@a2f0/agent-tool 0.1.48 → 0.1.50

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@a2f0/agent-tool",
-  "version": "0.1.48",
+  "version": "0.1.50",
   "packageManager": "bun@1.4.4",
   "type": "module",
   "description": "Portable cross-agent review, PR workflows, and shared skills",

package/src/cli.ts

@@ -16,7 +16,6 @@ import { bumpVersions, checkVersions, planVersions } from "./version/bumpVersion
 import { prepareVersions } from "./version/prepareVersions";
 import { resolveVersionConflicts } from "./version/resolveVersionConflicts";
 import { openPr } from "./pr/openPr";
-import { squashMerge } from "./pr/squashMerge";
 import metadata from "../package.json";
 import { runCommand } from "./commands/run";
 import { inspectLog } from "./commands/output";
@@ -25,7 +24,7 @@ import { branchCommand } from "./workflows/branch";
 import { commitsCommand, binariesCommand, gateCommand } from "./workflows/checks";
 import { hooksCommand } from "./workflows/hooks";
 import { repoCommand, policyCommand, toolchainCommand } from "./workflows/repository";
-import { prWorkflowCommand } from "./workflows/pr";
+import { mergeReviewedHead, prWorkflowCommand } from "./workflows/pr";
 import { releaseCommand } from "./release/commands";
 import { checkoutRoot } from "./workflows/core";
 import { procCommand, teardownCommand } from "./processes/commands";
@@ -89,7 +88,7 @@ Usage: agent-tool [--repo <directory>] [--config <file>] <command>
   --help | --version
 
 Legacy actions remain available: solicitClaudeCodeReview, solicitCodexReview,
-solicitOpencodeReview, openPr, squashMerge, bumpVersions, checkVersions,
+solicitOpencodeReview, openPr, bumpVersions, checkVersions,
 resolveVersionConflicts. A successful review exit means a usable review was
 returned; inspect VERDICT before shipping. Skill install previews unless --apply.
 `;
@@ -251,7 +250,7 @@ export function main(argv = process.argv.slice(2)): number | Promise<number> {
     }
     usage(action === "merge" && args.length === 3, "Usage: agent-tool pr merge <subject-or-empty> <reviewed-head-oid> <base-branch>");
     usage(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i.test(args[1]!), "Merge requires a full reviewed HEAD OID.");
-    return squashMerge(root, args[0], args[1], args[2]);
+    return mergeReviewedHead(root, args[0], args[1], args[2]);
   }
   if (command === "versions") {
     const action = args.shift();

package/src/permissions/catalog.ts

@@ -37,7 +37,6 @@ export const CATALOG: CatalogEntry[] = [
   ...["checkVersions"].map(command => ({ command, class: "read" as const })),
   ...["bumpVersions", "resolveVersionConflicts", "solicitClaudeCodeReview", "solicitCodexReview", "solicitOpencodeReview"].map(command => ({ command, class: "local" as const })),
   { command: "openPr", class: "share" },
-  { command: "squashMerge", class: "release" },
 ];
 // `run`, `run-group` and `proc start` execute arbitrary commands, so they stay unclassified and keep the harness default.
 // `bun x` runs only executables that `permissions.executables` classifies; project.ts adds those.

package/src/pr/squashMerge.ts

@@ -97,7 +97,7 @@ export function parsePullRequestMergeTarget(
     recordField(pullRequest, "autoMergeRequest") !== null
   ) {
     throw new Error(
-      "Pull request already has a queued or automatic merge; cancel it before running squashMerge.",
+      "Pull request already has a queued or automatic merge; cancel it before running pr merge.",
     );
   }
   if (expectedBaseRef !== undefined && baseRefName !== expectedBaseRef) {

package/src/runAgentToolAction.ts

@@ -1,5 +1,4 @@
 import { openPr } from "./pr/openPr";
-import { squashMerge } from "./pr/squashMerge";
 import { solicitClaudeCodeReview } from "./review/solicitClaudeCodeReview";
 import { solicitCodexReview } from "./review/solicitCodexReview";
 import { solicitOpencodeReview } from "./review/solicitOpencodeReview";
@@ -7,7 +6,7 @@ import { bumpVersions, checkVersions } from "./version/bumpVersions";
 import { resolveVersionConflicts } from "./version/resolveVersionConflicts";
 
 const AGENT_TOOL_USAGE =
-  "Usage: agent-tool <solicitClaudeCodeReview|solicitCodexReview|solicitOpencodeReview|openPr|squashMerge|bumpVersions|checkVersions|resolveVersionConflicts> [args]\n";
+  "Usage: agent-tool <solicitClaudeCodeReview|solicitCodexReview|solicitOpencodeReview|openPr|bumpVersions|checkVersions|resolveVersionConflicts> [args]\n";
 
 export interface AgentToolActions {
   readonly bumpVersions: (rootDir: string, baseOid?: string) => number;
@@ -20,12 +19,6 @@ export interface AgentToolActions {
   ) => number | Promise<number>;
   readonly solicitCodexReview: (rootDir: string, effort?: string) => number | Promise<number>;
   readonly solicitOpencodeReview: (rootDir: string, effort?: string) => number | Promise<number>;
-  readonly squashMerge: (
-    rootDir: string,
-    subject?: string,
-    expectedHeadSha?: string,
-    expectedBaseRef?: string,
-  ) => number;
 }
 
 const defaultActions: AgentToolActions = {
@@ -36,7 +29,6 @@ const defaultActions: AgentToolActions = {
   solicitClaudeCodeReview,
   solicitCodexReview,
   solicitOpencodeReview,
-  squashMerge,
 };
 
 function assertMaximumPositionals(
@@ -58,7 +50,7 @@ export function runAgentToolAction(
   actions: AgentToolActions = defaultActions,
 ): number | Promise<number> {
   const [action, ...positionals] = args;
-  const [first, second, third] = positionals;
+  const [first] = positionals;
   switch (action) {
     case "bumpVersions": {
       assertMaximumPositionals(action, positionals, 1);
@@ -88,10 +80,12 @@ export function runAgentToolAction(
       assertMaximumPositionals(action, positionals, 1);
       return actions.openPr(rootDir, first);
     }
-    case "squashMerge": {
-      assertMaximumPositionals(action, positionals, 3);
-      return actions.squashMerge(rootDir, first, second, third);
-    }
+    case "squashMerge":
+      // Removed: its optional reviewed head let a merge skip preflight.
+      process.stderr.write(
+        "squashMerge was removed; use agent-tool pr merge <subject-or-empty> <reviewed-head-oid> <base-branch>.\n",
+      );
+      return 1;
     default:
       process.stderr.write(`Unknown action: ${action ?? "(none)"}\n`);
       process.stderr.write(AGENT_TOOL_USAGE);

package/src/workflows/pr.ts

@@ -4,11 +4,11 @@ import { closeSync, readFileSync } from "node:fs";
 import { createLog } from "../commands/logFile";
 import { DEFAULT_LIMITS, logTail, outputLimit } from "../commands/output";
 import { loadConfig } from "../config";
-import { remoteBranchHead, resolvePr, resolveRepositoryGitUrl } from "../git/prContext";
+import { remoteBranchHead, resolveFreshBaseRef, resolvePr, resolveRepositoryGitUrl } from "../git/prContext";
 import { assertMergeChecks } from "../pr/mergeChecks";
 import { assertStrictBaseFreshness } from "../pr/baseFreshness";
 import { baseFreshness, behindReason, cancelRuns } from "./prFreshness";
-import { resolvePullRequestMergeTarget } from "../pr/squashMerge";
+import { resolvePullRequestMergeTarget, squashMerge } from "../pr/squashMerge";
 import { planVersions } from "../version/bumpVersions";
 import { assert, clean, currentBranch, git, head, json, oid, option, flag, output, poll, timeoutOptions } from "./core";
 
@@ -86,6 +86,22 @@ export function preflight(expectedHead: string, baseBranch: string, baseOid: str
   return { ok: true, repo: identity.repo, pr: pr.number, url: pr.url, headOid: expectedHead, baseBranch, baseOid, checks: checks.checks };
 }
 
+/**
+ * Merge a reviewed HEAD only after every preflight gate passes against the
+ * freshly fetched live base: a skipped, failed, or stale preflight run never
+ * leads to a merge. The reviewed HEAD and base branch are required, so no
+ * merge path skips preflight.
+ */
+export function mergeReviewedHead(rootDir: string, subject: string | undefined, expectedHead: string, baseBranch: string): number {
+  assert(!!expectedHead && !!baseBranch, "Merge requires a reviewed HEAD and a base branch.");
+  const identity = resolvePr();
+  const baseOid = resolveFreshBaseRef(identity.repo, baseBranch);
+  try { preflight(expectedHead, baseBranch, baseOid); }
+  catch (error) { throw new Error(`Refusing to merge: preflight failed against live ${baseBranch} ${baseOid}: ${(error as Error).message}`); }
+  // Bind the merge to the branch that passed preflight, so a retarget in between is refused.
+  return squashMerge(rootDir, subject, expectedHead, baseBranch);
+}
+
 interface Comment { id: string; databaseId: number; body: string; url: string; author: { login: string } | null }
 interface Page<T> { nodes: T[]; pageInfo: { hasNextPage: boolean; endCursor: string | null } }
 interface Thread { id: string; isResolved: boolean; isOutdated: boolean; path: string; line: number | null; comments: Page<Comment> }