@henryqw/pi-pr 9.0.6 → 9.1.1

package/LICENSE-APACHE-2.0

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE.md

@@ -0,0 +1,24 @@
+# Licence scope and source notices
+
+This package contains files under two licences. This is not a choice of licence for each file.
+
+- The existing pi-pr extension code, package-owned PR skills, and tests use the MIT licence in `LICENSE`.
+- The imported files listed below and their modifications use Apache-2.0. `LICENSE-APACHE-2.0` is an exact copy of the original source licence. These files are not relicensed as MIT.
+
+## Imported source
+
+Source: Henry Wang's `HenryQW/skills` repository, <https://github.com/HenryQW/skills>.
+The read-only source snapshot inspected for these notices is commit `6857c81611ab8e7aaacf4233452a0841d7df79a9`.
+Each source path below is relative to that repository. Each package path is relative to this package.
+
+| Source path | Package path | Modification notice |
+| --- | --- | --- |
+| `git-commit/SKILL.md` | `skills/git-commit/SKILL.md` | Modified for pi-pr: use the shared native scoped commit tool, content/index checks, and uncertain-outcome rules. |
+| `git-pr/SKILL.md` | `skills/git-pr/SKILL.md` | Modified for pi-pr: replace shell publication with bounded native dispatch, explicit base intent, upstream consent, and exact PR reuse. |
+| `update-from-main/SKILL.md` | `skills/update-from-main/SKILL.md` | Modified for pi-pr: packaged helper guidance, bounded check output, exact backup identity, worktree ownership, and retained-backup recovery after success or failure. |
+| `update-from-main/scripts/update_from_main.py` | `skills/update-from-main/scripts/update_from_main.py` | Modified for pi-pr: add collision/race regressions, identify the backup by a unique reflog message, record its owner in per-worktree refs, and apply its exact OID without popping or dropping it. |
+| `update-from-main/scripts/validate.py` | `skills/update-from-main/scripts/validate.py` | Copied validator; added the source, licence, and modification notice header. |
+
+The source snapshot has no separate `NOTICE` file and no file-specific copyright notice in these five files. The full original Apache licence, including its appendix, is preserved unchanged. Attribution to the source author and repository is retained here. The unrelated source `agents/openai.yaml` files were not imported.
+
+These notices do not change the existing MIT licence for the package-owned code. The package manifest uses `(MIT AND Apache-2.0)` to describe the combined distribution. This notice and both licence files are included in the packed package.

package/README.md

@@ -1,6 +1,6 @@
 # `@henryqw/pi-pr`
 
-See the current branch pull request in the Pi footer. Run `/pr` to create, update, repair, review, or merge it when safe, without repeatedly checking GitHub by hand.
+See the current branch pull request in the Pi footer. Run `/pr` for the full PR lifecycle, or ask the agent to commit local work or create/update a PR without authorizing repair or merge.
 
 ## Install
 
@@ -27,11 +27,16 @@ Run `/pr` in a GitHub checkout. It reads fresh local and GitHub state, takes the
 | Surface | Type | Purpose |
 | --- | --- | --- |
 | `/pr` | command | Human entry point; inspect and act on the current branch's pull request. |
+| `pi_git_commit` | tool | Agent-only local inspection and scoped commits; never pushes. |
+| `pi_git_pr` | tool | Agent-only PR creation/publication; no feedback, CI repair, base rebase, or merge. |
 | `pi_pr_create` | tool | Agent-only guarded creation steps selected by `/pr`. |
 | `pi_pr_fix_ci` | tool | Agent-only guarded GitHub Actions repair. |
 | `pi_pr_publish_work` | tool | Agent-only scoped local work publication. |
 | `pi_pr_sweep` | tool | Agent-only feedback triage and publication. |
 | `pi_pr_update_branch` | tool | Agent-only conflict rebase and publication. |
+| `git-commit` | skill | Agent guidance for standalone scoped Conventional Commits. |
+| `git-pr` | skill | Agent guidance for authorized PR creation or publication. |
+| `update-from-main` | skill | Agent guidance and Python helper for merging exact fetched `origin/main`. |
 | `pi-pr-comment-sweep` | skill | Agent guidance for review feedback. |
 | `pi-pr-create` | skill | Agent guidance for creating a pull request. |
 | `pi-pr-fix-ci` | skill | Agent guidance for failed GitHub Actions. |
@@ -40,9 +45,40 @@ Run `/pr` in a GitHub checkout. It reads fresh local and GitHub state, takes the
 | Footer | ui | Linked PR number and plain-language status. |
 | Widget | ui | Action hint or transient routing status. |
 
-`/pr` accepts no flags, prose, or base argument. Start with the command, not a helper skill or tool: direct calls cannot establish route authority. The helper run is bound to the current session and worktree. Its agent tools use plain-object parameter schemas so providers that omit root-union tools can expose them; action-specific arguments are still checked before the workflow runs.
+`/pr` accepts no flags, prose, or base argument. For the full lifecycle, start with the command. For a create/update-only request, the agent reads `git-pr` and calls `pi_git_pr`. Both entries establish session-local authority for the same helpers; a direct `pi_pr_*` call cannot establish it. The helper run is bound to the current session and worktree. Its agent tools use plain-object parameter schemas so providers that omit root-union tools can expose them; action-specific arguments are still checked before the workflow runs.
 
-The `pi_pr_*` tools are model-only and run one action at a time. Codemode scripts and other tools cannot call them, so a script cannot batch guarded actions or filter the result the model needs for its next safety decision. With `codemode.mode` set to `only`, Pi hides other tools behind `codemode` but keeps these declared, so `/pr` workflows still work.
+The `pi_git_*` and `pi_pr_*` tools are model-only and run one action at a time. Codemode scripts and other tools cannot call them, so a script cannot batch guarded actions or filter the result the model needs for its next safety decision. With `codemode.mode` set to `only`, Pi hides other tools behind `codemode` but keeps these declared, so `/pr` workflows still work.
+
+### Local commits and bounded PR publication
+
+Ask the agent to commit a scoped change. `git-commit` resolves an explicit local target, the PR base, or the repository default branch. `pi_git_commit` inspects that target and pending work, then commits only reviewed paths. It requires an existing commit and an attached branch. It never fetches, pushes, amends, bypasses hooks, or changes Git configuration.
+
+Ask the agent to create or update a PR. `pi_git_pr` permits creation, local publication, and local sync onto the proven PR head. It stops before feedback, CI repair, base rebase, CI waiting, and merge. Local sync can fast-forward or rebase local commits onto the PR head, but not onto the base. Existing PRs retain their base, title, and body, including an exact-head PR that appears between push and publication. The tool never retargets them. An explicit `base` must match the existing PR base or the configured/default creation base. To select another creation base, explicitly authorize the branch's repository-local `gh-merge-base` setting first.
+
+An inferred target requires specific permission to configure this repository's branch upstream. Without it, the tool stops before linking or creation. `allowUpstream: true` records this consent for one invocation; it never permits global configuration changes. It is not required for an already configured target.
+
+All commit callers use the same literal-path staging and commit parent/tree checks. Standalone, creation, and local-publication inspections also detect file-byte and index changes even when Git status letters stay the same. Unrelated staging, partial staging, `.context/`, and common secret filenames block a commit. Filename checks cannot detect every secret: the agent must inspect content and ownership. Hooks run normally. An uncertain commit or push must not be replayed without checking its actual outcome.
+
+### Agent arguments
+
+- `pi_git_commit`: `{ action: "inspect", target: "<local-ref-or-OID>" }` returns `inspectionId`, `head`, `targetOid`, `mergeBase`, and `paths`. Then use `{ action: "commit", inspectionId: "<returned-ID>", ownedPaths: ["<exact-path>"], message: "fix: <subject>" }`. A successful commit returns `head` and consumes the inspection. Inspect again for another coherent group. Subjects are limited to 72 characters; bodies and footers are allowed.
+- `pi_git_pr`: `{ base?: "<exact-base-ref>", allowUpstream?: true }`. Omit `base` when the user gave no explicit base. Set `allowUpstream` only after specific consent. The result has `nextStep` and can include a proven `url`, `blocker`, or `handoff`. With `handoff`, end the turn: native settlement loads the reserved package skill with its run ID. Do not guess IDs or start another PR entry. Authorization continues across handoffs, but expires when the invocation ends.
+
+### Standalone merge from main
+
+Ask to update the current branch from main. `update-from-main` runs its packaged Python helper once. It requires Python 3.9 or newer and Git with `fetch --porcelain`. Unlike the `/pr` base-update route, this helper **merges**, not rebases. It fetches before local mutation and uses the exact OID from fetch output. It backs up tracked and untracked changes; when ignored paths collide with the source tree, the backup also includes ignored files. It never pushes.
+
+Each backup has a unique Git reflog message, so another linked worktree's stash push cannot change its identity. Before it stashes, the helper records ownership in the per-worktree ref `refs/worktree/update-from-main/pending/<token>`, then replaces it with `refs/worktree/update-from-main/backup` at the captured OID. Restoration always applies the captured OID with `--index`. The helper never pops or drops a stash. Backups stay retained after success as well as conflict, hook, or submodule failures.
+
+A retained backup blocks further runs only in the worktree that owns it, also after a branch switch; other worktrees can update. Report the backup OID, and restore from it rather than from a later `origin/main`. After the user verifies restored bytes and staging and explicitly asks, complete recovery with `git update-ref -d refs/worktree/update-from-main/backup <oid>`. This keeps the stash entry. An interrupted run leaves the `pending` ref and blocks its worktree until recovery. Backups from earlier helper versions have no recorded owner and block every worktree until the user drops them or the confirmed owner adopts them; adoption keeps the stash entry. Removing a worktree removes its ownership refs but not its stash entries. See the packaged `update-from-main` skill for the exact recovery and adoption commands.
+
+### Local acceptance checks
+
+From this source checkout, run `pnpm --filter @henryqw/pi-pr test:git-workflows`. It uses existing Node tests, temporary real Git repositories, and controlled GitHub responses, with no live GitHub writes. See [executed cases and independent acceptance instructions](./docs/git-workflows-tested.md) for the commands, tested boundaries, and limits.
+
+### Licences
+
+Existing pi-pr code uses MIT. The imported `git-commit`, `git-pr`, and `update-from-main` skills and the Python helper/validator use Apache-2.0, including their modifications. See [licence scope, source identity, and modification notices](./NOTICE.md). Both licence files are included in the package.
 
 ## Flow
 

package/docs/git-workflows-tested.md

@@ -0,0 +1,119 @@
+# Git workflow consolidation checks
+
+## Candidate and scope
+
+The candidate includes checkpoints `36008cb0c6fabf94e7d8ddee3c2b302c8fffd121` and `8506d67ce276138b213ab42637cb6afae9eb2322`, applied in that order, then the completion changes. This report covers checks run in `/Users/henry/Git/pi-harness/.worktrees/subagent-46a5a4b61cc1fd6e8b66ea3a`.
+
+- `pi_git_commit` is the standalone local entry. Creation, local publication, and feedback commits share literal-path staging and parent/tree checks. CI guidance uses the standalone commit entry with the captured PR head as its target.
+- `git-pr` now calls `pi_git_pr`, not a second shell workflow or a request to run `/pr`. Its authorization permits creation, local publication, and sync onto the PR head. It excludes feedback, CI repair, base rebase, CI waiting, and merge. `/pr` retains its full lifecycle.
+- `update-from-main` remains a standalone merge of the exact fetched OID. Recovery keeps backups. The original `/Users/henry/Git/skills` sources stayed read-only during isolated validation. Source retirement is a separate step after Main acceptance.
+- The package manifest publishes all eight skills and their helpers. The root local manifest also declares the same skill directory. `@henryqw/pi-pr` moves from `9.0.3` to `9.1.0` for the new callable workflows and skills. No other package needs a release.
+
+## Executed cases
+
+| Check | Actual coverage |
+| --- | --- |
+| `git-commit.test.ts` | Real temporary Git repositories: local-only commits, coherent groups, literal filenames, message bodies, remaining unrelated work, coherent staged renames/deletions, unrelated staging, partial staging, same-status byte drift, branch movement, active Git operations, context/secret paths, cancellation, failed hooks, lost successful responses, and hooks that change the committed tree. Uncertain attempts cannot replay. |
+| Creation and local-publication tests | Shared byte/index inspection and staging, rename scope, clean verification, exact captured OID and lease, frozen checks, failed checks, divergent local commits, and consumed uncertain commits/pushes. Creation tests also cover explicit base match/mismatch, PR reuse, upstream recovery, and title/body races. Git mutation cases use temporary repositories or strict command mocks; GitHub responses are controlled. |
+| Feedback sweep tests | Real temporary Git repositories with controlled GitHub responses: scope and authority checks, preserved partial staging, literal add/delete paths, exact parent/tree recovery, and lost-response reconciliation. Existing recovery, feedback, validation, and resolution tests remain active. |
+| `pr-native.test.ts` | Native `AgentSession`, `ExtensionRunner`, and settlement methods: hidden skill dispatch, no editable queue guidance, full-lifecycle continuation, bounded create/publication handoff without UI, and no unauthorized feedback continuation. Workflow bodies and GitHub discovery are controlled in these tests. |
+| `native source Git tools` in `pr.test.ts` | Registered source tools with real commit/publication helpers in a temporary repository. Standalone commit does not push; explicit base mismatch stops; active PR authority blocks a second commit entry; native settlement supplies the package skill; validation and exact-lease/OID publication write only a local bare repository; a merge-ready PR is not merged. GitHub discovery and repository identity are controlled responses, not live API reads. |
+| Merge helper self-test | Real temporary repositories: a merge with staged/untracked restoration, tracked stash conflict, untracked and ignored upstream-path collisions, ignored newline filenames, merge-conflict recovery using the captured OID after upstream advances, retained-backup rerun rejection, fetch failure before local mutation, tracking-ref movement after fetch, up-to-date/main/detached refusal, dirty submodule restoration, required submodule update recovery, and failed merge-hook recovery. Only fetch lock-race responses and tracking-ref movement are injected. |
+| Installed Pi resource probe | Pi `1.0.2` `DefaultPackageManager.resolveExtensionSources` and `loadSkills` resolve the package and root local manifests. Both return the extension entry and all eight skills, with no skill diagnostics. The probe uses in-memory settings and a temporary agent directory; it does not load models or write user configuration. |
+
+## Fixes and check history
+
+The checkpoint baseline passed 426 package tests, the feedback self-test, and the copied Python validator. This worker did not rely on the prior worker's reported 129 focused tests.
+
+The source commit tool did not trigger the documented presentation refresh: the event handler recognized only shell commits. It now refreshes after a successful `pi_git_commit` commit, but not inspection or failure. The existing projection test covers this boundary.
+
+A real Git probe also found that `git add -A -- old.txt new.txt` fails with exit 128 after a staged rename: the old path is already absent from the index. The shared staging helper now leaves fully staged paths unchanged and adds only unstaged/untracked selected paths. It still rejects unrelated and partially staged work first. Real cases cover complete staged renames in standalone, creation, and publication commits, plus staged deletion in standalone and sweep commits.
+
+Added cases also establish same-status byte-drift rejection in both PR inspection callers, partial-stage preservation in the sweep, untracked collision backup preservation in the merge helper, and a registered-tool commit/publication exercise. No merge algorithm or PR lease/recovery path was replaced.
+
+During development, typecheck rejected an unsafe test-only boundary-entry access. The test now checks the entry before reading its content. The first source-tool probe expected the wrong no-action notification text; that redundant assertion was removed. These were test defects, not successful workflow claims. The four focused Git cases then passed.
+
+Checks on the previous candidate `6a4d39d`, before the independent review corrections (these are not revision rerun results):
+
+| Command | Result |
+| --- | --- |
+| `pnpm --filter @henryqw/pi-pr test` | Exit 0: 428 Node tests, feedback self-test, and merge helper self-test passed. |
+| `pnpm --filter @henryqw/pi-pr typecheck` | Exit 0. |
+| `python3 extensions/pi-pr/skills/update-from-main/scripts/validate.py` | Exit 0 on the checkpoint baseline; the final expanded helper also passed through the package test command. |
+| `pnpm run docs:validate` | Exit 0: README structure, 49 docs-related tests, and link checks passed. |
+| `pnpm run check:package-versions` | Exit 0. |
+| `pnpm install --lockfile-only --offline --ignore-scripts` | Exit 0; version/resource edits need no dependency resolution change, so `pnpm-lock.yaml` is unchanged. |
+| `cd extensions/pi-pr && npm pack --dry-run --ignore-scripts --json` | Exit 0: 35 published files at `9.1.0`; an assertion probe confirmed all eight skills, source entry, shared commit helper, both Python scripts, report, and README SVG. No tarball was created. |
+| `git diff --check` | Exit 0. |
+
+Output was captured in temporary logs. Success summaries were limited to 20 lines; failure output was limited to 80 lines or 8 KiB. The installed-authority resource probe ran with `node --input-type=module` and imported `DefaultPackageManager`, `SettingsManager`, and `loadSkills` directly from the Pi `1.0.2` path given below.
+
+## Independent evidence on the previous candidate
+
+The parent supplied the following exact-source acceptance results for the previous tree. This worker has not rerun these independent probes on the revision or inspected raw worker sessions.
+
+- First agent: 22 passing tests, including five registered-source guidance probes. These used real local commits, native handoff, checks, and local exact-OID/lease pushes. Commands and saved logs are under `/tmp/pi-git-acceptance-c2e9d284.Y5SPGS`. Its collector rejected valid final ancestry across a custom record; the cases and unchanged identity were recovered from saved evidence. The collector failure is not proof that the native workflow failed.
+- Second agent: four successful subprocess fixtures. Safe evidence is `/tmp/pi-update-main-acceptance.ZXSHb1/report.txt` and `probe-results.json`: partial-index/untracked byte restoration; ignored upstream collision backup; conflict recovery using the original OID after main advanced, with retained-backup rerun refusal; and fetch failure preserving all state. `acceptance.py` exited 1 after the first two cases because macOS `sed` rejected `--`. `resume.py` inspected and continued the same fixture and returned 0; it did not restart or rerun an uncertain merge.
+- The old success result that popped the backup is invalid under the corrected retention policy. These prior fixtures do not prove the new concurrent-stash behavior.
+- The second task overall FAILED because its environment probe disclosed a credential, despite its passing Git fixtures. The parent notified the user. No token value is in the safe reports or fixtures. This revision does not inspect or reproduce credential output and does not change pi-subagent.
+
+## Review corrections and revision evidence
+
+1. The merge helper no longer captures `refs/stash` after push or checks it before `pop stash@{0}`. Native stash pushes use a unique run message; the helper finds its OID in the native stash reflog. Restoration always uses `git stash apply --index <captured-OID>`. Every backup stays retained after success or failure until verified explicit user removal. Legacy named backups still block another run. Exact fetched-main OID and merge/conflict/hook/submodule recovery are unchanged.
+2. The registered bounded entry passes `preserveExistingMetadata` into the shared creator. An exact-head PR that appears after push is validated for open lifecycle, repository/ref/OID, and base, then reused without edit/create. Full `/pr` keeps its metadata-update behavior. Controlled regressions exercise bounded reuse, full metadata update, and rejection of a different base or head. The entry-boundary test checks that bounded authority reaches the creator.
+3. The package now declares `(MIT AND Apache-2.0)`. `LICENSE` still applies to existing MIT code. `LICENSE-APACHE-2.0` is byte-for-byte equal to the read-only original `/Users/henry/Git/skills/LICENSE`. `NOTICE.md` identifies source commit `6857c81611ab8e7aaacf4233452a0841d7df79a9`, lists the imported paths and modifications, and scopes Apache versus MIT. Each imported skill/helper/validator has a source and modification notice. The source has no separate NOTICE file for these paths. Both licences and the notice are published.
+
+The smallest real-Git race regressions use another linked worktree. One inserts its stash push after this helper's push but before backup capture. The other inserts its push immediately before restoration. Both verify partial-index and binary untracked bytes, the original backup OID, the peer backup's OID/content, and two retained stack entries. Legacy-backup refusal and successful-restoration rerun refusal are also checked. No automatic stack deletion is used.
+
+Focused commands run on this revision:
+
+- `python3 extensions/pi-pr/skills/update-from-main/scripts/validate.py`: exit 0, including both real-Git races and recovery checks.
+- `pnpm --filter @henryqw/pi-pr exec node --test --test-name-pattern='metadata when an exact PR appears|agent PR entry carries base' test/pr-create.test.ts test/pr.test.ts`: initially three cases passed before adding the two mismatched-authority cases; the complete final package run below covers those added cases.
+
+Final checks run on this revision:
+
+| Command | Result and local log |
+| --- | --- |
+| `pnpm --filter @henryqw/pi-pr test` | Exit 0: 432 Node tests plus feedback and expanded merge self-tests. Log: `/var/folders/6y/58h3_t417xdb67x996096jjr0000gn/T/tmp.jXV17CCNcZ`. |
+| `pnpm --filter @henryqw/pi-pr typecheck` | Exit 0. Log: `/var/folders/6y/58h3_t417xdb67x996096jjr0000gn/T/tmp.vtgSindNDY`. |
+| `pnpm run docs:validate` | Exit 0: structure, 49 docs tests, and link checks. Log: `/var/folders/6y/58h3_t417xdb67x996096jjr0000gn/T/tmp.JW98lXOnhR`. |
+| `pnpm install --lockfile-only --offline --ignore-scripts` | Exit 0; lockfile remains unchanged. Log: `/var/folders/6y/58h3_t417xdb67x996096jjr0000gn/T/tmp.BcSv0ViqC9`. |
+| `pnpm run check:package-versions` | Exit 0. Log: `/var/folders/6y/58h3_t417xdb67x996096jjr0000gn/T/tmp.lTNTARDRvY`. |
+| `cd extensions/pi-pr && npm pack --dry-run --ignore-scripts --json` | Exit 0; 37 files. Assertions verified both licences, NOTICE.md, all eight skills, Python helper/validator, source entries, report and SVG. The Apache licence equals the original bytes. No tarball was created. Log: `/var/folders/6y/58h3_t417xdb67x996096jjr0000gn/T/tmp.jYi8Xk2CQl`. |
+| `git diff --check` | Exit 0. |
+
+The release stays `@henryqw/pi-pr@9.1.0`; no other package releases. Main owns root-wide combined validation and final independent acceptance. These revision checks do not rerun the prior independent collectors or fixture scripts. Live GitHub, live models, TUI behavior, and manual backup removal remain untested.
+
+## Main acceptance
+
+Main accepted and promoted runtime candidate `62711f2643bd73c26d2fe29925e00c758c21df65`, with the same source tree as revision `274695fe84b7da903d998edc3b21d85c2b509651`.
+
+- `pnpm --filter @henryqw/pi-pr test:git-workflows`: exit 0 on that exact integration candidate. Log: `/tmp/pi-pr-main-acceptance.zKbmC8`.
+- Guarded final checks: `pnpm test`, `pnpm run docs:validate`, `pnpm run check:package-versions`, `git diff --check`, and `npm pack --dry-run --json` from `extensions/pi-pr` all returned exit 0. The runtime candidate stayed unchanged.
+- The guarded exact-candidate review and the separate final reviewer both returned `PASS`.
+- This section is a report-only update after promotion. It does not claim another model-driven package run, live GitHub write, or replay of the previous independent fixture scripts. Credential replacement and removal of installed standalone skill copies remain user actions.
+
+## Independent acceptance entry
+
+From the exact candidate checkout, with existing workspace dependencies and Python 3.9+ installed, run:
+
+```bash
+log=$(mktemp)
+pnpm --filter @henryqw/pi-pr test:git-workflows >"$log" 2>&1
+rc=$?
+echo "git-workflows exit=$rc log=$log"
+if [ "$rc" -eq 0 ]; then tail -20 "$log"; else tail -80 "$log" | tail -c 8192; fi
+exit "$rc"
+```
+
+This entry uses the existing Node test runner and Python validator, not a new framework. It runs the standalone commit, native dispatch, real local publication, registered source-tool, and merge recovery exercises. Temporary repositories and agent directories are removed. Any unknown GitHub mutation in the source-tool exercise fails the test; the only push destination is its temporary bare repository. No credentials, external repository, model request, or persistent Pi setting is needed.
+
+Main can give separate acceptance workers the source `extensions/pi-pr/extensions/pr.ts` and the packaged `skills/git-commit`, `skills/git-pr`, or `skills/update-from-main` guidance. Use only controlled temporary Git/GitHub contexts. Compare the resulting commits, index, backup OIDs, and native handoff with the cases above. Use returned inspection/run IDs, never fabricated authority. Run the helper once per fixture; inspect and restore retained backups rather than rerun. Main owns the independent agent-guidance exercise and source retirement after acceptance.
+
+## Limits
+
+- Automated native tests use the workspace-pinned Pi `1.0.0` dependency. The installed `1.0.2` authority is `/Users/henry/.pi/agent/install/releases/1.0.2/node_modules/@earendil-works/pi-coding-agent`; its documentation and declarations were inspected, and its resource APIs were probed. Live model-driven use of the packaged tools and TUI behavior were not tested.
+- Controlled GitHub responses test authorization and command boundaries. They do not prove live GitHub authentication, repository policy, network transport, or GitHub Enterprise behavior.
+- A user request and upstream consent are agent guidance requirements; a Boolean tool field cannot prove that a person gave consent. Ownership, secret-content detection, check adequacy, and semantic conflict resolution still need agent/user judgment.
+- The acceptance entry is available for later local runs. Main's exact-candidate acceptance and root-wide checks are recorded above. Package typecheck passed on the revision; no new claim is made for unchanged packages' typechecks.
+- No live GitHub change, external push, npm publication, or persistent user configuration edit was made. Source retirement is permitted only after acceptance; installed standalone copies are not removed automatically.

package/extensions/git-commit.ts

@@ -0,0 +1,132 @@
+import { createHash, randomUUID } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { lstat, readlink } from "node:fs/promises";
+import { join } from "node:path";
+import { spawnBounded, type Exec, type ExecOptions } from "@henryqw/pi-process";
+import { inspectWorktreeState, parseNulPaths, parseStatusSnapshot, readHead, requiredOid, requiredText, runChecked, validatePaths, withWorktreeLock } from "./pr-execution.ts";
+
+export type PendingCommit = { head: string; status: string; integrity: string };
+
+export function commitPaths(input: string[]): string[] {
+	const paths = validatePaths(input, "Commit paths");
+	if (!paths.length) throw new Error("Commit paths must not be empty");
+	for (const path of paths) {
+		const parts = path.split("/");
+		if (parts.some((part) => !part || part === "." || part === ".git" || part === ".context") || path.includes("\0")) {
+			throw new Error("Commit paths must be canonical and must exclude .git/ and .context/");
+		}
+		if (parts.some((part) => /^(?:\.env(?:\..*)?|credentials(?:\..*)?|id_(?:rsa|dsa|ecdsa|ed25519)|.*\.(?:pem|key|p12|pfx))$/i.test(part))) {
+			throw new Error("Commit paths include a possible secret; remove it from the commit scope");
+		}
+	}
+	return paths;
+}
+
+/** Integrity includes file bytes, symlink targets, modes, and the index, not only status letters. */
+export async function inspectPendingCommit(exec: Exec, options: ExecOptions): Promise<PendingCommit> {
+	if (await inspectWorktreeState(exec, options) === "operation") throw new Error("Git operation in progress");
+	const head = await readHead(exec, options);
+	const status = (await runChecked(exec, "git", ["status", "--porcelain=v2", "-z", "--untracked-files=all"], options)).stdout;
+	const hash = createHash("sha256").update(status);
+	hash.update((await runChecked(exec, "git", ["diff", "--cached", "--binary", "--no-ext-diff", "--no-textconv"], options)).stdout);
+	for (const path of validatePaths([...parseStatusSnapshot(status).keys()], "Pending paths")) {
+		const absolute = join(options.cwd, path);
+		let stat;
+		try { stat = await lstat(absolute); }
+		catch (error) {
+			if ((error as NodeJS.ErrnoException).code === "ENOENT") { hash.update("deleted\0"); continue; }
+			throw error;
+		}
+		hash.update(`${path}\0${stat.mode}\0`);
+		if (stat.isSymbolicLink()) hash.update(await readlink(absolute));
+		else if (stat.isFile()) for await (const chunk of createReadStream(absolute)) {
+			options.signal?.throwIfAborted();
+			hash.update(chunk);
+		}
+		else throw new Error("Pending directories or submodules need a separate ownership decision");
+		hash.update("\0");
+	}
+	return { head, status, integrity: hash.digest("hex") };
+}
+
+export async function requirePendingCommit(exec: Exec, options: ExecOptions, pending: PendingCommit): Promise<void> {
+	const current = await inspectPendingCommit(exec, options);
+	if (current.head !== pending.head || current.status !== pending.status || current.integrity !== pending.integrity) {
+		throw new Error("Pending work changed after inspection; review it again");
+	}
+}
+
+/** Call under the worktree lock. Never replace unrelated or partially staged work. */
+export async function stageCommitPaths(exec: Exec, options: ExecOptions, input: string[]): Promise<void> {
+	const paths = commitPaths(input);
+	const staged = parseNulPaths((await runChecked(exec, "git", ["diff", "--cached", "--no-renames", "--name-only", "-z"], options)).stdout, "Staged paths");
+	if (staged.some((path) => !paths.includes(path))) throw new Error("Unrelated staged changes require an ownership decision");
+	const unstaged = parseNulPaths((await runChecked(exec, "git", ["diff", "--no-renames", "--name-only", "-z"], options)).stdout, "Unstaged paths");
+	if (staged.some((path) => unstaged.includes(path))) throw new Error("Partially staged changes require an ownership decision; staging was preserved");
+	// Keep coherent staging, including deletions and both sides of a rename. Deleted paths
+	// are no longer in the index, so adding them again can fail with an unmatched pathspec.
+	const toStage = paths.filter((path) => !staged.includes(path));
+	if (toStage.length) await runChecked(exec, "git", ["--literal-pathspecs", "add", "-A", "--", ...toStage], options);
+}
+
+export function validateCommitMessage(message: string): void {
+	if (typeof message !== "string" || !/^(?:feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(?:\([^\r\n()]+\))?!?: [^\r\n]+(?:\n[\s\S]*)?$/.test(message) || message.split("\n")[0]!.length > 72 || message.length > 16_384 || message.includes("\0")) {
+		throw new Error("Use a Conventional Commit message with a subject of at most 72 characters");
+	}
+}
+
+export async function commitStagedPaths(exec: Exec, options: ExecOptions, message: string): Promise<void> {
+	validateCommitMessage(message);
+	const parent = await readHead(exec, options);
+	const tree = requiredOid((await runChecked(exec, "git", ["write-tree"], options)).stdout.trim(), "commit tree");
+	await runChecked(exec, "git", ["commit", "-m", message], options);
+	const actual = (await runChecked(exec, "git", ["show", "-s", "--format=%P %T", "HEAD"], options)).stdout.trim();
+	if (actual !== `${parent} ${tree}`) throw new Error("Commit parent or tree changed, possibly by a hook; inspect the actual commit and do not replay it");
+}
+
+type Options = { cwd: string; agentDir?: string; exec?: Exec };
+
+/** A single session/worktree owns this object. Unknown mutations consume it until manual review. */
+export class GitCommitter {
+	private pending?: PendingCommit & { inspectionId: string; branch: string };
+	private uncertain = false;
+	private readonly exec: Exec;
+	private readonly options: Options;
+	constructor(options: Options) { this.options = options; this.exec = options.exec ?? spawnBounded; }
+
+	async inspect(target: string, signal?: AbortSignal) {
+		if (this.uncertain) throw new Error("Commit outcome needs manual review; do not replay it. Reload only after review");
+		requiredText(target, "target");
+		return withWorktreeLock(this.options.cwd, async () => {
+			const options = { cwd: this.options.cwd, signal };
+			const branch = requiredText((await runChecked(this.exec, "git", ["branch", "--show-current"], options)).stdout.trim(), "attached branch");
+			const targetOid = requiredOid((await runChecked(this.exec, "git", ["rev-parse", "--verify", "--end-of-options", `${target}^{commit}`], options)).stdout.trim(), "target OID");
+			const pending = await inspectPendingCommit(this.exec, options);
+			const mergeBase = requiredOid((await runChecked(this.exec, "git", ["merge-base", pending.head, targetOid], options)).stdout.trim(), "merge base");
+			const inspectionId = randomUUID();
+			this.pending = { ...pending, inspectionId, branch };
+			return { inspectionId, head: pending.head, targetOid, mergeBase, paths: [...parseStatusSnapshot(pending.status).keys()] };
+		}, { agentDir: this.options.agentDir, signal });
+	}
+
+	async commit(inspectionId: string, pathsInput: string[], message: string, signal?: AbortSignal) {
+		const pending = this.pending;
+		if (!pending || pending.inspectionId !== inspectionId || this.uncertain) throw new Error("Commit inspection is absent, stale, or consumed");
+		const paths = commitPaths(pathsInput);
+		if (paths.some((path) => !parseStatusSnapshot(pending.status).has(path))) throw new Error("Commit paths must be reviewed pending paths");
+		validateCommitMessage(message);
+		return withWorktreeLock(this.options.cwd, async () => {
+			const options = { cwd: this.options.cwd, signal };
+			if ((await runChecked(this.exec, "git", ["branch", "--show-current"], options)).stdout.trim() !== pending.branch) throw new Error("Commit branch changed");
+			await requirePendingCommit(this.exec, options, pending);
+			// Stage validation can fail without consuming an attempt. No commit has run yet.
+			await stageCommitPaths(this.exec, options, paths);
+			this.pending = undefined;
+			this.uncertain = true;
+			await commitStagedPaths(this.exec, options, message);
+			const head = await readHead(this.exec, options);
+			this.uncertain = false;
+			return { head };
+		}, { agentDir: this.options.agentDir, signal });
+	}
+}

package/extensions/pr-command.ts

@@ -12,6 +12,7 @@ import {
 	loadCurrentPullRequest,
 	samePullRequestSnapshot,
 	type CurrentPullRequest,
+	type CurrentPullRequestDiscovery,
 } from "./pr-github.ts";
 import {
 	deriveNextStep,
@@ -39,10 +40,14 @@ type WorkflowLaunchAction = "prepare" | "inspect" | "rebase" | "start" | "resume
 type WorkflowReservationResult = { runId: string; action: WorkflowLaunchAction };
 
 type PrCommandPi = Pick<ExtensionAPI, "exec" | "getCommands" | "sendUserMessage">;
+export type PublicationRequest = { base?: string; allowUpstream: boolean };
+
 export type PrCommandInvocation = ((nextStep: NextStep) => void) & {
 	sessionGeneration: number;
 	assertCurrent(): void;
 	run?: PrRun;
+	publication?: PublicationRequest;
+	onDiscovery?: (discovery: CurrentPullRequestDiscovery) => void;
 	staleRediscoveries?: number;
 	replanAuthority?: CurrentPullRequest;
 };
@@ -245,6 +250,7 @@ export function createPrCommandHandler(
 		if (args.trim()) throw new Error("/pr does not accept arguments");
 		const discovery = await load(pi, ctx);
 		onRouteResolved?.assertCurrent();
+		onRouteResolved?.onDiscovery?.(discovery);
 		if (discovery.kind === "current") onRouteResolved?.run?.observeRemote(discovery.pullRequest.head.oid);
 		if (onRouteResolved?.replanAuthority && (discovery.kind !== "current" ||
 			!samePullRequestSnapshot(onRouteResolved.replanAuthority, discovery.pullRequest))) {
@@ -254,6 +260,10 @@ export function createPrCommandHandler(
 			!isSameConfirmedMerge(linkedAuthority, discovery.pullRequest))) {
 			throw new Error("Link branch continuation cancelled: configured pull request context changed");
 		}
+		const publication = onRouteResolved?.publication;
+		if (publication?.base && discovery.kind === "current" && publication.base !== discovery.pullRequest.base.ref) {
+			throw new Error(`Requested base ${publication.base} differs from current PR base ${discovery.pullRequest.base.ref}; no retargeting is authorized`);
+		}
 		let nextStep = deriveNextStep(discovery);
 		if (discovery.kind === "current" && discovery.pullRequest.lifecycle === "open" &&
 			!discovery.pullRequest.conditions.draft && discovery.pullRequest.target.provenance === "configured" &&
@@ -267,13 +277,22 @@ export function createPrCommandHandler(
 			nextStep = "sweep";
 			onRouteResolved?.assertCurrent();
 		}
-		if (discovery.kind === "current" && (nextStep === "merge" || nextStep === "none" || nextStep === "wait-ci") &&
+		if (!publication && discovery.kind === "current" && (nextStep === "merge" || nextStep === "none" || nextStep === "wait-ci") &&
 			discovery.pullRequest.lifecycle === "open" && !discovery.pullRequest.conditions.draft &&
 			discovery.pullRequest.target.provenance === "configured" &&
 			discovery.pullRequest.local.worktree === "clean" && discovery.pullRequest.local.head === "equal") {
 			if (await needsFeedback(discovery.pullRequest, { cwd: ctx.cwd, signal: ctx.signal, load })) nextStep = "sweep";
 			onRouteResolved?.assertCurrent();
 		}
+		if (publication) {
+			if ((nextStep === "link-branch" || nextStep === "create" && discovery.kind === "none" && discovery.creationTarget.provenance === "inferred") && !publication.allowUpstream) {
+				throw new Error("Publication needs repository-local upstream configuration; ask for permission, then set allowUpstream: true");
+			}
+			if (!["create", "publish-work", "sync-local", "link-branch", "none"].includes(nextStep)) {
+				ctx.ui.notify(`Create/update authorization stops before ${nextStep}${discovery.kind === "current" ? `: ${discovery.pullRequest.url.href}` : ""}; use /pr only for the full lifecycle`, "info");
+				nextStep = "none";
+			}
+		}
 		onRouteResolved?.(nextStep);
 		if (discovery.kind === "inactive") return nextStep;
 		if (discovery.kind === "blocked") {