spidersan 0.20.1 → 0.20.2

package/dist/commands/conflicts.js

@@ -0,0 +1,773 @@
+/**
+ * spidersan conflicts
+ *
+ * Detect file conflicts between branches.
+ * Supports tiered conflict blocking:
+ *   TIER 1: Warning only (informational)
+ *   TIER 2: Pause (notify agent, recommend action)
+ *   TIER 3: Block (exit with error, prevent merge)
+ */
+import { Command } from 'commander';
+import { compilePatterns } from '../lib/regex-utils.js';
+import { execFileSync, spawnSync } from 'child_process';
+import { basename } from 'path';
+import { getStorage } from '../storage/index.js';
+import { SupabaseStorage } from '../storage/supabase.js';
+import { resolveSupabaseCredentials } from '../lib/supabase-credentials.js';
+import { loadMachineIdentity } from '../lib/machine.js';
+import { getRepoName, registryRepoNames, resolveBranchRef } from '../lib/git.js';
+import { analyzeSemantic, resolveBranchTip, resolveCrossMachineRef } from '../lib/semantic-analysis.js';
+import { getCLIPath } from '../lib/security.js';
+import { isExcludedPath } from './register.js';
+import { loadConfig } from '../lib/config.js';
+import { ECOSYSTEM_UNCONFIGURED_HINT, resolveEcosystemRepos } from '../lib/ecosystem-env.js';
+import { logActivity } from '../lib/activity.js';
+import { isGhAvailable, getPRDetails, getPRLabels, listOpenPRs, getPRChangedFiles } from '../lib/github.js';
+import { analyzeCarries } from '../lib/carries.js';
+import { classifyWithLabel } from '../lib/conflict-tier.js';
+import { createNotifier, deliver } from '../lib/notify.js';
+import { analyzeRealConflicts } from '../lib/git-merge-analyzer.js';
+import { getTrunkBranch } from '../lib/trunk.js';
+import { activeBranches } from '../lib/reconcile.js';
+// Lazy so the transport is resolved at first use, not at import.
+let _notifier = null;
+function notifier() {
+    return (_notifier ??= createNotifier());
+}
+/**
+ * Pull other machines' registered branches as synthetic conflict targets.
+ *
+ * Why this exists: the registry is per-machine local state, and the pre-push /
+ * pre-merge hook calls `conflicts`. Without this, a teammate on another machine
+ * editing the same file was NEVER flagged — the hook advisory silently only ever
+ * saw local branches, giving false "you're good to merge" confidence. The data
+ * was already in Supabase (`registry-sync --push` writes it, `cross-conflicts`
+ * reads it); `conflicts` just never asked (tb-ly0b).
+ *
+ * Fail-open by design: unconfigured / offline / auth failure returns [] so the
+ * check degrades to local-only rather than blocking a push. Callers that need to
+ * distinguish "no conflicts" from "couldn't check" should use `cross-conflicts`.
+ *
+ * ponytail: one Supabase round-trip, only on the branch-overlap path (--real and
+ * --ecosystem return before this). Sub-second in practice and the hook is fail-open.
+ */
+export function crossMachineBranches(views) {
+    const branches = [];
+    for (const view of views) {
+        for (const b of view.branches) {
+            // Non-active entries are another machine's finished/abandoned work,
+            // and a file-less entry can never overlap — both would be phantom
+            // conflicts, which this codebase treats as worse than a miss.
+            if (b.status !== 'active' || !b.files?.length)
+                continue;
+            branches.push({
+                ...b,
+                // Machine-qualified so the report distinguishes a remote branch
+                // from a local one of the same name (e.g. two mains).
+                name: `${view.machine_name}/${b.name}`,
+            });
+        }
+    }
+    return branches;
+}
+async function fetchCrossMachineBranches(ownBranches = []) {
+    try {
+        const creds = await resolveSupabaseCredentials();
+        if (!creds)
+            return { branches: [], degraded: false, status: 'no-credentials' };
+        const machine = await loadMachineIdentity();
+        const supabase = new SupabaseStorage(creds);
+        // Excluding our own machine_id matters: without it this machine's own
+        // pushed rows come back and conflict against themselves.
+        // ownBranches: a branch pushed from here can reach the registry as a pushed-branch
+        // row before this machine's own registry-sync lands; it must not conflict with itself.
+        const views = await supabase.pullRegistries(registryRepoNames(), machine.id, ownBranches);
+        return { branches: crossMachineBranches(views), degraded: false, status: 'checked' };
+    }
+    catch {
+        return { branches: [], degraded: true, status: 'degraded' };
+    }
+}
+function getCurrentBranch() {
+    try {
+        return execFileSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { encoding: 'utf-8' }).trim();
+    }
+    catch {
+        throw new Error('Not in a git repository');
+    }
+}
+async function notifyConflicts(branch, conflicts) {
+    let hasTier3 = false;
+    let hasTier2 = false;
+    for (const c of conflicts) {
+        if (c.tier === 3)
+            hasTier3 = true;
+        else if (c.tier === 2)
+            hasTier2 = true;
+        if (hasTier3 && hasTier2)
+            break;
+    }
+    if (!hasTier3 && !hasTier2)
+        return;
+    const severity = hasTier3 ? '🔴 TIER 3 BLOCK' : '🟠 TIER 2 PAUSE';
+    const message = `🕷️⚠️ **Conflict Alert** on \`${branch}\`\n\n${severity}\n\nConflicting files require coordination.`;
+    const contested = [...new Set(conflicts.flatMap((c) => c.files))].sort();
+    // `deliver` inspects the result and logs the real outcome. The previous
+    // implementation POSTed to a decommissioned host inside a bare `catch {}`,
+    // so `--notify` reported nothing either way. (sp-hnjf)
+    await deliver(notifier(), {
+        repo: getRepoName(),
+        branch,
+        tier: hasTier3 ? 3 : 2,
+        message,
+        dedupe: `conflicts:${branch}:${contested.join(',')}`,
+        files: contested,
+        // stderr, not stdout: this runs before the --json blob is printed, and a
+        // delivery diagnostic must never end up inside machine-readable output.
+    }, (m) => console.error(m));
+}
+function runEcosystemScan(repos, asJson) {
+    const results = [];
+    for (const repo of repos) {
+        const name = basename(repo);
+        const result = spawnSync(process.execPath, [getCLIPath(), 'conflicts', '--json'], { cwd: repo, encoding: 'utf-8', timeout: 15000 });
+        if (result.status === null || result.error) {
+            results.push({ repo, name, tier3: 0, tier2: 0, tier1: 0, error: 'spawn failed' });
+            continue;
+        }
+        if (result.status !== 0) {
+            // Exit 1 can be --strict mode; try to parse stdout anyway
+            // If it says "not initialized", mark as skipped
+            const combinedOut = (result.stderr ?? '') + (result.stdout ?? '');
+            if (combinedOut.includes('not initialized') || combinedOut.includes('not registered')) {
+                results.push({ repo, name, tier3: 0, tier2: 0, tier1: 0, skipped: true });
+                continue;
+            }
+        }
+        try {
+            const data = JSON.parse(result.stdout);
+            results.push({
+                repo,
+                name,
+                tier3: data.summary.tier3,
+                tier2: data.summary.tier2,
+                tier1: data.summary.tier1,
+            });
+        }
+        catch {
+            results.push({ repo, name, tier3: 0, tier2: 0, tier1: 0, error: 'parse failed' });
+        }
+    }
+    const totals = results.reduce((acc, r) => ({ tier3: acc.tier3 + r.tier3, tier2: acc.tier2 + r.tier2, tier1: acc.tier1 + r.tier1 }), { tier3: 0, tier2: 0, tier1: 0 });
+    const reposWithConflicts = results.filter(r => r.tier3 + r.tier2 + r.tier1 > 0).length;
+    if (asJson) {
+        console.log(JSON.stringify({
+            ecosystem: true,
+            repos: results,
+            summary: { ...totals, repos_scanned: results.length, repos_with_conflicts: reposWithConflicts },
+        }, null, 2));
+        return;
+    }
+    console.log(`
+🕷️  ECOSYSTEM CONFLICT SCAN
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+`);
+    for (const r of results) {
+        if (r.skipped) {
+            console.log(`  ⬜ ${r.name.padEnd(22)} (not initialized)`);
+            continue;
+        }
+        if (r.error) {
+            console.log(`  ❓ ${r.name.padEnd(22)} (${r.error})`);
+            continue;
+        }
+        const icon = r.tier3 > 0 ? '🔴' : r.tier2 > 0 ? '🟠' : r.tier1 > 0 ? '🟡' : '✅';
+        const counts = r.tier3 + r.tier2 + r.tier1 > 0
+            ? `  T3:${r.tier3} T2:${r.tier2} T1:${r.tier1}`
+            : '  clean';
+        console.log(`  ${icon} ${r.name.padEnd(22)}${counts}`);
+    }
+    console.log(`\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━`);
+    console.log(`📊 Total: 🔴 ${totals.tier3} BLOCK | 🟠 ${totals.tier2} PAUSE | 🟡 ${totals.tier1} WARN`);
+    console.log(`   Repos scanned: ${results.length} | With conflicts: ${reposWithConflicts}`);
+}
+// ── Real (git merge-tree) conflict scan ─────────────────────────────────────────
+/**
+ * Render a single real-conflict report (git merge-tree backed) to the console.
+ * `✅ <branch>: clean vs <base>` or `⚠️ <branch>: N real conflict(s) vs <base>`
+ * with the conflicting file list + kind, plus a dim `method` line. On an
+ * environmental `error`, prints it and returns (caller continues to the next target).
+ */
+function renderRealReport(report) {
+    if (report.error) {
+        console.log(`❌ ${report.branch}: ${report.error}`);
+        return;
+    }
+    if (report.clean) {
+        console.log(`✅ ${report.branch}: clean vs ${report.base}`);
+    }
+    else {
+        const n = report.conflicts.length;
+        console.log(`⚠️ ${report.branch}: ${n} real conflict${n === 1 ? '' : 's'} vs ${report.base}`);
+        for (const c of report.conflicts) {
+            console.log(`   • ${c.file} (${c.kind})`);
+        }
+    }
+    // Dim trailing line showing which git path produced the result.
+    console.log(`\x1b[2m   method: ${report.method}\x1b[0m`);
+}
+/**
+ * `conflicts --real`: compute TRUE merge conflicts via git merge-tree against the
+ * trunk (or `--base`), for the current branch / `--branch` / (with `--all`) every
+ * active registered branch.
+ *
+ * Pure git for the single-target path — works with NO `.spidersan/registry.json`.
+ * Only `--all` (which enumerates registered branches) requires an initialized
+ * registry, and that path is gated here.
+ *
+ * @returns the process exit code (0 always, unless `--exit-code` + conflicts → 1).
+ */
+/**
+ * The ref `--real` merges INTO: the remote-tracking trunk when it exists,
+ * otherwise the local branch name.
+ *
+ * A local trunk in a long-lived checkout can lag origin badly — a leftover
+ * worktree pinning the branch ref held one 78 commits back — and merge-tree
+ * against a stale base resolves cleanly where the real merge does not. That is
+ * a green earned by comparing against the wrong thing (sp-vifo). The `--pr` arm
+ * already reasoned this way (tb-57fr); this generalises it to `--branch`,
+ * `--all` and the current branch.
+ *
+ * Does NOT fetch: it reads refs already on disk, because this runs from a
+ * pre-merge hook and a check that hits the network every invocation is a
+ * different problem. `origin/<trunk>` can therefore be stale too — the report
+ * always names the base it used, so the reader can see what was compared.
+ */
+function resolveRealBase(trunk) {
+    const ref = resolveBranchRef(trunk);
+    return ref?.startsWith('refs/remotes/') ? `origin/${trunk}` : trunk;
+}
+/** precondition(pr): `needs-<kind>:<resource>` labels gate a PR until they're cleared. */
+const NEEDS_LABEL = /^needs-[a-z0-9]+:/i;
+function preconditionLabels(labels) {
+    return labels.filter((l) => NEEDS_LABEL.test(l));
+}
+function renderGate(gate) {
+    if (gate.unknown) {
+        console.log('\n🛑 precondition UNKNOWN: could not read PR labels (gh missing/unauthenticated) — failing closed.');
+    }
+    else if (gate.unmet) {
+        console.log(`\n🛑 precondition UNMET: ${gate.labels.join(', ')} — resource not satisfied; clear the label to merge.`);
+    }
+    else {
+        console.log('\n✅ precondition: no unmet needs-* gate.');
+    }
+}
+function renderCarries(report) {
+    const total = report.own.length + report.inherited.length;
+    console.log(`\n🧬 carries: ${total} commit(s) — ${report.own.length} own, ${report.inherited.length} inherited`);
+    for (const c of report.own)
+        console.log(`   • ${c.sha.slice(0, 7)} ${c.subject}  (own)`);
+    for (const c of report.inherited) {
+        console.log(`   🚩 ${c.sha.slice(0, 7)} ${c.subject}  — also on ${c.branches.join(', ')}`);
+    }
+    if (report.flagged) {
+        console.log('   ⚠️ provenance: this PR carries commits from another open branch — merging lands them too.');
+    }
+}
+async function runRealConflicts(options) {
+    // `|| resolveRealBase(...)` short-circuits: an explicit --base skips trunk
+    // detection entirely, as it always has.
+    let base = options.base || resolveRealBase(getTrunkBranch());
+    // Determine target branches.
+    let targets;
+    let prNumber;
+    if (options.pr) {
+        // --pr in real mode: the PR head isn't a local ref, so fetch it. Without
+        // this, --real fell through to getCurrentBranch() and silently checked
+        // trunk-vs-trunk → a false "clean" (tb-57fr).
+        prNumber = parseInt(options.pr, 10);
+        if (isNaN(prNumber) || prNumber <= 0) {
+            console.error('❌ Invalid PR number. Provide a positive integer, e.g. --pr 42');
+            return 1;
+        }
+        const ref = `refs/spidersan/pr-${prNumber}`;
+        try {
+            // pull/<n>/head exists on the base repo even for fork PRs.
+            // Leading '+' forces the update — after a PR force-push the stashed
+            // ref is non-fast-forward and a plain refspec would fail forever.
+            execFileSync('git', ['fetch', '--quiet', 'origin', `+pull/${prNumber}/head:${ref}`], { stdio: 'pipe' });
+            // Check against the REMOTE trunk, not a possibly-stale local one — a PR
+            // merges into origin's HEAD. Falling back to local `main` (which can lag)
+            // is the same false-confidence class as tb-57fr.
+            if (!options.base) {
+                const trunk = getTrunkBranch();
+                // Unlike resolveRealBase(), this arm DOES fetch — it is already
+                // fetching the PR head, and a PR merges into origin's tip.
+                execFileSync('git', ['fetch', '--quiet', 'origin', trunk], { stdio: 'pipe' });
+                base = `origin/${trunk}`;
+            }
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(`❌ Could not fetch PR #${prNumber} head: ${msg}`);
+            return 1;
+        }
+        targets = [ref];
+    }
+    else if (options.all) {
+        // --all enumerates registered branches → requires an initialized registry.
+        const storage = await getStorage();
+        if (!(await storage.isInitialized())) {
+            console.error('❌ Spidersan not initialized. Run: spidersan init');
+            console.error('   (--real --all needs the registry; --real alone does not)');
+            return 1;
+        }
+        // Reconcile-on-read: fold git truth over stale `active` status so a
+        // branch already merged into trunk isn't checked for conflicts (tb-8sa.1).
+        targets = activeBranches(await storage.list()).map((b) => b.name);
+    }
+    else {
+        targets = [options.branch || getCurrentBranch()];
+    }
+    const results = [];
+    for (const branch of targets) {
+        results.push(await analyzeRealConflicts(base, branch));
+    }
+    const anyConflicts = results.some((r) => !r.error && !r.clean);
+    // --pr extras: precondition() gate + carries() provenance (opt-in, compose).
+    let gate;
+    let carries;
+    if (prNumber !== undefined) {
+        const ref = `refs/spidersan/pr-${prNumber}`;
+        if (options.gate) {
+            // Fail closed: if gh is missing or the label fetch errors we cannot
+            // prove the gate is clear, so it stays unmet.
+            const labels = isGhAvailable() ? await getPRLabels(prNumber) : null;
+            if (labels === null) {
+                gate = { labels: [], unmet: true, unknown: true };
+            }
+            else {
+                const needs = preconditionLabels(labels);
+                gate = { labels: needs, unmet: needs.length > 0 };
+            }
+        }
+        if (options.carries) {
+            const self = [base]; // exclude base + the PR's own remote head from "other branch"
+            try {
+                self.push(`origin/${(await getPRDetails(prNumber)).headBranch}`);
+            }
+            catch { /* best-effort self-exclusion */ }
+            carries = analyzeCarries(base, ref, self);
+        }
+    }
+    if (options.json) {
+        console.log(JSON.stringify({ base, results, carries, gate }, null, 2));
+    }
+    else {
+        if (results.length === 0) {
+            console.log(`🕷️ No active branches to check vs ${base}.`);
+        }
+        for (const report of results) {
+            renderRealReport(report);
+        }
+        if (gate)
+            renderGate(gate);
+        if (carries)
+            renderCarries(carries);
+    }
+    // --strict is the advertised CI flag on the legacy path; honour it here too
+    // instead of silently ignoring it (real conflicts are always tier-blocking).
+    return (options.exitCode || options.strict) && (anyConflicts || gate?.unmet === true) ? 1 : 0;
+}
+export const conflictsCommand = new Command('conflicts')
+    .description('Detect file conflicts between branches (with tiered blocking)')
+    .option('--branch <name>', 'Check conflicts for specific branch')
+    .option('--pr <number>', 'Check conflicts for a GitHub pull request by number')
+    .option('--vs-prs', 'Also detect conflicts against other open PRs (not just registered branches); composes with --real')
+    .option('--json', 'Output as JSON')
+    .option('--tier <level>', 'Filter by minimum tier (1, 2, or 3)', '1')
+    .option('--strict', 'Strict mode: exit with error if TIER 2+ conflicts found')
+    .option('--notify', 'Deliver TIER 2+ conflicts to the configured alert room (SPIDERSAN_ROOM_TOKEN)')
+    .option('--semantic', 'Use semantic (AST) analysis for symbol-level conflict detection')
+    .option('--ecosystem', 'Scan all ecosystem repos and aggregate conflict tiers')
+    .option('--repos <paths>', 'Comma-separated repo paths for --ecosystem scan')
+    .option('--real', 'Compute TRUE merge conflicts via git merge-tree (vs registry overlap)')
+    .option('--base <ref>', 'Base/trunk ref to merge into for --real (default: detected trunk)')
+    .option('--all', 'With --real: check every active registered branch')
+    .option('--exit-code', 'With --real: exit 1 if any real conflicts found (like git diff)')
+    .option('--carries', 'With --pr: show carries() provenance (own vs inherited commits)')
+    .option('--gate', 'With --pr: check precondition() needs-* labels; --exit-code blocks if unmet')
+    .action(async (options) => {
+    // ── Real (git merge-tree) conflicts ──────────────────────────────────
+    // Runs BEFORE the storage-init guard: a single-target real check is pure
+    // git and must work with no .spidersan/registry.json. Only --real --all
+    // touches the registry, and runRealConflicts gates that path itself.
+    //
+    // --pr defaults to the real merge-tree path (tb-8hgg): "will this PR merge
+    // into trunk" is the common question and file-overlap false-positives it
+    // (see #80/identity.ts). Opt into the legacy file-overlap check with --vs-prs.
+    //
+    // --real --vs-prs COMPOSES: it runs the merge-tree check vs trunk AND then
+    // falls through to the cross-PR/overlap pass, because the two answer
+    // different questions ("does this merge?" vs "is anyone else touching these
+    // files?") and /spidersan documents `conflicts --pr <N> --real --vs-prs` as
+    // THE authoritative pre-merge check. Before sp-a1l3 the `options.real` arm
+    // returned here, so that documented command silently dropped the cross-PR
+    // half and exited 0 looking healthy — a check reporting success while doing
+    // nothing. Exit codes are composed at the end via finish(): real conflicts
+    // are tier-blocking, overlap is advisory (only --strict makes it block), so
+    // the process code is max(real, overlap).
+    const composeRealAndOverlap = !!(options.real && options.vsPrs);
+    let realExitCode = 0;
+    if (options.real || (options.pr && !options.vsPrs)) {
+        realExitCode = await runRealConflicts(options);
+        if (!composeRealAndOverlap) {
+            if (realExitCode !== 0)
+                process.exit(realExitCode);
+            return;
+        }
+        console.log(''); // separate the two reports
+    }
+    /**
+     * Terminate the overlap pass, folding in the real-conflict verdict.
+     * On the composed path a non-zero code from EITHER half must survive;
+     * on the plain overlap path realExitCode is 0, so behaviour is unchanged.
+     */
+    const finish = (overlapCode) => {
+        const code = Math.max(realExitCode, overlapCode);
+        if (code !== 0)
+            process.exit(code);
+    };
+    // ── Ecosystem shortcut ───────────────────────────────────────────────
+    if (options.ecosystem) {
+        // No built-in repo list ships with the package: the list comes from
+        // --repos, SPIDERSAN_ECOSYSTEM (path list) or conflicts.ecosystemRepos.
+        const { repos } = resolveEcosystemRepos(await loadConfig(), {
+            reposFlag: options.repos,
+        });
+        if (repos.length === 0) {
+            console.error(`ℹ️  ${ECOSYSTEM_UNCONFIGURED_HINT}`);
+        }
+        runEcosystemScan(repos, !!options.json);
+        finish(0);
+        return;
+    }
+    const storage = await getStorage();
+    const config = await loadConfig();
+    if (!await storage.isInitialized()) {
+        // --real is deliberately registry-independent; adding --vs-prs must not
+        // turn a working real check into a hard failure. Degrade loudly instead
+        // of dying — but never silently (sp-a1l3).
+        if (composeRealAndOverlap) {
+            console.error('⚠️  Overlap/cross-PR check skipped: spidersan not initialized here (run: spidersan init).');
+            console.error('   The --real merge-tree result above stands on its own; the --vs-prs half did NOT run.');
+            finish(0);
+            return;
+        }
+        console.error('❌ Spidersan not initialized. Run: spidersan init');
+        process.exit(1);
+    }
+    const minTier = parseInt(options.tier, 10);
+    // Load custom patterns from config
+    const highSeverity = (config.conflicts?.highSeverityPatterns || []).map(p => new RegExp(p));
+    const mediumSeverity = (config.conflicts?.mediumSeverityPatterns || []).map(p => new RegExp(p));
+    const compiledHigh = compilePatterns(highSeverity);
+    const compiledMedium = compilePatterns(mediumSeverity);
+    let targetBranch;
+    let targetFiles;
+    let targetPrNumber;
+    const prNumberByLabel = new Map(); // display label -> PR number (labels are NOT git refs)
+    if (options.pr) {
+        // --pr mode: fetch PR head branch + changed files from GitHub
+        const prNumber = parseInt(options.pr, 10);
+        if (isNaN(prNumber) || prNumber <= 0) {
+            console.error('❌ Invalid PR number. Provide a positive integer, e.g. --pr 42');
+            process.exit(1);
+        }
+        if (!isGhAvailable()) {
+            console.error('❌ GitHub CLI (gh) is not available or not authenticated.');
+            console.error('   Install: https://cli.github.com  →  gh auth login');
+            process.exit(1);
+        }
+        let prDetails;
+        try {
+            prDetails = await getPRDetails(prNumber);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(`❌ Failed to fetch PR #${prNumber}: ${msg}`);
+            process.exit(1);
+        }
+        targetBranch = prDetails.headBranch;
+        targetFiles = prDetails.files;
+        targetPrNumber = prNumber;
+        console.log(`🕷️ Checking conflicts for PR #${prNumber}: "${prDetails.title}"`);
+        console.log(`   Branch: ${targetBranch} (${targetFiles.length} file(s) changed)`);
+    }
+    else {
+        // Normal --branch or current branch mode
+        targetBranch = options.branch || getCurrentBranch();
+        const target = await storage.get(targetBranch);
+        if (!target) {
+            // Same reasoning as the isInitialized() guard above: on the composed
+            // --real --vs-prs path the real check already produced a valid answer,
+            // so an unregistered branch degrades the overlap half loudly rather
+            // than failing the whole command (sp-a1l3).
+            if (composeRealAndOverlap) {
+                console.error(`⚠️  Overlap/cross-PR check skipped: branch "${targetBranch}" is not registered (run: spidersan register --files "...").`);
+                console.error('   The --real merge-tree result above stands on its own; the --vs-prs half did NOT run.');
+                finish(0);
+                return;
+            }
+            console.error(`❌ Branch "${targetBranch}" is not registered.`);
+            console.error('   Run: spidersan register --files "..."');
+            process.exit(1);
+        }
+        targetFiles = target.files;
+    }
+    // Reconcile-on-read: branches already merged into trunk drop out before
+    // overlap detection, so a stale `active` entry can't phantom-conflict (tb-8sa.1).
+    const allBranches = activeBranches(await storage.list());
+    // --vs-prs: pull other open PRs as conflict targets too, so two simultaneous
+    // PRs touching the same files flag each other even when neither branch is in
+    // the local registry. PRs become synthetic active "branches" (no agent → wake
+    // skips them). Self (same headBranch) is excluded.
+    // ponytail: 1 + N gh calls (list + per-PR diff); fine for typical open-PR counts,
+    // parallelise if a repo ever carries hundreds of open PRs.
+    const prHeadBranches = [];
+    if (options.vsPrs) {
+        if (!isGhAvailable()) {
+            console.error('⚠️  --vs-prs needs gh (unavailable/unauthenticated); checking registered branches only.');
+        }
+        else {
+            const openPRs = (await listOpenPRs()).filter(pr => pr.headBranch !== targetBranch);
+            prHeadBranches.push(...openPRs.map(pr => pr.headBranch));
+            openPRs.forEach(pr => prNumberByLabel.set(`PR #${pr.number} (${pr.headBranch})`, pr.number));
+            const prBranches = await Promise.all(openPRs.map(async (pr) => ({
+                name: `PR #${pr.number} (${pr.headBranch})`,
+                files: await getPRChangedFiles(pr.number),
+                registeredAt: new Date(),
+                status: 'active',
+                description: pr.title,
+            })));
+            allBranches.push(...prBranches.filter(b => b.files.length > 0));
+        }
+    }
+    // Cross-machine: other machines' registered branches are conflict targets
+    // too. Automatic (not opt-in) so the pre-push/pre-merge hook — which calls
+    // plain `conflicts` — actually catches a teammate on another machine
+    // touching the same file. Fail-open: degraded => local-only (tb-ly0b).
+    const cross = await fetchCrossMachineBranches([targetBranch, ...allBranches.map(b => b.name), ...prHeadBranches]);
+    allBranches.push(...cross.branches);
+    const crossMachineLabels = new Set(cross.branches.map(b => b.name)); // origin-only refs for these
+    const conflicts = [];
+    // Performance Optimization: Convert target files to Set for O(1) lookup
+    // Reduces complexity from O(N*M*K) to O(N*M) where N=branches, M=files/branch, K=target_files
+    // Filter excluded paths (node_modules/, dist/, etc.) at query time to handle stale registrations
+    const targetFilesSet = new Set(targetFiles.filter(f => !isExcludedPath(f)));
+    for (const branch of allBranches) {
+        if (branch.name === targetBranch || branch.status !== 'active')
+            continue;
+        // Performance Optimization: Replace .filter() with a standard loop to avoid array allocation.
+        // Short-circuit using O(1) Set lookup (targetFilesSet.has) before calling the expensive isExcludedPath.
+        const overlappingFiles = [];
+        for (let i = 0; i < branch.files.length; i++) {
+            const f = branch.files[i];
+            if (targetFilesSet.has(f) && !isExcludedPath(f)) {
+                overlappingFiles.push(f);
+            }
+        }
+        if (overlappingFiles.length > 0) {
+            // Get highest tier for this conflict
+            let maxTier = { tier: 1, label: 'WARN', icon: '🟡', action: '' };
+            for (const file of overlappingFiles) {
+                const fileTier = classifyWithLabel(file, {
+                    extraTier3: compiledHigh,
+                    extraTier2: compiledMedium,
+                });
+                if (fileTier.tier > maxTier.tier) {
+                    maxTier = fileTier;
+                }
+            }
+            if (maxTier.tier >= minTier) {
+                conflicts.push({
+                    branch: branch.name,
+                    files: overlappingFiles,
+                    tier: maxTier.tier,
+                    tierInfo: maxTier,
+                    ...(branch.sessionId ? { sessionId: branch.sessionId } : {}),
+                });
+            }
+        }
+    }
+    // SEMANTIC ANALYSIS with AST parser
+    let semanticConflicts = [];
+    let semanticSkipped = []; // files we could not analyze — "no conflicts" is unproven if non-empty
+    let semanticUnsupported = []; // overlapping files of a type --semantic doesn't cover
+    if (options.semantic && conflicts.length > 0) {
+        console.log('\n🔬 Running semantic (AST) analysis...');
+        const fetchPrRef = (n) => {
+            const ref = `refs/spidersan/pr-${n}`;
+            try {
+                // '+' forces the update after a PR force-push (same as the --real arm)
+                execFileSync('git', ['fetch', '--quiet', 'origin', `+pull/${n}/head:${ref}`], { stdio: 'pipe', timeout: 30_000 }); // bounded: a stalled origin must not hang the command
+                return ref;
+            }
+            catch {
+                return null;
+            }
+        };
+        // Labels ("PR #N (branch)", "machine/branch") are display text, not refs:
+        // resolve each to a real ref, or null (→ reported as skipped, never swallowed).
+        const refForLabel = (label) => {
+            const n = prNumberByLabel.get(label);
+            if (n !== undefined)
+                return fetchPrRef(n);
+            // another machine's branch resolves only against origin; a registered local branch is local-first
+            return crossMachineLabels.has(label) ? resolveCrossMachineRef(label) : resolveBranchTip(label);
+        };
+        // Current side: the PR's own head under --pr (HEAD is just whatever is checked out),
+        // else the target branch (HEAD when it is the checked-out one).
+        const currentRef = targetPrNumber !== undefined
+            ? fetchPrRef(targetPrNumber)
+            : targetBranch === getCurrentBranch() ? 'HEAD' : resolveBranchTip(targetBranch);
+        const res = analyzeSemantic(targetBranch, currentRef, conflicts.map(c => ({ label: c.branch, files: c.files, ref: refForLabel(c.branch) })));
+        semanticConflicts = res.conflicts;
+        semanticSkipped = res.skipped;
+        semanticUnsupported = res.unsupported;
+        for (const line of semanticSkipped)
+            console.log(`  ⚠️  ${line}`);
+        if (semanticUnsupported.length > 0) {
+            const shown = semanticUnsupported.slice(0, 5).join(', ') + (semanticUnsupported.length > 5 ? `, +${semanticUnsupported.length - 5} more` : '');
+            console.log(`  ℹ️  not analyzable by --semantic (unsupported file type): ${shown}`);
+        }
+    }
+    // Sort by tier (highest first)
+    conflicts.sort((a, b) => b.tier - a.tier);
+    let tier3Count = 0;
+    let tier2Count = 0;
+    let tier1Count = 0;
+    for (const c of conflicts) {
+        if (c.tier === 3)
+            tier3Count++;
+        else if (c.tier === 2)
+            tier2Count++;
+        else if (c.tier === 1)
+            tier1Count++;
+    }
+    // Log conflict detection to activity log
+    if (conflicts.length > 0) {
+        logActivity({
+            event: 'conflict_detected',
+            branch: targetBranch,
+            details: {
+                tier3: tier3Count,
+                tier2: tier2Count,
+                tier1: tier1Count,
+                conflicting_branches: conflicts.map(c => c.branch),
+            }
+        });
+    }
+    // Check for blocking conditions
+    const shouldBlock = options.strict && (tier3Count > 0 || tier2Count > 0);
+    // Deliver the alert if requested
+    if (options.notify && (tier3Count > 0 || tier2Count > 0)) {
+        await notifyConflicts(targetBranch, conflicts);
+    }
+    if (options.json) {
+        console.log(JSON.stringify({
+            branch: targetBranch,
+            conflicts,
+            crossMachine: cross.status,
+            summary: {
+                tier3: tier3Count,
+                tier2: tier2Count,
+                tier1: tier1Count,
+                blocked: shouldBlock
+            }
+        }, null, 2));
+        finish(shouldBlock ? 1 : 0);
+        return;
+    }
+    if (conflicts.length === 0) {
+        // Say what was CHECKED, not what we wish it proved. This path compares
+        // registered file lists; it never runs a merge. It is structurally blind
+        // to add/add and content conflicts against the base — so "no overlap"
+        // is not "merges cleanly", and claiming the latter is the lie this
+        // wording removes (PATTERN_silent_success, instance #5).
+        const compared = allBranches.filter((b) => b.name !== targetBranch && b.status === 'active').length;
+        console.log(`🕷️ No registry overlap for "${targetBranch}" (vs ${compared} registered branch${compared === 1 ? '' : 'es'})`);
+        console.log('   ℹ️  Registry-only — NOT a merge simulation. For merge readiness: spidersan conflicts --real');
+        // Never let a failed cross-machine check read as an all-clear — that
+        // silent false confidence is the whole bug this path fixes (tb-ly0b).
+        if (cross.degraded) {
+            console.error('   ⚠️  Cross-machine check unavailable — LOCAL branches only.');
+        }
+        else if (cross.status === 'no-credentials') {
+            // Same lie, quieter: no creds in this shell reads exactly like a clean cloud check.
+            console.log('   ℹ️  Cloud registry not checked (no Supabase credentials) — LOCAL branches only.');
+        }
+        finish(0);
+        return;
+    }
+    console.log(`
+🕷️ CONFLICT ANALYSIS: "${targetBranch}"
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+        `);
+    for (const conflict of conflicts) {
+        console.log(`${conflict.tierInfo.icon} TIER ${conflict.tier} (${conflict.tierInfo.label}): ${conflict.branch}${conflict.sessionId ? ` (session ${conflict.sessionId})` : ''}`);
+        for (const file of conflict.files) {
+            const fileTier = classifyWithLabel(file, {
+                extraTier3: compiledHigh,
+                extraTier2: compiledMedium,
+            });
+            console.log(`   ${fileTier.icon} ${file}`);
+        }
+        console.log(`   → ${conflict.tierInfo.action}`);
+        console.log('');
+    }
+    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+    console.log(`📊 Summary: 🔴 ${tier3Count} BLOCK | 🟠 ${tier2Count} PAUSE | 🟡 ${tier1Count} WARN`);
+    // Show semantic analysis results
+    if (options.semantic && semanticConflicts.length > 0) {
+        console.log(`\n🔬 SEMANTIC CONFLICTS DETECTED (${semanticConflicts.length} symbols):`);
+        console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+        for (const sc of semanticConflicts) {
+            console.log(`  ⚡ ${sc.symbolType} '${sc.symbolName}'`);
+            console.log(`     Modified in BOTH branches (different content)`);
+        }
+        console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+        console.log('\n💡 TIP: Coordinate on these specific functions/classes,');
+        console.log('   not just the files. One of you should rebase.');
+        if (semanticSkipped.length + semanticUnsupported.length > 0) {
+            console.log(`   ⚠️  incomplete: ${semanticSkipped.length + semanticUnsupported.length} file(s) could not be analyzed, so more may exist.`);
+        }
+    }
+    else if (options.semantic && semanticSkipped.length + semanticUnsupported.length > 0) {
+        console.log(`\n🔬 SEMANTIC ANALYSIS: incomplete — ${semanticSkipped.length + semanticUnsupported.length} file(s) could not be analyzed; no verdict.`);
+    }
+    else if (options.semantic && semanticConflicts.length === 0) {
+        console.log('\n🔬 SEMANTIC ANALYSIS: No symbol-level conflicts!');
+        console.log('   Files overlap, but different functions were modified.');
+        console.log('   ✅ Likely safe to merge (git will auto-merge).');
+    }
+    if (tier3Count > 0) {
+        console.log(`
+🔴 TIER 3 CONFLICTS FOUND
+   These files are security-critical and MUST be resolved.
+   Merge is BLOCKED until conflicts are cleared.
+            `);
+    }
+    else if (tier2Count > 0) {
+        console.log(`
+🟠 TIER 2 CONFLICTS FOUND
+   Coordinate with the other agent before proceeding.
+            `);
+    }
+    if (shouldBlock) {
+        console.log('❌ Strict mode: Exiting with error due to TIER 2+ conflicts.');
+    }
+    finish(shouldBlock ? 1 : 0);
+});
+//# sourceMappingURL=conflicts.js.map