gitbash 2.2.2 → 3.0.1

package/README.md

@@ -1,6 +1,6 @@
 # gitbash
 
-Pure bash, zero-dependency git utilities. Reduce repetitive typing and supercharge git workflows with optional interactive previews and safe cleanup — see a [full comparison](./docs/workflows.md).
+Git utilities written in pure bash: only git is required, fzf, delta and bat are optional. Reduce repetitive typing and supercharge git workflows with optional interactive previews and safe cleanup — see a [full comparison](./docs/workflows.md).
 
 ![screenshot-status.png](./docs/screenshot-status.png)
 
@@ -76,7 +76,7 @@ curl -fsSL https://raw.githubusercontent.com/jaggli/gitbash/main/install.sh | sh
 irm https://raw.githubusercontent.com/jaggli/gitbash/main/install.ps1 | iex
 ```
 
-It installs to `~/.local/share/gitbash` and links `~/.local/bin/gitbash` (add that folder to your PATH if the script says so); delete both to uninstall. Set `GITBASH_VERSION` for a specific version, and `GITBASH_INSTALL_DIR` / `GITBASH_BIN_DIR` for other locations.
+It downloads the package published on npm, checks it against npm's sha512 checksum, and installs it to `~/.local/share/gitbash` and links `~/.local/bin/gitbash` (add that folder to your PATH if the script says so); delete both to uninstall. Set `GITBASH_VERSION` for a specific version, and `GITBASH_INSTALL_DIR` / `GITBASH_BIN_DIR` for other locations.
 
 ## Options
 
@@ -94,6 +94,8 @@ It installs to `~/.local/share/gitbash` and links `~/.local/bin/gitbash` (add th
 
 ## Commands
 
+`-y` / `--yes` answers every yes/no question with yes and is passed on to the commands a command runs (e.g. `pr -y` → `commit`). Deleting unmerged work or remote branches and force-pushing always ask. Options with a value accept `--days=14` and `--days 14`.
+
 ### branch
 
 Interactive menu for branch operations (create/switch/update).
@@ -107,7 +109,7 @@ branch --version    # Show version
 ### create
 
 ```bash
-create [--feature|--bugfix|--hotfix|--release|-t] [--push|--no-push] [JIRA_LINK|ISSUE] [TITLE...]
+create [--feature|--bugfix|--hotfix|--release|-t] [-p|--push|--no-push] [-y] [JIRA_LINK|ISSUE] [TITLE...]
 ```
 
 Create a branch from the latest `origin/<base>` with optional Jira parsing, then push and track it (`GITBASH_CREATE_AUTO_PUSH`, `--no-push`).
@@ -140,7 +142,7 @@ create                                  # Interactive mode (no Jira prompt)
 ```bash
 create PROJ-123 fix bug                 # → feature/PROJ-123-fix-bug
 create fix bug                          # → feature/NOISSUE-fix-bug
-create enhance login screen             # → feature/enhance-login-screen (parsing disabled)
+create --no-push PROJ-7 quick fix       # → feature/PROJ-7-quick-fix, not pushed
 ```
 
 ### switch
@@ -191,7 +193,7 @@ Interactive staging with fzf and diff previews.
 ### pr
 
 ```bash
-pr [-p|--push] [--print]
+pr [-p|--push] [--print] [-y|--yes]
 ```
 
 Open the pull request in the browser: the existing PR via the GitHub CLI when available, otherwise the create page (GitHub, GitHub Enterprise, GitLab, Bitbucket, Azure DevOps). Offers to commit local changes and to push a branch that is not on the remote yet. `-p` pushes first, `--print` prints the URL.
@@ -215,7 +217,7 @@ Reset the current branch like a fresh clone: fetch, `git reset --hard <remote>/<
 ### update
 
 ```bash
-update [-p|--push]
+update [-p|--push] [-y|--yes]
 ```
 
 Merge the latest `origin/<base>` into the current branch. With local changes, asks to commit, stash (restored afterwards) or abort. Lists conflicts and opens the merge tool (`GITBASH_MERGE_COMMAND`). On the base branch itself, fast-forwards it.
@@ -240,23 +242,23 @@ Interactive stash menu: create, apply, or delete stashes.
 ### stash
 
 ```bash
-stash [NAME...]
+stash [--] [NAME...]
 ```
 
-Create named stash (includes untracked files).
+Create named stash (includes untracked files). Use `--` for a name starting with `-`.
 
 ### unstash
 
-Apply stash with fzf picker. Drops it afterwards unless you say no.
+Apply stash with fzf picker. Drops it afterwards unless you say no. `-y` drops it without asking.
 
 ### cleanstash
 
-Delete stashes (multi-select with TAB).
+Delete stashes (multi-select with TAB). `-y` skips the confirmation.
 
 ### cleanup
 
 ```bash
-cleanup [--dry-run] [--days=N] [-y|--yes] [--json]
+cleanup [-n|--dry-run] [--days=N] [-y|--yes] [--json]
 ```
 
 Find and delete leftover local branches:
@@ -288,7 +290,7 @@ Unpushed commits are shown per branch. Deletes with `git branch -d`; force-delet
 ### commits
 
 ```bash
-commits [-a|--all] [COUNT]
+commits [-a|--all] [-y|--yes] [COUNT]
 ```
 
 List the current branch's own commits with option to revert. On a feature branch only commits not in the base branch are shown; on the base branch its first-parent history (merged branches as their merge commit). If the upstream has new commits, offers to fast-forward first. Multi-select with TAB; selected commits are reverted newest first.

package/bin/gitbash

@@ -20,7 +20,9 @@ if [[ "$SCRIPT_DIR" == */node_modules/.pnpm/gitbash@*/node_modules/gitbash &&
 fi
 COMMANDS_DIR="$SCRIPT_DIR/commands"
 VERSION="$(grep -o '"version": *"[^"]*"' "$SCRIPT_DIR/package.json" | head -1 | cut -d'"' -f4)"
-export SCRIPT_DIR GITBASH_BIN VERSION
+# Not exported: they would leak into git hooks, editors and merge tools.
+# Commands are sourced into this process; nested runs of gitbash set them again.
+export -n SCRIPT_DIR GITBASH_BIN VERSION
 
 # shellcheck source=../commands/_utils.sh
 source "$COMMANDS_DIR/_utils.sh"
@@ -394,7 +396,8 @@ check_pwsh_integration() {
         # Restricted (the default of Windows PowerShell) and AllSigned block the profile
         case "$policy" in
             Restricted|AllSigned|Undefined)
-                if gb_confirm "PowerShell blocks scripts, including your profile ($policy). Allow local scripts (execution policy RemoteSigned)?" y; then
+                # A security setting: never changed by pressing Enter or by GITBASH_ASSUME_YES
+                if gb_confirm --strict "PowerShell blocks scripts, including your profile ($policy). Allow local scripts (execution policy RemoteSigned)?" n; then
                     if "$exe" -NoProfile -NonInteractive -Command 'Set-ExecutionPolicy -Scope CurrentUser RemoteSigned -Force'; then
                         print_success "Local scripts allowed."
                     else

package/commands/_utils.sh

@@ -111,7 +111,8 @@ prompt_read() {
 }
 
 # Yes/no question. Returns 0 for yes, 1 for no. EOF or Enter picks the default.
-# GITBASH_ASSUME_YES=1 (set by --yes flags) answers yes, unless --strict is given.
+# GITBASH_ASSUME_YES=1 (exported by --yes flags, so commands run from a command
+# inherit it) answers yes, unless --strict is given.
 # Usage: gb_confirm [--strict] "Question?" y|n
 gb_confirm() {
     local strict=false
@@ -269,7 +270,12 @@ _gb_normalize_config() {
         GITBASH_CLEANUP_DAYS=7
     fi
     GITBASH_CLEANUP_DAYS="${GITBASH_CLEANUP_DAYS:-7}"
-    if ! [[ "${GITBASH_REMOTE:-origin}" =~ ^[A-Za-z0-9._-]+$ ]]; then
+    # Values reach git as arguments: a leading '-' would be read as an option
+    if [[ -n "$GITBASH_BASE_BRANCH" ]] && ! _gb_valid_branch_name "$GITBASH_BASE_BRANCH"; then
+        print_warning "Invalid GITBASH_BASE_BRANCH '$GITBASH_BASE_BRANCH', detecting the base branch instead."
+        GITBASH_BASE_BRANCH=""
+    fi
+    if ! [[ "${GITBASH_REMOTE:-origin}" =~ ^[A-Za-z0-9._][A-Za-z0-9._-]*$ ]]; then
         print_warning "Invalid GITBASH_REMOTE '$GITBASH_REMOTE', using 'origin'."
         GITBASH_REMOTE="origin"
     fi
@@ -345,15 +351,24 @@ gb_current_branch() {
     git symbolic-ref --quiet --short HEAD 2>/dev/null
 }
 
-# Detect the base branch: GITBASH_BASE_BRANCH, <remote>/HEAD, main, master
+# Returns 0 if $1 is a valid branch name that can't be mistaken for an option.
+# (git itself accepts refs like "refs/heads/--output=file", so check the dash too.)
+_gb_valid_branch_name() {
+    [[ -n "$1" && "$1" != -* ]] && git check-ref-format "refs/heads/$1" >/dev/null 2>&1
+}
+
+# Detect the base branch: GITBASH_BASE_BRANCH, <remote>/HEAD, main, master.
+# The result is passed to git as an argument: names from a committed .gitbashrc
+# or from the remote are only used when valid.
 gb_base_branch() {
     local remote branch
     remote=$(gb_remote)
-    if [[ -n "${GITBASH_BASE_BRANCH:-}" ]]; then
+    if [[ -n "${GITBASH_BASE_BRANCH:-}" ]] && _gb_valid_branch_name "$GITBASH_BASE_BRANCH"; then
         echo "$GITBASH_BASE_BRANCH"
         return 0
     fi
-    if branch=$(git symbolic-ref --quiet --short "refs/remotes/$remote/HEAD" 2>/dev/null); then
+    if branch=$(git symbolic-ref --quiet --short "refs/remotes/$remote/HEAD" 2>/dev/null) &&
+       _gb_valid_branch_name "${branch#"$remote"/}"; then
         echo "${branch#"$remote"/}"
         return 0
     fi
@@ -434,18 +449,39 @@ gb_sync_and_push() {
     done
 
     local remote branch
-    remote=$(gb_remote)
     if ! branch=$(gb_current_branch); then
         print_error "Detached HEAD: check out a branch before pushing."
         return 1
     fi
+
+    # Push to the branch's upstream (e.g. a fork, or a different name on the remote),
+    # else to <GITBASH_REMOTE>/<branch>. An upstream that is a protected branch (a
+    # branch started from origin/main tracks main) is never pushed to.
+    local target="$branch" set_upstream=false up_remote up_merge
+    remote=$(gb_remote)
+    up_remote=$(git config "branch.$branch.remote" 2>/dev/null) || up_remote=""
+    up_merge=$(git config "branch.$branch.merge" 2>/dev/null) || up_merge=""
+    up_merge="${up_merge#refs/heads/}"
+    if [[ -n "$up_remote" && "$up_remote" != "." && "$up_remote" != -* && -n "$up_merge" ]] &&
+       git remote get-url "$up_remote" >/dev/null 2>&1 &&
+       _gb_valid_branch_name "$up_merge" && ! gb_is_protected "$up_merge"; then
+        remote="$up_remote"
+        target="$up_merge"
+    else
+        set_upstream=true
+    fi
     if ! git remote get-url "$remote" >/dev/null 2>&1; then
         print_error "No remote '$remote' configured."
         return 1
     fi
+    local refspec="$branch" where="$remote"
+    if [[ "$target" != "$branch" ]]; then
+        refspec="$branch:refs/heads/$target"
+        where="$remote/$target"
+    fi
 
     local out
-    if ! out=$(git ls-remote --heads "$remote" "refs/heads/$branch" 2>&1); then
+    if ! out=$(git ls-remote --heads "$remote" "refs/heads/$target" 2>&1); then
         print_error "Could not reach '$remote':"
         printf '%s\n' "$out" >&2
         return 1
@@ -453,40 +489,40 @@ gb_sync_and_push() {
 
     # New branch: first push sets up tracking
     if [[ -z "$out" ]]; then
-        print_info "Pushing new branch '$branch' to '$remote'..."
-        if git push -u "$remote" "$branch"; then
-            print_success "Pushed '$branch' to '$remote'."
+        print_info "Pushing new branch '$branch' to '$where'..."
+        if git push -u "$remote" "$refspec"; then
+            print_success "Pushed '$branch' to '$where'."
             return 0
         fi
-        print_error "Failed to push '$branch' to '$remote'."
+        print_error "Failed to push '$branch' to '$where'."
         return 1
     fi
 
-    if ! git fetch --quiet "$remote" "+refs/heads/$branch:refs/remotes/$remote/$branch"; then
-        print_error "Failed to fetch '$remote/$branch'."
+    if ! git fetch --quiet "$remote" "+refs/heads/$target:refs/remotes/$remote/$target"; then
+        print_error "Failed to fetch '$remote/$target'."
         return 1
     fi
 
     local local_commit remote_commit
     local_commit=$(git rev-parse HEAD)
-    remote_commit=$(git rev-parse "refs/remotes/$remote/$branch")
+    remote_commit=$(git rev-parse "refs/remotes/$remote/$target")
 
     if [[ "$local_commit" == "$remote_commit" ]]; then
-        print_info "'$remote/$branch' is already up to date."
+        print_info "'$remote/$target' is already up to date."
         return 0
     fi
 
     local push_args=()
-    if [[ -z "$(git config "branch.$branch.remote" 2>/dev/null)" ]]; then
+    if [[ "$set_upstream" == true ]]; then
         push_args+=("-u")
     fi
 
     if git merge-base --is-ancestor "$remote_commit" "$local_commit"; then
         : # Ahead of the remote: plain push
     elif git merge-base --is-ancestor "$local_commit" "$remote_commit"; then
-        print_info "'$remote/$branch' has new commits. Fast-forwarding..."
-        if git merge --ff-only --quiet "refs/remotes/$remote/$branch"; then
-            print_success "Up to date with '$remote/$branch'. Nothing to push."
+        print_info "'$remote/$target' has new commits. Fast-forwarding..."
+        if git merge --ff-only --quiet "refs/remotes/$remote/$target"; then
+            print_success "Up to date with '$remote/$target'. Nothing to push."
             return 0
         fi
         print_error "Fast-forward failed."
@@ -496,10 +532,10 @@ gb_sync_and_push() {
         ahead=$(git rev-list --count "$remote_commit..$local_commit")
         behind=$(git rev-list --count "$local_commit..$remote_commit")
         if [[ "$amend" == true || "$force" == true ]]; then
-            print_warning "'$remote/$branch' differs from your rewritten branch ($ahead local vs $behind remote commit(s))."
-            if gb_confirm --strict "Overwrite '$remote/$branch' with your version (push --force-with-lease)?" n; then
-                if git push "${push_args[@]+"${push_args[@]}"}" --force-with-lease="refs/heads/$branch:$remote_commit" "$remote" "$branch"; then
-                    print_success "Force-pushed '$branch' to '$remote'."
+            print_warning "'$remote/$target' differs from your rewritten branch ($ahead local vs $behind remote commit(s))."
+            if gb_confirm --strict "Overwrite '$remote/$target' with your version (push --force-with-lease)?" n; then
+                if git push "${push_args[@]+"${push_args[@]}"}" --force-with-lease="refs/heads/$target:$remote_commit" "$remote" "$refspec"; then
+                    print_success "Force-pushed '$branch' to '$where'."
                     return 0
                 fi
                 print_error "Force push failed (someone else may have pushed in the meantime)."
@@ -509,18 +545,18 @@ gb_sync_and_push() {
             return 1
         fi
 
-        print_warning "Your branch and '$remote/$branch' have diverged ($ahead local, $behind remote commit(s))."
+        print_warning "Your branch and '$remote/$target' have diverged ($ahead local, $behind remote commit(s))."
         local choice
-        gb_choice choice "[r]ebase onto '$remote/$branch', [m]erge it, or [a]bort? (r/m/A):" "rma" "a"
+        gb_choice choice "[r]ebase onto '$remote/$target', [m]erge it, or [a]bort? (r/m/A):" "rma" "a"
         case "$choice" in
             r)
-                if ! git rebase --rebase-merges "refs/remotes/$remote/$branch"; then
+                if ! git rebase --rebase-merges "refs/remotes/$remote/$target"; then
                     print_error "Rebase stopped. Resolve the conflicts and run 'git rebase --continue', or 'git rebase --abort'."
                     return 1
                 fi
                 ;;
             m)
-                if ! git merge --no-edit "refs/remotes/$remote/$branch"; then
+                if ! git merge --no-edit "refs/remotes/$remote/$target"; then
                     print_error "Merge stopped. Resolve the conflicts and commit, or run 'git merge --abort'."
                     return 1
                 fi
@@ -532,12 +568,12 @@ gb_sync_and_push() {
         esac
     fi
 
-    print_info "Pushing '$branch' to '$remote'..."
-    if git push "${push_args[@]+"${push_args[@]}"}" "$remote" "$branch"; then
-        print_success "Pushed '$branch' to '$remote'."
+    print_info "Pushing '$branch' to '$where'..."
+    if git push "${push_args[@]+"${push_args[@]}"}" "$remote" "$refspec"; then
+        print_success "Pushed '$branch' to '$where'."
         return 0
     fi
-    print_error "Failed to push '$branch' to '$remote'."
+    print_error "Failed to push '$branch' to '$where'."
     return 1
 }
 

package/commands/branch.sh

@@ -30,60 +30,12 @@ Features:
   - Update: Update current branch with latest main/master
 
 Navigation:
-  ↑/↓ or j/k    Navigate through options
+  ↑/↓           Navigate through options (typing filters the list)
   Enter         Select action
   ESC/Ctrl-C    Abort
 
 Examples:
-  $ branch
-  Branch action >
-  > 🌿 Create - Create a new feature branch
-    🔀 Switch - Switch to another branch
-    ⬆️  Update - Update current branch with main/master
-    ✖ Abort
-
-  # Select "Create" and press Enter
-  Enter Jira link (e.g., https://jira.company.com/browse/PROJ-123):
-  > PROJ-123
-  Parsed issue number: PROJ-123
-
-  Enter branch title (will be converted to lowercase with dashes):
-  > add new feature
-
-  Branch name: feature/PROJ-123-add-new-feature
-  Updating 'main' from origin...
-  ✓ 'main' is up to date.
-  ✓ Successfully created and switched to branch: feature/PROJ-123-add-new-feature (from main)
-
-  ---
-
-  $ branch
-  Branch action >
-  > 🌿 Create - Create a new feature branch
-    🔀 Switch - Switch to another branch
-    ⬆️  Update - Update current branch with main/master
-    ✖ Abort
-
-  # Select "Switch" and press Enter
-  Select branch: 
-  Current: main
-  > local: main
-    local: feature/PROJ-123-add-new-feature
-    remote: origin/develop
-
-  ---
-
-  $ branch
-  Branch action >
-  > 🌿 Create - Create a new feature branch
-    🔀 Switch - Switch to another branch
-    ⬆️  Update - Update current branch with main/master
-    ✖ Abort
-
-  # Select "Update" and press Enter
-  Fetching latest 'main' from origin...
-  Merging updated 'main' into 'feature/PROJ-123-add-new-feature'...
-  ✓ 'feature/PROJ-123-add-new-feature' is now up-to-date with 'main'.
+  $ branch      # pick Create, Switch or Update, then continue as in that command
 
 Actions:
   🌿 Create - Create a new feature branch with Jira parsing
@@ -102,6 +54,12 @@ EOF
         return 0
     fi
 
+    if [[ $# -gt 0 ]]; then
+        print_error "Unknown argument: $1"
+        echo "Usage: branch [-h|--help]" >&2
+        return 1
+    fi
+
     # -----------------------------
     # 1. Check for fzf
     # -----------------------------

package/commands/cleanstash.sh

@@ -20,6 +20,7 @@ Delete git stashes without applying them.
 Interactive fuzzy finder (fzf) with preview and multi-select support.
 
 Options:
+  -y, --yes     Delete the selected stashes without asking again
   -h, --help    Show this help message
 
 Navigation:
@@ -40,6 +41,19 @@ EOF
         return 0
     fi
 
+    while [[ $# -gt 0 ]]; do
+        case "$1" in
+            -h|--help) cleanstash --help; return 0 ;;
+            -y|--yes) export GITBASH_ASSUME_YES=1 ;;
+            *)
+                print_error "Unknown argument: $1"
+                echo "Usage: cleanstash [-y|--yes]" >&2
+                return 1
+                ;;
+        esac
+        shift
+    done
+
     require_git_repo || return 1
 
     local stash_list

package/commands/cleanup.sh

@@ -45,7 +45,7 @@ Find and delete local branches that are no longer needed.
 Options:
   -h, --help       Show this help message
   --json           Output branch data as JSON (non-interactive)
-  --dry-run        List the branches that would be pre-selected, without deleting
+  -n, --dry-run    List the branches that would be pre-selected, without deleting
   --days=N         Override stale threshold (default: 7 days, configurable via GITBASH_CLEANUP_DAYS)
   -y, --yes        Delete the pre-selected branches without the picker (safe delete only)
 
@@ -88,12 +88,17 @@ EOF
         json_mode=true
         shift
         ;;
-      --dry-run)
+      -n|--dry-run)
         dry_run=true
         shift
         ;;
-      --days=*)
-        days_threshold="${1#--days=}"
+      --days=*|--days)
+        if [[ "$1" == --days ]]; then
+          days_threshold="${2:-}"
+          shift
+        else
+          days_threshold="${1#--days=}"
+        fi
         if ! [[ "$days_threshold" =~ ^[1-9][0-9]*$ ]]; then
           print_error "Invalid days value: $days_threshold"
           return 1
@@ -101,7 +106,7 @@ EOF
         shift
         ;;
       -y|--yes)
-        GITBASH_ASSUME_YES=1
+        export GITBASH_ASSUME_YES=1
         shift
         ;;
       *)

package/commands/commit.sh

@@ -83,7 +83,7 @@ EOF
         shift
         ;;
       -y|--yes)
-        GITBASH_ASSUME_YES=1
+        export GITBASH_ASSUME_YES=1
         shift
         ;;
       --force-with-lease)

package/commands/commits.sh

@@ -13,7 +13,7 @@ commits() {
     fi
     if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
         gb_help << 'EOF'
-Usage: commits [-a|--all] [COUNT]
+Usage: commits [-a|--all] [-y|--yes] [COUNT]
 
 List the commits made on the current branch with option to revert selected ones.
 
@@ -26,6 +26,7 @@ Arguments:
 
 Options:
   -a, --all     Show all recent commits reachable from HEAD
+  -y, --yes     Revert the selected commits without asking again
 
 Navigation:
   ↑/↓           Navigate through commits
@@ -59,6 +60,7 @@ EOF
     while [[ $# -gt 0 ]]; do
         case "$1" in
             -a|--all) all=true ;;
+            -y|--yes) export GITBASH_ASSUME_YES=1 ;;
             -*) print_error "Unknown option '$1'. See 'commits --help'."; return 1 ;;
             *)
                 if [[ -n "$count" ]]; then

package/commands/create.sh

@@ -63,8 +63,9 @@ Options:
   --bugfix         Use 'bugfix/' type
   --hotfix         Use 'hotfix/' type
   --release        Use 'release/' type
-  --push           Push the new branch to the remote (default: GITBASH_CREATE_AUTO_PUSH)
+  -p, --push       Push the new branch to the remote (default: GITBASH_CREATE_AUTO_PUSH)
   --no-push        Don't push the new branch
+  -y, --yes        Don't ask for confirmations (switches to an existing branch of the same name)
 
 Configuration (run 'gitbash --config'):
   - GITBASH_CREATE_BRANCH_PREFIX: Custom prefix between type and issue (default: "")
@@ -101,7 +102,8 @@ EOF
       --bugfix) branch_type="bugfix/"; shift ;;
       --hotfix) branch_type="hotfix/"; shift ;;
       --release) branch_type="release/"; shift ;;
-      --push) auto_push="yes"; shift ;;
+      -p|--push) auto_push="yes"; shift ;;
+      -y|--yes) export GITBASH_ASSUME_YES=1; shift ;;
       --no-push) auto_push="no"; shift ;;
       --)
         shift

package/commands/pr.sh

@@ -78,7 +78,7 @@ EOF
         shift
         ;;
       -y|--yes)
-        GITBASH_ASSUME_YES=1
+        export GITBASH_ASSUME_YES=1
         shift
         ;;
       *)

package/commands/stale.sh

@@ -84,8 +84,13 @@ EOF
                 my_mode=true
                 shift
                 ;;
-            --age=*)
-                stale_months="${1#--age=}"
+            --age=*|--age)
+                if [[ "$1" == --age ]]; then
+                    stale_months="${2:-}"
+                    shift
+                else
+                    stale_months="${1#--age=}"
+                fi
                 if ! [[ "$stale_months" =~ ^[1-9][0-9]*$ ]]; then
                     print_error "Invalid age value: $stale_months"
                     return 1
@@ -273,7 +278,8 @@ TOGGLE_EOF
 
     local failed=0 out
     for branch in "${branches_to_delete[@]}"; do
-        if out=$(git push "$remote" --delete "$branch" 2>&1); then
+        # A refspec, not a bare name: branch names come from the remote
+        if out=$(git push "$remote" ":refs/heads/$branch" 2>&1); then
             print_success "Deleted $remote/$branch"
         else
             print_error "Failed to delete $remote/$branch:"

package/commands/stash.sh

@@ -12,13 +12,14 @@ stash() {
     fi
     if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
         gb_help << 'EOF'
-Usage: stash [NAME...]
+Usage: stash [--] [NAME...]
 
 Create a git stash with a descriptive name.
 If no name is provided, prompts for one interactively.
 
 Options:
   -h, --help    Show this help message
+  --            Everything after this is the name (even if it starts with '-')
 
 Features:
   - Stashes all changes: staged, unstaged and untracked files
@@ -45,6 +46,20 @@ EOF
         return 0
     fi
 
+    local name_parts=()
+    while [[ $# -gt 0 ]]; do
+        case "$1" in
+            -h|--help) stash --help; return 0 ;;
+            --) shift; name_parts+=("$@"); break ;;
+            -*)
+                print_error "Unknown option: $1 (use 'stash -- $1' for a name starting with '-')"
+                return 1
+                ;;
+            *) name_parts+=("$1") ;;
+        esac
+        shift
+    done
+
     require_git_repo || return 1
 
     if ! git rev-parse --verify --quiet HEAD >/dev/null; then
@@ -58,8 +73,8 @@ EOF
     fi
 
     local stash_name
-    if [[ $# -gt 0 ]]; then
-        stash_name="$*"
+    if [[ ${#name_parts[@]} -gt 0 ]]; then
+        stash_name="${name_parts[*]}"
     else
         prompt_read "Stash name: " stash_name || true
         if [[ -z "$stash_name" ]]; then

package/commands/stashes.sh

@@ -29,60 +29,12 @@ Features:
   - Clean up: Delete stashes without applying them
 
 Navigation:
-  ↑/↓ or j/k    Navigate through options
+  ↑/↓           Navigate through options (typing filters the list)
   Enter         Select action
   ESC/Ctrl-C    Abort
 
 Examples:
-  $ stashes
-  Stash action >
-  > 💾 Stash - Create a new stash with a name
-    📦 Unstash - Apply and optionally drop a stash
-    🗑️  Clean up - Delete stashes without applying
-    ✖ Abort
-
-  # Select "Stash" and press Enter
-  Stash name: work in progress
-  ✓ Created stash: work in progress
-
-  ---
-
-  $ stashes
-  Stash action >
-  > 💾 Stash - Create a new stash with a name
-    📦 Unstash - Apply and optionally drop a stash
-    🗑️  Clean up - Delete stashes without applying
-    ✖ Abort
-
-  # Select "Unstash" and press Enter
-  Available stashes >
-  > stash@{0}: WIP on main: 1a2b3c4 commit message
-    stash@{1}: WIP on feature: 5d6e7f8 another commit
-    ✖ Abort
-
-  Applying stash@{0} ...
-  Drop stash@{0} now? (Y/n): y
-
-  ---
-
-  $ stashes
-  Stash action >
-  > 📦 Unstash - Apply and optionally drop a stash
-    🗑️  Clean up - Delete stashes without applying
-    ✖ Abort
-
-  # Select "Clean up" and press Enter
-  Available stashes >
-  > stash@{0}: WIP on main: 1a2b3c4 commit message
-    stash@{1}: WIP on feature: 5d6e7f8 another commit
-    ✖ Abort
-
-  # Use TAB to select multiple stashes
-  Selected stashes to delete:
-    - stash@{0}
-    - stash@{1}
-
-  Delete these 2 stash(es)? (y/N): y
+  $ stashes     # pick Stash, Unstash or Clean up, then continue as in that command
 
 Actions:
   💾 Stash       - Create a new stash with all changes
@@ -101,6 +53,12 @@ EOF
         return 0
     fi
 
+    if [[ $# -gt 0 ]]; then
+        print_error "Unknown argument: $1"
+        echo "Usage: stashes [-h|--help]" >&2
+        return 1
+    fi
+
     # -----------------------------
     # 1. Check for fzf
     # -----------------------------

package/commands/status.sh

@@ -74,6 +74,11 @@ Requirements:
 EOF
     return 0
   fi
+  if [[ $# -gt 0 ]]; then
+    print_error "Unknown argument: $1"
+    echo "Usage: status [-h|--help]" >&2
+    return 1
+  fi
 
   require_git_repo || return 1
   require_fzf || return 1

package/commands/switch.sh

@@ -139,6 +139,15 @@ EOF
       ;;
   esac
 
+  # Branch names never start with '-': anything like that is a mistyped option
+  local arg
+  for arg in "$@"; do
+    case "$arg" in
+      -h|--help) switch --help; return 0 ;;
+      -*) print_error "Unknown option: $arg"; echo "Usage: switch [FILTER...]" >&2; return 1 ;;
+    esac
+  done
+
   require_git_repo || return 1
   require_fzf || return 1
 

package/commands/unstash.sh

@@ -32,6 +32,7 @@ Apply a git stash to your working directory with optional removal.
 Interactive fuzzy finder (fzf) with preview support.
 
 Options:
+  -y, --yes     Don't ask for confirmations (drops the stash after applying it)
   -h, --help    Show this help message
 
 Workflow:
@@ -49,6 +50,19 @@ EOF
         return 0
     fi
 
+    while [[ $# -gt 0 ]]; do
+        case "$1" in
+            -h|--help) unstash --help; return 0 ;;
+            -y|--yes) export GITBASH_ASSUME_YES=1 ;;
+            *)
+                print_error "Unknown argument: $1"
+                echo "Usage: unstash [-y|--yes]" >&2
+                return 1
+                ;;
+        esac
+        shift
+    done
+
     require_git_repo || return 1
 
     local stash_list

package/commands/update.sh

@@ -57,7 +57,7 @@ EOF
         shift
         ;;
       -y|--yes)
-        GITBASH_ASSUME_YES=1
+        export GITBASH_ASSUME_YES=1
         shift
         ;;
       *)

package/docs/CONTRIBUTING.md

@@ -78,8 +78,8 @@ We use [Changesets](https://github.com/changesets/changesets) to manage versions
 
 ```bash
 # 1. Create your feature branch
-./bin/gitbash create
-# Select "feature", enter "NOISSUE" or issue number, add description
+./bin/gitbash create -t
+# Pick the type (feature/bugfix), enter the issue number or press Enter for NOISSUE, then a title
 
 # 2. Make your changes
 vim commands/stale.sh
@@ -98,13 +98,14 @@ npm run changeset
 
 ### What happens to changesets:
 
-When your PR is merged:
-1. The changeset file is included in the main branch
-2. When ready for release, maintainers run `npm run version`
-3. Changesets are consumed and version is bumped
-4. CHANGELOG.md is automatically updated
-5. Changes are published with `npm run release`
-6. Pushing the `vX.Y.Z` tag triggers the Release workflow, which creates the GitHub release with that version's CHANGELOG.md section as its notes (re-run it for an existing tag via "Run workflow")
+Releases run only in GitHub Actions ([release.yml](../.github/workflows/release.yml)), never from a laptop:
+
+1. When your PR is merged, its changeset lands on `main`.
+2. The Release workflow runs CI, then opens (or updates) the **`chore: release vX.Y.Z`** pull request: `changeset version` bumps `package.json` and adds the CHANGELOG.md section. More merged changesets are added to the same pull request.
+3. On the release pull request, approve its CI run ("Approve workflows to run"): runs for pull requests opened by GitHub Actions wait for a maintainer. Merging it **stages** the version on npm with [trusted publishing](https://docs.npmjs.com/trusted-publishers) (no npm token, with provenance) and creates a draft GitHub release (no tag yet, not visible to `gitbash --update`).
+4. A maintainer reviews and approves the staged version on npmjs.com or with `npm stage approve` ([staged publishing](https://docs.npmjs.com/staged-publishing/), needs 2FA; the workflow cannot approve).
+5. Within 15 minutes a scheduled run sees the version live on npm and publishes the GitHub release, which creates the `vX.Y.Z` tag. To do it right away: `gh workflow run release.yml`.
+6. If a run fails, re-run it: finished steps are skipped. To re-stage a rejected version, delete its draft release and re-run.
 
 ## Development Guidelines
 

package/docs/SECURITY.md

@@ -6,10 +6,10 @@ The following versions of this project are currently receiving security updates:
 
 | Version | Supported |
 |--------|-----------|
-| 2.x.x  | ✅        |
-| < 2.0  | ❌        |
+| 3.x.x  | ✅        |
+| < 3.0  | ❌        |
 
-Security fixes are only applied to the latest minor/patch release of the **2.x.x** series. Older versions must be upgraded to receive patches.
+Security fixes are only applied to the latest minor/patch release of the **3.x.x** series. Older versions must be upgraded to receive patches.
 
 Versions before 2.0 executed repository `.gitbashrc` files as shell code, so opening a cloned repository with a malicious `.gitbashrc` could run arbitrary commands. Upgrade to 2.0 or later.
 
@@ -19,11 +19,21 @@ Versions before 2.0 executed repository `.gitbashrc` files as shell code, so ope
 
 - Configuration files (`~/.gitbashrc`, a repository's `.gitbashrc` and `.gitbashrc-user`) are **parsed, never executed**. Only plain `GITBASH_*="value"` lines from a fixed list of settings are read; values containing `$`, backticks, backslashes or quotes are rejected.
 - A repository's committed `.gitbashrc` is treated as untrusted: it cannot set `GITBASH_MERGE_COMMAND` (the only setting that names a program to run). That setting is only read from `~/.gitbashrc` and `.gitbashrc-user`.
+- Settings that reach git as arguments are validated: `GITBASH_BASE_BRANCH` (and a base branch taken from the remote's `HEAD`) must be a valid branch name that does not start with `-`, and `GITBASH_REMOTE` must not start with `-`. Before 3.0.0, a committed `.gitbashrc` could set `GITBASH_BASE_BRANCH="--output=<file>"` and make `switch` or `cleanup` overwrite that file.
 - `gitbash --init` prints wrapper functions that call the installed `gitbash` binary; command code is not sourced into your shell.
 - `pr` and `repo` never pass credentials from the remote URL to the browser.
 
 ---
 
+## Releases
+
+- Releases are staged only by the Release workflow in GitHub Actions, with npm trusted publishing (OIDC, no long-lived npm token) and [provenance](https://docs.npmjs.com/generating-provenance-statements). A version goes live only after a maintainer approves it with 2FA ([staged publishing](https://docs.npmjs.com/staged-publishing/)); neither the workflow nor a leaked GitHub token can publish on its own. Check an installed copy with `npm audit signatures`.
+- The install script (`install.sh`, also used by `gitbash --update` for script installs) downloads that same npm package and installs it only if it matches the sha512 checksum npm records for the version, so a moved git tag cannot change what gets installed.
+- The npm package is published before the GitHub release, which `gitbash --update` and the install script use.
+- Third-party actions are pinned to commit SHAs and kept up to date by Dependabot; each workflow job gets only the permissions it needs.
+
+---
+
 ## Reporting a Vulnerability
 
 We take security vulnerabilities seriously and appreciate your efforts to responsibly disclose them.

package/docs/workflows.md

@@ -10,7 +10,7 @@ Gitbash reduces repetitive typing and provides interactive previews and safe cle
 | Checkout base branch                                                                                   | `switch main`                                                   | `git switch main`                                                                                                                               |
 | Create feature branch (from latest main)                                                               | `create PROJ-123 add login`                                     | `git switch -c feature/PROJ-123-add-login main`<br>`git push -u origin feature/PROJ-123-add-login`                                              |
 | Create a stash (WIP)                                                                                   | `stash "WIP PROJ-123 implement login"`                          | `git stash push -u -m "WIP PROJ-123 implement login"`                                                                                           |
-| Create + switch to another branch (ensure main up-to-date)                                             | `create OTHER-456 fix typo`                                     | `git switch main`<br>`git pull origin main`<br>`git switch -c bugfix/OTHER-456-fix-typo main`<br>`git push -u origin bugfix/OTHER-456-fix-typo` |
+| Create + switch to another branch (ensure main up-to-date)                                             | `create --bugfix OTHER-456 fix typo`                            | `git switch main`<br>`git pull origin main`<br>`git switch -c bugfix/OTHER-456-fix-typo main`<br>`git push -u origin bugfix/OTHER-456-fix-typo` |
 | Implement changes on other branch, commit & push                                                       | `commit -p "fix(OTHER-456): fix typo"`                          | `git add -A`<br>`git commit -m "fix(OTHER-456): fix typo"`<br>`git push -u origin bugfix/OTHER-456-fix-typo`                                    |
 | Switch back to original Jira branch                                                                    | `switch PROJ-123`                                               | `git switch feature/PROJ-123-add-login`                                                                                                         |
 | Verify main was up-to-date at creation time<br>Update feature branch by merging current `main` into it | `update`                                                        | `git fetch origin`<br>`git log --oneline HEAD..origin/main`<br>`git pull origin main` (run while on feature branch)                             |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitbash",
-  "version": "2.2.2",
+  "version": "3.0.1",
   "description": "Opinionated git utilities for bash with fzf-powered menus",
   "author": "jaggli",
   "license": "MIT",
@@ -38,14 +38,17 @@
     "linux",
     "win32"
   ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
   "engines": {
     "node": ">=14"
   },
   "scripts": {
     "test": "bats test",
     "changeset": "changeset",
-    "version": "changeset version",
-    "release": "scripts/release.sh"
+    "version": "changeset version"
   },
   "devDependencies": {
     "@changesets/cli": "^2.29.8",