@slamb2k/mad-skills 2.0.37 → 2.0.38

package/skills/ship/scripts/ci-watch.sh

@@ -0,0 +1,204 @@
+#!/usr/bin/env bash
+# ci-watch.sh — Poll CI/pipeline checks until complete with fail-fast
+# Usage: ci-watch.sh <PLATFORM> <PR_NUMBER> <BRANCH> [azdo options]
+# AzDO options: --azdo-mode=cli|rest --azdo-org-url=URL --azdo-project=NAME --azdo-project-url-safe=NAME
+# Env: AZURE_DEVOPS_EXT_PAT or AZDO_PAT (required for azdo rest mode)
+# Exit codes: 0=all_passed/no_checks, 1=some_failed, 2=pending (timeout), 3=tool error
+set -uo pipefail
+
+PLATFORM="${1:?Usage: ci-watch.sh <PLATFORM> <PR_NUMBER> <BRANCH>}"
+PR_NUMBER="${2:?Usage: ci-watch.sh <PLATFORM> <PR_NUMBER> <BRANCH>}"
+BRANCH="${3:?Usage: ci-watch.sh <PLATFORM> <PR_NUMBER> <BRANCH>}"
+shift 3
+
+AZDO_MODE="" AZDO_ORG_URL="" AZDO_PROJECT="" AZDO_PROJECT_URL_SAFE=""
+for arg in "$@"; do
+  case "$arg" in
+    --azdo-mode=*)             AZDO_MODE="${arg#*=}" ;;
+    --azdo-org-url=*)          AZDO_ORG_URL="${arg#*=}" ;;
+    --azdo-project=*)          AZDO_PROJECT="${arg#*=}" ;;
+    --azdo-project-url-safe=*) AZDO_PROJECT_URL_SAFE="${arg#*=}" ;;
+  esac
+done
+
+STATUS="" CHECKS="" FAILING=""
+
+emit_report() {
+  echo "CHECKS_REPORT_BEGIN"
+  echo "status=$STATUS"
+  echo "checks=$CHECKS"
+  echo "failing_checks=${FAILING:-none}"
+  echo "CHECKS_REPORT_END"
+}
+
+# ── GitHub ──────────────────────────────────────────────
+if [ "$PLATFORM" = "github" ]; then
+  if ! command -v gh &>/dev/null; then
+    STATUS="no_checks"; FAILING="none"
+    emit_report; exit 3
+  fi
+
+  # gh pr checks --watch blocks until done; --fail-fast stops on first failure
+  gh pr checks "$PR_NUMBER" --watch --fail-fast 2>/dev/null || true
+
+  # Parse final status
+  CHECKS_JSON=$(gh pr checks "$PR_NUMBER" --json name,state 2>/dev/null || echo "[]")
+  if [ "$CHECKS_JSON" = "[]" ]; then
+    STATUS="no_checks"; CHECKS=""; FAILING="none"
+    emit_report; exit 0
+  fi
+
+  FAIL_COUNT=$(echo "$CHECKS_JSON" | jq '[.[] | select(.state=="FAILURE")] | length')
+  CHECKS=$(echo "$CHECKS_JSON" | jq -r '.[] | "\(.name):\(.state | ascii_downcase)"' | paste -sd, -)
+  FAILING=$(echo "$CHECKS_JSON" | jq -r '.[] | select(.state=="FAILURE") | .name' | paste -sd, -)
+
+  if [ "${FAIL_COUNT:-0}" -gt 0 ]; then
+    STATUS="some_failed"
+    emit_report; exit 1
+  else
+    STATUS="all_passed"; FAILING="none"
+    emit_report; exit 0
+  fi
+fi
+
+# ── Azure DevOps ────────────────────────────────────────
+
+# Resolve PAT for REST mode
+PAT="${AZURE_DEVOPS_EXT_PAT:-${AZDO_PAT:-}}"
+AUTH=""
+if [ "$AZDO_MODE" = "rest" ]; then
+  if [ -z "$PAT" ]; then
+    STATUS="no_checks"; FAILING="none"
+    CHECKS="error:no PAT configured"
+    emit_report; exit 3
+  fi
+  AUTH="Authorization: Basic $(echo -n ":$PAT" | base64)"
+fi
+
+# ── AzDO CLI mode ──────────────────────────────────────
+if [ "$AZDO_MODE" = "cli" ]; then
+  # Wait for CI to start (max 2 min)
+  RUNS_FOUND=false
+  for _ in $(seq 1 8); do
+    RUN_COUNT=$(az pipelines runs list --branch "$BRANCH" --top 5 \
+      --org "$AZDO_ORG_URL" --project "$AZDO_PROJECT" \
+      --query "length(@)" -o tsv 2>/dev/null)
+    if [ -n "$RUN_COUNT" ] && [ "$RUN_COUNT" != "0" ]; then
+      RUNS_FOUND=true; break
+    fi
+    sleep 15
+  done
+
+  if [ "$RUNS_FOUND" = false ]; then
+    # Check PR policies
+    POLICY_COUNT=$(az repos pr policy list --id "$PR_NUMBER" \
+      --org "$AZDO_ORG_URL" --project "$AZDO_PROJECT" \
+      --query "length(@)" -o tsv 2>/dev/null || echo "0")
+    if [ "$POLICY_COUNT" = "0" ] || [ -z "$POLICY_COUNT" ]; then
+      STATUS="no_checks"; CHECKS=""; FAILING="none"
+      emit_report; exit 0
+    fi
+  fi
+
+  # Wait for runs to complete with fail-fast (max 30 min)
+  for _ in $(seq 1 120); do
+    FAILED=$(az pipelines runs list --branch "$BRANCH" --top 5 \
+      --org "$AZDO_ORG_URL" --project "$AZDO_PROJECT" \
+      --query "[?result=='failed'] | length(@)" -o tsv 2>/dev/null)
+    if [ -n "$FAILED" ] && [ "$FAILED" != "0" ]; then
+      break
+    fi
+
+    IN_PROGRESS=$(az pipelines runs list --branch "$BRANCH" --top 5 \
+      --org "$AZDO_ORG_URL" --project "$AZDO_PROJECT" \
+      --query "[?status=='inProgress'] | length(@)" -o tsv 2>/dev/null)
+    if [ "$IN_PROGRESS" = "0" ] || [ -z "$IN_PROGRESS" ]; then break; fi
+    sleep 15
+  done
+
+  # Determine final status
+  RUNS_TABLE=$(az pipelines runs list --branch "$BRANCH" --top 5 \
+    --org "$AZDO_ORG_URL" --project "$AZDO_PROJECT" \
+    --query "[].{name:definition.name, result:result}" -o json 2>/dev/null || echo "[]")
+  CHECKS=$(echo "$RUNS_TABLE" | jq -r '.[] | "\(.name):\(.result // "pending")"' | paste -sd, -)
+  FAILING=$(echo "$RUNS_TABLE" | jq -r '.[] | select(.result=="failed") | .name' | paste -sd, -)
+
+  # Also check PR policies
+  REJECTED=$(az repos pr policy list --id "$PR_NUMBER" \
+    --org "$AZDO_ORG_URL" --project "$AZDO_PROJECT" \
+    --query "[?status=='rejected'] | length(@)" -o tsv 2>/dev/null || echo "0")
+
+  FAIL_COUNT=$(echo "$RUNS_TABLE" | jq '[.[] | select(.result=="failed")] | length')
+  STILL_RUNNING=$(echo "$RUNS_TABLE" | jq '[.[] | select(.result==null)] | length')
+
+  if [ "${FAIL_COUNT:-0}" -gt 0 ] || [ "${REJECTED:-0}" -gt 0 ]; then
+    STATUS="some_failed"
+    emit_report; exit 1
+  elif [ "${STILL_RUNNING:-0}" -gt 0 ]; then
+    STATUS="pending"; FAILING="none"
+    emit_report; exit 2
+  else
+    STATUS="all_passed"; FAILING="none"
+    emit_report; exit 0
+  fi
+fi
+
+# ── AzDO REST mode ─────────────────────────────────────
+if [ "$AZDO_MODE" = "rest" ]; then
+  BUILDS_URL="$AZDO_ORG_URL/$AZDO_PROJECT_URL_SAFE/_apis/build/builds?branchName=refs/heads/$BRANCH&\$top=5&api-version=7.0"
+
+  # Wait for CI to start (max 2 min)
+  RUNS_FOUND=false
+  for _ in $(seq 1 8); do
+    RUN_COUNT=$(curl -s -H "$AUTH" "$BUILDS_URL" | jq '.value | length')
+    if [ -n "$RUN_COUNT" ] && [ "$RUN_COUNT" != "0" ]; then
+      RUNS_FOUND=true; break
+    fi
+    sleep 15
+  done
+
+  if [ "$RUNS_FOUND" = false ]; then
+    EVALS=$(curl -s -H "$AUTH" \
+      "$AZDO_ORG_URL/$AZDO_PROJECT_URL_SAFE/_apis/policy/evaluations?artifactId=vstfs:///CodeReview/CodeReviewId/$AZDO_PROJECT_URL_SAFE/$PR_NUMBER&api-version=7.0")
+    EVAL_COUNT=$(echo "$EVALS" | jq '.value | length')
+    if [ "$EVAL_COUNT" = "0" ] || [ -z "$EVAL_COUNT" ]; then
+      STATUS="no_checks"; CHECKS=""; FAILING="none"
+      emit_report; exit 0
+    fi
+  fi
+
+  # Wait for runs with fail-fast (max 30 min)
+  for _ in $(seq 1 120); do
+    BUILDS_JSON=$(curl -s -H "$AUTH" "$BUILDS_URL")
+
+    FAIL_COUNT=$(echo "$BUILDS_JSON" | jq '[.value[] | select(.result=="failed")] | length')
+    if [ "${FAIL_COUNT:-0}" -gt 0 ]; then break; fi
+
+    IN_PROGRESS=$(echo "$BUILDS_JSON" | jq '[.value[] | select(.status=="inProgress")] | length')
+    if [ "$IN_PROGRESS" = "0" ]; then break; fi
+    sleep 15
+  done
+
+  # Final status
+  BUILDS_JSON=$(curl -s -H "$AUTH" "$BUILDS_URL")
+  CHECKS=$(echo "$BUILDS_JSON" | jq -r '.value[] | "\(.definition.name):\(.result // "pending")"' | paste -sd, -)
+  FAILING=$(echo "$BUILDS_JSON" | jq -r '.value[] | select(.result=="failed") | .definition.name' | paste -sd, -)
+  FAIL_COUNT=$(echo "$BUILDS_JSON" | jq '[.value[] | select(.result=="failed")] | length')
+  STILL_RUNNING=$(echo "$BUILDS_JSON" | jq '[.value[] | select(.status=="inProgress")] | length')
+
+  # Check policy evaluations
+  EVALS=$(curl -s -H "$AUTH" \
+    "$AZDO_ORG_URL/$AZDO_PROJECT_URL_SAFE/_apis/policy/evaluations?artifactId=vstfs:///CodeReview/CodeReviewId/$AZDO_PROJECT_URL_SAFE/$PR_NUMBER&api-version=7.0")
+  REJECTED=$(echo "$EVALS" | jq '[.value[] | select(.status=="rejected")] | length')
+
+  if [ "${FAIL_COUNT:-0}" -gt 0 ] || [ "${REJECTED:-0}" -gt 0 ]; then
+    STATUS="some_failed"
+    emit_report; exit 1
+  elif [ "${STILL_RUNNING:-0}" -gt 0 ]; then
+    STATUS="pending"; FAILING="none"
+    emit_report; exit 2
+  else
+    STATUS="all_passed"; FAILING="none"
+    emit_report; exit 0
+  fi
+fi

package/skills/ship/scripts/merge.sh

@@ -0,0 +1,146 @@
+#!/usr/bin/env bash
+# merge.sh — Merge a PR on GitHub or Azure DevOps
+# Usage: merge.sh <PLATFORM> <PR_NUMBER> [--squash|--merge] [--delete-branch|--keep-branch] [azdo options]
+# AzDO options: --azdo-mode=cli|rest --azdo-org-url=URL --azdo-project=NAME --azdo-project-url-safe=NAME
+# Env: AZURE_DEVOPS_EXT_PAT or AZDO_PAT (required for azdo rest mode)
+# Exit codes: 0=merged, 1=failed, 2=failed after retry
+set -uo pipefail
+
+PLATFORM="${1:?Usage: merge.sh <PLATFORM> <PR_NUMBER> [flags]}"
+PR_NUMBER="${2:?Usage: merge.sh <PLATFORM> <PR_NUMBER> [flags]}"
+shift 2
+
+SQUASH=true DELETE_BRANCH=true
+AZDO_MODE="" AZDO_ORG_URL="" AZDO_PROJECT="" AZDO_PROJECT_URL_SAFE=""
+
+for arg in "$@"; do
+  case "$arg" in
+    --merge)                   SQUASH=false ;;
+    --squash)                  SQUASH=true ;;
+    --keep-branch)             DELETE_BRANCH=false ;;
+    --delete-branch)           DELETE_BRANCH=true ;;
+    --azdo-mode=*)             AZDO_MODE="${arg#*=}" ;;
+    --azdo-org-url=*)          AZDO_ORG_URL="${arg#*=}" ;;
+    --azdo-project=*)          AZDO_PROJECT="${arg#*=}" ;;
+    --azdo-project-url-safe=*) AZDO_PROJECT_URL_SAFE="${arg#*=}" ;;
+  esac
+done
+
+STATUS="" MERGE_COMMIT="" MERGE_TYPE="" BRANCH_DELETED="" ERRORS="none"
+
+emit_report() {
+  echo "LAND_REPORT_BEGIN"
+  echo "status=$STATUS"
+  echo "merge_commit=$MERGE_COMMIT"
+  echo "merge_type=$MERGE_TYPE"
+  echo "branch_deleted=$BRANCH_DELETED"
+  echo "errors=$ERRORS"
+  echo "LAND_REPORT_END"
+}
+
+MERGE_TYPE=$( [ "$SQUASH" = true ] && echo "squash" || echo "merge" )
+
+# ── GitHub ──────────────────────────────────────────────
+if [ "$PLATFORM" = "github" ]; then
+  GH_MERGE_FLAG=$( [ "$SQUASH" = true ] && echo "--squash" || echo "--merge" )
+  GH_BRANCH_FLAG=$( [ "$DELETE_BRANCH" = true ] && echo "--delete-branch" || echo "" )
+
+  if gh pr merge "$PR_NUMBER" $GH_MERGE_FLAG $GH_BRANCH_FLAG 2>/dev/null; then
+    STATUS="success"
+    MERGE_COMMIT=$(gh pr view "$PR_NUMBER" --json mergeCommit -q '.mergeCommit.oid' 2>/dev/null | head -c 7)
+    BRANCH_DELETED=$DELETE_BRANCH
+  else
+    STATUS="failed"
+    ERRORS="gh pr merge failed"
+    BRANCH_DELETED=false
+  fi
+  emit_report
+  [ "$STATUS" = "success" ] && exit 0 || exit 1
+fi
+
+# ── Azure DevOps ────────────────────────────────────────
+PAT="${AZURE_DEVOPS_EXT_PAT:-${AZDO_PAT:-}}"
+SQUASH_FLAG=$( [ "$SQUASH" = true ] && echo "true" || echo "false" )
+DELETE_FLAG=$( [ "$DELETE_BRANCH" = true ] && echo "true" || echo "false" )
+
+# ── AzDO CLI mode ──────────────────────────────────────
+if [ "$AZDO_MODE" = "cli" ]; then
+  # Check for rejected policies
+  REJECTED=$(az repos pr policy list --id "$PR_NUMBER" \
+    --org "$AZDO_ORG_URL" --project "$AZDO_PROJECT" \
+    --query "[?status=='rejected'] | length(@)" -o tsv 2>/dev/null)
+  if [ -n "$REJECTED" ] && [ "$REJECTED" != "0" ]; then
+    STATUS="failed"
+    ERRORS="$REJECTED PR policies are rejected"
+    MERGE_COMMIT=""; BRANCH_DELETED=false
+    emit_report; exit 1
+  fi
+
+  # Complete the PR
+  if az repos pr update --id "$PR_NUMBER" --status completed \
+    --org "$AZDO_ORG_URL" --project "$AZDO_PROJECT" \
+    --squash "$SQUASH_FLAG" \
+    --delete-source-branch "$DELETE_FLAG" 2>/dev/null; then
+    STATUS="success"
+    MERGE_COMMIT=$(git rev-parse --short HEAD 2>/dev/null)
+    BRANCH_DELETED=$DELETE_BRANCH
+  else
+    # Retry once after 30s (policies may still be evaluating)
+    sleep 30
+    if az repos pr update --id "$PR_NUMBER" --status completed \
+      --org "$AZDO_ORG_URL" --project "$AZDO_PROJECT" \
+      --squash "$SQUASH_FLAG" \
+      --delete-source-branch "$DELETE_FLAG" 2>/dev/null; then
+      STATUS="success"
+      MERGE_COMMIT=$(git rev-parse --short HEAD 2>/dev/null)
+      BRANCH_DELETED=$DELETE_BRANCH
+    else
+      STATUS="failed"
+      ERRORS="Merge failed after retry"
+      MERGE_COMMIT=""; BRANCH_DELETED=false
+      emit_report; exit 2
+    fi
+  fi
+  emit_report
+  exit 0
+fi
+
+# ── AzDO REST mode ─────────────────────────────────────
+if [ "$AZDO_MODE" = "rest" ]; then
+  AUTH="Authorization: Basic $(echo -n ":$PAT" | base64)"
+  REPO_NAME=$(basename -s .git "$(git remote get-url origin)")
+  PR_API="$AZDO_ORG_URL/$AZDO_PROJECT_URL_SAFE/_apis/git/repositories/$REPO_NAME/pullrequests/$PR_NUMBER"
+
+  # Check for rejected policies
+  EVALS=$(curl -s -H "$AUTH" \
+    "$AZDO_ORG_URL/$AZDO_PROJECT_URL_SAFE/_apis/policy/evaluations?artifactId=vstfs:///CodeReview/CodeReviewId/$AZDO_PROJECT_URL_SAFE/$PR_NUMBER&api-version=7.0")
+  REJECTED=$(echo "$EVALS" | jq '[.value[] | select(.status=="rejected")] | length')
+  if [ "$REJECTED" != "0" ]; then
+    STATUS="failed"
+    ERRORS="PR has rejected policy evaluations"
+    MERGE_COMMIT=""; BRANCH_DELETED=false
+    emit_report; exit 1
+  fi
+
+  # Resolve merge strategy
+  MERGE_STRATEGY=$( [ "$SQUASH" = true ] && echo "squash" || echo "noFastForward" )
+
+  # Complete the PR
+  RESPONSE=$(curl -s -X PATCH -H "$AUTH" -H "Content-Type: application/json" \
+    "$PR_API?api-version=7.0" \
+    -d "{\"status\": \"completed\", \"completionOptions\": {\"mergeStrategy\": \"$MERGE_STRATEGY\", \"deleteSourceBranch\": $DELETE_FLAG}}")
+
+  PR_STATUS=$(echo "$RESPONSE" | jq -r '.status // empty')
+  if [ "$PR_STATUS" = "completed" ]; then
+    STATUS="success"
+    MERGE_COMMIT=$(echo "$RESPONSE" | jq -r '.lastMergeCommit.commitId // empty' | head -c 7)
+    BRANCH_DELETED=$DELETE_BRANCH
+  else
+    STATUS="failed"
+    ERRORS="REST merge returned status: ${PR_STATUS:-unknown}"
+    MERGE_COMMIT=""; BRANCH_DELETED=false
+    emit_report; exit 1
+  fi
+  emit_report
+  exit 0
+fi

package/skills/ship/tests/evals.json

@@ -19,12 +19,12 @@
     ]
   },
   {
-    "name": "subagent-architecture",
+    "name": "script-based-architecture",
     "prompt": "Ship everything to production",
     "assertions": [
       { "type": "contains", "value": "██" },
-      { "type": "regex", "value": "ship.analyzer", "flags": "i" },
-      { "type": "semantic", "value": "Mentions using specialized subagents for different stages, including a ship-analyzer agent for code analysis and commit/PR creation" }
+      { "type": "regex", "value": "(script|sync\\.sh|ci-watch\\.sh|merge\\.sh|general.purpose)", "flags": "i" },
+      { "type": "semantic", "value": "Uses deterministic scripts for sync, CI monitoring, and merge stages, with LLM subagents only for commit/PR authoring and CI fix analysis" }
     ]
   }
 ]

package/skills/sync/SKILL.md

@@ -59,8 +59,9 @@ Status icons: ✅ done · ❌ failed · ⚠️ degraded · ⏳ working · ⏭️
 
 ---
 
-Synchronize local repository with the remote default branch using a single
-Bash subagent to isolate all git operations from the primary conversation.
+Synchronize local repository with the remote default branch using a
+deterministic bash script — no LLM subagent needed since all steps are
+pure git commands.
 
 ## Flags
 
@@ -112,110 +113,29 @@ Pass `{REMOTE}` and `{DEFAULT_BRANCH}` into the subagent prompt.
 
 ## Execution
 
-Launch a **Bash subagent** (haiku — pure git commands, no code analysis needed):
+Run the sync script directly — no LLM subagent needed since all steps are
+deterministic git commands:
 
-```
-Task(
-  subagent_type: "Bash",
-  model: "haiku",
-  description: "Sync repo with {DEFAULT_BRANCH}",
-  prompt: <see prompt below>
-)
+```bash
+# Resolve skill root (plugin install or direct install)
+for SKILL_ROOT in \
+  "${CLAUDE_PLUGIN_ROOT:-}" \
+  "$HOME/.claude/plugins/marketplaces/slamb2k" \
+  "$(dirname "$(readlink -f "$0")")/.."
+do
+  [ -f "$SKILL_ROOT/skills/sync/scripts/sync.sh" ] && break
+done
+
+bash "$SKILL_ROOT/skills/sync/scripts/sync.sh" \
+  "{REMOTE}" "{DEFAULT_BRANCH}" {FLAGS}
 ```
 
-### Subagent Prompt
+Parse the output between `SYNC_REPORT_BEGIN` and `SYNC_REPORT_END` markers.
+Extract `key=value` pairs for the report fields: `status`, `remote`,
+`default_branch`, `main_updated_to`, `current_branch`, `stash`, `rebase`,
+`branches_cleaned`, `errors`.
 
-```
-Synchronize this git repository with {REMOTE}/{DEFAULT_BRANCH}. Execute the
-following steps in order and report results.
-
-Limit SYNC_REPORT to 15 lines maximum.
-
-FLAGS: {flags from request, or "none"}
-
-## Steps
-
-1. **Check state**
-   BRANCH=$(git branch --show-current 2>/dev/null || echo "DETACHED")
-   CHANGES=$(git status --porcelain | head -20)
-   Record: current_branch=$BRANCH, has_changes=(non-empty CHANGES)
-
-   If BRANCH == "DETACHED":
-     Record error: "Detached HEAD — cannot sync. Checkout a branch first."
-     Skip to Output.
-
-2. **Stash changes** (skip if --no-stash or no changes)
-   If has_changes and not --no-stash:
-     git stash push -m "sync-auto-stash-$(date +%Y%m%d-%H%M%S)"
-     Record: stash_created=true
-
-3. **Sync {DEFAULT_BRANCH}**
-   git fetch {REMOTE}
-   If BRANCH != "{DEFAULT_BRANCH}":
-     git checkout {DEFAULT_BRANCH}
-   git pull {REMOTE} {DEFAULT_BRANCH} --ff-only
-   If pull fails (diverged):
-     git pull {REMOTE} {DEFAULT_BRANCH} --rebase
-   Record: main_commit=$(git rev-parse --short HEAD)
-   Record: main_message=$(git log -1 --format=%s)
-
-4. **Return to branch and update** (skip if already on {DEFAULT_BRANCH})
-   If current_branch != "{DEFAULT_BRANCH}":
-     git checkout $BRANCH
-     If --no-rebase:
-       git merge {DEFAULT_BRANCH} --no-edit
-     Else:
-       git rebase {DEFAULT_BRANCH}
-       If rebase fails:
-         git rebase --abort
-         Record: rebase_status="conflict — aborted, branch unchanged"
-
-5. **Restore stash** (if created in step 2)
-   If stash_created:
-     git stash pop
-     If pop fails (conflict):
-       Record: stash="conflict — run 'git stash show' to inspect"
-     Else:
-       Record: stash="restored"
-
-6. **Cleanup branches** (skip if --no-cleanup)
-   git fetch --prune
-
-   # Delete branches whose remote is gone
-   for branch in $(git branch -vv | grep ': gone]' | awk '{print $1}'); do
-     if [ "$branch" != "$BRANCH" ]; then
-       git branch -d "$branch" 2>/dev/null && echo "Deleted: $branch"
-     fi
-   done
-
-   # Delete branches fully merged into {DEFAULT_BRANCH} (except current)
-   for branch in $(git branch --merged {DEFAULT_BRANCH} | grep -v '^\*' | grep -v '{DEFAULT_BRANCH}'); do
-     branch=$(echo "$branch" | xargs)
-     if [ "$branch" != "$BRANCH" ] && [ -n "$branch" ]; then
-       git branch -d "$branch" 2>/dev/null && echo "Deleted: $branch"
-     fi
-   done
-
-   Record: branches_cleaned={list of deleted branches, or "none"}
-
-7. **Final state**
-   echo "Branch: $(git branch --show-current)"
-   echo "HEAD: $(git log -1 --format='%h %s')"
-   echo "Status: $(git status --short | wc -l) modified files"
-
-## Output Format
-
-SYNC_REPORT:
-- status: success|failed
-- remote: {REMOTE}
-- default_branch: {DEFAULT_BRANCH}
-- main_updated_to: {commit} - {message}
-- current_branch: {branch}
-- stash: restored|none|conflict
-- rebase: success|conflict|skipped
-- branches_cleaned: {list or "none"}
-- errors: {any errors encountered}
-```
+Exit codes: 0=success, 1=fatal error, 2=partial success (conflict warnings).
 
 ---
 

package/skills/sync/scripts/sync.sh

@@ -0,0 +1,158 @@
+#!/usr/bin/env bash
+# sync.sh — Deterministic repo sync with origin/default-branch
+# Usage: sync.sh <REMOTE> <DEFAULT_BRANCH> [--no-stash] [--no-cleanup] [--no-rebase]
+# Output: Key-value SYNC_REPORT between BEGIN/END markers on stdout
+# Exit codes: 0=success, 1=fatal, 2=partial (conflict warnings)
+set -uo pipefail
+
+REMOTE="${1:?Usage: sync.sh <REMOTE> <DEFAULT_BRANCH> [flags]}"
+DEFAULT_BRANCH="${2:?Usage: sync.sh <REMOTE> <DEFAULT_BRANCH> [flags]}"
+shift 2
+
+NO_STASH=false; NO_CLEANUP=false; NO_REBASE=false
+for arg in "$@"; do
+  case "$arg" in
+    --no-stash)   NO_STASH=true ;;
+    --no-cleanup) NO_CLEANUP=true ;;
+    --no-rebase)  NO_REBASE=true ;;
+  esac
+done
+
+# Report fields
+STATUS="success"
+MAIN_UPDATED_TO=""
+CURRENT_BRANCH=""
+STASH_STATUS="none"
+REBASE_STATUS="skipped"
+BRANCHES_CLEANED="none"
+ERRORS="none"
+STASH_CREATED=false
+EXIT_CODE=0
+
+emit_report() {
+  echo "SYNC_REPORT_BEGIN"
+  echo "status=$STATUS"
+  echo "remote=$REMOTE"
+  echo "default_branch=$DEFAULT_BRANCH"
+  echo "main_updated_to=$MAIN_UPDATED_TO"
+  echo "current_branch=$CURRENT_BRANCH"
+  echo "stash=$STASH_STATUS"
+  echo "rebase=$REBASE_STATUS"
+  echo "branches_cleaned=$BRANCHES_CLEANED"
+  echo "errors=$ERRORS"
+  echo "SYNC_REPORT_END"
+  exit "$EXIT_CODE"
+}
+
+# Step 1: Check state
+BRANCH=$(git branch --show-current 2>/dev/null || echo "DETACHED")
+CURRENT_BRANCH="$BRANCH"
+
+if [ "$BRANCH" = "DETACHED" ]; then
+  STATUS="failed"
+  ERRORS="Detached HEAD — cannot sync. Checkout a branch first."
+  EXIT_CODE=1
+  emit_report
+fi
+
+HAS_CHANGES=false
+if [ -n "$(git status --porcelain 2>/dev/null | head -1)" ]; then
+  HAS_CHANGES=true
+fi
+
+# Step 2: Stash changes
+if [ "$HAS_CHANGES" = true ] && [ "$NO_STASH" = false ]; then
+  if git stash push -m "sync-auto-stash-$(date +%Y%m%d-%H%M%S)" 2>/dev/null; then
+    STASH_CREATED=true
+  fi
+fi
+
+# Step 3: Sync default branch
+git fetch "$REMOTE" 2>/dev/null
+
+if [ "$BRANCH" != "$DEFAULT_BRANCH" ]; then
+  git checkout "$DEFAULT_BRANCH" 2>/dev/null
+fi
+
+if ! git pull "$REMOTE" "$DEFAULT_BRANCH" --ff-only 2>/dev/null; then
+  if ! git pull "$REMOTE" "$DEFAULT_BRANCH" --rebase 2>/dev/null; then
+    STATUS="failed"
+    ERRORS="Failed to pull $REMOTE/$DEFAULT_BRANCH"
+    EXIT_CODE=1
+    # Try to get back to original branch
+    [ "$BRANCH" != "$DEFAULT_BRANCH" ] && git checkout "$BRANCH" 2>/dev/null
+    # Restore stash if we created one
+    [ "$STASH_CREATED" = true ] && git stash pop 2>/dev/null
+    emit_report
+  fi
+fi
+
+MAIN_COMMIT=$(git rev-parse --short HEAD 2>/dev/null)
+MAIN_MESSAGE=$(git log -1 --format=%s 2>/dev/null)
+MAIN_UPDATED_TO="$MAIN_COMMIT - $MAIN_MESSAGE"
+
+# Step 4: Return to branch and update
+if [ "$BRANCH" != "$DEFAULT_BRANCH" ]; then
+  git checkout "$BRANCH" 2>/dev/null
+
+  if [ "$NO_REBASE" = true ]; then
+    if ! git merge "$DEFAULT_BRANCH" --no-edit 2>/dev/null; then
+      REBASE_STATUS="conflict — merge aborted"
+      EXIT_CODE=2
+    else
+      REBASE_STATUS="success"
+    fi
+  else
+    if ! git rebase "$DEFAULT_BRANCH" 2>/dev/null; then
+      git rebase --abort 2>/dev/null
+      REBASE_STATUS="conflict — aborted, branch unchanged"
+      EXIT_CODE=2
+    else
+      REBASE_STATUS="success"
+    fi
+  fi
+fi
+
+CURRENT_BRANCH=$(git branch --show-current 2>/dev/null)
+
+# Step 5: Restore stash
+if [ "$STASH_CREATED" = true ]; then
+  if git stash pop 2>/dev/null; then
+    STASH_STATUS="restored"
+  else
+    STASH_STATUS="conflict — run 'git stash show' to inspect"
+    EXIT_CODE=2
+  fi
+fi
+
+# Step 6: Cleanup branches
+if [ "$NO_CLEANUP" = false ]; then
+  git fetch --prune 2>/dev/null
+
+  CLEANED=()
+
+  # Delete branches whose remote is gone
+  while IFS= read -r b; do
+    [ -z "$b" ] && continue
+    [ "$b" = "$CURRENT_BRANCH" ] && continue
+    if git branch -d "$b" 2>/dev/null; then
+      CLEANED+=("$b")
+    fi
+  done < <(git branch -vv 2>/dev/null | grep ': gone]' | awk '{print $1}')
+
+  # Delete branches fully merged into default branch
+  while IFS= read -r b; do
+    b=$(echo "$b" | xargs)
+    [ -z "$b" ] && continue
+    [ "$b" = "$CURRENT_BRANCH" ] && continue
+    if git branch -d "$b" 2>/dev/null; then
+      CLEANED+=("$b")
+    fi
+  done < <(git branch --merged "$DEFAULT_BRANCH" 2>/dev/null | grep -v '^\*' | grep -v "$DEFAULT_BRANCH")
+
+  if [ ${#CLEANED[@]} -gt 0 ]; then
+    BRANCHES_CLEANED=$(IFS=,; echo "${CLEANED[*]}")
+  fi
+fi
+
+emit_report