@aspruyt/xfg 6.0.3 → 6.2.0

package/dist/vcs/github-pr-strategy.js

@@ -1,15 +1,15 @@
 import { existsSync, writeFileSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
-import { escapeShellArg, escapeRegExp } from "../shared/shell-utils.js";
+import { escapeRegExp } from "../shared/regex-utils.js";
 import { assertGitHubRepo } from "../repo/index.js";
 import { BasePRStrategy } from "./pr-strategy.js";
 import { withRetry, isPermanentError } from "../shared/retry-utils.js";
-import { sanitizeCredentials } from "./sanitize-utils.js";
+import { sanitizeCredentials } from "../shared/sanitize-utils.js";
 import { toErrorMessage } from "../shared/type-guards.js";
 import { safeCleanup } from "../shared/cleanup-utils.js";
 import { NO_OP_DEBUG_LOG } from "../shared/logger.js";
 import { getStderr } from "../shared/command-executor.js";
-import { buildTokenEnv, getHostnameFlag } from "../shared/gh-api-utils.js";
+import { buildTokenEnv, buildHostnameArgs } from "../shared/gh-api-utils.js";
 import { SyncError } from "../shared/errors.js";
 /**
  * Get the repo flag value for gh CLI commands.
@@ -26,14 +26,26 @@ function buildPRUrlRegex(host) {
     return new RegExp(`https://${escapedHost}/[\\w-]+/[\\w.-]+/pull/\\d+`);
 }
 export class GitHubPRStrategy extends BasePRStrategy {
+    bodyFilePath = ".pr-body.md";
     async findExistingPRUrl(options) {
         const { repoInfo, branchName, workDir, retries = 3, token } = options;
         assertGitHubRepo(repoInfo, "GitHub PR strategy");
         const repoFlag = getRepoFlag(repoInfo);
         const tokenEnv = buildTokenEnv(token);
-        const command = `gh pr list --repo ${escapeShellArg(repoFlag)} --head ${escapeShellArg(branchName)} --json url --jq '.[0].url'`;
+        const args = [
+            "pr",
+            "list",
+            "--repo",
+            repoFlag,
+            "--head",
+            branchName,
+            "--json",
+            "url",
+            "--jq",
+            ".[0].url",
+        ];
         try {
-            const existingPR = await withRetry(() => this.executor.exec(command, workDir, { env: tokenEnv }), { retries, log: this.log });
+            const existingPR = await withRetry(() => this.executor.exec("gh", args, workDir, { env: tokenEnv }), { retries, log: this.log });
             return existingPR || null;
         }
         catch (error) {
@@ -50,7 +62,6 @@ export class GitHubPRStrategy extends BasePRStrategy {
     async closeExistingPR(options) {
         const { repoInfo, branchName, baseBranch, workDir, retries = 3, token, } = options;
         assertGitHubRepo(repoInfo, "GitHub PR strategy");
-        // First check if there's an existing PR (pass token through)
         const existingUrl = await this.findExistingPRUrl({
             repoInfo,
             branchName,
@@ -60,25 +71,33 @@ export class GitHubPRStrategy extends BasePRStrategy {
             token,
         });
         if (!existingUrl) {
-            return false;
+            return { status: "no_pr" };
         }
-        // Extract PR number from URL
         const prNumber = existingUrl.match(/\/pull\/(\d+)/)?.[1];
         if (!prNumber) {
-            this.log?.warn(`Could not extract PR number from URL: ${existingUrl}`);
-            return false;
+            return {
+                status: "close_failed",
+                message: `Could not extract PR number from URL: ${existingUrl}`,
+            };
         }
         const repoFlag = getRepoFlag(repoInfo);
         const tokenEnv = buildTokenEnv(token);
-        const command = `gh pr close ${escapeShellArg(prNumber)} --repo ${escapeShellArg(repoFlag)} --delete-branch`;
+        const args = [
+            "pr",
+            "close",
+            prNumber,
+            "--repo",
+            repoFlag,
+            "--delete-branch",
+        ];
         try {
-            await withRetry(() => this.executor.exec(command, workDir, { env: tokenEnv }), { retries, log: this.log });
-            return true;
+            await withRetry(() => this.executor.exec("gh", args, workDir, { env: tokenEnv }), { retries, log: this.log });
+            return { status: "closed" };
         }
         catch (error) {
             const message = toErrorMessage(error);
             this.log?.warn(`Failed to close existing PR #${prNumber}: ${message}`);
-            return false;
+            return { status: "close_failed", message };
         }
     }
     async create(options) {
@@ -89,18 +108,28 @@ export class GitHubPRStrategy extends BasePRStrategy {
             writeFileSync(bodyFile, body, "utf-8");
         }
         catch (err) {
-            throw new SyncError(`Failed to write PR description to ${bodyFile}: ${toErrorMessage(err)}`);
+            throw new SyncError(`Failed to write PR description to ${bodyFile}: ${toErrorMessage(err)}`, { cause: err });
         }
         const tokenEnv = buildTokenEnv(token);
-        let command = `gh pr create --title ${escapeShellArg(title)} --body-file ${escapeShellArg(bodyFile)} --base ${escapeShellArg(baseBranch)} --head ${escapeShellArg(branchName)}`;
-        // Append label flags
+        const args = [
+            "pr",
+            "create",
+            "--title",
+            title,
+            "--body-file",
+            bodyFile,
+            "--base",
+            baseBranch,
+            "--head",
+            branchName,
+        ];
         if (labels && labels.length > 0) {
             for (const label of labels) {
-                command += ` --label ${escapeShellArg(label)}`;
+                args.push("--label", label);
             }
         }
         try {
-            const result = await withRetry(() => this.executor.exec(command, workDir, { env: tokenEnv }), { retries, log: this.log });
+            const result = await withRetry(() => this.executor.exec("gh", args, workDir, { env: tokenEnv }), { retries, log: this.log });
             // Extract URL from output - use strict regex for valid PR URLs only
             const host = repoInfo.host;
             const urlRegex = buildPRUrlRegex(host);
@@ -125,12 +154,17 @@ export class GitHubPRStrategy extends BasePRStrategy {
      * Check if auto-merge is enabled on the repository.
      */
     async checkAutoMergeEnabled(repoInfo, workDir, retries = 3, token) {
-        const hostnameFlag = getHostnameFlag(repoInfo);
-        const hostnamePart = hostnameFlag ? `${hostnameFlag} ` : "";
+        const hostnameArgs = buildHostnameArgs(repoInfo);
         const tokenEnv = buildTokenEnv(token);
-        const command = `gh api ${hostnamePart}repos/${escapeShellArg(repoInfo.owner)}/${escapeShellArg(repoInfo.repo)} --jq '.allow_auto_merge // false'`;
+        const args = [
+            "api",
+            ...hostnameArgs,
+            `repos/${repoInfo.owner}/${repoInfo.repo}`,
+            "--jq",
+            ".allow_auto_merge // false",
+        ];
         try {
-            const result = await withRetry(() => this.executor.exec(command, workDir, { env: tokenEnv }), { retries, log: this.log });
+            const result = await withRetry(() => this.executor.exec("gh", args, workDir, { env: tokenEnv }), { retries, log: this.log });
             return result.trim() === "true";
         }
         catch (error) {
@@ -149,8 +183,12 @@ export class GitHubPRStrategy extends BasePRStrategy {
             case "rebase":
                 return "--rebase";
             case "merge":
-            default:
+            case undefined:
                 return "--merge";
+            default: {
+                const _exhaustive = strategy;
+                throw new Error(`Unexpected merge strategy: ${_exhaustive}`);
+            }
         }
     }
     async merge(options) {
@@ -163,7 +201,6 @@ export class GitHubPRStrategy extends BasePRStrategy {
             };
         }
         const strategyFlag = this.getMergeStrategyFlag(config.strategy);
-        const deleteBranchFlag = config.deleteBranch ? "--delete-branch" : "";
         const tokenEnv = buildTokenEnv(token);
         if (config.mode === "auto") {
             // Check if auto-merge is enabled on the repo
@@ -179,9 +216,15 @@ export class GitHubPRStrategy extends BasePRStrategy {
                     autoMergeEnabled: false,
                 };
             }
-            // Enable auto-merge
-            const autoCommand = `gh pr merge ${escapeShellArg(prUrl)} --auto ${strategyFlag} ${deleteBranchFlag}`.trim();
-            return this.executeMergeCommand(() => this.executor.exec(autoCommand, workDir, { env: tokenEnv }), retries, {
+            const autoArgs = [
+                "pr",
+                "merge",
+                prUrl,
+                "--auto",
+                strategyFlag,
+                ...(config.deleteBranch ? ["--delete-branch"] : []),
+            ];
+            return this.executeMergeCommand(() => this.executor.exec("gh", autoArgs, workDir, { env: tokenEnv }), retries, {
                 success: true,
                 message: "Auto-merge enabled. PR will merge when checks pass.",
                 merged: false,
@@ -190,8 +233,15 @@ export class GitHubPRStrategy extends BasePRStrategy {
         }
         if (config.mode === "force") {
             this.log?.warn(`Force-merging PR ${prUrl} using admin privileges (bypasses branch protection)`);
-            const forceCommand = `gh pr merge ${escapeShellArg(prUrl)} --admin ${strategyFlag} ${deleteBranchFlag}`.trim();
-            return this.executeMergeCommand(() => this.executor.exec(forceCommand, workDir, { env: tokenEnv }), retries, {
+            const forceArgs = [
+                "pr",
+                "merge",
+                prUrl,
+                "--admin",
+                strategyFlag,
+                ...(config.deleteBranch ? ["--delete-branch"] : []),
+            ];
+            return this.executeMergeCommand(() => this.executor.exec("gh", forceArgs, workDir, { env: tokenEnv }), retries, {
                 success: true,
                 message: "PR merged successfully using admin privileges.",
                 merged: true,

package/dist/vcs/gitlab-pr-strategy.d.ts

@@ -1,10 +1,7 @@
 import type { PRResult } from "./types.js";
 import { BasePRStrategy } from "./pr-strategy.js";
-import type { IPRStrategyLogger } from "./pr-strategy.js";
-import type { PRStrategyOptions, CloseExistingPROptions, MergeOptions, MergeResult } from "./types.js";
-import { type ICommandExecutor } from "../shared/command-executor.js";
+import type { PRStrategyOptions, CloseExistingPROptions, ClosePRResult, MergeOptions, MergeResult } from "./types.js";
 export declare class GitLabPRStrategy extends BasePRStrategy {
-    constructor(executor: ICommandExecutor, log?: IPRStrategyLogger);
     /**
      * Build the repo flag for glab commands.
      * Format: namespace/repo (supports nested groups)
@@ -23,7 +20,7 @@ export declare class GitLabPRStrategy extends BasePRStrategy {
      */
     private getMergeStrategyFlag;
     findExistingPRUrl(options: CloseExistingPROptions): Promise<string | null>;
-    closeExistingPR(options: CloseExistingPROptions): Promise<boolean>;
+    closeExistingPR(options: CloseExistingPROptions): Promise<ClosePRResult>;
     create(options: PRStrategyOptions): Promise<PRResult>;
     merge(options: MergeOptions): Promise<MergeResult>;
 }

package/dist/vcs/gitlab-pr-strategy.js

@@ -1,21 +1,13 @@
-import { existsSync, writeFileSync, unlinkSync } from "node:fs";
-import { join } from "node:path";
-import { escapeShellArg } from "../shared/shell-utils.js";
 import { assertGitLabRepo } from "../repo/index.js";
 import { BasePRStrategy } from "./pr-strategy.js";
 import { withRetry, isPermanentError } from "../shared/retry-utils.js";
-import { getStderr, } from "../shared/command-executor.js";
+import { getStderr } from "../shared/command-executor.js";
 import { parseApiJson } from "../shared/json-utils.js";
-import { sanitizeCredentials } from "./sanitize-utils.js";
+import { sanitizeCredentials } from "../shared/sanitize-utils.js";
 import { toErrorMessage } from "../shared/type-guards.js";
-import { safeCleanup } from "../shared/cleanup-utils.js";
-import { NO_OP_DEBUG_LOG } from "../shared/logger.js";
 import { SyncError } from "../shared/errors.js";
+const MR_CREATED_MSG = "MR created successfully";
 export class GitLabPRStrategy extends BasePRStrategy {
-    constructor(executor, log) {
-        super(executor, log);
-        this.bodyFilePath = ".mr-description.md";
-    }
     /**
      * Build the repo flag for glab commands.
      * Format: namespace/repo (supports nested groups)
@@ -61,19 +53,30 @@ export class GitLabPRStrategy extends BasePRStrategy {
             case "rebase":
                 return "--rebase";
             case "merge":
-            default:
+            case undefined:
                 return "";
+            /* c8 ignore next 4 */
+            default: {
+                const _exhaustive = strategy;
+                throw new Error(`Unexpected merge strategy: ${_exhaustive}`);
+            }
         }
     }
     async findExistingPRUrl(options) {
         const { repoInfo, branchName, workDir, retries = 3 } = options;
         assertGitLabRepo(repoInfo, "GitLab PR strategy");
         const repoFlag = this.getRepoFlag(repoInfo);
-        // Use glab mr list with JSON output for reliable parsing
-        // Note: glab mr list returns open MRs by default (use -c for closed, -M for merged)
-        const command = `glab mr list --source-branch ${escapeShellArg(branchName)} -R ${escapeShellArg(repoFlag)} -F json`;
         try {
-            const result = await withRetry(() => this.executor.exec(command, workDir), { retries, log: this.log });
+            const result = await withRetry(() => this.executor.exec("glab", [
+                "mr",
+                "list",
+                "--source-branch",
+                branchName,
+                "-R",
+                repoFlag,
+                "-F",
+                "json",
+            ], workDir), { retries, log: this.log });
             if (!result || result.trim() === "" || result.trim() === "[]") {
                 return null;
             }
@@ -97,7 +100,6 @@ export class GitLabPRStrategy extends BasePRStrategy {
     async closeExistingPR(options) {
         const { repoInfo, branchName, baseBranch, workDir, retries = 3 } = options;
         assertGitLabRepo(repoInfo, "GitLab PR strategy");
-        // First check if there's an existing MR
         const existingUrl = await this.findExistingPRUrl({
             repoInfo,
             branchName,
@@ -106,84 +108,74 @@ export class GitLabPRStrategy extends BasePRStrategy {
             retries,
         });
         if (!existingUrl) {
-            return false;
+            return { status: "no_pr" };
         }
-        // Extract MR IID from URL
         const mrInfo = this.parseMRUrl(existingUrl);
         if (!mrInfo) {
-            this.log?.warn(`Could not extract MR IID from URL: ${existingUrl}`);
-            return false;
+            return {
+                status: "close_failed",
+                message: `Could not extract MR IID from URL: ${existingUrl}`,
+            };
         }
         const repoFlag = this.getRepoFlag(repoInfo);
-        // Close the MR
-        const closeCommand = `glab mr close ${escapeShellArg(mrInfo.mrIid)} -R ${escapeShellArg(repoFlag)}`;
         try {
-            await withRetry(() => this.executor.exec(closeCommand, workDir), {
-                retries,
-                log: this.log,
-            });
+            await withRetry(() => this.executor.exec("glab", ["mr", "close", mrInfo.mrIid, "-R", repoFlag], workDir), { retries, log: this.log });
         }
         catch (error) {
             const message = toErrorMessage(error);
             this.log?.warn(`Failed to close existing MR !${mrInfo.mrIid}: ${message}`);
-            return false;
+            return { status: "close_failed", message };
         }
-        const deleteBranchCommand = `git push origin --delete ${escapeShellArg(branchName)}`;
         try {
-            await withRetry(() => this.executor.exec(deleteBranchCommand, workDir), {
-                retries,
-                log: this.log,
-            });
+            await withRetry(() => this.executor.exec("git", ["push", "origin", "--delete", branchName], workDir), { retries, log: this.log });
         }
         catch (error) {
-            // Branch deletion failure is not critical
-            const message = toErrorMessage(error);
-            this.log?.warn(`Failed to delete branch ${branchName}: ${message}`);
+            const message = `MR !${mrInfo.mrIid} closed but branch ${branchName} deletion failed: ${toErrorMessage(error)}`;
+            this.log?.warn(message);
+            return { status: "close_failed", message };
         }
-        return true;
+        return { status: "closed" };
     }
     async create(options) {
         const { repoInfo, title, body, branchName, baseBranch, workDir, retries = 3, } = options;
         assertGitLabRepo(repoInfo, "GitLab PR strategy");
         const repoFlag = this.getRepoFlag(repoInfo);
-        const descFile = join(workDir, this.bodyFilePath);
-        try {
-            writeFileSync(descFile, body, "utf-8");
-        }
-        catch (err) {
-            throw new SyncError(`Failed to write PR description to ${descFile}: ${toErrorMessage(err)}`);
-        }
-        // glab mr create with description from file
-        const command = `glab mr create --source-branch ${escapeShellArg(branchName)} --target-branch ${escapeShellArg(baseBranch)} --title ${escapeShellArg(title)} --description "$(cat ${escapeShellArg(descFile)})" --yes -R ${escapeShellArg(repoFlag)}`;
-        try {
-            const result = await withRetry(() => this.executor.exec(command, workDir), { retries, log: this.log });
-            // Extract MR URL from output
-            // glab typically outputs the URL directly
-            const urlMatch = result.match(/https:\/\/[^\s]+\/-\/merge_requests\/\d+/);
-            if (urlMatch) {
-                return {
-                    url: urlMatch[0],
-                    success: true,
-                    message: "MR created successfully",
-                };
-            }
-            // Fallback: extract MR number and build URL
-            const mrMatch = result.match(/!(\d+)/);
-            if (mrMatch) {
-                return {
-                    url: this.buildMRUrl(repoInfo, mrMatch[1]),
-                    success: true,
-                    message: "MR created successfully",
-                };
-            }
-            throw new SyncError(`Could not parse MR URL from output: ${result}`);
+        const args = [
+            "mr",
+            "create",
+            "--source-branch",
+            branchName,
+            "--target-branch",
+            baseBranch,
+            "--title",
+            title,
+            "--description",
+            body,
+            "--yes",
+            "-R",
+            repoFlag,
+        ];
+        const result = await withRetry(() => this.executor.exec("glab", args, workDir), { retries, log: this.log });
+        // Extract MR URL from output
+        // glab typically outputs the URL directly
+        const urlMatch = result.match(/https:\/\/[^\s]+\/-\/merge_requests\/\d+/);
+        if (urlMatch) {
+            return {
+                url: urlMatch[0],
+                success: true,
+                message: MR_CREATED_MSG,
+            };
         }
-        finally {
-            safeCleanup(() => {
-                if (existsSync(descFile))
-                    unlinkSync(descFile);
-            }, `failed to remove ${descFile}`, this.log ?? NO_OP_DEBUG_LOG);
+        // Fallback: extract MR number and build URL
+        const mrMatch = result.match(/!(\d+)/);
+        if (mrMatch) {
+            return {
+                url: this.buildMRUrl(repoInfo, mrMatch[1]),
+                success: true,
+                message: MR_CREATED_MSG,
+            };
         }
+        throw new SyncError(`Could not parse MR URL from output: ${result}`);
     }
     async merge(options) {
         const { prUrl, config, workDir, retries = 3 } = options;
@@ -205,18 +197,19 @@ export class GitLabPRStrategy extends BasePRStrategy {
         }
         const repoFlag = `${mrInfo.namespace}/${mrInfo.repo}`;
         const strategyFlag = this.getMergeStrategyFlag(config.strategy);
-        const deleteBranchFlag = config.deleteBranch
-            ? "--remove-source-branch"
-            : "";
         if (config.mode === "auto") {
-            // Enable auto-merge when pipeline succeeds
-            const autoFlagParts = [
+            const args = [
+                "mr",
+                "merge",
+                mrInfo.mrIid,
                 "--when-pipeline-succeeds",
-                strategyFlag,
-                deleteBranchFlag,
-            ].filter(Boolean);
-            const autoCommand = `glab mr merge ${escapeShellArg(mrInfo.mrIid)} ${autoFlagParts.join(" ")} -R ${escapeShellArg(repoFlag)} -y`;
-            return this.executeMergeCommand(() => this.executor.exec(autoCommand.trim(), workDir), retries, {
+                ...(strategyFlag ? [strategyFlag] : []),
+                ...(config.deleteBranch ? ["--remove-source-branch"] : []),
+                "-R",
+                repoFlag,
+                "-y",
+            ];
+            return this.executeMergeCommand(() => this.executor.exec("glab", args, workDir), retries, {
                 success: true,
                 message: "Auto-merge enabled. MR will merge when pipeline succeeds.",
                 merged: false,
@@ -224,10 +217,18 @@ export class GitLabPRStrategy extends BasePRStrategy {
             }, "Failed to enable auto-merge");
         }
         if (config.mode === "force") {
-            // Force merge immediately
-            const forceFlagParts = [strategyFlag, deleteBranchFlag].filter(Boolean);
-            const forceCommand = `glab mr merge ${escapeShellArg(mrInfo.mrIid)} ${forceFlagParts.join(" ")} -R ${escapeShellArg(repoFlag)} -y`;
-            return this.executeMergeCommand(() => this.executor.exec(forceCommand.trim(), workDir), retries, {
+            this.log?.warn(`Force-merging MR ${mrInfo.mrIid} immediately (bypasses pipeline requirements)`);
+            const args = [
+                "mr",
+                "merge",
+                mrInfo.mrIid,
+                ...(strategyFlag ? [strategyFlag] : []),
+                ...(config.deleteBranch ? ["--remove-source-branch"] : []),
+                "-R",
+                repoFlag,
+                "-y",
+            ];
+            return this.executeMergeCommand(() => this.executor.exec("glab", args, workDir), retries, {
                 success: true,
                 message: "MR merged successfully.",
                 merged: true,

package/dist/vcs/graphql-commit-strategy.d.ts

@@ -76,11 +76,7 @@ export declare class GraphQLCommitStrategy implements ICommitStrategy {
      * This happens when the branch was updated between getting HEAD and making the commit.
      */
     private isHeadOidMismatchError;
-    /**
-     * Execute a GraphQL query or mutation for ref operations.
-     * Handles command construction, retry, error sanitization, and response parsing.
-     * Uses gh CLI's --input flag to pass GraphQL via stdin (same pattern as executeGraphQLMutation).
-     */
+    private execGraphQL;
     private executeGraphQLRefOp;
     /**
      * Query the remote for a repository's Node ID and a ref's Node ID.

package/dist/vcs/graphql-commit-strategy.js

@@ -1,9 +1,8 @@
 import { isGitHubRepo } from "../repo/index.js";
-import { escapeShellArg } from "../shared/shell-utils.js";
 import { withRetry, CORE_PERMANENT_ERROR_PATTERNS, DEFAULT_PERMANENT_ERROR_PATTERNS, } from "../shared/retry-utils.js";
 import { toErrorMessage } from "../shared/type-guards.js";
 import { parseApiJson } from "../shared/json-utils.js";
-import { buildTokenEnv } from "../shared/gh-api-utils.js";
+import { buildHostnameArgs, buildTokenEnv } from "../shared/gh-api-utils.js";
 import { ValidationError, GraphQLApiError } from "../shared/errors.js";
 /**
  * Maximum payload size for GitHub GraphQL API (50MB).
@@ -104,15 +103,11 @@ export class GraphQLCommitStrategy {
         let lastError = null;
         for (let attempt = 0; attempt <= retries; attempt++) {
             try {
-                const safeBranch = escapeShellArg(branchName);
-                if (gitOps) {
-                    await gitOps.fetchBranch(branchName);
+                if (!gitOps) {
+                    throw new ValidationError("gitOps is required for GraphQL commit strategy");
                 }
-                else {
-                    await this.executor.exec(`git fetch origin +${safeBranch}:refs/remotes/origin/${safeBranch}`, workDir);
-                }
-                // Get the remote HEAD SHA for this branch (not local HEAD)
-                const headSha = await this.executor.exec(`git rev-parse origin/${safeBranch}`, workDir);
+                await gitOps.fetchBranch(branchName);
+                const headSha = await this.executor.exec("git", ["rev-parse", `origin/${branchName}`], workDir);
                 const result = await this.executeGraphQLMutation(repoInfo, branchName, message, headSha.trim(), additions, deletions, workDir, token);
                 return result;
             }
@@ -125,6 +120,7 @@ export class GraphQLCommitStrategy {
                 throw lastError;
             }
         }
+        // Defensive — loop always exits via return or throw, but TS needs this for exhaustiveness
         throw (lastError ?? new GraphQLApiError("Unexpected error in GraphQL commit"));
     }
     /**
@@ -164,19 +160,12 @@ export class GraphQLCommitStrategy {
             query: mutation,
             variables,
         });
-        const hostnameArg = repoInfo.host !== "github.com"
-            ? `--hostname ${escapeShellArg(repoInfo.host)}`
-            : "";
-        const tokenEnv = buildTokenEnv(token);
-        const command = `echo ${escapeShellArg(requestBody)} | gh api graphql ${hostnameArg} --input -`;
         let response;
         try {
-            response = await withRetry(() => this.executor.exec(command, workDir, { env: tokenEnv }), {
-                permanentErrorPatterns: [
-                    ...DEFAULT_PERMANENT_ERROR_PATTERNS,
-                    ...OID_MISMATCH_PATTERNS,
-                ],
-            });
+            response = await this.execGraphQL(requestBody, repoInfo, workDir, token, [
+                ...DEFAULT_PERMANENT_ERROR_PATTERNS,
+                ...OID_MISMATCH_PATTERNS,
+            ]);
         }
         catch (error) {
             throw this.sanitizeCommandError(error, repositoryNameWithOwner);
@@ -215,7 +204,7 @@ export class GraphQLCommitStrategy {
         if (refId && force) {
             // Branch exists + force: delete then recreate from local HEAD
             await this.deleteRemoteRef(refId, workDir, repoInfo, token);
-            const sha = (await this.executor.exec("git rev-parse HEAD", workDir)).trim();
+            const sha = (await this.executor.exec("git", ["rev-parse", "HEAD"], workDir)).trim();
             await this.createRemoteRef(repositoryId, branchName, sha, workDir, repoInfo, token);
         }
         else if (!refId) {
@@ -223,7 +212,7 @@ export class GraphQLCommitStrategy {
             // Race condition: on newly created forks, queryRemoteRef may return null
             // due to eventual consistency, but the branch may exist by the time we
             // try to create it. Treat "already exists" as success.
-            const sha = (await this.executor.exec("git rev-parse HEAD", workDir)).trim();
+            const sha = (await this.executor.exec("git", ["rev-parse", "HEAD"], workDir)).trim();
             try {
                 await this.createRemoteRef(repositoryId, branchName, sha, workDir, repoInfo, token);
             }
@@ -261,7 +250,9 @@ export class GraphQLCommitStrategy {
         if (cleanMessage.length > 2000) {
             cleanMessage = cleanMessage.substring(0, 2000) + "... (truncated)";
         }
-        return new GraphQLApiError(`Commit failed for ${repo}: ${cleanMessage}`);
+        return new GraphQLApiError(`Commit failed for ${repo}: ${cleanMessage}`, {
+            cause: error,
+        });
     }
     /**
      * Check if an error is due to expectedHeadOid mismatch (optimistic locking failure).
@@ -271,23 +262,16 @@ export class GraphQLCommitStrategy {
         const message = error.message.toLowerCase();
         return OID_MISMATCH_PATTERNS.some((pattern) => pattern.test(message));
     }
-    /**
-     * Execute a GraphQL query or mutation for ref operations.
-     * Handles command construction, retry, error sanitization, and response parsing.
-     * Uses gh CLI's --input flag to pass GraphQL via stdin (same pattern as executeGraphQLMutation).
-     */
+    async execGraphQL(requestBody, repoInfo, workDir, token, permanentErrorPatterns) {
+        const hostnameArgs = buildHostnameArgs(repoInfo);
+        const tokenEnv = buildTokenEnv(token);
+        return withRetry(() => this.executor.exec("gh", ["api", "graphql", ...hostnameArgs, "--input", "-"], workDir, { env: tokenEnv, input: requestBody }), { permanentErrorPatterns });
+    }
     async executeGraphQLRefOp(queryOrMutation, repoInfo, workDir, token) {
         const requestBody = JSON.stringify({ query: queryOrMutation });
-        const hostnameArg = repoInfo.host !== "github.com"
-            ? `--hostname ${escapeShellArg(repoInfo.host)}`
-            : "";
-        const tokenEnv = buildTokenEnv(token);
-        const command = `echo ${escapeShellArg(requestBody)} | gh api graphql ${hostnameArg} --input -`;
         let response;
         try {
-            response = await withRetry(() => this.executor.exec(command, workDir, { env: tokenEnv }), {
-                permanentErrorPatterns: GraphQLCommitStrategy.GRAPHQL_PERMANENT_ERROR_PATTERNS,
-            });
+            response = await this.execGraphQL(requestBody, repoInfo, workDir, token, GraphQLCommitStrategy.GRAPHQL_PERMANENT_ERROR_PATTERNS);
         }
         catch (error) {
             throw this.sanitizeCommandError(error, `${repoInfo.owner}/${repoInfo.repo}`);

package/dist/vcs/pr-creator.js

@@ -47,8 +47,15 @@ function formatFileChanges(files) {
             case "delete":
                 actionText = "Deleted";
                 break;
-            default:
-                actionText = "Changed";
+            /* c8 ignore next 3 -- filtered out by line 77 */
+            case "skip":
+                actionText = "Skipped";
+                break;
+            /* c8 ignore next 4 */
+            default: {
+                const _exhaustive = f.action;
+                throw new Error(`Unexpected action: ${_exhaustive}`);
+            }
         }
         return `- ${actionText} \`${f.fileName}\``;
     })