@a2f0/agent-tool 0.1.48 → 0.1.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@a2f0/agent-tool",
-  "version": "0.1.48",
+  "version": "0.1.49",
   "packageManager": "bun@1.4.4",
   "type": "module",
   "description": "Portable cross-agent review, PR workflows, and shared skills",

package/src/cli.ts

@@ -16,7 +16,6 @@ import { bumpVersions, checkVersions, planVersions } from "./version/bumpVersion
 import { prepareVersions } from "./version/prepareVersions";
 import { resolveVersionConflicts } from "./version/resolveVersionConflicts";
 import { openPr } from "./pr/openPr";
-import { squashMerge } from "./pr/squashMerge";
 import metadata from "../package.json";
 import { runCommand } from "./commands/run";
 import { inspectLog } from "./commands/output";
@@ -25,7 +24,7 @@ import { branchCommand } from "./workflows/branch";
 import { commitsCommand, binariesCommand, gateCommand } from "./workflows/checks";
 import { hooksCommand } from "./workflows/hooks";
 import { repoCommand, policyCommand, toolchainCommand } from "./workflows/repository";
-import { prWorkflowCommand } from "./workflows/pr";
+import { mergeReviewedHead, prWorkflowCommand } from "./workflows/pr";
 import { releaseCommand } from "./release/commands";
 import { checkoutRoot } from "./workflows/core";
 import { procCommand, teardownCommand } from "./processes/commands";
@@ -251,7 +250,7 @@ export function main(argv = process.argv.slice(2)): number | Promise<number> {
     }
     usage(action === "merge" && args.length === 3, "Usage: agent-tool pr merge <subject-or-empty> <reviewed-head-oid> <base-branch>");
     usage(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i.test(args[1]!), "Merge requires a full reviewed HEAD OID.");
-    return squashMerge(root, args[0], args[1], args[2]);
+    return mergeReviewedHead(root, args[0], args[1], args[2]);
   }
   if (command === "versions") {
     const action = args.shift();

package/src/runAgentToolAction.ts

@@ -1,10 +1,10 @@
 import { openPr } from "./pr/openPr";
-import { squashMerge } from "./pr/squashMerge";
 import { solicitClaudeCodeReview } from "./review/solicitClaudeCodeReview";
 import { solicitCodexReview } from "./review/solicitCodexReview";
 import { solicitOpencodeReview } from "./review/solicitOpencodeReview";
 import { bumpVersions, checkVersions } from "./version/bumpVersions";
 import { resolveVersionConflicts } from "./version/resolveVersionConflicts";
+import { mergeReviewedHead } from "./workflows/pr";
 
 const AGENT_TOOL_USAGE =
   "Usage: agent-tool <solicitClaudeCodeReview|solicitCodexReview|solicitOpencodeReview|openPr|squashMerge|bumpVersions|checkVersions|resolveVersionConflicts> [args]\n";
@@ -36,7 +36,8 @@ const defaultActions: AgentToolActions = {
   solicitClaudeCodeReview,
   solicitCodexReview,
   solicitOpencodeReview,
-  squashMerge,
+  // A reviewed HEAD merges only after every preflight gate passes.
+  squashMerge: mergeReviewedHead,
 };
 
 function assertMaximumPositionals(

package/src/workflows/pr.ts

@@ -4,11 +4,11 @@ import { closeSync, readFileSync } from "node:fs";
 import { createLog } from "../commands/logFile";
 import { DEFAULT_LIMITS, logTail, outputLimit } from "../commands/output";
 import { loadConfig } from "../config";
-import { remoteBranchHead, resolvePr, resolveRepositoryGitUrl } from "../git/prContext";
+import { remoteBranchHead, resolveFreshBaseRef, resolvePr, resolveRepositoryGitUrl } from "../git/prContext";
 import { assertMergeChecks } from "../pr/mergeChecks";
 import { assertStrictBaseFreshness } from "../pr/baseFreshness";
 import { baseFreshness, behindReason, cancelRuns } from "./prFreshness";
-import { resolvePullRequestMergeTarget } from "../pr/squashMerge";
+import { resolvePullRequestMergeTarget, squashMerge } from "../pr/squashMerge";
 import { planVersions } from "../version/bumpVersions";
 import { assert, clean, currentBranch, git, head, json, oid, option, flag, output, poll, timeoutOptions } from "./core";
 
@@ -86,6 +86,23 @@ export function preflight(expectedHead: string, baseBranch: string, baseOid: str
   return { ok: true, repo: identity.repo, pr: pr.number, url: pr.url, headOid: expectedHead, baseBranch, baseOid, checks: checks.checks };
 }
 
+/**
+ * Merge a reviewed HEAD only after every preflight gate passes against the
+ * freshly fetched live base: a skipped, failed, or stale preflight run never
+ * leads to a merge. Without a reviewed HEAD (legacy manual form) only the
+ * merge helper's own checks apply.
+ */
+export function mergeReviewedHead(rootDir: string, subject?: string, expectedHead?: string, baseBranch?: string): number {
+  if (!expectedHead) return squashMerge(rootDir, subject, expectedHead, baseBranch);
+  const identity = resolvePr();
+  const branch = baseBranch ?? resolvePullRequestMergeTarget(identity).baseRefName;
+  const baseOid = resolveFreshBaseRef(identity.repo, branch);
+  try { preflight(expectedHead, branch, baseOid); }
+  catch (error) { throw new Error(`Refusing to merge: preflight failed against live ${branch} ${baseOid}: ${(error as Error).message}`); }
+  // Bind the merge to the branch that passed preflight, inferred or given, so a retarget in between is refused.
+  return squashMerge(rootDir, subject, expectedHead, branch);
+}
+
 interface Comment { id: string; databaseId: number; body: string; url: string; author: { login: string } | null }
 interface Page<T> { nodes: T[]; pageInfo: { hasNextPage: boolean; endCursor: string | null } }
 interface Thread { id: string; isResolved: boolean; isOutdated: boolean; path: string; line: number | null; comments: Page<Comment> }