[iscekic]

What changed

PR-link verification required the PR head ref to equal both the session's stored git_branch and the branch the session reported pushing (pr_head_ref). When those differ — a session that pushes its PR from another branch than the one it recorded — no PR head ref could satisfy both, so the session's own link was always rejected.

• apps/web/src/lib/integrations/platforms/github/pr-link-identity.ts: verifySessionPullRequestLink uses pr_head_ref as the PR-head-ref evidence and falls back to the stored git_branch only for a link that carries no head ref. The session repo, PR URL repo, PR number, base repo, head repo and head-SHA/commit evidence rules are unchanged.
• apps/web/src/lib/integrations/platforms/github/webhook-handlers/upsert-cli-session-pull-requests.ts: the webhook gate applies the same rule in SQL — coalesce(nullif(pr_head_ref, ''), nullif(git_branch, '')) must name the payload head ref. A stored head ref naming another branch still blocks the match; a differing stored branch no longer blocks a matching reported head ref. The head-SHA evidence predicate is unchanged.
• Tests: replaced the case that pinned rejection when the stored branch and reported head ref disagree with cases that accept the reported head ref (with head SHA and head-ref-only evidence), reject a head ref matching neither, and pin the stored-branch fallback. Added the same before/after coverage to the webhook gate tests and a refresh-procedure test in cli-sessions-v2-router.test.ts.

End-to-end evidence

Local PostgreSQL (pnpm test:db, migrations applied) on the work VM, NODE_ENV=test jest in apps/web.

Branch (after):

pnpm exec jest src/lib/integrations/platforms/github src/routers/cli-sessions-v2-router.test.ts
Test Suites: 24 passed, 24 total
Tests:       1 skipped, 491 passed, 492 total

Before the fix, with the two source files reverted and the new tests in place:

● verifySessionPullRequestLink - accepts › accepts the reported head ref when it differs from the stored session branch
  Expected: {"evidence": "head_sha", "verified": true}
  Received: {"reason": "head_ref_mismatch", "verified": false}

● upsertCliSessionPullRequestsFromWebhook › per-session verified gate › verifies when the reported head ref names the payload head ref and the stored branch differs
  Expected: 1  Received: 0

● cli-sessions-v2-router › refreshAssociatedPullRequest › verifies the PR when its head ref is the branch the session reported pushing
  Received has value: null

So the refresh procedure previously returned associatedPr: null and left pr_link_verified_at unset for a session whose stored branch differs from the branch it reported pushing; with the change it returns the PR, writes the github_branch_pull_requests row and sets pr_link_verified_at. The webhook path now verifies the same sessions.

Checks: oxlint 0 warnings/0 errors on the changed files, oxfmt --list-different clean, tsgo --noEmit exit 0 in apps/web.

No visual surface: the change is a pure predicate plus SQL gate, verified through the real database-backed refresh procedure and the webhook handler.

Proxy answers

The owner's proxy gave these answers in the owner's place.

1. Question: Webhook gate: The same 'both stored refs must equal the PR head ref' rule also lives in the webhook SQL gate (upsert-cli-session-pull-requests.ts). Fixing only the pure verifier makes refresh accept those sessions while the webhook still will not mark them verified. Which scope?
   Answer: Also widen the webhook predicate
   Confidence: 0.55 · Precedent: Fix the root cause and the class of the issue on every affected surface: session 75f8833fe8c1, "fix this for all shared services model pickers on all surfaces"; session 89824a222897, "if you saw a gap, fix it"

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The only change since the previous review is a doc-comment update in refreshAssociatedPullRequest, and I verified that its description matches the current verifier (link.headRef || sessionRepo.gitBranch) and the call site passing session.pr_head_ref; no new defects found.

Files Reviewed (6 files cumulative, 1 in incremental diff)

• apps/web/src/routers/cli-sessions-v2-router.ts - doc comment only, verified against implementation
• apps/web/src/lib/integrations/platforms/github/pr-link-identity.ts - previously reviewed, targeted re-check
• apps/web/src/lib/integrations/platforms/github/pr-link-identity.test.ts - previously reviewed
• apps/web/src/lib/integrations/platforms/github/webhook-handlers/upsert-cli-session-pull-requests.ts - previously reviewed, targeted re-check
• apps/web/src/lib/integrations/platforms/github/webhook-handlers/upsert-cli-session-pull-requests.test.ts - previously reviewed
• apps/web/src/routers/cli-sessions-v2-router.test.ts - previously reviewed

Tests were not executed in this read-only review; assessment is based on static analysis of the incremental diff and the current verifier/webhook call sites.

Previous Review Summary (commit 20c776a)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 20c776a)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The verifier and the webhook SQL gate now apply the same head-ref rule (pr_head_ref, falling back to git_branch only when no reported ref exists), and I verified by inspection that every webhook-verified combination is also accepted by refresh (no revocation path); tests are targeted and consistent with the new semantics.

Files Reviewed (5 files)

• apps/web/src/lib/integrations/platforms/github/pr-link-identity.ts - no issues
• apps/web/src/lib/integrations/platforms/github/pr-link-identity.test.ts - no issues
• apps/web/src/lib/integrations/platforms/github/webhook-handlers/upsert-cli-session-pull-requests.ts - no issues
• apps/web/src/lib/integrations/platforms/github/webhook-handlers/upsert-cli-session-pull-requests.test.ts - no issues
• apps/web/src/routers/cli-sessions-v2-router.test.ts - no issues

Tests were not executed in this read-only review; the assessment is based on static analysis of the diff, the current router/webhook call sites, and the ingest normalization of prHeadRef.

---

_{Reviewed by deepseek-v4.1-flash-1017 · Input: 33.7K · Output: 3K · Cached: 271K}

_{Review guidance: REVIEW.md from base branch main}