patchrelay 0.41.7 → 0.42.0

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
   "service": "patchrelay",
-  "version": "0.41.7",
-  "commit": "604350d6627f",
-  "builtAt": "2026-04-13T18:24:22.746Z"
+  "version": "0.42.0",
+  "commit": "ad4fbfa6efc4",
+  "builtAt": "2026-04-14T14:44:46.179Z"
 }

package/dist/hook-runner.js

@@ -8,7 +8,7 @@ export async function runProjectHook(repoPath, hookName, options) {
     }
     const result = await execCommand(hookPath, [], {
         cwd: options.cwd,
-        env: { ...process.env, ...(options.env ?? {}) },
+        env: { ...sanitizedParentEnv(), ...(options.env ?? {}) },
         timeoutMs: options.timeoutMs ?? 120_000,
     });
     return {
@@ -18,6 +18,23 @@ export async function runProjectHook(repoPath, hookName, options) {
         stderr: result.stderr,
     };
 }
+// Patchrelay runs as a service with NODE_ENV=production, which makes `npm ci`
+// in a project hook silently omit devDependencies. The subject project's install
+// surface is a separate concern from patchrelay's own runtime, so scrub the
+// variables that would leak patchrelay's production posture into the hook.
+const STRIPPED_PARENT_ENV_VARS = [
+    "NODE_ENV",
+    "NPM_CONFIG_PRODUCTION",
+    "NPM_CONFIG_OMIT",
+    "NPM_CONFIG_INCLUDE",
+];
+function sanitizedParentEnv() {
+    const env = { ...process.env };
+    for (const key of STRIPPED_PARENT_ENV_VARS) {
+        delete env[key];
+    }
+    return env;
+}
 export function buildHookEnv(issueKey, branchName, stage, worktreePath) {
     return {
         PATCHRELAY_ISSUE_KEY: issueKey,

package/dist/prompting/patchrelay.js

@@ -356,6 +356,22 @@ function buildPublicationContract(runType) {
             "If the worktree already contains relevant changes for this issue, verify them and publish them.",
             "If you changed files for this issue, commit them, push the issue branch, and open or update the PR before stopping.",
             "Do not stop with only local commits or uncommitted changes.",
+            "",
+            "## PR Body Contract",
+            "",
+            "When you open or update a PR, shape the body so a strict reviewer can decide in one pass.",
+            "",
+            "Title: imperative, ≤72 chars. Do not prefix with the issue key — the branch carries it.",
+            "",
+            "Body sections, in this order. Omit any that do not apply but keep the order:",
+            "",
+            "  ## Why — 1-3 sentences on the problem and motivation.",
+            "  ## What — ≤5 bullets naming the files or surfaces that change.",
+            "  ## Tradeoffs — one explicit tradeoff taken, or the single word \"None\".",
+            "  ## Risks — 1-3 things a strict reviewer would ask about. For each, either fix it before committing or explain why it is acceptable. This section is load-bearing; a strict reviewer reads it first.",
+            "",
+            "Do not restate the diff in prose. Quote the ambiguous fragment directly if the reader needs to see it.",
+            "Do not add a \"Verification\" or \"I ran these commands\" section; CI owns pass/fail and posts check runs the reviewer already sees.",
         ].join("\n");
     }
     return [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchrelay",
-  "version": "0.41.7",
+  "version": "0.42.0",
   "license": "MIT",
   "type": "module",
   "repository": {