@brainervirus/workit-core 8.10.0 → 8.12.0

package/src/core/route-intent.ts

@@ -1,37 +1,165 @@
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { inWorkitWorkspace, rawInvocations } from "../hooks/raw-git";
+import type { ShellDialect } from "../hooks/shell-words";
 import { validateBranchNameFor, type BranchNamePolicyCheck } from "./branch";
 
-// ponytail: recognize direct literal Git forms only; expand coverage if users need shell AST support.
-export const shellBranchTarget = (command: string): string | null => {
-  if (
-    !command.trim() ||
-    /[\r\n;&|<>`'"$()\\*?{}~!#]/u.test(command) ||
-    command.includes("[") ||
-    command.includes("]")
-  )
-    return null;
-
-  const args = command.trim().split(/\s+/u);
-  if (args[0] !== "git") return null;
-  const option = args[2];
+/** A name a shell cannot settle before running (`$X`, `` `cmd` ``): never judged. */
+const UNKNOWABLE = /[$`*?[\]{}~]/u;
+
+const SWITCH_CREATE = new Set(["-c", "--create", "-C", "--force-create", "--orphan"]);
+const CHECKOUT_CREATE = new Set(["-b", "-B", "--orphan"]);
+const WORKTREE_CREATE = new Set(["-b", "-B"]);
+/** `git branch` options that list, delete or configure: no branch is created. */
+const BRANCH_NO_CREATE = new Set(
+  ["-d", "-D", "--delete", "-l", "--list", "-a", "--all", "-r", "--remotes", "--show-current"]
+    .concat(["-v", "-vv", "--verbose", "--contains", "--no-contains", "--merged", "--no-merged"])
+    .concat(["--points-at", "--sort", "--format", "--column", "--no-column", "-u"])
+    .concat(["--set-upstream-to", "--unset-upstream", "--edit-description", "-i", "--ignore-case"]),
+);
+/** `git branch -m|-c [<old>] <new>`: a rename or copy creates `<new>`. */
+const BRANCH_RENAME = new Set(["-m", "-M", "--move", "-c", "-C", "--copy"]);
+
+/** The value of `flag` in `args` (`-c x`, `-cx`, `--create=x`), or null. */
+const flagValue = (args: readonly string[], flags: ReadonlySet<string>): string | null => {
+  for (let index = 1; index < args.length; index++) {
+    const arg = args[index];
+    if (arg === "--") return null;
+    if (flags.has(arg)) return args[index + 1] ?? null;
+    const eq = arg.indexOf("=");
+    if (arg.startsWith("--") && eq > 0 && flags.has(arg.slice(0, eq))) return arg.slice(eq + 1);
+    // An attached short value: `-cchore/x`.
+    if (!arg.startsWith("--") && arg.length > 2 && flags.has(arg.slice(0, 2))) return arg.slice(2);
+  }
+  return null;
+};
+
+/** `git worktree add` options that take a value. */
+const WORKTREE_VALUES = new Set(["--reason"]);
+
+/**
+ * `git worktree add [-b|-B <b>] <path> [<commit-ish>]`: the -b name, or, with
+ * only a path (no -b, -B, --detach or commit-ish), the branch git names after
+ * the path's last component.
+ */
+const worktreeTarget = (args: readonly string[]): string | null => {
+  const named = flagValue(args, WORKTREE_CREATE);
+  if (named !== null) return named;
+  const positionals: string[] = [];
+  for (let index = 1; index < args.length; index++) {
+    const arg = args[index];
+    if (arg === "--detach" || arg === "-d") return null;
+    if (WORKTREE_VALUES.has(arg)) index++;
+    else if (!arg.startsWith("-")) positionals.push(arg);
+  }
+  if (positionals.length !== 1) return null;
+  const base = positionals[0].split(/[\\/]/u).findLast(Boolean) ?? "";
+  return base && base !== "." && base !== ".." ? base : null;
+};
+
+/** The branch `git branch …` creates (plain, rename or copy), or null. */
+const branchCommandTarget = (args: readonly string[]): string | null => {
+  let rename = false;
+  const positionals: string[] = [];
+  for (let index = 1; index < args.length; index++) {
+    const arg = args[index];
+    if (arg === "--") {
+      positionals.push(...args.slice(index + 1));
+      break;
+    }
+    const flag = arg.split("=", 1)[0];
+    if (BRANCH_NO_CREATE.has(flag)) return null;
+    if (BRANCH_RENAME.has(flag)) rename = true;
+    else if (!arg.startsWith("-")) positionals.push(arg);
+  }
+  if (positionals.length < 1 || positionals.length > 2) return null;
+  return rename ? (positionals.at(-1) ?? null) : positionals[0];
+};
+
+/**
+ * The branch one git invocation creates: `switch -c|-C|--create <b>`,
+ * `checkout -b|-B <b>`, `branch [-m|-c] <b> [start]` and `worktree add -b|-B
+ * <b>`, wherever the option stands. `args` start at the subcommand (after
+ * git's global options). Null when it creates none.
+ */
+export const gitBranchCreation = (args: readonly string[]): string | null => {
+  const [sub, second] = args;
   const target =
-    args[1] === "switch" &&
-    ["-c", "--create", "-C", "--force-create"].includes(option ?? "") &&
-    (args.length === 4 || args.length === 5)
-      ? args[3]
-      : args[1] === "checkout" &&
-          ["-b", "-B"].includes(option ?? "") &&
-          (args.length === 4 || args.length === 5)
-        ? args[3]
-        : args[1] === "branch" && (args.length === 3 || args.length === 4)
-          ? args[2]
-          : null;
-  return target && !target.startsWith("-") ? target : null;
+    sub === "switch"
+      ? flagValue(args, SWITCH_CREATE)
+      : sub === "checkout"
+        ? flagValue(args, CHECKOUT_CREATE)
+        : sub === "branch"
+          ? branchCommandTarget(args)
+          : sub === "worktree" && second === "add"
+            ? worktreeTarget(args.slice(1))
+            : null;
+  return target && !target.startsWith("-") && !UNKNOWABLE.test(target) ? target : null;
+};
+
+export type ShellBranchTarget = {
+  branch: string;
+  /** The directory git runs in, relative to the hook's cwd; undefined when unknowable. */
+  dir: string | null | undefined;
+};
+
+/**
+ * Every branch a shell command creates, through the raw-git tokenizer: `&&`,
+ * `;` and `|` chains, `cd`/`pushd` and `git -C`, env prefixes and wrappers,
+ * quoted names and `bash -c` scripts.
+ */
+export const shellBranchTargets = (
+  command: string,
+  dialect: ShellDialect = "posix",
+): ShellBranchTarget[] => {
+  if (!/\bgit\b/u.test(command)) return [];
+  const found: ShellBranchTarget[] = [];
+  for (const invocation of rawInvocations(command, dialect)) {
+    if (invocation.tool !== "git") continue;
+    const branch = gitBranchCreation(invocation.args);
+    if (branch) found.push({ branch, dir: invocation.dir });
+  }
+  return found;
 };
 
+/** The first branch a shell command creates, or null. */
+export const shellBranchTarget = (command: string): string | null =>
+  shellBranchTargets(command)[0]?.branch ?? null;
+
+/** The branch already exists in `dir`: resetting or checking it out is not a new name. */
+const localBranchExists = (dir: string, branch: string): boolean =>
+  spawnSync("git", ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`], {
+    cwd: dir,
+    stdio: "ignore",
+    timeout: 5_000,
+  }).status === 0;
+
+/**
+ * The branch policy verdict for every new branch a shell command creates,
+ * each checked in the directory git runs in (a linked worktree resolves to
+ * its main checkout's workspace). A command that runs in the hook's cwd is
+ * judged there. One that changes directory is judged only when that
+ * directory is known, already exists and is in a Workit workspace: a scratch
+ * repository (`cd "$(mktemp -d)"`, `git init x && cd x`, a fresh clone) is
+ * not the cwd workspace's business. A name that already exists locally is
+ * skipped (`git branch -f legacy HEAD`). Null when no new branch is judged;
+ * the first violation otherwise.
+ */
 export const shellBranchPolicyViolation = (
   root: string,
   command: string,
+  dialect: ShellDialect = "posix",
 ): BranchNamePolicyCheck | null => {
-  const target = shellBranchTarget(command);
-  return target === null ? null : validateBranchNameFor(root, target);
+  let judged = false;
+  for (const target of shellBranchTargets(command, dialect)) {
+    if (target.dir === undefined) continue;
+    const dir = target.dir === null ? root : path.resolve(root, target.dir);
+    if (target.dir !== null && (!existsSync(dir) || !inWorkitWorkspace(dir))) continue;
+    if (localBranchExists(dir, target.branch)) continue;
+    judged = true;
+    const check = validateBranchNameFor(dir, target.branch);
+    if (!check.ok) return check;
+  }
+  return judged ? { ok: true } : null;
 };

package/src/core/workspaces.ts

@@ -143,6 +143,12 @@ const workspaceConfigSchema = z
     defaultEndpoint: z.unknown().optional(),
     /** How a normal-risk behavior change is verified (S17); same rules as grants. */
     verification: z.enum(["self", "independent"]).optional(),
+    /**
+     * Whether commits get the `Workit-Session:` trailer (default true). With
+     * `false`, `workit git commit` and the session hook write none and
+     * authorship lives in the ledger only (`commit.recorded`).
+     */
+    trailers: z.boolean().optional(),
     /** Autonomy grants (D15): only ever set here, by the user. */
     autonomy: z
       .object(
@@ -633,8 +639,14 @@ const runtimeWorkspaceIndexSchema = z
 /** The workspaces.json entry matching cwd, checked only for name/glob (D17). */
 const matchRuntimeWorkspace = (
   cwd: string,
-): { file: string; selected: Record<string, unknown> & { name: string } } | null => {
-  const file = path.join(configDir(), "workspaces.json");
+  dir: string = configDir(),
+): {
+  file: string;
+  selected: Record<string, unknown> & { name: string };
+  /** Every entry whose glob matches cwd, the selected one included. */
+  matches: Array<Record<string, unknown> & { name: string; glob: string }>;
+} | null => {
+  const file = path.join(dir, "workspaces.json");
   let raw: string;
   try {
     raw = readFileSync(file, "utf8");
@@ -666,7 +678,7 @@ const matchRuntimeWorkspace = (
   const matches = matchingEntries(cwd, entries ?? []);
   const workspaceName = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
   const selected = selectWorkspaceMatch(matches, cwd, workspaceName);
-  return selected ? { file, selected } : null;
+  return selected ? { file, selected, matches } : null;
 };
 
 /**
@@ -683,6 +695,37 @@ export const resolveRuntimeReleaseTracks = (
     : null;
 };
 
+/**
+ * Whether commits in cwd's workspace carry the `Workit-Session:` trailer.
+ * The selected workspace's own `trailers` wins; unset, it inherits from the
+ * nearest enclosing workspace that also matches cwd (a repo workspace nested
+ * in `work`), and defaults to true. Read leniently: no workspace, or an
+ * unreadable workspaces.json, keeps the trailer. `from` names the entry the
+ * value came from (null for the default).
+ */
+export const workspaceTrailers = (
+  cwd: string,
+  dir?: string,
+): { enabled: boolean; workspace: string | null; from: string | null } => {
+  let matched: ReturnType<typeof matchRuntimeWorkspace>;
+  try {
+    matched = matchRuntimeWorkspace(cwd, dir);
+  } catch {
+    return { enabled: true, workspace: null, from: null };
+  }
+  if (!matched) return { enabled: true, workspace: null, from: null };
+  const { selected, matches } = matched;
+  const enclosing = matches
+    .filter((entry) => entry !== selected)
+    .toSorted((a, b) => globSpecificity(b.glob) - globSpecificity(a.glob));
+  const source = [selected, ...enclosing].find((entry) => typeof entry.trailers === "boolean");
+  return {
+    enabled: source?.trailers !== false,
+    workspace: selected.name,
+    from: source?.name ?? null,
+  };
+};
+
 const resolveRuntimeWorkspaceCandidate = (
   cwd: string,
   kind: RuntimeWorkspacePolicy,

package/src/fanout-brief.ts

@@ -7,6 +7,10 @@
 // `<branch>-try<n>` (refused when another slice has that branch), worktree
 // `<worktree>+try<n>` and session `<lead>-w-<slice>+try<n>`: slice ids cannot
 // contain `+`, so no attempt collides with another slice's path or session.
+// The lead's host (WORKIT_HOST, or its own session variable) picks the identity
+// and git rules: Claude Code workers use the WORKIT_SESSION_ID in their env (the lead's: SubagentStart issues ids only to judges) and plain
+// git; OpenCode, Pi and Codex workers export nothing (the host derives the id);
+// Cursor, CI and plain terminals export `<lead>-w-<slice>`.
 // The lead must have a WORKIT_SESSION_ID: worker ids derive from it. A
 // worker id longer than the ledger's 128 characters hashes its slice part. The fan-in line follows the plan's `fanIn`:
 // one PR per slice forbids every merge; integration mode has the worker merge
@@ -36,7 +40,8 @@ export type BriefOutcome = {
   tier: string;
   /** Absolute when the slice's worktree exists, else relative to the worker's worktree root. */
   scratch: string;
-  session: string;
+  /** The id a worker exports, or null when its host issues or derives it. */
+  session: string | null;
   standing: Array<{ id: string; what: string }>;
   text: string;
 };
@@ -49,15 +54,61 @@ const REPORT = [
   "  anything out of scope as a follow-up, not a diff.",
 ];
 
-const rules = (mode: BriefMode, branch: string, base: string): string[] => [
-  "RULES:",
-  mode === "new"
-    ? `  1. First command: \`workit git branch ${branch} --base ${base}\` (your worktree may start on another name).`
-    : `  1. First command: \`git switch ${branch}\`, then continue from its head.`,
-  '  2. Decide ambiguities yourself: `workit ledger ruling "<what>" --why "<why>" --cost-if-wrong "<cost>"`; stop only for an irreversible, security-sensitive or out-of-worktree action.',
-  "  3. Commit with `workit git commit -m <msg> -- <paths in SCOPE>`; push only if this brief says so.",
-  "  4. Never record a verdict on your own work.",
-];
+/**
+ * How a worker's identity is settled on the lead's host (host-session.ts,
+ * docs/agents/hosts.md):
+ *   - `issued`: Claude Code. SubagentStart issues ids only to verifiers and
+ *     reviewers, so an implementer keeps the lead's WORKIT_SESSION_ID from its
+ *     env; worktree isolation refuses every `workit git` form, so it uses
+ *     plain git and never mints an id;
+ *   - `derived`: OpenCode, Pi, Codex. The worker's shell carries the host's own
+ *     session id, which exporting WORKIT_SESSION_ID cannot replace;
+ *   - `declared`: Cursor, CI, a plain terminal. Nothing vouches for an id, so
+ *     the brief declares `<lead>-w-<slice>`.
+ */
+export type BriefIdentity = "issued" | "derived" | "declared";
+
+const identityOf = (host: string | null): BriefIdentity => {
+  const family = host?.replace(/_(?:cli|desktop)$/, "") ?? "";
+  if (family === "claude_code") return "issued";
+  if (family === "opencode" || family === "pi" || family === "codex") return "derived";
+  return "declared";
+};
+
+const identityLines = (identity: BriefIdentity, session: string): string[] => {
+  if (identity === "issued")
+    return [
+      "  Session: your env already has WORKIT_SESSION_ID (the lead's id; SubagentStart issues ids only to verifiers and reviewers). Use it as is, in your Workit-Session trailer and workit commands; never export or hand-mint one.",
+    ];
+  if (identity === "derived")
+    return [
+      "  Session: your host already sets WORKIT_SESSION_ID in your shell; export nothing and never hand-mint one.",
+    ];
+  return [`  export WORKIT_SESSION_ID=${session}`];
+};
+
+const rules = (
+  identity: BriefIdentity,
+  mode: BriefMode,
+  branch: string,
+  base: string,
+): string[] => {
+  const plain = identity === "issued";
+  let first = `  1. First command: \`workit git branch ${branch} --base ${base}\` (your worktree may start on another name).`;
+  if (mode === "resume")
+    first = `  1. First command: \`git switch ${branch}\`, then continue from its head.`;
+  else if (plain)
+    first = `  1. First command: \`git fetch origin && git switch -c ${branch} origin/${base}\` (plain git: worktree isolation refuses every \`workit git\` form).`;
+  return [
+    "RULES:",
+    first,
+    '  2. Decide ambiguities yourself: `workit ledger ruling "<what>" --why "<why>" --cost-if-wrong "<cost>"`; stop only for an irreversible, security-sensitive or out-of-worktree action.',
+    plain
+      ? '  3. Commit with plain `git commit -m <msg> --trailer "Workit-Session: <the WORKIT_SESSION_ID in your env>" --trailer "<your host attribution trailer>" -- <paths in SCOPE>`; push only if this brief says so.'
+      : "  3. Commit with `workit git commit -m <msg> -- <paths in SCOPE>`; push only if this brief says so.",
+    "  4. Never record a verdict on your own work.",
+  ];
+};
 
 /** A session id fragment that the ledger accepts ([A-Za-z0-9_.:@/+-]). */
 const sessionSafe = (text: string): string => text.replace(/[^A-Za-z0-9_.:@/+-]/gu, "-");
@@ -119,7 +170,9 @@ export function renderBrief(
     id: row.id,
     what: String(row.what),
   }));
-  const session = workerSession(sessionSafe(input.actor.session), slice.id, input.attempt);
+  const identity = identityOf(input.actor.host);
+  const minted = workerSession(sessionSafe(input.actor.session), slice.id, input.attempt);
+  const session = identity === "declared" ? minted : null;
   const fanIn =
     plan.fanIn === "integration"
       ? [
@@ -156,8 +209,8 @@ export function renderBrief(
     ...(standing.length
       ? standing.map((order) => `  - ${order.what}`)
       : ["  - none recorded beyond this brief"]),
-    `  export WORKIT_SESSION_ID=${session}`,
-    ...rules(mode, branch, slice.base),
+    ...identityLines(identity, minted),
+    ...rules(identity, mode, branch, slice.base),
   ];
   return {
     ok: true,

package/src/forge/exec.ts

@@ -31,6 +31,8 @@ export type ForgeRunner = (
     timeoutMs: number;
     /** Credential for this call (GH_TOKEN / GITLAB_TOKEN); never logged. */
     token?: string;
+    /** Written to stdin (a JSON body for `api --input -`); argv has a size limit. */
+    input?: string;
   },
 ) => CliRun;
 
@@ -90,7 +92,9 @@ export function systemRunner(
       timeout: options.timeoutMs,
       killSignal: "SIGKILL",
       windowsHide: true,
-      stdio: ["ignore", "pipe", "pipe"],
+      ...(options.input === undefined
+        ? { stdio: ["ignore", "pipe", "pipe"] as const }
+        : { input: options.input, stdio: ["pipe", "pipe", "pipe"] as const }),
     });
     const error: NodeJS.ErrnoException | undefined = result.error;
     return {
@@ -248,8 +252,10 @@ export function apiWrite<T>(
   args: readonly string[],
   what: string,
   timeoutMs: number = FORGE_TIMEOUTS.api,
+  /** A request body sent on stdin (pair it with `--input -`). */
+  input?: string,
 ): ForgeResult<T> {
-  const run = runner(bin, args, { timeoutMs });
+  const run = runner(bin, args, input === undefined ? { timeoutMs } : { timeoutMs, input });
   if (run.status !== 0) {
     const text = redactText(`${run.stderr}\n${run.stdout}`).trim();
     const reason = forgeReason(run);

package/src/forge/github.ts

@@ -27,7 +27,7 @@ const CONTEXTS = `contexts(first: 100, after: $contexts) { pageInfo { hasNextPag
 
 export const PR_STATUS_QUERY = `query($owner: String!, $name: String!, $number: Int!, $threads: String, $contexts: String) { repository(owner: $owner, name: $name) { pullRequest(number: $number) { ${PR_FIELDS} ${THREADS} commits(last: 1) { nodes { commit { oid statusCheckRollup { state ${CONTEXTS} } } } } } } }`;
 
-export const FIND_PR_QUERY = `query($owner: String!, $name: String!, $head: String!) { repository(owner: $owner, name: $name) { pullRequests(headRefName: $head, first: 20, orderBy: { field: CREATED_AT, direction: DESC }) { nodes { number url state headRefName headRefOid headRepositoryOwner { login } } } } }`;
+export const FIND_PR_QUERY = `query($owner: String!, $name: String!, $head: String!) { repository(owner: $owner, name: $name) { pullRequests(headRefName: $head, first: 20, orderBy: { field: CREATED_AT, direction: DESC }) { nodes { number url state baseRefName headRefName headRefOid headRepositoryOwner { login } } } } }`;
 
 const READY_MUTATION = `mutation($id: ID!) { markPullRequestReadyForReview(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`;
 const DRAFT_MUTATION = `mutation($id: ID!) { convertPullRequestToDraft(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`;
@@ -351,6 +351,7 @@ export function createGitHubForge(options: {
               number: number;
               url: string;
               state: string;
+              baseRefName?: string;
               headRefName: string;
               headRefOid: string | null;
               headRepositoryOwner: { login: string } | null;
@@ -365,11 +366,21 @@ export function createGitHubForge(options: {
       const ours = nodes.filter(
         (node) =>
           node.headRefName === head &&
+          (!match.base || node.baseRefName === undefined || node.baseRefName === match.base) &&
           ((match.owner !== null &&
             node.headRepositoryOwner?.login.toLowerCase() === match.owner.toLowerCase()) ||
             (match.sha !== null && node.headRefOid === match.sha)),
       );
-      const pick = ours.find((node) => node.state === "OPEN") ?? ours[0];
+      const open = ours.filter((node) => node.state === "OPEN");
+      // No base named and open PRs into several bases (a git-flow release
+      // into main and its back-merge into develop): never guess.
+      if (!match.base && new Set(open.map((node) => node.baseRefName)).size > 1)
+        return failure(
+          "blocked",
+          `ambiguous_pr: ${head} has open pull requests ${open.map((node) => `#${node.number} -> ${node.baseRefName}`).join(", ")}`,
+          `pass --pr <n>, e.g. --pr ${open[0].number}`,
+        );
+      const pick = open[0] ?? ours[0];
       if (!pick) return success(null);
       const ref: PrRef = {
         number: pick.number,
@@ -517,6 +528,7 @@ export function createGitHubForge(options: {
     },
 
     merge(number, mergeOptions) {
+      const squash = mergeOptions.method === "squash" ? mergeOptions.squashMessage : undefined;
       // sha= is GitHub's atomic head guard: 409 when the head moved.
       const merged = apiWrite<{ sha?: string; merged?: boolean; message?: string }>(
         runner,
@@ -527,12 +539,21 @@ export function createGitHubForge(options: {
           "-X",
           "PUT",
           `repos/${repo}/pulls/${number}/merge`,
-          "-f",
-          `sha=${mergeOptions.sha}`,
-          "-f",
-          `merge_method=${mergeOptions.method}`,
+          ...(squash
+            ? ["--input", "-"]
+            : ["-f", `sha=${mergeOptions.sha}`, "-f", `merge_method=${mergeOptions.method}`]),
         ],
         `merge of pull request #${number}`,
+        undefined,
+        // The squash message rides stdin: argv has a size limit (E2BIG).
+        squash
+          ? JSON.stringify({
+              sha: mergeOptions.sha,
+              merge_method: mergeOptions.method,
+              commit_title: squash.subject,
+              commit_message: squash.body,
+            })
+          : undefined,
       );
       if (!merged.ok) return merged;
       if (merged.data.merged === false)

package/src/forge/gitlab.ts

@@ -327,10 +327,18 @@ export function createGitLabForge(options: {
       const matches = list.data.filter(
         (mr) =>
           mr.source_branch === head &&
+          (!match.base || mr.target_branch === undefined || mr.target_branch === match.base) &&
           ((match.projectId !== null && mr.source_project_id === match.projectId) ||
             (match.sha !== null && mr.sha === match.sha)),
       );
-      const pick = matches.find((mr) => mr.state === "opened") ?? matches[0];
+      const open = matches.filter((mr) => mr.state === "opened");
+      if (!match.base && new Set(open.map((mr) => mr.target_branch)).size > 1)
+        return failure(
+          "blocked",
+          `ambiguous_pr: ${head} has open merge requests ${open.map((mr) => `!${mr.iid} -> ${mr.target_branch}`).join(", ")}`,
+          `pass --pr <n>, e.g. --pr ${open[0].iid}`,
+        );
+      const pick = open[0] ?? matches[0];
       return success(
         pick
           ? {
@@ -548,6 +556,7 @@ export function createGitLabForge(options: {
     },
 
     merge(iid, mergeOptions) {
+      const squash = mergeOptions.method === "squash" ? mergeOptions.squashMessage : undefined;
       // GitLab's merge method is a project setting; squash is per request.
       if (mergeOptions.method === "rebase")
         return failure(
@@ -565,12 +574,27 @@ export function createGitLabForge(options: {
           "-X",
           "PUT",
           `${project}/merge_requests/${iid}/merge`,
-          "-f",
-          `sha=${mergeOptions.sha}`,
-          "-F",
-          `squash=${mergeOptions.method === "squash" ? "true" : "false"}`,
+          ...(squash
+            ? ["--input", "-"]
+            : [
+                "-f",
+                `sha=${mergeOptions.sha}`,
+                "-F",
+                `squash=${mergeOptions.method === "squash" ? "true" : "false"}`,
+              ]),
         ],
         `merge of merge request !${iid}`,
+        undefined,
+        // The squash message rides stdin: argv has a size limit (E2BIG).
+        squash
+          ? JSON.stringify({
+              sha: mergeOptions.sha,
+              squash: true,
+              squash_commit_message: squash.body
+                ? `${squash.subject}\n\n${squash.body}`
+                : squash.subject,
+            })
+          : undefined,
       );
       if (!merged.ok) return merged;
       const value = merged.data;