guardian-framework 0.1.0

package/templates/pi/scripts/languages/typescript/validate-operations.sh

@@ -0,0 +1,162 @@
+#!/usr/bin/env bash
+# ============================================================================
+# validate-operations.sh — TypeScript
+# ============================================================================
+set -euo pipefail
+
+PASS_COUNT=0; ERRORS=(); WARNINGS=()
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
+pass() { echo -e "${GREEN}✅ PASS${NC} $1"; PASS_COUNT=$((PASS_COUNT + 1)); }
+fail() { echo -e "${RED}❌ FAIL${NC} $1"; ERRORS+=("$1"); }
+warn() { echo -e "${YELLOW}⚠️  WARN${NC} $1"; WARNINGS+=("$1"); }
+
+echo "============================================"
+echo "  Operations Validation (TypeScript)"
+echo "============================================"
+echo ""
+
+SRC_DIR="${1:-src}"
+
+# ---------------------------------------------------------------------------
+# Structured Logging
+# ---------------------------------------------------------------------------
+echo "--- Structured Logging ---"
+LOGGING_LIBS=0
+if [ -d "$SRC_DIR" ] || [ -d "." ]; then
+    SEARCH_DIRS=""
+    if [ -d "$SRC_DIR" ]; then
+        SEARCH_DIRS="$SRC_DIR"
+    fi
+    SEARCH_DIRS="${SEARCH_DIRS} ${SEARCH_DIRS:+.}"
+
+    for dir in $SEARCH_DIRS; do
+        [ -d "$dir" ] || continue
+        FOUND=$(find "$dir" -type f \( -name "*.ts" -o -name "*.tsx" \) -not -path "*/node_modules/*" \
+            -exec grep -lE "(winston|pino|bunyan|console\.(log|info|warn|error))" {} + 2>/dev/null | wc -l | tr -d ' ')
+        LOGGING_LIBS=$((LOGGING_LIBS + FOUND))
+    done
+    if [ "$LOGGING_LIBS" -gt 0 ]; then
+        pass "Structured logging detected ($LOGGING_LIBS files)"
+    else
+        warn "No structured logging or console.log patterns found"
+    fi
+else
+    warn "No source directory found, skipping logging check"
+fi
+
+# ---------------------------------------------------------------------------
+# Health Checks
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Health Checks ---"
+HEALTH_ROUTES=0
+if [ -d "$SRC_DIR" ]; then
+    HEALTH_ROUTES=$(find "$SRC_DIR" -type f \( -name "*.ts" -o -name "*.tsx" \) -not -path "*/node_modules/*" \
+        -exec grep -lE "(/health[^/]?|/healthz|/ready|/readiness)" {} + 2>/dev/null | wc -l | tr -d ' ')
+    if [ "$HEALTH_ROUTES" -gt 0 ]; then
+        pass "Health check endpoints found ($HEALTH_ROUTES files)"
+    else
+        warn "No health check endpoints detected (/health, /healthz, /ready)"
+    fi
+else
+    warn "No source directory found, skipping health check check"
+fi
+
+# ---------------------------------------------------------------------------
+# Graceful Shutdown
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Graceful Shutdown ---"
+SHUTDOWN_HANDLERS=0
+if [ -d "$SRC_DIR" ]; then
+    SHUTDOWN_HANDLERS=$(find "$SRC_DIR" -type f \( -name "*.ts" -o -name "*.tsx" \) -not -path "*/node_modules/*" \
+        -exec grep -lE "process\.on\(['\"]SIG(TERM|INT)['\"]" {} + 2>/dev/null | wc -l | tr -d ' ')
+    if [ "$SHUTDOWN_HANDLERS" -gt 0 ]; then
+        pass "Graceful shutdown handlers found ($SHUTDOWN_HANDLERS files)"
+    else
+        warn "No SIGTERM/SIGINT handlers detected"
+    fi
+else
+    warn "No source directory found, skipping shutdown check"
+fi
+
+# ---------------------------------------------------------------------------
+# Metrics
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Metrics ---"
+METRICS_LIBS=0
+if [ -d "$SRC_DIR" ]; then
+    METRICS_LIBS=$(find "$SRC_DIR" -type f \( -name "*.ts" -o -name "*.tsx" \) -not -path "*/node_modules/*" \
+        -exec grep -lE "(prom-client|@opentelemetry|statsd|hot-shots|dd-trace)" {} + 2>/dev/null | wc -l | tr -d ' ')
+    if [ "$METRICS_LIBS" -gt 0 ]; then
+        pass "Metrics/observability libraries detected ($METRICS_LIBS files)"
+    else
+        warn "No metrics libraries (prom-client, OpenTelemetry, statsd) detected"
+    fi
+else
+    warn "No source directory found, skipping metrics check"
+fi
+
+# ---------------------------------------------------------------------------
+# Error Handling
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Error Handling ---"
+ERROR_PATTERNS=0
+if [ -d "$SRC_DIR" ]; then
+    # Check for try/catch blocks
+    TRY_CATCH=$(find "$SRC_DIR" -type f \( -name "*.ts" -o -name "*.tsx" \) -not -path "*/node_modules/*" \
+        -exec grep -lE "try\s*\{" {} + 2>/dev/null | wc -l | tr -d ' ')
+    # Check for error middleware (Express-style)
+    ERROR_MIDDLEWARE=$(find "$SRC_DIR" -type f \( -name "*.ts" -o -name "*.tsx" \) -not -path "*/node_modules/*" \
+        -exec grep -lE "error.*:.*Error.*req.*res" {} + 2>/dev/null | wc -l | tr -d ' ')
+    ERROR_PATTERNS=$((TRY_CATCH + ERROR_MIDDLEWARE))
+    if [ "$ERROR_PATTERNS" -gt 0 ]; then
+        pass "Error handling patterns found ($ERROR_PATTERNS files with try/catch or error middleware)"
+    else
+        warn "No error handling patterns detected"
+    fi
+else
+    warn "No source directory found, skipping error handling check"
+fi
+
+# ---------------------------------------------------------------------------
+# Configuration
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Configuration ---"
+CONFIG_FOUND=0
+if [ -d "$SRC_DIR" ]; then
+    CONFIG_FOUND=$(find "$SRC_DIR" -type f \( -name "*.ts" -o -name "*.tsx" \) -not -path "*/node_modules/*" \
+        -exec grep -lE "(dotenv|require\(['\"]config['\"]\)|process\.env)" {} + 2>/dev/null | wc -l | tr -d ' ')
+    if [ "$CONFIG_FOUND" -gt 0 ]; then
+        pass "Configuration management detected ($CONFIG_FOUND files with dotenv/config/process.env)"
+    else
+        warn "No configuration management patterns detected (dotenv, config, process.env)"
+    fi
+else
+    warn "No source directory found, skipping configuration check"
+fi
+
+# ---------------------------------------------------------------------------
+# Summary
+# ---------------------------------------------------------------------------
+echo ""
+echo "============================================"
+echo "  Summary"
+echo "============================================"
+echo -e "  Passed:   ${GREEN}${PASS_COUNT}${NC}"
+echo -e "  Failed:   ${RED}${#ERRORS[@]}${NC}"
+echo ""
+
+if [ ${#ERRORS[@]} -gt 0 ]; then
+    echo "FAILURES:"
+    for err in "${ERRORS[@]}"; do
+        echo "  - $err"
+    done
+    exit 1
+fi
+
+echo -e "${GREEN}Operations validation passed.${NC}"
+exit 0

package/templates/pi/scripts/languages/typescript/validate-security.sh

@@ -0,0 +1,169 @@
+#!/usr/bin/env bash
+# ============================================================================
+# validate-security.sh — TypeScript
+# ============================================================================
+set -euo pipefail
+
+PASS_COUNT=0; ERRORS=(); WARNINGS=()
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
+pass() { echo -e "${GREEN}✅ PASS${NC} $1"; PASS_COUNT=$((PASS_COUNT + 1)); }
+fail() { echo -e "${RED}❌ FAIL${NC} $1"; ERRORS+=("$1"); }
+warn() { echo -e "${YELLOW}⚠️  WARN${NC} $1"; WARNINGS+=("$1"); }
+
+echo "============================================"
+echo "  Security Validation (TypeScript)"
+echo "============================================"
+echo ""
+
+# Detect package manager
+PKG_MGR=""
+if [ -f "bun.lock" ] || [ -f "bun.lockb" ]; then
+    PKG_MGR="bun"
+elif [ -f "yarn.lock" ]; then
+    PKG_MGR="yarn"
+elif [ -f "package-lock.json" ]; then
+    PKG_MGR="npm"
+fi
+
+# ---------------------------------------------------------------------------
+# Hardcoded Secrets
+# ---------------------------------------------------------------------------
+echo "--- Hardcoded Secrets ---"
+SECRET_COUNT=0
+for ext in ts tsx; do
+    COUNT=$(find . -name "*.$ext" -not -path "./node_modules/*" -not -path "./.next/*" -not -path "./dist/*" \
+        -exec grep -E "(apiKey|api_key|apiKey|secret|password|token|privateKey)\s*[:=]\s*['\"][^'\"]{8,}['\"]" {} + 2>/dev/null | wc -l | tr -d ' ')
+    SECRET_COUNT=$((SECRET_COUNT + COUNT))
+done
+if [ "$SECRET_COUNT" -eq 0 ]; then
+    pass "No hardcoded secrets detected"
+else
+    fail "Potential hardcoded secrets found ($SECRET_COUNT occurrences)"
+fi
+
+# ---------------------------------------------------------------------------
+# SQL/NoSQL Injection
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- SQL/NoSQL Injection ---"
+INJECTION_PATTERNS=0
+for ext in ts tsx; do
+    # Template literals used with query/exec calls
+    COUNT=$(find . -name "*.$ext" -not -path "./node_modules/*" -not -path "./.next/*" -not -path "./dist/*" \
+        -exec grep -E "\.(query|exec)\(\s*\`" {} + 2>/dev/null | wc -l | tr -d ' ')
+    INJECTION_PATTERNS=$((INJECTION_PATTERNS + COUNT))
+done
+if [ "$INJECTION_PATTERNS" -eq 0 ]; then
+    pass "No SQL/NoSQL injection patterns detected"
+else
+    warn "Potential injection patterns found ($INJECTION_PATTERNS template literal queries — review manually)"
+fi
+
+# ---------------------------------------------------------------------------
+# Dependency Audit
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Dependency Audit ---"
+if [ "$PKG_MGR" = "bun" ] && command -v bun &>/dev/null; then
+    AUDIT_OUT=$(bun audit 2>&1 || true)
+    CRITICAL=$(echo "$AUDIT_OUT" | grep -ci "critical" 2>/dev/null || echo "0")
+    HIGH=$(echo "$AUDIT_OUT" | grep -ci "high" 2>/dev/null || echo "0")
+    if [ "$CRITICAL" -gt 0 ] || [ "$HIGH" -gt 0 ]; then
+        fail "Dependency audit found critical/high vulnerabilities"
+    else
+        pass "No critical/high vulnerabilities in dependencies"
+    fi
+elif command -v npm &>/dev/null; then
+    AUDIT_OUT=$(npm audit 2>&1 || true)
+    if echo "$AUDIT_OUT" | grep -q "found 0 vulnerabilities" 2>/dev/null; then
+        pass "No vulnerabilities in dependencies"
+    else
+        CRITICAL_HIGH=$(echo "$AUDIT_OUT" | grep -iE "(critical|high).*vulnerab" 2>/dev/null | head -1 || true)
+        if [ -n "$CRITICAL_HIGH" ]; then
+            fail "Dependency audit found critical/high vulnerabilities"
+        else
+            pass "No critical/high vulnerabilities in dependencies"
+        fi
+    fi
+else
+    warn "No package manager available for dependency audit"
+fi
+
+# ---------------------------------------------------------------------------
+# eval / Dangerous Patterns
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- eval / Dangerous Patterns ---"
+DANGEROUS_COUNT=0
+for ext in ts tsx; do
+    COUNT=$(find . -name "*.$ext" -not -path "./node_modules/*" -not -path "./.next/*" -not -path "./dist/*" \
+        -exec grep -E "(eval\(|innerHTML\s*=|dangerouslySetInnerHTML)" {} + 2>/dev/null | wc -l | tr -d ' ')
+    DANGEROUS_COUNT=$((DANGEROUS_COUNT + COUNT))
+done
+if [ "$DANGEROUS_COUNT" -eq 0 ]; then
+    pass "No dangerous patterns (eval/innerHTML/dangerouslySetInnerHTML) found"
+else
+    warn "Dangerous patterns detected ($DANGEROUS_COUNT occurrences — review for XSS risk)"
+fi
+
+# ---------------------------------------------------------------------------
+# XSS Prevention
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- XSS Prevention ---"
+SANITIZE_LIBS=0
+for ext in ts tsx; do
+    COUNT=$(find . -name "*.$ext" -not -path "./node_modules/*" -not -path "./.next/*" -not -path "./dist/*" \
+        -exec grep -lE "(DOMPurify|sanitize-html|xss|sanitize)" {} + 2>/dev/null | wc -l | tr -d ' ')
+    SANITIZE_LIBS=$((SANITIZE_LIBS + COUNT))
+done
+if [ "$SANITIZE_LIBS" -gt 0 ]; then
+    pass "Sanitization libraries detected ($SANITIZE_LIBS files)"
+else
+    # Only warn if there are TSX files (likely has JSX/DOM rendering)
+    TSX_COUNT=$(find . -name "*.tsx" -not -path "./node_modules/*" -not -path "./.next/*" -not -path "./dist/*" 2>/dev/null | wc -l | tr -d ' ')
+    if [ "$TSX_COUNT" -gt 0 ]; then
+        warn "No sanitization library found in TSX files (consider DOMPurify or sanitize-html)"
+    else
+        pass "No TSX files, sanitization not applicable"
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# HTTPS Enforcement
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- HTTPS Enforcement ---"
+HTTP_ONLY=0
+for ext in ts tsx; do
+    COUNT=$(find . -name "*.$ext" -not -path "./node_modules/*" -not -path "./.next/*" -not -path "./dist/*" \
+        -exec grep -E "['\"]http://(?!localhost)" {} + 2>/dev/null | grep -ivE "(test|spec|mock|example|dev)" | wc -l | tr -d ' ')
+    HTTP_ONLY=$((HTTP_ONLY + COUNT))
+done
+if [ "$HTTP_ONLY" -eq 0 ]; then
+    pass "No hardcoded HTTP URLs (non-localhost) found"
+else
+    warn "Hardcoded HTTP URLs detected ($HTTP_ONLY occurrences — use HTTPS for production)"
+fi
+
+# ---------------------------------------------------------------------------
+# Summary
+# ---------------------------------------------------------------------------
+echo ""
+echo "============================================"
+echo "  Summary"
+echo "============================================"
+echo -e "  Passed:   ${GREEN}${PASS_COUNT}${NC}"
+echo -e "  Failed:   ${RED}${#ERRORS[@]}${NC}"
+echo ""
+
+if [ ${#ERRORS[@]} -gt 0 ]; then
+    echo "FAILURES:"
+    for err in "${ERRORS[@]}"; do
+        echo "  - $err"
+    done
+    exit 1
+fi
+
+echo -e "${GREEN}Security validation passed.${NC}"
+exit 0

package/templates/pi/scripts/languages/typescript/validate-tests.sh

@@ -0,0 +1,158 @@
+#!/usr/bin/env bash
+# ============================================================================
+# validate-tests.sh — TypeScript
+# ============================================================================
+set -euo pipefail
+
+PASS_COUNT=0; ERRORS=(); WARNINGS=()
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
+pass() { echo -e "${GREEN}✅ PASS${NC} $1"; PASS_COUNT=$((PASS_COUNT + 1)); }
+fail() { echo -e "${RED}❌ FAIL${NC} $1"; ERRORS+=("$1"); }
+warn() { echo -e "${YELLOW}⚠️  WARN${NC} $1"; WARNINGS+=("$1"); }
+
+echo "============================================"
+echo "  Test Validation (TypeScript)"
+echo "============================================"
+echo ""
+
+# Detect package manager
+PKG_MGR=""
+if [ -f "bun.lock" ] || [ -f "bun.lockb" ]; then
+    PKG_MGR="bun"
+elif [ -f "yarn.lock" ]; then
+    PKG_MGR="yarn"
+elif [ -f "package-lock.json" ]; then
+    PKG_MGR="npm"
+fi
+
+# ---------------------------------------------------------------------------
+# Unit Tests
+# ---------------------------------------------------------------------------
+echo "--- Unit Tests ---"
+if [ -d "tests/unit" ] || [ -d "test/unit" ]; then
+    UNIT_DIR=""
+    if [ -d "tests/unit" ]; then
+        UNIT_DIR="tests/unit"
+    elif [ -d "test/unit" ]; then
+        UNIT_DIR="test/unit"
+    fi
+
+    if [ "$PKG_MGR" = "bun" ] && command -v bun &>/dev/null; then
+        if bun test "$UNIT_DIR" 2>/dev/null; then
+            pass "Unit tests passed (bun test)"
+        else
+            fail "Unit tests failed (bun test)"
+        fi
+    elif command -v npx &>/dev/null; then
+        if npx vitest run "$UNIT_DIR" 2>/dev/null; then
+            pass "Unit tests passed (npx vitest)"
+        elif npx jest "$UNIT_DIR" 2>/dev/null; then
+            pass "Unit tests passed (npx jest)"
+        else
+            fail "Unit tests failed"
+        fi
+    else
+        warn "No test runner available for unit tests"
+    fi
+else
+    pass "No unit test directory (skipped)"
+fi
+
+# ---------------------------------------------------------------------------
+# Integration Tests
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Integration Tests ---"
+if [ -d "tests/integration" ] || [ -d "test/integration" ]; then
+    INT_DIR=""
+    if [ -d "tests/integration" ]; then
+        INT_DIR="tests/integration"
+    elif [ -d "test/integration" ]; then
+        INT_DIR="test/integration"
+    fi
+
+    if [ "$PKG_MGR" = "bun" ] && command -v bun &>/dev/null; then
+        if bun test "$INT_DIR" 2>/dev/null; then
+            pass "Integration tests passed (bun test)"
+        else
+            fail "Integration tests failed (bun test)"
+        fi
+    elif command -v npx &>/dev/null; then
+        if npx vitest run "$INT_DIR" 2>/dev/null; then
+            pass "Integration tests passed (npx vitest)"
+        elif npx jest "$INT_DIR" 2>/dev/null; then
+            pass "Integration tests passed (npx jest)"
+        else
+            fail "Integration tests failed"
+        fi
+    else
+        warn "No test runner available for integration tests"
+    fi
+else
+    pass "No integration test directory (skipped)"
+fi
+
+# ---------------------------------------------------------------------------
+# Coverage
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Coverage ---"
+if command -v npx &>/dev/null; then
+    COVERAGE_OUTPUT=""
+    # Try vitest first
+    if npx vitest run --coverage 2>&1 | tee /tmp/ts_coverage_output >/dev/null; then
+        COVERAGE_OUTPUT=$(cat /tmp/ts_coverage_output)
+    fi
+    # If vitest didn't produce output, try jest
+    if [ -z "$COVERAGE_OUTPUT" ]; then
+        npx jest --coverage 2>&1 | tee /tmp/ts_coverage_output >/dev/null || true
+        COVERAGE_OUTPUT=$(cat /tmp/ts_coverage_output)
+    fi
+
+    if [ -n "$COVERAGE_OUTPUT" ]; then
+        # Extract percentage — vitest and jest report differently
+        COVERAGE_PCT=$(echo "$COVERAGE_OUTPUT" | grep -iE "(statements|all files).*[0-9]+(\.[0-9]+)?%" | grep -oE '[0-9]+(\.[0-9]+)?%' | head -1 | tr -d '%' || echo "")
+        if [ -z "$COVERAGE_PCT" ]; then
+            # Fallback: look for any percentage on a TOTAL or All lines
+            COVERAGE_PCT=$(echo "$COVERAGE_OUTPUT" | grep -iE "(total|all).*[0-9]+(\.[0-9]+)?%" | grep -oE '[0-9]+(\.[0-9]+)?%' | head -1 | tr -d '%' || echo "")
+        fi
+        if [ -n "$COVERAGE_PCT" ]; then
+            # Compare against 80% threshold
+            COVERAGE_INT=$(echo "$COVERAGE_PCT" | cut -d'.' -f1)
+            if [ "${COVERAGE_INT:-0}" -ge 80 ]; then
+                pass "Coverage: ${COVERAGE_PCT}% (≥ 80%)"
+            else
+                fail "Coverage: ${COVERAGE_PCT}% (< 80%)"
+            fi
+        else
+            warn "Coverage output parsed but percentage not detected"
+        fi
+    else
+        warn "No coverage tool produced output"
+    fi
+    rm -f /tmp/ts_coverage_output
+else
+    warn "npx not available, skipping coverage"
+fi
+
+# ---------------------------------------------------------------------------
+# Summary
+# ---------------------------------------------------------------------------
+echo ""
+echo "============================================"
+echo "  Summary"
+echo "============================================"
+echo -e "  Passed:   ${GREEN}${PASS_COUNT}${NC}"
+echo -e "  Failed:   ${RED}${#ERRORS[@]}${NC}"
+echo ""
+
+if [ ${#ERRORS[@]} -gt 0 ]; then
+    echo "FAILURES:"
+    for err in "${ERRORS[@]}"; do
+        echo "  - $err"
+    done
+    exit 1
+fi
+
+echo -e "${GREEN}Test validation passed.${NC}"
+exit 0

package/templates/pi/scripts/merge-mr.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+# Merge Merge Request / Pull Request
+#
+# Merges the current PR via GitHub CLI when CI checks pass.
+#
+# Usage: bash .pi/scripts/merge-mr.sh --issue-id "issue-github-gitlab-connector"
+
+set -euo pipefail
+
+detect_platform() {
+    # First: check guardian-manifest.json for repoTool
+    if [ -f "guardian-manifest.json" ]; then
+        local tool=$(jq -r '.repoTool // ""' guardian-manifest.json 2>/dev/null || echo "")
+        if [[ "$tool" == "glab" ]]; then echo "gitlab"; return; fi
+        if [[ "$tool" == "gh" ]]; then echo "github"; return; fi
+    fi
+    # Fallback: check environment or installed CLIs
+    if [[ -n "${GIT_PLATFORM:-}" ]]; then
+        echo "$GIT_PLATFORM"
+    elif command -v gh &>/dev/null && gh auth status &>/dev/null 2>&1; then
+        echo "github"
+    elif command -v glab &>/dev/null && glab auth status &>/dev/null 2>&1; then
+        echo "gitlab"
+    else
+        echo "none"
+    fi
+}
+
+ISSUE_ID=""
+
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --issue-id) ISSUE_ID="$2"; shift 2 ;;
+        *) shift ;;
+    esac
+done
+
+PLATFORM=$(detect_platform)
+BRANCH_NAME="feature/${ISSUE_ID}"
+
+if [[ "$PLATFORM" == "none" ]]; then
+    echo "No git platform detected. Cannot merge without gh/glab CLI."
+    echo "Merge skipped — local only."
+    exit 0
+fi
+
+case "$PLATFORM" in
+    github)
+        # Find the PR for this branch
+        PR_NUMBER=$(gh pr list --head "$BRANCH_NAME" --json number -q '.[0].number' 2>/dev/null || echo "")
+
+        if [[ -z "$PR_NUMBER" ]]; then
+            echo "No PR found for branch $BRANCH_NAME"
+            exit 0
+        fi
+
+        # Check PR mergeability
+        PR_STATE=$(gh pr view "$PR_NUMBER" --json state -q '.state' 2>/dev/null || echo "unknown")
+        if [[ "$PR_STATE" == "MERGED" ]]; then
+            echo "PR #$PR_NUMBER already merged"
+            exit 0
+        fi
+
+        if [[ "$PR_STATE" == "CLOSED" ]]; then
+            echo "PR #$PR_NUMBER is closed"
+            exit 0
+        fi
+
+        # Attempt merge with squash
+        MERGE_RESULT=$(gh pr merge "$PR_NUMBER" --squash --delete-branch 2>&1) || MERGE_RESULT=""
+
+        if [[ -n "$MERGE_RESULT" ]]; then
+            echo "Merged PR #$PR_NUMBER: $MERGE_RESULT"
+            # Switch back to main branch
+            git checkout main 2>/dev/null || git checkout master 2>/dev/null || true
+            git pull origin main 2>/dev/null || git pull origin master 2>/dev/null || true
+        else
+            echo "Merge failed for PR #$PR_NUMBER" >&2
+            exit 1
+        fi
+        ;;
+
+    gitlab)
+        MR_IID=$(glab mr list --source-branch "$BRANCH_NAME" --json iid -q '.[0].iid' 2>/dev/null || echo "")
+
+        if [[ -z "$MR_IID" ]]; then
+            echo "No MR found for branch $BRANCH_NAME"
+            exit 0
+        fi
+
+        glab mr merge "$MR_IID" --when-pipeline-succeeds 2>&1 || true
+        git checkout main 2>/dev/null || git checkout master 2>/dev/null || true
+        git pull origin main 2>/dev/null || git pull origin master 2>/dev/null || true
+        ;;
+esac