Merge pull request #14 from pylon-code/upstream/2026-08-13-pr-surfaces

feat(web): adopt upstream pull request surfaces

Author: rynfar

apps/server/src/auth/RpcAuthorization.ts

@@ -61,10 +61,13 @@ export const RPC_REQUIRED_SCOPES = {
   [WS_METHODS.pullRequestsActivity]: AuthOrchestrationReadScope,
   [WS_METHODS.pullRequestsDiffFileContents]: AuthOrchestrationReadScope,
   [WS_METHODS.pullRequestsRunAction]: AuthOrchestrationOperateScope,
+  [WS_METHODS.pullRequestsUpdate]: AuthOrchestrationOperateScope,
   [WS_METHODS.pullRequestsComment]: AuthOrchestrationOperateScope,
+  [WS_METHODS.pullRequestsUpdateComment]: AuthOrchestrationOperateScope,
   [WS_METHODS.pullRequestsSubmitReview]: AuthOrchestrationOperateScope,
   [WS_METHODS.pullRequestsReplyToThread]: AuthOrchestrationOperateScope,
   [WS_METHODS.pullRequestsSetThreadResolution]: AuthOrchestrationOperateScope,
+  [WS_METHODS.pullRequestsSetReaction]: AuthOrchestrationOperateScope,
   // Read scope like the reads it un-caches: refreshing is part of reading, and a read-only
   // client pressing refresh must not be told it may not look again.
   [WS_METHODS.pullRequestsInvalidate]: AuthOrchestrationReadScope,

apps/server/src/git/GitManager.test.ts

@@ -9,8 +9,10 @@ import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
 import * as Option from "effect/Option";
 import * as PlatformError from "effect/PlatformError";
+import * as References from "effect/References";
 import * as Scope from "effect/Scope";
 import { ChildProcessSpawner } from "effect/unstable/process";
 import { expect } from "vite-plus/test";
@@ -1439,6 +1441,58 @@ it.layer(GitManagerTestLayer)("GitManager", (it) => {
     }),
   );
 
+  it.effect("status logs actionable provider detail without exposing the upstream cause", () =>
+    Effect.gen(function* () {
+      const repoDir = yield* makeTempDir("t3code-git-manager-");
+      yield* initRepo(repoDir);
+      yield* runGit(repoDir, ["checkout", "-b", "feature/status-rate-limited"]);
+      const remoteDir = yield* createBareRemote();
+      yield* runGit(repoDir, ["remote", "add", "origin", remoteDir]);
+      yield* runGit(repoDir, ["push", "-u", "origin", "feature/status-rate-limited"]);
+
+      const upstreamCause = "GraphQL rate limit for user ID 51714798 and token secret-value";
+      const { manager } = yield* makeManager({
+        ghScenario: {
+          failWith: new GitHubCli.GitHubCliRateLimitError({
+            command: "gh",
+            cwd: repoDir,
+            cause: new Error(upstreamCause),
+          }),
+        },
+      });
+      const logs: Array<{ message: string; annotations: Record<string, unknown> }> = [];
+      const logger = Logger.make<unknown, void>(({ fiber, message }) => {
+        logs.push({
+          message: String(message),
+          annotations: { ...fiber.getRef(References.CurrentLogAnnotations) },
+        });
+      });
+
+      const status = yield* manager
+        .status({ cwd: repoDir })
+        .pipe(Effect.provide(Logger.layer([logger], { mergeWithExisting: false })));
+
+      expect(status.pr).toBeNull();
+      const warning = logs.find((entry) => entry.message.includes("PR lookup failed"));
+      expect(warning?.annotations).toMatchObject({
+        operation: "lookupStatusPr",
+        branch: "feature/status-rate-limited",
+        errorTag: "SourceControlProviderError",
+        provider: "github",
+        providerOperation: "listChangeRequests",
+        providerCommand: "gh",
+        errorDetail:
+          "GitHub API rate limit exceeded. Run `gh api rate_limit` to inspect the quota and reset time.",
+      });
+      const loggedText = [
+        warning?.message ?? "",
+        ...Object.values(warning?.annotations ?? {}).map(String),
+      ].join("\n");
+      expect(loggedText).not.toContain(upstreamCause);
+      expect(loggedText).not.toContain("secret-value");
+    }),
+  );
+
   it.effect("status keeps the last known PR when a later lookup fails", () =>
     Effect.gen(function* () {
       const repoDir = yield* makeTempDir("t3code-git-manager-");

apps/server/src/git/GitManager.ts

@@ -12,6 +12,7 @@ import * as Option from "effect/Option";
 import * as Order from "effect/Order";
 import * as Path from "effect/Path";
 import * as Ref from "effect/Ref";
+import * as Schema from "effect/Schema";
 import {
   GitActionProgressEvent,
   GitActionProgressPhase,
@@ -28,6 +29,7 @@ import {
   type VcsStatusRemoteResult,
   VcsStatusResult,
   ModelSelection,
+  SourceControlProviderError,
   type SourceControlWritingStyleSettings,
 } from "@t3tools/contracts";
 import {
@@ -113,6 +115,7 @@ const PR_LOOKUP_CACHE_TTL = Duration.minutes(2);
 const PR_LOOKUP_FAILURE_BASE_TTL = Duration.seconds(20);
 const PR_LOOKUP_FAILURE_MAX_TTL = Duration.minutes(15);
 const PR_LOOKUP_CACHE_CAPACITY = 2_048;
+const isSourceControlProviderError = Schema.is(SourceControlProviderError);
 
 /**
  * How long a failed PR lookup is cached, given the number of consecutive
@@ -1066,6 +1069,14 @@ export const make = Effect.gen(function* () {
               typeof error === "object" && error !== null && "_tag" in error
                 ? String(error._tag)
                 : typeof error,
+            ...(isSourceControlProviderError(error)
+              ? {
+                  provider: error.provider,
+                  providerOperation: error.operation,
+                  providerCommand: error.command ?? "unknown",
+                  errorDetail: error.detail,
+                }
+              : {}),
           }),
           Effect.andThen(resolveBranchHeadContext(cwd, details)),
           Effect.map((headContext) =>

apps/server/src/pullRequest/AzureDevOpsPullRequestCli.test.ts

@@ -342,7 +342,40 @@ layer("AzureDevOpsPullRequestCli.layer", (it) => {
     }),
   );
 
+  it.effect("stores the squash choice with an auto-completion, as a merge now does", () =>
+    Effect.gen(function* () {
+      mockedExecute.mockReturnValue(Effect.succeed(output("{}")));
+      const cli = yield* AzureDevOpsPullRequestCli.AzureDevOpsPullRequestCli;
+
+      yield* cli.runPullRequestAction({
+        cwd: "/w",
+        number: 42,
+        action: "enable-auto-merge",
+        mergeMethod: "squash",
+      });
+
+      expect(argsOfCall(0)).toEqual([
+        "repos",
+        "pr",
+        "update",
+        "--detect",
+        "true",
+        "--id",
+        "42",
+        "--auto-complete",
+        "true",
+        "--squash",
+        "true",
+        "--only-show-errors",
+        "--output",
+        "json",
+      ]);
+    }),
+  );
+
   it.effect.each([
+    { action: "enable-auto-merge", expected: ["--auto-complete", "true", "--squash", "false"] },
+    { action: "disable-auto-merge", expected: ["--auto-complete", "false"] },
     { action: "draft", expected: ["--draft", "true"] },
     { action: "ready", expected: ["--draft", "false"] },
     { action: "close", expected: ["--status", "abandoned"] },
@@ -370,6 +403,79 @@ layer("AzureDevOpsPullRequestCli.layer", (it) => {
     }),
   );
 
+  it.effect.each([
+    { name: "a title", rewrite: { title: "Add the page" }, expected: ["--title=Add the page"] },
+    {
+      name: "a description",
+      rewrite: { body: "Why the page changed" },
+      expected: ["--description=Why the page changed"],
+    },
+    {
+      name: "both",
+      rewrite: { title: "Add the page", body: "Why the page changed" },
+      expected: ["--title=Add the page", "--description=Why the page changed"],
+    },
+  ] as const)("rewrites $name, sending nothing it was not given", ({ rewrite, expected }) =>
+    Effect.gen(function* () {
+      mockedExecute.mockReturnValue(Effect.succeed(output("{}")));
+      const cli = yield* AzureDevOpsPullRequestCli.AzureDevOpsPullRequestCli;
+
+      yield* cli.updatePullRequest({ cwd: "/w", number: 42, ...rewrite });
+
+      expect(argsOfCall(0)).toEqual([
+        "repos",
+        "pr",
+        "update",
+        "--detect",
+        "true",
+        "--id",
+        "42",
+        ...expected,
+        "--only-show-errors",
+        "--output",
+        "json",
+      ]);
+    }),
+  );
+
+  it.effect("sends a description that starts with a dash as one value, not as a flag", () =>
+    Effect.gen(function* () {
+      mockedExecute.mockReturnValue(Effect.succeed(output("{}")));
+      const cli = yield* AzureDevOpsPullRequestCli.AzureDevOpsPullRequestCli;
+
+      yield* cli.updatePullRequest({
+        cwd: "/w",
+        number: 42,
+        body: "- rewrote the page\n- kept the rest",
+      });
+
+      // One argument, so the leading dash of an ordinary bullet list never reaches az as a flag,
+      // and the whole text stays together where `--description` would otherwise take several.
+      expect(argsOfCall(0)).toContain("--description=- rewrote the page\n- kept the rest");
+    }),
+  );
+
+  it.effect("rewrites through the provider, which says it takes one", () =>
+    Effect.gen(function* () {
+      mockedExecute.mockReturnValue(Effect.succeed(output("{}")));
+      const provider = yield* AzureDevOpsPullRequestProvider.make;
+
+      // False for a remark because nothing here can post one, so there is none to rewrite.
+      expect(provider.capabilities.edit).toEqual({ changeRequest: true, comment: false });
+      assert.isDefined(provider.updateChangeRequest);
+      yield* provider.updateChangeRequest({
+        cwd: "/w",
+        repository: "web",
+        host: "dev.azure.com",
+        number: 42,
+        title: "Add the page",
+      });
+
+      expect(argsOfCall(0)).toContain("--title=Add the page");
+      expect(argsOfCall(0)).not.toContain("--description");
+    }),
+  );
+
   it.effect("reads the conversation through the REST API, pinned to a version", () =>
     Effect.gen(function* () {
       mockedExecute.mockReturnValueOnce(

apps/server/src/pullRequest/AzureDevOpsPullRequestCli.ts

@@ -159,6 +159,14 @@ export class AzureDevOpsPullRequestCli extends Context.Service<
       readonly mergeMethod?: PullRequestMergeMethod;
     }) => Effect.Effect<void, AzureDevOpsPullRequestCliError>;
 
+    /** Rewrites the pull request's own words, through the same command that moves it. */
+    readonly updatePullRequest: (input: {
+      readonly cwd: string;
+      readonly number: number;
+      readonly title?: string | undefined;
+      readonly body?: string | undefined;
+    }) => Effect.Effect<void, AzureDevOpsPullRequestCliError>;
+
     /**
      * Adds reviewers to a pull request, or takes them off it. `az repos pr reviewer` is the whole
      * of what Azure offers here: it adds and removes named identities, and has no counterpart that
@@ -212,12 +220,21 @@ function actionArgs(
   switch (action) {
     case "merge":
       return ["--status", "completed", "--squash", mergeMethod === "squash" ? "true" : "false"];
+    // Auto-complete is Azure's own name for it: the pull request stays active and Azure completes
+    // it once its policies pass. The squash choice is stored with it, as it is for a merge now.
+    case "enable-auto-merge":
+      return ["--auto-complete", "true", "--squash", mergeMethod === "squash" ? "true" : "false"];
+    case "disable-auto-merge":
+      return ["--auto-complete", "false"];
     case "ready":
       return ["--draft", "false"];
     case "draft":
       return ["--draft", "true"];
     case "close":
       return ["--status", "abandoned"];
+    // Never reached: this host does not declare the action, so nothing offers it.
+    case "update-branch":
+      return [];
     case "reopen":
       return ["--status", "active"];
   }
@@ -481,6 +498,29 @@ export const make = Effect.gen(function* () {
           ],
         })
         .pipe(Effect.asVoid),
+
+    updatePullRequest: (input) =>
+      azure
+        .execute({
+          cwd: input.cwd,
+          args: [
+            "repos",
+            "pr",
+            "update",
+            ...detectArgs,
+            "--id",
+            String(input.number),
+            // One argument rather than a flag and a value beside it: a description usually opens
+            // with a bullet, and az reads a dash in the next argv slot as a flag of its own.
+            // `--description` also takes several strings, and this keeps the whole text as one.
+            ...(input.title === undefined ? [] : [`--title=${input.title}`]),
+            ...(input.body === undefined ? [] : [`--description=${input.body}`]),
+            "--only-show-errors",
+            "--output",
+            "json",
+          ],
+        })
+        .pipe(Effect.asVoid),
   });
 });
 

apps/server/src/pullRequest/AzureDevOpsPullRequestProvider.test.ts

@@ -9,7 +9,15 @@ describe("azure devops viewer permissions", () => {
     // and an unknown permission is granted rather than guessed away. Azure refuses the ones it
     // will not allow, at the moment they are taken, in words this could not have written.
     expect(AZURE_DEVOPS_VIEWER_PERMISSIONS).toEqual({
-      actions: ["merge", "ready", "draft", "close", "reopen"],
+      actions: [
+        "merge",
+        "ready",
+        "draft",
+        "close",
+        "reopen",
+        "enable-auto-merge",
+        "disable-auto-merge",
+      ],
       // False because the host itself cannot post one, not because this viewer may not.
       comment: false,
       resolve: false,

apps/server/src/pullRequest/AzureDevOpsPullRequestProvider.ts

@@ -18,18 +18,31 @@ const CAPABILITIES: PullRequestCapabilities = {
   // Reading a conversation is a plain REST read, but posting one is not something this can
   // claim without having run it, so the composer stays hidden.
   comment: false,
-  actions: ["merge", "ready", "draft", "close", "reopen"],
+  actions: [
+    "merge",
+    "ready",
+    "draft",
+    "close",
+    "reopen",
+    "enable-auto-merge",
+    "disable-auto-merge",
+  ],
   // Azure squashes as a completion option; it has no rebase strategy of its own.
   mergeMethods: ["merge", "squash"],
   // `az repos pr list` filters by status, creator, reviewer and branch, and by no text at all.
   search: false,
+  reactions: false,
   // With no patch to show there are no lines to write against, so nothing here is offered.
   review: { inlineComment: false, reply: false, resolve: false, verdicts: [] },
   // `az repos pr reviewer add` and `remove` name identities, and nothing anywhere in `az repos`
   // lists the ones this repository could name — that lives behind the identity and graph APIs, a
   // different service with its own permissions. So the page takes a name here rather than being
   // handed a menu built out of a guess.
   reviewers: { request: true, listCandidates: false },
+  // A new title and description travel on the same `az repos pr update` that moves a pull request.
+  // Rewriting a remark is false for the same reason posting one is: this cannot put a remark on
+  // Azure DevOps at all, so there is nothing here it could rewrite either.
+  edit: { changeRequest: true, comment: false },
 };
 
 /**
@@ -153,6 +166,7 @@ export const make = Effect.gen(function* () {
             checks: [],
             mergeCapabilities: { merge: true, squash: true, rebase: false },
             viewerPermissions: AZURE_DEVOPS_VIEWER_PERMISSIONS,
+            autoMergeEnabled: pullRequest.autoMergeEnabled,
           }),
         ),
       ),
@@ -206,6 +220,16 @@ export const make = Effect.gen(function* () {
         })
         .pipe(Effect.mapError(fail("runAction"))),
 
+    updateChangeRequest: (input) =>
+      cli
+        .updatePullRequest({
+          cwd: input.cwd,
+          number: input.number,
+          title: input.title,
+          body: input.body,
+        })
+        .pipe(Effect.mapError(fail("updateChangeRequest"))),
+
     // Never called: `capabilities.reviewers.listCandidates` is false, and the service refuses the
     // list without it.
     listReviewerCandidates: () =>
@@ -240,6 +264,8 @@ export const make = Effect.gen(function* () {
     replyToThread: () => unsupported("replyToThread"),
 
     setThreadResolution: () => unsupported("setThreadResolution"),
+
+    setReaction: () => unsupported("setReaction"),
   };
 
   return provider;