dev-loops 0.6.0 → 0.7.1

package/scripts/github/detect-checkpoint-evidence.mjs

@@ -9,15 +9,19 @@ import {
   summarizeGateReviewCommentMarkers,
   summarizeGateReviewComments,
 } from "../_core-helpers.mjs";
-import { access } from "node:fs/promises";
+import { access, readFile } from "node:fs/promises";
 import path from "node:path";
 import { parsePrNumber, requireTokenValue, runChild } from "../_cli-primitives.mjs";
 import { fetchGithubReviewThreadsPayload } from "./capture-review-threads.mjs";
 import { parseRepoSlug } from "@dev-loops/core/github/repo-slug";
-import { loadDevLoopConfig, resolveGateConfig, resolveRequireFanoutEvidence } from "@dev-loops/core/config";
+import { FANOUT_PROVENANCE_MIN_REVIEWERS, GATE_FULL_LABEL, loadDevLoopConfig, resolveGateConfig, resolveLightMode, resolveRequireFanoutEvidence, resolveRequireFanoutProvenance } from "@dev-loops/core/config";
+import { FANOUT_UNAVAILABLE_MESSAGE, provenanceConsistencyError } from "@dev-loops/core/loop/gate-fanin";
+import { detectMergeBaseScope, isEligibleForLightMode } from "../loop/detect-change-scope.mjs";
 import { buildLogPath } from "./write-gate-findings-log.mjs";
 import { ensureAsyncRunnerOwnership } from "../loop/_pr-runner-coordination.mjs";
 import { detectStaleRunner } from "../loop/_stale-runner-detection.mjs";
+import { resolveLedgerCheckouts, resolveRepoRoot } from "../loop/_repo-root-resolver.mjs";
+import { JQ_OUTPUT_PARSE_OPTIONS, JQ_OUTPUT_USAGE, emitResult, matchJqOutputToken } from "../lib/jq-output.mjs";
 const USAGE = `Usage: detect-checkpoint-evidence.mjs --repo <owner/name> --pr <number>
 Fetch the live PR head SHA and visible PR issue comments, then summarize the
 latest valid draft-gate and pre-approval checkpoint verdict comments. Always fail
@@ -84,9 +88,11 @@ Output (stdout, JSON; always includes preMergeGateCheck):
 Error output (stderr, JSON):
   { "ok": false, "error": "...", "usage": "..." }
   { "ok": false, "error": "..." }
+${JQ_OUTPUT_USAGE}
 Exit codes:
   0  Success (gate evidence is valid)
-  1  Argument error, gh failure, malformed gh JSON, or missing required pre-merge gate evidence.`.trim();
+  1  Argument error, gh failure, malformed gh JSON, or missing required pre-merge gate evidence.
+  2  Invalid --jq filter.`.trim();
 const parseError = buildParseError(USAGE);
 export function parseDetectCheckpointEvidenceCliArgs(argv) {
   const { tokens } = parseArgs({
@@ -96,6 +102,7 @@ export function parseDetectCheckpointEvidenceCliArgs(argv) {
       repo: { type: "string" },
       pr: { type: "string" },
       "require-before-merge": { type: "boolean" },
+      ...JQ_OUTPUT_PARSE_OPTIONS,
     },
     allowPositionals: true,
     strict: false,
@@ -125,6 +132,7 @@ export function parseDetectCheckpointEvidenceCliArgs(argv) {
       options.pr = parsePrNumber(requireTokenValue(token, parseError), parseError);
       continue;
     }
+    if (matchJqOutputToken(token, options, (t) => requireTokenValue(t, parseError))) continue;
     if (token.name === "require-before-merge") {
       throw parseError(`--require-before-merge has been removed: gate evidence enforcement is now always-on by default. Omit the flag.`);
     }
@@ -249,7 +257,24 @@ export function buildPreMergeGateCheck(evidence, unresolvedThreadCount = null, s
   // { required: false, gates: [] } so the `.required` guard skips this block.
   if (fanoutEnforcement && fanoutEnforcement.required) {
     for (const gate of fanoutEnforcement.gates) {
-      if (gate.executionMode !== "fanout_fanin") {
+      // Light-mode acceptance (#1174): a genuinely under-threshold micro-PR
+      // collapses the gate fan-out to a single inline check (#1043). Accept that
+      // inline verdict ONLY when ALL hold, fail CLOSED otherwise:
+      //   - lightMode is enabled in config, AND
+      //   - the reviewed head's merge-base scope was RE-DERIVED under threshold
+      //     (scopeUnderThreshold; false whenever scope could not be derived), AND
+      //   - the PR carries no gate:full label (which always forces fan-out), AND
+      //   - the verdict records a non-empty inline reason.
+      // Any non-light inline verdict (over threshold / label / lightMode off /
+      // scope underivable) falls through to the byte-identical rejection below.
+      const lightAccepted =
+        gate.executionMode === "inline_single_agent"
+        && fanoutEnforcement.lightMode === true
+        && fanoutEnforcement.hasFullLabel !== true
+        && gate.scopeUnderThreshold === true
+        && typeof gate.inlineReason === "string"
+        && gate.inlineReason.trim().length > 0;
+      if (gate.executionMode !== "fanout_fanin" && !lightAccepted) {
         failures.push(
           `${gate.name}: requireFanoutEvidence is enabled but executionMode is "${gate.executionMode ?? "unset"}" (expected "fanout_fanin"); inline gate verdicts are not accepted`,
         );
@@ -259,6 +284,31 @@ export function buildPreMergeGateCheck(evidence, unresolvedThreadCount = null, s
         failures.push(
           `${gate.name}: requireFanoutEvidence is enabled but no findings-log ledger exists for the reviewed head (${gate.ledgerPath})`,
         );
+        continue;
+      }
+      // Opt-in provenance enforcement (gates.requireFanoutProvenance), layered on
+      // top of fan-out evidence. When off (default) requireProvenance is falsy so
+      // NO new failure is added — behavior is byte-identical to today. When on, a
+      // fanout_fanin ledger must record INTERNALLY-CONSISTENT provenance (checked
+      // the same way the write path validates it — a hand-edited or shadow ledger
+      // is re-validated here, not trusted) with distinctReviewers >= the floor.
+      // Provenance is enforced ONLY for fanout_fanin verdicts (#1174): a
+      // light-accepted inline verdict is already scope-bounded and has no
+      // multi-reviewer provenance to record, so requiring it would make the
+      // light path unmergeable — the inverse of this issue's fix.
+      if (fanoutEnforcement.requireProvenance && gate.executionMode === "fanout_fanin") {
+        const prov = gate.provenance;
+        const consistencyErr = provenanceConsistencyError(prov);
+        const reviewers = prov && Number.isInteger(prov.distinctReviewers) ? prov.distinctReviewers : null;
+        if (consistencyErr) {
+          failures.push(
+            `${gate.name}: requireFanoutProvenance is enabled but the findings-log ledger lacks valid fan-out provenance (${consistencyErr}); ${FANOUT_UNAVAILABLE_MESSAGE}`,
+          );
+        } else if (reviewers === null || reviewers < FANOUT_PROVENANCE_MIN_REVIEWERS) {
+          failures.push(
+            `${gate.name}: requireFanoutProvenance is enabled but the findings-log ledger lacks valid fan-out provenance (need provenance.distinctReviewers >= ${FANOUT_PROVENANCE_MIN_REVIEWERS}, got ${reviewers === null ? "none" : reviewers}); ${FANOUT_UNAVAILABLE_MESSAGE}`,
+          );
+        }
       }
     }
   }
@@ -287,24 +337,88 @@ async function ledgerExists(fullPath) {
     return false;
   }
 }
+/**
+ * True if the ledger (relative path) exists under ANY enumerated checkout
+ * (main + every worktree). Fixes #1050: a ledger written in the PR worktree is
+ * found even when the check runs from a different checkout's git-toplevel.
+ */
+async function ledgerExistsInAny(checkouts, ledgerPath) {
+  for (const root of checkouts) {
+    if (await ledgerExists(path.resolve(root, ledgerPath))) {
+      return true;
+    }
+  }
+  return false;
+}
+/**
+ * Read the recorded fan-out `provenance` object from a ledger across the
+ * enumerated checkouts. Mirrors ledgerExistsInAny's "ANY checkout satisfies"
+ * semantics: prefers the FIRST checkout whose ledger provenance actually
+ * SATISFIES enforcement (internally consistent AND distinctReviewers >= floor),
+ * so a below-floor or provenance-less ledger in an earlier-enumerated checkout
+ * cannot SHADOW a valid one in the PR worktree (which would falsely fail closed).
+ * Falls back to the first non-null provenance (for a useful diagnostic message)
+ * only when NO checkout satisfies, and null only when none is present. Only
+ * called when requireFanoutProvenance is enabled so the default path pays no I/O.
+ */
+async function readLedgerProvenanceInAny(checkouts, ledgerPath) {
+  let firstNonNull = null;
+  for (const root of checkouts) {
+    const full = path.resolve(root, ledgerPath);
+    try {
+      const parsed = JSON.parse(await readFile(full, "utf8"));
+      const prov = parsed && typeof parsed === "object" ? parsed.provenance : null;
+      if (prov == null) continue; // ledger present but no provenance — keep scanning.
+      if (provenanceConsistencyError(prov) === null && prov.distinctReviewers >= FANOUT_PROVENANCE_MIN_REVIEWERS) {
+        return prov; // satisfying ledger — prefer it over any earlier below-floor one.
+      }
+      if (firstNonNull === null) firstNonNull = prov; // remember for diagnostics.
+    } catch {
+      // Missing/unreadable/malformed ledger in this checkout — try the next.
+    }
+  }
+  return firstNonNull;
+}
 /**
  * Build the fan-out evidence enforcement descriptor.
  *
  * Enforcement is ON by default (opt-out via gates.requireFanoutEvidence: false).
  * Returns { required: false } when enforcement is disabled OR when config is
  * unavailable (config == null — null or undefined — after a failed load) — config-unavailable must
- * fail open and never enable enforcement. When enabled, records per-required-gate
- * executionMode and whether the deterministic findings-log ledger exists for the
- * reviewed head SHA so the pre-merge check can fail closed on inline verdicts or
- * missing ledgers.
+ * fail open and never enable enforcement. When enabled, returns
+ * { required: true, requireProvenance, lightMode, hasFullLabel, gates } where
+ * each per-required-gate entry records executionMode, inlineReason,
+ * scopeUnderThreshold, and whether the deterministic findings-log ledger exists
+ * for the reviewed head SHA, so the pre-merge check can fail closed on inline
+ * verdicts or missing ledgers.
+ *
+ * Light mode (#1174): when gates.lightMode is configured, `hasFullLabel`
+ * (gate:full PR label) and `baseRef` feed a fail-closed merge-base scope
+ * re-derivation for inline verdicts. A gate's scopeUnderThreshold is true only
+ * when light mode is on, the PR has no gate:full label, a base ref is known,
+ * and the reviewed head's merge-base diff is genuinely under threshold — which
+ * lets the pre-merge check accept an inline single-agent verdict for a
+ * small-scope PR instead of always rejecting inline evidence.
  */
-async function buildFanoutEnforcement({ repo, pr, currentHeadSha, draftGateMarker, preApprovalGateMarker, config, cwd }) {
+export async function buildFanoutEnforcement({ repo, pr, currentHeadSha, draftGateMarker, preApprovalGateMarker, config, cwd, hasFullLabel = false, baseRef = null }) {
   // Fail open when config could not be loaded/validated. `== null` covers both
   // null and undefined; the loader only ever yields null on failure, but the
   // loose check defensively treats an absent config as unavailable.
   if (config == null || !resolveRequireFanoutEvidence(config)) {
+    // Disabled/unavailable return is intentionally byte-identical to before
+    // (no requireProvenance key): buildPreMergeGateCheck only reads it inside
+    // the `required` block, so this preserves the exact existing shape.
     return { required: false, gates: [] };
   }
+  // Provenance enforcement is opt-in and layered ON TOP of fan-out evidence: it
+  // only takes effect while evidence enforcement (above) is active.
+  const requireProvenance = resolveRequireFanoutProvenance(config);
+  // Light-mode facts (#1174): the threshold that a re-derived merge-base scope
+  // must fall under for an inline verdict to be accepted. null when lightMode is
+  // disabled → no inline verdict can ever be accepted (scopeUnderThreshold stays
+  // false), preserving today's rejection.
+  const lightThreshold = resolveLightMode(config);
+  const lightMode = lightThreshold != null;
   const draftRequired = resolveGateConfig(config, "draft").required;
   const preApprovalRequired = resolveGateConfig(config, "preApproval").required;
   const gateSpecs = [
@@ -312,18 +426,35 @@ async function buildFanoutEnforcement({ repo, pr, currentHeadSha, draftGateMarke
     { name: "pre_approval_gate", marker: preApprovalGateMarker, required: preApprovalRequired },
   ].filter((spec) => spec.required && spec.marker.visible);
   const gates = [];
+  const checkouts = resolveLedgerCheckouts(cwd);
+  // checkouts[0] is always resolveRepoRoot(cwd) (resolveLedgerCheckouts adds it
+  // first, unconditionally, and never throws — it falls back to cwd on git
+  // failure) — reuse it instead of a second `git rev-parse --show-toplevel`.
+  const repoRoot = checkouts[0];
   for (const spec of gateSpecs) {
     const headSha = spec.marker.headSha ?? currentHeadSha;
     const ledgerPath = buildLogPath({ repo, pr, gate: spec.name, headSha, tmpRoot: "tmp" });
-    const fullPath = path.resolve(cwd, ledgerPath);
+    // Re-derive scope FAIL-CLOSED for inline verdicts only (the fan-out default
+    // path pays no git I/O). scopeUnderThreshold is true ONLY when lightMode is
+    // on, the PR has no gate:full label, a base ref is known, and the merge-base
+    // diff for the reviewed head is genuinely under threshold. Any git/scope
+    // failure leaves it false, so the inline verdict is rejected exactly as today.
+    let scopeUnderThreshold = false;
+    if (lightMode && !hasFullLabel && baseRef && spec.marker.executionMode === "inline_single_agent") {
+      const scope = detectMergeBaseScope({ base: baseRef, head: headSha, cwd: repoRoot });
+      scopeUnderThreshold = scope.ok === true && isEligibleForLightMode(scope, lightThreshold);
+    }
     gates.push({
       name: spec.name,
       executionMode: spec.marker.executionMode ?? null,
+      inlineReason: spec.marker.inlineReason ?? null,
+      scopeUnderThreshold,
       ledgerPath,
-      ledgerExists: await ledgerExists(fullPath),
+      ledgerExists: await ledgerExistsInAny(checkouts, ledgerPath),
+      provenance: requireProvenance ? await readLedgerProvenanceInAny(checkouts, ledgerPath) : null,
     });
   }
-  return { required: true, gates };
+  return { required: true, requireProvenance, lightMode, hasFullLabel, gates };
 }
 export async function detectCheckpointEvidence(options, { env = process.env, ghCommand = "gh", cwd = process.cwd() } = {}) {
   const runnerOwnership = await ensureAsyncRunnerOwnership({
@@ -378,8 +509,31 @@ export async function detectCheckpointEvidence(options, { env = process.env, ghC
   // treat it as config-unavailable and leave fan-out enforcement disabled
   // (preserves default behavior). Other gate checks remain unaffected.
   let config = null;
-  const { config: loadedConfig, errors: configErrors } = await loadDevLoopConfig({ repoRoot: cwd });
+  const { config: loadedConfig, errors: configErrors } = await loadDevLoopConfig({ repoRoot: resolveRepoRoot(cwd) });
   config = Array.isArray(configErrors) && configErrors.length > 0 ? null : loadedConfig;
+  // Light-mode pre-merge facts (#1174): the base commit for the merge-base scope
+  // re-derivation and whether the PR forces full fan-out via the gate:full label.
+  // Fetched LAZILY — only when fan-out enforcement is active AND lightMode is on
+  // AND a gate actually recorded an inline verdict — so the common fan-out path
+  // (and every existing caller/test) makes NO extra gh call and stays unchanged.
+  let baseRef = null;
+  let hasFullLabel = false;
+  const anyInlineVerdict = [draftGateMarker, preApprovalGateMarker].some(
+    (marker) => marker.visible && marker.executionMode === "inline_single_agent",
+  );
+  if (config != null && resolveRequireFanoutEvidence(config) && resolveLightMode(config) != null && anyInlineVerdict) {
+    try {
+      const lightFacts = await runGhJson(["pr", "view", String(options.pr), "--repo", options.repo, "--json", "baseRefOid,labels"], { env, ghCommand });
+      baseRef = typeof lightFacts?.baseRefOid === "string" && lightFacts.baseRefOid.trim().length > 0
+        ? lightFacts.baseRefOid.trim()
+        : null;
+      hasFullLabel = Array.isArray(lightFacts?.labels)
+        && lightFacts.labels.some((label) => (typeof label === "string" ? label : label?.name) === GATE_FULL_LABEL);
+    } catch {
+      // Fail CLOSED: without the label/base facts we cannot safely accept an
+      // inline verdict, so leave baseRef null (scope underivable → rejected).
+    }
+  }
   const fanoutEnforcement = await buildFanoutEnforcement({
     repo: options.repo,
     pr: options.pr,
@@ -388,6 +542,8 @@ export async function detectCheckpointEvidence(options, { env = process.env, ghC
     preApprovalGateMarker,
     config,
     cwd,
+    hasFullLabel,
+    baseRef,
   });
   return {
     ok: true,
@@ -458,7 +614,7 @@ async function main() {
       process.exitCode = 1;
       return;
     }
-    process.stdout.write(`${JSON.stringify(output)}\n`);
+    process.exitCode = emitResult(output, { jq: options.jq, silent: options.silent });
   } catch (error) {
     if (error && typeof error === "object" && "staleRunner" in error && error.staleRunner) {
       const staleRunnerCheck = {

package/scripts/github/detect-linked-issue-pr.mjs

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import { parseArgs } from "node:util";
 import { buildParseError, formatCliError, isDirectCliRun, parseJsonText } from "../_core-helpers.mjs";
-import { parseIssueNumber, requireTokenValue, runChild } from "../_cli-primitives.mjs";
+import { parseIssueNumber, requireTokenValue, runChild as defaultRunChild } from "../_cli-primitives.mjs";
 import { parseRepoSlug } from "@dev-loops/core/github/repo-slug";
+import { JQ_OUTPUT_PARSE_OPTIONS, JQ_OUTPUT_USAGE, emitResult, matchJqOutputToken } from "../lib/jq-output.mjs";
 export const LINKED_ISSUE_PR_QUERY = [
   "query($owner:String!, $name:String!, $issue:Int!, $after:String) {",
   "  repository(owner:$owner, name:$name) {",
@@ -28,6 +29,7 @@ export const LINKED_ISSUE_PR_QUERY = [
   "          }",
   "          ... on CrossReferencedEvent {",
   "            createdAt",
+  "            willCloseTarget",
   "            source {",
   "              __typename",
   "              ... on PullRequest {",
@@ -73,12 +75,18 @@ Error output (stderr, JSON):
   Argument/usage errors:
     { "ok": false, "error": "...", "usage": "..." }
   gh/runtime failures:
-    { "ok": false, "error": "..." }`.trim();
+    { "ok": false, "error": "..." }
+${JQ_OUTPUT_USAGE}`.trim();
 const parseError = buildParseError(USAGE);
 export function parseDetectLinkedIssuePrCliArgs(argv) {
   const { tokens } = parseArgs({
     args: [...argv],
-    options: { help: { type: "boolean", short: "h" }, repo: { type: "string" }, issue: { type: "string" } },
+    options: {
+      help: { type: "boolean", short: "h" },
+      repo: { type: "string" },
+      issue: { type: "string" },
+      ...JQ_OUTPUT_PARSE_OPTIONS,
+    },
     allowPositionals: true,
     strict: false,
     tokens: true,
@@ -107,6 +115,7 @@ export function parseDetectLinkedIssuePrCliArgs(argv) {
       options.issue = parseIssueNumber(requireTokenValue(token, parseError), parseError);
       continue;
     }
+    if (matchJqOutputToken(token, options, (t) => requireTokenValue(t, parseError))) continue;
     throw parseError(`Unknown argument: ${token.rawName}`);
   }
   if (options.repo === undefined || options.issue === undefined) {
@@ -162,6 +171,13 @@ function normalizeLinkedPrNode(node) {
     };
   }
   if (node.__typename === "CrossReferencedEvent") {
+    // Only a cross-reference that will CLOSE this issue owns its board status.
+    // A bare body-mention (willCloseTarget:false, e.g. "part of #X") must not
+    // create board-ownership linkage — otherwise every sibling a PR mentions
+    // gets dragged to In Progress and the resolver fails closed (#1130).
+    if (node.willCloseTarget !== true) {
+      return null;
+    }
     return {
       eventType: "CROSS_REFERENCED_EVENT",
       eventCreatedAt: node.createdAt,
@@ -253,7 +269,7 @@ export function selectLinkedIssuePr(candidates) {
   });
   return sorted[0] ?? null;
 }
-export async function detectLinkedIssuePr({ repo, issue }, { env = process.env, ghCommand = "gh" } = {}) {
+export async function detectLinkedIssuePr({ repo, issue }, { env = process.env, ghCommand = "gh", runChild = defaultRunChild } = {}) {
   const { owner, name } = parseRepoSlug(repo);
   const candidates = [];
   const closedUnmergedCandidates = [];
@@ -322,7 +338,7 @@ export async function detectLinkedIssuePr({ repo, issue }, { env = process.env,
 }
 export async function runCli(
   argv = process.argv.slice(2),
-  { stdout = process.stdout, env = process.env, ghCommand = "gh" } = {},
+  { stdout = process.stdout, stderr = process.stderr, env = process.env, ghCommand = "gh" } = {},
 ) {
   const options = parseDetectLinkedIssuePrCliArgs(argv);
   if (options.help) {
@@ -333,7 +349,7 @@ export async function runCli(
     { repo: options.repo, issue: options.issue },
     { env, ghCommand },
   );
-  stdout.write(`${JSON.stringify(result)}\n`);
+  process.exitCode = emitResult(result, { jq: options.jq, silent: options.silent, stdout, stderr });
 }
 if (isDirectCliRun(import.meta.url)) {
   runCli().catch((error) => {

package/scripts/github/edit-pr.mjs

@@ -0,0 +1,259 @@
+#!/usr/bin/env node
+import { readFile } from "node:fs/promises";
+import { readFileSync } from "node:fs";
+import { buildParseError, formatCliError, isDirectCliRun } from "../_core-helpers.mjs";
+import { parsePrNumber, requireTokenValue, runChild } from "../_cli-primitives.mjs";
+import { parseRepoSlug } from "@dev-loops/core/github/repo-slug";
+import { parseArgs } from "node:util";
+import { JQ_OUTPUT_PARSE_OPTIONS, JQ_OUTPUT_USAGE, emitResult, matchJqOutputToken } from "../lib/jq-output.mjs";
+
+const USAGE = `Usage: edit-pr.mjs --repo <owner/name> --pr <number> [--title <t>] [--body <b> | --body-file <path>] [--add-assignee <u>] [--remove-assignee <u>] [--milestone <m>]
+Edit PR title/body/assignees/milestone. Thin wrapper over \`gh pr edit\` — use this
+instead of an agent-level raw \`gh pr edit\` so the loop's internal-tooling record
+stays clean (siblings: view-pr.mjs, comment-issue.mjs; #1057).
+Required:
+  --repo <owner/name>           Repository slug (e.g. owner/repo)
+  --pr <number>                 Pull request number
+At least one edit:
+  --title <t>                   New PR title
+  --body <b>                    New PR body as a single argument
+  --body-file <path>            Read the new body from a file (- reads stdin)
+  --add-assignee <u>            Assignee to add (repeatable)
+  --remove-assignee <u>         Assignee to remove (repeatable)
+  --milestone <m>               Milestone to set (empty string clears it)
+                                (--title/--body/--body-file reject empty or
+                                whitespace-only values; use --milestone "" only
+                                to clear the milestone)
+Output (stdout, JSON):
+  { "ok": true, "repo": "owner/repo", "pr": 17, "edited": ["title", "body", ...] }
+Error output (stderr, JSON):
+  { "ok": false, "error": "...", "usage"?: "..." }
+${JQ_OUTPUT_USAGE}
+Exit codes:
+  0  Success
+  1  Argument error or gh failure
+  2  Invalid --jq filter`.trim();
+const parseError = buildParseError(USAGE);
+
+export function parseEditPrCliArgs(argv) {
+  const { tokens } = parseArgs({
+    args: [...argv],
+    options: {
+      help: { type: "boolean", short: "h" },
+      repo: { type: "string" },
+      pr: { type: "string" },
+      title: { type: "string" },
+      body: { type: "string" },
+      "body-file": { type: "string" },
+      "add-assignee": { type: "string", multiple: true },
+      "remove-assignee": { type: "string", multiple: true },
+      milestone: { type: "string" },
+      ...JQ_OUTPUT_PARSE_OPTIONS,
+    },
+    allowPositionals: true,
+    strict: false,
+    tokens: true,
+  });
+  const options = {
+    help: false,
+    repo: undefined,
+    pr: undefined,
+    title: undefined,
+    body: undefined,
+    bodyFile: undefined,
+    addAssignees: [],
+    removeAssignees: [],
+    milestone: undefined,
+    jq: undefined,
+    silent: false,
+  };
+  for (const token of tokens) {
+    if (token.kind === "positional") {
+      throw parseError(`Unknown argument: ${token.value}`);
+    }
+    if (token.kind !== "option") {
+      continue;
+    }
+    if (token.name === "help") {
+      options.help = true;
+      return options;
+    }
+    if (token.name === "repo") {
+      options.repo = requireTokenValue(token, parseError).trim();
+      continue;
+    }
+    if (token.name === "pr") {
+      options.pr = parsePrNumber(requireTokenValue(token, parseError), parseError);
+      continue;
+    }
+    if (token.name === "title") {
+      const title = requireTokenValue(token, parseError);
+      if (title.trim().length === 0) {
+        throw parseError("--title must not be empty or whitespace-only");
+      }
+      options.title = title;
+      continue;
+    }
+    if (token.name === "body") {
+      const body = requireTokenValue(token, parseError);
+      if (body.trim().length === 0) {
+        throw parseError("--body must not be empty or whitespace-only");
+      }
+      options.body = body;
+      continue;
+    }
+    if (token.name === "body-file") {
+      const rawPath = requireTokenValue(token, parseError).trim();
+      if (rawPath.length === 0) {
+        throw parseError("--body-file must be a non-empty path");
+      }
+      options.bodyFile = rawPath;
+      continue;
+    }
+    if (token.name === "add-assignee") {
+      const u = requireTokenValue(token, parseError).trim();
+      if (u.length === 0) throw parseError("--add-assignee must be a non-empty login");
+      options.addAssignees.push(u);
+      continue;
+    }
+    if (token.name === "remove-assignee") {
+      const u = requireTokenValue(token, parseError).trim();
+      if (u.length === 0) throw parseError("--remove-assignee must be a non-empty login");
+      options.removeAssignees.push(u);
+      continue;
+    }
+    if (token.name === "milestone") {
+      // Read the raw token value: an empty string is a valid milestone value
+      // (`gh pr edit --milestone ""` clears it), so this deliberately does NOT
+      // go through requireTokenValue (which rejects empty). Guard only a truly
+      // missing value (`--milestone` with no following token). A whitespace-only
+      // value is neither a clear nor a real milestone name — fail closed rather
+      // than forwarding it to gh for a less actionable error.
+      if (typeof token.value !== "string") {
+        throw parseError("--milestone requires a value (use an empty string to clear)");
+      }
+      if (token.value.length > 0 && token.value.trim().length === 0) {
+        throw parseError('--milestone must be a milestone name or "" to clear (whitespace-only is not allowed)');
+      }
+      options.milestone = token.value;
+      continue;
+    }
+    if (matchJqOutputToken(token, options, (t) => requireTokenValue(t, parseError))) continue;
+    throw parseError(`Unknown argument: ${token.rawName}`);
+  }
+  if (options.repo === undefined || options.pr === undefined) {
+    throw parseError("Editing a PR requires both --repo <owner/name> and --pr <number>");
+  }
+  if (options.body !== undefined && options.bodyFile !== undefined) {
+    throw parseError("--body and --body-file are mutually exclusive; pass only one");
+  }
+  const hasEdit =
+    options.title !== undefined ||
+    options.body !== undefined ||
+    options.bodyFile !== undefined ||
+    options.addAssignees.length > 0 ||
+    options.removeAssignees.length > 0 ||
+    options.milestone !== undefined;
+  if (!hasEdit) {
+    throw parseError("Editing a PR requires at least one of --title/--body/--body-file/--add-assignee/--remove-assignee/--milestone");
+  }
+  try {
+    parseRepoSlug(options.repo);
+  } catch (error) {
+    throw parseError(error instanceof Error ? error.message : String(error));
+  }
+  return options;
+}
+
+async function resolveBody(options) {
+  if (options.bodyFile === undefined) return options.body;
+  // Stdin (fd 0): the fs/promises readFile does NOT accept an integer fd, so read
+  // it synchronously via the callback-style API (which does). A real path stays on
+  // the async promise read.
+  const body =
+    options.bodyFile === "-" ? readFileSync(0, "utf8") : await readFile(options.bodyFile, "utf8");
+  // Fail closed on an empty / whitespace-only file so a blank --body-file cannot
+  // silently clear the PR body (USAGE promises --body/--title reject empties).
+  if (body.trim().length === 0) {
+    throw new Error(`--body-file ${options.bodyFile} is empty`);
+  }
+  return body;
+}
+
+// Build the `gh pr edit` args and the parallel `edited` list (which fields were
+// touched) so callers get a stable summary without re-reading the PR.
+async function buildEditArgs(options) {
+  const args = ["pr", "edit", String(options.pr), "--repo", options.repo];
+  const edited = [];
+  if (options.title !== undefined) {
+    args.push("--title", options.title);
+    edited.push("title");
+  }
+  // resolveBody still runs for validation (reads the file, throws on empty /
+  // whitespace-only). A REAL --body-file path is handed straight to gh so large
+  // bodies avoid command-length limits. But `--body-file -` (stdin) was already
+  // consumed by resolveBody reading fd 0; re-emitting `--body-file -` makes gh
+  // re-read an exhausted stdin and clear the body, so pass the resolved string
+  // inline via --body instead.
+  const body = await resolveBody(options);
+  if (body !== undefined) {
+    if (options.bodyFile !== undefined && options.bodyFile !== "-") {
+      args.push("--body-file", options.bodyFile);
+    } else {
+      args.push("--body", body);
+    }
+    edited.push("body");
+  }
+  for (const u of options.addAssignees) {
+    args.push("--add-assignee", u);
+  }
+  if (options.addAssignees.length > 0) edited.push("add-assignee");
+  for (const u of options.removeAssignees) {
+    args.push("--remove-assignee", u);
+  }
+  if (options.removeAssignees.length > 0) edited.push("remove-assignee");
+  if (options.milestone !== undefined) {
+    args.push("--milestone", options.milestone);
+    edited.push("milestone");
+  }
+  return { args, edited };
+}
+
+export async function editPr(options, { env = process.env, ghCommand = "gh", run = runChild } = {}) {
+  const { args, edited } = await buildEditArgs(options);
+  const result = await run(ghCommand, args, env);
+  if (result.code !== 0) {
+    const detail = result.stderr.trim() || `exit code ${result.code}`;
+    throw new Error(`gh pr edit failed: ${detail}`);
+  }
+  return { ok: true, repo: options.repo, pr: options.pr, edited };
+}
+
+export async function runCli(
+  argv = process.argv.slice(2),
+  { stdout = process.stdout, stderr = process.stderr, env = process.env, ghCommand = "gh", run = runChild } = {},
+) {
+  let options;
+  try {
+    options = parseEditPrCliArgs(argv);
+  } catch (error) {
+    stderr.write(`${formatCliError(error)}\n`);
+    return 1;
+  }
+  if (options.help) {
+    stdout.write(`${USAGE}\n`);
+    return 0;
+  }
+  let result;
+  try {
+    result = await editPr(options, { env, ghCommand, run });
+  } catch (error) {
+    stderr.write(`${JSON.stringify({ ok: false, error: error instanceof Error ? error.message : String(error) })}\n`);
+    return 1;
+  }
+  return emitResult(result, { jq: options.jq, silent: options.silent, stdout, stderr });
+}
+
+if (isDirectCliRun(import.meta.url)) {
+  runCli().then((code) => { process.exitCode = code; });
+}

package/scripts/github/fetch-ci-logs.mjs

@@ -3,7 +3,7 @@ import { buildParseError, formatCliError, isDirectCliRun, parseJsonText } from "
 import { parsePrNumber, requireTokenValue, runChild } from "../_cli-primitives.mjs";
 import { parseRepoSlug } from "@dev-loops/core/github/repo-slug";
 import { parseArgs } from "node:util";
-import { JQ_OUTPUT_PARSE_OPTIONS, JQ_OUTPUT_USAGE, emitResult } from "../lib/jq-output.mjs";
+import { JQ_OUTPUT_PARSE_OPTIONS, JQ_OUTPUT_USAGE, emitResult, matchJqOutputToken } from "../lib/jq-output.mjs";
 
 const DEFAULT_TAIL_LINES = 200;
 
@@ -91,14 +91,7 @@ export function parseFetchCiLogsCliArgs(argv) {
       options.tail = value;
       continue;
     }
-    if (token.name === "jq") {
-      options.jq = requireTokenValue(token, parseError);
-      continue;
-    }
-    if (token.name === "silent") {
-      options.silent = true;
-      continue;
-    }
+    if (matchJqOutputToken(token, options, (t) => requireTokenValue(t, parseError))) continue;
     throw parseError(`Unknown argument: ${token.rawName}`);
   }
   if (options.repo === undefined || options.pr === undefined) {