@dadado/agent-kit-cli 6.3.0 → 6.4.0

package/dist/{chunk-YRFSTHR5.js → chunk-XEEB4YSA.js}

@@ -1,7 +1,13 @@
+import {
+  DRIVER_PROTOCOL_VERSION,
+  DriverAgentSink,
+  createDriverAnswerReader,
+  createDriverEmitter
+} from "./chunk-MWTXI6C5.js";
 import {
   classifyGateExit,
   landGateExit
-} from "./chunk-KVY425NM.js";
+} from "./chunk-TZ5XYIEF.js";
 import {
   InputLine,
   ScrollRegion,
@@ -14,16 +20,17 @@ import {
   parsePlanFrontmatter
 } from "./chunk-L5V3W3DY.js";
 import {
-  LineSplitter,
   RedactingStreamBuffer,
   claudeRedactions,
-  formatHitlGateLine,
-  formatHitlSummary,
-  operatorQuitStop,
   parseStreamLine,
   redactSecrets,
   renderStreamEvent
-} from "./chunk-JEI6HACW.js";
+} from "./chunk-NJVWTROP.js";
+import {
+  LineSplitter,
+  formatHitlSummary,
+  operatorQuitStop
+} from "./chunk-IRTS7WEA.js";
 import {
   TtySpinner,
   shouldUseVisualMotion,
@@ -491,218 +498,6 @@ async function withLiveTui(opts, run) {
   }
 }
 
-// src/plan-loop/driver-events.ts
-import { createInterface } from "readline";
-import { StringDecoder as StringDecoder2 } from "string_decoder";
-var DRIVER_PROTOCOL_MAJOR = 1;
-var DRIVER_PROTOCOL_VERSION = "1.1.0";
-var DRIVER_EVENTS_FORMATS = ["ndjson"];
-var INBOUND_MAX_CHARS = 64 * 1024;
-var AGENT_PENDING_MAX_CHARS = 4 * 1024 * 1024;
-function formatDriverEvent(event, now = () => /* @__PURE__ */ new Date()) {
-  return `${JSON.stringify({ v: DRIVER_PROTOCOL_MAJOR, ts: now().toISOString(), ...event })}
-`;
-}
-function createDriverEmitter(write = (text) => {
-  process.stdout.write(text);
-}, now) {
-  return {
-    emit(event) {
-      try {
-        write(formatDriverEvent(event, now));
-      } catch {
-      }
-    }
-  };
-}
-function parseDriverInbound(line) {
-  const text = line.trim();
-  if (text.length > INBOUND_MAX_CHARS) return { ok: false, error: "line too long" };
-  let value;
-  try {
-    value = JSON.parse(text);
-  } catch {
-    return { ok: false, error: "not JSON" };
-  }
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    return { ok: false, error: "not a JSON object" };
-  }
-  const msg = value;
-  if (msg.v !== void 0 && msg.v !== DRIVER_PROTOCOL_MAJOR) {
-    return { ok: false, error: `unsupported protocol v${String(msg.v)}` };
-  }
-  if (msg.type === "stop") {
-    return {
-      ok: true,
-      message: { type: "stop", ...typeof msg.reason === "string" ? { reason: msg.reason } : {} }
-    };
-  }
-  if (msg.type !== "hitl_reply")
-    return { ok: false, error: `unknown type ${JSON.stringify(msg.type)}` };
-  if (typeof msg.askId !== "string" || !/^[a-z0-9-]+$/.test(msg.askId)) {
-    return { ok: false, error: "hitl_reply.askId must be a kebab-case string" };
-  }
-  if (typeof msg.reply === "number") {
-    if (!Number.isInteger(msg.reply) || msg.reply < 1) {
-      return { ok: false, error: "hitl_reply.reply number must be a positive integer" };
-    }
-    return { ok: true, message: { type: "hitl_reply", askId: msg.askId, reply: msg.reply } };
-  }
-  if (typeof msg.reply === "string" && msg.reply.trim() && !/[\r\n]/.test(msg.reply)) {
-    return { ok: true, message: { type: "hitl_reply", askId: msg.askId, reply: msg.reply.trim() } };
-  }
-  return { ok: false, error: "hitl_reply.reply must be a number or a one-line non-empty string" };
-}
-function inboundToRawAnswer(gate, parsed) {
-  if (!parsed.ok) return { kind: "stop", cause: "protocol error", detail: parsed.error };
-  const message = parsed.message;
-  if (message.type === "stop") return { kind: "stop", cause: "driver stop" };
-  if (message.askId !== gate.askId) {
-    return {
-      kind: "stop",
-      cause: "protocol error",
-      detail: `reply for ${message.askId} while gate ${gate.askId} is open`
-    };
-  }
-  return { kind: "line", text: String(message.reply) };
-}
-function createDriverAnswerReader(opts) {
-  const input = opts.input ?? process.stdin;
-  const queue = [];
-  let ended = false;
-  let waiter = null;
-  let rl = null;
-  const ensure = () => {
-    if (rl) return;
-    rl = createInterface({ input, terminal: false, crlfDelay: Number.POSITIVE_INFINITY });
-    rl.on("line", (line) => {
-      if (!line.trim()) return;
-      if (waiter) {
-        const w = waiter;
-        waiter = null;
-        w(line);
-      } else queue.push(line);
-    });
-    rl.on("close", () => {
-      ended = true;
-      if (waiter) {
-        const w = waiter;
-        waiter = null;
-        w(null);
-      }
-    });
-  };
-  const nextLine = (signal) => new Promise((resolve) => {
-    const queued = queue.shift();
-    if (queued !== void 0) {
-      resolve(queued);
-      return;
-    }
-    if (ended) {
-      resolve(null);
-      return;
-    }
-    const onAbort = () => {
-      if (waiter === settle) waiter = null;
-      resolve(null);
-    };
-    const settle = (line) => {
-      signal?.removeEventListener("abort", onAbort);
-      resolve(line);
-    };
-    if (signal?.aborted) {
-      resolve(null);
-      return;
-    }
-    signal?.addEventListener("abort", onAbort, { once: true });
-    waiter = settle;
-  });
-  return {
-    read: async (gate, readOpts) => {
-      ensure();
-      opts.emitter.emit({
-        type: "hitl_gate",
-        tick: opts.tick(),
-        askId: gate.askId,
-        labels: [...gate.labels],
-        detection: gate.detection,
-        line: formatHitlGateLine(gate)
-      });
-      const line = await nextLine(readOpts.signal);
-      if (line === null) return { kind: "eof" };
-      return inboundToRawAnswer(gate, parseDriverInbound(line));
-    },
-    close: () => {
-      const r = rl;
-      rl = null;
-      r?.close();
-      if (typeof input.pause === "function") {
-        input.pause();
-      }
-    }
-  };
-}
-var DriverAgentSink = class {
-  constructor(emitter, tick) {
-    this.emitter = emitter;
-    this.tick = tick;
-  }
-  emitter;
-  tick;
-  pending = "";
-  dropped = false;
-  decoder = new StringDecoder2("utf8");
-  feed(chunk) {
-    try {
-      const text = typeof chunk === "string" ? chunk : this.decoder.write(chunk);
-      if (!text) return;
-      const lines = (this.pending + text).split("\n");
-      this.pending = lines.pop() ?? "";
-      for (const line of lines) {
-        if (this.dropped) {
-          this.dropped = false;
-          continue;
-        }
-        this.take(line);
-      }
-      if (this.pending.length > AGENT_PENDING_MAX_CHARS) {
-        this.pending = "";
-        this.dropped = true;
-      }
-    } catch {
-    }
-  }
-  end() {
-    try {
-      const rest = this.pending + this.decoder.end();
-      this.pending = "";
-      if (rest && !this.dropped) this.take(rest);
-      this.dropped = false;
-    } catch {
-    }
-  }
-  take(raw) {
-    const line = raw.replace(/\r$/, "");
-    if (!line.trim()) return;
-    const trimmed = line.trim();
-    if (trimmed.startsWith("{")) {
-      try {
-        const event = JSON.parse(trimmed);
-        if (typeof event === "object" && event !== null && !Array.isArray(event)) {
-          this.emitter.emit({
-            type: "agent_event",
-            tick: this.tick,
-            event
-          });
-          return;
-        }
-      } catch {
-      }
-    }
-    this.emitter.emit({ type: "agent_text", tick: this.tick, text: line });
-  }
-};
-
 // src/plan-loop/run-loop.ts
 import { readFile as readFile4, rm, unlink } from "fs/promises";
 import path5 from "path";
@@ -1525,6 +1320,5 @@ async function runPlanLoop(opts) {
 export {
   shouldUseLiveTui,
   withLiveTui,
-  DRIVER_EVENTS_FORMATS,
   runPlanLoop
 };

package/dist/{chunk-QTBTKEXK.js → chunk-ZPZVROS5.js}

@@ -1,6 +1,6 @@
 import {
   gateExitNotePath
-} from "./chunk-KVY425NM.js";
+} from "./chunk-TZ5XYIEF.js";
 
 // src/plan-loop/merge-detect.ts
 async function isAncestor(git, ref, baseRef) {

package/dist/{contribute-NLM2BN6Z.js → contribute-PP7HMPW7.js}

@@ -1,18 +1,18 @@
 import {
   REGISTRY_CLI_ARGS,
   resolveRegistryFromCli
-} from "./chunk-U26MRIWN.js";
+} from "./chunk-H46W7NHC.js";
 import {
   logger
 } from "./chunk-ZB43YMHW.js";
 import {
   managedPairs
-} from "./chunk-25J2SMJQ.js";
+} from "./chunk-E465FAWM.js";
 import {
   loadAgentKitManifest,
   normalizeRelPath,
   resolveContained
-} from "./chunk-6KUSG7BJ.js";
+} from "./chunk-7BEHUBEJ.js";
 import "./chunk-C4Q77GGJ.js";
 import "./chunk-5B4DVO6C.js";
 

package/dist/{countdown-QXJD6TDB.js → countdown-LAUZMI7U.js}

@@ -4,12 +4,12 @@ import {
   REVIEW_PACK_SLASH,
   parseReviewPackMaxBytes,
   reviewBackendMessage
-} from "./chunk-MO63KZBP.js";
+} from "./chunk-KX3OUY4W.js";
 import {
   detectAgentBackend,
   listDetectBackendIds
-} from "./chunk-GUQYNUV4.js";
-import "./chunk-QTBTKEXK.js";
+} from "./chunk-R7DA4KXG.js";
+import "./chunk-ZPZVROS5.js";
 import {
   GATE_EXIT_MARKER_RELPATH,
   defaultExec,
@@ -20,23 +20,25 @@ import {
   readGateExitMarker,
   resolveGateExitRefs,
   writeGateExitMarker
-} from "./chunk-KVY425NM.js";
+} from "./chunk-TZ5XYIEF.js";
 import "./chunk-MUTTNRX4.js";
 import {
   classifySlash,
   normalizeSlashName,
   promoteBlockedMessage,
   unknownSlashMessage
-} from "./chunk-Z7ABX5QI.js";
+} from "./chunk-WOHZ4T5V.js";
 import {
   CLAUDE_MAX_BUDGET_USD_ENV,
   CLAUDE_MAX_TURNS_ENV,
-  HITL_UNANSWERED_EXIT_CODE,
   RedactingStreamBuffer,
   redactSecrets
-} from "./chunk-JEI6HACW.js";
+} from "./chunk-NJVWTROP.js";
+import {
+  HITL_UNANSWERED_EXIT_CODE
+} from "./chunk-IRTS7WEA.js";
 import "./chunk-WGLPZXNU.js";
-import "./chunk-MAPOQEA2.js";
+import "./chunk-6RRG3WOE.js";
 import "./chunk-QTON2GQX.js";
 import {
   logger

package/dist/{diff-HHG4JEDE.js → diff-HYWC4G6Y.js}

@@ -1,18 +1,18 @@
 import {
   REGISTRY_CLI_ARGS,
   resolveRegistryFromCli
-} from "./chunk-U26MRIWN.js";
+} from "./chunk-H46W7NHC.js";
 import {
   logger
 } from "./chunk-ZB43YMHW.js";
 import {
   diffAgainstRegistry,
   summarizeDiff
-} from "./chunk-VQBI3JVS.js";
-import "./chunk-25J2SMJQ.js";
+} from "./chunk-ANPSYWQO.js";
+import "./chunk-E465FAWM.js";
 import {
   loadAgentKitManifest
-} from "./chunk-6KUSG7BJ.js";
+} from "./chunk-7BEHUBEJ.js";
 import "./chunk-C4Q77GGJ.js";
 import "./chunk-5B4DVO6C.js";
 

package/dist/{doctor-TWF2M3S3.js → doctor-2X3HBRJJ.js}

@@ -2,20 +2,20 @@ import {
   assessHooksHealth,
   executeSafeReadinessFixes,
   refreshRepositoryProfile
-} from "./chunk-WMVMBPCR.js";
+} from "./chunk-AXLXEAVJ.js";
 import {
   writeReadinessSnapshot
 } from "./chunk-HAFRAXGV.js";
-import "./chunk-NNKOWUWM.js";
+import "./chunk-HHR56LJQ.js";
 import "./chunk-WGLPZXNU.js";
-import "./chunk-MAPOQEA2.js";
+import "./chunk-6RRG3WOE.js";
 import {
   withCliProgress
 } from "./chunk-QTON2GQX.js";
 import {
   detectWorkspaceParent,
   workspaceParentAdvisoryLines
-} from "./chunk-OVOXRH5W.js";
+} from "./chunk-Q4PCMRM5.js";
 import {
   createReadinessReport
 } from "./chunk-PNFF6OU3.js";
@@ -32,11 +32,11 @@ import {
 } from "./chunk-B3VR5YBQ.js";
 import {
   warnIfRunningCliBehindNpm
-} from "./chunk-6GYKOHIL.js";
+} from "./chunk-3OM7JODZ.js";
 import "./chunk-PFEUZXVT.js";
-import "./chunk-VQBI3JVS.js";
-import "./chunk-25J2SMJQ.js";
-import "./chunk-6KUSG7BJ.js";
+import "./chunk-ANPSYWQO.js";
+import "./chunk-E465FAWM.js";
+import "./chunk-7BEHUBEJ.js";
 import {
   KIT_VERSION
 } from "./chunk-7HDQEK6T.js";

package/dist/engine-info-4ZWEIHSX.js

@@ -0,0 +1,89 @@
+import {
+  DRIVER_PROTOCOL_VERSION
+} from "./chunk-MWTXI6C5.js";
+import {
+  bundledDashboardCandidates
+} from "./chunk-XDCCYBCJ.js";
+import "./chunk-IRTS7WEA.js";
+import "./chunk-ZB43YMHW.js";
+
+// src/commands/engine-info.ts
+import { defineCommand } from "citty";
+
+// src/lifecycle/engine-info.ts
+import { readFileSync } from "fs";
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+function loadPackageMetadata() {
+  for (const packagePath of ["../package.json", "../../package.json"]) {
+    try {
+      const metadata = require2(packagePath);
+      if (typeof metadata.version === "string" && metadata.name === "@dadado/agent-kit-cli") {
+        return metadata;
+      }
+    } catch {
+    }
+  }
+  throw new Error("Unable to resolve the Agent Kit CLI package.json");
+}
+var DATA_VERSION_RE = /^\s*dashboardDataVersion:\s*["'](\d+\.\d+\.\d+)["']/m;
+function parseDashboardDataVersion(source) {
+  return DATA_VERSION_RE.exec(source)?.[1] ?? null;
+}
+function readDashboardDataVersion(candidates) {
+  for (const candidate of candidates) {
+    try {
+      const found = parseDashboardDataVersion(readFileSync(candidate, "utf8"));
+      if (found) return found;
+    } catch {
+    }
+  }
+  return null;
+}
+function buildEngineManifest(opts = {}) {
+  const metadata = opts.metadata ?? loadPackageMetadata();
+  const candidates = opts.dashboardCandidates ?? bundledDashboardCandidates("dashboard-data.mjs");
+  const node = metadata.engines?.node;
+  return {
+    manifestVersion: 1,
+    name: String(metadata.name),
+    version: String(metadata.version),
+    node: typeof node === "string" ? node : "",
+    driverProtocol: DRIVER_PROTOCOL_VERSION,
+    dashboardDataVersion: readDashboardDataVersion(candidates),
+    entry: "dist/index.js",
+    dashboardServe: "dashboard/serve.mjs"
+  };
+}
+function renderEngineManifest(m) {
+  return [
+    `${m.name} ${m.version}`,
+    `node ${m.node || "(unspecified)"}`,
+    `driver protocol ${m.driverProtocol}`,
+    `dashboard data ${m.dashboardDataVersion ?? "(no dashboard found)"}`,
+    `entry ${m.entry}`,
+    `dashboard server ${m.dashboardServe}`
+  ].join("\n");
+}
+
+// src/commands/engine-info.ts
+var engineInfoCommand = defineCommand({
+  meta: {
+    name: "engine-info",
+    description: "Print the engine manifest: version, Node range, driver protocol, snapshot schema"
+  },
+  args: {
+    json: { type: "boolean", description: "Print the manifest as JSON", default: false }
+  },
+  run({ args }) {
+    const manifest = buildEngineManifest();
+    process.stdout.write(
+      args.json ? `${JSON.stringify(manifest, null, 2)}
+` : `${renderEngineManifest(manifest)}
+`
+    );
+  }
+});
+export {
+  engineInfoCommand
+};

package/dist/{ground-control-NMYYIVCV.js → ground-control-WKV2BMOW.js}

@@ -1,7 +1,7 @@
 import {
   blobId,
   isTicketMerged
-} from "./chunk-QTBTKEXK.js";
+} from "./chunk-ZPZVROS5.js";
 import {
   GATE_EXIT_BRANCH_PREFIX,
   GATE_EXIT_MARKER_RELPATH,
@@ -16,15 +16,16 @@ import {
   readGateExitMarker,
   resolveGateExitRefs,
   writeGateExitMarker
-} from "./chunk-KVY425NM.js";
+} from "./chunk-TZ5XYIEF.js";
 import "./chunk-MUTTNRX4.js";
 import {
   redactSecrets
-} from "./chunk-JEI6HACW.js";
+} from "./chunk-NJVWTROP.js";
+import "./chunk-IRTS7WEA.js";
 import {
   findOnPath
 } from "./chunk-WGLPZXNU.js";
-import "./chunk-MAPOQEA2.js";
+import "./chunk-6RRG3WOE.js";
 import "./chunk-QTON2GQX.js";
 import {
   logger

package/dist/{guard-EHXF76ID.js → guard-ZZRQW3DJ.js}

@@ -272,6 +272,55 @@ function ghTargetsPublicRepo(head) {
   if (!/^(?:[\w./-]+\/)?gh\s+pr\s+(?:create|merge)\b/.test(head)) return false;
   return PUBLIC_REPO_RE.test(head);
 }
+var PR_MERGE_HEAD_RE = /^(?:[\w./-]+\/)?(gh\s+pr|glab\s+mr)\s+merge\b/;
+var PR_MERGE_VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "-R",
+  "--repo",
+  "-t",
+  "--subject",
+  "-b",
+  "--body",
+  "-F",
+  "--body-file",
+  "-A",
+  "--author-email",
+  "--match-head-commit",
+  "-m",
+  "--message",
+  "--squash-message",
+  "--sha"
+]);
+function parsePrMergeHead(head) {
+  const m = PR_MERGE_HEAD_RE.exec(head);
+  if (!m?.[1]) return null;
+  const forge = m[1].startsWith("gh") ? "github" : "gitlab";
+  const tokens = head.slice(m[0].length).trim().split(/\s+/).filter(Boolean);
+  let selector = null;
+  let repo = null;
+  for (let i = 0; i < tokens.length; i++) {
+    const t = tokens[i];
+    const inline = /^(--?[\w-]+)=(.*)$/.exec(t);
+    if (inline) {
+      if (inline[1] === "-R" || inline[1] === "--repo") repo = inline[2] || null;
+      continue;
+    }
+    if (t.startsWith("-")) {
+      if (PR_MERGE_VALUE_FLAGS.has(t)) {
+        if ((t === "-R" || t === "--repo") && tokens[i + 1]) repo = tokens[i + 1];
+        i++;
+      }
+      continue;
+    }
+    if (selector === null) selector = t;
+  }
+  return { forge, selector, repo };
+}
+function prMergeKey(target) {
+  return `${target.forge}\0${target.repo ?? ""}\0${target.selector ?? ""}`;
+}
+function prMergeTargets(command) {
+  return shellSegments(command).map((segment) => parsePrMergeHead(canonicalGitHead(segment))).filter((t) => t !== null);
+}
 function anyHeadMatches(command, re) {
   return shellInvocationHeads(command).some((head) => re.test(head));
 }
@@ -377,6 +426,23 @@ var SHELL_DENY_RULES = [
       }
       return false;
     })
+  },
+  {
+    // Claude settings allow `gh pr merge` / `glab mr merge` so the /git-staging merge
+    // skips the auto-mode classifier; this rule keeps that allowance to non-protected bases.
+    id: "pr-merge-protected-base",
+    description: "merging a PR/MR into main/master/prod bypasses /git-prod; an unresolved base (gh/glab could not read the PR/MR: not logged in, wrong selector, or no such PR) is denied too",
+    test: (cmd, opts) => {
+      const bases = opts?.prMergeBases;
+      if (!bases) return false;
+      return shellSegments(cmd).some((segment) => {
+        if (segmentHasAllowMainPushEnv(segment)) return false;
+        const target = parsePrMergeHead(canonicalGitHead(segment));
+        if (!target) return false;
+        const base = bases[prMergeKey(target)];
+        return typeof base !== "string" || isProtectedBranch(base);
+      });
+    }
   }
 ];
 function evaluateShellCommand(command, opts = {}) {
@@ -425,15 +491,47 @@ async function detectRemotes(cwd) {
     return void 0;
   }
 }
-var defaultGuardShellDeps = { detectCurrentBranch, detectRemotes };
-var GIT_OR_GH_RE = /\b(git|gh)\b/;
+var PR_BASE_TIMEOUT_MS = 3e3;
+async function resolvePrBase(target, cwd) {
+  const selector = target.selector ? [target.selector] : [];
+  try {
+    if (target.forge === "github") {
+      const repo2 = target.repo ? ["--repo", target.repo] : [];
+      const { stdout: stdout2 } = await execFileAsync(
+        "gh",
+        ["pr", "view", ...selector, ...repo2, "--json", "baseRefName", "-q", ".baseRefName"],
+        { encoding: "utf8", cwd, timeout: PR_BASE_TIMEOUT_MS }
+      );
+      return stdout2.trim() || null;
+    }
+    const repo = target.repo ? ["-R", target.repo] : [];
+    const { stdout } = await execFileAsync(
+      "glab",
+      ["mr", "view", ...selector, ...repo, "-F", "json"],
+      {
+        encoding: "utf8",
+        cwd,
+        timeout: PR_BASE_TIMEOUT_MS
+      }
+    );
+    const base = JSON.parse(stdout).target_branch;
+    return typeof base === "string" && base ? base : null;
+  } catch {
+    return null;
+  }
+}
+var defaultGuardShellDeps = { detectCurrentBranch, detectRemotes, resolvePrBase };
+var GIT_OR_FORGE_RE = /\b(git|gh|glab)\b/;
 async function evaluateGuardShell(command, cwd = process.cwd(), deps = defaultGuardShellDeps) {
-  if (!GIT_OR_GH_RE.test(command)) return evaluateShellCommand(command);
-  const [currentBranch, remotes] = await Promise.all([
+  if (!GIT_OR_FORGE_RE.test(command)) return evaluateShellCommand(command);
+  const targets = prMergeTargets(command);
+  const [currentBranch, remotes, bases] = await Promise.all([
     deps.detectCurrentBranch(cwd),
-    deps.detectRemotes(cwd)
+    deps.detectRemotes(cwd),
+    Promise.all(targets.map((t) => deps.resolvePrBase(t, cwd)))
   ]);
-  return evaluateShellCommand(command, { currentBranch, remotes });
+  const prMergeBases = targets.length > 0 ? Object.fromEntries(targets.map((t, i) => [prMergeKey(t), bases[i] ?? null])) : void 0;
+  return evaluateShellCommand(command, { currentBranch, remotes, prMergeBases });
 }
 async function runGuardShellHook(formatArg, deps = {}) {
   const format = resolveGuardShellFormat(formatArg);
@@ -448,7 +546,8 @@ async function runGuardShellHook(formatArg, deps = {}) {
     }
     const result = await evaluateGuardShell(command, cwd, {
       detectCurrentBranch: deps.detectCurrentBranch ?? defaultGuardShellDeps.detectCurrentBranch,
-      detectRemotes: deps.detectRemotes ?? defaultGuardShellDeps.detectRemotes
+      detectRemotes: deps.detectRemotes ?? defaultGuardShellDeps.detectRemotes,
+      resolvePrBase: deps.resolvePrBase ?? defaultGuardShellDeps.resolvePrBase
     });
     return formatGuardShellOutput(result, format);
   };
@@ -468,7 +567,7 @@ var guardCommand = defineCommand({
     shell: defineCommand({
       meta: {
         name: "shell",
-        description: "Evaluate a shell command against the git-workflow / protected-branch deny-list (git checkout|restore|reset --hard|clean -fd + pushes to main/master/prod + direct git push/gh pr create|merge against the public repo). Not a general destructive-command guard: rm -rf, chmod, dd are allowed."
+        description: "Evaluate a shell command against the git-workflow / protected-branch deny-list (git checkout|restore|reset --hard|clean -fd + pushes to main/master/prod + gh pr merge / glab mr merge into main/master/prod or an unresolved base + direct git push/gh pr create|merge against the public repo). Not a general destructive-command guard: rm -rf, chmod, dd are allowed."
       },
       args: {
         json: {