
+        ...DEFAULTS,
+        automations: { pollIntervalMs: 60_000 },
+    });
+    startPolling(makeDeps());
+    assert.equal(isPolling(), true);
+    await stopPolling();
+    assert.equal(isPolling(), false);
+});
+test('startPolling() is idempotent — calling twice does not create two timers', async () => {
+    const INTERVAL = 50;
+    let callCount = 0;
+    saveConfig(configPath, {
+        ...DEFAULTS,
+        automations: {
+            autoCheckoutReviewRequests: true,
+            pollIntervalMs: INTERVAL,
+            lastPollTimestamp: new Date().toISOString(),
+        },
+    });
+    const exec = makeMockExec({
+        onExec: (cmd, argv) => {
+            if (cmd === 'gh' && argv[0] === 'api')
+                callCount++;
+        },
+    });
+    const deps = makeDeps({ execAsync: exec });
+    startPolling(deps);
+    startPolling(deps); // second call must be a no-op
+    await waitForCycles(INTERVAL, 2);
+    // Two timer cycles elapsed. If only one timer exists, gh was called ~2 times.
+    // If startPolling were NOT idempotent (two timers), we would see ~4 calls.
+    assert.ok(callCount <= 3, `Expected at most 3 gh calls (got ${callCount}) — suggests only one timer running`);
+});
+test('first-run guard — when lastPollTimestamp is absent, no notifications are processed', async () => {
+    const INTERVAL = 50;
+    // Config without lastPollTimestamp — first-run scenario
+    saveConfig(configPath, {
+        ...DEFAULTS,
+        automations: {
+            autoCheckoutReviewRequests: true,
+            pollIntervalMs: INTERVAL,
+            // No lastPollTimestamp — module will default to "now"
+        },
+    });
+    const broadcastedEvents = [];
+    let fetchCallCount = 0;
+    const exec = makeMockExec({
+        // Notification is old (well before "now"), so it should NOT be processed
+        notificationLines: [
+            makeNotificationLine({
+                updatedAt: new Date(Date.now() - 60_000).toISOString(), // 1 minute ago
+                ownerRepo: 'owner/my-repo',
+            }),
+        ],
+        remoteUrl: 'https://github.com/owner/my-repo.git',
+        onExec: (cmd, argv) => {
+            if (cmd === 'git' && argv[0] === 'fetch')
+                fetchCallCount++;
+        },
+    });
+    const deps = makeDeps({
+        execAsync: exec,
+        broadcastEvent: (event, data) => broadcastedEvents.push({ event, data }),
+    });
+    startPolling(deps);
+    await waitForCycles(INTERVAL);
+    // The notification predates the first-run "now" baseline, so no checkout should occur
+    assert.equal(fetchCallCount, 0, 'git fetch should not be called for historical notifications');
+    assert.equal(broadcastedEvents.length, 0, 'No review-checkout events should be broadcast');
+});
+test('JSON parse safety — non-JSON lines in gh output do not crash', async () => {
+    const INTERVAL = 50;
+    saveConfig(configPath, {
+        ...DEFAULTS,
+        automations: {
+            autoCheckoutReviewRequests: true,
+            pollIntervalMs: INTERVAL,
+            lastPollTimestamp: new Date(Date.now() - 120_000).toISOString(), // 2 min ago
+        },
+    });
+    // Mix valid JSON with non-JSON warning lines that gh sometimes emits
+    const validNotification = makeNotificationLine({
+        updatedAt: new Date().toISOString(),
+        ownerRepo: 'owner/my-repo',
+        prNumber: 7,
+    });
+    const exec = makeMockExec({
+        notificationLines: [
+            'Warning: some gh warning message',
+            validNotification,
+            'another non-JSON line',
+        ],
+        remoteUrl: 'https://github.com/owner/my-repo.git',
+    });
+    // Just verify it doesn't throw — if parsing crashes, startPolling's setInterval
+    // would log an unhandled rejection. We capture broadcastEvent to confirm the
+    // valid notification was still processed.
+    const broadcastedEvents = [];
+    const deps = makeDeps({
+        execAsync: exec,
+        broadcastEvent: (event, data) => broadcastedEvents.push({ event, data }),
+    });
+    // Should not throw
+    startPolling(deps);
+    await waitForCycles(INTERVAL);
+    // The valid notification was newer than lastPollTimestamp — should be processed
+    const checkoutEvents = broadcastedEvents.filter((e) => e.event === 'review-checkout');
+    assert.equal(checkoutEvents.length, 1, 'Valid notification should still be processed despite surrounding non-JSON lines');
+});
+test('poll skips processing when autoCheckoutReviewRequests is disabled', async () => {
+    const INTERVAL = 50;
+    saveConfig(configPath, {
+        ...DEFAULTS,
+        automations: {
+            autoCheckoutReviewRequests: false,
+            pollIntervalMs: INTERVAL,
+            lastPollTimestamp: new Date(Date.now() - 120_000).toISOString(),
+        },
+    });
+    let ghCallCount = 0;
+    const exec = makeMockExec({
+        notificationLines: [
+            makeNotificationLine({ updatedAt: new Date().toISOString() }),
+        ],
+        onExec: (cmd, argv) => {
+            if (cmd === 'gh' && argv[0] === 'api')
+                ghCallCount++;
+        },
+    });
+    startPolling(makeDeps({ execAsync: exec }));
+    await waitForCycles(INTERVAL);
+    // pollOnce returns early when the flag is off — gh should not even be called
+    assert.equal(ghCallCount, 0, 'gh should not be called when autoCheckoutReviewRequests is false');
+});
+test('stopPolling() awaits the in-flight poll before resolving', async () => {
+    const DELAY_MS = 100;
+    saveConfig(configPath, {
+        ...DEFAULTS,
+        automations: {
+            autoCheckoutReviewRequests: true,
+            pollIntervalMs: 60_000,
+            lastPollTimestamp: new Date(Date.now() - 120_000).toISOString(),
+        },
+    });
+    const broadcastedEvents = [];
+    // Wrap the normal exec with a deliberate delay so the poll stays in-flight
+    const normalExec = makeMockExec({
+        notificationLines: [
+            makeNotificationLine({
+                updatedAt: new Date().toISOString(),
+                ownerRepo: 'owner/my-repo',
+            }),
+        ],
+        remoteUrl: 'https://github.com/owner/my-repo.git',
+    });
+    const delayedExec = async (...args) => {
+        await new Promise((r) => setTimeout(r, DELAY_MS));
+        return normalExec(...args);
+    };
+    const deps = makeDeps({
+        execAsync: delayedExec,
+        broadcastEvent: (event, data) => broadcastedEvents.push({ event, data }),
+    });
+    startPolling(deps);
+    // Give the initial poll just enough time to start (but not finish — it takes ~100ms per call)
+    await new Promise((r) => setTimeout(r, 10));
+    // stopPolling() must await the in-flight poll
+    await stopPolling();
+    // The poll ran to completion — broadcastEvent must have been called
+    const checkoutEvents = broadcastedEvents.filter((e) => e.event === 'review-checkout');
+    assert.ok(checkoutEvents.length >= 1, 'broadcastEvent should have been called before stopPolling() returned');
+});
+test('poll-start watermark: lastPollTimestamp saved is the time before the fetch, not after', async () => {
+    const INTERVAL = 60_000;
+    saveConfig(configPath, {
+        ...DEFAULTS,
+        automations: {
+            autoCheckoutReviewRequests: true,
+            pollIntervalMs: INTERVAL,
+            lastPollTimestamp: new Date(Date.now() - 120_000).toISOString(),
+        },
+    });
+    const EXEC_DELAY_MS = 50;
+    const normalExec = makeMockExec({
+        notificationLines: [],
+        remoteUrl: 'https://github.com/owner/my-repo.git',
+    });
+    const delayedExec = async (...args) => {
+        await new Promise((r) => setTimeout(r, EXEC_DELAY_MS));
+        return normalExec(...args);
+    };
+    const deps = makeDeps({ execAsync: delayedExec });
+    // Bracket the poll with timestamps
+    const beforePoll = Date.now();
+    startPolling(deps);
+    await stopPolling(); // waits for the initial poll to complete
+    const afterPoll = Date.now();
+    // Read the config that was written by the poll
+    const savedConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    const savedTs = savedConfig.automations?.lastPollTimestamp;
+    assert.ok(savedTs !== undefined, 'lastPollTimestamp should have been saved');
+    const savedMs = new Date(savedTs).getTime();
+    assert.ok(savedMs >= beforePoll, `saved timestamp (${savedTs}) should be >= poll start (${new Date(beforePoll).toISOString()})`);
+    assert.ok(savedMs <= afterPoll, `saved timestamp (${savedTs}) should be <= poll end (${new Date(afterPoll).toISOString()})`);
+    // The key invariant: the saved timestamp is the poll-START watermark, not poll-end.
+    // We verify this by confirming it precedes the time after stopPolling returned.
+    // Because exec has a deliberate delay, a poll-END timestamp would be noticeably later.
+    // We simply confirm the saved value is a valid ISO string within the expected window.
+    assert.ok(!isNaN(savedMs), 'saved lastPollTimestamp should be a valid date');
+});
+test('pollInFlight guard prevents overlapping poll cycles', async () => {
+    const INTERVAL_MS = 10;
+    const EXEC_DELAY_MS = 100; // each poll takes ~100ms — far longer than the interval
+    saveConfig(configPath, {
+        ...DEFAULTS,
+        automations: {
+            autoCheckoutReviewRequests: true,
+            pollIntervalMs: INTERVAL_MS,
+            lastPollTimestamp: new Date(Date.now() - 120_000).toISOString(),
+        },
+    });
+    let ghCallCount = 0;
+    const normalExec = makeMockExec({
+        notificationLines: [],
+        remoteUrl: 'https://github.com/owner/my-repo.git',
+        onExec: (cmd, argv) => {
+            if (cmd === 'gh' && argv[0] === 'api')
+                ghCallCount++;
+        },
+    });
+    const delayedExec = async (...args) => {
+        await new Promise((r) => setTimeout(r, EXEC_DELAY_MS));
+        return normalExec(...args);
+    };
+    const deps = makeDeps({ execAsync: delayedExec });
+    startPolling(deps);
+    // Wait long enough for several timer ticks to fire (10ms interval × ~15 ticks = 150ms)
+    // but each poll takes 100ms, so without the guard we would expect many concurrent calls.
+    await new Promise((r) => setTimeout(r, 150));
+    await stopPolling();
+    // Without the pollInFlight guard, 150ms / 10ms = ~15 timer fires would each spawn a poll,
+    // meaning gh could be called ~15 times. With the guard, at most 2 polls can complete
+    // in 150ms (one starting at t=0 finishing at ~100ms, one starting at ~100ms finishing at ~200ms).
+    assert.ok(ghCallCount <= 3, `Expected at most 3 gh calls due to pollInFlight guard (got ${ghCallCount})`);
+    assert.ok(ghCallCount >= 1, `Expected at least 1 gh call to confirm polling ran (got ${ghCallCount})`);
+});

package/dist/test/server/analytics.js

@@ -0,0 +1,121 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import Database from 'better-sqlite3';
+import { Router } from 'express';
+let db = null;
+let insertStmt = null;
+const SCHEMA = `
+CREATE TABLE IF NOT EXISTS events (
+  id          INTEGER PRIMARY KEY AUTOINCREMENT,
+  timestamp   TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%f', 'now')),
+  category    TEXT NOT NULL,  -- 'session', 'ui', 'agent', 'navigation', 'workspace'
+  action      TEXT NOT NULL,
+  target      TEXT,
+  properties  TEXT,
+  session_id  TEXT,
+  device      TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_events_timestamp ON events(timestamp);
+CREATE INDEX IF NOT EXISTS idx_events_category_action ON events(category, action);
+CREATE INDEX IF NOT EXISTS idx_events_target ON events(target);
+`;
+const INSERT_SQL = 'INSERT INTO events (category, action, target, properties, session_id, device) VALUES (?, ?, ?, ?, ?, ?)';
+export function initAnalytics(configDir) {
+    if (db) {
+        db.close();
+        db = null;
+        insertStmt = null;
+    }
+    const dbPath = path.join(configDir, 'analytics.db');
+    db = new Database(dbPath);
+    db.pragma('journal_mode = WAL');
+    db.exec(SCHEMA);
+    insertStmt = db.prepare(INSERT_SQL);
+}
+export function closeAnalytics() {
+    if (db) {
+        db.close();
+        db = null;
+        insertStmt = null;
+    }
+}
+function runInsert(stmt, event) {
+    stmt.run(event.category, event.action, event.target ?? null, event.properties ? JSON.stringify(event.properties) : null, event.session_id ?? null, event.device ?? null);
+}
+export function trackEvent(event) {
+    if (!insertStmt)
+        return;
+    try {
+        runInsert(insertStmt, event);
+    }
+    catch {
+        // Analytics write failure is non-fatal
+    }
+}
+export function getDbPath(configDir) {
+    return path.join(configDir, 'analytics.db');
+}
+export function getDbSize(configDir) {
+    try {
+        return fs.statSync(getDbPath(configDir)).size;
+    }
+    catch {
+        return 0;
+    }
+}
+export function createAnalyticsRouter(configDir) {
+    const router = Router();
+    // POST /analytics/events — batch ingest from frontend
+    router.post('/events', (req, res) => {
+        const { events } = req.body;
+        if (!Array.isArray(events)) {
+            res.status(400).json({ error: 'events array required' });
+            return;
+        }
+        if (!db || !insertStmt) {
+            res.status(503).json({ error: 'Analytics not initialized' });
+            return;
+        }
+        const stmt = insertStmt;
+        const insertMany = db.transaction((evts) => {
+            let inserted = 0;
+            for (const evt of evts) {
+                if (!evt.category || !evt.action)
+                    continue;
+                runInsert(stmt, evt);
+                inserted++;
+            }
+            return inserted;
+        });
+        try {
+            const inserted = insertMany(events);
+            res.json({ ok: true, count: inserted });
+        }
+        catch {
+            res.status(500).json({ error: 'Failed to write events' });
+        }
+    });
+    // GET /analytics/size — DB file size in bytes
+    router.get('/size', (_req, res) => {
+        res.json({ bytes: getDbSize(configDir) });
+    });
+    // DELETE /analytics/events — truncate events table
+    router.delete('/events', (_req, res) => {
+        if (!db) {
+            res.status(503).json({ error: 'Analytics not initialized' });
+            return;
+        }
+        try {
+            db.exec('DELETE FROM events');
+            try {
+                db.pragma('wal_checkpoint(TRUNCATE)');
+            }
+            catch { /* best-effort */ }
+            res.json({ ok: true });
+        }
+        catch {
+            res.status(500).json({ error: 'Failed to clear analytics' });
+        }
+    });
+    return router;
+}

package/dist/test/server/auth.js

@@ -0,0 +1,63 @@
+import crypto from 'node:crypto';
+import { promisify } from 'node:util';
+const scrypt = promisify(crypto.scrypt);
+const SCRYPT_KEYLEN = 64;
+const MAX_ATTEMPTS = 5;
+const LOCKOUT_DURATION_MS = 15 * 60 * 1000; // 15 minutes
+const attemptMap = new Map();
+export async function hashPin(pin) {
+    const salt = crypto.randomBytes(16).toString('hex');
+    const derived = await scrypt(pin, salt, SCRYPT_KEYLEN);
+    return `scrypt:${salt}:${derived.toString('hex')}`;
+}
+export async function verifyPin(pin, hash) {
+    if (hash.startsWith('scrypt:')) {
+        const [, salt, storedHashHex] = hash.split(':');
+        if (!salt || !storedHashHex)
+            return false;
+        try {
+            const storedBuf = Buffer.from(storedHashHex, 'hex');
+            if (storedBuf.length !== SCRYPT_KEYLEN)
+                return false;
+            const derived = await scrypt(pin, salt, SCRYPT_KEYLEN);
+            return crypto.timingSafeEqual(storedBuf, derived);
+        }
+        catch {
+            return false;
+        }
+    }
+    // Legacy bcrypt hashes are migrated at startup; if one reaches here, reject it
+    return false;
+}
+export function isRateLimited(ip) {
+    const entry = attemptMap.get(ip);
+    if (!entry)
+        return false;
+    if (entry.lockedUntil) {
+        if (Date.now() < entry.lockedUntil) {
+            return true;
+        }
+        attemptMap.delete(ip);
+    }
+    return false;
+}
+export function recordFailedAttempt(ip) {
+    const entry = attemptMap.get(ip) ?? { count: 0, lockedUntil: null };
+    entry.count += 1;
+    if (entry.count >= MAX_ATTEMPTS) {
+        entry.lockedUntil = Date.now() + LOCKOUT_DURATION_MS;
+    }
+    attemptMap.set(ip, entry);
+}
+export function clearRateLimit(ip) {
+    attemptMap.delete(ip);
+}
+export function generateCookieToken() {
+    return crypto.randomBytes(32).toString('hex');
+}
+export function isLegacyHash(hash) {
+    return !!hash && !hash.startsWith('scrypt:');
+}
+export function _resetForTesting() {
+    attemptMap.clear();
+}

package/dist/test/server/branch-linker.js

@@ -0,0 +1,124 @@
+import path from 'node:path';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { Router } from 'express';
+import { loadConfig } from './config.js';
+const execFileAsync = promisify(execFile);
+const GIT_TIMEOUT_MS = 10_000;
+const CACHE_TTL_MS = 60_000;
+let cache = null;
+/** Clears the branch linker cache (call when sessions are created or ended). */
+export function invalidateBranchLinkerCache() {
+    cache = null;
+}
+/**
+ * Extracts all ticket IDs from a branch name.
+ * Returns an array of normalized ticket IDs (e.g. "PROJ-123", "GH-456").
+ */
+function extractTicketIds(branchName) {
+    const ids = [];
+    // Jira/Linear style: PROJECT-123 (2+ uppercase letters, dash, digits)
+    // Skip "GH" prefix — that's our GitHub Issues namespace, handled separately below.
+    const jiraRegex = /([A-Z]{2,}-\d+)/gi;
+    let match;
+    while ((match = jiraRegex.exec(branchName)) !== null) {
+        if (match[1] && match[1].toUpperCase().split('-')[0] !== 'GH') {
+            ids.push(match[1].toUpperCase());
+        }
+    }
+    // GitHub Issues: gh-123 at word boundaries (start/end or preceded/followed by dash or slash)
+    const ghRegex = /(?:^|[-/])gh-(\d+)(?:[-/]|$)/gi;
+    while ((match = ghRegex.exec(branchName)) !== null) {
+        ids.push(`GH-${match[1]}`);
+    }
+    return ids;
+}
+/**
+ * Creates and returns an Express Router that handles all /branch-linker routes.
+ *
+ * Caller is responsible for mounting and applying auth middleware:
+ *   app.use('/branch-linker', requireAuth, createBranchLinkerRouter({ configPath }));
+ */
+export function createBranchLinkerRouter(deps) {
+    const { configPath } = deps;
+    const exec = deps.execAsync ?? execFileAsync;
+    const getActiveBranchNames = deps.getActiveBranchNames ?? (() => new Map());
+    const router = Router();
+    function getConfig() {
+        return loadConfig(configPath);
+    }
+    /** Core link-building logic, usable both from the HTTP handler and internal callers. */
+    async function fetchLinks() {
+        const config = getConfig();
+        const workspacePaths = config.workspaces ?? [];
+        if (workspacePaths.length === 0) {
+            return {};
+        }
+        const now = Date.now();
+        // Return cached result if still fresh
+        if (cache && now - cache.fetchedAt < CACHE_TTL_MS) {
+            return cache.links;
+        }
+        // Get active branch names per repo from sessions
+        const activeBranchNames = getActiveBranchNames();
+        // Fetch branches per workspace using Promise.allSettled (partial failures are non-fatal)
+        const results = await Promise.allSettled(workspacePaths.map(async (wsPath) => {
+            let stdout;
+            try {
+                ({ stdout } = await exec('git', ['branch', '--format=%(refname:short)'], { cwd: wsPath, timeout: GIT_TIMEOUT_MS }));
+            }
+            catch {
+                // Not a git repo or git not available — non-fatal
+                return [];
+            }
+            const repoName = path.basename(wsPath);
+            const activeInRepo = activeBranchNames.get(wsPath) ?? new Set();
+            const branchNames = stdout.split('\n').map((b) => b.trim()).filter(Boolean);
+            const links = [];
+            for (const branchName of branchNames) {
+                const ticketIds = extractTicketIds(branchName);
+                for (const ticketId of ticketIds) {
+                    links.push({
+                        ticketId,
+                        link: {
+                            repoPath: wsPath,
+                            repoName,
+                            branchName,
+                            hasActiveSession: activeInRepo.has(branchName),
+                        },
+                    });
+                }
+            }
+            return links;
+        }));
+        // Build the ticket -> BranchLink[] map
+        const linksMap = new Map();
+        for (const result of results) {
+            if (result.status === 'fulfilled') {
+                for (const { ticketId, link } of result.value) {
+                    const existing = linksMap.get(ticketId);
+                    if (existing) {
+                        existing.push(link);
+                    }
+                    else {
+                        linksMap.set(ticketId, [link]);
+                    }
+                }
+            }
+        }
+        // Convert Map to plain object for JSON serialization
+        const response = {};
+        for (const [ticketId, links] of linksMap) {
+            response[ticketId] = links;
+        }
+        // Update module-level cache
+        cache = { links: response, fetchedAt: now };
+        return response;
+    }
+    // GET /branch-linker/links — map of ticketId -> BranchLink[]
+    router.get('/links', async (_req, res) => {
+        const response = await fetchLinks();
+        res.json(response);
+    });
+    return Object.assign(router, { fetchLinks });
+}