spidersan 0.10.0 → 0.20.2

package/dist/commands/conflicts.js

@@ -11,17 +11,83 @@ import { Command } from 'commander';
 import { compilePatterns } from '../lib/regex-utils.js';
 import { execFileSync, spawnSync } from 'child_process';
 import { basename } from 'path';
-import { homedir } from 'os';
 import { getStorage } from '../storage/index.js';
-import { ASTParser } from '../lib/ast.js';
-import { validateBranchName } from '../lib/security.js';
+import { SupabaseStorage } from '../storage/supabase.js';
+import { resolveSupabaseCredentials } from '../lib/supabase-credentials.js';
+import { loadMachineIdentity } from '../lib/machine.js';
+import { getRepoName, registryRepoNames, resolveBranchRef } from '../lib/git.js';
+import { analyzeSemantic, resolveBranchTip, resolveCrossMachineRef } from '../lib/semantic-analysis.js';
+import { getCLIPath } from '../lib/security.js';
 import { isExcludedPath } from './register.js';
 import { loadConfig } from '../lib/config.js';
+import { ECOSYSTEM_UNCONFIGURED_HINT, resolveEcosystemRepos } from '../lib/ecosystem-env.js';
 import { logActivity } from '../lib/activity.js';
-import { isGhAvailable, getPRDetails } from '../lib/github.js';
+import { isGhAvailable, getPRDetails, getPRLabels, listOpenPRs, getPRChangedFiles } from '../lib/github.js';
+import { analyzeCarries } from '../lib/carries.js';
 import { classifyWithLabel } from '../lib/conflict-tier.js';
-// Config
-const HUB_URL = process.env.HUB_URL || 'https://hub.treebird.uk';
+import { createNotifier, deliver } from '../lib/notify.js';
+import { analyzeRealConflicts } from '../lib/git-merge-analyzer.js';
+import { getTrunkBranch } from '../lib/trunk.js';
+import { activeBranches } from '../lib/reconcile.js';
+// Lazy so the transport is resolved at first use, not at import.
+let _notifier = null;
+function notifier() {
+    return (_notifier ??= createNotifier());
+}
+/**
+ * Pull other machines' registered branches as synthetic conflict targets.
+ *
+ * Why this exists: the registry is per-machine local state, and the pre-push /
+ * pre-merge hook calls `conflicts`. Without this, a teammate on another machine
+ * editing the same file was NEVER flagged — the hook advisory silently only ever
+ * saw local branches, giving false "you're good to merge" confidence. The data
+ * was already in Supabase (`registry-sync --push` writes it, `cross-conflicts`
+ * reads it); `conflicts` just never asked (tb-ly0b).
+ *
+ * Fail-open by design: unconfigured / offline / auth failure returns [] so the
+ * check degrades to local-only rather than blocking a push. Callers that need to
+ * distinguish "no conflicts" from "couldn't check" should use `cross-conflicts`.
+ *
+ * ponytail: one Supabase round-trip, only on the branch-overlap path (--real and
+ * --ecosystem return before this). Sub-second in practice and the hook is fail-open.
+ */
+export function crossMachineBranches(views) {
+    const branches = [];
+    for (const view of views) {
+        for (const b of view.branches) {
+            // Non-active entries are another machine's finished/abandoned work,
+            // and a file-less entry can never overlap — both would be phantom
+            // conflicts, which this codebase treats as worse than a miss.
+            if (b.status !== 'active' || !b.files?.length)
+                continue;
+            branches.push({
+                ...b,
+                // Machine-qualified so the report distinguishes a remote branch
+                // from a local one of the same name (e.g. two mains).
+                name: `${view.machine_name}/${b.name}`,
+            });
+        }
+    }
+    return branches;
+}
+async function fetchCrossMachineBranches(ownBranches = []) {
+    try {
+        const creds = await resolveSupabaseCredentials();
+        if (!creds)
+            return { branches: [], degraded: false, status: 'no-credentials' };
+        const machine = await loadMachineIdentity();
+        const supabase = new SupabaseStorage(creds);
+        // Excluding our own machine_id matters: without it this machine's own
+        // pushed rows come back and conflict against themselves.
+        // ownBranches: a branch pushed from here can reach the registry as a pushed-branch
+        // row before this machine's own registry-sync lands; it must not conflict with itself.
+        const views = await supabase.pullRegistries(registryRepoNames(), machine.id, ownBranches);
+        return { branches: crossMachineBranches(views), degraded: false, status: 'checked' };
+    }
+    catch {
+        return { branches: [], degraded: true, status: 'degraded' };
+    }
+}
 function getCurrentBranch() {
     try {
         return execFileSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { encoding: 'utf-8' }).trim();
@@ -30,7 +96,7 @@ function getCurrentBranch() {
         throw new Error('Not in a git repository');
     }
 }
-async function notifyHub(branch, conflicts) {
+async function notifyConflicts(branch, conflicts) {
     let hasTier3 = false;
     let hasTier2 = false;
     for (const c of conflicts) {
@@ -45,154 +111,26 @@ async function notifyHub(branch, conflicts) {
         return;
     const severity = hasTier3 ? '🔴 TIER 3 BLOCK' : '🟠 TIER 2 PAUSE';
     const message = `🕷️⚠️ **Conflict Alert** on \`${branch}\`\n\n${severity}\n\nConflicting files require coordination.`;
-    try {
-        await fetch(`${HUB_URL}/api/chat`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                agent: 'spidersan',
-                name: 'Spidersan',
-                message,
-                glyph: '🕷️'
-            })
-        });
-    }
-    catch {
-        // Hub offline - silent fail
-    }
+    const contested = [...new Set(conflicts.flatMap((c) => c.files))].sort();
+    // `deliver` inspects the result and logs the real outcome. The previous
+    // implementation POSTed to a decommissioned host inside a bare `catch {}`,
+    // so `--notify` reported nothing either way. (sp-hnjf)
+    await deliver(notifier(), {
+        repo: getRepoName(),
+        branch,
+        tier: hasTier3 ? 3 : 2,
+        message,
+        dedupe: `conflicts:${branch}:${contested.join(',')}`,
+        files: contested,
+        // stderr, not stdout: this runs before the --json blob is printed, and a
+        // delivery diagnostic must never end up inside machine-readable output.
+    }, (m) => console.error(m));
 }
-/**
- * Wake a conflicting agent and send them a message about what to fix
- */
-async function wakeConflictingAgent(agentId, myBranch, theirBranch, _conflictingFiles) {
-    // 1. Wake the agent via Hub
-    try {
-        const wakeResponse = await fetch(`${HUB_URL}/api/wake/${agentId}`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                sender: 'spidersan',
-                reason: `Conflict on ${theirBranch} - need resolution`
-            })
-        });
-        if (wakeResponse.ok) {
-            console.log(`  🔔 Wake signal sent to ${agentId}`);
-        }
-    }
-    catch {
-        console.log(`  ⚠️ Could not wake ${agentId} via Hub`);
-    }
-    return true;
-}
-/**
- * Wait for a specified time
- */
-function sleep(ms) {
-    return new Promise(resolve => setTimeout(resolve, ms));
-}
-/**
- * Suggest simple resolutions for add/add style conflicts where both branches added the same file
- * Typically occurs with docs or generated files. This prints guidance and a recommended sequence
- * to preserve both variants for auditability (e.g., create a .incoming copy).
- */
-function suggestAddAddResolution(conflicts) {
-    const addAddFiles = new Set();
-    for (const conflict of conflicts) {
-        for (const f of conflict.files) {
-            // Simple heuristic: docs and markdown files are common add/add candidates
-            if (/\.md$/.test(f) || /docs\//.test(f)) {
-                addAddFiles.add(f);
-            }
-        }
-    }
-    if (addAddFiles.size === 0)
-        return;
-    console.log('\n💡 Add/Add Conflict Helper');
-    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-    console.log('Detected files added in both branches. Recommended actions:');
-    console.log('  1. Preserve incoming variant for auditability:');
-    console.log('       git checkout --theirs <file> && mv <file> <file>.<their-branch>.incoming && git add <file>.<their-branch>.incoming');
-    console.log('  2. Keep canonical version in main branch and include note linking the incoming variant.');
-    console.log('  3. Commit and continue rebase: git add -A && git rebase --continue');
-    console.log('\nExamples:');
-    for (const f of addAddFiles) {
-        console.log(`   • ${f} -> preserve incoming as ${f}.incoming`);
-    }
-    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n');
-}
-/**
- * Prompt user for Y/N confirmation (prevents Ralph Wiggum loops)
- * @param prompt - The question to ask
- * @param autoConfirm - If true, skip prompt and return true (for --auto mode)
- */
-async function confirmAction(prompt, autoConfirm = false) {
-    if (autoConfirm) {
-        console.log(`${prompt} [Y/n]: Y (auto)`);
-        return true;
-    }
-    const readline = await import('readline');
-    const rl = readline.createInterface({
-        input: process.stdin,
-        output: process.stdout
-    });
-    return new Promise((resolve) => {
-        rl.question(`${prompt} [Y/n]: `, (answer) => {
-            rl.close();
-            const normalized = answer.toLowerCase().trim();
-            resolve(normalized === '' || normalized === 'y' || normalized === 'yes');
-        });
-    });
-}
-// ── Ecosystem scan ────────────────────────────────────────────────────────────
-/**
- * Default ecosystem repos. Configurable via SPIDERSAN_ECOSYSTEM env var.
- * Falls back to ~/Dev/ structure (old) or ~/Dev/projects/ structure (new).
- */
-function getDefaultEcosystemRepos() {
-    if (process.env.SPIDERSAN_ECOSYSTEM) {
-        return process.env.SPIDERSAN_ECOSYSTEM.split(':').map((r) => r.trim()).filter(Boolean);
-    }
-    const homeDir = process.env.HOME || homedir();
-    return [
-        `${homeDir}/Dev/Envoak`,
-        `${homeDir}/Dev/treebird-internal`,
-        `${homeDir}/Dev/spidersan`,
-        `${homeDir}/Dev/Toak`,
-        `${homeDir}/Dev/flockview`,
-        `${homeDir}/Dev/mappersan`,
-        `${homeDir}/Dev/treebird`,
-        `${homeDir}/Dev/treementor`,
-        // Agent repos
-        `${homeDir}/Dev/Artisan`,
-        `${homeDir}/Dev/Birdsan`,
-        `${homeDir}/Dev/Cosan`,
-        `${homeDir}/Dev/Marksan`,
-        `${homeDir}/Dev/Sherlocksan`,
-        `${homeDir}/Dev/Teachersan`,
-        `${homeDir}/Dev/Watsan`,
-        `${homeDir}/Dev/Yosef`,
-        // Tools & libs
-        `${homeDir}/Dev/boidz`,
-        `${homeDir}/Dev/beads`,
-        `${homeDir}/Dev/birdseye`,
-        `${homeDir}/Dev/invoak`,
-        `${homeDir}/Dev/myceliumail`,
-        `${homeDir}/Dev/nanoclaw`,
-        `${homeDir}/Dev/nanoclaw-private`,
-        `${homeDir}/Dev/proaksy`,
-        `${homeDir}/Dev/sasu`,
-        `${homeDir}/Dev/skills`,
-        `${homeDir}/Dev/spidersan`,
-        `${homeDir}/Dev/treebird-heavy`,
-        `${homeDir}/Dev/Recovery-Tree-New`,
-    ];
-}
-const DEFAULT_ECOSYSTEM_REPOS = getDefaultEcosystemRepos();
 function runEcosystemScan(repos, asJson) {
     const results = [];
     for (const repo of repos) {
         const name = basename(repo);
-        const result = spawnSync('spidersan', ['conflicts', '--json'], { cwd: repo, encoding: 'utf-8', timeout: 15000 });
+        const result = spawnSync(process.execPath, [getCLIPath(), 'conflicts', '--json'], { cwd: repo, encoding: 'utf-8', timeout: 15000 });
         if (result.status === null || result.error) {
             results.push({ repo, name, tier3: 0, tier2: 0, tier1: 0, error: 'spawn failed' });
             continue;
@@ -253,33 +191,280 @@ function runEcosystemScan(repos, asJson) {
     console.log(`📊 Total: 🔴 ${totals.tier3} BLOCK | 🟠 ${totals.tier2} PAUSE | 🟡 ${totals.tier1} WARN`);
     console.log(`   Repos scanned: ${results.length} | With conflicts: ${reposWithConflicts}`);
 }
+// ── Real (git merge-tree) conflict scan ─────────────────────────────────────────
+/**
+ * Render a single real-conflict report (git merge-tree backed) to the console.
+ * `✅ <branch>: clean vs <base>` or `⚠️ <branch>: N real conflict(s) vs <base>`
+ * with the conflicting file list + kind, plus a dim `method` line. On an
+ * environmental `error`, prints it and returns (caller continues to the next target).
+ */
+function renderRealReport(report) {
+    if (report.error) {
+        console.log(`❌ ${report.branch}: ${report.error}`);
+        return;
+    }
+    if (report.clean) {
+        console.log(`✅ ${report.branch}: clean vs ${report.base}`);
+    }
+    else {
+        const n = report.conflicts.length;
+        console.log(`⚠️ ${report.branch}: ${n} real conflict${n === 1 ? '' : 's'} vs ${report.base}`);
+        for (const c of report.conflicts) {
+            console.log(`   • ${c.file} (${c.kind})`);
+        }
+    }
+    // Dim trailing line showing which git path produced the result.
+    console.log(`\x1b[2m   method: ${report.method}\x1b[0m`);
+}
+/**
+ * `conflicts --real`: compute TRUE merge conflicts via git merge-tree against the
+ * trunk (or `--base`), for the current branch / `--branch` / (with `--all`) every
+ * active registered branch.
+ *
+ * Pure git for the single-target path — works with NO `.spidersan/registry.json`.
+ * Only `--all` (which enumerates registered branches) requires an initialized
+ * registry, and that path is gated here.
+ *
+ * @returns the process exit code (0 always, unless `--exit-code` + conflicts → 1).
+ */
+/**
+ * The ref `--real` merges INTO: the remote-tracking trunk when it exists,
+ * otherwise the local branch name.
+ *
+ * A local trunk in a long-lived checkout can lag origin badly — a leftover
+ * worktree pinning the branch ref held one 78 commits back — and merge-tree
+ * against a stale base resolves cleanly where the real merge does not. That is
+ * a green earned by comparing against the wrong thing (sp-vifo). The `--pr` arm
+ * already reasoned this way (tb-57fr); this generalises it to `--branch`,
+ * `--all` and the current branch.
+ *
+ * Does NOT fetch: it reads refs already on disk, because this runs from a
+ * pre-merge hook and a check that hits the network every invocation is a
+ * different problem. `origin/<trunk>` can therefore be stale too — the report
+ * always names the base it used, so the reader can see what was compared.
+ */
+function resolveRealBase(trunk) {
+    const ref = resolveBranchRef(trunk);
+    return ref?.startsWith('refs/remotes/') ? `origin/${trunk}` : trunk;
+}
+/** precondition(pr): `needs-<kind>:<resource>` labels gate a PR until they're cleared. */
+const NEEDS_LABEL = /^needs-[a-z0-9]+:/i;
+function preconditionLabels(labels) {
+    return labels.filter((l) => NEEDS_LABEL.test(l));
+}
+function renderGate(gate) {
+    if (gate.unknown) {
+        console.log('\n🛑 precondition UNKNOWN: could not read PR labels (gh missing/unauthenticated) — failing closed.');
+    }
+    else if (gate.unmet) {
+        console.log(`\n🛑 precondition UNMET: ${gate.labels.join(', ')} — resource not satisfied; clear the label to merge.`);
+    }
+    else {
+        console.log('\n✅ precondition: no unmet needs-* gate.');
+    }
+}
+function renderCarries(report) {
+    const total = report.own.length + report.inherited.length;
+    console.log(`\n🧬 carries: ${total} commit(s) — ${report.own.length} own, ${report.inherited.length} inherited`);
+    for (const c of report.own)
+        console.log(`   • ${c.sha.slice(0, 7)} ${c.subject}  (own)`);
+    for (const c of report.inherited) {
+        console.log(`   🚩 ${c.sha.slice(0, 7)} ${c.subject}  — also on ${c.branches.join(', ')}`);
+    }
+    if (report.flagged) {
+        console.log('   ⚠️ provenance: this PR carries commits from another open branch — merging lands them too.');
+    }
+}
+async function runRealConflicts(options) {
+    // `|| resolveRealBase(...)` short-circuits: an explicit --base skips trunk
+    // detection entirely, as it always has.
+    let base = options.base || resolveRealBase(getTrunkBranch());
+    // Determine target branches.
+    let targets;
+    let prNumber;
+    if (options.pr) {
+        // --pr in real mode: the PR head isn't a local ref, so fetch it. Without
+        // this, --real fell through to getCurrentBranch() and silently checked
+        // trunk-vs-trunk → a false "clean" (tb-57fr).
+        prNumber = parseInt(options.pr, 10);
+        if (isNaN(prNumber) || prNumber <= 0) {
+            console.error('❌ Invalid PR number. Provide a positive integer, e.g. --pr 42');
+            return 1;
+        }
+        const ref = `refs/spidersan/pr-${prNumber}`;
+        try {
+            // pull/<n>/head exists on the base repo even for fork PRs.
+            // Leading '+' forces the update — after a PR force-push the stashed
+            // ref is non-fast-forward and a plain refspec would fail forever.
+            execFileSync('git', ['fetch', '--quiet', 'origin', `+pull/${prNumber}/head:${ref}`], { stdio: 'pipe' });
+            // Check against the REMOTE trunk, not a possibly-stale local one — a PR
+            // merges into origin's HEAD. Falling back to local `main` (which can lag)
+            // is the same false-confidence class as tb-57fr.
+            if (!options.base) {
+                const trunk = getTrunkBranch();
+                // Unlike resolveRealBase(), this arm DOES fetch — it is already
+                // fetching the PR head, and a PR merges into origin's tip.
+                execFileSync('git', ['fetch', '--quiet', 'origin', trunk], { stdio: 'pipe' });
+                base = `origin/${trunk}`;
+            }
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(`❌ Could not fetch PR #${prNumber} head: ${msg}`);
+            return 1;
+        }
+        targets = [ref];
+    }
+    else if (options.all) {
+        // --all enumerates registered branches → requires an initialized registry.
+        const storage = await getStorage();
+        if (!(await storage.isInitialized())) {
+            console.error('❌ Spidersan not initialized. Run: spidersan init');
+            console.error('   (--real --all needs the registry; --real alone does not)');
+            return 1;
+        }
+        // Reconcile-on-read: fold git truth over stale `active` status so a
+        // branch already merged into trunk isn't checked for conflicts (tb-8sa.1).
+        targets = activeBranches(await storage.list()).map((b) => b.name);
+    }
+    else {
+        targets = [options.branch || getCurrentBranch()];
+    }
+    const results = [];
+    for (const branch of targets) {
+        results.push(await analyzeRealConflicts(base, branch));
+    }
+    const anyConflicts = results.some((r) => !r.error && !r.clean);
+    // --pr extras: precondition() gate + carries() provenance (opt-in, compose).
+    let gate;
+    let carries;
+    if (prNumber !== undefined) {
+        const ref = `refs/spidersan/pr-${prNumber}`;
+        if (options.gate) {
+            // Fail closed: if gh is missing or the label fetch errors we cannot
+            // prove the gate is clear, so it stays unmet.
+            const labels = isGhAvailable() ? await getPRLabels(prNumber) : null;
+            if (labels === null) {
+                gate = { labels: [], unmet: true, unknown: true };
+            }
+            else {
+                const needs = preconditionLabels(labels);
+                gate = { labels: needs, unmet: needs.length > 0 };
+            }
+        }
+        if (options.carries) {
+            const self = [base]; // exclude base + the PR's own remote head from "other branch"
+            try {
+                self.push(`origin/${(await getPRDetails(prNumber)).headBranch}`);
+            }
+            catch { /* best-effort self-exclusion */ }
+            carries = analyzeCarries(base, ref, self);
+        }
+    }
+    if (options.json) {
+        console.log(JSON.stringify({ base, results, carries, gate }, null, 2));
+    }
+    else {
+        if (results.length === 0) {
+            console.log(`🕷️ No active branches to check vs ${base}.`);
+        }
+        for (const report of results) {
+            renderRealReport(report);
+        }
+        if (gate)
+            renderGate(gate);
+        if (carries)
+            renderCarries(carries);
+    }
+    // --strict is the advertised CI flag on the legacy path; honour it here too
+    // instead of silently ignoring it (real conflicts are always tier-blocking).
+    return (options.exitCode || options.strict) && (anyConflicts || gate?.unmet === true) ? 1 : 0;
+}
 export const conflictsCommand = new Command('conflicts')
     .description('Detect file conflicts between branches (with tiered blocking)')
     .option('--branch <name>', 'Check conflicts for specific branch')
     .option('--pr <number>', 'Check conflicts for a GitHub pull request by number')
+    .option('--vs-prs', 'Also detect conflicts against other open PRs (not just registered branches); composes with --real')
     .option('--json', 'Output as JSON')
     .option('--tier <level>', 'Filter by minimum tier (1, 2, or 3)', '1')
     .option('--strict', 'Strict mode: exit with error if TIER 2+ conflicts found')
-    .option('--notify', 'Notify Hub of TIER 2+ conflicts')
-    .option('--wake', 'Wake conflicting agents and send them fix instructions')
-    .option('--retry <seconds>', 'After waking, wait N seconds and re-check conflicts')
-    .option('--auto', 'Auto mode: skip confirmations (enables Ralph Wiggum loop)')
-    .option('--max-retries <count>', 'Maximum retry attempts in auto mode (default: 5)', '5')
+    .option('--notify', 'Deliver TIER 2+ conflicts to the configured alert room (SPIDERSAN_ROOM_TOKEN)')
     .option('--semantic', 'Use semantic (AST) analysis for symbol-level conflict detection')
     .option('--ecosystem', 'Scan all ecosystem repos and aggregate conflict tiers')
     .option('--repos <paths>', 'Comma-separated repo paths for --ecosystem scan')
+    .option('--real', 'Compute TRUE merge conflicts via git merge-tree (vs registry overlap)')
+    .option('--base <ref>', 'Base/trunk ref to merge into for --real (default: detected trunk)')
+    .option('--all', 'With --real: check every active registered branch')
+    .option('--exit-code', 'With --real: exit 1 if any real conflicts found (like git diff)')
+    .option('--carries', 'With --pr: show carries() provenance (own vs inherited commits)')
+    .option('--gate', 'With --pr: check precondition() needs-* labels; --exit-code blocks if unmet')
     .action(async (options) => {
+    // ── Real (git merge-tree) conflicts ──────────────────────────────────
+    // Runs BEFORE the storage-init guard: a single-target real check is pure
+    // git and must work with no .spidersan/registry.json. Only --real --all
+    // touches the registry, and runRealConflicts gates that path itself.
+    //
+    // --pr defaults to the real merge-tree path (tb-8hgg): "will this PR merge
+    // into trunk" is the common question and file-overlap false-positives it
+    // (see #80/identity.ts). Opt into the legacy file-overlap check with --vs-prs.
+    //
+    // --real --vs-prs COMPOSES: it runs the merge-tree check vs trunk AND then
+    // falls through to the cross-PR/overlap pass, because the two answer
+    // different questions ("does this merge?" vs "is anyone else touching these
+    // files?") and /spidersan documents `conflicts --pr <N> --real --vs-prs` as
+    // THE authoritative pre-merge check. Before sp-a1l3 the `options.real` arm
+    // returned here, so that documented command silently dropped the cross-PR
+    // half and exited 0 looking healthy — a check reporting success while doing
+    // nothing. Exit codes are composed at the end via finish(): real conflicts
+    // are tier-blocking, overlap is advisory (only --strict makes it block), so
+    // the process code is max(real, overlap).
+    const composeRealAndOverlap = !!(options.real && options.vsPrs);
+    let realExitCode = 0;
+    if (options.real || (options.pr && !options.vsPrs)) {
+        realExitCode = await runRealConflicts(options);
+        if (!composeRealAndOverlap) {
+            if (realExitCode !== 0)
+                process.exit(realExitCode);
+            return;
+        }
+        console.log(''); // separate the two reports
+    }
+    /**
+     * Terminate the overlap pass, folding in the real-conflict verdict.
+     * On the composed path a non-zero code from EITHER half must survive;
+     * on the plain overlap path realExitCode is 0, so behaviour is unchanged.
+     */
+    const finish = (overlapCode) => {
+        const code = Math.max(realExitCode, overlapCode);
+        if (code !== 0)
+            process.exit(code);
+    };
     // ── Ecosystem shortcut ───────────────────────────────────────────────
     if (options.ecosystem) {
-        const repos = options.repos
-            ? options.repos.split(',').map((r) => r.trim()).filter(Boolean)
-            : DEFAULT_ECOSYSTEM_REPOS;
+        // No built-in repo list ships with the package: the list comes from
+        // --repos, SPIDERSAN_ECOSYSTEM (path list) or conflicts.ecosystemRepos.
+        const { repos } = resolveEcosystemRepos(await loadConfig(), {
+            reposFlag: options.repos,
+        });
+        if (repos.length === 0) {
+            console.error(`ℹ️  ${ECOSYSTEM_UNCONFIGURED_HINT}`);
+        }
         runEcosystemScan(repos, !!options.json);
+        finish(0);
         return;
     }
     const storage = await getStorage();
     const config = await loadConfig();
     if (!await storage.isInitialized()) {
+        // --real is deliberately registry-independent; adding --vs-prs must not
+        // turn a working real check into a hard failure. Degrade loudly instead
+        // of dying — but never silently (sp-a1l3).
+        if (composeRealAndOverlap) {
+            console.error('⚠️  Overlap/cross-PR check skipped: spidersan not initialized here (run: spidersan init).');
+            console.error('   The --real merge-tree result above stands on its own; the --vs-prs half did NOT run.');
+            finish(0);
+            return;
+        }
         console.error('❌ Spidersan not initialized. Run: spidersan init');
         process.exit(1);
     }
@@ -291,6 +476,8 @@ export const conflictsCommand = new Command('conflicts')
     const compiledMedium = compilePatterns(mediumSeverity);
     let targetBranch;
     let targetFiles;
+    let targetPrNumber;
+    const prNumberByLabel = new Map(); // display label -> PR number (labels are NOT git refs)
     if (options.pr) {
         // --pr mode: fetch PR head branch + changed files from GitHub
         const prNumber = parseInt(options.pr, 10);
@@ -314,6 +501,7 @@ export const conflictsCommand = new Command('conflicts')
         }
         targetBranch = prDetails.headBranch;
         targetFiles = prDetails.files;
+        targetPrNumber = prNumber;
         console.log(`🕷️ Checking conflicts for PR #${prNumber}: "${prDetails.title}"`);
         console.log(`   Branch: ${targetBranch} (${targetFiles.length} file(s) changed)`);
     }
@@ -322,13 +510,57 @@ export const conflictsCommand = new Command('conflicts')
         targetBranch = options.branch || getCurrentBranch();
         const target = await storage.get(targetBranch);
         if (!target) {
+            // Same reasoning as the isInitialized() guard above: on the composed
+            // --real --vs-prs path the real check already produced a valid answer,
+            // so an unregistered branch degrades the overlap half loudly rather
+            // than failing the whole command (sp-a1l3).
+            if (composeRealAndOverlap) {
+                console.error(`⚠️  Overlap/cross-PR check skipped: branch "${targetBranch}" is not registered (run: spidersan register --files "...").`);
+                console.error('   The --real merge-tree result above stands on its own; the --vs-prs half did NOT run.');
+                finish(0);
+                return;
+            }
             console.error(`❌ Branch "${targetBranch}" is not registered.`);
             console.error('   Run: spidersan register --files "..."');
             process.exit(1);
         }
         targetFiles = target.files;
     }
-    const allBranches = await storage.list();
+    // Reconcile-on-read: branches already merged into trunk drop out before
+    // overlap detection, so a stale `active` entry can't phantom-conflict (tb-8sa.1).
+    const allBranches = activeBranches(await storage.list());
+    // --vs-prs: pull other open PRs as conflict targets too, so two simultaneous
+    // PRs touching the same files flag each other even when neither branch is in
+    // the local registry. PRs become synthetic active "branches" (no agent → wake
+    // skips them). Self (same headBranch) is excluded.
+    // ponytail: 1 + N gh calls (list + per-PR diff); fine for typical open-PR counts,
+    // parallelise if a repo ever carries hundreds of open PRs.
+    const prHeadBranches = [];
+    if (options.vsPrs) {
+        if (!isGhAvailable()) {
+            console.error('⚠️  --vs-prs needs gh (unavailable/unauthenticated); checking registered branches only.');
+        }
+        else {
+            const openPRs = (await listOpenPRs()).filter(pr => pr.headBranch !== targetBranch);
+            prHeadBranches.push(...openPRs.map(pr => pr.headBranch));
+            openPRs.forEach(pr => prNumberByLabel.set(`PR #${pr.number} (${pr.headBranch})`, pr.number));
+            const prBranches = await Promise.all(openPRs.map(async (pr) => ({
+                name: `PR #${pr.number} (${pr.headBranch})`,
+                files: await getPRChangedFiles(pr.number),
+                registeredAt: new Date(),
+                status: 'active',
+                description: pr.title,
+            })));
+            allBranches.push(...prBranches.filter(b => b.files.length > 0));
+        }
+    }
+    // Cross-machine: other machines' registered branches are conflict targets
+    // too. Automatic (not opt-in) so the pre-push/pre-merge hook — which calls
+    // plain `conflicts` — actually catches a teammate on another machine
+    // touching the same file. Fail-open: degraded => local-only (tb-ly0b).
+    const cross = await fetchCrossMachineBranches([targetBranch, ...allBranches.map(b => b.name), ...prHeadBranches]);
+    allBranches.push(...cross.branches);
+    const crossMachineLabels = new Set(cross.branches.map(b => b.name)); // origin-only refs for these
     const conflicts = [];
     // Performance Optimization: Convert target files to Set for O(1) lookup
     // Reduces complexity from O(N*M*K) to O(N*M) where N=branches, M=files/branch, K=target_files
@@ -363,33 +595,52 @@ export const conflictsCommand = new Command('conflicts')
                     branch: branch.name,
                     files: overlappingFiles,
                     tier: maxTier.tier,
-                    tierInfo: maxTier
+                    tierInfo: maxTier,
+                    ...(branch.sessionId ? { sessionId: branch.sessionId } : {}),
                 });
             }
         }
     }
     // SEMANTIC ANALYSIS with AST parser
-    const semanticConflicts = [];
+    let semanticConflicts = [];
+    let semanticSkipped = []; // files we could not analyze — "no conflicts" is unproven if non-empty
+    let semanticUnsupported = []; // overlapping files of a type --semantic doesn't cover
     if (options.semantic && conflicts.length > 0) {
         console.log('\n🔬 Running semantic (AST) analysis...');
-        const astParser = new ASTParser();
-        for (const conflict of conflicts) {
-            for (const file of conflict.files) {
-                // Only analyze TypeScript/JavaScript files
-                if (!/\.(ts|js|tsx|jsx)$/.test(file))
-                    continue;
-                try {
-                    // Get file content from both branches
-                    // Security: Use execFileSync to prevent command injection via file names
-                    const currentContent = execFileSync('git', ['show', `HEAD:${file}`], { encoding: 'utf-8' });
-                    const otherContent = execFileSync('git', ['show', `${conflict.branch}:${file}`], { encoding: 'utf-8' });
-                    const symbolConflicts = astParser.findSymbolConflicts(currentContent, `${targetBranch}:${file}`, otherContent, `${conflict.branch}:${file}`);
-                    semanticConflicts.push(...symbolConflicts);
-                }
-                catch {
-                    // File might not exist in one branch, skip
-                }
+        const fetchPrRef = (n) => {
+            const ref = `refs/spidersan/pr-${n}`;
+            try {
+                // '+' forces the update after a PR force-push (same as the --real arm)
+                execFileSync('git', ['fetch', '--quiet', 'origin', `+pull/${n}/head:${ref}`], { stdio: 'pipe', timeout: 30_000 }); // bounded: a stalled origin must not hang the command
+                return ref;
+            }
+            catch {
+                return null;
             }
+        };
+        // Labels ("PR #N (branch)", "machine/branch") are display text, not refs:
+        // resolve each to a real ref, or null (→ reported as skipped, never swallowed).
+        const refForLabel = (label) => {
+            const n = prNumberByLabel.get(label);
+            if (n !== undefined)
+                return fetchPrRef(n);
+            // another machine's branch resolves only against origin; a registered local branch is local-first
+            return crossMachineLabels.has(label) ? resolveCrossMachineRef(label) : resolveBranchTip(label);
+        };
+        // Current side: the PR's own head under --pr (HEAD is just whatever is checked out),
+        // else the target branch (HEAD when it is the checked-out one).
+        const currentRef = targetPrNumber !== undefined
+            ? fetchPrRef(targetPrNumber)
+            : targetBranch === getCurrentBranch() ? 'HEAD' : resolveBranchTip(targetBranch);
+        const res = analyzeSemantic(targetBranch, currentRef, conflicts.map(c => ({ label: c.branch, files: c.files, ref: refForLabel(c.branch) })));
+        semanticConflicts = res.conflicts;
+        semanticSkipped = res.skipped;
+        semanticUnsupported = res.unsupported;
+        for (const line of semanticSkipped)
+            console.log(`  ⚠️  ${line}`);
+        if (semanticUnsupported.length > 0) {
+            const shown = semanticUnsupported.slice(0, 5).join(', ') + (semanticUnsupported.length > 5 ? `, +${semanticUnsupported.length - 5} more` : '');
+            console.log(`  ℹ️  not analyzable by --semantic (unsupported file type): ${shown}`);
         }
     }
     // Sort by tier (highest first)
@@ -420,14 +671,15 @@ export const conflictsCommand = new Command('conflicts')
     }
     // Check for blocking conditions
     const shouldBlock = options.strict && (tier3Count > 0 || tier2Count > 0);
-    // Notify Hub if requested
+    // Deliver the alert if requested
     if (options.notify && (tier3Count > 0 || tier2Count > 0)) {
-        await notifyHub(targetBranch, conflicts);
+        await notifyConflicts(targetBranch, conflicts);
     }
     if (options.json) {
         console.log(JSON.stringify({
             branch: targetBranch,
             conflicts,
+            crossMachine: cross.status,
             summary: {
                 tier3: tier3Count,
                 tier2: tier2Count,
@@ -435,13 +687,28 @@ export const conflictsCommand = new Command('conflicts')
                 blocked: shouldBlock
             }
         }, null, 2));
-        if (shouldBlock)
-            process.exit(1);
+        finish(shouldBlock ? 1 : 0);
         return;
     }
     if (conflicts.length === 0) {
-        console.log(`🕷️ No conflicts detected for "${targetBranch}"`);
-        console.log('   ✅ You\'re good to merge!');
+        // Say what was CHECKED, not what we wish it proved. This path compares
+        // registered file lists; it never runs a merge. It is structurally blind
+        // to add/add and content conflicts against the base — so "no overlap"
+        // is not "merges cleanly", and claiming the latter is the lie this
+        // wording removes (PATTERN_silent_success, instance #5).
+        const compared = allBranches.filter((b) => b.name !== targetBranch && b.status === 'active').length;
+        console.log(`🕷️ No registry overlap for "${targetBranch}" (vs ${compared} registered branch${compared === 1 ? '' : 'es'})`);
+        console.log('   ℹ️  Registry-only — NOT a merge simulation. For merge readiness: spidersan conflicts --real');
+        // Never let a failed cross-machine check read as an all-clear — that
+        // silent false confidence is the whole bug this path fixes (tb-ly0b).
+        if (cross.degraded) {
+            console.error('   ⚠️  Cross-machine check unavailable — LOCAL branches only.');
+        }
+        else if (cross.status === 'no-credentials') {
+            // Same lie, quieter: no creds in this shell reads exactly like a clean cloud check.
+            console.log('   ℹ️  Cloud registry not checked (no Supabase credentials) — LOCAL branches only.');
+        }
+        finish(0);
         return;
     }
     console.log(`
@@ -449,7 +716,7 @@ export const conflictsCommand = new Command('conflicts')
 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
         `);
     for (const conflict of conflicts) {
-        console.log(`${conflict.tierInfo.icon} TIER ${conflict.tier} (${conflict.tierInfo.label}): ${conflict.branch}`);
+        console.log(`${conflict.tierInfo.icon} TIER ${conflict.tier} (${conflict.tierInfo.label}): ${conflict.branch}${conflict.sessionId ? ` (session ${conflict.sessionId})` : ''}`);
         for (const file of conflict.files) {
             const fileTier = classifyWithLabel(file, {
                 extraTier3: compiledHigh,
@@ -462,8 +729,6 @@ export const conflictsCommand = new Command('conflicts')
     }
     console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
     console.log(`📊 Summary: 🔴 ${tier3Count} BLOCK | 🟠 ${tier2Count} PAUSE | 🟡 ${tier1Count} WARN`);
-    // Offer add/add resolution suggestions for likely add/add files
-    suggestAddAddResolution(conflicts);
     // Show semantic analysis results
     if (options.semantic && semanticConflicts.length > 0) {
         console.log(`\n🔬 SEMANTIC CONFLICTS DETECTED (${semanticConflicts.length} symbols):`);
@@ -475,6 +740,12 @@ export const conflictsCommand = new Command('conflicts')
         console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
         console.log('\n💡 TIP: Coordinate on these specific functions/classes,');
         console.log('   not just the files. One of you should rebase.');
+        if (semanticSkipped.length + semanticUnsupported.length > 0) {
+            console.log(`   ⚠️  incomplete: ${semanticSkipped.length + semanticUnsupported.length} file(s) could not be analyzed, so more may exist.`);
+        }
+    }
+    else if (options.semantic && semanticSkipped.length + semanticUnsupported.length > 0) {
+        console.log(`\n🔬 SEMANTIC ANALYSIS: incomplete — ${semanticSkipped.length + semanticUnsupported.length} file(s) could not be analyzed; no verdict.`);
     }
     else if (options.semantic && semanticConflicts.length === 0) {
         console.log('\n🔬 SEMANTIC ANALYSIS: No symbol-level conflicts!');
@@ -494,77 +765,9 @@ export const conflictsCommand = new Command('conflicts')
    Coordinate with the other agent before proceeding.
             `);
     }
-    // Wake conflicting agents if --wake flag is set
-    if (options.wake && conflicts.length > 0) {
-        // Collect agents to wake
-        const agentsToWake = new Map();
-        // Performance Optimization: Use the already fetched allBranches
-        // to avoid N+1 slow network requests to storage.get()
-        const branchMap = new Map(allBranches.map(b => [b.name, b]));
-        for (const conflict of conflicts) {
-            const conflictBranch = branchMap.get(conflict.branch);
-            const agentId = conflictBranch?.agent;
-            if (agentId && !agentsToWake.has(agentId)) {
-                agentsToWake.set(agentId, { branch: conflict.branch, files: conflict.files });
-            }
-        }
-        if (agentsToWake.size === 0) {
-            console.log('\n⚠️ No agents registered on conflicting branches.');
-        }
-        else {
-            // Show what will happen and ask for confirmation
-            console.log('\n🔔 WAKE AGENTS?');
-            console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-            for (const [agent, info] of agentsToWake) {
-                console.log(`  • ${agent} (${info.branch})`);
-            }
-            console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-            console.log('This will:');
-            console.log('  1. Send wake signal via Hub\n');
-            const confirmed = await confirmAction('Wake these agents?', options.auto);
-            if (confirmed) {
-                console.log('\n🔔 WAKING AGENTS...\n');
-                for (const [agentId, info] of agentsToWake) {
-                    await wakeConflictingAgent(agentId, targetBranch, info.branch, info.files);
-                }
-                console.log(`\n✅ Woke ${agentsToWake.size} agent(s)`);
-                // If --retry is set, ask before waiting
-                if (options.retry) {
-                    const waitSeconds = parseInt(options.retry, 10);
-                    const retryConfirmed = await confirmAction(`\nWait ${waitSeconds}s and re-check conflicts?`, options.auto);
-                    if (retryConfirmed) {
-                        console.log(`\n⏳ Waiting ${waitSeconds}s for agents to resolve conflicts...`);
-                        await sleep(waitSeconds * 1000);
-                        console.log('\n🔄 RE-CHECKING CONFLICTS...\n');
-                        const { execFileSync } = await import('child_process');
-                        try {
-                            const { getCLIPath } = await import('../lib/security.js');
-                            // Security: Use execFileSync with argument array
-                            const safeBranch = validateBranchName(targetBranch);
-                            const tierArg = String(parseInt(options.tier, 10) || 1);
-                            execFileSync(process.execPath, [getCLIPath(), 'conflicts', '--branch', safeBranch, '--tier', tierArg], {
-                                encoding: 'utf-8',
-                                stdio: 'inherit'
-                            });
-                            return;
-                        }
-                        catch {
-                            console.log('❌ Conflicts still exist after retry.');
-                        }
-                    }
-                    else {
-                        console.log('⏭️ Skipping retry.');
-                    }
-                }
-            }
-            else {
-                console.log('⏭️ Skipping wake.');
-            }
-        }
-    }
     if (shouldBlock) {
         console.log('❌ Strict mode: Exiting with error due to TIER 2+ conflicts.');
-        process.exit(1);
     }
+    finish(shouldBlock ? 1 : 0);
 });
 //# sourceMappingURL=conflicts.js.map