devlyn-cli 3.3.0 → 3.3.1

package/AGENTS.md

@@ -38,7 +38,7 @@ Each skill's `SKILL.md` is the source of truth for flags and workflow. Do not du
 
 Engine roles: orchestrator = whichever CLI the user opened (this contract is symmetric with CLAUDE.md. If you are Codex orchestrating `/devlyn:resolve`, the phase machinery is mandatory regardless of task size; if you will not run it, say so explicitly and stop — do not silently degrade to ad-hoc execution); legacy executor (with optional separate worker/primary/pair profiles) uses the canonical skill's orchestrator-supported default, overridable per run with `--engine <name>` or durably via machine-local `.devlyn/engines.json` `{"executor": "<name>", "pair_judge_priority": ["<name>", ...]}`; PLAN is orchestrator-fixed and never inherits `--engine` or the executor pin; pair judge = first available OTHER engine, default for VERIFY whenever available; risk probes remain conditional and --no-pair opts out. Pins fail closed (`BLOCKED:<engine>-unavailable` / `BLOCKED:invalid-engine-config`); new engines plug in by shipping `_shared/adapters/<name>.md`. `/devlyn:engines` (no args) shows the role table + detected engines; `executor <name>` / `pair <name>,...` / `clear` manage the pins. The executor pin binds the orchestrator in plain conversation too, not only inside a skill run: when you would implement directly and executor is pinned to a non-default engine, route that work through the pin — via `/devlyn:resolve` (reads it at PHASE 0) or by delegating to that engine; no pin / no file → use the canonical skill's orchestrator-supported default. The pair-judge pin stays pipeline-scoped. `/devlyn:engines role` configures explicit engine/model/effort for supported worker and judge routes; `/devlyn:resolve --role-config <path>` overrides roles for one run. Canonical skills define precedence, evidence and unsupported-route errors; absent profiles preserve existing defaults.
 
-Conversational entry: Before loading a workflow or writing files, inspect the requested change and relevant callers/tests. Quoted phase names, past logs and skill-file paths are context, not an instruction to invoke that workflow; follow the current user request. Default to direct execution when inspection makes the requested behavior, affected boundaries and verification tractable in the current context, including bounded multi-file work. Preserve requested behavior, scope, explicit constraints and the executor pin; make scoped edits, run required checks, review the final diff, and report changes with evidence. One concise route/check explanation suffices; ordinary direct work needs no spec, pipeline state, phase workers or extra approval. For direct/full/queue work, the outer owner reads `references/task-completion.md` relative to the installed `devlyn:resolve` skill's directory: prospective task-branch ownership (own linked worktree), scoped commit acceptance, then push + PR after required archive/queue commits. Local-only/no-push wins; delivery pending/failure stays separate from product verification.
+Conversational entry: Before loading a workflow or writing files, inspect the requested change and relevant callers/tests. Quoted phase names, past logs and skill-file paths are context, not an instruction to invoke that workflow; follow the current user request. Default to direct execution when inspection makes the requested behavior, affected boundaries and verification tractable in the current context, including bounded multi-file work. Preserve requested behavior, scope, explicit constraints and the executor pin; make scoped edits, run required checks, review the final diff, and report changes with evidence. One concise route/check explanation suffices; ordinary direct work needs no spec, pipeline state, phase workers or extra approval. For direct/full/queue work, the outer owner reads `references/task-completion.md` relative to the installed `devlyn:resolve` skill's directory: prospective task-branch ownership (own linked worktree), scoped commit acceptance, then PR/merge and recoverable owned-resource cleanup after required archive/queue commits. Local-only/no-push wins; delivery pending/failure stays separate from product verification.
 
 Use full `/devlyn:resolve` automatically only when inspection identifies interacting requirements or verification work too complex to manage reliably in the current context, such as coupled durable state, concurrent ownership and failure recovery across boundaries. Name the concrete interaction or verification gap. Domain labels (security/auth/payment/persistence/concurrency/API), file count and a spec document alone do not trigger it. Investigate or clarify missing intent/access first; a pipeline cannot supply them. Direct work still requires risk-proportionate checks and independent review for consequential changes. Explicit resolve (even small), explicit spec-mode workflows and queue drains retain all canonical phases, independent verification, pins and failure handling. If the full-route condition emerges mid-edit, carry the existing delta into its scope/evidence; do not reset the baseline or reconfirm existing authorization.
 

package/CLAUDE.md

@@ -51,7 +51,7 @@ Each skill's `SKILL.md` is the source of truth for its flags and workflow — do
 
 ### Conversational entry + full-route handoff
 
-Before loading a workflow or writing files, inspect the requested change and relevant callers/tests. Quoted phase names, past logs and skill-file paths are context, not an instruction to invoke that workflow; follow the current user request. Default to direct execution when inspection makes the requested behavior, affected boundaries and verification tractable in the current context, including bounded multi-file work. Preserve requested behavior, scope, explicit constraints and the executor pin; make scoped edits, run required checks, review the final diff, and report changes with evidence. One concise route/check explanation suffices; ordinary direct work needs no spec, pipeline state, phase workers or extra approval. For direct/full/queue work, the outer owner reads `references/task-completion.md` relative to the installed `devlyn:resolve` skill's directory: prospective task-branch ownership (own linked worktree), scoped commit acceptance, then push + PR after required archive/queue commits. Local-only/no-push wins; delivery pending/failure stays separate from product verification.
+Before loading a workflow or writing files, inspect the requested change and relevant callers/tests. Quoted phase names, past logs and skill-file paths are context, not an instruction to invoke that workflow; follow the current user request. Default to direct execution when inspection makes the requested behavior, affected boundaries and verification tractable in the current context, including bounded multi-file work. Preserve requested behavior, scope, explicit constraints and the executor pin; make scoped edits, run required checks, review the final diff, and report changes with evidence. One concise route/check explanation suffices; ordinary direct work needs no spec, pipeline state, phase workers or extra approval. For direct/full/queue work, the outer owner reads `references/task-completion.md` relative to the installed `devlyn:resolve` skill's directory: prospective task-branch ownership (own linked worktree), scoped commit acceptance, then PR/merge and recoverable owned-resource cleanup after required archive/queue commits. Local-only/no-push wins; delivery pending/failure stays separate from product verification.
 
 Use full `/devlyn:resolve` automatically only when inspection identifies interacting requirements or verification work too complex to manage reliably in the current context, such as coupled durable state, concurrent ownership and failure recovery across boundaries. Name the concrete interaction or verification gap. Domain labels (security/auth/payment/persistence/concurrency/API), file count and a spec document alone do not trigger it. Investigate or clarify missing intent/access first; a pipeline cannot supply them. Direct work still requires risk-proportionate checks and independent review for consequential changes. Explicit resolve (even small), explicit spec-mode workflows and queue drains retain all canonical phases, independent verification, pins and failure handling. If the full-route condition emerges mid-edit, carry the existing delta into its scope/evidence; do not reset the baseline or reconfirm existing authorization.
 

package/README.md

@@ -84,10 +84,10 @@ PLAN  →  IMPLEMENT  →  BUILD_GATE  →  CLEANUP  →  VERIFY (fresh subagent
 Common flags: `--engine claude|codex|omp` (default: the orchestrator-supported default), `--role-config <path>` (one-run worker/judge profiles, see below), `--bypass build-gate,cleanup`, `--pair-verify` (force pair-mode JUDGE in VERIFY), `--no-pair` (intentional solo VERIFY), `--risk-probes` / `--no-risk-probes`, `--perf` (per-phase timing).
 `--pair-verify` and `--no-pair` are mutually exclusive; using both stops with `BLOCKED:invalid-flags`.
 
-Each task gets its own linked worktree; accepted tasks default to scoped commit → push → PR.
-After the PR merges, either mode cleans the worktree and branch its session
-released; anything in use is kept. Set `git config --local devlyn.completionMode auto` to
-also request a normal protected merge; `task-complete.py complete --mode auto|pr`
+Each task gets its own linked worktree; accepted tasks default to scoped commit → push → PR
+→ merge when the repository allows it (otherwise the PR waits for a person). After the
+PR merges, the worktree and branch its session released are cleaned; anything in use is
+kept. Set `git config --local devlyn.completionMode pr` to stop at the PR; `task-complete.py complete --mode auto|pr`
 overrides one task. Local-only/no-push instructions take precedence; existing
 branches cannot be adopted. Full runs require successful archive before delivery;
 direct tasks use their actual checks and root acceptance. Verify-only never

package/bin/instruction-templates.json

@@ -222,6 +222,7 @@
       "9f62c5b2a94e8b5e81528ccbdb6f78d147d14882108568b2cb3b7f85212694c0",
       "a02eb2d8d77553327fb77377dbfedeab059b2e68e0a33c469b9be54a5d55182b",
       "a3a15249968f64085b0cec8c0826688a4c3a1e4cf09b4879054baa086d5cbca1",
+      "a4da26a46ab83815d8ca5d747c68a907ad67dad485adbc6c863b982ee23b307e",
       "a5d6ff585d696254d6727cd1e6d7f8825881f90210eff744265e211ced715ea3",
       "a7ff913df40945a8a16b6632214020a368119ff665953d4a07ec58330b39f101",
       "aafc680a7ac73e100f4a17d2c4070190e68563f78614c39f4c2f58f1e291d9a9",
@@ -775,6 +776,7 @@
       "e29fec7d54a144ea4867a3764fccdee6849d58d0f32eacdd56b2c317863fa1c6",
       "e2e0fc585321ee2013cccaed95d47c49fbca71b54c67abad9080d19d70e3c1a5",
       "e3b2f7be15a793f07cbe8e51aa2feeac51d4c67077b94e5e20bad2e14be07fc5",
+      "e468c242cc38c390f9679fca61f355848f58d51570249dfbb65b4f2e26a9dfb1",
       "e4bafa0f553e899b65f05feabf4cbe86d8246c57cbba745eb79e6aa858f40a6b",
       "e5160f4da789914e7f93694a55b9f80b8d06c3b0a126ff60f7627b0b418ae292",
       "e55a62fa1a993f5df1b44d1c55ef27915938d58a1c357604f3dc150f795672df",

package/config/skills/_shared/task-complete.py

@@ -172,7 +172,7 @@ def policy(receipt, override):
     require(config.returncode == 1 or config.stdout in {"auto\n", "pr\n"}, "invalid local devlyn.completionMode; use auto|pr")
     value = config.stdout.strip() if config.returncode == 0 else None
     require(override is None or override in {"auto", "pr"}, "invalid task mode; use auto|pr")
-    return override or value or "pr"
+    return override or value or "auto"
 
 
 def allocate(args):
@@ -685,8 +685,6 @@ def complete(args):
             inspect_workspace(current)
         bind_acceptance(receipt, path, args.acceptance)
         info = repo_policy(receipt)
-        if mode == "auto":
-            require(info["mergeCommitAllowed"], "repository disallows merge commits; use pr mode or resolve policy with repository owner")
         if receipt.get("pr_number"):
             pr = json.loads(gh(receipt, "pr", "view", str(receipt["pr_number"]), "--json", PR_FIELDS))
         else:
@@ -725,12 +723,18 @@ def complete(args):
             inspect_workspace(receipt)
             verify_files(Path(receipt["worktree"]), receipt["files"])
             require(remote_head(receipt, receipt["branch"]) == receipt["publish_sha"], "remote head race before merge")
+            refused = None
             if not pr.get("autoMergeRequest"):
-                gh(receipt, "pr", "merge", str(pr["number"]), "--auto", "--merge", "--match-head-commit", receipt["publish_sha"])
+                try:
+                    require(info["mergeCommitAllowed"], "repository disallows merge commits")
+                    gh(receipt, "pr", "merge", str(pr["number"]), "--auto", "--merge", "--match-head-commit", receipt["publish_sha"])
+                except CompletionError as error:
+                    refused = str(error)
             pr = json.loads(gh(receipt, "pr", "view", str(pr["number"]), "--json", PR_FIELDS))
             validate_pr(receipt, pr)
             if pr["state"] != "MERGED":
-                return result("PENDING")
+                # Merge only when the repository allows it; a refused request leaves the PR for a person.
+                return dict(result("PR"), merge_refused=refused) if refused and not pr.get("autoMergeRequest") else result("PENDING")
         receipt["merge"] = pr
         atomic_json(path, receipt)
         cleanup(receipt, path, pr)
@@ -1242,7 +1246,7 @@ class CompletionTests(unittest.TestCase):
         self.g("config", "url." + alias + ".insteadOf", intended)
         self.allocate(); self.accept()
         self.assertEqual(json.loads(self.receipt.read_text(encoding="utf-8"))["remote_url"], {"literal": intended, "fetch": alias, "push": alias})
-        result, _ = self.complete()
+        result, _ = self.complete("--mode", "pr")
         self.assertEqual(result["status"], "PR")
         self.assertEqual(self.g("ls-remote", "origin", "refs/heads/task/fixture").split()[0], self.sha)
         d = json.loads(self.data.read_text(encoding="utf-8"))
@@ -1374,6 +1378,15 @@ class CompletionTests(unittest.TestCase):
         self.assertEqual(result["status"], "COMPLETE")
         self.assertFalse(self.task.exists())
 
+    @unittest.skipUnless(sys.platform == "darwin" or sys.platform.startswith("linux"), "writer observation requires POSIX")
+    def test_default_mode_merges_when_possible_and_cleans(self):
+        self.allocate(); self.accept()
+        result, _ = self.complete("--writers-stopped")
+        self.assertEqual(result["status"], "COMPLETE")
+        self.assertEqual(json.loads(self.data.read_text(encoding="utf-8")).get("merges"), 1)
+        self.assertFalse(self.task.exists())
+        self.assertEqual(self.g("branch", "--list", "task/fixture"), "")
+
     def test_release_is_refused_from_inside_the_task_tree(self):
         self.allocate(); self.accept()
         _, r = self.complete("--mode", "pr", "--writers-stopped", cwd=self.task, success=False)
@@ -1710,10 +1723,12 @@ class CompletionTests(unittest.TestCase):
 
     def test_interrupted_external_effects(self):
         self.allocate(); self.accept()
-        for effect in ("push", "create", "merge"):
+        for effect in ("push", "create"):
             self.configure(**{"interrupt_"+effect: True})
             _, r = self.complete("--writers-stopped", "--mode", "auto", success=False)
             self.assertNotEqual(r.returncode, 0)
+        # A merge command that fails after merging is judged by the PR state, not its exit code.
+        self.configure(interrupt_merge=True)
         result, _ = self.complete("--writers-stopped")
         self.assertEqual(result["status"], "COMPLETE")
         d = json.loads(self.data.read_text(encoding="utf-8"))
@@ -1801,16 +1816,19 @@ class CompletionTests(unittest.TestCase):
     def test_policy_and_local_only_persist(self):
         self.allocate(); self.accept()
         self.configure(merge_allowed=False)
-        _, r = self.complete("--mode", "auto", success=False)
-        self.assertNotEqual(r.returncode, 0)
-        self.assertEqual(json.loads(self.data.read_text(encoding="utf-8")).get("pushs",0), 0)
+        result, _ = self.complete()
+        self.assertEqual((result["status"], result["merge_refused"]), ("PR", "repository disallows merge commits"))
+        d = json.loads(self.data.read_text(encoding="utf-8"))
+        self.assertEqual((d.get("pushs", 0), d.get("merges", 0)), (1, 0))
         self.complete("--mode", "pr")
         result, _ = self.complete()
         self.assertEqual(result["status"], "PR")
+        self.assertNotIn("merge_refused", result)
         self.configure(merge_allowed=True, auto_allowed=False, pending=True)
-        _, r = self.complete("--mode", "auto", success=False)
-        self.assertNotEqual(r.returncode, 0)
-        self.assertIn("disallows auto merge", json.loads(r.stdout)["reason"])
+        result, _ = self.complete("--mode", "auto")
+        self.assertEqual(result["status"], "PR")
+        self.assertIn("disallows auto merge", result["merge_refused"])
+        self.assertTrue(self.task.exists())
         result, _ = self.complete("--no-push")
         self.assertEqual(result["status"], "LOCAL_ONLY")
         result, _ = self.complete(acceptance=False)

package/config/skills/devlyn:resolve/references/task-completion.md

@@ -101,19 +101,19 @@ python3 "$DEVLYN_SHARED_DIR/task-complete.py" complete \
 ```
 
 Project policy is `git config --local devlyn.completionMode auto|pr`; absent means
-`pr`. Invalid local values fail before external effects, even with an override.
+`auto`. Invalid local values fail before external effects, even with an override.
 Use `complete --mode auto|pr` for one task, or `--local-only`/`--no-push` to honor
 the user's delivery restriction. These per-task choices persist in the receipt.
 
 `pr` pushes the exact accepted task ref and creates/reuses its exact repository,
 head and base PR. While OPEN, it cancels owned auto-merge, reports `PR` with its URL
 and retains the checkout. Once MERGED by any method, either mode cleans released
-resources in that call, on resume or at the next allocation. Opt-in `auto` also requests
+resources in that call, on resume or at the next allocation. Default `auto` also requests
 `gh pr merge --auto --merge --match-head-commit <accepted SHA>`. Repository
 checks/reviews and merge policy remain authoritative: no admin bypass, strategy
-fallback or repository setting changes. A repository that disallows
-merge commits fails visibly; disabled auto merge may also reject a pending
-request. Command success alone never proves merge.
+fallback or repository setting changes. When the repository disallows merge
+commits or refuses the request, delivery reports `PR` with `merge_refused` and
+the PR waits for a person. Command success alone never proves merge.
 
 `PENDING` retains the workspace and reports a receipt-based resume command.
 `BLOCKED` includes the cause and the same retry path; repair the reported condition

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devlyn-cli",
-  "version": "3.3.0",
+  "version": "3.3.1",
   "description": "Loop & harness engineering for AI coding agents (Claude Code, Codex, and any AGENTS.md-driven agent) — take intent to shipped, engineer-quality software hands-free with phase-gated pipelines and agent orchestration",
   "homepage": "https://github.com/fysoul17/devlyn-cli#readme",
   "bin": {