@senad-d/branchme 0.1.4 → 0.1.5

package/CHANGELOG.md

@@ -3,8 +3,8 @@
 ## 0.1.0 - Unreleased
 
 - Implemented the `branchme` informational slash command with help aliases.
-- Added strict BranchMe tools: `branch_status`, `change_branch`, `create_branch`, `push_branch`, and `pull_request`.
-- Added argv-style git helpers for repository status, branch validation/creation/switching, clean-worktree preflight, upstream detection, and current-branch push/publish.
+- Added strict BranchMe tools: `branch_status`, `change_branch`, `pull_branch`, `create_branch`, `push_branch`, and `pull_request`.
+- Added argv-style git helpers for repository status, branch validation/creation/switching, clean-worktree preflight, upstream detection, fast-forward-only current-branch pull, and current-branch push/publish.
 - Added GitHub repository resolution, environment-token and local `.env` token fallback handling, REST pull request creation, response validation, and token redaction.
 - Added bounded automatic Git context before each agent run with branch/upstream state, working-tree counts and unstaged paths, authenticated related-open-PR lookup, and recent commits.
 - Expanded `branch_status` into a shared, explicit, read-only context refresh for state that may change during a run.

package/README.md

@@ -11,12 +11,12 @@
 
 <p align="center">
   Current-repository branch and pull request tools for <a href="https://pi.dev">pi</a>.
-  <br />Inspect branch state, switch/create branches, push, and open GitHub PRs from pi prompts.
+  <br />Inspect branch state, switch/create/update branches, push, and open GitHub PRs from pi prompts.
 </p>
 
 ---
 
-BranchMe is a Pi extension for safe branch workflow automation. Before each agent run, it appends a bounded, read-only snapshot of the current Git repository to the system prompt. It also adds an informational `/branchme` command and five agent-callable tools that explicitly refresh state, switch to an existing local branch, create a branch from the current `HEAD`, push the current branch, and create a GitHub pull request.
+BranchMe is a Pi extension for safe branch workflow automation. Before each agent run, it appends a bounded, read-only snapshot of the current Git repository to the system prompt. It also adds an informational `/branchme` command and six agent-callable tools that explicitly refresh state, switch to an existing local branch, fast-forward the clean current branch from its upstream, create a branch from the current `HEAD`, push the current branch, and create a GitHub pull request.
 
 <table align="center">
   <tr>
@@ -30,8 +30,8 @@ BranchMe is a Pi extension for safe branch workflow automation. Before each agen
 </table>
 
 - **Context-aware:** every agent run starts with bounded branch, working-tree, related-PR, and recent-commit metadata; repository metadata is untrusted data, not instructions.
-- **Current-repository only:** Git and GitHub operations are scoped to the checkout where pi is running.
-- **Commit-safe:** context collection is read-only, and BranchMe never stages files, creates commits, generates commit messages, rebases, merges, resets, or edits files directly.
+- **Current-repository only:** Git and GitHub operations are scoped to the checkout where pi is running; `pull_branch` updates only the clean current branch from its configured upstream.
+- **Commit-safe:** context collection is read-only, and BranchMe never stages files, creates commits, generates commit messages, rebases, creates merge commits, resets, or edits files directly.
 - **Strict tools:** tool schemas reject extra properties such as `force`, `stash`, `discard`, `owner`, `repo`, `path`, or `baseRef`.
 - **PR-ready:** create GitHub pull requests from existing local branches after verifying the `headBranch` matches GitHub and the base is visible, with explicit PR fields and `GITHUB_TOKEN` or `GH_TOKEN` from the process environment or a local `.env` fallback.
 
@@ -81,12 +81,14 @@ A typical BranchMe flow is:
 
 1. Use the automatic snapshot to understand state at the start of the agent run.
 2. Use `branch_status` when you explicitly need fresh state, especially after a Git mutation in the same run.
-3. Switch with `change_branch` or create from current `HEAD` with `create_branch`.
-4. Make edits and commit outside BranchMe.
-5. Push the current branch with `push_branch`.
-6. After `push_branch` completes and GitHub can see the branches, create a pull request with `pull_request`.
+3. Switch to the local base branch with `change_branch`.
+4. Update it from its configured upstream with `pull_branch`, which requires a clean worktree and uses fast-forward-only semantics.
+5. Create from the updated `HEAD` with `create_branch`.
+6. Make edits and commit outside BranchMe.
+7. Push the current branch with `push_branch`.
+8. After `push_branch` completes and GitHub can see the branches, create a pull request with `pull_request`.
 
-BranchMe is tool-based. The slash command is informational only and never changes branches, pushes, commits, stages, edits files, or opens pull requests.
+BranchMe is tool-based. The slash command is informational only and never changes or updates branches, pushes, commits, stages, edits files, or opens pull requests.
 
 ---
 
@@ -156,7 +158,7 @@ $EDITOR .env
 pi
 ```
 
-`push_branch` uses your normal Git remote credentials. BranchMe does not inject `GITHUB_TOKEN` into `git push`.
+`pull_branch` and `push_branch` use your normal Git remote credentials. BranchMe does not inject `GITHUB_TOKEN` into `git pull` or `git push`.
 When the current branch already has an upstream, BranchMe pushes an explicit `HEAD:<upstream-branch-ref>` refspec to the configured upstream remote instead of relying on a bare `git push`.
 Run `pull_request` only after `push_branch` has completed; `pull_request` preflights the GitHub `headBranch` and `baseBranch` before creating the PR and fails with retry guidance if a branch is not visible yet or the GitHub `headBranch` commit does not match the local branch.
 
@@ -197,11 +199,12 @@ Commands are informational only. BranchMe actions are performed by agent-callabl
 | --- | --- | --- |
 | `branch_status` | `{}` | Explicitly refreshes the same bounded context used at agent start: repo root in structured details, branch/detached state, upstream and ahead/behind counts, working-tree counts and unstaged/untracked paths, related open PR, and recent commits. It is read-only. |
 | `change_branch` | `{ "branchName": string }` | Validates `branchName`, requires `refs/heads/<branchName>` to exist locally, rejects dirty worktrees, and runs `git switch <branchName>`. |
+| `pull_branch` | `{}` | Requires a clean current branch with a configured upstream and runs `git pull --ff-only --no-rebase --no-autostash <upstream-remote> <upstream-branch-ref>`; divergence fails without rebasing or creating a merge commit. |
 | `create_branch` | `{ "branchName": string }` | Validates `branchName`, rejects existing local branches, and runs `git switch -c <branchName>` from current `HEAD`. |
 | `push_branch` | `{}` | Pushes the current branch to its configured upstream remote with an explicit `HEAD:<upstream-branch-ref>` refspec, or publishes it with `git push --set-upstream origin <currentBranch>` when no upstream exists. |
 | `pull_request` | `{ "headBranch": string, "baseBranch": string, "title": string, "body": string, "draft": boolean }` | Preflights GitHub branch visibility and verifies the GitHub `headBranch` commit matches the local branch, then creates a pull request in the resolved current repository via `POST /repos/{owner}/{repo}/pulls`; branch refs must exist locally and cannot use `owner:branch`. |
 
-All schemas reject additional properties. `change_branch` never accepts `baseRef`, `force`, `stash`, `discard`, `create`, `owner`, `repo`, or path inputs. `pull_request` never accepts `owner`, `repo`, or owner-prefixed branch refs; BranchMe resolves the repository from local `origin` and/or matching `GITHUB_REPOSITORY`.
+All schemas reject additional properties. `change_branch` never accepts `baseRef`, `force`, `stash`, `discard`, `create`, `owner`, `repo`, or path inputs. `pull_branch` has a strict empty schema and never accepts a branch, remote, force, or rebase option. `pull_request` never accepts `owner`, `repo`, or owner-prefixed branch refs; BranchMe resolves the repository from local `origin` and/or matching `GITHUB_REPOSITORY`.
 
 ---
 
@@ -219,7 +222,7 @@ Before each agent run, BranchMe appends an **Automatic Git Context** snapshot to
 
 Collection defaults are a 5-second timeout per local Git command, a 4-second related-PR lookup timeout, at most 512 characters per metadata value, and at most 4,000 characters for the rendered snapshot. GitHub response bodies are limited to 64 KiB. The formatter can further shorten values or omit entries to stay within the total limit.
 
-The snapshot is fresh at agent start but is not live. A branch switch, commit, file change, push, or other mutation later in the same run can make it stale. `branch_status` performs an explicit current-state refresh through the same shared collector and remains read-only; it does not mutate files, Git state, or GitHub state.
+The snapshot is fresh at agent start but is not live. A branch switch, pull, commit, file change, push, or other mutation later in the same run can make it stale. `branch_status` performs an explicit current-state refresh through the same shared collector and remains read-only; it does not mutate files, Git state, or GitHub state.
 
 Related-PR metadata does not come from Git alone. When repository, branch, and credentials resolve, automatic collection and explicit `branch_status` may make an authenticated `GET /repos/{owner}/{repo}/pulls?state=open&head={owner}:{branch}&per_page=1` request. Without a token there is no unauthenticated fallback or GitHub request; the PR field is reported as unavailable while local Git context remains usable.
 
@@ -229,7 +232,8 @@ Use BranchMe from pi prompts or automation that drives pi with explicit tool cal
 
 ```text
 Use branch_status.
-Create branch feature/docs-refresh from the current HEAD with create_branch.
+Switch to the base branch with change_branch, then use pull_branch after the switch completes.
+Create branch feature/docs-refresh from the updated current HEAD with create_branch.
 Push the current branch with push_branch.
 After push_branch completes, create a draft pull request from feature/docs-refresh to main titled "Refresh docs" with this body: "...".
 ```
@@ -239,6 +243,7 @@ BranchMe operates only on the repository where pi is running:
 - Automatic collection and `branch_status` run bounded, read-only Git commands from the verified git root.
 - Git commands use `pi.exec("git", args, { cwd, signal, timeout })` with argv arrays; repository mutations run from the verified git root.
 - `change_branch` switches only to existing local branches and has no `force`, `stash`, `discard`, remote, or path input.
+- `pull_branch` requires a clean worktree and configured upstream, updates only the current branch with `git pull --ff-only --no-rebase --no-autostash`, and has no branch, remote, force, or rebase input.
 - `create_branch` creates from the current `HEAD` only and has no `baseRef` input.
 - `push_branch` pushes only the current branch, uses no bare upstream `git push`, and has no `branchName` input.
 - `pull_request` creates PRs only for the resolved current GitHub repository, requires `headBranch` and `baseBranch` to exist locally, requires the GitHub `headBranch` commit to match the local branch, queues behind in-flight same-repository git mutation windows when possible, and rejects `owner:branch` head refs.
@@ -287,10 +292,12 @@ Ensure the token and Git credentials have permission for the branch and pull req
 | Problem | Try |
 | --- | --- |
 | Not a git repository | Start pi from inside a git checkout. |
-| Detached `HEAD` | Use `change_branch` to switch to an existing local branch, or checkout a branch before `create_branch` or `push_branch`. |
+| Detached `HEAD` | Use `change_branch` to switch to an existing local branch, or checkout a branch before `pull_branch`, `create_branch`, or `push_branch`. |
 | Branch already exists | Choose a new local branch name for `create_branch`, or use `change_branch` to switch to it. |
 | Branch does not exist locally | Create a local branch first; `change_branch` does not checkout remote branches. |
-| Dirty worktree before branch switch | Commit, stash, or discard changes outside BranchMe before using `change_branch`. |
+| Dirty worktree before branch switch or pull | Commit, stash, or discard changes outside BranchMe before using `change_branch` or `pull_branch`. |
+| Pull has no upstream | Configure the current branch upstream outside BranchMe, then retry `pull_branch`. |
+| Pull is not a fast-forward | Reconcile the divergent branch outside BranchMe; `pull_branch` never rebases, force-updates, or creates a merge commit. |
 | Push fails | Confirm the current branch is correct and your normal Git remote credentials can push. |
 | Related PR is unavailable | Set `GITHUB_TOKEN` or `GH_TOKEN` before starting pi if related-PR context is wanted. Without a token, BranchMe keeps local context and intentionally makes no unauthenticated GitHub request. |
 | PR auth fails | Set `GITHUB_TOKEN` or `GH_TOKEN` before starting pi, or copy `.env.example` to `.env` and fill in one token. |
@@ -312,7 +319,7 @@ npm run check:pack
 printf '/branchme help\n/quit\n' | pi --no-extensions -e .
 ```
 
-Validation covers TypeScript typechecking, formatting checks, automatic context collection and prompt injection, mocked GitHub lookup, unit tests, package checks, checkout Pi runtime smoke, and package-content verification. The checkout smoke loads BranchMe through Pi, then uses a temporary verifier command to confirm all five BranchMe tools are visible through `pi.getAllTools()` with strict schemas and prompt metadata. Smoke-test notes are recorded in [`docs/SMOKE_TEST.md`](docs/SMOKE_TEST.md), and TUI/help captures are stored in [`docs/TUI_CAPTURE.md`](docs/TUI_CAPTURE.md).
+Validation covers TypeScript typechecking, formatting checks, automatic context collection and prompt injection, mocked GitHub lookup, unit tests, package checks, checkout Pi runtime smoke, and package-content verification. The checkout smoke loads BranchMe through Pi, then uses a temporary verifier command to confirm all six BranchMe tools are visible through `pi.getAllTools()` with strict schemas and prompt metadata. Smoke-test notes are recorded in [`docs/SMOKE_TEST.md`](docs/SMOKE_TEST.md), and TUI/help captures are stored in [`docs/TUI_CAPTURE.md`](docs/TUI_CAPTURE.md).
 
 Refresh TUI captures intentionally with:
 

package/SECURITY.md

@@ -17,14 +17,17 @@ Implemented git mutations are limited to:
 
 - `change_branch`: `git switch <branchName>` after branch-name validation, local `refs/heads/<branchName>` verification, and clean-worktree preflight.
 - `create_branch`: `git switch -c <branchName>` from current `HEAD` after branch-name validation and existing-branch checks.
+- `pull_branch`: `git pull --ff-only --no-rebase --no-autostash <upstreamRemote> <upstreamBranchRef>` for the clean current branch after validating its configured upstream target.
 - `push_branch`: `git push <upstreamRemote> HEAD:<upstreamBranchRef>` for the current branch when an upstream exists, or `git push --set-upstream origin <currentBranch>` when no upstream exists.
 
 Before each agent run, BranchMe also runs bounded, read-only Git commands to collect branch/upstream/ahead-behind state, working-tree counts, up to 20 unstaged or untracked path entries, and up to 5 recent commits. The same collector runs when `branch_status` explicitly refreshes context. Collection does not run `switch`, `push`, `add`, `commit`, or any other mutation, and it never reads diffs or file contents.
 
-Branch switching can update working-tree files as normal Git checkout behavior. Mutating branch operations for the same repository are serialized to avoid same-turn branch races. `pull_request` also uses the same repository queue around PR preflight and creation so it can wait behind an already-started same-repository push. BranchMe rejects dirty worktrees before `change_branch` and does not force checkout, stash, stage files, create commits, reset, rebase, merge, or edit files directly.
+Branch switching and fast-forward pulls can update working-tree files as normal Git behavior. Mutating branch operations for the same repository are serialized to avoid same-turn branch races. `pull_request` also uses the same repository queue around PR preflight and creation so it can wait behind an already-started same-repository mutation. BranchMe rejects dirty worktrees before `change_branch` and `pull_branch`. It does not force checkout, stash, stage files, create commits, reset, rebase, create merge commits, or edit files directly.
 
 ## Network behavior
 
+`pull_branch` and `push_branch` contact the configured Git remote through the user's normal Git transport and credentials. They do not use or inject `GITHUB_TOKEN` or `GH_TOKEN`.
+
 BranchMe's GitHub helpers use these REST API requests:
 
 ```text
@@ -45,12 +48,15 @@ BranchMe operates on the current repository only.
 - The GitHub repository is inferred from local `origin` and/or `GITHUB_REPOSITORY`.
 - Tool inputs never accept filesystem paths, `owner`, `repo`, or owner-prefixed `owner:branch` PR refs.
 - `change_branch` accepts only `branchName` and never creates branches, checks out remote branches, forces, stashes, or discards changes.
+- `pull_branch` accepts no parameters, updates only the clean current branch from its configured upstream, and uses fast-forward-only semantics.
 - If local `origin` and `GITHUB_REPOSITORY` both resolve but disagree, PR creation and related-PR lookup fail closed.
 - PR branch inputs are validated as existing local branch-name refs; missing local branches and cross-repository `head` values are rejected before token lookup or any GitHub request.
 - PR branch inputs must also be visible on GitHub before the PR is created, and `headBranch` must match the local branch commit; unpublished or stale `headBranch` values fail with guidance to run `push_branch`, wait for it to complete, and retry `pull_request`.
 
 ## Credentials
 
+Git pull and push authentication is handled by the user's configured Git credential and transport setup. BranchMe never passes GitHub API tokens to Git commands.
+
 `pull_request` and related-PR lookup check `process.env.GITHUB_TOKEN`, then `process.env.GH_TOKEN`. If neither process token is set, BranchMe reads a local `.env` file from the verified git root and checks:
 
 - `GITHUB_TOKEN` (preferred)

package/docs/SMOKE_TEST.md

@@ -18,7 +18,7 @@ pi --no-extensions -e .
 ## Automated smoke behavior
 
 - `npm run smoke:pi` first runs isolated checkout Pi processes from a temporary non-Git working directory: one with `pi --no-extensions -e <package> -e <temporary verifier>` and `/branchmeverify verify`, then one with `pi --no-extensions -e <package>` and `/branchme help`.
-- The temporary command verifier calls `pi.getAllTools()` after BranchMe loads and confirms `branch_status`, `change_branch`, `create_branch`, `push_branch`, and `pull_request` are active runtime tools with strict schemas, prompt guidelines, descriptions, and extension source metadata.
+- The temporary command verifier calls `pi.getAllTools()` after BranchMe loads and confirms `branch_status`, `change_branch`, `pull_branch`, `create_branch`, `push_branch`, and `pull_request` are active runtime tools with strict schemas, prompt guidelines, descriptions, and extension source metadata.
 - A second temporary verifier registers a deterministic local smoke model, blocks `fetch`, and runs normal prompts through real Pi lifecycle handling. It verifies automatic no-tool Git context in a temporary repository, one real `branch_status` tool refresh after a verifier-created local change, safe credential-free related-PR status with no request, and non-Git startup fallback.
 - The checkout command smoke accepts either `/branchme help` text or the read-only BranchMe status fallback as equivalent non-mutating command output.
 - `npm run smoke:pi:packed` creates an npm tarball under a temporary directory, installs that tarball into a separate temporary package with `npm install --omit=dev`, and runs pi against the installed package instead of the source checkout.
@@ -32,7 +32,7 @@ pi --no-extensions -e .
 ## Result
 
 - `npm run validate` passed.
-- `npm run smoke:pi` loaded BranchMe through Pi, verified all five BranchMe tools through the real `pi.getAllTools()` runtime surface, and confirmed non-mutating BranchMe command output.
+- `npm run smoke:pi` loaded BranchMe through Pi, verified all six BranchMe tools through the real `pi.getAllTools()` runtime surface, and confirmed non-mutating BranchMe command output.
 - The isolated Git-context prompt smoke observed the `before_agent_start` snapshot, answered branch and dirty-tree state without a tool call, refreshed a verifier-created local change through one real `branch_status` call, returned safe unavailable context without credentials or outside Git, and attempted no network request.
 - `npm run smoke:pi:packed` packed BranchMe outside the repository, installed the artifact in a temporary production workspace, loaded the installed package through Pi, and confirmed non-mutating BranchMe command output.
 - `npm run check:pack` confirmed the package contents are limited to public docs, images, source, license, package metadata, `.env.example`, and `tsconfig.json`.

package/docs/STRUCTURE.md

@@ -1,6 +1,6 @@
 # BranchMe Structure Guide
 
-BranchMe is a TypeScript Pi extension package for current-repository git branch, push, and GitHub pull request workflows.
+BranchMe is a TypeScript Pi extension package for current-repository git branch update, push, and GitHub pull request workflows.
 
 ## Source layout
 
@@ -13,7 +13,7 @@ src/
 ├── commands/
 │   └── branchme-command.ts       # /branchme status/help command; informational only
 ├── tools/
-│   └── branchme-tools.ts         # branch_status/change_branch/create_branch/push_branch/pull_request registration
+│   └── branchme-tools.ts         # branch_status/change_branch/pull_branch/create_branch/push_branch/pull_request registration
 ├── git.ts                        # argv-style git helpers and per-repo workflow queue
 ├── github.ts                     # GitHub repo resolution, env/.env tokens, branch preflight, REST calls, redaction
 └── ui/
@@ -22,11 +22,11 @@ src/
 
 ## Module boundaries
 
-1. `src/extension.ts` stays small and registers the command, five tools, and one `before_agent_start` context hook.
+1. `src/extension.ts` stays small and registers the command, six tools, and one `before_agent_start` context hook.
 2. `src/git-context.ts` owns the shared read-only collector, escaped/bounded formatter, automatic system-prompt append, and the current-state output used by `branch_status`.
 3. `src/commands/branchme-command.ts` parses `/branchme`, `/branchme help`, `--help`, and `-h`; it never performs git or GitHub mutations and avoids raw stdout in JSON mode.
 4. `src/tools/branchme-tools.ts` owns TypeBox schemas, prompt metadata, tool content, and safe structured details. `branch_status` delegates to the shared context collector for an explicit refresh.
-5. `src/git.ts` owns current-repository git behavior: root detection, branch/upstream/ahead-behind inspection, working-tree parsing, recent-commit collection, branch validation, branch creation, existing-local-branch switching, clean-worktree preflight, current-branch push/publish, and the per-repository workflow queue.
+5. `src/git.ts` owns current-repository git behavior: root detection, branch/upstream/ahead-behind inspection, working-tree parsing, recent-commit collection, branch validation, branch creation, existing-local-branch switching, clean-worktree preflight, fast-forward-only current-branch pull, current-branch push/publish, and the per-repository workflow queue.
 6. `src/github.ts` owns GitHub `owner/repo` parsing, repository boundary checks, `GITHUB_TOKEN`/`GH_TOKEN` process-env and hardened git-root `.env` fallback resolution, authenticated related-open-PR lookup, PR branch-name syntax validation, GitHub branch visibility/commit preflight, PR REST calls, bounded response validation, and redacted errors.
 7. `src/redaction.ts` owns shared credential redaction for Git, GitHub, and prompt-bound metadata.
 8. `src/types.ts` keeps serializable details shared by helpers, context, and tools.
@@ -36,7 +36,7 @@ src/
 
 - No long-lived processes, watchers, timers, sockets, or background jobs start in the extension factory.
 - A single `before_agent_start` handler synchronously collects a fresh snapshot for each agent run and appends it to the existing system prompt; failures degrade to bounded unavailable context rather than blocking startup.
-- Slash commands are informational; tools perform branch, push, and PR actions. There is no context command or sixth tool.
+- Slash commands are informational; tools perform branch update, push, and PR actions. There is no context command or seventh tool.
 - Every tool uses a strict TypeBox object schema with `additionalProperties: false`.
 - Every tool defines a description, `promptSnippet`, and tool-specific `promptGuidelines` that explicitly name the tool.
 - Git commands use `pi.exec("git", args, { cwd, signal, timeout })` with argv arrays; repository mutations run from the verified git root and same-repository mutation/PR windows are serialized per repository.
@@ -51,11 +51,12 @@ src/
 - Related-PR lookup may issue an authenticated `GET /pulls` before every agent run and on explicit refresh. It has a 4-second timeout and 64 KiB response limit, and makes no unauthenticated fallback request.
 - The start-of-run snapshot may be stale after a mutation in that same run; `branch_status` is the explicit read-only refresh.
 - `change_branch` mutates local HEAD and working-tree files only through `git switch <branchName>` for existing local branches after a clean-worktree preflight.
+- `pull_branch` requires a clean worktree and configured upstream, then updates only the current branch with an explicit `git pull --ff-only --no-rebase --no-autostash <remote> <remote-ref>` command; divergence fails without a rebase or merge commit.
 - `create_branch` mutates local branch/HEAD only with `git switch -c`.
 - `push_branch` mutates remote refs only for the current branch and uses an explicit upstream remote/refspec instead of bare `git push` when an upstream exists.
 - `pull_request` requires `headBranch` and `baseBranch` to exist locally, requires `headBranch` to match the GitHub-visible branch commit, queues behind already-started same-repository git mutation windows, makes GitHub REST API calls for the resolved current repository only, and rejects missing, owner-prefixed, or unsafe branch refs before token lookup or the request.
 - `pull_request` reads `GITHUB_TOKEN` or `GH_TOKEN` from process environment first; only when neither process token is set does it read those token keys from a small regular `.env` file in the verified git root as a fallback.
-- BranchMe does not force checkout, stash, stage, commit, directly edit files, read non-token `.env` keys, follow unsafe `.env` file types, depend on GitHub CLI, or collect telemetry.
+- BranchMe does not force checkout, stash, stage, commit, rebase, create merge commits, directly edit files, read non-token `.env` keys, follow unsafe `.env` file types, depend on GitHub CLI, or collect telemetry.
 
 ## Documentation
 

package/docs/TUI_CAPTURE.md

@@ -23,16 +23,19 @@ Commands only show info; BranchMe tools perform actions.
 ## Workflow
 
 1. `branch_status` — inspect repo and branch state.
-2. `change_branch` / `create_branch` — switch to an existing clean branch or create one from `HEAD`.
-3. Commit outside BranchMe.
-4. `push_branch` — push the current branch.
-5. `pull_request` — open a PR after `push_branch` completes and GitHub sees the branches.
+2. `change_branch` — switch to the clean local base branch.
+3. `pull_branch` — fast-forward the current branch from its configured upstream.
+4. `create_branch` — create a new branch from the updated `HEAD`.
+5. Commit outside BranchMe.
+6. `push_branch` — push the current branch.
+7. `pull_request` — open a PR after `push_branch` completes and GitHub sees the branches.
 
 ## Requirements
 
 - Run inside a Git repo with `git` available.
 - For PRs: GitHub `origin` and `GITHUB_TOKEN` or `GH_TOKEN` (environment or `.env`).
-- BranchMe never stages or commits.
+- `pull_branch` requires a clean working tree and configured upstream.
+- BranchMe never stages, commits, rebases, or creates merge commits.
 ```
 
 ## Panel: Tiny mode: clean branch with token
@@ -98,12 +101,12 @@ Width: 80
 │   Status            │ WORKFLOW                                               │
 │▶  Workflow          │  branch_status  -> inspect                             │
 │                     │  change_branch  -> existing local                      │
+│                     │  pull_branch    -> fast-forward                        │
 │                     │  create_branch  -> from HEAD                           │
 │                     │  push_branch    -> current branch                      │
 │                     │  pull_request   -> after push                          │
-│                     │                                                        │
 ├─────────────────────┴────────────────────────────────────────────────────────┤
-│ 2/2 • workflow • inspect → change/create → push → PR                         │
+│ 2/2 • workflow • inspect → change → pull → create → push → PR                │
 ╰──────────────────────────────────────────────────────────────────────────────╯
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@senad-d/branchme",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "type": "module",
   "description": "Minimal Pi extension for current-repository git branch, push, and pull request workflows.",
   "license": "MIT",

package/src/commands/branchme-command.ts

@@ -32,16 +32,19 @@ export function getBranchMeHelpText(): string {
     "## Workflow",
     "",
     "1. `branch_status` — inspect repo and branch state.",
-    "2. `change_branch` / `create_branch` — switch to an existing clean branch or create one from `HEAD`.",
-    "3. Commit outside BranchMe.",
-    "4. `push_branch` — push the current branch.",
-    "5. `pull_request` — open a PR after `push_branch` completes and GitHub sees the branches.",
+    "2. `change_branch` — switch to the clean local base branch.",
+    "3. `pull_branch` — fast-forward the current branch from its configured upstream.",
+    "4. `create_branch` — create a new branch from the updated `HEAD`.",
+    "5. Commit outside BranchMe.",
+    "6. `push_branch` — push the current branch.",
+    "7. `pull_request` — open a PR after `push_branch` completes and GitHub sees the branches.",
     "",
     "## Requirements",
     "",
     "- Run inside a Git repo with `git` available.",
     "- For PRs: GitHub `origin` and `GITHUB_TOKEN` or `GH_TOKEN` (environment or `.env`).",
-    "- BranchMe never stages or commits.",
+    "- `pull_branch` requires a clean working tree and configured upstream.",
+    "- BranchMe never stages, commits, rebases, or creates merge commits.",
   ].join("\n");
 }
 

package/src/constants.ts

@@ -4,6 +4,7 @@ export const BRANCHME_COMMAND_NAME = "branchme";
 export const BRANCH_STATUS_TOOL_NAME = "branch_status";
 export const CREATE_BRANCH_TOOL_NAME = "create_branch";
 export const CHANGE_BRANCH_TOOL_NAME = "change_branch";
+export const PULL_BRANCH_TOOL_NAME = "pull_branch";
 export const PUSH_BRANCH_TOOL_NAME = "push_branch";
 export const PULL_REQUEST_TOOL_NAME = "pull_request";
 
@@ -11,12 +12,14 @@ export const BRANCHME_TOOL_NAMES = [
   BRANCH_STATUS_TOOL_NAME,
   CREATE_BRANCH_TOOL_NAME,
   CHANGE_BRANCH_TOOL_NAME,
+  PULL_BRANCH_TOOL_NAME,
   PUSH_BRANCH_TOOL_NAME,
   PULL_REQUEST_TOOL_NAME,
 ] as const;
 
 export const GIT_STATUS_TIMEOUT_MS = 5_000;
 export const GIT_MUTATION_TIMEOUT_MS = 30_000;
+export const GIT_PULL_TIMEOUT_MS = 120_000;
 export const GIT_PUSH_TIMEOUT_MS = 120_000;
 export const GITHUB_RELATED_PR_TIMEOUT_MS = 4_000;
 

package/src/git.ts

@@ -4,6 +4,7 @@ import {
   GIT_CONTEXT_RECENT_COMMIT_LIMIT,
   GIT_CONTEXT_VALUE_LIMIT_CHARS,
   GIT_MUTATION_TIMEOUT_MS,
+  GIT_PULL_TIMEOUT_MS,
   GIT_PUSH_TIMEOUT_MS,
   GIT_STATUS_TIMEOUT_MS,
   MAX_SUMMARY_OUTPUT_CHARS,
@@ -18,6 +19,7 @@ import type {
   GitExecResult,
   GitFileChange,
   GitFileChangeSummary,
+  PullBranchDetails,
   PushBranchDetails,
   RecentCommit,
   WorkingTreeDetails,
@@ -182,6 +184,12 @@ export async function getUpstreamBranch(
   return upstream || null;
 }
 
+interface ConfiguredUpstreamTarget {
+  upstream: string;
+  remote: string;
+  remoteRef: string;
+}
+
 interface PushTarget {
   upstream: string | null;
   mode: "push" | "publish";
@@ -191,21 +199,23 @@ interface PushTarget {
   args: string[];
 }
 
-function validateRemoteName(remote: string): void {
-  if (!remote) throw new Error("Unable to push current branch: upstream remote is missing.");
-  if (remote === ".") throw new Error("Unable to push current branch: upstream is a local branch, not a remote.");
-  if (remote.startsWith("-")) throw new Error("Unable to push current branch: upstream remote cannot start with '-'.");
+type UpstreamOperation = "pull" | "push";
+
+function validateRemoteName(remote: string, operation: UpstreamOperation): void {
+  if (!remote) throw new Error(`Unable to ${operation} current branch: upstream remote is missing.`);
+  if (remote === ".") throw new Error(`Unable to ${operation} current branch: upstream is a local branch, not a remote.`);
+  if (remote.startsWith("-")) throw new Error(`Unable to ${operation} current branch: upstream remote cannot start with '-'.`);
   if (remote.includes(":") || remote.includes("@")) {
-    throw new Error("Unable to push current branch: upstream remote name cannot be a URL or user-prefixed target.");
+    throw new Error(`Unable to ${operation} current branch: upstream remote name cannot be a URL or user-prefixed target.`);
   }
   if (/[\u0000-\u001f\u007f]/u.test(remote) || /\s/u.test(remote)) {
-    throw new Error("Unable to push current branch: upstream remote contains whitespace or control characters.");
+    throw new Error(`Unable to ${operation} current branch: upstream remote contains whitespace or control characters.`);
   }
 }
 
-function normalizeRemoteHeadRef(mergeRef: string): string {
+function normalizeRemoteHeadRef(mergeRef: string, operation: UpstreamOperation): string {
   if (!mergeRef.startsWith("refs/heads/")) {
-    throw new Error("Unable to push current branch: upstream merge ref is not a branch ref.");
+    throw new Error(`Unable to ${operation} current branch: upstream merge ref is not a branch ref.`);
   }
 
   const branchName = mergeRef.slice("refs/heads/".length);
@@ -231,15 +241,39 @@ async function getBranchConfigValue(
   return value || null;
 }
 
-async function resolvePushTarget(
+async function resolveConfiguredUpstreamTarget(
   pi: Pick<ExtensionAPI, "exec">,
   ctx: GitCommandContext,
   currentBranch: string,
+  operation: UpstreamOperation,
   signal?: AbortSignal,
-): Promise<PushTarget> {
+): Promise<ConfiguredUpstreamTarget | null> {
   validateBranchNameInput(currentBranch);
   const upstream = await getUpstreamBranch(pi, ctx, signal);
-  if (!upstream) {
+  if (!upstream) return null;
+
+  const remote = await getBranchConfigValue(pi, ctx, currentBranch, "remote", signal);
+  const mergeRef = await getBranchConfigValue(pi, ctx, currentBranch, "merge", signal);
+  if (!remote || !mergeRef) {
+    throw new Error(`Unable to ${operation} current branch: upstream exists but branch remote/merge configuration is incomplete.`);
+  }
+
+  validateRemoteName(remote, operation);
+  return {
+    upstream,
+    remote,
+    remoteRef: normalizeRemoteHeadRef(mergeRef, operation),
+  };
+}
+
+async function resolvePushTarget(
+  pi: Pick<ExtensionAPI, "exec">,
+  ctx: GitCommandContext,
+  currentBranch: string,
+  signal?: AbortSignal,
+): Promise<PushTarget> {
+  const upstreamTarget = await resolveConfiguredUpstreamTarget(pi, ctx, currentBranch, "push", signal);
+  if (!upstreamTarget) {
     const remoteRef = `refs/heads/${currentBranch}`;
     return {
       upstream: null,
@@ -251,22 +285,12 @@ async function resolvePushTarget(
     };
   }
 
-  const remote = await getBranchConfigValue(pi, ctx, currentBranch, "remote", signal);
-  const mergeRef = await getBranchConfigValue(pi, ctx, currentBranch, "merge", signal);
-  if (!remote || !mergeRef) {
-    throw new Error("Unable to push current branch: upstream exists but branch remote/merge configuration is incomplete.");
-  }
-
-  validateRemoteName(remote);
-  const remoteRef = normalizeRemoteHeadRef(mergeRef);
-  const refspec = `HEAD:${remoteRef}`;
+  const refspec = `HEAD:${upstreamTarget.remoteRef}`;
   return {
-    upstream,
+    ...upstreamTarget,
     mode: "push",
-    remote,
-    remoteRef,
     refspec,
-    args: ["push", remote, refspec],
+    args: ["push", upstreamTarget.remote, refspec],
   };
 }
 
@@ -676,6 +700,41 @@ export async function changeExistingLocalBranch(
   });
 }
 
+export async function pullCurrentBranch(
+  pi: Pick<ExtensionAPI, "exec">,
+  ctx: GitCommandContext,
+  signal?: AbortSignal,
+): Promise<PullBranchDetails> {
+  const repoRoot = await getGitRoot(pi, ctx, signal);
+  const rootCtx = { cwd: repoRoot };
+
+  return withRepositoryMutationQueue(repoRoot, async () => {
+    const currentBranch = await requireCurrentBranch(pi, rootCtx, signal);
+    if (await hasWorkingTreeChanges(pi, rootCtx, signal)) {
+      throw new Error("Working tree has uncommitted changes; clean it before pulling the current branch.");
+    }
+
+    const target = await resolveConfiguredUpstreamTarget(pi, rootCtx, currentBranch, "pull", signal);
+    if (!target) {
+      throw new Error(`Unable to pull current branch '${safeDetail(currentBranch)}': no upstream is configured.`);
+    }
+
+    const result = await runGit(pi, rootCtx, ["pull", "--ff-only", "--no-rebase", "--no-autostash", target.remote, target.remoteRef], {
+      signal,
+      timeout: GIT_PULL_TIMEOUT_MS,
+    });
+
+    return {
+      repoRoot,
+      currentBranch: safeDetail(currentBranch),
+      upstream: safeDetail(target.upstream),
+      remote: safeDetail(target.remote),
+      remoteRef: safeDetail(target.remoteRef),
+      output: safeOutput(result.stdout || result.stderr),
+    };
+  });
+}
+
 export async function pushCurrentBranch(
   pi: Pick<ExtensionAPI, "exec">,
   ctx: GitCommandContext,

package/src/tools/branchme-tools.ts

@@ -4,6 +4,7 @@ import {
   BRANCH_STATUS_TOOL_NAME,
   CHANGE_BRANCH_TOOL_NAME,
   CREATE_BRANCH_TOOL_NAME,
+  PULL_BRANCH_TOOL_NAME,
   PULL_REQUEST_TOOL_NAME,
   PUSH_BRANCH_TOOL_NAME,
 } from "../constants.ts";
@@ -13,6 +14,7 @@ import {
   getGitRoot,
   getLocalBranchCommit,
   localBranchExists,
+  pullCurrentBranch,
   pushCurrentBranch,
   validateBranchName,
   withRepositoryMutationQueue,
@@ -197,6 +199,26 @@ export function registerBranchMeTools(pi: Pick<ExtensionAPI, "registerTool" | "e
     },
   });
 
+  pi.registerTool({
+    name: PULL_BRANCH_TOOL_NAME,
+    label: "Pull Branch",
+    description: "pull_branch updates the current branch from its configured upstream with git pull --ff-only --no-rebase --no-autostash. pull_branch requires a clean working tree and never rebases, creates merge commits, force-updates, stashes, stages, or commits.",
+    promptSnippet: "pull_branch: fast-forward the clean current branch from its configured upstream without rebasing",
+    promptGuidelines: [
+      "Use pull_branch only when the user explicitly wants to update the current branch from its configured upstream.",
+      "Use pull_branch only on a clean working tree with an upstream; pull_branch has no branchName, remote, force, or rebase parameters.",
+      "Do not call pull_branch in the same tool batch as change_branch or create_branch; call pull_branch after change_branch completes, then call create_branch after pull_branch completes.",
+    ],
+    parameters: EmptyParametersSchema,
+    async execute(_toolCallId, _params, signal, _onUpdate, ctx) {
+      const details = await pullCurrentBranch(pi, ctx, signal);
+      return {
+        content: [{ type: "text", text: `Pulled current branch ${details.currentBranch} with fast-forward-only semantics.` }],
+        details,
+      };
+    },
+  });
+
   pi.registerTool({
     name: PUSH_BRANCH_TOOL_NAME,
     label: "Push Branch",

package/src/types.ts

@@ -87,6 +87,15 @@ export interface ChangeBranchDetails {
   hasChangesBeforeSwitch: false;
 }
 
+export interface PullBranchDetails {
+  repoRoot: string;
+  currentBranch: string;
+  upstream: string;
+  remote: string;
+  remoteRef: string;
+  output: string;
+}
+
 export interface PushBranchDetails {
   repoRoot: string;
   currentBranch: string;

package/src/ui/branchme-panel.ts

@@ -177,7 +177,7 @@ function sectionFooter(section: BranchMePanelSection, data: BranchMePanelData):
     case "status":
       return "status • current repository only • tools perform actions";
     case "workflow":
-      return "workflow • inspect → change/create → push → PR";
+      return "workflow • inspect → change → pull → create → push → PR";
   }
 }
 
@@ -197,6 +197,7 @@ function sectionRows(section: BranchMePanelSection, data: BranchMePanelData): Pa
         heading("WORKFLOW"),
         workflowDetailRow("branch_status", "inspect"),
         workflowDetailRow("change_branch", "existing local"),
+        workflowDetailRow("pull_branch", "fast-forward"),
         workflowDetailRow("create_branch", "from HEAD"),
         workflowDetailRow("push_branch", "current branch"),
         workflowDetailRow("pull_request", "after push"),