@a2f0/agent-tool 0.1.1

package/src/git/prContext.ts

@@ -0,0 +1,497 @@
+import { gitEnvironment } from "./environment";
+import { execFileSync, spawnSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+
+import { viewCurrentBranchPr } from "./currentBranchPr";
+
+export interface PrIdentity {
+  readonly branch: string;
+  readonly repo: string;
+  readonly prNumber: string;
+  readonly title: string;
+}
+
+export interface PrContext extends PrIdentity {
+  readonly baseRef: string;
+}
+
+export interface PrView extends PrIdentity {
+  readonly baseRefName: string;
+}
+
+interface SpawnResult {
+  readonly status: number | null;
+  readonly signal: string | null;
+  readonly error?: Error;
+}
+
+// Large diffs blow past execFileSync's default 1 MiB maxBuffer and throw
+// ENOBUFS before we can hand the diff to a reviewer, so capture generously.
+export const MAX_BUFFER_BYTES = 512 * 1024 * 1024;
+
+export function run(command: string, args: string[]): string {
+  return execFileSync(command, args, {
+    env: gitEnvironment(),
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    maxBuffer: MAX_BUFFER_BYTES,
+  }).trim();
+}
+
+function tryRun(command: string, args: string[]): string | null {
+  try {
+    return run(command, args);
+  } catch {
+    return null;
+  }
+}
+
+function safeParse(source: string): unknown {
+  try {
+    return JSON.parse(source);
+  } catch {
+    return undefined;
+  }
+}
+
+function fieldOf(value: unknown, key: string): unknown {
+  return typeof value === "object" && value !== null
+    ? Reflect.get(value, key)
+    : undefined;
+}
+
+function stringField(source: string, key: string): string {
+  const value = fieldOf(safeParse(source), key);
+  return typeof value === "string" ? value : "";
+}
+
+function firstPrNumber(source: string | null): string {
+  if (source === null) {
+    return "";
+  }
+  const parsed = safeParse(source);
+  if (!Array.isArray(parsed) || parsed.length === 0) {
+    return "";
+  }
+  const numberField = fieldOf(parsed[0], "number");
+  return typeof numberField === "number" ? String(numberField) : "";
+}
+
+function gitRefExists(ref: string): boolean {
+  if (ref.length === 0) {
+    return false;
+  }
+  const result = spawnSync(
+    "git",
+    ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`],
+    { stdio: "ignore", env: gitEnvironment() },
+  );
+  return result.status === 0;
+}
+
+type RefExists = (ref: string) => boolean;
+
+interface FreshBaseRefDependencies {
+  readonly fetch: (repositoryUrl: string, target: string) => string;
+  readonly refExists: RefExists;
+  readonly repositoryGitUrl: (repo: string) => string;
+}
+
+/** Resolve an optional exact review base supplied by the coordinating skill. */
+export function resolvePinnedReviewBase(
+  pinnedBaseOid: string | undefined,
+  refExists: RefExists = gitRefExists,
+): string | undefined {
+  const oid = pinnedBaseOid?.trim() ?? "";
+  if (oid.length === 0) {
+    return undefined;
+  }
+  if (!/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/iu.test(oid)) {
+    throw new Error("AGENT_TOOL_REVIEW_BASE_OID must be a full Git OID.");
+  }
+  if (!refExists(oid)) {
+    throw new Error(
+      `Pinned review base '${oid}' is unavailable locally. Fetch it and retry.`,
+    );
+  }
+  return oid;
+}
+
+/** Select a repository fetch URL using the protocol configured for `gh`. */
+export function selectRepositoryGitUrl(
+  protocol: string,
+  httpsUrl: string,
+  sshUrl: string,
+): string {
+  if (protocol === "https" && httpsUrl.length > 0) {
+    return httpsUrl;
+  }
+  if (protocol === "ssh" && sshUrl.length > 0) {
+    return sshUrl;
+  }
+  throw new Error(`Unsupported or unavailable git protocol '${protocol}'.`);
+}
+
+export function resolveRepositoryGitUrl(repo: string): string {
+  const repoRaw = run("gh", ["repo", "view", repo, "--json", "url,sshUrl"]);
+  const httpsUrl = stringField(repoRaw, "url");
+  const sshUrl = stringField(repoRaw, "sshUrl");
+  let host = "";
+  try {
+    host = new URL(httpsUrl).host;
+  } catch {
+    throw new Error(`Could not resolve the GitHub host for '${repo}'.`);
+  }
+  const protocol = run("gh", ["config", "get", "git_protocol", "--host", host]);
+  return selectRepositoryGitUrl(protocol, httpsUrl, sshUrl);
+}
+
+/** The line of an `ls-remote` listing naming exactly `refs/heads/<branch>`. */
+export function parseRemoteBranchHead(
+  listing: string,
+  branch: string,
+): string | null {
+  for (const line of listing.split("\n")) {
+    const [oid = "", ref = ""] = line.trim().split(/\s+/);
+    if (ref === `refs/heads/${branch}` && oid.length > 0) return oid;
+  }
+  return null;
+}
+
+/** The commit a branch points to on the repository, or null when absent. */
+export function remoteBranchHead(
+  repositoryUrl: string,
+  branch: string,
+): string | null {
+  return parseRemoteBranchHead(
+    run("git", ["ls-remote", "--heads", repositoryUrl, `refs/heads/${branch}`]),
+    branch,
+  );
+}
+
+/** Build a fetch that records the requested branch in a caller-owned ref. */
+export function buildBaseFetchArgs(
+  repositoryUrl: string,
+  target: string,
+  temporaryRef: string,
+): string[] {
+  return [
+    "fetch",
+    "--quiet",
+    "--no-tags",
+    repositoryUrl,
+    `+${target}:${temporaryRef}`,
+  ];
+}
+
+function fetchBase(repositoryUrl: string, target: string): string {
+  const temporaryRef = `refs/codex/review-base/${process.pid}-${randomUUID()}`;
+  try {
+    const result = spawnSync(
+      "git",
+      buildBaseFetchArgs(repositoryUrl, target, temporaryRef),
+      { stdio: "ignore", env: gitEnvironment() },
+    );
+    if (spawnExitCode("git fetch", result) !== 0) {
+      throw new Error(
+        `Could not fetch base '${target}' from '${repositoryUrl}'.`,
+      );
+    }
+    return run("git", ["rev-parse", `${temporaryRef}^{commit}`]);
+  } finally {
+    spawnSync("git", ["update-ref", "-d", temporaryRef], {
+      stdio: "ignore",
+      env: gitEnvironment(),
+    });
+  }
+}
+
+const freshBaseRefDependencies: FreshBaseRefDependencies = {
+  fetch: fetchBase,
+  refExists: gitRefExists,
+  repositoryGitUrl: resolveRepositoryGitUrl,
+};
+
+/**
+ * Base ref for a review, resolved to the exact base snapshot from the repository
+ * that owns the PR. A branch cut from an older base would otherwise diff in
+ * upstream commits it never authored — so a review (or repair round) could flag
+ * or touch code the branch does not own.
+ */
+export function resolveFreshBaseRef(
+  repo: string,
+  baseRefName: string,
+  dependencies: FreshBaseRefDependencies = freshBaseRefDependencies,
+): string {
+  const fetchedOid = dependencies.fetch(
+    dependencies.repositoryGitUrl(repo),
+    `refs/heads/${baseRefName}`,
+  );
+  if (!dependencies.refExists(fetchedOid)) {
+    throw new Error(
+      `Fetched base '${fetchedOid}' from '${repo}' is unavailable locally.`,
+    );
+  }
+  return fetchedOid;
+}
+
+/** Prefer an already-fetched pinned base over any new repository lookup. */
+export function selectReviewBaseRef(
+  pinnedBaseRef: string | undefined,
+  repo: string,
+  baseRefName: string,
+  dependencies: FreshBaseRefDependencies = freshBaseRefDependencies,
+): string {
+  return pinnedBaseRef ?? resolveFreshBaseRef(repo, baseRefName, dependencies);
+}
+
+/**
+ * Map a spawnSync result to a process exit code. A failure to launch (missing
+ * binary) or a signal termination leaves `status` null; treat those as a
+ * nonzero exit so callers can detect the failure and fall back.
+ */
+export function spawnExitCode(command: string, result: SpawnResult): number {
+  if (result.error) {
+    process.stderr.write(`Failed to run ${command}: ${result.error.message}\n`);
+    return 1;
+  }
+  if (result.signal !== null) {
+    process.stderr.write(`${command} terminated by signal ${result.signal}\n`);
+    return 1;
+  }
+  return result.status ?? 1;
+}
+
+function defaultBranchName(source: string): string {
+  const ref = fieldOf(safeParse(source), "defaultBranchRef");
+  const name = fieldOf(ref, "name");
+  return typeof name === "string" ? name : "";
+}
+
+/**
+ * Resolve the current git branch, GitHub repo, and the repo's default branch.
+ * Throws when on the default branch (or a conventional `main`/`master`) or when
+ * the repo can't be determined (gh not authenticated).
+ */
+export function resolveRepoContext(): {
+  branch: string;
+  repo: string;
+  defaultBranch: string;
+} {
+  const branch = run("git", ["rev-parse", "--abbrev-ref", "HEAD"]);
+
+  const infoRaw = tryRun("gh", [
+    "repo",
+    "view",
+    "--json",
+    "nameWithOwner,defaultBranchRef",
+  ]);
+  const repo = infoRaw === null ? "" : stringField(infoRaw, "nameWithOwner");
+  if (repo.length === 0) {
+    throw new Error(
+      "Could not determine repository. Ensure gh is authenticated.",
+    );
+  }
+  const defaultBranch = infoRaw === null ? "" : defaultBranchName(infoRaw);
+
+  if (branch === defaultBranch || branch === "main" || branch === "master") {
+    throw new Error(
+      `Cannot run this on the default branch ('${branch}'). Checkout a feature branch first.`,
+    );
+  }
+
+  return { branch, repo, defaultBranch };
+}
+
+/**
+ * Number of the open PR for `branch`, or "" when the query **succeeded** and
+ * found none. A failed `gh` call (auth, rate limit, network) throws rather than
+ * reporting "" — callers use the empty string to mean "no PR yet" and would
+ * otherwise pick the wrong review base or skip a duplicate-PR guard on a
+ * transient failure.
+ */
+export function findOpenPrNumber(branch: string, repo: string): string {
+  const raw = tryRun("gh", [
+    "pr",
+    "list",
+    "--head",
+    branch,
+    "--state",
+    "open",
+    "--json",
+    "number",
+    "-R",
+    repo,
+  ]);
+  if (raw === null) {
+    throw new Error(
+      `Could not list open PRs for branch '${branch}'. Ensure gh is authenticated and reachable.`,
+    );
+  }
+  return firstPrNumber(raw);
+}
+
+/** Read a known-open PR's title and base identity from GitHub. */
+function viewPr(branch: string, repo: string, prNumber: string): PrView {
+  const viewRaw = run("gh", [
+    "pr",
+    "view",
+    prNumber,
+    "--json",
+    "title,baseRefName",
+    "-R",
+    repo,
+  ]);
+
+  return {
+    branch,
+    repo,
+    prNumber,
+    title: stringField(viewRaw, "title"),
+    baseRefName: stringField(viewRaw, "baseRefName"),
+  };
+}
+
+export interface ReviewContextDependencies {
+  readonly findOpenPrNumber: typeof findOpenPrNumber;
+  readonly pinnedBaseRefName: string | undefined;
+  readonly pinnedBaseOid: string | undefined;
+  readonly resolvePinnedReviewBase: typeof resolvePinnedReviewBase;
+  readonly resolveRepoContext: typeof resolveRepoContext;
+  readonly selectReviewBaseRef: typeof selectReviewBaseRef;
+  readonly viewCurrentBranchPr: typeof viewCurrentBranchPr;
+  readonly viewPr: typeof viewPr;
+}
+
+/** Require a coordinator's named review target to match current GitHub state. */
+export function assertPinnedReviewBaseRef(
+  pinnedBaseRefName: string | undefined,
+  actualBaseRefName: string,
+): void {
+  const expected = pinnedBaseRefName?.trim() ?? "";
+  if (expected.length > 0 && expected !== actualBaseRefName) {
+    throw new Error(
+      `Review base changed from pinned branch '${expected}' to '${actualBaseRefName}'.`,
+    );
+  }
+}
+
+/**
+ * Resolve the open PR for the current branch from git + GitHub. Throws with an
+ * actionable message when there is nothing reviewable (on main, no PR, gh not
+ * authenticated).
+ */
+function fetchPrView(): PrView {
+  const { branch, repo } = resolveRepoContext();
+
+  const currentBranchPr = viewCurrentBranchPr(branch);
+  if (currentBranchPr !== undefined) {
+    return currentBranchPr;
+  }
+
+  const prNumber = findOpenPrNumber(branch, repo);
+  if (prNumber.length === 0) {
+    throw new Error(`No PR found for branch '${branch}'. Create a PR first.`);
+  }
+
+  return viewPr(branch, repo, prNumber);
+}
+
+/** Current GitHub state of a PR (e.g. "OPEN", "MERGED", "CLOSED"). */
+export function prState(prNumber: string, repo: string): string {
+  return stringField(
+    run("gh", ["pr", "view", prNumber, "--json", "state", "-R", repo]),
+    "state",
+  );
+}
+
+/** Identity of the open PR for the current branch (no base-ref resolution). */
+export function resolvePr(): PrIdentity {
+  const view = fetchPrView();
+  return {
+    branch: view.branch,
+    repo: view.repo,
+    prNumber: view.prNumber,
+    title: view.title,
+  };
+}
+
+/**
+ * PR identity plus a base ref that `git diff` can resolve locally, for a review
+ * that may run *before* the branch has a PR.
+ *
+ * When an open PR exists this matches what a post-open review would see: the
+ * base ref is the PR's own base, resolved to its current remote tip. When none
+ * exists yet, `prNumber`/`title` are empty and the base ref is the repository's
+ * current default branch — so the identical `base...HEAD` diff can be reviewed on
+ * the local branch now and reviewed again once its PR is open. Either way the base
+ * is fetched fresh, so a stale local ref never leaks upstream commits into the
+ * diff. Throws on the default branch, via `resolveRepoContext`.
+ */
+export function resolveReviewContext(
+  dependencies?: ReviewContextDependencies,
+): PrContext {
+  const {
+    AGENT_TOOL_REVIEW_BASE_OID: pinnedBaseOid,
+    AGENT_TOOL_REVIEW_BASE_REF: pinnedBaseRefName,
+  } = process.env;
+  const deps = dependencies ?? {
+    findOpenPrNumber,
+    pinnedBaseRefName,
+    pinnedBaseOid,
+    resolvePinnedReviewBase,
+    resolveRepoContext,
+    selectReviewBaseRef,
+    viewCurrentBranchPr,
+    viewPr,
+  };
+  const {
+    branch,
+    repo: checkoutRepo,
+    defaultBranch,
+  } = deps.resolveRepoContext();
+  const pinnedBaseRef = deps.resolvePinnedReviewBase(deps.pinnedBaseOid);
+
+  const currentBranchPr = deps.viewCurrentBranchPr(branch);
+  const prNumber =
+    currentBranchPr?.prNumber ?? deps.findOpenPrNumber(branch, checkoutRepo);
+  if (prNumber.length === 0) {
+    if (defaultBranch.length === 0) {
+      throw new Error(
+        "Could not determine the repository default branch to review against.",
+      );
+    }
+    assertPinnedReviewBaseRef(deps.pinnedBaseRefName, defaultBranch);
+    // No PR yet: review the local branch against the *current* remote default,
+    // fetched fresh so a stale local ref cannot pull unrelated upstream commits
+    // into the diff.
+    return {
+      branch,
+      repo: checkoutRepo,
+      prNumber: "",
+      title: "",
+      baseRef: deps.selectReviewBaseRef(
+        pinnedBaseRef,
+        checkoutRepo,
+        defaultBranch,
+      ),
+    };
+  }
+
+  const view = currentBranchPr ?? deps.viewPr(branch, checkoutRepo, prNumber);
+  if (view.baseRefName.length === 0) {
+    throw new Error("Could not determine base branch from GitHub.");
+  }
+  assertPinnedReviewBaseRef(deps.pinnedBaseRefName, view.baseRefName);
+  return {
+    branch,
+    repo: view.repo,
+    prNumber,
+    title: view.title,
+    baseRef: deps.selectReviewBaseRef(
+      pinnedBaseRef,
+      view.repo,
+      view.baseRefName,
+    ),
+  };
+}

package/src/harnesses.ts

@@ -0,0 +1,53 @@
+import { type PrContext, resolveReviewContext, run } from "./git/prContext";
+import { withPinnedReviewInput } from "./review/pinnedReviewInput";
+import { resolveReviewEffort, type ReviewEffort } from "./review/reviewEffort";
+import { buildReviewPrompt, CLAUDE_ACCESS_NOTE, CODEX_ACCESS_NOTE, OPENCODE_ACCESS_NOTE } from "./review/reviewPrompt";
+import { spawnClaudeReview } from "./review/solicitClaudeCodeReview";
+import { spawnCodexReview } from "./review/solicitCodexReview";
+import { spawnOpencodeReview } from "./review/solicitOpencodeReview";
+
+export interface Harness {
+  name: "claude" | "codex" | "opencode";
+  executable: string;
+  skillDirectory: string;
+  defaultEffort: ReviewEffort;
+  accessNote: string;
+  review: (prompt: string, effort: ReviewEffort, snapshotRoot: string) => number;
+}
+
+/** Harness-specific discovery and invocation stay behind this small boundary. */
+export const HARNESSES: readonly Harness[] = [
+  { name: "claude", executable: "claude", skillDirectory: ".claude/skills", defaultEffort: "xhigh", accessNote: CLAUDE_ACCESS_NOTE, review: spawnClaudeReview },
+  { name: "codex", executable: "codex", skillDirectory: ".agents/skills", defaultEffort: "high", accessNote: CODEX_ACCESS_NOTE, review: spawnCodexReview },
+  { name: "opencode", executable: "opencode", skillDirectory: ".opencode/skills", defaultEffort: "high", accessNote: OPENCODE_ACCESS_NOTE, review: spawnOpencodeReview },
+];
+
+export function harnessNamed(name: string): Harness {
+  const harness = HARNESSES.find(item => item.name === name);
+  if (!harness) throw new Error(`Unknown harness '${name}'; choose claude, codex, or opencode.`);
+  return harness;
+}
+
+/** An explicit local base enables review without GitHub or network access. */
+export function review(rootDir: string, name: string, effortArg?: string, base?: string): number {
+  const harness = harnessNamed(name);
+  const effort = resolveReviewEffort(effortArg, harness.defaultEffort);
+  const context: PrContext = base === undefined ? resolveReviewContext() : {
+    branch: run("git", ["rev-parse", "--abbrev-ref", "HEAD"]),
+    repo: rootDir,
+    prNumber: "",
+    title: "",
+    baseRef: run("git", ["rev-parse", "--verify", "--end-of-options", `${base}^{commit}`]),
+  };
+  return withPinnedReviewInput(rootDir, context, input => {
+    const exitCode = harness.review(buildReviewPrompt({
+      context,
+      diff: input.diff,
+      reviewInstructions: input.reviewInstructions,
+      accessNote: harness.accessNote,
+      repositoryRoot: input.snapshotRoot,
+    }), effort, input.snapshotRoot);
+    if (run("git", ["rev-parse", "HEAD"]) !== input.headCommit) throw new Error("HEAD changed during review; review the new commit again.");
+    return exitCode;
+  });
+}

package/src/index.ts

@@ -0,0 +1,9 @@
+#!/usr/bin/env bun
+import { main } from "./cli";
+
+try {
+  process.exitCode = main();
+} catch (error) {
+  process.stderr.write(`Error: ${error instanceof Error ? error.message : String(error)}\n`);
+  process.exitCode = 1;
+}

package/src/pr/assertBranchPushed.ts

@@ -0,0 +1,21 @@
+/**
+ * `gh pr create` needs the head branch on the repository at the commit being
+ * proposed, and this tool never pushes: a push runs the pre-push gate, which
+ * the caller owns. Refuse clearly rather than let `gh` report a blank head.
+ */
+export function assertBranchPushed(input: {
+  readonly branch: string;
+  readonly localHead: string;
+  readonly remoteHead: string | null;
+}): void {
+  if (input.remoteHead === null) {
+    throw new Error(
+      `Branch '${input.branch}' is not on the repository. openPr does not push; run 'git push -u origin ${input.branch}' first.`,
+    );
+  }
+  if (input.remoteHead !== input.localHead) {
+    throw new Error(
+      `Branch '${input.branch}' is at ${input.remoteHead} on the repository but ${input.localHead} locally. Fetch and reconcile, then push (never force) before opening the PR.`,
+    );
+  }
+}

package/src/pr/assertNoClaudeBranding.ts

@@ -0,0 +1,52 @@
+/**
+ * Branding signatures that Claude Code injects into commit/PR footers. These
+ * target the attribution itself -- the "Generated with Claude Code" line, its
+ * claude.com/claude-code and claude.ai/code links, and Claude co-author
+ * trailers -- not every prose mention of the words, so a PR that legitimately
+ * documents the repo's own Claude tooling is not blocked.
+ */
+const CLAUDE_BRANDING_PATTERNS: ReadonlyArray<{
+  readonly label: string;
+  readonly pattern: RegExp;
+}> = [
+  {
+    label:
+      "Claude Code attribution link (claude.com/claude-code or claude.ai/code)",
+    pattern: /claude\.(?:com\/claude-code|ai\/code)/i,
+  },
+  {
+    label: '"Generated with Claude Code" attribution',
+    pattern: /generated\s+with\s+\[?\s*claude\s+code/i,
+  },
+  {
+    label: "Co-authored-by Claude trailer",
+    pattern: /co-authored-by:\s*claude\b/i,
+  },
+  {
+    label: "Anthropic no-reply co-author address (noreply@anthropic.com)",
+    pattern: /\bnoreply@anthropic\.com\b/i,
+  },
+];
+
+/**
+ * Reject a PR body that carries Claude Code branding. The pre-push hook already
+ * strips Co-authored-by trailers from commits; this applies the same policy to
+ * PR descriptions, where memory and prompt guidance alone have not held. Throws
+ * with the matched signals when branding is present; returns silently otherwise.
+ */
+export function assertNoClaudeBranding(body: string): void {
+  const matched = CLAUDE_BRANDING_PATTERNS.filter(({ pattern }) =>
+    pattern.test(body),
+  );
+  if (matched.length === 0) {
+    return;
+  }
+
+  const labels = matched.map(({ label }) => `  - ${label}`).join("\n");
+  throw new Error(
+    `PR body contains Claude Code branding:\n${labels}\n\n` +
+      "Remove every Claude Code attribution line, co-author trailer, and " +
+      "claude.com/claude-code or claude.ai/code link from the PR description, " +
+      "then re-run open-pr.",
+  );
+}

package/src/pr/baseFreshness.ts

@@ -0,0 +1,67 @@
+import { run } from "../git/prContext";
+
+function field(value: unknown, key: string): unknown {
+  return typeof value === "object" && value !== null
+    ? Reflect.get(value, key)
+    : undefined;
+}
+
+function reason(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+function strictStatusRule(rule: unknown): boolean {
+  const parameters = field(rule, "parameters");
+  const checks = field(parameters, "required_status_checks");
+  return field(rule, "type") === "required_status_checks" &&
+    field(parameters, "strict_required_status_checks_policy") === true &&
+    Array.isArray(checks) && checks.length > 0;
+}
+
+/**
+ * GitHub's merge mutation has no expected-base input. An active strict status
+ * rule that the merging actor cannot bypass makes GitHub itself reject a head
+ * that lacks the latest base, closing the race after the final freshness check.
+ */
+export function assertStrictBaseFreshness(
+  repo: string,
+  baseRef: string,
+  read: typeof run = run,
+): void {
+  const where = `${repo}:${baseRef}`;
+  let rulesetIds: unknown[];
+  try {
+    // --jq emits one rule per line across every page.
+    rulesetIds = [...new Set(
+      read("gh", ["api", "--paginate", `repos/${repo}/rules/branches/${encodeURIComponent(baseRef)}`, "--jq", ".[]"])
+        .split("\n")
+        .filter(Boolean)
+        .map((line): unknown => JSON.parse(line))
+        .filter(strictStatusRule)
+        .map((rule) => field(rule, "ruleset_id")),
+    )];
+  } catch (error) {
+    throw new Error(`Could not read effective rules for ${where}; refusing to merge. ${reason(error)}`);
+  }
+  if (rulesetIds.length === 0) {
+    throw new Error(`${where} has no strict required status check rule; refusing to merge.`);
+  }
+  for (const id of rulesetIds) {
+    if (!Number.isSafeInteger(id)) continue;
+    let ruleset: unknown;
+    try {
+      ruleset = JSON.parse(read("gh", ["api", `repos/${repo}/rulesets/${id}`]));
+    } catch (error) {
+      throw new Error(`Could not verify ruleset ${id} for ${where}; refusing to merge. ${reason(error)}`);
+    }
+    const rules = field(ruleset, "rules");
+    if (
+      field(ruleset, "enforcement") === "active" &&
+      field(ruleset, "current_user_can_bypass") === "never" &&
+      Array.isArray(rules) && rules.some(strictStatusRule)
+    ) return;
+  }
+  throw new Error(
+    `The authenticated actor can bypass strict base freshness for ${where}, or no strict ruleset is active; refusing to merge.`,
+  );
+}