spidersan 0.20.1 → 0.20.2

package/dist/lib/git-events-subscriber.js

@@ -0,0 +1,870 @@
+/**
+ * git-events-subscriber
+ *
+ * Subscribes to spidersan_git_events via Supabase Realtime for low-latency
+ * git-change notifications, with a catch-up poll on startup/reconnect so no
+ * events are missed while a machine was offline.
+ *
+ * Delivery model:
+ *   Realtime INSERT  — instant fan-out (< 1s when connected)
+ *   Catch-up query   — WHERE seq > last_seen_seq on startup/reconnect
+ *
+ * Actions per event type (P1 — notify, not auto-execute):
+ *   push          → warn agent, log to activity + pending files
+ *   pull_request  → log only
+ *   create        → log only
+ *   delete        → mark registry branch abandoned, archive entry
+ *
+ * AI layer (P2): pending events will be routed through spidersan-smol/gemma4
+ * for ecosystem-aware severity decisions. The pending log is the handoff point.
+ */
+import { execFileSync, execFile } from 'child_process';
+import { promisify } from 'util';
+import { existsSync, readFileSync, writeFileSync, appendFileSync, readdirSync, statSync, renameSync } from 'fs';
+import { join, resolve } from 'path';
+import { homedir } from 'os';
+import { getStorage } from '../storage/index.js';
+import { resolveSupabaseEnv } from './supabase-credentials.js';
+import { handleEvent } from './ai/event-handler.js';
+import { createNotifier, deliver } from './notify.js';
+import { logActivity } from './activity.js';
+const execFileAsync = promisify(execFile);
+// Resolved on first use, not at import — the daemon gets its room token from
+// `envoak vault inject`, so the env is only populated once the process runs.
+let _notifier = null;
+function notifier() {
+    return (_notifier ??= createNotifier());
+}
+/**
+ * The compare-API credential, preferring the vault-injected name.
+ *
+ * It cannot be stored as `GITHUB_TOKEN`: envoak's protected-namespace filter
+ * (`SENSITIVE_PREFIXES` in Envoak vault.ts) refuses to inject any name starting
+ * `GITHUB_`, so a vault secret called GITHUB_TOKEN would be granted, decrypted,
+ * and then dropped — leaving the daemon silently unauthenticated at 60 req/h.
+ * Hence the app-prefixed `spidersan/SPIDERSAN_GITHUB_TOKEN`.
+ *
+ * `GITHUB_TOKEN` stays as a fallback so a plain shell (or CI) that already
+ * exports it keeps working.
+ */
+export function resolveGithubToken(env = process.env) {
+    return env.SPIDERSAN_GITHUB_TOKEN || env.GITHUB_TOKEN || undefined;
+}
+// ─── Paths ────────────────────────────────────────────────────────────────────
+const SPIDERSAN_DIR = join(homedir(), '.spidersan');
+const CURSOR_FILE = join(SPIDERSAN_DIR, 'git-watch-cursor.json');
+const ACTIVITY_LOG = join(SPIDERSAN_DIR, 'activity.jsonl');
+const PENDING_LOG = join(SPIDERSAN_DIR, 'git-events-pending.jsonl');
+const PENDING_CONSUMED_LOG = join(SPIDERSAN_DIR, 'git-events-consumed.jsonl');
+const PENDING_TEMP = join(SPIDERSAN_DIR, 'git-events-pending.jsonl.tmp');
+const ARCHIVE_LOG = join(SPIDERSAN_DIR, 'archive.jsonl');
+// ─── Cursor persistence ───────────────────────────────────────────────────────
+function readCursor() {
+    try {
+        if (!existsSync(CURSOR_FILE))
+            return 0;
+        const data = JSON.parse(readFileSync(CURSOR_FILE, 'utf8'));
+        return typeof data.seq === 'number' ? data.seq : 0;
+    }
+    catch {
+        return 0;
+    }
+}
+function writeCursor(seq) {
+    try {
+        writeFileSync(CURSOR_FILE, JSON.stringify({ seq, updated_at: new Date().toISOString() }));
+    }
+    catch {
+        // non-fatal
+    }
+}
+// ─── Activity / pending logging ───────────────────────────────────────────────
+function appendLog(file, entry) {
+    try {
+        appendFileSync(file, JSON.stringify(entry) + '\n');
+    }
+    catch {
+        // non-fatal
+    }
+}
+// ─── Remote URL → local path cache ───────────────────────────────────────────
+/**
+ * Build a map from "owner/repo" to local clone path(s).
+ * Scans provided repoPaths first; if empty, scans all registered repos
+ * by reading their .spidersan/registry.json locations from ~/.spidersan.
+ */
+export function normalizeRemoteUrl(url) {
+    // Normalize ssh and https to a lowercase "owner/repo" key
+    // git@github.com:treebird7/Envoak.git  →  treebird7/envoak
+    // https://github.com/Treebird-Ecosystem/treebird.git  →  treebird-ecosystem/treebird
+    // Lowercase because GitHub names are case-insensitive and event.repo is GitHub's
+    // canonical casing, which a hand-set remote URL need not match.
+    return url
+        .replace(/^git@github\.com:/, '')
+        .replace(/^https?:\/\/github\.com\//, '')
+        .replace(/\.git$/, '')
+        .toLowerCase();
+}
+// treebird moved to the Treebird-Ecosystem org on 2026-10-11; the old name still
+// redirects, and a webhook or a not-yet-updated clone can report either.
+const TREEBIRD_REPOS = new Set(['treebird-ecosystem/treebird', 'treebird7/treebird']);
+export function isTreebirdRepo(repo) {
+    return TREEBIRD_REPOS.has(repo.toLowerCase());
+}
+function getRemoteForPath(repoPath) {
+    try {
+        const url = execFileSync('git', ['remote', 'get-url', 'origin'], {
+            cwd: repoPath,
+            encoding: 'utf-8',
+            timeout: 5000,
+        }).trim();
+        return normalizeRemoteUrl(url);
+    }
+    catch {
+        return null;
+    }
+}
+function buildRepoMap(explicitPaths) {
+    const map = new Map(); // owner/repo → [localPath, ...]
+    const pathsToScan = explicitPaths.length > 0
+        ? explicitPaths
+        : discoverRegisteredRepoPaths();
+    for (const p of pathsToScan) {
+        const absPath = resolve(p);
+        const remote = getRemoteForPath(absPath);
+        if (!remote)
+            continue;
+        const existing = map.get(remote) ?? [];
+        existing.push(absPath);
+        map.set(remote, existing);
+    }
+    return map;
+}
+/**
+ * Number of tracked-but-missing files in a working tree before we alarm. A few
+ * is normal (an intentional `rm`); whole directories missing is the signature of
+ * a stale-revert / branch-juggle that stranded the working tree behind HEAD
+ * (see coord-tree/patterns/shared-checkout-collision.md — the 2026-06-13 incident
+ * where a mixed `git reset` advanced HEAD past a stale tree, wiping node-tree/
+ * ci-tree/TREES.md from the working copy while .git stayed current).
+ */
+const WT_INTEGRITY_THRESHOLD = 5;
+/**
+ * Detect the stale-revert signature in one repo: many tracked files DELETED in
+ * the working tree (HEAD/index intact). This is recoverable and non-destructive
+ * — `git restore` brings the files back — so we only warn, loudly, with the fix.
+ * Returns true if an alarm fired.
+ */
+export function checkWorkingTreeIntegrity(repoPath, log) {
+    let deleted;
+    try {
+        const out = execFileSync('git', ['ls-files', '--deleted'], {
+            cwd: repoPath,
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+        if (!out)
+            return false;
+        deleted = out.split('\n').filter(Boolean);
+    }
+    catch {
+        return false; // not a git repo / git unavailable — skip silently
+    }
+    if (deleted.length < WT_INTEGRITY_THRESHOLD)
+        return false;
+    const sample = deleted.slice(0, 5).join(', ');
+    log(`🚨 working-tree integrity: ${deleted.length} tracked file(s) MISSING from the working tree in ` +
+        `${repoPath} (e.g. ${sample}${deleted.length > 5 ? ', …' : ''}). This is the stale-revert / ` +
+        `branch-juggle signature — HEAD likely advanced past a stranded working tree. Nothing is lost ` +
+        `(.git is intact). Recover with:  cd ${repoPath} && git ls-files -z --deleted | xargs -0 git restore --`);
+    return true;
+}
+/** Run the working-tree integrity check across every watched local path. */
+function sweepWorkingTreeIntegrity(repoMap, log) {
+    const seen = new Set();
+    for (const paths of repoMap.values()) {
+        for (const p of paths) {
+            if (seen.has(p))
+                continue;
+            seen.add(p);
+            checkWorkingTreeIntegrity(p, log);
+        }
+    }
+}
+/**
+ * Discover repo paths from all .spidersan registries visible from ~/.spidersan.
+ * Falls back to scanning ~/Dev/* for .spidersan directories.
+ */
+function discoverRegisteredRepoPaths() {
+    const devDir = join(homedir(), 'Dev');
+    const paths = [];
+    try {
+        const entries = readdirSync(devDir);
+        for (const entry of entries) {
+            const full = join(devDir, entry);
+            try {
+                if (statSync(full).isDirectory() && existsSync(join(full, '.spidersan', 'registry.json'))) {
+                    paths.push(full);
+                }
+            }
+            catch {
+                // skip
+            }
+        }
+    }
+    catch {
+        // devDir doesn't exist or can't be read
+    }
+    return paths;
+}
+// ─── Per-repo worker queue ────────────────────────────────────────────────────
+const queues = new Map(); // repoPath → last task
+function enqueue(repoPath, task) {
+    const last = queues.get(repoPath) ?? Promise.resolve();
+    const next = last.then(task).catch(() => undefined);
+    queues.set(repoPath, next);
+}
+// ─── Tree-pair detection ──────────────────────────────────────────────────────
+const TREE_PAIR_RE = /^(sql-tree|ts-tree)\/pairs\/[^/]+\.json$/;
+const TREE_ACTION_HINTS = {
+    'sql-tree': 'mycsan /sql-review validate',
+    'ts-tree': 'ts-review validate',
+};
+/**
+ * When a push lands on treebird (either org name), compare before..after via GitHub API
+ * and detect newly added gold-pair JSON files. Emits a targeted pending entry
+ * per tree so the validation cue is specific and actionable.
+ */
+async function detectTreePairs(event, log) {
+    if (!event.before_sha || !event.after_sha)
+        return;
+    const url = `https://api.github.com/repos/${event.repo}/compare/${event.before_sha}...${event.after_sha}`;
+    const githubToken = resolveGithubToken();
+    const headers = {
+        'Accept': 'application/vnd.github.v3+json',
+        'User-Agent': 'spidersan-git-watch',
+    };
+    if (githubToken)
+        headers['Authorization'] = `Bearer ${githubToken}`;
+    try {
+        const res = await fetch(url, { headers });
+        if (!res.ok)
+            return;
+        const data = await res.json();
+        const newPairs = (data.files ?? []).filter(f => f.status === 'added' && TREE_PAIR_RE.test(f.filename));
+        if (!newPairs.length)
+            return;
+        // Group by tree (sql-tree / ts-tree)
+        const grouped = {};
+        for (const f of newPairs) {
+            const tree = f.filename.split('/')[0];
+            (grouped[tree] ??= []).push(f.filename);
+        }
+        for (const [tree, files] of Object.entries(grouped)) {
+            const hint = TREE_ACTION_HINTS[tree] ?? `review ${tree}/pairs/`;
+            log(`🌱  ${files.length} new pair(s) in ${tree} — validate: \`${hint}\``);
+            appendLog(PENDING_LOG, {
+                type: 'tree_pairs_ready',
+                tree,
+                files,
+                count: files.length,
+                repo: event.repo,
+                branch: event.branch,
+                after_sha: event.after_sha?.slice(0, 7),
+                received_at: event.received_at,
+                ts: new Date().toISOString(),
+                action_hint: hint,
+            });
+        }
+    }
+    catch {
+        // non-fatal — GitHub API might be rate-limited or unreachable
+    }
+}
+// ─── Pending tree-pairs consumer ──────────────────────────────────────────────
+/** Deterministic ID for a tree_pairs_ready entry — used for idempotent consumption. */
+function makeEntryId(entry) {
+    const tree = typeof entry.tree === 'string' ? entry.tree : 'unknown';
+    const sha = typeof entry.after_sha === 'string' ? entry.after_sha : 'unknown';
+    const repo = typeof entry.repo === 'string' ? entry.repo : 'unknown';
+    const files = Array.isArray(entry.files) ? entry.files.join('|') : '';
+    return `${repo}:${sha}:${tree}:${files}`;
+}
+/** Read already-consumed entry IDs from the consumed log. */
+function readConsumedIds() {
+    try {
+        if (!existsSync(PENDING_CONSUMED_LOG))
+            return new Set();
+        const lines = readFileSync(PENDING_CONSUMED_LOG, 'utf8').split('\n').filter(Boolean);
+        const ids = new Set();
+        for (const line of lines) {
+            try {
+                const entry = JSON.parse(line);
+                if (typeof entry._id === 'string')
+                    ids.add(entry._id);
+            }
+            catch { /* skip malformed */ }
+        }
+        return ids;
+    }
+    catch {
+        return new Set();
+    }
+}
+let isConsuming = false; // single-flight guard
+/**
+ * Read pending.jsonl, emit a hive handoff signal for each unconsumed
+ * tree_pairs_ready entry, then atomically rewrite the file without them.
+ *
+ * Only successfully dispatched entries are removed — on failure the entry
+ * stays in pending for the next poll cycle. Uses a deterministic ID so
+ * restarts are idempotent.
+ */
+async function consumePendingTreePairs(log) {
+    if (isConsuming)
+        return;
+    isConsuming = true;
+    try {
+        if (!existsSync(PENDING_LOG))
+            return;
+        let rawLines;
+        try {
+            rawLines = readFileSync(PENDING_LOG, 'utf8').split('\n').filter(Boolean);
+        }
+        catch {
+            return;
+        }
+        const consumedIds = readConsumedIds();
+        const remaining = []; // non-tree_pairs_ready lines → kept
+        const toConsume = [];
+        for (const line of rawLines) {
+            try {
+                const entry = JSON.parse(line);
+                if (entry.type === 'tree_pairs_ready') {
+                    const id = makeEntryId(entry);
+                    if (!consumedIds.has(id)) {
+                        toConsume.push({ entry, id, raw: line });
+                    }
+                    // Already-consumed entries are dropped from pending silently
+                }
+                else {
+                    remaining.push(line);
+                }
+            }
+            catch {
+                remaining.push(line); // preserve malformed lines verbatim
+            }
+        }
+        if (toConsume.length === 0)
+            return;
+        log(`🔁 consuming ${toConsume.length} pending tree_pairs_ready event(s)`);
+        const succeeded = [];
+        const failed = []; // raw lines to keep in pending
+        for (const { entry, id, raw } of toConsume) {
+            const task = typeof entry.action_hint === 'string' ? entry.action_hint : `review ${entry.tree}/pairs/`;
+            const files = Array.isArray(entry.files) ? entry.files : [];
+            const summary = `spidersan auto-dispatch: ${entry.tree} pair(s) ready — ${entry.repo}@${entry.after_sha} — ${task}`;
+            // Retry-and-retain, now driven by the delivery result rather than
+            // by whether a subprocess exited 0. Tier 1: this is a review
+            // prompt, not a conflict — it obliges someone to look, not to stop.
+            const delivery = await deliver(notifier(), {
+                repo: String(entry.repo ?? 'unknown'),
+                branch: String(entry.branch ?? 'unknown'),
+                tier: 1,
+                message: summary,
+                dedupe: `tree_pairs:${id}`,
+                files,
+                details: { trigger: 'tree_pairs_ready', tree: entry.tree, task, after_sha: entry.after_sha },
+            }, log);
+            if (delivery.ok) {
+                succeeded.push({ entry, id });
+                log(`✅ dispatched ${id}`);
+            }
+            else {
+                log(`⚠  dispatch failed for ${id}: ${delivery.reason} — retaining in pending`);
+                failed.push(raw);
+            }
+        }
+        if (succeeded.length === 0)
+            return;
+        // Record successful dispatches in consumed log
+        for (const { entry, id } of succeeded) {
+            appendLog(PENDING_CONSUMED_LOG, { ...entry, _id: id, consumed_at: new Date().toISOString() });
+        }
+        // Atomic rewrite: remaining non-consumed lines + any failed tree_pairs lines
+        const finalLines = [...remaining, ...failed];
+        try {
+            writeFileSync(PENDING_TEMP, finalLines.length > 0 ? finalLines.join('\n') + '\n' : '');
+            renameSync(PENDING_TEMP, PENDING_LOG);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            log(`⚠  failed to rewrite pending log: ${msg}`);
+        }
+    }
+    finally {
+        isConsuming = false;
+    }
+}
+const NULL_SHA = '0000000000000000000000000000000000000000';
+const SHA_RE = /^[0-9a-f]{7,40}$/i;
+async function enrichFilesFromGit(repoPath, beforeSha, afterSha) {
+    if (!beforeSha || !afterSha || beforeSha === NULL_SHA)
+        return [];
+    if (!SHA_RE.test(beforeSha) || !SHA_RE.test(afterSha))
+        return [];
+    try {
+        const { stdout } = await execFileAsync('git', ['diff', '--name-only', `${beforeSha}...${afterSha}`], {
+            cwd: repoPath,
+            timeout: 10000,
+        });
+        return stdout.trim().split('\n').filter(Boolean);
+    }
+    catch {
+        return [];
+    }
+}
+// ─── Event handlers ───────────────────────────────────────────────────────────
+async function handlePush(event, localPaths, log) {
+    const shortSha = event.after_sha?.slice(0, 7) ?? 'unknown';
+    const who = event.sender_login ?? 'unknown';
+    const branch = event.branch ?? event.ref ?? 'unknown';
+    log(`⚠  git push: ${event.repo} ${branch} by ${who} (${shortSha}) — run \`spidersan conflicts\` to check conflicts`);
+    // sp-8iqm: the main-updated fleet announce was removed, not re-pointed. It
+    // fired into a dead `envoak hive signal` for a month and nobody missed it;
+    // the push is already logged to the activity log below. Alerts are for conflicts, not for every push to main.
+    const entry = {
+        type: 'git_push',
+        repo: event.repo,
+        branch,
+        sender: who,
+        after_sha: shortSha,
+        received_at: event.received_at,
+        ts: new Date().toISOString(),
+        action_hint: 'spidersan conflicts',
+    };
+    appendLog(ACTIVITY_LOG, { ...entry, source: 'git-watch' });
+    appendLog(PENDING_LOG, entry);
+    // Detect newly committed gold pairs in sql-tree / ts-tree
+    if (isTreebirdRepo(event.repo)) {
+        await detectTreePairs(event, log);
+    }
+    // Phase C: AI advice — computed once per event (not per local path)
+    const aiRepoPath = localPaths[0];
+    const files = aiRepoPath
+        ? await enrichFilesFromGit(aiRepoPath, event.before_sha, event.after_sha)
+        : [];
+    const payload = {
+        type: 'push',
+        repo: event.repo,
+        branch,
+        files,
+        metadata: { after_sha: event.after_sha, sender: who },
+    };
+    try {
+        const advice = await handleEvent(payload, { repoRoot: aiRepoPath, localOnly: true });
+        if (advice.tier >= 2) {
+            logActivity({
+                repo: event.repo,
+                branch,
+                agent: who !== 'unknown' ? who : undefined,
+                event: 'conflict_detected',
+                details: {
+                    source: 'git-watch-ai',
+                    tier: advice.tier,
+                    action: advice.action,
+                    message: advice.message,
+                    commands: advice.commands,
+                    after_sha: event.after_sha,
+                    files_checked: files.length,
+                },
+            });
+            log(`🕷  AI [T${advice.tier}/${advice.action}] ${event.repo}/${branch}: ${advice.message.slice(0, 120)}`);
+            await deliver(notifier(), {
+                repo: event.repo,
+                branch,
+                tier: advice.tier,
+                message: advice.message,
+                dedupe: `push:${event.after_sha ?? 'unknown'}`,
+                agent: who !== 'unknown' ? who : undefined,
+                files,
+                details: { action: advice.action, commands: advice.commands, trigger: 'push', after_sha: event.after_sha },
+            }, log);
+        }
+    }
+    catch {
+        // AI layer failure is non-fatal — daemon continues
+    }
+    // Per-path queue: reserved for Phase C2 per-path operations
+    for (const p of localPaths) {
+        enqueue(p, async () => { void p; });
+    }
+}
+async function handlePR(event, _localPaths, log) {
+    const action = event.action ?? 'event';
+    const branch = event.branch ?? 'unknown';
+    const who = event.sender_login ?? 'unknown';
+    log(`ℹ  PR ${action}: ${event.repo} ${branch} by ${who}`);
+    appendLog(ACTIVITY_LOG, { type: 'pull_request', action, repo: event.repo, branch, sender: who, received_at: event.received_at, ts: new Date().toISOString(), source: 'git-watch' });
+    // Phase C2: AI merge-readiness advice
+    const payload = {
+        type: 'pull_request',
+        repo: event.repo,
+        branch,
+        metadata: { action, sender: who },
+    };
+    try {
+        const advice = await handleEvent(payload, { localOnly: true });
+        if (advice.tier >= 2) {
+            logActivity({
+                repo: event.repo,
+                branch,
+                agent: who !== 'unknown' ? who : undefined,
+                event: 'conflict_detected',
+                details: {
+                    source: 'git-watch-ai',
+                    trigger: 'pull_request',
+                    pr_action: action,
+                    tier: advice.tier,
+                    action: advice.action,
+                    message: advice.message,
+                    commands: advice.commands,
+                },
+            });
+            log(`🕷  AI [T${advice.tier}/${advice.action}] PR ${event.repo}/${branch}: ${advice.message.slice(0, 120)}`);
+            await deliver(notifier(), {
+                repo: event.repo,
+                branch,
+                tier: advice.tier,
+                message: advice.message,
+                dedupe: `pr:${action}`,
+                agent: who !== 'unknown' ? who : undefined,
+                details: { action: advice.action, commands: advice.commands, trigger: 'pull_request', pr_action: action },
+            }, log);
+        }
+    }
+    catch {
+        // AI layer failure is non-fatal
+    }
+}
+async function handleCreate(event, _localPaths, log) {
+    if (event.ref_type !== 'branch')
+        return;
+    const branch = event.branch ?? 'unknown';
+    const who = event.sender_login ?? 'unknown';
+    log(`ℹ  branch created: ${event.repo}/${branch} by ${who}`);
+    appendLog(ACTIVITY_LOG, { type: 'branch_created', repo: event.repo, branch, sender: who, received_at: event.received_at, ts: new Date().toISOString(), source: 'git-watch' });
+    // Phase C2: register branch stub so AI conflict detection knows it exists
+    // before any files are pushed. Files start empty; enriched on first push.
+    try {
+        const storage = await getStorage();
+        const existing = await storage.get(branch);
+        if (!existing) {
+            await storage.register({
+                name: branch,
+                files: [],
+                status: 'active',
+                agent: who !== 'unknown' ? who : undefined,
+                description: `auto-registered by git-watch on remote create (${event.repo})`,
+            });
+            log(`   registered branch stub: ${branch}`);
+            logActivity({
+                repo: event.repo,
+                branch,
+                agent: who !== 'unknown' ? who : undefined,
+                event: 'register',
+                details: { source: 'git-watch-auto', trigger: 'remote_branch_create' },
+            });
+        }
+    }
+    catch {
+        // Storage write is best-effort — log failure is non-fatal
+    }
+}
+async function handleDelete(event, localPaths, log) {
+    if (event.ref_type !== 'branch')
+        return;
+    const branch = event.branch ?? 'unknown';
+    const who = event.sender_login ?? 'unknown';
+    log(`🗑  branch deleted remotely: ${event.repo}/${branch} by ${who} — archiving in local registries`);
+    // Only fire the conflict notification once even if multiple local paths exist
+    let notified = false;
+    for (const p of localPaths) {
+        enqueue(p, async () => {
+            try {
+                const storage = await getStorage();
+                const allBranches = await storage.list();
+                const entry = allBranches.find(b => b.name === branch);
+                if (!entry)
+                    return;
+                // Notify if the deleted branch had active file registrations — means
+                // conflict detection was tracking it and other branches may share files.
+                if (!notified && entry.status === 'active' && entry.files && entry.files.length > 0) {
+                    notified = true;
+                    log(`⚠  deleted branch ${branch} had ${entry.files.length} registered file(s) — potential conflict impact`);
+                    logActivity({
+                        repo: event.repo,
+                        branch,
+                        agent: who !== 'unknown' ? who : undefined,
+                        event: 'conflict_detected',
+                        details: {
+                            trigger: 'branch_deleted_with_active_registrations',
+                            files: entry.files,
+                            deleted_by: who,
+                        },
+                    });
+                    // Tier 2: the files were tracked for conflict detection, so
+                    // another branch may still be registered against them —
+                    // actionable, but not a BLOCK the way a live overlap is.
+                    await deliver(notifier(), {
+                        repo: event.repo,
+                        branch,
+                        tier: 2,
+                        message: `deleted branch had ${entry.files.length} active conflict registration(s) — other branches may share these files`,
+                        dedupe: 'branch_deleted',
+                        agent: who !== 'unknown' ? who : undefined,
+                        files: entry.files,
+                        details: { trigger: 'branch_deleted_with_active_registrations', deleted_by: who },
+                    }, log);
+                }
+                // Archive first, then remove from active registry
+                appendLog(ARCHIVE_LOG, {
+                    ...entry,
+                    archived_at: new Date().toISOString(),
+                    archived_reason: 'remote-delete',
+                    archived_by: who,
+                    repo_path: p,
+                });
+                await storage.update(branch, { status: 'abandoned' });
+                log(`   archived ${branch} from ${p}`);
+            }
+            catch {
+                // non-fatal
+            }
+        });
+    }
+    appendLog(ACTIVITY_LOG, { type: 'branch_deleted', repo: event.repo, branch, sender: who, received_at: event.received_at, ts: new Date().toISOString(), source: 'git-watch' });
+}
+async function dispatchEvent(event, repoMap, opts) {
+    const log = opts.logger ?? (opts.quiet ? () => { } : (m) => console.log(`[git-watch] ${m}`));
+    const localPaths = repoMap.get(event.repo.toLowerCase()) ?? [];
+    opts.onEvent?.(event);
+    switch (event.event_type) {
+        case 'push': return handlePush(event, localPaths, log);
+        case 'pull_request': return handlePR(event, localPaths, log);
+        case 'create': return handleCreate(event, localPaths, log);
+        case 'delete': return handleDelete(event, localPaths, log);
+    }
+}
+function getConfig() {
+    const { url, key } = resolveSupabaseEnv();
+    if (!url)
+        return null;
+    const jwt = process.env.COLONY_SESSION_JWT;
+    if (!jwt && !key)
+        return null;
+    return { url, key: key ?? '', jwt };
+}
+async function supabaseFetch(cfg, path, params = {}) {
+    const qs = new URLSearchParams(params).toString();
+    const endpoint = `${cfg.url}/rest/v1/${path}${qs ? '?' + qs : ''}`;
+    const headers = {
+        'apikey': cfg.key,
+        'Content-Type': 'application/json',
+    };
+    headers['Authorization'] = cfg.jwt ? `Bearer ${cfg.jwt}` : `Bearer ${cfg.key}`;
+    try {
+        const res = await fetch(endpoint, { headers });
+        if (!res.ok)
+            return null;
+        return res.json();
+    }
+    catch {
+        return null;
+    }
+}
+// ─── Catch-up query ───────────────────────────────────────────────────────────
+async function catchUp(cfg, repoMap, opts) {
+    const cursor = readCursor();
+    const data = await supabaseFetch(cfg, 'spidersan_git_events', {
+        'seq': `gt.${cursor}`,
+        'order': 'seq.asc',
+        'limit': '200',
+        'select': '*',
+    });
+    if (!data?.length)
+        return;
+    for (const row of data) {
+        await dispatchEvent(row, repoMap, opts);
+    }
+    writeCursor(data[data.length - 1].seq);
+}
+/**
+ * Opens a Supabase Realtime WebSocket subscription to spidersan_git_events.
+ * Uses Node 24's native globalThis.WebSocket — no extra dependencies.
+ * Returns null if WebSocket is unavailable (graceful downgrade to polling).
+ */
+function startRealtimeSubscription(cfg, repoMap, opts, highWaterMark, log) {
+    // Feature-detect native WebSocket (Node 21.3+)
+    const WS = globalThis.WebSocket;
+    if (!WS)
+        return null;
+    // Rebind so TypeScript keeps it non-nullable inside nested closures
+    const WSClass = WS;
+    const project = cfg.url.replace('https://', '').split('.')[0];
+    const wsUrl = `wss://${project}.supabase.co/realtime/v1/websocket?apikey=${cfg.key}&vsn=1.0.0`;
+    let ws = null;
+    let stopped = false;
+    let heartbeatTimer = null;
+    let reconnectTimer = null;
+    let backoffMs = 1000;
+    let refCounter = 1;
+    function connect() {
+        if (stopped)
+            return;
+        ws = new WSClass(wsUrl);
+        ws.onopen = () => {
+            backoffMs = 1000;
+            log('realtime: WebSocket active');
+            // Join the postgres_changes channel
+            ws.send(JSON.stringify({
+                topic: 'realtime:public:spidersan_git_events',
+                event: 'phx_join',
+                payload: {
+                    config: {
+                        broadcast: { ack: false },
+                        presence: { key: '' },
+                        postgres_changes: [
+                            { event: 'INSERT', schema: 'public', table: 'spidersan_git_events' },
+                        ],
+                    },
+                    access_token: cfg.jwt ?? cfg.key,
+                },
+                ref: String(refCounter++),
+            }));
+            // Heartbeat every 25s
+            heartbeatTimer = setInterval(() => {
+                if (ws?.readyState === 1 /* OPEN */) {
+                    ws.send(JSON.stringify({
+                        topic: 'phoenix',
+                        event: 'heartbeat',
+                        payload: {},
+                        ref: String(refCounter++),
+                    }));
+                }
+            }, 25_000);
+        };
+        ws.onmessage = (ev) => {
+            let msg;
+            try {
+                msg = JSON.parse(ev.data);
+            }
+            catch {
+                return;
+            }
+            // Supabase sends postgres_changes events
+            if (msg.event !== 'postgres_changes')
+                return;
+            const data = msg.payload?.data;
+            if (!data || data.type !== 'INSERT')
+                return;
+            const record = data.record;
+            if (!record || typeof record.seq !== 'number')
+                return;
+            // Dedup with shared high-water mark
+            if (record.seq <= highWaterMark.seq)
+                return;
+            highWaterMark.seq = record.seq;
+            writeCursor(record.seq);
+            dispatchEvent(record, repoMap, opts).catch(() => { });
+        };
+        ws.onerror = () => { };
+        ws.onclose = () => {
+            if (heartbeatTimer) {
+                clearInterval(heartbeatTimer);
+                heartbeatTimer = null;
+            }
+            if (stopped)
+                return;
+            log(`realtime: disconnected — reconnecting in ${backoffMs / 1000}s`);
+            reconnectTimer = setTimeout(() => {
+                // Catch up on events missed during disconnect, then reconnect
+                if (getConfig())
+                    catchUp(cfg, repoMap, opts).catch(() => { }).finally(connect);
+            }, backoffMs);
+            backoffMs = Math.min(backoffMs * 2, 30_000);
+        };
+    }
+    connect();
+    return {
+        stop: () => {
+            stopped = true;
+            if (heartbeatTimer)
+                clearInterval(heartbeatTimer);
+            if (reconnectTimer)
+                clearTimeout(reconnectTimer);
+            ws?.close();
+        },
+    };
+}
+// ─── Public API ───────────────────────────────────────────────────────────────
+/**
+ * Start the git-events daemon in hybrid mode:
+ *  - Supabase Realtime WebSocket for < 1s delivery (when available)
+ *  - 5-min safety-sweep poll to catch events missed during disconnects
+ * Returns a handle with a stop() method.
+ */
+export async function startGitWatch(opts = {}) {
+    const log = opts.logger ?? (opts.quiet ? () => { } : (m) => console.log(`[git-watch] ${m}`));
+    // Safety-sweep interval: 5 min when realtime is active, otherwise use configured interval
+    const pollMs = opts.pollIntervalMs ?? 60_000;
+    const cfg = getConfig();
+    if (!cfg) {
+        throw new Error('git-watch: SUPABASE_URL and (SUPABASE_KEY or COLONY_SESSION_JWT) are required');
+    }
+    const repoMap = buildRepoMap(opts.repoPaths ?? []);
+    log(`Watching ${repoMap.size} repo(s): ${[...repoMap.keys()].join(', ')}`);
+    // Working-tree integrity sweep on startup (catches a stranded/stale-reverted tree)
+    sweepWorkingTreeIntegrity(repoMap, log);
+    // Shared high-water mark (monotonic seq dedup between realtime + poll paths)
+    const highWaterMark = { seq: readCursor() };
+    // Catch-up on startup
+    await catchUp(cfg, repoMap, opts);
+    await consumePendingTreePairs(log);
+    // Start Realtime WebSocket (unless explicitly disabled)
+    let realtimeHandle = null;
+    if (!opts.disableRealtime) {
+        realtimeHandle = startRealtimeSubscription(cfg, repoMap, opts, highWaterMark, log);
+        if (!realtimeHandle) {
+            log('realtime: WebSocket unavailable — polling only');
+        }
+    }
+    // Safety-sweep poll (5 min when realtime active, else use configured interval)
+    const sweepMs = realtimeHandle ? Math.max(pollMs, 5 * 60_000) : pollMs;
+    const pollTimer = setInterval(async () => {
+        sweepWorkingTreeIntegrity(repoMap, log);
+        await catchUp(cfg, repoMap, opts);
+        await consumePendingTreePairs(log);
+    }, sweepMs);
+    return {
+        stop: () => {
+            clearInterval(pollTimer);
+            realtimeHandle?.stop();
+        },
+    };
+}
+/**
+ * One-shot catch-up: fetch any missed events since last cursor, then exit.
+ * Useful for cron/CI environments that don't run persistent daemons.
+ */
+export async function catchUpOnce(opts = {}) {
+    const cfg = getConfig();
+    if (!cfg)
+        throw new Error('git-watch: SUPABASE_URL and (SUPABASE_KEY or COLONY_SESSION_JWT) are required');
+    const repoMap = buildRepoMap(opts.repoPaths ?? []);
+    const log = opts.logger ?? (opts.quiet ? () => { } : (m) => console.log(`[git-watch] ${m}`));
+    sweepWorkingTreeIntegrity(repoMap, log);
+    await catchUp(cfg, repoMap, opts);
+    await consumePendingTreePairs(log);
+}
+//# sourceMappingURL=git-events-subscriber.js.map