stageflow 0.42.0 → 0.44.0

package/dist/runstore/runStatusClock.js

@@ -0,0 +1,19 @@
+export const RUN_CLOCK_TERMINAL_STATUSES = [
+    "succeeded",
+    "failed",
+    "cancelled",
+];
+const TERMINAL = new Set(RUN_CLOCK_TERMINAL_STATUSES);
+export function isRunClockTerminal(status) {
+    return status !== undefined && TERMINAL.has(status);
+}
+export function nextFinishedAt(input) {
+    if (isRunClockTerminal(input.nextStatus)) {
+        if (input.currentFinishedAt != null &&
+            input.currentFinishedAt !== "") {
+            return { action: "keep" };
+        }
+        return { action: "stamp", finishedAt: input.now };
+    }
+    return { action: "clear" };
+}

package/dist/runstore/sqlite/SqliteRunStore.d.ts

@@ -32,6 +32,7 @@ export declare class SqliteRunStore implements RunStore {
     findRunByDispatchKey(dispatchKey: string): Promise<CreatedRun | undefined>;
     private readSubmission;
     getRunBySubmission(key: string): Promise<RunSubmissionRecord | null>;
+    private applyRunStatusUpdate;
     updateRunStatus(runId: string, status: RunStatus): Promise<void>;
     tryUpdateRunStatus(runId: string, status: RunStatus, expectedStatus: RunStatus): Promise<boolean>;
     patchRunWorkspaceBinding(runId: string, patch: {

package/dist/runstore/sqlite/SqliteRunStore.js

@@ -15,6 +15,7 @@ import { applyPendingMigrations, assertSchemaVersion, } from "./migrations/index
 import { StoreSchemaError } from "./storeSchemaError.js";
 import { applyStorePragmas } from "./applyStorePragmas.js";
 import { RunSubmissionExistsError } from "../submission.js";
+import { nextFinishedAt } from "../runStatusClock.js";
 const EXECUTION_SELECT_COLS = `run_id, stage_id, attempt, status, verification_outcome, started_at, finished_at, envelope_json, cost_usd, usage_json, auto_resume_count`;
 const ensuredStageDirs = new Set();
 function executionFromRow(row) {
@@ -289,58 +290,57 @@ export class SqliteRunStore {
         await this.ready();
         return this.readSubmission(key);
     }
+    applyRunStatusUpdate(runId, status, expectedStatus) {
+        const now = new Date().toISOString();
+        const current = this.db
+            .prepare(`SELECT finished_at FROM runs WHERE run_id = ?`)
+            .get(runId);
+        if (current === undefined) {
+            throw new Error(`Run not found: ${runId}`);
+        }
+        const decision = nextFinishedAt({
+            nextStatus: status,
+            currentFinishedAt: current.finished_at,
+            now,
+        });
+        const params = {
+            run_id: runId,
+            status,
+            updated_at: now,
+        };
+        let finishedSql;
+        if (decision.action === "stamp") {
+            finishedSql = "finished_at = @finished_at";
+            params.finished_at = decision.finishedAt;
+        }
+        else if (decision.action === "clear") {
+            finishedSql = "finished_at = NULL";
+        }
+        else {
+            finishedSql = "finished_at = finished_at";
+        }
+        const expectedClause = expectedStatus !== undefined
+            ? " AND status = @expected_status"
+            : "";
+        if (expectedStatus !== undefined) {
+            params.expected_status = expectedStatus;
+        }
+        const result = this.db
+            .prepare(`UPDATE runs SET status = @status, updated_at = @updated_at, ${finishedSql}
+         WHERE run_id = @run_id${expectedClause}`)
+            .run(params);
+        return result.changes;
+    }
     async updateRunStatus(runId, status) {
         await this.ready();
-        const now = new Date().toISOString();
-        const isTerminal = status === "succeeded" || status === "failed" || status === "cancelled";
-        const result = isTerminal
-            ? this.db
-                .prepare(`UPDATE runs SET status = @status, updated_at = @updated_at,
-              finished_at = COALESCE(finished_at, @finished_at)
-             WHERE run_id = @run_id`)
-                .run({
-                run_id: runId,
-                status,
-                updated_at: now,
-                finished_at: now,
-            })
-            : this.db
-                .prepare(`UPDATE runs SET status = @status, updated_at = @updated_at WHERE run_id = @run_id`)
-                .run({
-                run_id: runId,
-                status,
-                updated_at: now,
-            });
-        if (result.changes === 0) {
+        if (this.applyRunStatusUpdate(runId, status, undefined) === 0) {
             throw new Error(`Run not found: ${runId}`);
         }
     }
     async tryUpdateRunStatus(runId, status, expectedStatus) {
         await this.ready();
-        const now = new Date().toISOString();
-        const isTerminal = status === "succeeded" || status === "failed" || status === "cancelled";
-        const result = isTerminal
-            ? this.db
-                .prepare(`UPDATE runs SET status = @status, updated_at = @updated_at,
-              finished_at = COALESCE(finished_at, @finished_at)
-             WHERE run_id = @run_id AND status = @expected_status`)
-                .run({
-                run_id: runId,
-                status,
-                expected_status: expectedStatus,
-                updated_at: now,
-                finished_at: now,
-            })
-            : this.db
-                .prepare(`UPDATE runs SET status = @status, updated_at = @updated_at
-             WHERE run_id = @run_id AND status = @expected_status`)
-                .run({
-                run_id: runId,
-                status,
-                expected_status: expectedStatus,
-                updated_at: now,
-            });
-        if (result.changes > 0)
+        const changes = this.applyRunStatusUpdate(runId, status, expectedStatus);
+        if (changes > 0)
             return true;
         const exists = this.db
             .prepare(`SELECT 1 AS ok FROM runs WHERE run_id = ?`)

package/dist/runstore/workspaceLayout.js

@@ -1,6 +1,7 @@
 import { access, lstat, mkdir, readdir, realpath } from "node:fs/promises";
 import path from "node:path";
 import { globalCredentialRoot } from "../project/globalHome.js";
+import { buildArtifactListedPath } from "../runtime/artifactPath.js";
 import { STAGEFLOW_AGENT_AUTH_PATH_ENV } from "../runtime/credentialBinding.js";
 import { SF_STAGE_WORKER } from "../runtime/stageWorkerProtocol.js";
 export { stageDir } from "./paths.js";
@@ -186,7 +187,11 @@ export function resolveArtifactTarget(runWorkspaceDir, stageId, attempt, relativ
         path.isAbsolute(relativeToArtifacts)) {
         throw new Error("path escapes the stage artifacts directory");
     }
-    const runRelativePath = path.posix.join("stages", stageId, "attempts", String(attempt), "artifacts", ...relativeToArtifacts.split(path.sep));
+    const runRelativePath = buildArtifactListedPath({
+        stageId,
+        attempt,
+        relative: relativeToArtifacts.split(path.sep).join("/"),
+    });
     return {
         absolutePath: resolved,
         runRelativePath,

package/dist/runtime/artifactDiskInspect.d.ts

@@ -0,0 +1,14 @@
+export type ArtifactDiskFileType = "file" | "directory" | "symlink" | "other" | "missing";
+export type ArtifactDiskPresence = {
+    file_type: ArtifactDiskFileType;
+    /** Lexical absolute path under root when the walk reached a leaf. */
+    absolutePath?: string;
+    /** From lstat when `file_type` is `file`. */
+    size_bytes?: number;
+};
+/**
+ * Closed-posture walk of `relativePath` under `rootDir`: lstat every segment,
+ * classify symlink / missing / file / directory / other. Does not follow
+ * symlinks. Escape attempts are `missing`. Non-ENOENT errors propagate.
+ */
+export declare function inspectArtifactUnderRoot(rootDir: string, relativePath: string): Promise<ArtifactDiskPresence>;

package/dist/runtime/artifactDiskInspect.js

@@ -0,0 +1,52 @@
+import { lstat } from "node:fs/promises";
+import path from "node:path";
+/**
+ * Closed-posture walk of `relativePath` under `rootDir`: lstat every segment,
+ * classify symlink / missing / file / directory / other. Does not follow
+ * symlinks. Escape attempts are `missing`. Non-ENOENT errors propagate.
+ */
+export async function inspectArtifactUnderRoot(rootDir, relativePath) {
+    const target = path.resolve(rootDir, relativePath);
+    const relative = path.relative(rootDir, target);
+    if (relative === "" ||
+        relative === ".." ||
+        relative.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relative)) {
+        return { file_type: "missing" };
+    }
+    try {
+        const segments = relative.split(path.sep).filter((segment) => segment !== "");
+        let current = rootDir;
+        let stats;
+        for (const segment of segments) {
+            current = path.join(current, segment);
+            stats = await lstat(current);
+            if (stats.isSymbolicLink()) {
+                return { file_type: "symlink", absolutePath: current };
+            }
+            if (current !== target && !stats.isDirectory()) {
+                return { file_type: "other", absolutePath: current };
+            }
+        }
+        if (stats === undefined) {
+            return { file_type: "missing" };
+        }
+        if (stats.isDirectory()) {
+            return { file_type: "directory", absolutePath: current };
+        }
+        if (!stats.isFile()) {
+            return { file_type: "other", absolutePath: current };
+        }
+        return {
+            file_type: "file",
+            absolutePath: current,
+            size_bytes: stats.size,
+        };
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return { file_type: "missing" };
+        }
+        throw error;
+    }
+}

package/dist/runtime/artifactPath.d.ts

@@ -0,0 +1,24 @@
+/** Parts of a run-relative artifact path under `stages/.../artifacts/`. */
+export type ArtifactPathParts = {
+    stageId: string;
+    attempt: number;
+    relative: string;
+};
+export type ArtifactPathMode = {
+    kind: "grantable";
+} | {
+    kind: "current_attempt";
+    stageId: string;
+    attempt: number;
+};
+export declare function attemptArtifactsPrefix(stageId: string, attempt: number): string;
+export declare function buildArtifactListedPath(parts: ArtifactPathParts): string;
+/**
+ * Accept a listed artifact path under a mode.
+ * - `grantable`: full run-relative path to a prior stage/attempt artifact file.
+ * - `current_attempt`: that attempt's run-relative prefix, or a bare path under
+ *   its artifacts dir; foreign `stages/...` paths are rejected.
+ */
+export declare function acceptArtifactListedPath(listedPath: string, mode: ArtifactPathMode): ArtifactPathParts | undefined;
+export declare function parseArtifactListedPath(listedPath: string): ArtifactPathParts | undefined;
+export declare function isGrantableArtifactPath(listedPath: string): boolean;

package/dist/runtime/artifactPath.js

@@ -0,0 +1,84 @@
+import path from "node:path";
+export function attemptArtifactsPrefix(stageId, attempt) {
+    return path.posix.join("stages", stageId, "attempts", String(attempt), "artifacts");
+}
+export function buildArtifactListedPath(parts) {
+    const relative = parts.relative.replace(/\\/g, "/");
+    const segments = relative.split("/").filter((segment) => segment.length > 0);
+    return path.posix.join("stages", parts.stageId, "attempts", String(parts.attempt), "artifacts", ...segments);
+}
+function parseStrictGrantable(listedPath) {
+    if (typeof listedPath !== "string" || listedPath.length === 0)
+        return undefined;
+    const posix = listedPath.replace(/\\/g, "/");
+    if (path.isAbsolute(listedPath) || path.posix.isAbsolute(posix))
+        return undefined;
+    if (posix.includes("\0") || posix.includes(".."))
+        return undefined;
+    const parts = posix.split("/").filter((part) => part.length > 0);
+    if (parts.length < 6)
+        return undefined;
+    if (parts[0] !== "stages" || parts[2] !== "attempts" || parts[4] !== "artifacts") {
+        return undefined;
+    }
+    const attemptRaw = parts[3];
+    if (!/^\d+$/.test(attemptRaw))
+        return undefined;
+    const attempt = Number(attemptRaw);
+    if (!Number.isInteger(attempt) || attempt < 1)
+        return undefined;
+    const relative = parts.slice(5).join("/");
+    if (relative.length === 0)
+        return undefined;
+    return {
+        stageId: parts[1],
+        attempt,
+        relative,
+    };
+}
+/**
+ * Accept a listed artifact path under a mode.
+ * - `grantable`: full run-relative path to a prior stage/attempt artifact file.
+ * - `current_attempt`: that attempt's run-relative prefix, or a bare path under
+ *   its artifacts dir; foreign `stages/...` paths are rejected.
+ */
+export function acceptArtifactListedPath(listedPath, mode) {
+    if (mode.kind === "grantable") {
+        return parseStrictGrantable(listedPath);
+    }
+    if (typeof listedPath !== "string" || listedPath.length === 0) {
+        return undefined;
+    }
+    const posixListed = listedPath.replace(/\\/g, "/");
+    if (path.isAbsolute(listedPath) || path.posix.isAbsolute(posixListed)) {
+        return undefined;
+    }
+    const prefix = attemptArtifactsPrefix(mode.stageId, mode.attempt);
+    if (posixListed === prefix || posixListed === `${prefix}/`) {
+        return undefined;
+    }
+    if (posixListed.startsWith(`${prefix}/`)) {
+        const relative = posixListed.slice(prefix.length + 1);
+        if (relative.length === 0)
+            return undefined;
+        return {
+            stageId: mode.stageId,
+            attempt: mode.attempt,
+            relative,
+        };
+    }
+    if (posixListed.startsWith("stages/")) {
+        return undefined;
+    }
+    return {
+        stageId: mode.stageId,
+        attempt: mode.attempt,
+        relative: posixListed,
+    };
+}
+export function parseArtifactListedPath(listedPath) {
+    return parseStrictGrantable(listedPath);
+}
+export function isGrantableArtifactPath(listedPath) {
+    return acceptArtifactListedPath(listedPath, { kind: "grantable" }) !== undefined;
+}

package/dist/runtime/completionCheckRunner.js

@@ -1,11 +1,12 @@
 import { createHash } from "node:crypto";
 import { spawn } from "node:child_process";
-import { lstat, readFile } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { assertEnvelopePayload } from "../envelope/payloadSchema.js";
 import { resolveBashPath } from "../preflight/bash.js";
 import { redactString } from "../logging/redact.js";
 import { getNamedSecrets } from "../logging/namedSecrets.js";
+import { inspectArtifactUnderRoot } from "./artifactDiskInspect.js";
 import { signalProcessGroup } from "./stageProcessLauncher.js";
 const MAX_COMMAND_OUTPUT_BYTES = 64 * 1024;
 const COMMAND_KILL_ESCALATE_MS = 2000;
@@ -163,56 +164,27 @@ async function runCommandCheck(check, input) {
     }
 }
 async function inspectArtifact(artifactsDir, relativePath) {
-    const target = path.resolve(artifactsDir, relativePath);
-    const relative = path.relative(artifactsDir, target);
-    if (relative === "" || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+    const presence = await inspectArtifactUnderRoot(artifactsDir, relativePath);
+    if (presence.file_type === "missing") {
         return { kind: "artifact", path: relativePath, exists: false, file_type: "missing" };
     }
-    try {
-        // lstat every component rather than just the target: lstat(target) follows
-        // a symlink in a parent directory, which could otherwise prove a file that
-        // lives outside the attempt artifact root.
-        const segments = relative.split(path.sep).filter((segment) => segment !== "");
-        let current = artifactsDir;
-        let stats;
-        for (const segment of segments) {
-            current = path.join(current, segment);
-            stats = await lstat(current);
-            if (stats.isSymbolicLink()) {
-                return { kind: "artifact", path: relativePath, exists: true, file_type: "symlink" };
-            }
-            if (current !== target && !stats.isDirectory()) {
-                return { kind: "artifact", path: relativePath, exists: true, file_type: "other" };
-            }
-        }
-        if (stats === undefined) {
-            return { kind: "artifact", path: relativePath, exists: false, file_type: "missing" };
-        }
-        if (stats.isSymbolicLink()) {
-            return { kind: "artifact", path: relativePath, exists: true, file_type: "symlink" };
-        }
-        if (stats.isDirectory()) {
-            return { kind: "artifact", path: relativePath, exists: true, file_type: "directory" };
-        }
-        if (!stats.isFile()) {
-            return { kind: "artifact", path: relativePath, exists: true, file_type: "other" };
-        }
-        const content = await readFile(target);
+    if (presence.file_type !== "file" || presence.absolutePath === undefined) {
         return {
             kind: "artifact",
             path: relativePath,
             exists: true,
-            file_type: "file",
-            size_bytes: stats.size,
-            sha256: createHash("sha256").update(content).digest("hex"),
+            file_type: presence.file_type,
         };
     }
-    catch (error) {
-        if (error.code === "ENOENT") {
-            return { kind: "artifact", path: relativePath, exists: false, file_type: "missing" };
-        }
-        throw error;
-    }
+    const content = await readFile(presence.absolutePath);
+    return {
+        kind: "artifact",
+        path: relativePath,
+        exists: true,
+        file_type: "file",
+        size_bytes: presence.size_bytes,
+        sha256: createHash("sha256").update(content).digest("hex"),
+    };
 }
 async function runArtifactCheck(check, input) {
     try {

package/dist/runtime/githubPollSource.d.ts

@@ -15,6 +15,7 @@ export type GithubPullItem = {
     user: {
         login: string;
     } | null;
+    head_sha?: string | null;
 };
 export type GithubPollResponse = {
     status: number;
@@ -35,14 +36,28 @@ export type GithubPollClient = {
 };
 export declare function defaultCreateGithubClient(token: string): GithubPollClient;
 export type NormalizedGithubEvent = {
-    action: "opened" | "merged" | "closed" | "updated";
+    action: "opened" | "synchronize" | "updated" | "merged" | "closed";
     number: number;
     title: string;
     url: string;
     author: string;
     repo: string;
     updatedAt: string;
+    headSha?: string;
 };
+type PollCursor = {
+    updatedAt: string;
+    number: number;
+};
+/**
+ * Classify a PR list delta into a normalized GitHub action.
+ *
+ * `opened` is reserved for brand-new PRs: equal created/updated timestamps, or
+ * first sight of a number whose `created_at` is after the poll cursor. A missing
+ * prior head SHA alone is not enough — that also happens on upgrade (no `heads`
+ * row yet), eviction, or a cold PR falling into the poll window.
+ */
+export declare function deriveGithubAction(item: GithubPullItem, previousHeadSha: string | undefined, cursor?: PollCursor | null): NormalizedGithubEvent["action"];
 export type GithubPollSourceOptions = {
     store: RunStore;
     cwd?: string;
@@ -59,9 +74,11 @@ export type GithubPollSourceOptions = {
  * per tick regardless of how many triggers watch it), and diffs each repo's
  * PR list against a persisted ETag + cursor to find genuinely new activity.
  *
- * The first tick for a never-before-seen repo only seeds the cursor — it
- * never fires for a repo's pre-existing PR history, mirroring how
- * `ScheduleSource` seeds `next_run_at` without firing on first sight.
+ * The first tick for a never-before-seen repo only seeds the cursor and
+ * per-PR head SHAs — it never fires for a repo's pre-existing PR history,
+ * mirroring how `ScheduleSource` seeds `next_run_at` without firing on
+ * first sight. The same quiet baseline runs when a cursor already exists
+ * but `heads` has never been written (upgrade from a pre-heads store).
  */
 export declare class GithubPollSource implements TriggerSourcePort {
     private readonly store;
@@ -84,3 +101,4 @@ export declare class GithubPollSource implements TriggerSourcePort {
     private pollRepo;
     private fireSafely;
 }
+export {};

package/dist/runtime/githubPollSource.js

@@ -50,31 +50,99 @@ export function defaultCreateGithubClient(token) {
                     created_at: pr.created_at,
                     updated_at: pr.updated_at,
                     user: pr.user ? { login: pr.user.login } : null,
+                    head_sha: pr.head?.sha ?? null,
                 })),
             };
         },
     };
 }
-function deriveAction(item) {
+const HEADS_LIMIT = 200;
+function isCreatedAfterCursor(item, cursor) {
+    const createdMs = new Date(item.created_at).getTime();
+    const cursorMs = new Date(cursor.updatedAt).getTime();
+    if (createdMs !== cursorMs)
+        return createdMs > cursorMs;
+    return item.number > cursor.number;
+}
+/**
+ * Classify a PR list delta into a normalized GitHub action.
+ *
+ * `opened` is reserved for brand-new PRs: equal created/updated timestamps, or
+ * first sight of a number whose `created_at` is after the poll cursor. A missing
+ * prior head SHA alone is not enough — that also happens on upgrade (no `heads`
+ * row yet), eviction, or a cold PR falling into the poll window.
+ */
+export function deriveGithubAction(item, previousHeadSha, cursor = null) {
     if (item.merged_at)
         return "merged";
     if (item.state === "closed")
         return "closed";
     if (item.created_at === item.updated_at)
         return "opened";
+    if (previousHeadSha === undefined) {
+        if (cursor !== null && isCreatedAfterCursor(item, cursor))
+            return "opened";
+        return "updated";
+    }
+    const currentSha = item.head_sha ?? null;
+    if (previousHeadSha !== "" &&
+        currentSha !== null &&
+        currentSha !== previousHeadSha) {
+        return "synchronize";
+    }
     return "updated";
 }
-function normalizeGithubItem(item, repo) {
+function normalizeGithubItem(item, repo, previousHeadSha, cursor) {
+    const headSha = item.head_sha ?? null;
     return {
-        action: deriveAction(item),
+        action: deriveGithubAction(item, previousHeadSha, cursor),
         number: item.number,
         title: item.title,
         url: item.html_url,
         author: item.user?.login ?? "unknown",
         repo,
         updatedAt: item.updated_at,
+        ...(headSha ? { headSha } : {}),
     };
 }
+function parseHeads(raw) {
+    if (raw === null)
+        return {};
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+            return {};
+        const out = {};
+        for (const [key, value] of Object.entries(parsed)) {
+            if (typeof value === "string")
+                out[key] = value;
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
+function seedHeadsFromItems(items) {
+    const heads = {};
+    for (const item of items) {
+        const sha = item.head_sha ?? null;
+        if (sha)
+            heads[String(item.number)] = sha;
+    }
+    return heads;
+}
+function boundHeads(heads, currentItems) {
+    if (Object.keys(heads).length <= HEADS_LIMIT)
+        return heads;
+    const currentNumbers = new Set(currentItems.map((item) => String(item.number)));
+    const next = {};
+    for (const [key, value] of Object.entries(heads)) {
+        if (currentNumbers.has(key))
+            next[key] = value;
+    }
+    return next;
+}
 function parseCursor(raw) {
     if (raw === null)
         return null;
@@ -111,9 +179,11 @@ function firstSecretRef(matches) {
  * per tick regardless of how many triggers watch it), and diffs each repo's
  * PR list against a persisted ETag + cursor to find genuinely new activity.
  *
- * The first tick for a never-before-seen repo only seeds the cursor — it
- * never fires for a repo's pre-existing PR history, mirroring how
- * `ScheduleSource` seeds `next_run_at` without firing on first sight.
+ * The first tick for a never-before-seen repo only seeds the cursor and
+ * per-PR head SHAs — it never fires for a repo's pre-existing PR history,
+ * mirroring how `ScheduleSource` seeds `next_run_at` without firing on
+ * first sight. The same quiet baseline runs when a cursor already exists
+ * but `heads` has never been written (upgrade from a pre-heads store).
  */
 export class GithubPollSource {
     store;
@@ -217,6 +287,8 @@ export class GithubPollSource {
         const adapterId = `github:${repo}`;
         const etag = await this.store.getTriggerAdapterState(adapterId, "etag");
         const cursor = parseCursor(await this.store.getTriggerAdapterState(adapterId, "cursor"));
+        const headsRaw = await this.store.getTriggerAdapterState(adapterId, "heads");
+        let heads = parseHeads(headsRaw);
         const [owner, repoName] = repo.split("/");
         let response;
         try {
@@ -239,13 +311,24 @@ export class GithubPollSource {
         if (response.items.length === 0)
             return;
         const newest = response.items[0];
-        if (cursor === null) {
+        // First sight, or upgrade from a pre-heads store (cursor present, heads absent):
+        // baseline without firing so aged PRs are not misclassified as opened.
+        if (cursor === null || headsRaw === null) {
+            heads = seedHeadsFromItems(response.items);
+            await this.store.setTriggerAdapterState(adapterId, "heads", JSON.stringify(heads));
             await this.store.setTriggerAdapterState(adapterId, "cursor", JSON.stringify({ updatedAt: newest.updated_at, number: newest.number }));
             return;
         }
         const newItems = response.items.filter((item) => isNewerThanCursor(item, cursor)).reverse();
         for (const item of newItems) {
-            const summary = normalizeGithubItem(item, repo);
+            const numberKey = String(item.number);
+            const previousHeadSha = Object.prototype.hasOwnProperty.call(heads, numberKey) ? heads[numberKey] : undefined;
+            const summary = normalizeGithubItem(item, repo, previousHeadSha, cursor);
+            const nextSha = item.head_sha ?? null;
+            if (nextSha)
+                heads[numberKey] = nextSha;
+            else if (previousHeadSha !== undefined && previousHeadSha !== "")
+                heads[numberKey] = previousHeadSha;
             for (const match of matches) {
                 const { definition } = match;
                 if (!matchesEventFilter(definition.event?.match, summary))
@@ -253,6 +336,8 @@ export class GithubPollSource {
                 await this.fireSafely(onFire, match, summary);
             }
         }
+        heads = boundHeads(heads, response.items);
+        await this.store.setTriggerAdapterState(adapterId, "heads", JSON.stringify(heads));
         await this.store.setTriggerAdapterState(adapterId, "cursor", JSON.stringify({ updatedAt: newest.updated_at, number: newest.number }));
     }
     async fireSafely(onFire, match, summary) {

package/dist/runtime/priorArtifactGrants.d.ts

@@ -0,0 +1,8 @@
+import type { ResolvePriorEnvelopeResult } from "./envelopeRouting.js";
+import type { StageArtifactGrant } from "./stageRoots.js";
+export { isGrantableArtifactPath } from "./artifactPath.js";
+/** Sandbox path for one artifact. Colliding names from different attempts include the attempt. */
+export declare function assignGrantContainerPaths(listedPaths: readonly string[]): Map<string, string>;
+export declare function artifactGrantsFromPriors(workspaceDir: string, prior: Extract<ResolvePriorEnvelopeResult, {
+    ok: true;
+}>): Promise<StageArtifactGrant[]>;