Commit f4600d77dd7c2fa9f10e8f4500882e427fcc7e26 | the-knife

apps/server/integration/OrchestrationEngineHarness.integration.ts+1-1

...	@@ -352,7 +352,7 @@ export const makeOrchestrationIntegrationHarness = (	...	@@ -352,7 +352,7 @@ export const makeOrchestrationIntegrationHarness = (
352	Layer.provideMerge(runtimeServicesLayer),	352	Layer.provideMerge(runtimeServicesLayer),
353	Layer.provideMerge(	353	Layer.provideMerge(
354	Layer.mock(PullRequestService.PullRequestService)({	354	Layer.mock(PullRequestService.PullRequestService)({
355	refreshAfterTurn: Effect.void,	355	refreshAfterTurn: () => Effect.void,
356	}),	356	}),
357	),	357	),
358	Layer.provideMerge(	358	Layer.provideMerge(

apps/server/src/orchestration/Layers/CheckpointReactor.test.ts+1-1

...	@@ -336,7 +336,7 @@ describe("CheckpointReactor", () => {	...	@@ -336,7 +336,7 @@ describe("CheckpointReactor", () => {
336	prefix: "t3-checkpoint-reactor-test-",	336	prefix: "t3-checkpoint-reactor-test-",
337	});	337	});
338	const pullRequestRefreshes: number[] = [];	338	const pullRequestRefreshes: number[] = [];
339	const refreshAfterTurn = Effect.sync(() => void pullRequestRefreshes.push(1));	339	const refreshAfterTurn = () => Effect.sync(() => void pullRequestRefreshes.push(1));
340	const vcsStatusBroadcasterLayer = Layer.succeed(VcsStatusBroadcaster, {	340	const vcsStatusBroadcasterLayer = Layer.succeed(VcsStatusBroadcaster, {
341	getStatus: () => Effect.die("getStatus should not be called in this test"),	341	getStatus: () => Effect.die("getStatus should not be called in this test"),
342	refreshLocalStatus: (cwd: string) =>	342	refreshLocalStatus: (cwd: string) =>

apps/server/src/orchestration/Layers/CheckpointReactor.ts+1-1

...	@@ -886,7 +886,7 @@ const make = Effect.gen(function* () {	...	@@ -886,7 +886,7 @@ const make = Effect.gen(function* () {
886	(startedTurnId === undefined && !thread.session?.activeTurnId))	886	(startedTurnId === undefined && !thread.session?.activeTurnId))
887	) {	887	) {
888	pending.delete(event.threadId);	888	pending.delete(event.threadId);
889	yield* pullRequests.refreshAfterTurn;	889	yield* pullRequests.refreshAfterTurn(thread.projectId);
890	}	890	}
891	if (	891	if (
892	event.type === "turn.aborted" &&	892	event.type === "turn.aborted" &&

apps/server/src/pullRequest/GitHubPullRequestCli.test.ts+2

apps/server/src/pullRequest/GitHubPullRequestCli.ts+1

...	@@ -1106,6 +1106,7 @@ export const make = Effect.gen(function* () {	...	@@ -1106,6 +1106,7 @@ export const make = Effect.gen(function* () {
1106	captureVerifiedCredential(input).pipe(	1106	captureVerifiedCredential(input).pipe(
1107	Effect.flatMap(({ host, token, accountId, viewer, credentialFingerprint }) =>	1107	Effect.flatMap(({ host, token, accountId, viewer, credentialFingerprint }) =>
1108	use({ accountId, viewer, credentialFingerprint }).pipe(	1108	use({ accountId, viewer, credentialFingerprint }).pipe(
		1109	Effect.provideService(SourceControlRateLimit.CredentialScope, credentialFingerprint),
1109	Effect.provideService(GitHubCli.PinnedGitHubCredential, {	1110	Effect.provideService(GitHubCli.PinnedGitHubCredential, {
1110	host,	1111	host,
1111	token,	1112	token,

apps/server/src/pullRequest/GitHubPullRequestProvider.ts+5-1

 @@ -109,7 +109,11 @@ export function gitHubProviderFailure(
 ): PullRequestProviderFailure {
   if (error._tag === "GitHubCliUnavailableError") return { reason: "missing-tool" };
   if (error._tag === "GitHubCliAuthenticationError") return { reason: "unauthenticated" };
-  if (error._tag === "GitHubCliRateLimitError") return { reason: "rate-limited" };
+  if (error._tag === "GitHubCliRateLimitError")
+    return {
+      reason: "rate-limited",
+      ...(error.retryAt === undefined ? {} : { retryAt: error.retryAt }),
+    };
   if (error._tag === "SourceControlRateLimitPausedError") {
     return { reason: "rate-limited", retryAt: error.retryAt };
   }

apps/server/src/pullRequest/PullRequestReadCache.test.ts+175-9

...	@@ -5,18 +5,12 @@ import * as Deferred from "effect/Deferred";	...	@@ -5,18 +5,12 @@ import * as Deferred from "effect/Deferred";
5	import * as Effect from "effect/Effect";	5	import * as Effect from "effect/Effect";
6	import * as Fiber from "effect/Fiber";	6	import * as Fiber from "effect/Fiber";
7	import * as FileSystem from "effect/FileSystem";	7	import * as FileSystem from "effect/FileSystem";
8	import * as Layer from "effect/Layer";
9	import * as TestClock from "effect/testing/TestClock";	8	import * as TestClock from "effect/testing/TestClock";
10	import * as KeyValueStore from "effect/unstable/persistence/KeyValueStore";	9	import * as KeyValueStore from "effect/unstable/persistence/KeyValueStore";
11	import * as Persistence from "effect/unstable/persistence/Persistence";
12	import * as PullRequestReadCache from "./PullRequestReadCache.ts";	10	import * as PullRequestReadCache from "./PullRequestReadCache.ts";
13		11
14	const cacheLayer = (directory: string) =>	12	const cacheLayer = (directory: string) =>
15	PullRequestReadCache.make.pipe(	13	PullRequestReadCache.make.pipe(Effect.provide(KeyValueStore.layerFileSystem(directory)));
16	Effect.provide(
17	Persistence.layerKvs.pipe(Layer.provideMerge(KeyValueStore.layerFileSystem(directory))),
18	),
19	);
20		14
21	it.layer(NodeServices.layer)("PR filesystem cache", (it) => {	15	it.layer(NodeServices.layer)("PR filesystem cache", (it) => {
22	it.effect("reuses files after restart and respects the original expiry", () =>	16	it.effect("reuses files after restart and respects the original expiry", () =>
...	@@ -52,15 +46,106 @@ it.layer(NodeServices.layer)("PR filesystem cache", (it) => {	...	@@ -52,15 +46,106 @@ it.layer(NodeServices.layer)("PR filesystem cache", (it) => {
52	Effect.andThen(Deferred.await(release)),	46	Effect.andThen(Deferred.await(release)),
53	Effect.as("old"),	47	Effect.as("old"),
54	),	48	),
		49	["pr"],
55	)	50	)
56	.pipe(Effect.forkChild);	51	.pipe(Effect.forkChild);
57	yield* Deferred.await(started);	52	yield* Deferred.await(started);
58	const invalidate = yield* cache.invalidate.pipe(Effect.forkChild({ startImmediately: true }));	53	const invalidate = yield* cache
		54	.invalidate("pr")
		55	.pipe(Effect.forkChild({ startImmediately: true }));
59	yield* Deferred.succeed(release, undefined);	56	yield* Deferred.succeed(release, undefined);
60	yield* Fiber.join(read);	57	yield* Fiber.join(read);
61	yield* Fiber.join(invalidate);	58	yield* Fiber.join(invalidate);
62	const restarted = yield* cacheLayer(directory);	59	const restarted = yield* cacheLayer(directory);
63	assert.strictEqual(yield* restarted.get("summary", Effect.succeed("new")), "new");	60	assert.strictEqual(yield* restarted.get("summary", Effect.succeed("new"), ["pr"]), "new");
		61	}),
		62	);
		63
		64	it.effect("invalidates only the changed scope across restarts and coalesces its next reads", () =>
		65	Effect.gen(function* () {
		66	const fs = yield* FileSystem.FileSystem;
		67	const directory = yield* fs.makeTempDirectoryScoped({ prefix: "t3-pr-cache-" });
		68	let reads = 0;
		69	const lookup = Effect.sync(() => String(++reads));
		70	const cache = yield* cacheLayer(directory);
		71	yield* cache.get("first", lookup, ["project", "pr-1"]);
		72	yield* cache.get("second", lookup, ["project", "pr-2"]);
		73	yield* cache.get("third", lookup, ["other-project", "pr-3"]);
		74	yield* cache.invalidate("pr-1");
		75	const restarted = yield* cacheLayer(directory);
		76	const answers = yield* Effect.all(
		77	Array.from({ length: 10 }, () => restarted.get("first", lookup, ["project", "pr-1"])),
		78	{ concurrency: 10 },
		79	);
		80	assert.deepStrictEqual(answers, Array(10).fill("4"));
		81	assert.strictEqual(yield* restarted.get("second", lookup, ["project", "pr-2"]), "2");
		82	yield* restarted.invalidate("project");
		83	const again = yield* cacheLayer(directory);
		84	assert.strictEqual(yield* again.get("second", lookup, ["project", "pr-2"]), "5");
		85	assert.strictEqual(yield* again.get("third", lookup, ["other-project", "pr-3"]), "3");
		86	assert.strictEqual(reads, 5);
		87	const files = (yield* fs.readDirectory(directory)).length;
		88	for (let index = 0; index < 3; index++) {
		89	yield* again.invalidate("pr-1");
		90	yield* again.get("first", lookup, ["project", "pr-1"]);
		91	}
		92	assert.strictEqual((yield* fs.readDirectory(directory)).length, files);
		93	}),
		94	);
		95
		96	it.effect("shares a pending refresh without blocking an unrelated cached PR", () =>
		97	Effect.gen(function* () {
		98	const cache = yield* PullRequestReadCache.make;
		99	yield* cache.get("first", Effect.succeed("old"), ["pr-1"]);
		100	yield* cache.get("second", Effect.succeed("warm"), ["pr-2"]);
		101	yield* cache.invalidate("pr-1");
		102	const started = yield* Deferred.make<void>();
		103	const release = yield* Deferred.make<void>();
		104	let reads = 0;
		105	const refresh = cache.get(
		106	"first",
		107	Effect.gen(function* () {
		108	reads++;
		109	yield* Deferred.succeed(started, undefined);
		110	yield* Deferred.await(release);
		111	return "fresh";
		112	}),
		113	["pr-1"],
		114	);
		115	const pending = yield* Effect.all(
		116	Array.from({ length: 10 }, () => refresh),
		117	{
		118	concurrency: 10,
		119	},
		120	).pipe(Effect.forkChild);
		121	yield* Deferred.await(started);
		122	assert.strictEqual(yield* cache.get("second", Effect.die("cache miss"), ["pr-2"]), "warm");
		123	yield* Deferred.succeed(release, undefined);
		124	assert.deepStrictEqual(yield* Fiber.join(pending), Array(10).fill("fresh"));
		125	assert.strictEqual(reads, 1);
		126	}).pipe(Effect.provide(KeyValueStore.layerMemory)),
		127	);
		128
		129	it.effect("compacts expired scope records without discarding fresh PR data", () =>
		130	Effect.gen(function* () {
		131	const fs = yield* FileSystem.FileSystem;
		132	const directory = yield* fs.makeTempDirectoryScoped({ prefix: "t3-pr-cache-" });
		133	const cache = yield* cacheLayer(directory);
		134	yield* cache.get("summary", Effect.succeed("old"), ["pr"]);
		135	yield* cache.invalidate("pr");
		136	for (let index = 0; index < 100; index++) yield* cache.invalidate(`pr-${index}`);
		137	assert.strictEqual((yield* fs.readDirectory(directory)).length, 2);
		138	const before = (yield* fs.stat(`${directory}/revisions`)).size;
		139	yield* TestClock.adjust("59 seconds");
		140	assert.strictEqual(yield* cache.get("summary", Effect.succeed("fresh"), ["pr"]), "fresh");
		141	yield* TestClock.adjust("1 second");
		142	yield* cache.invalidate("other-pr");
		143	assert.isTrue((yield* fs.stat(`${directory}/revisions`)).size < before);
		144	const restarted = yield* cacheLayer(directory);
		145	assert.strictEqual(
		146	yield* restarted.get("summary", Effect.die("cache miss"), ["pr"]),
		147	"fresh",
		148	);
64	}),	149	}),
65	);	150	);
66		151
...	@@ -75,4 +160,85 @@ it.layer(NodeServices.layer)("PR filesystem cache", (it) => {	...	@@ -75,4 +160,85 @@ it.layer(NodeServices.layer)("PR filesystem cache", (it) => {
75	assert.strictEqual(yield* restarted.get("summary", Effect.succeed("recovered")), "recovered");	160	assert.strictEqual(yield* restarted.get("summary", Effect.succeed("recovered")), "recovered");
76	}),	161	}),
77	);	162	);
		163
		164	it.effect("resumes caching after a failed scope read", () =>
		165	Effect.gen(function* () {
		166	const backing = yield* KeyValueStore.KeyValueStore;
		167	let fail = true;
		168	let reads = 0;
		169	const cache = yield* PullRequestReadCache.make.pipe(
		170	Effect.provideService(KeyValueStore.KeyValueStore, {
		171	...backing,
		172	get: (key) =>
		173	Effect.suspend(() => {
		174	if (!fail) return backing.get(key);
		175	fail = false;
		176	return Effect.fail(
		177	new KeyValueStore.KeyValueStoreError({ method: "get", message: "unavailable" }),
		178	);
		179	}),
		180	}),
		181	);
		182	const read = cache.get(
		183	"summary",
		184	Effect.sync(() => String(++reads)),
		185	["pr"],
		186	);
		187	assert.strictEqual(yield* read, "1");
		188	assert.strictEqual(yield* read, "2");
		189	assert.strictEqual(yield* read, "2");
		190	}).pipe(Effect.provide(KeyValueStore.layerMemory)),
		191	);
		192
		193	it.effect("cancels abandoned reads without blocking invalidation", () =>
		194	Effect.gen(function* () {
		195	const cache = yield* PullRequestReadCache.make;
		196	const started = yield* Deferred.make<void>();
		197	const read = yield* cache
		198	.get("summary", Deferred.succeed(started, undefined).pipe(Effect.andThen(Effect.never)), [
		199	"pr",
		200	])
		201	.pipe(Effect.forkChild);
		202	yield* Deferred.await(started);
		203	yield* Fiber.interrupt(read);
		204	yield* cache.invalidate("pr");
		205	assert.strictEqual(yield* cache.get("summary", Effect.succeed("fresh"), ["pr"]), "fresh");
		206	}).pipe(Effect.provide(KeyValueStore.layerMemory)),
		207	);
		208
		209	it.effect(
		210	"finishes the in-memory revision update when invalidation is canceled after writing",
		211	() =>
		212	Effect.gen(function* () {
		213	const backing = yield* KeyValueStore.KeyValueStore;
		214	const written = yield* Deferred.make<void>();
		215	const release = yield* Deferred.make<void>();
		216	const cache = yield* PullRequestReadCache.make.pipe(
		217	Effect.provideService(KeyValueStore.KeyValueStore, {
		218	...backing,
		219	set: (key, value) =>
		220	backing
		221	.set(key, value)
		222	.pipe(
		223	Effect.andThen(
		224	key === "revisions"
		225	? Deferred.succeed(written, undefined).pipe(
		226	Effect.andThen(Deferred.await(release)),
		227	)
		228	: Effect.void,
		229	),
		230	),
		231	}),
		232	);
		233	yield* cache.get("summary", Effect.succeed("old"), ["pr"]);
		234	const invalidation = yield* cache.invalidate("pr").pipe(Effect.forkChild);
		235	yield* Deferred.await(written);
		236	const interrupt = yield* Fiber.interrupt(invalidation).pipe(
		237	Effect.forkChild({ startImmediately: true }),
		238	);
		239	yield* Deferred.succeed(release, undefined);
		240	yield* Fiber.join(interrupt);
		241	assert.strictEqual(yield* cache.get("summary", Effect.succeed("fresh"), ["pr"]), "fresh");
		242	}).pipe(Effect.provide(KeyValueStore.layerMemory)),
		243	);
78	});	244	});

apps/server/src/pullRequest/PullRequestReadCache.ts+92-34

...	@@ -5,7 +5,6 @@ import * as Hash from "effect/Hash";	...	@@ -5,7 +5,6 @@ import * as Hash from "effect/Hash";
5	import { PullRequestOperationError, PullRequestUnavailableError } from "@t3tools/contracts";	5	import { PullRequestOperationError, PullRequestUnavailableError } from "@t3tools/contracts";
6	import * as Crypto from "effect/Crypto";	6	import * as Crypto from "effect/Crypto";
7	import * as Encoding from "effect/Encoding";	7	import * as Encoding from "effect/Encoding";
8	import * as Option from "effect/Option";
9	import * as Context from "effect/Context";	8	import * as Context from "effect/Context";
10	import * as Duration from "effect/Duration";	9	import * as Duration from "effect/Duration";
11	import * as Effect from "effect/Effect";	10	import * as Effect from "effect/Effect";
...	@@ -22,19 +21,35 @@ import { ServerConfig } from "../config.ts";	...	@@ -22,19 +21,35 @@ import { ServerConfig } from "../config.ts";
22		21
23	const CONCURRENT_READS = 512;	22	const CONCURRENT_READS = 512;
24	type ReadError = PullRequestOperationError \| PullRequestUnavailableError;	23	type ReadError = PullRequestOperationError \| PullRequestUnavailableError;
25		24	const revisionCodec = Schema.fromJsonString(
		25	Schema.Record(
		26	Schema.String,
		27	Schema.Struct({ revision: Schema.String, expiresAt: Schema.Finite }),
		28	),
		29	);
26	class Read extends Persistable.Class<{	30	class Read extends Persistable.Class<{
27	payload: { key: string; lookup: Effect.Effect<string, ReadError> };	31	payload: { key: string; revision: string; lookup: Effect.Effect<string, ReadError> };
28	}>()("PullRequestRead", {	32	}>()("PullRequestRead", {
29	primaryKey: ({ key }) => key,	33	primaryKey: ({ key }) => key,
30	success: Schema.Struct({ payload: Schema.String, expiresAt: Schema.Finite }),	34	success: Schema.Struct({
		35	payload: Schema.String,
		36	expiresAt: Schema.Finite,
		37	revision: Schema.optionalKey(Schema.String),
		38	}),
31	error: Schema.Union([PullRequestOperationError, PullRequestUnavailableError]),	39	error: Schema.Union([PullRequestOperationError, PullRequestUnavailableError]),
32	}) {	40	}) {
		41	matchesRevision(revision: string \| undefined): boolean {
		42	const stored = revision?.split(":") ?? [];
		43	return this.revision
		44	.split(":")
		45	.every((value, index) => value === "" \|\| value === stored[index]);
		46	}
		47
33	[Equal.symbol](that: unknown): boolean {	48	[Equal.symbol](that: unknown): boolean {
34	return that instanceof Read && that.key === this.key;	49	return that instanceof Read && that.key === this.key && that.revision === this.revision;
35	}	50	}
36	[Hash.symbol](): number {	51	[Hash.symbol](): number {
37	return Hash.string(this.key);	52	return Hash.string(`${this.key}:${this.revision}`);
38	}	53	}
39	}	54	}
40		55
...	@@ -44,8 +59,9 @@ export class PullRequestReadCache extends Context.Service<	...	@@ -44,8 +59,9 @@ export class PullRequestReadCache extends Context.Service<
44	readonly get: (	59	readonly get: (
45	key: string,	60	key: string,
46	lookup: Effect.Effect<string, ReadError>,	61	lookup: Effect.Effect<string, ReadError>,
		62	scopes?: ReadonlyArray<string>,
47	) => Effect.Effect<string, ReadError>;	63	) => Effect.Effect<string, ReadError>;
48	readonly invalidate: Effect.Effect<void>;	64	readonly invalidate: (scope: string) => Effect.Effect<void>;
49	}	65	}
50	>()("t3/pullRequest/PullRequestReadCache") {}	66	>()("t3/pullRequest/PullRequestReadCache") {}
51		67
...	@@ -55,6 +71,18 @@ export const make = Effect.gen(function* () {	...	@@ -55,6 +71,18 @@ export const make = Effect.gen(function* () {
55	const clock = yield* Clock.Clock;	71	const clock = yield* Clock.Clock;
56	let enabled = true;	72	let enabled = true;
57	const lock = yield* Semaphore.make(CONCURRENT_READS);	73	const lock = yield* Semaphore.make(CONCURRENT_READS);
		74	const digest = (key: string) =>
		75	crypto.digest("SHA-256", new TextEncoder().encode(key)).pipe(Effect.map(Encoding.encodeHex));
		76	const revisions = yield* Cache.makeWith(
		77	() =>
		78	backing
		79	.get("revisions")
		80	.pipe(Effect.flatMap((raw) => Schema.decodeUnknownEffect(revisionCodec)(raw ?? "{}"))),
		81	{
		82	capacity: 1,
		83	timeToLive: (exit) => (Exit.isSuccess(exit) ? Duration.infinity : Duration.zero),
		84	},
		85	);
58	const timeToLive: Persistable.TimeToLiveFn<Read> = (exit) =>	86	const timeToLive: Persistable.TimeToLiveFn<Read> = (exit) =>
59	Exit.isSuccess(exit)	87	Exit.isSuccess(exit)
60	? Duration.millis(Math.max(0, exit.value.expiresAt - clock.currentTimeMillisUnsafe()))	88	? Duration.millis(Math.max(0, exit.value.expiresAt - clock.currentTimeMillisUnsafe()))
...	@@ -62,7 +90,11 @@ export const make = Effect.gen(function* () {	...	@@ -62,7 +90,11 @@ export const make = Effect.gen(function* () {
62	const cache = yield* PersistedCache.make(	90	const cache = yield* PersistedCache.make(
63	(request: Read) =>	91	(request: Read) =>
64	request.lookup.pipe(	92	request.lookup.pipe(
65	Effect.map((payload) => ({ payload, expiresAt: clock.currentTimeMillisUnsafe() + 60_000 })),	93	Effect.map((payload) => ({
		94	payload,
		95	expiresAt: clock.currentTimeMillisUnsafe() + 60_000,
		96	revision: request.revision,
		97	})),
66	),	98	),
67	{	99	{
68	storeId: "pr-v2",	100	storeId: "pr-v2",
...	@@ -70,36 +102,63 @@ export const make = Effect.gen(function* () {	...	@@ -70,36 +102,63 @@ export const make = Effect.gen(function* () {
70	inMemoryTTL: timeToLive,	102	inMemoryTTL: timeToLive,
71	inMemoryCapacity: CONCURRENT_READS,	103	inMemoryCapacity: CONCURRENT_READS,
72	},	104	},
		105	).pipe(Effect.provide(Persistence.layerKvs));
		106	const refreshes = yield* Cache.makeWith(
		107	Effect.fn("PullRequestReadCache.refresh")(function* (request: Read) {
		108	const stored = yield* cache.get(request);
		109	if (request.matchesRevision(stored.revision)) return stored;
		110	yield* cache.invalidate(request);
		111	return yield* cache.get(request);
		112	}),
		113	{ capacity: CONCURRENT_READS, timeToLive: () => Duration.zero },
73	);	114	);
74	return PullRequestReadCache.of({	115	return PullRequestReadCache.of({
75	get: Effect.fn("PullRequestReadCache.get")(function* (key, lookup) {	116	get: Effect.fn("PullRequestReadCache.get")(function* (key, lookup, scopes = []) {
76	if (!enabled) return yield* lookup;	117	if (!enabled) return yield* lookup;
77	const digest = yield* crypto
78	.digest("SHA-256", new TextEncoder().encode(key))
79	.pipe(Effect.option);
80	if (Option.isNone(digest)) return yield* lookup;
81	const read = yield* Effect.cached(lookup);	118	const read = yield* Effect.cached(lookup);
82	return yield* cache	119	return yield* Effect.gen(function* () {
83	.get(new Read({ key: Encoding.encodeHex(digest.value), lookup: read }))	120	const current = yield* Cache.get(revisions, undefined);
84	.pipe(	121	const now = clock.currentTimeMillisUnsafe();
85	Effect.map((result) => result.payload),	122	const revision = scopes
86	Effect.catchTags({	123	.map((scope) => {
87	PersistenceError: () => read,	124	const value = current[scope];
88	SchemaError: () => read,	125	return value !== undefined && value.expiresAt > now ? value.revision : "";
89	}),	126	})
90	Effect.uninterruptible,	127	.join(":");
91	lock.withPermits(1),	128	const request = new Read({ key: yield* digest(key), revision, lookup: read });
92	);	129	const stored = yield* cache.get(request);
		130	return (
		131	request.matchesRevision(stored.revision) ? stored : yield* Cache.get(refreshes, request)
		132	).payload;
		133	}).pipe(
		134	Effect.catchTags({
		135	PlatformError: () => read,
		136	KeyValueStoreError: () => read,
		137	PersistenceError: () => read,
		138	SchemaError: () => read,
		139	}),
		140	lock.withPermits(1),
		141	);
93	}),	142	}),
94	// Let existing reads finish before clearing, so they cannot repopulate stale entries.	143	invalidate: (scope) =>
95	invalidate: Cache.invalidateAll(cache.inMemory).pipe(	144	Effect.gen(function* () {
96	Effect.andThen(backing.clear),	145	const now = clock.currentTimeMillisUnsafe();
97	Effect.catch(() => {	146	const current = yield* Cache.get(revisions, undefined);
98	enabled = false;	147	const next = Object.fromEntries(
99	return Effect.logWarning("PR cache disabled after clearing failed");	148	Object.entries(current).filter(([, value]) => value.expiresAt > now),
100	}),	149	);
101	lock.withPermits(CONCURRENT_READS),	150	next[scope] = { revision: yield* crypto.randomUUIDv4, expiresAt: now + 60_000 };
102	),	151	const encoded = yield* Schema.encodeEffect(revisionCodec)(next);
		152	yield* backing.set("revisions", encoded);
		153	yield* Cache.set(revisions, undefined, next);
		154	}).pipe(
		155	Effect.catch(() => {
		156	enabled = false;
		157	return Effect.logWarning("PR cache disabled after clearing failed");
		158	}),
		159	Effect.uninterruptible,
		160	lock.withPermits(CONCURRENT_READS),
		161	),
103	});	162	});
104	});	163	});
105		164
...	@@ -108,7 +167,6 @@ export const layer = Layer.unwrap(	...	@@ -108,7 +167,6 @@ export const layer = Layer.unwrap(
108	const config = yield* ServerConfig;	167	const config = yield* ServerConfig;
109	const path = yield* Path.Path;	168	const path = yield* Path.Path;
110	return Layer.effect(PullRequestReadCache, make).pipe(	169	return Layer.effect(PullRequestReadCache, make).pipe(
111	Layer.provide(Persistence.layerKvs),
112	Layer.provide(	170	Layer.provide(
113	KeyValueStore.layerFileSystem(	171	KeyValueStore.layerFileSystem(
114	path.join(config.providerStatusCacheDir, "pull-requests"),	172	path.join(config.providerStatusCacheDir, "pull-requests"),

apps/server/src/pullRequest/PullRequestService.test.ts+227-98

 @@ -1,6 +1,5 @@
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import * as KeyValueStore from "effect/unstable/persistence/KeyValueStore";
-import * as Persistence from "effect/unstable/persistence/Persistence";
 import { assert, it } from "@effect/vitest";
 import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
 @@ -204,7 +203,6 @@ function makeService(input: {
         }),
         SourceControlRateLimit.layer,
         Layer.effect(PullRequestReadCache.PullRequestReadCache, PullRequestReadCache.make).pipe(
-          Layer.provide(Persistence.layerKvs),
           Layer.provide(KeyValueStore.layerMemory),
           Layer.provide(NodeServices.layer),
         ),
 @@ -3117,6 +3115,107 @@ it.effect("a listing narrowed to some projects is its own cache entry", () =>
   }),
 );
+it.effect("keeps unrelated PRs warm after a mutation, explicit refresh, and project turn", () =>
+  Effect.gen(function* () {
+    const calls: string[] = [];
+    const service = yield* makeService({
+      projects: [
+        project({ id: "p1", title: "web", workspaceRoot: "/a", repository: "acme/web" }),
+        project({ id: "p2", title: "docs", workspaceRoot: "/b", repository: "acme/docs" }),
+      ],
+      providers: [
+        fakeProvider("github", {
+          getChangeRequest: (input) =>
+            Effect.sync(() => {
+              calls.push(`${input.repository}/${input.number}`);
+              return { ...hostedChangeRequest("body"), number: input.number };
+            }),
+        }),
+      ],
+    });
+    const refs = [
+      { projectId: "p1" as ProjectId, repository: "acme/web", number: 1 },
+      { projectId: "p1" as ProjectId, repository: "acme/web", number: 2 },
+      { projectId: "p2" as ProjectId, repository: "acme/docs", number: 3 },
+    ];
+    const readAll = Effect.forEach(refs, (ref) => service.summary({ ...ref, allowStale: false }));
+    yield* readAll;
+    yield* service.invalidate({ reference: { ...refs[0]!, host: "github.com" } });
+    yield* readAll;
+    assert.deepStrictEqual(calls, ["acme/web/1", "acme/web/2", "acme/docs/3", "acme/web/1"]);
+    yield* service.comment({ ...refs[0]!, body: "hello" });
+    yield* readAll;
+    assert.deepStrictEqual(calls.slice(4), ["acme/web/1"]);
+    yield* service.refreshAfterTurn("p1" as ProjectId);
+    yield* readAll;
+    assert.deepStrictEqual(calls.slice(5), ["acme/web/1", "acme/web/2"]);
+  }),
+);
+it.effect(
+  "keeps matching PR numbers on different hosts separate and refreshes the serving project",
+  () =>
+    Effect.gen(function* () {
+      const hosts: string[] = [];
+      const service = yield* makeService({
+        projects: [
+          project({ id: "p1", title: "public", workspaceRoot: "/a", repository: "acme/web" }),
+          project({
+            id: "p2",
+            title: "enterprise",
+            workspaceRoot: "/b",
+            repository: "acme/web",
+            host: "enterprise.test",
+          }),
+        ],
+        providers: [
+          fakeProvider("github", {
+            getChangeRequest: (input) =>
+              Effect.sync(() => {
+                hosts.push(input.host);
+                return hostedChangeRequest("body");
+              }),
+          }),
+        ],
+      });
+      const own = { projectId: "p1" as ProjectId, repository: "acme/web", number: 1 };
+      const other = { ...own, host: "enterprise.test" };
+      const readBoth = Effect.all([service.summary(own), service.summary(other)]);
+      yield* readBoth;
+      yield* service.invalidate({ reference: { ...own, host: "github.com" } });
+      yield* readBoth;
+      assert.deepStrictEqual(hosts, ["github.com", "enterprise.test", "github.com"]);
+      yield* service.invalidate({ reference: own });
+      yield* readBoth;
+      assert.deepStrictEqual(hosts.slice(3), ["github.com"]);
+      yield* service.refreshAfterTurn("p2" as ProjectId);
+      yield* readBoth;
+      assert.deepStrictEqual(hosts.slice(4), ["enterprise.test"]);
+    }),
+);
+it.effect("does not revive old summaries when project epochs are evicted", () =>
+  Effect.gen(function* () {
+    let title = "old";
+    const service = yield* makeService({
+      projects: [project({ id: "p1", title: "web", workspaceRoot: "/a", repository: "acme/web" })],
+      providers: [
+        fakeProvider("github", {
+          getChangeRequest: () => Effect.succeed({ ...hostedChangeRequest("body"), title }),
+        }),
+      ],
+    });
+    const ref = { projectId: "p1" as ProjectId, repository: "acme/web", number: 1 };
+    assert.strictEqual((yield* service.summary(ref))?.title, "old");
+    title = "new";
+    yield* service.refreshAfterTurn(ref.projectId);
+    assert.strictEqual((yield* service.summary(ref))?.title, "new");
+    for (let index = 0; index < 2048; index++)
+      yield* service.refreshAfterTurn(`project-${index}` as ProjectId);
+    assert.strictEqual((yield* service.summary(ref))?.title, "new");
+  }),
+);
 it.effect("explicit and turn invalidations make the next listing ask the host again", () =>
   Effect.gen(function* () {
     let hostCalls = 0;
 @@ -3148,7 +3247,7 @@ it.effect("explicit and turn invalidations make the next listing ask the host ag
     yield* service.invalidate({ reference });
     yield* service.list({ state: "open" });
     assert.strictEqual(hostCalls, 2);
-    yield* service.refreshAfterTurn;
+    yield* service.refreshAfterTurn("p1" as ProjectId);
     const refresh = Option.getOrThrow(yield* Stream.runHead(service.subscribeRefreshes));
     yield* service.list({ state: "open" });
     assert.isAbove(refresh, 0);
 @@ -3551,7 +3650,7 @@ it.effect(
       yield* service.listStats({ refs: [ref(1), ref(2), ref(3)] });
       assert.deepStrictEqual(asked, [[1, 2], [3], [2], [1, 2, 3]]);
-      yield* service.refreshAfterTurn;
+      yield* service.refreshAfterTurn("p1" as ProjectId);
       yield* service.listStats({ refs: [ref(1)] });
       assert.deepStrictEqual(asked, [[1, 2], [3], [2], [1, 2, 3], [1]]);
 @@ -3768,9 +3867,9 @@ it.effect("shares linked summaries and reuses them for display without asking th
   }),
 );
-it.effect("keeps routed summaries and details separate when the GitHub account changes", () =>
+it.effect("keeps routed reads separate when the GitHub account changes", () =>
   Effect.gen(function* () {
-    for (const operation of ["summary", "detail"] as const) {
+    for (const operation of ["summary", "detail", "diff"] as const) {
       let failing = false;
       let calls = 0;
       const read = () =>
 @@ -3785,16 +3884,27 @@ it.effect("keeps routed summaries and details separate when the GitHub account c
           project({ id: "p1", title: "web", workspaceRoot: "/a", repository: "acme/web" }),
         ],
         providers: [
-          fakeProvider("github", { getChangeRequestSummary: read, getChangeRequest: read }),
+          fakeProvider("github", {
+            getChangeRequestSummary: read,
+            getChangeRequest: read,
+            getDiff: () =>
+              read().pipe(
+                Effect.as({ patch: "private patch", truncated: false, nextCursor: null }),
+              ),
+          }),
         ],
       });
+      const readOperation = (input: Parameters<typeof service.diff>[0]) =>
+        Effect.gen(function* () {
+          yield* service[operation](input);
+        });
       const reference = { projectId: "p1" as ProjectId, repository: "acme/web", number: 1 };
-      yield* service[operation]({ ...reference, expectedAccountId: "101" });
+      yield* readOperation({ ...reference, expectedAccountId: "101" });
       failing = true;
       for (const allowStale of [false, true]) {
         const error = yield* Effect.flip(
-          service[operation]({ ...reference, expectedAccountId: "202", allowStale }),
+          readOperation({ ...reference, expectedAccountId: "202", allowStale }),
         );
         assert.strictEqual(error._tag, "PullRequestOperationError");
       }
 @@ -3805,7 +3915,7 @@ it.effect("keeps routed summaries and details separate when the GitHub account c
 it.effect("isolates routed caches for two credentials belonging to the same account", () =>
   Effect.gen(function* () {
-    for (const operation of ["summary", "detail"] as const) {
+    for (const operation of ["summary", "detail", "diff"] as const) {
       let credential = "broad";
       let calls = 0;
       const read = () =>
 @@ -3831,9 +3941,17 @@ it.effect("isolates routed caches for two credentials belonging to the same acco
               ),
             getChangeRequest: read,
             getChangeRequestSummary: read,
+            getDiff: () =>
+              read().pipe(
+                Effect.as({ patch: "private patch", truncated: false, nextCursor: null }),
+              ),
           }),
         ],
       });
+      const readOperation = (input: Parameters<typeof service.diff>[0]) =>
+        Effect.gen(function* () {
+          yield* service[operation](input);
+        });
       const reference = {
         projectId: "p1" as ProjectId,
         repository: "acme/web",
 @@ -3841,14 +3959,11 @@ it.effect("isolates routed caches for two credentials belonging to the same acco
         host: "github.com",
         expectedAccountId: "101",
       };
-      yield* service.withRoutingCredential(reference, service[operation](reference));
+      yield* service.withRoutingCredential(reference, readOperation(reference));
       credential = "restricted";
       for (const allowStale of [false, true]) {
         const error = yield* Effect.flip(
-          service.withRoutingCredential(
+          service.withRoutingCredential(reference, readOperation({ ...reference, allowStale })),
-            reference,
-            service[operation]({ ...reference, allowStale }),
-          ),
         );
         assert.strictEqual(error._tag, "PullRequestOperationError");
       }
 @@ -4354,90 +4469,104 @@ it.effect('resolves an author filter of "me" to the viewer before narrowing a ho
   }),
 );
-it.effect("authorizes stack rebases independently of whether the selected layer is behind", () =>
+for (const crossHost of [false, true]) {
-  Effect.gen(function* () {
+  it.effect(
-    let taken = 0;
+    `authorizes stack rebases and refreshes sibling layers (cross-host: ${crossHost})`,
-    let summaryReads = 0;
+    () =>
-    let mutationFails = false;
+      Effect.gen(function* () {
-    let stackRebase = true;
+        let taken = 0;
-    let stackActions = true;
+        let summaryReads = 0;
-    const capabilities = {
+        let mutationFails = false;
-      diff: true,
+        let stackRebase = true;
-      comment: true,
+        let stackActions = true;
-      actions: ["update-branch"] as const,
+        const capabilities = {
-      mergeMethods: ["merge"] as const,
+          diff: true,
-      updateMethods: ["rebase"] as const,
+          comment: true,
-      get stackActions() {
+          actions: ["update-branch"] as const,
-        return stackActions;
+          mergeMethods: ["merge"] as const,
-      },
+          updateMethods: ["rebase"] as const,
-      search: true,
+          get stackActions() {
-      reactions: true,
+            return stackActions;
-      review: FULL_REVIEW,
+          },
-      reviewers: FULL_REVIEWERS,
+          search: true,
-    };
+          reactions: true,
-    const service = yield* makeService({
+          review: FULL_REVIEW,
-      projects: [project({ id: "p1", title: "web", workspaceRoot: "/a", repository: "acme/web" })],
+          reviewers: FULL_REVIEWERS,
-      providers: [
+        };
-        fakeProvider("github", {
+        const service = yield* makeService({
-          capabilities,
+          projects: [
-          getViewerPermissions: () =>
+            project({ id: "p1", title: "web", workspaceRoot: "/a", repository: "acme/web" }),
-            Effect.succeed({
+            project({
-              actions: [],
+              id: "p2",
-              stackRebase,
+              title: "enterprise",
-              comment: true,
+              workspaceRoot: "/b",
-              resolve: false,
+              repository: "acme/web",
-              verdicts: [],
+              host: "enterprise.test",
-              requestReviewers: false,
-            }),
-          getChangeRequestSummary: () =>
-            Effect.sync(() => {
-              summaryReads++;
-              return changeRequest(8, "2026-07-01T00:00:00Z");
             }),
-          runAction: () =>
+          ],
-            Effect.gen(function* () {
+          providers: [
-              taken++;
+            fakeProvider("github", {
-              if (mutationFails) return yield* requestFailed;
+              capabilities,
+              getViewerPermissions: () =>
+                Effect.succeed({
+                  actions: [],
+                  stackRebase,
+                  comment: true,
+                  resolve: false,
+                  verdicts: [],
+                  requestReviewers: false,
+                }),
+              getChangeRequestSummary: () =>
+                Effect.sync(() => {
+                  summaryReads++;
+                  return changeRequest(8, "2026-07-01T00:00:00Z");
+                }),
+              runAction: () =>
+                Effect.gen(function* () {
+                  taken++;
+                  if (mutationFails) return yield* requestFailed;
+                }),
             }),
-        }),
+          ],
-      ],
+        });
-    });
+        const input = {
-    const input = {
+          ...(crossHost ? { host: "enterprise.test" } : {}),
-      projectId: "p1" as ProjectId,
+          projectId: "p1" as ProjectId,
-      repository: "acme/web",
+          repository: "acme/web",
-      number: 3,
+          number: 3,
-      action: "update-branch" as const,
+          action: "update-branch" as const,
-      updateMethod: "rebase" as const,
+          updateMethod: "rebase" as const,
-      stackNumber: 50,
+          stackNumber: 50,
-      expectedStackHeads: [{ number: 3, headSha: "ccc" }],
+          expectedStackHeads: [{ number: 3, headSha: "ccc" }],
-    };
+        };
-    yield* service.runAction(input);
+        yield* service.runAction(input);
-    assert.strictEqual(taken, 1);
+        assert.strictEqual(taken, 1);
-    const unrelated = { ...input, number: 8 };
+        const unrelated = { ...input, number: 8 };
-    yield* service.summary(unrelated);
+        yield* service.summary(unrelated);
-    assert.strictEqual(summaryReads, 1);
+        assert.strictEqual(summaryReads, 1);
-    stackRebase = false;
+        stackRebase = false;
-    assert.strictEqual(
+        assert.strictEqual(
-      (yield* Effect.flip(service.runAction(input)))._tag,
+          (yield* Effect.flip(service.runAction(input)))._tag,
-      "PullRequestOperationError",
+          "PullRequestOperationError",
-    );
+        );
-    stackRebase = true;
+        stackRebase = true;
-    stackActions = false;
+        stackActions = false;
-    assert.strictEqual(
+        assert.strictEqual(
-      (yield* Effect.flip(service.runAction(input)))._tag,
+          (yield* Effect.flip(service.runAction(input)))._tag,
-      "PullRequestOperationError",
+          "PullRequestOperationError",
-    );
+        );
-    assert.strictEqual(taken, 1);
+        assert.strictEqual(taken, 1);
-    yield* service.summary(unrelated);
+        yield* service.summary(unrelated);
-    assert.strictEqual(summaryReads, 1);
+        assert.strictEqual(summaryReads, 1);
-    stackActions = true;
+        stackActions = true;
-    mutationFails = true;
+        mutationFails = true;
-    yield* Effect.flip(service.runAction(input));
+        yield* Effect.flip(service.runAction(input));
-    assert.strictEqual(taken, 2);
+        assert.strictEqual(taken, 2);
-    yield* service.summary(unrelated);
+        yield* service.summary(unrelated);
-    assert.strictEqual(summaryReads, 2);
+        assert.strictEqual(summaryReads, 2);
-  }),
+      }),
-);
+  );
+}
 it.effect("refuses a way of updating a branch that the host or the viewer does not allow", () =>
   Effect.gen(function* () {
 @@ -4773,7 +4902,7 @@ it.effect("forgets the cached detail after a rewrite or terminal turn", () =>
     yield* service.detail(reference);
     assert.strictEqual(coreCalls, 2);
-    yield* service.refreshAfterTurn;
+    yield* service.refreshAfterTurn("p1" as ProjectId);
     yield* service.detail(reference);
     assert.strictEqual(coreCalls, 3);
   }),

apps/server/src/pullRequest/PullRequestService.ts+99-60

 @@ -24,6 +24,7 @@ import {
   pullRequestProviderRequirement,
   resolvePullRequestAuthorFilter,
   type OrchestrationProjectShell,
+  type ProjectId,
   type PullRequestAction,
   type PullRequestActionInput,
   type PullRequestActivity,
 @@ -67,6 +68,7 @@ import {
 } from "@t3tools/contracts";
 import { detectSourceControlProviderFromRemoteUrl } from "@t3tools/shared/sourceControl";
+import { AllowGitHubReserve } from "../sourceControl/GitHubCli.ts";
 import * as ProjectionSnapshotQuery from "../orchestration/Services/ProjectionSnapshotQuery.ts";
 import * as SourceControlProviderRegistry from "../sourceControl/SourceControlProviderRegistry.ts";
 import * as SourceControlRateLimit from "../sourceControl/SourceControlRateLimit.ts";
 @@ -186,7 +188,7 @@ export class PullRequestService extends Context.Service<
       Scope.Scope
     >;
     readonly subscribeRefreshes: Stream.Stream<number>;
-    readonly refreshAfterTurn: Effect.Effect<void>;
+    readonly refreshAfterTurn: (projectId: ProjectId) => Effect.Effect<void>;
     readonly detail: (input: PullRequestRef) => Effect.Effect<PullRequestDetail, PullRequestError>;
     readonly activity: (
       input: PullRequestRef,
 @@ -464,6 +466,7 @@ function withRateLimitBackoff(
       ),
       Effect.flatMap((lease) =>
         effect.pipe(
+          Effect.provideService(AllowGitHubReserve, allowPaused),
           Effect.tap(() => limits.recordSuccess({ ...key, lease })),
           Effect.tapError((error) =>
             error.reason === "rate-limited"
 @@ -794,6 +797,18 @@ export const make = Effect.gen(function* () {
       }),
     );
+  const canonicalRef = Effect.fn("PullRequestService.canonicalRef")(function* <
+    I extends PullRequestRef,
+  >(input: I) {
+    const project = yield* requireProject(input);
+    return {
+      ...input,
+      projectId: project.project.id,
+      host: project.host,
+      repository: project.repository,
+    };
+  });
   /**
    * What the signed-in account may do with this change request, asked of the host itself. Every
    * write goes through it: the page hides what a viewer may not do, and a request that arrived
 @@ -1783,7 +1798,11 @@ export const make = Effect.gen(function* () {
               .pipe(
                 // Once the authorized provider action starts, a failure may leave partial
                 // remote updates. Validation and permission failures above changed nothing.
-                Effect.ensuring(input.stackNumber === undefined ? Effect.void : refreshAfterTurn),
+                Effect.ensuring(
+                  input.stackNumber === undefined
+                    ? Effect.void
+                    : refreshAfterTurn(project.project.id),
+                ),
                 Effect.mapError(toPullRequestError("runAction")),
                 Effect.as(
                   project.api.kind === "azure-devops"
 @@ -2416,13 +2435,22 @@ export const make = Effect.gen(function* () {
   // scope re-entering `refEpochs` after eviction can never mint a key an old entry still has.
   let epochCounter = 0;
   let listingsEpoch = 0;
-  let turnRefreshEpoch = 0;
   const refEpochs = new Map<string, number>();
+  const projectEpochs = new Map<ProjectId, number>();
+  let projectEpochFloor = 0;
   const REF_EPOCH_CAPACITY = 2_048;
   const refScope = (ref: PullRequestRef) =>
-    `${ref.projectId} ${ref.host?.toLowerCase() ?? ""} ${ref.repository.toLowerCase()} ${ref.number}`;
+    JSON.stringify([
+      ref.projectId,
+      ref.host?.toLowerCase() ?? "",
+      ref.repository.toLowerCase(),
+      ref.number,
+    ]);
   const refEpoch = (ref: PullRequestRef) =>
-    Math.max(turnRefreshEpoch, refEpochs.get(refScope(ref)) ?? 0);
+    Math.max(
+      projectEpochs.get(ref.projectId) ?? projectEpochFloor,
+      refEpochs.get(refScope(ref)) ?? 0,
+    );
   // Keys carry the reference back out of the cache loader, so the slot layout is shared with
   // `refOfCacheKey` rather than read positionally at every loader.
   const refCacheKey = (ref: CredentialRef) =>
 @@ -2524,7 +2552,10 @@ export const make = Effect.gen(function* () {
         ),
       ),
     );
-    const payload = yield* readCache.get(key, encodedRead);
+    const payload = yield* readCache.get(key, encodedRead, [
+      `project:${input.projectId}`,
+      refScope(input),
+    ]);
     const decoded = yield* Schema.decodeUnknownEffect(codec)(payload).pipe(Effect.option);
     return Option.isSome(decoded) ? decoded.value : yield* lookup;
   });
 @@ -2723,20 +2754,9 @@ export const make = Effect.gen(function* () {
   const diffCache = yield* Cache.makeWith(
     (key: string) => {
-      const [, projectId, host, repository, number, cursor, commit] = JSON.parse(key) as [
+      const [reference, cursor, commit] = JSON.parse(key) as [string, string | null, string | null];
-        number,
-        string,
-        string | null,
-        string,
-        number,
-        string | null,
-        string | null,
-      ];
       return diffUncached({
-        projectId,
+        ...refOfCacheKey(reference),
-        ...(host === null ? {} : { host }),
-        repository,
-        number,
         ...(cursor === null ? {} : { cursor }),
         ...(commit === null ? {} : { commit }),
       } as PullRequestDiffInput);
 @@ -2745,18 +2765,14 @@ export const make = Effect.gen(function* () {
       capacity: DIFF_CACHE_CAPACITY,
       timeToLive: (exit, key) => {
         if (!Exit.isSuccess(exit)) return Duration.zero;
-        const commit = (JSON.parse(key) as ReadonlyArray<unknown>)[6];
+        const commit = (JSON.parse(key) as ReadonlyArray<unknown>)[2];
         return commit === null ? DIFF_CACHE_TTL : COMMIT_DIFF_CACHE_TTL;
       },
     },
   );
   const diff: PullRequestService["Service"]["diff"] = (input) => {
     const key = JSON.stringify([
-      refEpoch(input),
+      refCacheKey(input),
-      input.projectId,
-      input.host?.toLowerCase() ?? null,
-      input.repository.toLowerCase(),
-      input.number,
       input.cursor ?? null,
       input.commit ?? null,
       input.commit === undefined
 @@ -2826,7 +2842,14 @@ export const make = Effect.gen(function* () {
   const invalidate: PullRequestService["Service"]["invalidate"] = (input) => {
     const reference = input.reference;
     if (reference !== undefined) {
-      return readCache.invalidate.pipe(Effect.andThen(Effect.sync(() => bumpRefEpoch(reference))));
+      return canonicalRef(reference).pipe(
+        Effect.flatMap((ref) =>
+          readCache
+            .invalidate(refScope(ref))
+            .pipe(Effect.andThen(Effect.sync(() => bumpRefEpoch(ref)))),
+        ),
+        Effect.ignore,
+      );
     }
     return Effect.sync(() => {
       listingsEpoch = ++epochCounter;
 @@ -2834,12 +2857,22 @@ export const make = Effect.gen(function* () {
     }).pipe(Effect.andThen(Cache.invalidateAll(viewerFlights)));
   };
-  const refreshAfterTurn: PullRequestService["Service"]["refreshAfterTurn"] = Effect.suspend(() => {
+  const refreshAfterTurn: PullRequestService["Service"]["refreshAfterTurn"] = (projectId) =>
-    turnRefreshEpoch = listingsEpoch = ++epochCounter;
+    Effect.suspend(() => {
-    return readCache.invalidate.pipe(
+      listingsEpoch = ++epochCounter;
-      Effect.andThen(SubscriptionRef.set(pullRequestRefreshes, turnRefreshEpoch)),
+      projectEpochs.delete(projectId);
-    );
+      if (projectEpochs.size >= REF_EPOCH_CAPACITY) {
-  });
+        const oldest = projectEpochs.keys().next().value;
+        if (oldest !== undefined) {
+          projectEpochFloor = projectEpochs.get(oldest)!;
+          projectEpochs.delete(oldest);
+        }
+      }
+      projectEpochs.set(projectId, listingsEpoch);
+      return readCache
+        .invalidate(`project:${projectId}`)
+        .pipe(Effect.andThen(SubscriptionRef.set(pullRequestRefreshes, listingsEpoch)));
+    });
   // A mutation's own client re-reads right after it, and every other client's next read must
   // see the action too — so a write forgets the change request it touched and the listings its
 @@ -2849,22 +2882,28 @@ export const make = Effect.gen(function* () {
       method: (input: I) => Effect.Effect<void, PullRequestError>,
     ): ((input: I) => Effect.Effect<void, PullRequestError>) =>
     (input) =>
-      readCache.invalidate.pipe(
+      Effect.gen(function* () {
-        Effect.andThen(method(input)),
+        const ref = yield* canonicalRef(input);
-        Effect.ensuring(readCache.invalidate),
+        yield* readCache.invalidate(refScope(ref)).pipe(
-        Effect.tap(() =>
+          Effect.andThen(method(input)),
-          Effect.sync(() => {
+          Effect.ensuring(readCache.invalidate(refScope(ref))),
-            bumpRefEpoch(input);
+          Effect.tap(() =>
-            listingsEpoch = ++epochCounter;
+            Effect.sync(() => {
-          }),
+              bumpRefEpoch(ref);
-        ),
+              listingsEpoch = ++epochCounter;
-      );
+            }),
+          ),
+        );
+      });
   const runActionAndInvalidate: PullRequestService["Service"]["runAction"] = Effect.fn(
     "PullRequestService.runActionAndInvalidate",
   )(function* (input) {
-    yield* readCache.invalidate;
+    const ref = yield* canonicalRef(input);
-    const repository = yield* runAction(input).pipe(Effect.ensuring(readCache.invalidate));
+    yield* readCache.invalidate(refScope(ref));
-    bumpRefEpoch({ ...input, repository });
+    const repository = yield* runAction(input).pipe(
+      Effect.ensuring(readCache.invalidate(refScope(ref))),
+    );
+    bumpRefEpoch({ ...ref, repository });
     listingsEpoch = ++epochCounter;
     if (input.action === "merge") {
       // A successful merge action can merely enqueue the PR or enable auto-merge.
 @@ -2890,26 +2929,26 @@ export const make = Effect.gen(function* () {
       read: (input: I, ...args: Args) => Effect.Effect<A, E>,
     ) =>
     (input: I, ...args: Args) =>
-      routingCredential.pipe(
+      Effect.gen(function* () {
-        Effect.flatMap((credential) =>
+        const ref = yield* canonicalRef(input);
-          read(
+        const credential = yield* routingCredential;
-            credential === null
+        return yield* read(
-              ? input
+          credential === null
-              : {
+            ? ref
-                  ...input,
+            : { ...ref, [credentialNamespace]: credential.credentialFingerprint },
-                  [credentialNamespace]: credential.credentialFingerprint,
+          ...args,
-                },
+        );
-            ...args,
+      });
-          ),
-        ),
-      );
   return PullRequestService.of({
     routing,
     routingIdentity,
     withRoutingCredential,
     list,
-    listStats,
+    listStats: (input) =>
+      Effect.forEach(input.refs, (ref) => canonicalRef(ref).pipe(Effect.option)).pipe(
+        Effect.flatMap((refs) => listStats({ ...input, refs: refs.flatMap(Option.toArray) })),
+      ),
     summary: credentialCached(summary),
     stack: credentialCached(stack),
     subscribeMerges: PubSub.subscribe(mergedPullRequests).pipe(
 @@ -2922,7 +2961,7 @@ export const make = Effect.gen(function* () {
     detail: credentialCached(detail),
     activity: credentialCached(activity),
     threadComments,
-    diff,
+    diff: credentialCached(diff),
     diffFileContents,
     runAction: runActionAndInvalidate,
     update: invalidatedByMutation(update),

apps/server/src/sourceControl/GitHubCli.test.ts+112-1

...	@@ -1,5 +1,8 @@	...	@@ -1,5 +1,8 @@
1	import { assert, it, afterEach, describe, expect, vi } from "@effect/vitest";	1	import { assert, it, afterEach, describe, expect, vi } from "@effect/vitest";
2	import * as Cache from "effect/Cache";	2	import * as Cache from "effect/Cache";
		3	import * as TestClock from "effect/testing/TestClock";
		4	import * as Clock from "effect/Clock";
		5	import * as DateTime from "effect/DateTime";
3	import * as Effect from "effect/Effect";	6	import * as Effect from "effect/Effect";
4	import * as Layer from "effect/Layer";	7	import * as Layer from "effect/Layer";
5	import * as PlatformError from "effect/PlatformError";	8	import * as PlatformError from "effect/PlatformError";
...	@@ -10,6 +13,8 @@ import { VcsProcessExitError, VcsProcessSpawnError } from "@t3tools/contracts";	...	@@ -10,6 +13,8 @@ import { VcsProcessExitError, VcsProcessSpawnError } from "@t3tools/contracts";
10		13
11	import * as VcsProcess from "../vcs/VcsProcess.ts";	14	import * as VcsProcess from "../vcs/VcsProcess.ts";
12	import * as GitHubCli from "./GitHubCli.ts";	15	import * as GitHubCli from "./GitHubCli.ts";
		16	import * as GitHubGraphQlBudget from "./githubGraphQlBudget.ts";
		17	import * as SourceControlRateLimit from "./SourceControlRateLimit.ts";
13		18
14	const encodeGitHubCliError = Schema.encodeEffect(Schema.fromJsonString(GitHubCli.GitHubCliError));	19	const encodeGitHubCliError = Schema.encodeEffect(Schema.fromJsonString(GitHubCli.GitHubCliError));
15		20
...	@@ -21,12 +26,18 @@ const processOutput = (stdout: string): VcsProcess.VcsProcessOutput => ({	...	@@ -21,12 +26,18 @@ const processOutput = (stdout: string): VcsProcess.VcsProcessOutput => ({
21	stderrTruncated: false,	26	stderrTruncated: false,
22	});	27	});
23		28
		29	const quotaOutput = (remaining = 5000, resetAt = "2099-01-01T00:00:00Z") =>
		30	processOutput(
		31	JSON.stringify({ data: { rateLimit: { cost: 1, limit: 5000, remaining, resetAt } } }),
		32	);
		33
24	const mockRun = vi.fn<VcsProcess.VcsProcess["Service"]["run"]>();	34	const mockRun = vi.fn<VcsProcess.VcsProcess["Service"]["run"]>();
25		35
26	const layer = GitHubCli.layer.pipe(	36	const layer = GitHubCli.layer.pipe(
27	Layer.provide(	37	Layer.provide(
28	Layer.mock(VcsProcess.VcsProcess)({	38	Layer.mock(VcsProcess.VcsProcess)({
29	run: mockRun,	39	run: (input) =>
		40	input.args[1] === "rate_limit" ? Effect.succeed(quotaOutput()) : mockRun(input),
30	}),	41	}),
31	),	42	),
32	);	43	);
...	@@ -35,7 +46,98 @@ afterEach(() => {	...	@@ -35,7 +46,98 @@ afterEach(() => {
35	mockRun.mockReset();	46	mockRun.mockReset();
36	});	47	});
37		48
		49	it.effect("shares quota checks, preserves the reserve, and resumes after reset", () =>
		50	Effect.gen(function* () {
		51	let probes = 0;
		52	const commands: string[] = [];
		53	let remaining = 501;
		54	let resetAt = DateTime.formatIso(
		55	DateTime.makeUnsafe((yield* Clock.currentTimeMillis) + 60_000),
		56	);
		57	const gh = yield* GitHubCli.make.pipe(
		58	Effect.provideService(VcsProcess.VcsProcess, {
		59	run: (input) =>
		60	Effect.sync(() => {
		61	if (input.args[1] === "rate_limit") {
		62	probes++;
		63	assert.strictEqual(input.args[3], "enterprise.test");
		64	return quotaOutput(remaining, resetAt);
		65	}
		66	commands.push(input.args.slice(0, 2).join(" "));
		67	return processOutput("[]");
		68	}),
		69	}),
		70	);
		71	const read = (command: string) =>
		72	gh.execute({
		73	cwd: "/repo",
		74	args:
		75	command === "repo"
		76	? ["repo", "view", "enterprise.test/acme/web", "--json", "name"]
		77	: ["pr", command, "--repo=enterprise.test/acme/web", "--json", "number"],
		78	});
		79	yield* read("list");
		80	const failure = yield* read("view").pipe(Effect.flip);
		81	assert.strictEqual(failure._tag, "GitHubCliRateLimitError");
		82	assert.strictEqual(probes, 1);
		83	assert.deepStrictEqual(commands, ["pr list"]);
		84	yield* read("view").pipe(Effect.provideService(GitHubCli.AllowGitHubReserve, true));
		85	yield* gh.execute({ cwd: "/repo", args: ["pr", "merge", "1"] });
		86	assert.deepStrictEqual(commands, ["pr list", "pr view", "pr merge"]);
		87	remaining = 0;
		88	yield* TestClock.adjust("30 seconds");
		89	yield* read("repo").pipe(Effect.flip);
		90	assert.strictEqual(probes, 2);
		91	yield* TestClock.adjust("30 seconds");
		92	remaining = 5000;
		93	resetAt = DateTime.formatIso(DateTime.makeUnsafe((yield* Clock.currentTimeMillis) + 60_000));
		94	yield* Effect.all([read("list"), read("repo")], { concurrency: 2 });
		95	assert.strictEqual(probes, 3);
		96	assert.deepStrictEqual(commands.slice(3).toSorted(), ["pr list", "repo view"]);
		97	}).pipe(Effect.provide(Layer.merge(GitHubGraphQlBudget.layer, SourceControlRateLimit.layer))),
		98	);
		99
38	describe("GitHubCli.layer", () => {	100	describe("GitHubCli.layer", () => {
		101	it.effect("shares the registry budget with CLI reads through nested layer providers", () =>
		102	Effect.gen(function* () {
		103	const budget = yield* GitHubGraphQlBudget.GitHubGraphQlBudget;
		104	const gh = yield* GitHubCli.GitHubCli;
		105	yield* budget.observe("github.com", quotaOutput(0).stdout);
		106	const error = yield* gh.execute({ cwd: "/repo", args: ["pr", "list"] }).pipe(Effect.flip);
		107	assert.strictEqual(error._tag, "GitHubCliRateLimitError");
		108	expect(mockRun).not.toHaveBeenCalled();
		109	}).pipe(Effect.provide(layer.pipe(Layer.provide(GitHubGraphQlBudget.layer)))),
		110	);
		111
		112	it.effect("keeps quota snapshots separate for verified credentials on the same host", () =>
		113	Effect.gen(function* () {
		114	let reads = 0;
		115	const gh = yield* GitHubCli.make.pipe(
		116	Effect.provideService(VcsProcess.VcsProcess, {
		117	run: (input) =>
		118	Effect.sync(() => {
		119	if (input.args[1] === "rate_limit")
		120	return quotaOutput(input.env?.GH_TOKEN === "empty" ? 0 : 5000);
		121	reads++;
		122	return processOutput("[]");
		123	}),
		124	}),
		125	);
		126	const read = (token: string) =>
		127	gh.execute({ cwd: "/repo", args: ["pr", "list", "--repo", "github.com/acme/web"] }).pipe(
		128	Effect.provideService(GitHubCli.PinnedGitHubCredential, {
		129	host: "github.com",
		130	token: Redacted.make(token),
		131	credentialFingerprint: token,
		132	}),
		133	);
		134	yield* read("empty").pipe(Effect.flip);
		135	yield* read("healthy");
		136	yield* read("empty").pipe(Effect.flip);
		137	assert.strictEqual(reads, 1);
		138	}).pipe(Effect.provide(Layer.merge(GitHubGraphQlBudget.layer, SourceControlRateLimit.layer))),
		139	);
		140
39	it.effect("pins concurrent cached commands to their own verified credentials", () =>	141	it.effect("pins concurrent cached commands to their own verified credentials", () =>
40	Effect.gen(function* () {	142	Effect.gen(function* () {
41	mockRun.mockImplementation((input) =>	143	mockRun.mockImplementation((input) =>
...	@@ -523,6 +625,15 @@ describe("GitHubCli.layer", () => {	...	@@ -523,6 +625,15 @@ describe("GitHubCli.layer", () => {
523	assert.include(error.detail, "gh api rate_limit");	625	assert.include(error.detail, "gh api rate_limit");
524	assert.strictEqual(error.cause, cause);	626	assert.strictEqual(error.cause, cause);
525	assert.notInclude(error.message, "user ID");	627	assert.notInclude(error.message, "user ID");
		628	const paused = yield* gh
		629	.execute({ cwd: "/other-repo", args: ["pr", "list"] })
		630	.pipe(Effect.flip);
		631	assert.strictEqual(paused._tag, "GitHubCliRateLimitError");
		632	expect(mockRun).toHaveBeenCalledTimes(1);
		633	yield* TestClock.adjust("30 seconds");
		634	mockRun.mockReturnValueOnce(Effect.succeed(processOutput("[]")));
		635	yield* gh.execute({ cwd: "/other-repo", args: ["pr", "list"] });
		636	expect(mockRun).toHaveBeenCalledTimes(2);
526	}).pipe(Effect.provide(layer)),	637	}).pipe(Effect.provide(layer)),
527	);	638	);
528	});	639	});

apps/server/src/sourceControl/GitHubCli.ts+115-4

...	@@ -1,3 +1,6 @@	...	@@ -1,3 +1,6 @@
		1	import * as Cache from "effect/Cache";
		2	import * as Duration from "effect/Duration";
		3	import * as Exit from "effect/Exit";
1	import * as Context from "effect/Context";	4	import * as Context from "effect/Context";
2	import * as DateTime from "effect/DateTime";	5	import * as DateTime from "effect/DateTime";
3	import * as Effect from "effect/Effect";	6	import * as Effect from "effect/Effect";
...	@@ -15,6 +18,8 @@ import {	...	@@ -15,6 +18,8 @@ import {
15	} from "@t3tools/contracts";	18	} from "@t3tools/contracts";
16		19
17	import * as VcsProcess from "../vcs/VcsProcess.ts";	20	import * as VcsProcess from "../vcs/VcsProcess.ts";
		21	import * as GitHubGraphQlBudget from "./githubGraphQlBudget.ts";
		22	import * as SourceControlRateLimit from "./SourceControlRateLimit.ts";
18	import {	23	import {
19	decodeGitHubPullRequestJson,	24	decodeGitHubPullRequestJson,
20	decodeGitHubPullRequestListJson,	25	decodeGitHubPullRequestListJson,
...	@@ -30,7 +35,12 @@ export const PinnedGitHubCredential = Context.Reference<{	...	@@ -30,7 +35,12 @@ export const PinnedGitHubCredential = Context.Reference<{
30	readonly credentialFingerprint: string;	35	readonly credentialFingerprint: string;
31	} \| null>("t3/sourceControl/PinnedGitHubCredential", { defaultValue: () => null });	36	} \| null>("t3/sourceControl/PinnedGitHubCredential", { defaultValue: () => null });
32		37
33	function targetsVerifiedHost(args: ReadonlyArray<string>, host: string): boolean {	38	export const AllowGitHubReserve = Context.Reference<boolean>(
		39	"t3/sourceControl/AllowGitHubReserve",
		40	{ defaultValue: () => false },
		41	);
		42
		43	function commandHosts(args: ReadonlyArray<string>): Array<string \| null> {
34	const hosts: Array<string \| null> = [];	44	const hosts: Array<string \| null> = [];
35	const repositoryHost = (repository: string \| undefined) => {	45	const repositoryHost = (repository: string \| undefined) => {
36	if (repository === undefined) return null;	46	if (repository === undefined) return null;
...	@@ -54,6 +64,11 @@ function targetsVerifiedHost(args: ReadonlyArray<string>, host: string): boolean	...	@@ -54,6 +64,11 @@ function targetsVerifiedHost(args: ReadonlyArray<string>, host: string): boolean
54	else if (arg.startsWith("-R")) hosts.push(repositoryHost(arg.slice(2)));	64	else if (arg.startsWith("-R")) hosts.push(repositoryHost(arg.slice(2)));
55	else if (/^https?:\/\//i.test(arg)) hosts.push(repositoryHost(arg));	65	else if (/^https?:\/\//i.test(arg)) hosts.push(repositoryHost(arg));
56	}	66	}
		67	return hosts;
		68	}
		69
		70	function targetsVerifiedHost(args: ReadonlyArray<string>, host: string): boolean {
		71	const hosts = commandHosts(args);
57	return hosts.length > 0 && hosts.every((target) => target === host);	72	return hosts.length > 0 && hosts.every((target) => target === host);
58	}	73	}
59		74
...	@@ -91,7 +106,7 @@ export class GitHubCliAuthenticationError extends Schema.TaggedError<GitHubCliAu	...	@@ -91,7 +106,7 @@ export class GitHubCliAuthenticationError extends Schema.TaggedError<GitHubCliAu
91		106
92	export class GitHubCliRateLimitError extends Schema.TaggedError<GitHubCliRateLimitError>()(	107	export class GitHubCliRateLimitError extends Schema.TaggedError<GitHubCliRateLimitError>()(
93	"GitHubCliRateLimitError",	108	"GitHubCliRateLimitError",
94	gitHubCliFailureFields,	109	{ ...gitHubCliFailureFields, retryAt: Schema.optionalKey(Schema.Finite) },
95	) {	110	) {
96	get detail(): string {	111	get detail(): string {
97	return "GitHub API rate limit exceeded. Run `gh api rate_limit` to inspect the quota and reset time.";	112	return "GitHub API rate limit exceeded. Run `gh api rate_limit` to inspect the quota and reset time.";
...	@@ -274,17 +289,21 @@ export class GitHubCli extends Context.Service<	...	@@ -274,17 +289,21 @@ export class GitHubCli extends Context.Service<
274	readonly stdin?: string;	289	readonly stdin?: string;
275	readonly env?: NodeJS.ProcessEnv;	290	readonly env?: NodeJS.ProcessEnv;
276	readonly maxOutputBytes?: number;	291	readonly maxOutputBytes?: number;
		292	readonly rateLimitHost?: string;
		293	readonly allowReserve?: boolean;
277	}) => Effect.Effect<VcsProcess.VcsProcessOutput, GitHubCliError>;	294	}) => Effect.Effect<VcsProcess.VcsProcessOutput, GitHubCliError>;
278		295
279	readonly listOpenPullRequests: (input: {	296	readonly listOpenPullRequests: (input: {
280	readonly cwd: string;	297	readonly cwd: string;
281	readonly headSelector: string;	298	readonly headSelector: string;
282	readonly limit?: number;	299	readonly limit?: number;
		300	readonly rateLimitHost?: string;
283	}) => Effect.Effect<ReadonlyArray<GitHubPullRequestSummary>, GitHubCliError>;	301	}) => Effect.Effect<ReadonlyArray<GitHubPullRequestSummary>, GitHubCliError>;
284		302
285	readonly getPullRequest: (input: {	303	readonly getPullRequest: (input: {
286	readonly cwd: string;	304	readonly cwd: string;
287	readonly reference: string;	305	readonly reference: string;
		306	readonly rateLimitHost?: string;
288	}) => Effect.Effect<GitHubPullRequestSummary, GitHubCliError>;	307	}) => Effect.Effect<GitHubPullRequestSummary, GitHubCliError>;
289		308
290	readonly getRepositoryCloneUrls: (input: {	309	readonly getRepositoryCloneUrls: (input: {
...	@@ -308,6 +327,7 @@ export class GitHubCli extends Context.Service<	...	@@ -308,6 +327,7 @@ export class GitHubCli extends Context.Service<
308		327
309	readonly getDefaultBranch: (input: {	328	readonly getDefaultBranch: (input: {
310	readonly cwd: string;	329	readonly cwd: string;
		330	readonly rateLimitHost?: string;
311	}) => Effect.Effect<string \| null, GitHubCliError>;	331	}) => Effect.Effect<string \| null, GitHubCliError>;
312		332
313	readonly checkoutPullRequest: (input: {	333	readonly checkoutPullRequest: (input: {
...	@@ -377,8 +397,10 @@ function deriveRepositoryCloneUrlsFromCreateOutput(	...	@@ -377,8 +397,10 @@ function deriveRepositoryCloneUrlsFromCreateOutput(
377	/** @public Service construction is part of the canonical Effect module API. */	397	/** @public Service construction is part of the canonical Effect module API. */
378	export const make = Effect.gen(function* () {	398	export const make = Effect.gen(function* () {
379	const process = yield* VcsProcess.VcsProcess;	399	const process = yield* VcsProcess.VcsProcess;
		400	const budget = yield* GitHubGraphQlBudget.GitHubGraphQlBudget;
		401	const limits = yield* SourceControlRateLimit.SourceControlRateLimit;
380		402
381	const execute: GitHubCli["Service"]["execute"] = Effect.fn("GitHubCli.execute")(	403	const executeRaw: GitHubCli["Service"]["execute"] = Effect.fn("GitHubCli.executeRaw")(
382	function* (input) {	404	function* (input) {
383	const credential = yield* PinnedGitHubCredential;	405	const credential = yield* PinnedGitHubCredential;
384	if (credential !== null && !targetsVerifiedHost(input.args, credential.host)) {	406	if (credential !== null && !targetsVerifiedHost(input.args, credential.host)) {
...	@@ -416,11 +438,94 @@ export const make = Effect.gen(function* () {	...	@@ -416,11 +438,94 @@ export const make = Effect.gen(function* () {
416	},	438	},
417	);	439	);
418		440
		441	const quota = yield* Cache.makeWith(
		442	(key: string) => {
		443	const host = key.split("\0")[0]!;
		444	return executeRaw({
		445	cwd: globalThis.process.cwd(),
		446	args: [
		447	"api",
		448	"rate_limit",
		449	"--hostname",
		450	host,
		451	"--jq",
		452	".resources.graphql \| {data:{rateLimit:{cost:1,limit:.limit,remaining:.remaining,resetAt:(.reset\|todateiso8601)}}}",
		453	],
		454	}).pipe(
		455	Effect.tap((result) => budget.observe(host, result.stdout)),
		456	Effect.asVoid,
		457	);
		458	},
		459	{
		460	capacity: 32,
		461	timeToLive: (exit) => (Exit.isSuccess(exit) ? Duration.seconds(30) : Duration.zero),
		462	},
		463	);
		464	const execute: GitHubCli["Service"]["execute"] = Effect.fn("GitHubCli.execute")(
		465	function* (input) {
		466	const [command, action] = input.args;
		467	if (
		468	!(
		469	(command === "pr" && (action === "list" \|\| action === "view")) \|\|
		470	(command === "repo" && action === "view")
		471	)
		472	)
		473	return yield* executeRaw(input);
		474	const credential = yield* PinnedGitHubCredential;
		475	if (credential !== null && !targetsVerifiedHost(input.args, credential.host))
		476	return yield* executeRaw(input);
		477	const allowReserve = input.allowReserve ?? (yield* AllowGitHubReserve);
		478	const host = (
		479	credential?.host ??
		480	commandHosts(input.args).find((host) => host !== null) ??
		481	input.rateLimitHost ??
		482	input.env?.GH_HOST ??
		483	globalThis.process.env.GH_HOST ??
		484	"github.com"
		485	).toLowerCase();
		486	const key = { provider: "github" as const, host };
		487	const guarded = Effect.gen(function* () {
		488	const lease = yield* limits.check(key, allowReserve ? { allowPaused: true } : undefined);
		489	return yield* Effect.gen(function* () {
		490	yield* Cache.get(quota, `${host}\0${credential?.credentialFingerprint ?? ""}`);
		491	yield* budget.query(host, "query {}", allowReserve ? { allowReserve: true } : undefined);
		492	return yield* executeRaw(input);
		493	}).pipe(
		494	Effect.tap(() => limits.recordSuccess({ ...key, lease })),
		495	Effect.tapError((error) =>
		496	error._tag === "GitHubCliRateLimitError"
		497	? limits.recordRateLimit({ ...key, lease })
		498	: Effect.void,
		499	),
		500	);
		501	});
		502	return yield* guarded.pipe(
		503	Effect.provideService(
		504	SourceControlRateLimit.CredentialScope,
		505	credential?.credentialFingerprint ?? (yield* SourceControlRateLimit.CredentialScope),
		506	),
		507	Effect.catchTags({
		508	SourceControlRateLimitPausedError: (cause) =>
		509	Effect.fail(
		510	new GitHubCliRateLimitError({
		511	command: "gh",
		512	cwd: input.cwd,
		513	retryAt: cause.retryAt,
		514	cause,
		515	}),
		516	),
		517	}),
		518	);
		519	},
		520	);
		521
419	return GitHubCli.of({	522	return GitHubCli.of({
420	execute,	523	execute,
421	listOpenPullRequests: (input) =>	524	listOpenPullRequests: (input) =>
422	execute({	525	execute({
423	cwd: input.cwd,	526	cwd: input.cwd,
		527	...(input.rateLimitHost === undefined ? {} : { rateLimitHost: input.rateLimitHost }),
		528	allowReserve: true,
424	args: [	529	args: [
425	"pr",	530	"pr",
426	"list",	531	"list",
...	@@ -458,6 +563,8 @@ export const make = Effect.gen(function* () {	...	@@ -458,6 +563,8 @@ export const make = Effect.gen(function* () {
458	getPullRequest: (input) =>	563	getPullRequest: (input) =>
459	execute({	564	execute({
460	cwd: input.cwd,	565	cwd: input.cwd,
		566	...(input.rateLimitHost === undefined ? {} : { rateLimitHost: input.rateLimitHost }),
		567	allowReserve: true,
461	args: [	568	args: [
462	"pr",	569	"pr",
463	"view",	570	"view",
...	@@ -533,6 +640,7 @@ export const make = Effect.gen(function* () {	...	@@ -533,6 +640,7 @@ export const make = Effect.gen(function* () {
533	getDefaultBranch: (input) =>	640	getDefaultBranch: (input) =>
534	execute({	641	execute({
535	cwd: input.cwd,	642	cwd: input.cwd,
		643	...(input.rateLimitHost === undefined ? {} : { rateLimitHost: input.rateLimitHost }),
536	args: ["repo", "view", "--json", "defaultBranchRef", "--jq", ".defaultBranchRef.name"],	644	args: ["repo", "view", "--json", "defaultBranchRef", "--jq", ".defaultBranchRef.name"],
537	}).pipe(	645	}).pipe(
538	Effect.map((value) => {	646	Effect.map((value) => {
...	@@ -548,4 +656,7 @@ export const make = Effect.gen(function* () {	...	@@ -548,4 +656,7 @@ export const make = Effect.gen(function* () {
548	});	656	});
549	});	657	});
550		658
551	export const layer = Layer.effect(GitHubCli, make);	659	export const layer = Layer.effect(GitHubCli, make).pipe(
		660	Layer.provideMerge(GitHubGraphQlBudget.layer),
		661	Layer.provideMerge(SourceControlRateLimit.layer),
		662	);

apps/server/src/sourceControl/GitHubSourceControlProvider.test.ts+27

...	@@ -30,6 +30,33 @@ function makeProvider(github: Partial<GitHubCli.GitHubCli["Service"]>) {	...	@@ -30,6 +30,33 @@ function makeProvider(github: Partial<GitHubCli.GitHubCli["Service"]>) {
30	);	30	);
31	}	31	}
32		32
		33	it.effect("uses the enterprise quota for a current-repository default branch read", () =>
		34	Effect.gen(function* () {
		35	const provider = yield* GitHubSourceControlProvider.make.pipe(
		36	Effect.provide(GitHubCli.layer),
		37	Effect.provideService(VcsProcess.VcsProcess, {
		38	run: (input) =>
		39	Effect.sync(() => {
		40	if (input.args[1] !== "rate_limit") return processResult("main");
		41	assert.strictEqual(input.args[3], "enterprise.test");
		42	return processResult(
		43	'{"data":{"rateLimit":{"cost":1,"limit":5000,"remaining":5000,"resetAt":"2099-01-01T00:00:00Z"}}}',
		44	);
		45	}),
		46	}),
		47	);
		48	const branch = yield* provider.getDefaultBranch({
		49	cwd: "/enterprise-repo",
		50	context: {
		51	provider: { kind: "github", name: "GitHub Enterprise", baseUrl: "https://enterprise.test" },
		52	remoteName: "origin",
		53	remoteUrl: "https://enterprise.test/acme/web.git",
		54	},
		55	});
		56	assert.strictEqual(branch, "main");
		57	}),
		58	);
		59
33	it.effect("maps GitHub PR summaries into provider-neutral change requests", () =>	60	it.effect("maps GitHub PR summaries into provider-neutral change requests", () =>
34	Effect.gen(function* () {	61	Effect.gen(function* () {
35	const provider = yield* makeProvider({	62	const provider = yield* makeProvider({

apps/server/src/sourceControl/GitHubSourceControlProvider.ts+48-28

 @@ -127,6 +127,9 @@ export const make = Effect.gen(function* () {
           .listOpenPullRequests({
             cwd: input.cwd,
             headSelector: input.headSelector,
+            ...(input.context === undefined
+              ? {}
+              : { rateLimitHost: new URL(input.context.provider.baseUrl).host }),
             ...(input.limit !== undefined ? { limit: input.limit } : {}),
           })
           .pipe(
 @@ -152,6 +155,9 @@ export const make = Effect.gen(function* () {
       return github
         .execute({
           cwd: input.cwd,
+          ...(input.context === undefined
+            ? {}
+            : { rateLimitHost: new URL(input.context.provider.baseUrl).host }),
           args: [
             "pr",
             "list",
 @@ -267,23 +273,30 @@ export const make = Effect.gen(function* () {
     },
     listChangeRequests,
     getChangeRequest: (input) =>
-      github.getPullRequest(input).pipe(
+      github
-        Effect.map(toChangeRequest),
+        .getPullRequest({
-        Effect.mapError(
+          ...input,
-          (error) =>
+          ...(input.context === undefined
-            new SourceControlProviderError({
+            ? {}
-              provider: "github",
+            : { rateLimitHost: new URL(input.context.provider.baseUrl).host }),
-              operation: "getChangeRequest",
+        })
-              command: error.command,
+        .pipe(
-              cwd: input.cwd,
+          Effect.map(toChangeRequest),
-              reference: SourceControlProvider.transportSafeSourceControlErrorValue(
+          Effect.mapError(
-                input.reference,
+            (error) =>
-              ),
+              new SourceControlProviderError({
-              detail: error.detail,
+                provider: "github",
-              cause: error,
+                operation: "getChangeRequest",
-            }),
+                command: error.command,
+                cwd: input.cwd,
+                reference: SourceControlProvider.transportSafeSourceControlErrorValue(
+                  input.reference,
+                ),
+                detail: error.detail,
+                cause: error,
+              }),
+          ),
         ),
-      ),
     createChangeRequest: (input) =>
       github
         .createPullRequest({
 @@ -344,19 +357,26 @@ export const make = Effect.gen(function* () {
         ),
       ),
     getDefaultBranch: (input) =>
-      github.getDefaultBranch(input).pipe(
+      github
-        Effect.mapError(
+        .getDefaultBranch({
-          (error) =>
+          ...input,
-            new SourceControlProviderError({
+          ...(input.context === undefined
-              provider: "github",
+            ? {}
-              operation: "getDefaultBranch",
+            : { rateLimitHost: new URL(input.context.provider.baseUrl).host }),
-              command: error.command,
+        })
-              cwd: input.cwd,
+        .pipe(
-              detail: error.detail,
+          Effect.mapError(
-              cause: error,
+            (error) =>
-            }),
+              new SourceControlProviderError({
+                provider: "github",
+                operation: "getDefaultBranch",
+                command: error.command,
+                cwd: input.cwd,
+                detail: error.detail,
+                cause: error,
+              }),
+          ),
         ),
-      ),
     checkoutChangeRequest: (input) =>
       github.checkoutPullRequest(input).pipe(
         Effect.mapError(

apps/server/src/sourceControl/SourceControlRateLimit.test.ts+16

...	@@ -6,6 +6,22 @@ import * as SourceControlRateLimit from "./SourceControlRateLimit.ts";	...	@@ -6,6 +6,22 @@ import * as SourceControlRateLimit from "./SourceControlRateLimit.ts";
6		6
7	const github = { provider: "github" as const, host: "github.com" };	7	const github = { provider: "github" as const, host: "github.com" };
8		8
		9	it.effect("isolates cooldowns for verified credentials on the same host", () =>
		10	Effect.gen(function* () {
		11	const limits = yield* SourceControlRateLimit.SourceControlRateLimit;
		12	yield* limits
		13	.recordRateLimit({ ...github, lease: 0 })
		14	.pipe(Effect.provideService(SourceControlRateLimit.CredentialScope, "first"));
		15	yield* limits
		16	.check(github)
		17	.pipe(Effect.provideService(SourceControlRateLimit.CredentialScope, "second"));
		18	const error = yield* limits
		19	.check(github)
		20	.pipe(Effect.provideService(SourceControlRateLimit.CredentialScope, "first"), Effect.flip);
		21	assert.strictEqual(error._tag, "SourceControlRateLimitPausedError");
		22	}).pipe(Effect.provide(SourceControlRateLimit.layer)),
		23	);
		24
9	it("parses Retry-After seconds and HTTP dates", () => {	25	it("parses Retry-After seconds and HTTP dates", () => {
10	assert.equal(SourceControlRateLimit.retryAtFromHeader("120", 1_000), 121_000);	26	assert.equal(SourceControlRateLimit.retryAtFromHeader("120", 1_000), 121_000);
11	assert.equal(	27	assert.equal(

apps/server/src/sourceControl/SourceControlRateLimit.ts+10-5

apps/server/src/sourceControl/githubGraphQlBudget.test.ts+31

...	@@ -3,6 +3,7 @@ import * as Effect from "effect/Effect";	...	@@ -3,6 +3,7 @@ import * as Effect from "effect/Effect";
3	import * as TestClock from "effect/testing/TestClock";	3	import * as TestClock from "effect/testing/TestClock";
4		4
5	import * as GitHubGraphQlBudget from "./githubGraphQlBudget.ts";	5	import * as GitHubGraphQlBudget from "./githubGraphQlBudget.ts";
		6	import { CredentialScope } from "./SourceControlRateLimit.ts";
6		7
7	const RESET_AT = "2026-08-13T14:00:00.000Z";	8	const RESET_AT = "2026-08-13T14:00:00.000Z";
8	const NEXT_RESET_AT = "2026-08-13T15:00:00.000Z";	9	const NEXT_RESET_AT = "2026-08-13T15:00:00.000Z";
...	@@ -71,6 +72,23 @@ describe("GitHub GraphQL budget", () => {	...	@@ -71,6 +72,23 @@ describe("GitHub GraphQL budget", () => {
71	}).pipe(Effect.provide(GitHubGraphQlBudget.layer)),	72	}).pipe(Effect.provide(GitHubGraphQlBudget.layer)),
72	);	73	);
73		74
		75	it.effect("isolates query reservations and observations by credential", () =>
		76	Effect.gen(function* () {
		77	yield* TestClock.setTime(BEFORE_RESET);
		78	const budget = yield* GitHubGraphQlBudget.GitHubGraphQlBudget;
		79	const query = budget.query("github.com", "query { viewer { login } }");
		80	yield* budget
		81	.observe("github.com", rateLimit(0))
		82	.pipe(Effect.provideService(CredentialScope, "first"));
		83	yield* budget
		84	.observe("github.com", rateLimit(5000))
		85	.pipe(Effect.provideService(CredentialScope, "second"));
		86	yield* query.pipe(Effect.provideService(CredentialScope, "second"));
		87	const error = yield* query.pipe(Effect.provideService(CredentialScope, "first"), Effect.flip);
		88	expect(error.retryAt).toBe(Date.parse(RESET_AT));
		89	}).pipe(Effect.provide(GitHubGraphQlBudget.layer)),
		90	);
		91
74	it.effect("keeps the lower remaining value from out-of-order responses", () =>	92	it.effect("keeps the lower remaining value from out-of-order responses", () =>
75	Effect.gen(function* () {	93	Effect.gen(function* () {
76	yield* TestClock.setTime(BEFORE_RESET);	94	yield* TestClock.setTime(BEFORE_RESET);
...	@@ -181,6 +199,19 @@ describe("GitHub GraphQL budget", () => {	...	@@ -181,6 +199,19 @@ describe("GitHub GraphQL budget", () => {
181	}).pipe(Effect.provide(GitHubGraphQlBudget.layer)),	199	}).pipe(Effect.provide(GitHubGraphQlBudget.layer)),
182	);	200	);
183		201
		202	it.effect("stops interactive reads when the reserve is exhausted", () =>
		203	Effect.gen(function* () {
		204	yield* TestClock.setTime(BEFORE_RESET);
		205	const budget = yield* GitHubGraphQlBudget.GitHubGraphQlBudget;
		206	yield* budget.observe("github.com", rateLimit(1, 5000, RESET_AT, 1));
		207	yield* budget.query("github.com", "query { viewer { login } }", { allowReserve: true });
		208	const error = yield* budget
		209	.query("github.com", "query { viewer { login } }", { allowReserve: true })
		210	.pipe(Effect.flip);
		211	expect(error.retryAt).toBe(Date.parse(RESET_AT));
		212	}).pipe(Effect.provide(GitHubGraphQlBudget.layer)),
		213	);
		214
184	it.effect("ignores malformed or partial rate metadata", () =>	215	it.effect("ignores malformed or partial rate metadata", () =>
185	Effect.gen(function* () {	216	Effect.gen(function* () {
186	yield* TestClock.setTime(BEFORE_RESET);	217	yield* TestClock.setTime(BEFORE_RESET);

apps/server/src/sourceControl/githubGraphQlBudget.ts+7-4

 @@ -85,8 +85,8 @@ export const make = Effect.gen(function* () {
     function* (host, document, options) {
       if (!isReadOperation(document)) return document;
       const now = yield* Clock.currentTimeMillis;
+      const key = `${hostKey(host)}\0${yield* SourceControlRateLimit.CredentialScope}`;
       const retryAt = yield* Ref.modify(snapshots, (current) => {
-        const key = hostKey(host);
         const snapshot = current.get(key);
         if (snapshot === undefined) return [null, current] as const;
         if (snapshot.resetAtMs <= now) {
 @@ -94,8 +94,11 @@ export const make = Effect.gen(function* () {
           next.delete(key);
           return [null, next] as const;
         }
-        const remaining = Math.max(0, snapshot.remaining - Math.max(1, snapshot.cost));
+        const remaining = snapshot.remaining - Math.max(1, snapshot.cost);
-        if (options?.allowReserve !== true && remaining < snapshot.limit * GRAPHQL_RESERVE_RATIO) {
+        if (
+          remaining < 0 ||
+          (options?.allowReserve !== true && remaining < snapshot.limit * GRAPHQL_RESERVE_RATIO)
+        ) {
           return [snapshot.resetAtMs, current] as const;
         }
         const next = new Map(current);
 @@ -118,8 +121,8 @@ export const make = Effect.gen(function* () {
   )(function* (host, raw) {
     const snapshot = snapshotFrom(raw);
     if (snapshot === null) return;
+    const key = `${hostKey(host)}\0${yield* SourceControlRateLimit.CredentialScope}`;
     yield* Ref.update(snapshots, (current) => {
-      const key = hostKey(host);
       const previous = current.get(key);
       // Concurrent reads can finish out of order. Quota only falls within one reset window, and
       // an answer from an older window must not replace the current one.

packages/client-runtime/src/state/pullRequestRouting.ts+22-7

 @@ -49,6 +49,17 @@ const writes = new Set<string>([
 ]);
 const isRef = Schema.is(PullRequestRef);
 const isInvalidation = Schema.is(PullRequestInvalidateInput);
+const readTimeout = (environmentId: EnvironmentId) =>
+  Effect.timeoutOrElse({
+    duration: "30 seconds",
+    orElse: () =>
+      Effect.fail(
+        new EnvironmentRpcUnavailableError({
+          environmentId,
+          message: "The environment did not respond to the PR request.",
+        }),
+      ),
+  });
 interface RoutedRead {
   origin: EnvironmentId;
   reference: PullRequestRef;
 @@ -318,7 +329,8 @@ export function createPullRequestRouter() {
           if (!(yield* routingAllowed(registry, origin.target.environmentId, id, writes.has(tag))))
             return yield* visit(index + 1);
         }
-        return yield* run(id).pipe(
+        const operation = run(id);
+        return yield* (reads.has(tag) ? operation.pipe(readTimeout(id)) : operation).pipe(
           Effect.catch((error) => {
             if (
               (reads.has(tag) || rejectedBeforeDispatch(error)) &&
 @@ -366,12 +378,15 @@ export function createPullRequestRouter() {
     }
     if (!allowed) return yield* request(tag, input);
     const strictInput = { ...input, allowStale: false };
-    const source = yield* Effect.cached(request(tag, strictInput));
+    const source = yield* Effect.cached(
-    // Cached source reads usually finish before another environment can verify its account.
+      request(tag, strictInput).pipe(readTimeout(origin.target.environmentId)),
-    // Hedge slow reads only; never race mutations or retry an ambiguous write.
+    );
-    return yield* Effect.race(
+    const sourceEntry = entries.get(origin.target.environmentId);
-      source,
+    const routed = routedRequest(tag, strictInput, source);
-      routedRequest(tag, strictInput, source).pipe(Effect.delay("75 millis")),
+    return yield* (
+      sourceEntry !== undefined && isLocal(sourceEntry)
+        ? source.pipe(Effect.catch(() => routed))
+        : routed
     ).pipe(
       Effect.catch((error) =>
         input.allowStale !== false &&

packages/client-runtime/src/state/pullRequests.test.ts+28-19

 @@ -7,6 +7,9 @@ import {
 } from "@t3tools/contracts";
 import { expect, it } from "@effect/vitest";
 import * as Data from "effect/Data";
+import * as Deferred from "effect/Deferred";
+import * as Fiber from "effect/Fiber";
+import * as TestClock from "effect/testing/TestClock";
 import * as Effect from "effect/Effect";
 import * as Latch from "effect/Latch";
 import * as Layer from "effect/Layer";
 @@ -52,7 +55,7 @@ for (const scenario of [
   "prefers the local environment with the same github account",
   "falls back before mutation when the local account differs",
   "never retries an ambiguous mutation failure",
-  "returns a fast source read without checking alternate identities",
+  "returns a fast local source read without checking alternate identities",
   "keeps single-environment requests free of identity lookups",
   "keeps a local origin ahead of another local environment",
   "keeps mutations on an old origin server without retrying them",
 @@ -79,10 +82,12 @@ for (const scenario of [
           switchedAccount;
         const ambiguous = scenario === "never retries an ambiguous mutation failure";
         const reading =
-          scenario === "returns a fast source read without checking alternate identities";
+          scenario === "returns a fast local source read without checking alternate identities";
         const single = scenario === "keeps single-environment requests free of identity lookups";
         const localOrigin =
-          scenario === "keeps a local origin ahead of another local environment" || switchedAccount;
+          scenario === "keeps a local origin ahead of another local environment" ||
+          switchedAccount ||
+          reading;
         const oldOrigin =
           scenario === "keeps mutations on an old origin server without retrying them";
         const oldAlternate =
 @@ -557,15 +562,15 @@ for (const probe of ["origin", "alternate"] as const) {
   );
 }
-for (const source of ["pending", "pending-local", "failed", "offline"] as const) {
+for (const source of ["pending", "pending-local", "failed-local", "failed", "offline"] as const) {
-  it.live(
+  it.effect(
     source === "offline"
       ? "returns held source data only after both fresh paths fail"
-      : `hedges a ${source} source read to local and interrupts the losing read`,
+      : `uses one shared reader with a ${source} source`,
     () =>
       Effect.scoped(
         Effect.gen(function* () {
-          let interrupted = false;
+          const started = yield* Deferred.make<void>();
           const calls: string[] = [];
           const clientFor = (local: boolean) =>
             ({
 @@ -590,21 +595,16 @@ for (const source of ["pending", "pending-local", "failed", "offline"] as const)
                       operation: "summary",
                       detail: "github unreachable",
                     });
-                  return yield* Effect.never.pipe(
+                  yield* Deferred.succeed(started, undefined);
-                    Effect.onInterrupt(() =>
+                  return yield* Effect.never;
-                      Effect.sync(() => {
-                        interrupted = true;
-                      }),
-                    ),
-                  );
                 }),
             }) as unknown as WsRpcProtocolClient;
           const { environmentRegistry, supervisor } = yield* makeTestRuntime(
             clientFor(false),
             clientFor(true),
-            source === "pending-local",
+            source === "failed-local" || source === "pending-local",
           );
-          const result = yield* createPullRequestRouter()(WS_METHODS.pullRequestsSummary, {
+          const request = createPullRequestRouter()(WS_METHODS.pullRequestsSummary, {
             projectId: ProjectId.make("project-1"),
             repository: "acme/web",
             number: 7,
 @@ -613,14 +613,23 @@ for (const source of ["pending", "pending-local", "failed", "offline"] as const)
             Effect.provideService(GitHubRoutingPermissions, trustedRouting),
             Effect.provideService(EnvironmentSupervisor.EnvironmentSupervisor, supervisor),
           );
+          const fiber = yield* request.pipe(Effect.forkChild);
+          if (source === "pending-local") {
+            yield* Deferred.await(started);
+            yield* TestClock.adjust("30 seconds");
+          }
+          const result = yield* Fiber.join(fiber);
           if (source === "offline") {
             expect(result).toEqual({ state: "open" });
-            expect(calls).toEqual(["origin", "local", "held"]);
+            expect(calls).toEqual(["local", "origin", "held"]);
           } else {
             expect(result).toBeNull();
-            expect(calls).toEqual(["origin", "local"]);
+            expect(calls).toEqual(
+              source === "failed-local" || source === "pending-local"
+                ? ["origin", "local"]
+                : ["local"],
+            );
           }
-          expect(interrupted).toBe(source === "pending" || source === "pending-local");
         }),
       ),
   );

author	Bilal Bakr <62337003+Bil0000@users.noreply.github.com> 2026-09-16 01:30:58+03:00
committer	GitHub <noreply@github.com> 2026-09-15 15:30:58-07:00
log	f4600d77dd7c2fa9f10e8f4500882e427fcc7e26
tree	0cd5bab04d8947624e943639009a70e2fbd9cd64
parent	b84f63bb13f13b1d0ee8537c4d244d6f1efdb987
signature	Signed by PGP key B5690EEEBB952194

...	@@ -9,6 +9,7 @@ import { ChildProcessSpawner } from "effect/unstable/process";	...	@@ -9,6 +9,7 @@ import { ChildProcessSpawner } from "effect/unstable/process";
9		9
10	import * as GitHubCli from "../sourceControl/GitHubCli.ts";	10	import * as GitHubCli from "../sourceControl/GitHubCli.ts";
11	import * as VcsProcess from "../vcs/VcsProcess.ts";	11	import * as VcsProcess from "../vcs/VcsProcess.ts";
		12	import * as SourceControlRateLimit from "../sourceControl/SourceControlRateLimit.ts";
12	import * as GitHubGraphQlBudget from "../sourceControl/githubGraphQlBudget.ts";	13	import * as GitHubGraphQlBudget from "../sourceControl/githubGraphQlBudget.ts";
13	import * as GitHubPullRequestCli from "./GitHubPullRequestCli.ts";	14	import * as GitHubPullRequestCli from "./GitHubPullRequestCli.ts";
14	import { BASE_COMPARISON_GRAPHQL_QUERY } from "./gitHubPullRequestJson.ts";	15	import { BASE_COMPARISON_GRAPHQL_QUERY } from "./gitHubPullRequestJson.ts";
...	@@ -202,6 +203,7 @@ it.effect(	...	@@ -202,6 +203,7 @@ it.effect(
202	let activeToken = "broad-credential";	203	let activeToken = "broad-credential";
203	const commands: VcsProcess.VcsProcessInput[] = [];	204	const commands: VcsProcess.VcsProcessInput[] = [];
204	const github = yield* GitHubCli.make.pipe(	205	const github = yield* GitHubCli.make.pipe(
		206	Effect.provide(Layer.merge(GitHubGraphQlBudget.layer, SourceControlRateLimit.layer)),
205	Effect.provideService(VcsProcess.VcsProcess, {	207	Effect.provideService(VcsProcess.VcsProcess, {
206	run: (input) =>	208	run: (input) =>
207	Effect.sync(() => {	209	Effect.sync(() => {

...	@@ -13,6 +13,10 @@ import {	...	@@ -13,6 +13,10 @@ import {
13	const FALLBACK_COOLDOWN = Duration.seconds(30);	13	const FALLBACK_COOLDOWN = Duration.seconds(30);
14	const MAX_FALLBACK_COOLDOWN = Duration.minutes(15);	14	const MAX_FALLBACK_COOLDOWN = Duration.minutes(15);
15		15
		16	export const CredentialScope = Context.Reference<string>("t3/sourceControl/CredentialScope", {
		17	defaultValue: () => "",
		18	});
		19
16	interface RateLimitKey {	20	interface RateLimitKey {
17	readonly provider: SourceControlProviderKind;	21	readonly provider: SourceControlProviderKind;
18	readonly host: string;	22	readonly host: string;
...	@@ -59,8 +63,8 @@ export class SourceControlRateLimit extends Context.Service<	...	@@ -59,8 +63,8 @@ export class SourceControlRateLimit extends Context.Service<
59	}	63	}
60	>()("t3/sourceControl/SourceControlRateLimit") {}	64	>()("t3/sourceControl/SourceControlRateLimit") {}
61		65
62	function normalizedKey(key: RateLimitKey): string {	66	function normalizedKey(key: RateLimitKey, scope: string): string {
63	return `${key.provider}\0${key.host.trim().toLowerCase()}`;	67	return `${key.provider}\0${key.host.trim().toLowerCase()}\0${scope}`;
64	}	68	}
65		69
66	function fallbackCooldownMs(attempt: number): number {	70	function fallbackCooldownMs(attempt: number): number {
...	@@ -90,7 +94,8 @@ export const make = Effect.gen(function* () {	...	@@ -90,7 +94,8 @@ export const make = Effect.gen(function* () {
90	"SourceControlRateLimit.check",	94	"SourceControlRateLimit.check",
91	)(function* (input, options) {	95	)(function* (input, options) {
92	const now = yield* Clock.currentTimeMillis;	96	const now = yield* Clock.currentTimeMillis;
93	const entry = (yield* Ref.get(entries)).get(normalizedKey(input));	97	const key = normalizedKey(input, yield* CredentialScope);
		98	const entry = (yield* Ref.get(entries)).get(key);
94	if (entry !== undefined && entry.retryAt > now && options?.allowPaused !== true) {	99	if (entry !== undefined && entry.retryAt > now && options?.allowPaused !== true) {
95	return yield* new SourceControlRateLimitPausedError({	100	return yield* new SourceControlRateLimitPausedError({
96	provider: input.provider,	101	provider: input.provider,
...	@@ -105,8 +110,8 @@ export const make = Effect.gen(function* () {	...	@@ -105,8 +110,8 @@ export const make = Effect.gen(function* () {
105	"SourceControlRateLimit.recordRateLimit",	110	"SourceControlRateLimit.recordRateLimit",
106	)(function* (input) {	111	)(function* (input) {
107	const now = yield* Clock.currentTimeMillis;	112	const now = yield* Clock.currentTimeMillis;
		113	const key = normalizedKey(input, yield* CredentialScope);
108	yield* Ref.update(entries, (current) => {	114	yield* Ref.update(entries, (current) => {
109	const key = normalizedKey(input);
110	const previous = current.get(key);	115	const previous = current.get(key);
111	if (previous !== undefined && previous.generation > input.lease) {	116	if (previous !== undefined && previous.generation > input.lease) {
112	if (previous.retryAt <= now && (input.retryAt === undefined \|\| input.retryAt <= now)) {	117	if (previous.retryAt <= now && (input.retryAt === undefined \|\| input.retryAt <= now)) {
...	@@ -145,8 +150,8 @@ export const make = Effect.gen(function* () {	...	@@ -145,8 +150,8 @@ export const make = Effect.gen(function* () {
145	"SourceControlRateLimit.recordSuccess",	150	"SourceControlRateLimit.recordSuccess",
146	)(function* (input) {	151	)(function* (input) {
147	const now = yield* Clock.currentTimeMillis;	152	const now = yield* Clock.currentTimeMillis;
		153	const key = normalizedKey(input, yield* CredentialScope);
148	yield* Ref.update(entries, (current) => {	154	yield* Ref.update(entries, (current) => {
149	const key = normalizedKey(input);
150	const previous = current.get(key);	155	const previous = current.get(key);
151	if (previous === undefined \|\| previous.generation !== input.lease \|\| previous.retryAt > now) {	156	if (previous === undefined \|\| previous.generation !== input.lease \|\| previous.retryAt > now) {
152	return current;	157	return current;

fix: reduce GitHub quota use with sharing enabled (#11888)