@blogic-cz/agent-tools 1.6.12 → 1.6.14

package/README.md

@@ -355,6 +355,8 @@ bun gh-tool pr checks-failed --pr 123 --with-logs --format json # includes diagn
 bun gh-tool pr rerun-checks --pr 123 --failed-only --watch --timeout 600
 bun gh-tool pr trigger-checks --pr 123 --workflow dotnet-pull-request.yml # only when zero checks reported
 bun gh-tool pr watch --prs 123,124 --format jsonl --timeout 600
+bun gh-tool pr edit-comment --comment-id 456 --body-file correction.md # Edit your own review comment
+bun gh-tool pr edit-comment --comment-id 789 --kind issue --pr 123 --body "Corrected detail"
 bun gh-tool pr reply-and-resolve --comment-id 456 --body "Done" # infers PR and thread
 bun gh-tool pr request-review --repo be --pr 123 --reviewers alice,bob
 bun gh-tool pr review --pr 123 --event comment --body "Notes, no verdict"
@@ -365,6 +367,10 @@ bun gh-tool pr review --pr 123 --event approve --confirm
 # Optional --pr/--thread-id retain legacy flow and are validated before either mutation.
 ```
 
+`pr edit-comment` defaults to inline review comments; pass `--kind issue` for PR discussion
+comments. It checks the authenticated GitHub user owns the comment before editing, and `--pr`
+also verifies the comment belongs to that pull request.
+
 `pr review` creates and submits a review in one call, for a verdict reached from a diff with no pending review to submit. `pr submit-review` takes the same `--event` for a review that is already pending. `--event approve` and `--event request-changes` change whether the PR can merge, so both require `--confirm`, the same gate `pr merge` uses; `--event comment` carries no verdict and needs none. `--event comment` and `--event request-changes` require a non-empty body — GitHub rejects a bodyless one. GitHub also refuses a verdict on your own PR; that failure returns a hint pointing at `--event comment` instead of the raw API error.
 
 Reruns preflight every target before mutation and fail closed with `evidence_unavailable` when attempt jobs or logs cannot be read. Failed jobs use one `gh run rerun RUN --failed` mutation per workflow run. Without `--watch`, output returns current attempt metadata immediately; with `--watch`, discovery and watching share one absolute `--timeout` deadline and report `discovery_timeout` or `watch_timeout` with latest attempt state. Repeated matching pre-test infrastructure failures return `escalation_required` without mutation. See [`skills/gh-tool/SKILL.md`](skills/gh-tool/SKILL.md) for operating guidance; this section is canonical for added output fields.

package/dist/credential-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AAg4FF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAoWrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UA9wGD,SAAS,UAAU,UAAU,KAAK,IA8wGM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAhxGC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAgxGjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aAlxGE,MAAM,KAAK,OAkxGgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aApxGE,MAAM,KAAK,OAoxGgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YAtxGC,MAAM,KAAK,OAsxG0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAxxGC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAwxGf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YA1xGC,MAAM,KAAK,OA0xGsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YA5xGC,MAAM,KAAK,MAAM,GAAG,IA4xGa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AA66FF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA+XrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAt1GD,SAAS,UAAU,UAAU,KAAK,IAs1GM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAx1GC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAw1GjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aA11GE,MAAM,KAAK,OA01GgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aA51GE,MAAM,KAAK,OA41GgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YA91GC,MAAM,KAAK,OA81G0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAh2GC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAg2Gf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YAl2GC,MAAM,KAAK,OAk2GsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YAp2GC,MAAM,KAAK,MAAM,GAAG,IAo2Ga,CAAC"}

package/dist/gh-tool/pr/commands.d.ts

@@ -328,6 +328,15 @@ export declare const prCommentCommand: Command.Command<"comment", {
     readonly pr: Option.Option<number>;
     readonly repo: Option.Option<string>;
 }, {}, import("#gh/service").GhError, GitHubService>;
+export declare const prEditCommentCommand: Command.Command<"edit-comment", {
+    readonly body: Option.Option<string>;
+    readonly bodyFile: Option.Option<string>;
+    readonly commentId: number;
+    readonly format: "json" | "toon";
+    readonly kind: "issue" | "review";
+    readonly pr: Option.Option<number>;
+    readonly repo: Option.Option<string>;
+}, {}, import("#gh/service").GhError, GitHubService>;
 export declare const prDiscussionSummaryCommand: Command.Command<"discussion-summary", {
     readonly format: "json" | "toon";
     readonly pr: Option.Option<number>;

package/dist/gh-tool/pr/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../src/gh-tool/pr/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAW,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEjD,OAAO,KAAK,EAAE,WAAW,EAAkB,MAAM,WAAW,CAAC;AAG7D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAiGhD,eAAO,MAAM,cAAc,cAAe,MAAM,4FAM/C,CAAC;AAiCF,eAAO,MAAM,aAAa,OAAQ,MAAM,aAAa,MAAM;;;;;;gDA6BvD,CAAC;AAEL,KAAK,mBAAmB,GAAG;IACzB,QAAQ,CAAC,6BAA6B,EAAE,MAAM,CAAC;IAC/C,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;CAC/C,CAAC;AAEF,KAAK,0BAA0B,GAAG;IAChC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,qBAAqB,CAAC;IACjD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;AAEF,eAAO,MAAM,oBAAoB,YACtB,mBAAmB,UACpB,SAAS,WAAW,EAAE,KAC7B,0BAQF,CAAC;AAIF,eAAO,MAAM,cAAc,UAClB,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC,SAAS,MAAM,EAAE,EAAE,kBAAkB,CAkBrD,CAAC;AA8BF,eAAO,MAAM,mBAAmB,OAC1B,MAAM,GAAG,IAAI,kBACD,OAAO,mBACN,OAAO,oGAMgB,CAAC;AAE3C,eAAO,MAAM,oBAAoB,OAAQ,MAAM,GAAG,IAAI,SAAS,MAAM,GAAG,IAAI,qGAIjC,CAAC;AAE5C,eAAO,MAAM,mBAAmB,OAC1B,MAAM,GAAG,IAAI,UACT,MAAM,GAAG,IAAI,gBACP,MAAM,GAAG,IAAI,SACpB,MAAM,GAAG,IAAI,yGAMoB,CAAC;AAE3C,eAAO,MAAM,oBAAoB,OAAQ,MAAM,GAAG,IAAI;;;;;gDAIX,CAAC;AAK5C,eAAO,MAAM,aAAa,SAAU,MAAM,KAAG,MACgB,CAAC;AAE9D,eAAO,MAAM,gBAAgB,YAC3B,KAAK,EACL,cAAc,EACd,mBAAmB,EACnB,cAAc,CACN,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,KAAK,iBAAiB,GAAG;IACvB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1F,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,OAAO,CAAC;QACvB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC,CAAC;IACH,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC;QACrC,EAAE,EAAE,MAAM,CAAC;QACX,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC,CAAC;IACH,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjG,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,CAAC,SAAS,iBAAiB,YAC9C,CAAC,WACF;IACP,IAAI,EAAE,cAAc,CAAC;IACrB,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,SAAS,EAAE,OAAO,CAAC;CACpB;IAyCC,MAAM;IACN,OAAO;QACL,OAAO;QACP,OAAO;QACP,cAAc;QACd,aAAa;;IAEf,OAAO;gBAxEiC,MAAM;cAAQ,MAAM;wBAAkB,MAAM;;IAyEpF,OAAO;mBAvEI,MAAM;cACX,MAAM;wBACI,MAAM;uBACP,OAAO;yBACL,OAAO;;IAoExB,cAAc;YAjEV,MAAM;qBACG,MAAM,GAAG,IAAI;gBAClB,MAAM;cACR,MAAM;wBACI,MAAM;;IA8DtB,aAAa;gBA5DiC,MAAM;cAAQ,MAAM;wBAAkB,MAAM;;CA8D7F,CAAC;AAQF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAkExB,OAAO;;;;;QACP,cAAc;;;;;QACd,OAAO;;;;;;gDAGX,CAAC;AAEH,eAAO,MAAM,aAAa;;;;;oDAkCzB,CAAC;AAEF,eAAO,MAAM,eAAe;;;sGAa3B,CAAC;AAEF,eAAO,MAAM,aAAa;;;;;;;;;oDA2CzB,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;oDA4BlC,CAAC;AAEF,eAAO,MAAM,eAAe;;;;;;;;;;;gIA6D3B,CAAC;AAEF,eAAO,MAAM,aAAa;;;;;;;;;oDA0C6D,CAAC;AAExF,eAAO,MAAM,cAAc;;;;;;;oDAwC4D,CAAC;AAExF,eAAO,MAAM,cAAc;;;;;;;4FAkCiE,CAAC;AAE7F,eAAO,MAAM,cAAc;;;;oDAsB1B,CAAC;AAEF,eAAO,MAAM,cAAc;;;;oDAkBmE,CAAC;AAE/F,eAAO,MAAM,eAAe;;;;;;;;2HAqE3B,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;oDAyBqC,CAAC;AAExE,eAAO,MAAM,cAAc;;;;;;;gEAkC6D,CAAC;AAEzF,eAAO,MAAM,oBAAoB;;;;;;;oDAoChC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;oDA+BlC,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;;;oDAiC5B,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;oDAwBkE,CAAC;AAEjG,eAAO,MAAM,0BAA0B;;;;oDAsBtC,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;;;;oDAyC5B,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;;;oDAgD7B,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;oDAwCqD,CAAC;AAEzF,eAAO,MAAM,4BAA4B;;;;;;oDA8BoC,CAAC;AAE9E,eAAO,MAAM,gBAAgB;;;;;;oDAmC0C,CAAC;AAExE,eAAO,MAAM,0BAA0B;;;;oDAqBtC,CAAC;AAEF,eAAO,MAAM,cAAc;;;;;;;oDAiCyC,CAAC;AAErE,eAAO,MAAM,gBAAgB;;;;oDAiByC,CAAC;AAYvE,eAAO,MAAM,eAAe;;;;;;;;;oDAkD3B,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;oDAsDjC,CAAC;AAEF,eAAO,MAAM,yBAAyB,YACpC,SAAS,EACT,gBAAgB,EAChB,mBAAmB,CACX,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF,eAAO,MAAM,kBAAkB,GAAI,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,UAC1D,CAAC,QACH,aAAa,CAAC,MAAM,CAAC;;EAW5B,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;oDAgCjC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;oDAiBsD,CAAC;AAE1F,eAAO,MAAM,0BAA0B;;;;oDAuBtC,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;oDAgDpC,CAAC;AA2EF,eAAO,MAAM,cAAc,6HAG1B,CAAC"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../src/gh-tool/pr/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAW,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEjD,OAAO,KAAK,EAAE,WAAW,EAAkB,MAAM,WAAW,CAAC;AAG7D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAkGhD,eAAO,MAAM,cAAc,cAAe,MAAM,4FAM/C,CAAC;AAiCF,eAAO,MAAM,aAAa,OAAQ,MAAM,aAAa,MAAM;;;;;;gDA6BvD,CAAC;AAEL,KAAK,mBAAmB,GAAG;IACzB,QAAQ,CAAC,6BAA6B,EAAE,MAAM,CAAC;IAC/C,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;CAC/C,CAAC;AAEF,KAAK,0BAA0B,GAAG;IAChC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,qBAAqB,CAAC;IACjD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;AAEF,eAAO,MAAM,oBAAoB,YACtB,mBAAmB,UACpB,SAAS,WAAW,EAAE,KAC7B,0BAQF,CAAC;AAIF,eAAO,MAAM,cAAc,UAClB,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC,SAAS,MAAM,EAAE,EAAE,kBAAkB,CAkBrD,CAAC;AA8BF,eAAO,MAAM,mBAAmB,OAC1B,MAAM,GAAG,IAAI,kBACD,OAAO,mBACN,OAAO,oGAMgB,CAAC;AAE3C,eAAO,MAAM,oBAAoB,OAAQ,MAAM,GAAG,IAAI,SAAS,MAAM,GAAG,IAAI,qGAIjC,CAAC;AAE5C,eAAO,MAAM,mBAAmB,OAC1B,MAAM,GAAG,IAAI,UACT,MAAM,GAAG,IAAI,gBACP,MAAM,GAAG,IAAI,SACpB,MAAM,GAAG,IAAI,yGAMoB,CAAC;AAE3C,eAAO,MAAM,oBAAoB,OAAQ,MAAM,GAAG,IAAI;;;;;gDAIX,CAAC;AAK5C,eAAO,MAAM,aAAa,SAAU,MAAM,KAAG,MACgB,CAAC;AAE9D,eAAO,MAAM,gBAAgB,YAC3B,KAAK,EACL,cAAc,EACd,mBAAmB,EACnB,cAAc,CACN,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,KAAK,iBAAiB,GAAG;IACvB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1F,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,OAAO,CAAC;QACvB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC,CAAC;IACH,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC;QACrC,EAAE,EAAE,MAAM,CAAC;QACX,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC,CAAC;IACH,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjG,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,CAAC,SAAS,iBAAiB,YAC9C,CAAC,WACF;IACP,IAAI,EAAE,cAAc,CAAC;IACrB,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,SAAS,EAAE,OAAO,CAAC;CACpB;IAyCC,MAAM;IACN,OAAO;QACL,OAAO;QACP,OAAO;QACP,cAAc;QACd,aAAa;;IAEf,OAAO;gBAxEiC,MAAM;cAAQ,MAAM;wBAAkB,MAAM;;IAyEpF,OAAO;mBAvEI,MAAM;cACX,MAAM;wBACI,MAAM;uBACP,OAAO;yBACL,OAAO;;IAoExB,cAAc;YAjEV,MAAM;qBACG,MAAM,GAAG,IAAI;gBAClB,MAAM;cACR,MAAM;wBACI,MAAM;;IA8DtB,aAAa;gBA5DiC,MAAM;cAAQ,MAAM;wBAAkB,MAAM;;CA8D7F,CAAC;AAQF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAkExB,OAAO;;;;;QACP,cAAc;;;;;QACd,OAAO;;;;;;gDAGX,CAAC;AAEH,eAAO,MAAM,aAAa;;;;;oDAkCzB,CAAC;AAEF,eAAO,MAAM,eAAe;;;sGAa3B,CAAC;AAEF,eAAO,MAAM,aAAa;;;;;;;;;oDA2CzB,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;oDA4BlC,CAAC;AAEF,eAAO,MAAM,eAAe;;;;;;;;;;;gIA6D3B,CAAC;AAEF,eAAO,MAAM,aAAa;;;;;;;;;oDA0C6D,CAAC;AAExF,eAAO,MAAM,cAAc;;;;;;;oDAwC4D,CAAC;AAExF,eAAO,MAAM,cAAc;;;;;;;4FAkCiE,CAAC;AAE7F,eAAO,MAAM,cAAc;;;;oDAsB1B,CAAC;AAEF,eAAO,MAAM,cAAc;;;;oDAkBmE,CAAC;AAE/F,eAAO,MAAM,eAAe;;;;;;;;2HAqE3B,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;oDAyBqC,CAAC;AAExE,eAAO,MAAM,cAAc;;;;;;;gEAkC6D,CAAC;AAEzF,eAAO,MAAM,oBAAoB;;;;;;;oDAoChC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;oDA+BlC,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;;;oDAiC5B,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;oDAwBkE,CAAC;AAEjG,eAAO,MAAM,0BAA0B;;;;oDAsBtC,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;;;;oDAyC5B,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;;;oDAgD7B,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;oDAwCqD,CAAC;AAEzF,eAAO,MAAM,4BAA4B;;;;;;oDA8BoC,CAAC;AAE9E,eAAO,MAAM,gBAAgB;;;;;;oDAmC0C,CAAC;AAExE,eAAO,MAAM,oBAAoB;;;;;;;;oDAuCsD,CAAC;AAExF,eAAO,MAAM,0BAA0B;;;;oDAqBtC,CAAC;AAEF,eAAO,MAAM,cAAc;;;;;;;oDAiCyC,CAAC;AAErE,eAAO,MAAM,gBAAgB;;;;oDAiByC,CAAC;AAYvE,eAAO,MAAM,eAAe;;;;;;;;;oDAkD3B,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;oDAsDjC,CAAC;AAEF,eAAO,MAAM,yBAAyB,YACpC,SAAS,EACT,gBAAgB,EAChB,mBAAmB,CACX,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF,eAAO,MAAM,kBAAkB,GAAI,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,UAC1D,CAAC,QACH,aAAa,CAAC,MAAM,CAAC;;EAW5B,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;oDAgCjC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;oDAiBsD,CAAC;AAE1F,eAAO,MAAM,0BAA0B;;;;oDAuBtC,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;oDAgDpC,CAAC;AA2EF,eAAO,MAAM,cAAc,6HAG1B,CAAC"}

package/dist/gh-tool/pr/index.d.ts

@@ -1,2 +1,2 @@
-export { prChecksCommand, prChecksFailedCommand, prCloseCommand, prCommentCommand, prCommentsCommand, prCreateCommand, prDiscussionSummaryCommand, prDraftCommand, prEditCommand, prFeedbackCommand, prIssueCommentsCommand, prIssueCommentsLatestCommand, prLastHumanReviewerCommand, prListCommand, prMergeCommand, prReadyCommand, prStackCommand, prRequestReviewCommand, prReplyCommand, prRerunChecksCommand, prReplyAndResolveCommand, prResolveCommand, prReviewCommand, prReviewsCommand, prStatusCommand, prSubmitReviewCommand, prThreadsCommand, prTriggerChecksCommand, prWaitMergeableCommand, prReviewTriageCommand, prReviewTriageBatchCommand, prViewCommand, prWatchCommand, } from "./commands";
+export { prChecksCommand, prChecksFailedCommand, prCloseCommand, prCommentCommand, prEditCommentCommand, prCommentsCommand, prCreateCommand, prDiscussionSummaryCommand, prDraftCommand, prEditCommand, prFeedbackCommand, prIssueCommentsCommand, prIssueCommentsLatestCommand, prLastHumanReviewerCommand, prListCommand, prMergeCommand, prReadyCommand, prStackCommand, prRequestReviewCommand, prReplyCommand, prRerunChecksCommand, prReplyAndResolveCommand, prResolveCommand, prReviewCommand, prReviewsCommand, prStatusCommand, prSubmitReviewCommand, prThreadsCommand, prTriggerChecksCommand, prWaitMergeableCommand, prReviewTriageCommand, prReviewTriageBatchCommand, prViewCommand, prWatchCommand, } from "./commands";
 //# sourceMappingURL=index.d.ts.map

package/dist/gh-tool/pr/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/gh-tool/pr/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,aAAa,EACb,cAAc,EACd,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,oBAAoB,EACpB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,aAAa,EACb,cAAc,GACf,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/gh-tool/pr/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,aAAa,EACb,cAAc,EACd,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,oBAAoB,EACpB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,aAAa,EACb,cAAc,GACf,MAAM,YAAY,CAAC"}

package/dist/gh-tool/pr/review.d.ts

@@ -48,6 +48,13 @@ export declare const fetchDiscussionSummary: (pr: number | null) => Effect.Effec
     unresolvedReviewThreadsCount: number;
     unresolvedUnrepliedReviewThreadsCount: number;
 }, import("#gh/service").GhError, GitHubService>;
+export declare const editComment: (commentId: number, body: string, kind: "issue" | "review", pr: number | null) => Effect.Effect<{
+    commentId: number;
+    url: string;
+    updatedAt: string;
+    hint: string;
+    nextCommand: string;
+}, import("#gh/service").GhError, GitHubService>;
 /**
  * Reply to an inline review comment via REST API.
  */

package/dist/gh-tool/pr/review.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"review.d.ts","sourceRoot":"","sources":["../../../src/gh-tool/pr/review.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,KAAK,EAEV,YAAY,EAGZ,iBAAiB,EACjB,aAAa,EACb,YAAY,EAEb,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAye5C;;;GAGG;AACH,eAAO,MAAM,YAAY,gMAcvB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,uKAoCxB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,kBAAkB,8KAmC7B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,YAAY,+NA+CvB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;gDAaxB,CAAC;AAEH,eAAO,MAAM,uBAAuB,6JAgBlC,CAAC;AAEH,eAAO,MAAM,gBAAgB,gHA0C3B,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;gDA4CjC,CAAC;AAeH;;GAEG;AACH,eAAO,MAAM,cAAc;;;gDA4FzB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;gDA0FjC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,aAAa;;;gDAWxB,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAgCzD;;;GAGG;AACH,eAAO,MAAM,YAAY;QACnB,MAAM,GAAG,IAAI;WACV,WAAW;UACZ,MAAM;aACH,OAAO;;;;;;;gDAmDhB,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;gDAyM9B,CAAC;AAeH,eAAO,MAAM,sBAAsB;;;;gDA8CjC,CAAC"}
+{"version":3,"file":"review.d.ts","sourceRoot":"","sources":["../../../src/gh-tool/pr/review.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,KAAK,EAEV,YAAY,EAGZ,iBAAiB,EACjB,aAAa,EACb,YAAY,EAEb,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAkf5C;;;GAGG;AACH,eAAO,MAAM,YAAY,gMAcvB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,uKAoCxB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,kBAAkB,8KAmC7B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,YAAY,+NA+CvB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;gDAaxB,CAAC;AAEH,eAAO,MAAM,uBAAuB,6JAgBlC,CAAC;AAEH,eAAO,MAAM,gBAAgB,gHA0C3B,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;gDA4CjC,CAAC;AAeH,eAAO,MAAM,WAAW;;;;;;gDAmGtB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,cAAc;;;gDA4FzB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;gDA0FjC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,aAAa;;;gDAWxB,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAgCzD;;;GAGG;AACH,eAAO,MAAM,YAAY;QACnB,MAAM,GAAG,IAAI;WACV,WAAW;UACZ,MAAM;aACH,OAAO;;;;;;;gDAmDhB,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;gDAyM9B,CAAC;AAeH,eAAO,MAAM,sBAAsB;;;;gDA8CjC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.6.12",
+  "version": "1.6.14",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/credential-guard/index.ts

@@ -422,6 +422,7 @@ function literalBindingText(
   command: string,
   name: string,
   value: string,
+  allowBrackets = false,
 ): { text: string; syntax: string } | undefined {
   let text = "";
   let syntax = "";
@@ -453,7 +454,11 @@ function literalBindingText(
       syntax += quote ? " ".repeat(value.length) : value;
       i += match[0].length - 1;
     } else {
-      if (char === "`" || (!quote && /[(){}*?[\]#]/.test(char))) return undefined;
+      if (
+        char === "`" ||
+        (!quote && (/[(){}*?#]/.test(char) || (!allowBrackets && (char === "[" || char === "]"))))
+      )
+        return undefined;
       text += char;
       syntax += quote ? " " : char;
     }
@@ -608,24 +613,45 @@ function literalShellBodies(command: string): string[] | undefined {
   return bodies;
 }
 
-function isProvedLiteralShellBody(body: string): boolean {
+function isProvedLiteralShellBody(
+  body: string,
+  allowedNames: Set<string>,
+  isPathBlocked: (path: string) => boolean,
+  onProvedPredicate: () => void,
+): boolean {
   if (!body.trim()) return true;
   const materialized = materializeLiteralShell(body)?.command ?? body;
   const parsed = parseStaticShellCommands(materialized);
-  if (!parsed || typeof parsed === "string" || !hasProvedNavigationSequence(materialized))
-    return false;
+  if (!parsed || typeof parsed === "string") {
+    let proved = false;
+    if (
+      hasEnvironmentVariableExpansionRead(body, allowedNames, isPathBlocked, undefined, () => {
+        proved = true;
+      }) ||
+      !proved
+    )
+      return false;
+    onProvedPredicate();
+    return true;
+  }
+  if (!hasProvedNavigationSequence(materialized)) return false;
   if (isStaticHerdrPrompt(materialized)) return true;
   return parsed.pipelines.flat().every((words) => {
     const argv = unwrapProofCommand(words, "\0");
     if (!argv) return false;
     if (argv[0]?.split("/").at(-1) === "env") return false;
     const name = unwrapStaticCommand(argv)[0]?.split("/").at(-1) ?? "";
-    if (isShellWord(name))
+    if (isShellWord(name)) {
+      const nested = literalShellBodies(
+        words.map((word) => "'" + word.replaceAll("'", "'\"'\"'") + "'").join(" "),
+      );
       return (
-        literalShellBodies(
-          words.map((word) => "'" + word.replaceAll("'", "'\"'\"'") + "'").join(" "),
-        ) !== undefined
+        nested !== undefined &&
+        nested.every((inner) =>
+          isProvedLiteralShellBody(inner, allowedNames, isPathBlocked, onProvedPredicate),
+        )
       );
+    }
     return (
       isProvedCwdSubprocessRole(unwrapStaticCommand(argv)) ||
       (name === "bun" && isSafeLocalAssignmentCommand(argv) && !isUnsupportedInlineRuntime(argv)) ||
@@ -2535,7 +2561,9 @@ function hasEnvironmentVariableExpansionRead(
   allowedNames: Set<string>,
   isPathBlocked: (path: string) => boolean,
   onProvedStatus?: (command: string) => void,
+  onProvedPredicate?: () => void,
 ): boolean {
+  const originalCommand = command;
   let heredoc = boundedHeredoc(command);
   while (heredoc) {
     // In an unquoted heredoc, # and quote characters are data, not shell syntax.
@@ -2544,6 +2572,7 @@ function hasEnvironmentVariableExpansionRead(
     heredoc = boundedHeredoc(command);
   }
   if (!command.includes("$") && !command.includes("`")) return false;
+  let predicateSyntaxIntact = command === originalCommand;
   let invalidExpansion = false;
   const assignments = getLeadingLiteralAssignments(command);
   let localIndex = 0;
@@ -2562,6 +2591,7 @@ function hasEnvironmentVariableExpansionRead(
   for (let i = 0; i < command.length; i++) {
     const char = command[i] ?? "";
     if (!quote && char === "#" && !wordStarted) {
+      predicateSyntaxIntact = false;
       while (i + 1 < command.length && command[i + 1] !== "\n") i++;
       continue;
     }
@@ -2810,6 +2840,21 @@ function hasEnvironmentVariableExpansionRead(
   const materialized = normalized.replaceAll("ENVVALUE", "SAFEENVVALUE");
   const blocked = hasSensitiveFileRead(materialized, isPathBlocked);
   if (!blocked && statusCaptures.size) onProvedStatus?.(materialized);
+  // This is a complete command proof, not merely a recursively safe shell body.
+  if (
+    !blocked &&
+    parsed.pipelines.length === 1 &&
+    parsed.pipelines[0]?.length === 1 &&
+    !parsed.redirects.length
+  ) {
+    const argv = unwrapProofCommand(parsed.pipelines[0]?.[0] ?? [], "ENVVALUE");
+    if (argv && isApprovedEnvironmentPredicate(argv) && predicateSyntaxIntact) {
+      // Roles alone cannot prove original shell boundaries or discarded controls.
+      // Brackets are enabled only for the completely proved bracket builtin.
+      const binding = literalBindingText(normalized, "", "", argv[0] === "[");
+      if (binding && !/[;&|<>\r\n]/.test(binding.syntax.trim())) onProvedPredicate?.();
+    }
+  }
   return blocked;
 }
 
@@ -3120,11 +3165,37 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
     const shellBodies = literalShellBodies(command);
     if (!shellBodies || (shellBodies.length && shellDepth >= 8))
       return "cannot prove a bounded literal shell invocation";
+    const provedPredicateShellBodies: string[] = [];
     for (const body of shellBodies) {
       const reason = getDangerousBashReason(body, shellDepth + 1);
       if (reason || getBlockedCliTool(body, true, shellDepth + 1))
         return reason ?? "invokes a blocked CLI from a shell body";
-      if (!isProvedLiteralShellBody(body)) return "cannot prove a closed literal shell body";
+      if (
+        !isProvedLiteralShellBody(body, allowedEnvironmentVariables, isPathBlocked, () => {
+          provedPredicateShellBodies.push(body);
+        })
+      )
+        return "cannot prove a closed literal shell body";
+    }
+    if (provedPredicateShellBodies.length) {
+      const context = parseStaticShellCommands(command);
+      const binding = literalBindingText(command, "", "");
+      const argv =
+        context && typeof context !== "string"
+          ? unwrapProofCommand(context.pipelines[0]?.[0] ?? [], "\0")
+          : undefined;
+      if (
+        !context ||
+        typeof context === "string" ||
+        context.pipelines.length !== 1 ||
+        context.pipelines[0]?.length !== 1 ||
+        context.redirects.length !== 0 ||
+        !binding ||
+        /[;&|<>\r\n]/.test(binding.syntax.trim()) ||
+        !argv ||
+        !SHELL_IDENTITIES.has(argv[0] ?? "")
+      )
+        return "cannot prove a single literal shell predicate invocation";
     }
     const proof = materializeLiteralShell(command);
     if (!proof && /^\s*for\b/.test(command)) return "cannot prove a bounded literal shell loop";
@@ -3169,6 +3240,7 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
         allowedEnvironmentVariables,
         allowPackageInventory,
         shellBodies.filter((body) => {
+          if (provedPredicateShellBodies.includes(body)) return true;
           const parsed = parseStaticShellCommands(body);
           return (
             parsed &&

package/src/gh-tool/main.ts

@@ -36,6 +36,7 @@ import {
   prIssueCommentsCommand,
   prIssueCommentsLatestCommand,
   prCommentCommand,
+  prEditCommentCommand,
   prDiscussionSummaryCommand,
   prFeedbackCommand,
   prReplyCommand,
@@ -108,6 +109,7 @@ const prCommand = Command.make("pr", {}).pipe(
     prIssueCommentsCommand,
     prIssueCommentsLatestCommand,
     prCommentCommand,
+    prEditCommentCommand,
     prDiscussionSummaryCommand,
     prReplyCommand,
     prResolveCommand,
@@ -206,7 +208,7 @@ WORKFLOW FOR AI AGENTS:
   1. Use 'pr view' to inspect current PR
   2. Use 'pr discussion-summary' for overview (counts + latest discussion comment)
   3. Use 'pr threads' and 'pr issue-comments-latest --author <username> --body-contains "Review"' for review context
-  4. Use 'pr reply', 'pr comment' and 'pr resolve' to handle feedback
+  4. Use 'pr reply', 'pr comment', 'pr edit-comment' and 'pr resolve' to handle feedback
   4b. Use 'pr review --event request-changes|approve|comment --confirm' to post a verdict, or 'pr submit-review' for a pending one
   5. Use 'pr checks' to monitor CI status; 'pr trigger-checks --workflow <file.yml>' when zero checks were reported
   6. Use 'pr merge' to merge (dry-run by default)

package/src/gh-tool/pr/commands.ts

@@ -52,6 +52,7 @@ import {
 } from "./core";
 import {
   createReview,
+  editComment,
   fetchComments,
   fetchDiscussionSummary,
   fetchFeedback,
@@ -1306,6 +1307,47 @@ export const prCommentCommand = Command.make(
     ),
 ).pipe(Command.withDescription("Post a general PR discussion comment"));
 
+export const prEditCommentCommand = Command.make(
+  "edit-comment",
+  {
+    body: Flag.String("body").pipe(
+      Flag.withDescription("Updated comment body text"),
+      Flag.optional,
+    ),
+    bodyFile: Flag.String("body-file").pipe(
+      Flag.withDescription("Read updated comment body from a file path or '-' for stdin"),
+      Flag.optional,
+    ),
+    commentId: Flag.Int("comment-id").pipe(Flag.withDescription("ID of the comment to edit")),
+    format: formatOption,
+    kind: Flag.Literals("kind", ["review", "issue"]).pipe(
+      Flag.withDescription("Comment type: inline review comment or PR discussion comment"),
+      Flag.withDefault("review"),
+    ),
+    pr: Flag.Int("pr").pipe(
+      Flag.withDescription("Require the comment to belong to this PR"),
+      Flag.optional,
+    ),
+    repo: repoOption,
+  },
+  ({ body, bodyFile, commentId, format, kind, pr, repo }) =>
+    withRepo(
+      repo,
+      Effect.gen(function* () {
+        const resolvedBody = yield* resolveRequiredTextInput({
+          command: "gh-tool pr edit-comment",
+          value: Option.getOrNull(body),
+          fileValue: Option.getOrNull(bodyFile),
+          valueFlag: "--body",
+          fileFlag: "--body-file",
+          label: "body",
+        });
+        const result = yield* editComment(commentId, resolvedBody, kind, Option.getOrNull(pr));
+        yield* logFormatted(result, format);
+      }),
+    ),
+).pipe(Command.withDescription("Edit your own inline review or PR discussion comment"));
+
 export const prDiscussionSummaryCommand = Command.make(
   "discussion-summary",
   {

package/src/gh-tool/pr/index.ts

@@ -3,6 +3,7 @@ export {
   prChecksFailedCommand,
   prCloseCommand,
   prCommentCommand,
+  prEditCommentCommand,
   prCommentsCommand,
   prCreateCommand,
   prDiscussionSummaryCommand,

package/src/gh-tool/pr/review.ts

@@ -299,6 +299,15 @@ type ReviewCommentById = {
   pull_request_url: string;
 };
 
+type EditableComment = {
+  id: number;
+  user: { login: string };
+  html_url: string;
+  updated_at: string;
+  pull_request_url?: string;
+  issue_url?: string;
+};
+
 const REST_PAGE_SIZE = 100;
 
 const feedbackOrigin = (commitSha: string | null, currentHeadSha: string | null): FeedbackOrigin =>
@@ -801,6 +810,107 @@ const fetchReviewCommentById = Effect.fn("pr.fetchReviewCommentById")(function*
   return comment;
 });
 
+export const editComment = Effect.fn("pr.editComment")(function* (
+  commentId: number,
+  body: string,
+  kind: "review" | "issue",
+  pr: number | null,
+) {
+  const service = yield* GitHubService;
+  const repoInfo = yield* service.getRepoInfo();
+  const command = "gh-tool pr edit-comment";
+  if (
+    !Number.isInteger(commentId) ||
+    commentId <= 0 ||
+    (pr !== null && (!Number.isInteger(pr) || pr <= 0))
+  ) {
+    return yield* Effect.fail(
+      new GitHubCommandError({
+        command,
+        exitCode: 1,
+        stderr: "--comment-id and --pr must be positive integers",
+        message: "--comment-id and --pr must be positive integers",
+        hint: "Pass a positive comment ID and, when supplied, a positive PR number.",
+      }),
+    );
+  }
+  if (body.trim().length === 0) {
+    return yield* Effect.fail(
+      new GitHubCommandError({
+        command,
+        exitCode: 1,
+        stderr: "Comment body cannot be empty",
+        message: "Comment body cannot be empty",
+        hint: "Pass non-empty comment text with --body or --body-file.",
+      }),
+    );
+  }
+
+  const endpoint = `repos/${repoInfo.owner}/${repoInfo.name}/${kind === "review" ? "pulls" : "issues"}/comments/${commentId}`;
+  const target = yield* service.runGhJson<EditableComment>(["api", endpoint]);
+  const viewer = yield* service.runGhJson<{ login: string }>(["api", "user"]);
+  if (target.user.login.toLowerCase() !== viewer.login.toLowerCase()) {
+    return yield* Effect.fail(
+      new GitHubCommandError({
+        command,
+        exitCode: 1,
+        stderr: `Comment ${commentId} was written by ${target.user.login}; only your own comments can be edited`,
+        message: `Comment ${commentId} was written by ${target.user.login}; only your own comments can be edited`,
+        hint: "Edit only comments authored by the authenticated GitHub user.",
+      }),
+    );
+  }
+
+  const commentPrUrl = kind === "review" ? target.pull_request_url : target.issue_url;
+  if (pr !== null && !commentPrUrl?.endsWith(`/${kind === "review" ? "pulls" : "issues"}/${pr}`)) {
+    return yield* Effect.fail(
+      new GitHubCommandError({
+        command,
+        exitCode: 1,
+        stderr: `Comment ${commentId} does not belong to PR #${pr}`,
+        message: `Comment ${commentId} does not belong to PR #${pr}`,
+        hint: "Pass the PR that owns this comment, or omit --pr to edit by comment ID.",
+      }),
+    );
+  }
+  if (kind === "issue" && pr !== null) {
+    const pullRequest = yield* service.runGhJson<{ number: number }>([
+      "api",
+      `repos/${repoInfo.owner}/${repoInfo.name}/pulls/${pr}`,
+    ]);
+    if (pullRequest.number !== pr) {
+      return yield* Effect.fail(
+        new GitHubCommandError({
+          command,
+          exitCode: 1,
+          stderr: `Comment ${commentId} does not belong to PR #${pr}`,
+          message: `Comment ${commentId} does not belong to PR #${pr}`,
+          hint: "Pass the PR that owns this comment, or omit --pr to edit by comment ID.",
+        }),
+      );
+    }
+  }
+
+  const updated = yield* service.runGhJson<EditableComment>([
+    "api",
+    "-X",
+    "PATCH",
+    endpoint,
+    "-f",
+    `body=${body}`,
+  ]);
+  return {
+    commentId: updated.id,
+    url: updated.html_url,
+    updatedAt: updated.updated_at,
+    hint: "The comment was updated.",
+    nextCommand:
+      kind === "review"
+        ? "gh-tool pr comments --pr <number>"
+        : "gh-tool pr issue-comments --pr <number>",
+  };
+});
+
 /**
  * Reply to an inline review comment via REST API.
  */