pr-shepherd 0.45.0 → 0.46.1

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pr-shepherd",
   "description": "Autonomous PR CI monitor and review-comment resolver for agentic coding tools",
-  "version": "0.45.0",
+  "version": "0.46.1",
   "author": {
     "name": "Jonathan Ong",
     "email": "jonathanrichardong@gmail.com"

package/README.md

@@ -25,14 +25,14 @@ Full reference: [docs/README.md](docs/README.md). Feature matrix: [docs/features
 
 `pr-shepherd` moves deterministic PR orchestration into a local MCP server, with a CLI for shells and CI. Both interfaces fetch the same GitHub state, emit raw-enough context, and return a numbered plan for the calling agent to follow.
 
-The MCP server exposes canonical `iterate`, `apply`, and `build_suggestion_patches` tools. `apply` accepts ordered review mutations, selection-only file-view diagnostics, and journal entries; the deprecated singular suggestion tool remains temporarily as an adapter. Direct MCP calls require a repository-qualified `pr`: a GitHub PR URL or `owner/repo#N`; the explicit repository is the target for GitHub I/O, even when it differs from the local checkout. The CLI and programmatic API also retain bare-number and current-branch PR discovery. The shipped skills are thin dispatchers for those tools.
+The MCP server exposes canonical `iterate`, `apply`, and `build_suggestion_patches` tools. `apply` accepts ordered review mutations, file-view mutations, and journal entries; the deprecated singular suggestion tool remains temporarily as an adapter. Direct MCP calls require a repository-qualified `pr`: a GitHub PR URL or `owner/repo#N`; the explicit repository is the target for GitHub I/O, even when it differs from the local checkout. The CLI and programmatic API also retain bare-number and current-branch PR discovery. The shipped skills are thin dispatchers for those tools.
 
 Each tick returns exactly one action:
 
 - `WAIT` — no immediate action; continue with the next poll.
 - `MARK_READY` — the CLI converted an eligible draft PR to ready; continue polling.
-- `FIX_CODE` — agent work is required; complete it, then continue polling.
-- `MERGE` — run the emitted auto-merge command only when GitHub reports `viewerCanEnableAutoMerge`; queue enrollment otherwise hands off for authorization.
+- `FIX_CODE` — agent work is required; complete it, push when needed, then continue polling. Push access to the PR head branch is a usage precondition.
+- `MERGE` — run the emitted head-pinned auto-merge or queue command. Ordinary merges include a plain-merge fallback; queue merges include a GraphQL enqueue fallback. GitHub is authoritative for the result and reports any authorization failure.
 - `CANCEL` — stop polling because the PR merged, closed, or completed its ready-delay.
 - `ESCALATE` — stop polling until a human provides direction.
 
@@ -77,19 +77,19 @@ Conversations Resolved: No [Not Required]
 9. `[FIX_CODE]` is non-terminal: if you changed code, commit and push to the PR head branch, then run review mutations using the pushed commit SHA and iterate again with the same options; without code changes, complete the authorized review mutations and iterate again.
 ```
 
-See [docs/actions.md](docs/actions.md) for the complete output contract. Iterate/poll PR outcomes use exit codes `0` and `10`–`15`; command and GitHub failures use `sysexits.h` codes — [docs/exit-codes.md](docs/exit-codes.md).
+See [docs/actions.md](docs/actions.md) for the complete output contract and [docs/escalations.md](docs/escalations.md) for the exact finite human-handoff boundary. Iterate/poll PR outcomes use exit codes `0` and `10`–`15`; command and GitHub failures use `sysexits.h` codes — [docs/exit-codes.md](docs/exit-codes.md).
 
 ## Workflow Assumptions
 
 This system is opinionated and works best with PRs that use required status checks and conversation resolution.
 
 - A human inline thread whose original comment has `viewerDidAuthor: true` is replied to and resolved when its latest comment is unmarked. An unmarked other-human inline thread remains reply-only; a marker-ended other-human thread is already acknowledged and receives no further mutation. Human items are never minimized.
-- Detected bots and configured `botUsernames` review threads are returned until resolved; bot/non-human threads, PR comments, and review summaries can be resolved or minimized when eligible. Review summaries are not minimized while known inline child threads from that review remain unresolved.
+- Detected bots and configured `botUsernames` review threads are returned until resolved when the required mutation is authorized and the thread has a source location. Unauthorized or unlocated items are surfaced once and then marker-gated until edited. Bot/non-human threads, PR comments, and review summaries can be resolved or minimized when eligible. Review summaries are not minimized while known inline child threads from that review remain unresolved.
 - Shepherd identifies its own latest reply only when that comment begins `<!-- pr-shepherd -->`, not from author equality. A marked viewer-authored thread can be resolved without another reply as a retry.
 - Every review thread/comment/review summary is surfaced at least once, even if already outdated, resolved, or minimized; edited items re-surface through seen markers.
 - Draft PRs can be marked ready automatically when clean; disable with `actions.autoMarkReady: false` or `--no-auto-mark-ready`.
-- The CLI never performs git mutations itself — it only emits commit/push instructions for the agent to run. It recommends pushing autonomously (own-repo PRs, and fork PRs where the viewer has push access to the fork) unless GitHub's viewer fields affirmatively report no head-branch push access, in which case it hands the push off to a human instead.
-- Every GitHub mutation is permission-aware. Shepherd uses raw viewer capability fields, omits unauthorized commands, and repeats authorization checks in direct `apply` commands. Missing capability data fails closed.
+- The CLI never performs git mutations itself — it only emits commit/push instructions for the agent to run. Push access to the PR head is a usage precondition; GitHub viewer fields do not create a separate push-authorization handoff.
+- Generated iterate mutations and automatic actions are capability-aware and omit unauthorized commands. Explicit `apply` operations honor the caller's intent and surface GitHub's result; semantic human-content protections still apply.
 - `build_suggestion_patches` turns one or more ordered GitHub suggestion threads into checked patches and commit metadata, but never edits the working tree or git history. Local HEAD may be ahead when the live PR head is its ancestor.
 
 ## Usage
@@ -128,7 +128,7 @@ pr-shepherd 42 --quiet-status          # print only changed WAIT status snapshot
 pr-shepherd 42 --until-terminal        # continue through WAIT/MARK_READY until work or terminal state
 pr-shepherd 42 --debounce 5m           # wait 5m after first FIX_CODE, then return one batched tick
 pr-shepherd 42 --ready-delay 15m
-pr-shepherd 42 --merge                  # enable auto-merge when GitHub confirms viewer authorization
+pr-shepherd 42 --merge                  # request head-pinned auto-merge/queue; GitHub reports the result
 pr-shepherd iterate 42                 # single tick
 pr-shepherd owner/repo#42              # poll a PR in an explicit repository
 pr-shepherd https://github.com/owner/repo/pull/42
@@ -136,7 +136,7 @@ pr-shepherd https://github.com/owner/repo/pull/42
 
 ### Apply Review And Journal Changes, Or Select Files
 
-Use `apply` with ordered operations to reply/resolve/minimize/dismiss review items, select changed files for viewed-state authorization diagnostics, or append an idempotent Shepherd Journal item. File-view selection never mutates viewed state because GitHub exposes no exact viewer capability. Use `build_suggestion_patches` to turn ordered review suggestions into checked patches and commit metadata; it never changes the worktree or git history.
+Use `apply` with ordered operations to reply/resolve/minimize/dismiss review items, mark selected changed files as viewed, or append an idempotent Shepherd Journal item. Explicit operations are attempted and surface GitHub's per-operation results; generated iterate guidance remains capability-filtered. Use `build_suggestion_patches` to turn ordered review suggestions into checked patches and commit metadata; it never changes the worktree or git history.
 
 ### Extract Shepherd Journal Entries
 
@@ -156,6 +156,17 @@ complete Markdown list item with LF line endings. It fails closed for malformed
 containers and ignores journal-shaped examples hidden in Markdown constructs. The full journal API,
 including append and reconciliation helpers, is documented in [docs/api.md](docs/api.md).
 
+For shell automation that already has a PR body, use the equivalent local-only command:
+
+```sh
+pr-shepherd journal extract --body-file pr-body.md
+```
+
+It writes one JSON line containing the typed extraction result. It never reads GitHub credentials,
+configuration, or Shepherd logs. On POSIX, its final body-file path entry must be a readable regular
+file in a trusted parent directory; symlinks, FIFOs, and devices are rejected with exit code 66.
+Unsupported platforms fail closed with that same exit code.
+
 ### Clean Local State
 
 `pr-shepherd` stores seen markers, fix-attempt counters, stall fingerprints, ready-delay markers, and logs under `$PR_SHEPHERD_STATE_DIR` (default `$TMPDIR/pr-shepherd-state`).

package/bin/api.d.mts

@@ -22,7 +22,7 @@ export interface ReviewMutationsOperation {
     requireSha?: string;
 }
 export interface MarkFilesViewedOperation {
-    /** Compatibility-named selection only; always skips mutation because authorization is unverifiable. */
+    /** Marks selected changed files as viewed. GitHub authorizes the requested mutation. */
     type: "mark_files_viewed";
     files?: string[];
     tests?: boolean;
@@ -33,7 +33,7 @@ export interface AppendJournalOperation {
     item: string;
     dryRun?: boolean;
 }
-/** Operations run in this exact list order after validation; file-view selection is non-mutating. */
+/** Operations run in this exact list order after validation. */
 export type ApplyOperation = ReviewMutationsOperation | MarkFilesViewedOperation | AppendJournalOperation;
 export interface ApplyInput {
     /** PR shared by every operation in this ordered apply request. */

package/bin/checks/conclusions.d.mts

@@ -6,22 +6,6 @@ import type { CheckConclusion, ViewerAuthorization } from "../types.mts";
  * which covers fork push access — is the right field to gate on.
  */
 export declare function canRerunWorkflows(auth: ViewerAuthorization | undefined): boolean;
-/**
- * True when the viewer can push commits to the PR head branch — the fork, for a fork PR
- * (own-fork PRs report `headRepositoryPermission: "ADMIN"`), or the base repo otherwise.
- * `viewerCanEditFiles` is GitHub's direct "can the viewer commit to this PR" signal (true
- * for fork authors and for maintainers with "allow edits from maintainers" enabled) and
- * takes priority when present.
- *
- * pr-shepherd's premise is that the caller has push access to the PR it's iterating, so
- * this defaults to pushable: it withholds the autonomous push only when GitHub
- * affirmatively reports no head-branch access (`viewerCanEditFiles === false` and
- * `headRepositoryPermission` in `NONE`/`READ`/`TRIAGE`). An unverifiable/unknown signal —
- * matching the residual risk already accepted for CI reruns (see `canRerunWorkflows`) —
- * is treated as pushable rather than pre-emptively handed off; a push without access
- * simply fails when attempted.
- */
-export declare function canPushToHead(auth: ViewerAuthorization | undefined): boolean;
 /** Failing-check rows for formatter/instructions — excludes annotation-only carriers. */
 export declare function isFailingAgentCheck(check: {
     conclusion: CheckConclusion;

package/bin/checks/conclusions.mjs

@@ -11,33 +11,6 @@ export function canRerunWorkflows(auth) {
     const permission = auth?.repositoryPermission;
     return permission != null && RERUN_CAPABLE_PERMISSIONS.has(permission);
 }
-/** Repository roles that carry push access to the head branch. */
-const PUSH_CAPABLE_PERMISSIONS = new Set(["WRITE", "MAINTAIN", "ADMIN"]);
-/**
- * True when the viewer can push commits to the PR head branch — the fork, for a fork PR
- * (own-fork PRs report `headRepositoryPermission: "ADMIN"`), or the base repo otherwise.
- * `viewerCanEditFiles` is GitHub's direct "can the viewer commit to this PR" signal (true
- * for fork authors and for maintainers with "allow edits from maintainers" enabled) and
- * takes priority when present.
- *
- * pr-shepherd's premise is that the caller has push access to the PR it's iterating, so
- * this defaults to pushable: it withholds the autonomous push only when GitHub
- * affirmatively reports no head-branch access (`viewerCanEditFiles === false` and
- * `headRepositoryPermission` in `NONE`/`READ`/`TRIAGE`). An unverifiable/unknown signal —
- * matching the residual risk already accepted for CI reruns (see `canRerunWorkflows`) —
- * is treated as pushable rather than pre-emptively handed off; a push without access
- * simply fails when attempted.
- */
-export function canPushToHead(auth) {
-    if (auth === undefined)
-        return true;
-    if (auth.viewerCanEditFiles === true)
-        return true;
-    const permission = auth.headRepositoryPermission;
-    if (permission != null && !PUSH_CAPABLE_PERMISSIONS.has(permission))
-        return false;
-    return true;
-}
 /** True for conclusions that belong under `## Failing checks` (not success/skipped/neutral). */
 function isFailingCheckConclusion(conclusion) {
     return conclusion == null || !NON_FAILING_CONCLUSIONS.has(conclusion);

package/bin/cli/fix-formatter.mjs

@@ -9,9 +9,11 @@ import { isFailingAgentCheck } from "../checks/conclusions.mjs";
 import { renderMergeCommand } from "../commands/iterate/merge.mjs";
 export function formatFixCodeResult(header, result) {
     const sections = [header];
-    if (result.fix.threads.length > 0) {
-        sections.push("## Review threads");
-        for (const t of result.fix.threads) {
+    const renderThreads = (heading, threads) => {
+        if (threads.length === 0)
+            return;
+        sections.push(heading);
+        for (const t of threads) {
             const lineLabel = renderLineRange(t.startLine, t.line);
             const loc = t.path ? `\`${t.path}:${lineLabel}\`` : "(no location)";
             const heading = t.url ? `[threadId=${t.id}](${t.url})` : `\`threadId=${t.id}\``;
@@ -24,7 +26,11 @@ export function formatFixCodeResult(header, result) {
                 sections.push(renderSuggestionBlock(t.suggestion, ""));
             }
         }
-    }
+    };
+    const locatedThreads = result.fix.threads.filter((thread) => thread.path !== null && thread.line !== null);
+    const unlocatedThreads = result.fix.threads.filter((thread) => thread.path === null || thread.line === null);
+    renderThreads("## Review threads", locatedThreads);
+    renderThreads("## Unlocated review threads (logged once — no mutation)", unlocatedThreads);
     if (result.fix.resolutionOnlyThreads.length > 0) {
         sections.push("## Review threads to resolve");
         sections.push(result.fix.resolutionOnlyThreads

package/bin/cli/help-command-pages.d.mts

@@ -2,7 +2,7 @@ export declare const COMMAND_USAGE: {
     readonly default: string;
     readonly apply: `pr-shepherd apply
 
-Apply a review mutation, select changed files for authorization diagnostics, or append a PR journal item.
+Apply review mutations, mark selected changed files as viewed, or append a PR journal item.
 
 Usage:
   pr-shepherd apply review [PR] [review-flags]
@@ -36,8 +36,7 @@ At least one action flag is required.
 --help, -h                      Print this help and exit before GitHub I/O.`;
     readonly "apply files": `pr-shepherd apply files
 
-Select changed files and report that viewed-state authorization cannot be verified.
-No file viewed-state mutation is attempted.
+Mark selected changed files as viewed.
 
 Usage:
   pr-shepherd apply files [PR] [files...] [--tests] [--match REGEX]
@@ -176,8 +175,7 @@ Exit codes:
   See docs/exit-codes.md for the full sysexits.h table.`;
     readonly "mark-files-as-viewed": `pr-shepherd mark-files-as-viewed
 
-Deprecated compatibility alias for selection-only file-view authorization diagnostics.
-No file viewed-state mutation is attempted.
+Deprecated compatibility alias for marking selected PR files as viewed.
 
 Usage:
   pr-shepherd mark-files-as-viewed [PR] [files...] [--tests] [--match REGEX]
@@ -246,5 +244,18 @@ Flags:
   --help, -h           Print this help and exit before any GitHub I/O.
 
 Exit code: 0 on success (including no-change no-op); nonzero on failure (sysexits.h — see docs/exit-codes.md).`;
+    readonly "journal extract": `pr-shepherd journal extract
+
+Extract one visible, structurally valid Shepherd Journal from a local PR-body file.
+This command performs no GitHub, configuration, or log I/O.
+
+Usage:
+  pr-shepherd journal extract --body-file <path>
+
+The output is exactly one JSON line: the typed result from extractShepherdJournal.
+Malformed or unrecognized journal content is returned as {"ok":false,...} with exit code 0.
+On POSIX, the final body-file path entry must be a readable regular file in a trusted parent directory;
+symlinks, FIFOs, devices, and unreadable paths exit 66. Unsupported platforms fail closed with exit 66.
+--help, -h                      Print this help and exit before any I/O.`;
     readonly "log-file": "pr-shepherd log-file\n\nPrint the per-worktree append-only debug log path for the current repository.\nThe log is created by the first non-help pr-shepherd command that initializes logging.\n\nUsage:\n  pr-shepherd log-file [--format text|json]\n\nFlags:\n  --format text|json   Print a raw path or {\"path\": \"...\"} JSON. Default: text.\n  --help, -h           Print this help and exit before logging setup.\n\nEnvironment:\n  PR_SHEPHERD_LOG_DISABLED=1 disables logging.\n  PR_SHEPHERD_STATE_DIR overrides the base state directory.\n\nExit code: 0 on success; 1 if repository identity cannot be resolved.";
 };

package/bin/cli/help-command-pages.mjs

@@ -5,7 +5,7 @@ export const COMMAND_USAGE = {
     default: DEFAULT_USAGE,
     apply: `pr-shepherd apply
 
-Apply a review mutation, select changed files for authorization diagnostics, or append a PR journal item.
+Apply review mutations, mark selected changed files as viewed, or append a PR journal item.
 
 Usage:
   pr-shepherd apply review [PR] [review-flags]
@@ -39,8 +39,7 @@ At least one action flag is required.
 --help, -h                      Print this help and exit before GitHub I/O.`,
     "apply files": `pr-shepherd apply files
 
-Select changed files and report that viewed-state authorization cannot be verified.
-No file viewed-state mutation is attempted.
+Mark selected changed files as viewed.
 
 Usage:
   pr-shepherd apply files [PR] [files...] [--tests] [--match REGEX]
@@ -179,8 +178,7 @@ Exit codes:
   See docs/exit-codes.md for the full sysexits.h table.`,
     "mark-files-as-viewed": `pr-shepherd mark-files-as-viewed
 
-Deprecated compatibility alias for selection-only file-view authorization diagnostics.
-No file viewed-state mutation is attempted.
+Deprecated compatibility alias for marking selected PR files as viewed.
 
 Usage:
   pr-shepherd mark-files-as-viewed [PR] [files...] [--tests] [--match REGEX]
@@ -249,5 +247,18 @@ Flags:
   --help, -h           Print this help and exit before any GitHub I/O.
 
 Exit code: 0 on success (including no-change no-op); nonzero on failure (sysexits.h — see docs/exit-codes.md).`,
+    "journal extract": `pr-shepherd journal extract
+
+Extract one visible, structurally valid Shepherd Journal from a local PR-body file.
+This command performs no GitHub, configuration, or log I/O.
+
+Usage:
+  pr-shepherd journal extract --body-file <path>
+
+The output is exactly one JSON line: the typed result from extractShepherdJournal.
+Malformed or unrecognized journal content is returned as {"ok":false,...} with exit code 0.
+On POSIX, the final body-file path entry must be a readable regular file in a trusted parent directory;
+symlinks, FIFOs, devices, and unreadable paths exit 66. Unsupported platforms fail closed with exit 66.
+--help, -h                      Print this help and exit before any I/O.`,
     "log-file": LOG_FILE_USAGE,
 };

package/bin/cli/help-top-page.d.mts

@@ -1 +1 @@
-export declare const TOP_USAGE = "pr-shepherd\n\nAutonomous PR CI monitor and review-comment resolver for agentic coding tools.\n\nUsage:\n  pr-shepherd --version | -v\n  pr-shepherd --help | -h\n  pr-shepherd [PR] [poll-flags] [iterate-flags]\n  pr-shepherd iterate [PR] [iterate-flags]\n  pr-shepherd apply review [PR] [review-flags]\n  pr-shepherd apply files [PR] [files...] [--tests] [--match REGEX]\n  pr-shepherd apply journal [PR] <item> [--dry-run] [--format text|json]\n  pr-shepherd build-suggestion-patches [PR] --thread-id ID --message MSG [groups...]\n  pr-shepherd admin clean <pr|branch|current|repo|all> [value] [flags]\n  pr-shepherd admin log-file [--format text|json]\n\nCommands:\n  [PR]                 Poll until non-WAIT or timeout. This is the default command.\n  iterate              Run one iterate tick (single-tick alias).\n  apply review         Apply review-state mutations after fixes.\n  apply files          Select changed files; no viewed-state mutation is attempted.\n  apply journal        Append a list item to the Shepherd Journal details block of a PR body.\n  build-suggestion-patches\n                       Convert ordered GitHub suggestion threads into patches and commit instructions.\n  admin clean          Remove pr-shepherd state files.\n  admin log-file       Print the per-worktree debug log path.\n\nPR argument:\n  PR may be a number such as 42 or a GitHub pull request URL.\n  When omitted, pr-shepherd infers the current branch's pull request.\n\nCommon flags:\n  --format text|json   Output Markdown text or JSON. Default: text.\n  --verbose            Include verbose iterate fields and detailed poll-tick lines.\n  --help, -h           Print help and exit before any GitHub, git, config, or log I/O.\n\nIterate flags:\n  --ready-delay <duration>       Settle window before a clean PR cancels. Bare number = minutes. Example: 15m.\n  --stall-timeout <duration>     Escalate repeated unchanged failures after this duration. Bare number = minutes. 0 disables.\n  --no-auto-mark-ready           Do not convert draft PRs to ready for review.\n  --no-auto-cancel-actionable    Legacy no-op; workflow runs are never cancelled.\n\nPolling flags:\n  --interval <duration>          Delay between WAIT ticks. Bare number = seconds. Default: 60s.\n  --timeout <duration>           Poll wall-clock cap for WAIT ticks. Bare number = seconds. Default: 4.5m.\n  --debounce <duration>          Settle window after first FIX_CODE before returning. Bare number = seconds. Default: 60s. 0 disables.\n  --quiet-status                 During WAIT polling, print only changed status snapshots.\n  --until-terminal               Continue through WAIT/MARK_READY until FIX_CODE/CANCEL/ESCALATE.\n\nClean variants:\n  pr [number]          Remove state for one PR. Defaults to current branch PR.\n  branch [name]        Remove state for a branch's PR. Defaults to current branch.\n  current              Alias for branch against the current branch.\n  repo                 Remove all state for the current repository.\n  all                  Remove all pr-shepherd state.\n\nExit codes: 0 done, 10-19 PR state, 64-78 shepherd failed (sysexits.h).\n  0   CANCEL (merged or ready-delay elapsed)\n  10  WAIT\n  11  MARK_READY\n  12  FIX_CODE\n  13  ESCALATE\n  14  CANCEL (closed without merging)\nSee docs/exit-codes.md for the full sysexits.h error-code table.\n\nDuration examples: 30s, 4.5m, 1h. A bare number uses each flag's default unit (see above); decimals are allowed with an explicit unit (4.5m).\n\nRun 'pr-shepherd <command> --help' for command-specific details.";
+export declare const TOP_USAGE = "pr-shepherd\n\nAutonomous PR CI monitor and review-comment resolver for agentic coding tools.\n\nUsage:\n  pr-shepherd --version | -v\n  pr-shepherd --help | -h\n  pr-shepherd [PR] [poll-flags] [iterate-flags]\n  pr-shepherd iterate [PR] [iterate-flags]\n  pr-shepherd apply review [PR] [review-flags]\n  pr-shepherd apply files [PR] [files...] [--tests] [--match REGEX]\n  pr-shepherd apply journal [PR] <item> [--dry-run] [--format text|json]\n  pr-shepherd journal extract --body-file <path>\n  pr-shepherd build-suggestion-patches [PR] --thread-id ID --message MSG [groups...]\n  pr-shepherd admin clean <pr|branch|current|repo|all> [value] [flags]\n  pr-shepherd admin log-file [--format text|json]\n\nCommands:\n  [PR]                 Poll until non-WAIT or timeout. This is the default command.\n  iterate              Run one iterate tick (single-tick alias).\n  apply review         Apply review-state mutations after fixes.\n  apply files          Mark selected changed files as viewed.\n  apply journal        Append a list item to the Shepherd Journal details block of a PR body.\n  journal extract      Extract a validated Shepherd Journal from a local PR-body file as JSON.\n  build-suggestion-patches\n                       Convert ordered GitHub suggestion threads into patches and commit instructions.\n  admin clean          Remove pr-shepherd state files.\n  admin log-file       Print the per-worktree debug log path.\n\nPR argument:\n  PR may be a number such as 42 or a GitHub pull request URL.\n  When omitted, pr-shepherd infers the current branch's pull request.\n\nCommon flags:\n  --format text|json   Output Markdown text or JSON. Default: text.\n  --verbose            Include verbose iterate fields and detailed poll-tick lines.\n  --help, -h           Print help and exit before any GitHub, git, config, or log I/O.\n\nIterate flags:\n  --ready-delay <duration>       Settle window before a clean PR cancels. Bare number = minutes. Example: 15m.\n  --stall-timeout <duration>     Escalate repeated unchanged failures after this duration. Bare number = minutes. 0 disables.\n  --no-auto-mark-ready           Do not convert draft PRs to ready for review.\n  --no-auto-cancel-actionable    Legacy no-op; workflow runs are never cancelled.\n\nPolling flags:\n  --interval <duration>          Delay between WAIT ticks. Bare number = seconds. Default: 60s.\n  --timeout <duration>           Poll wall-clock cap for WAIT ticks. Bare number = seconds. Default: 4.5m.\n  --debounce <duration>          Settle window after first FIX_CODE before returning. Bare number = seconds. Default: 60s. 0 disables.\n  --quiet-status                 During WAIT polling, print only changed status snapshots.\n  --until-terminal               Continue through WAIT/MARK_READY until FIX_CODE/CANCEL/ESCALATE.\n\nClean variants:\n  pr [number]          Remove state for one PR. Defaults to current branch PR.\n  branch [name]        Remove state for a branch's PR. Defaults to current branch.\n  current              Alias for branch against the current branch.\n  repo                 Remove all state for the current repository.\n  all                  Remove all pr-shepherd state.\n\nExit codes: 0 done, 10-19 PR state, 64-78 shepherd failed (sysexits.h).\n  0   CANCEL (merged or ready-delay elapsed)\n  10  WAIT\n  11  MARK_READY\n  12  FIX_CODE\n  13  ESCALATE\n  14  CANCEL (closed without merging)\nSee docs/exit-codes.md for the full sysexits.h error-code table.\n\nDuration examples: 30s, 4.5m, 1h. A bare number uses each flag's default unit (see above); decimals are allowed with an explicit unit (4.5m).\n\nRun 'pr-shepherd <command> --help' for command-specific details.";

package/bin/cli/help-top-page.mjs

@@ -10,6 +10,7 @@ Usage:
   pr-shepherd apply review [PR] [review-flags]
   pr-shepherd apply files [PR] [files...] [--tests] [--match REGEX]
   pr-shepherd apply journal [PR] <item> [--dry-run] [--format text|json]
+  pr-shepherd journal extract --body-file <path>
   pr-shepherd build-suggestion-patches [PR] --thread-id ID --message MSG [groups...]
   pr-shepherd admin clean <pr|branch|current|repo|all> [value] [flags]
   pr-shepherd admin log-file [--format text|json]
@@ -18,8 +19,9 @@ Commands:
   [PR]                 Poll until non-WAIT or timeout. This is the default command.
   iterate              Run one iterate tick (single-tick alias).
   apply review         Apply review-state mutations after fixes.
-  apply files          Select changed files; no viewed-state mutation is attempted.
+  apply files          Mark selected changed files as viewed.
   apply journal        Append a list item to the Shepherd Journal details block of a PR body.
+  journal extract      Extract a validated Shepherd Journal from a local PR-body file as JSON.
   build-suggestion-patches
                        Convert ordered GitHub suggestion threads into patches and commit instructions.
   admin clean          Remove pr-shepherd state files.

package/bin/cli/help.d.mts

@@ -2,7 +2,7 @@ export declare const USAGE: {
     readonly default: string;
     readonly apply: `pr-shepherd apply
 
-Apply a review mutation, select changed files for authorization diagnostics, or append a PR journal item.
+Apply review mutations, mark selected changed files as viewed, or append a PR journal item.
 
 Usage:
   pr-shepherd apply review [PR] [review-flags]
@@ -36,8 +36,7 @@ At least one action flag is required.
 --help, -h                      Print this help and exit before GitHub I/O.`;
     readonly "apply files": `pr-shepherd apply files
 
-Select changed files and report that viewed-state authorization cannot be verified.
-No file viewed-state mutation is attempted.
+Mark selected changed files as viewed.
 
 Usage:
   pr-shepherd apply files [PR] [files...] [--tests] [--match REGEX]
@@ -176,8 +175,7 @@ Exit codes:
   See docs/exit-codes.md for the full sysexits.h table.`;
     readonly "mark-files-as-viewed": `pr-shepherd mark-files-as-viewed
 
-Deprecated compatibility alias for selection-only file-view authorization diagnostics.
-No file viewed-state mutation is attempted.
+Deprecated compatibility alias for marking selected PR files as viewed.
 
 Usage:
   pr-shepherd mark-files-as-viewed [PR] [files...] [--tests] [--match REGEX]
@@ -246,8 +244,21 @@ Flags:
   --help, -h           Print this help and exit before any GitHub I/O.
 
 Exit code: 0 on success (including no-change no-op); nonzero on failure (sysexits.h — see docs/exit-codes.md).`;
+    readonly "journal extract": `pr-shepherd journal extract
+
+Extract one visible, structurally valid Shepherd Journal from a local PR-body file.
+This command performs no GitHub, configuration, or log I/O.
+
+Usage:
+  pr-shepherd journal extract --body-file <path>
+
+The output is exactly one JSON line: the typed result from extractShepherdJournal.
+Malformed or unrecognized journal content is returned as {"ok":false,...} with exit code 0.
+On POSIX, the final body-file path entry must be a readable regular file in a trusted parent directory;
+symlinks, FIFOs, devices, and unreadable paths exit 66. Unsupported platforms fail closed with exit 66.
+--help, -h                      Print this help and exit before any I/O.`;
     readonly "log-file": "pr-shepherd log-file\n\nPrint the per-worktree append-only debug log path for the current repository.\nThe log is created by the first non-help pr-shepherd command that initializes logging.\n\nUsage:\n  pr-shepherd log-file [--format text|json]\n\nFlags:\n  --format text|json   Print a raw path or {\"path\": \"...\"} JSON. Default: text.\n  --help, -h           Print this help and exit before logging setup.\n\nEnvironment:\n  PR_SHEPHERD_LOG_DISABLED=1 disables logging.\n  PR_SHEPHERD_STATE_DIR overrides the base state directory.\n\nExit code: 0 on success; 1 if repository identity cannot be resolved.";
-    readonly top: "pr-shepherd\n\nAutonomous PR CI monitor and review-comment resolver for agentic coding tools.\n\nUsage:\n  pr-shepherd --version | -v\n  pr-shepherd --help | -h\n  pr-shepherd [PR] [poll-flags] [iterate-flags]\n  pr-shepherd iterate [PR] [iterate-flags]\n  pr-shepherd apply review [PR] [review-flags]\n  pr-shepherd apply files [PR] [files...] [--tests] [--match REGEX]\n  pr-shepherd apply journal [PR] <item> [--dry-run] [--format text|json]\n  pr-shepherd build-suggestion-patches [PR] --thread-id ID --message MSG [groups...]\n  pr-shepherd admin clean <pr|branch|current|repo|all> [value] [flags]\n  pr-shepherd admin log-file [--format text|json]\n\nCommands:\n  [PR]                 Poll until non-WAIT or timeout. This is the default command.\n  iterate              Run one iterate tick (single-tick alias).\n  apply review         Apply review-state mutations after fixes.\n  apply files          Select changed files; no viewed-state mutation is attempted.\n  apply journal        Append a list item to the Shepherd Journal details block of a PR body.\n  build-suggestion-patches\n                       Convert ordered GitHub suggestion threads into patches and commit instructions.\n  admin clean          Remove pr-shepherd state files.\n  admin log-file       Print the per-worktree debug log path.\n\nPR argument:\n  PR may be a number such as 42 or a GitHub pull request URL.\n  When omitted, pr-shepherd infers the current branch's pull request.\n\nCommon flags:\n  --format text|json   Output Markdown text or JSON. Default: text.\n  --verbose            Include verbose iterate fields and detailed poll-tick lines.\n  --help, -h           Print help and exit before any GitHub, git, config, or log I/O.\n\nIterate flags:\n  --ready-delay <duration>       Settle window before a clean PR cancels. Bare number = minutes. Example: 15m.\n  --stall-timeout <duration>     Escalate repeated unchanged failures after this duration. Bare number = minutes. 0 disables.\n  --no-auto-mark-ready           Do not convert draft PRs to ready for review.\n  --no-auto-cancel-actionable    Legacy no-op; workflow runs are never cancelled.\n\nPolling flags:\n  --interval <duration>          Delay between WAIT ticks. Bare number = seconds. Default: 60s.\n  --timeout <duration>           Poll wall-clock cap for WAIT ticks. Bare number = seconds. Default: 4.5m.\n  --debounce <duration>          Settle window after first FIX_CODE before returning. Bare number = seconds. Default: 60s. 0 disables.\n  --quiet-status                 During WAIT polling, print only changed status snapshots.\n  --until-terminal               Continue through WAIT/MARK_READY until FIX_CODE/CANCEL/ESCALATE.\n\nClean variants:\n  pr [number]          Remove state for one PR. Defaults to current branch PR.\n  branch [name]        Remove state for a branch's PR. Defaults to current branch.\n  current              Alias for branch against the current branch.\n  repo                 Remove all state for the current repository.\n  all                  Remove all pr-shepherd state.\n\nExit codes: 0 done, 10-19 PR state, 64-78 shepherd failed (sysexits.h).\n  0   CANCEL (merged or ready-delay elapsed)\n  10  WAIT\n  11  MARK_READY\n  12  FIX_CODE\n  13  ESCALATE\n  14  CANCEL (closed without merging)\nSee docs/exit-codes.md for the full sysexits.h error-code table.\n\nDuration examples: 30s, 4.5m, 1h. A bare number uses each flag's default unit (see above); decimals are allowed with an explicit unit (4.5m).\n\nRun 'pr-shepherd <command> --help' for command-specific details.";
+    readonly top: "pr-shepherd\n\nAutonomous PR CI monitor and review-comment resolver for agentic coding tools.\n\nUsage:\n  pr-shepherd --version | -v\n  pr-shepherd --help | -h\n  pr-shepherd [PR] [poll-flags] [iterate-flags]\n  pr-shepherd iterate [PR] [iterate-flags]\n  pr-shepherd apply review [PR] [review-flags]\n  pr-shepherd apply files [PR] [files...] [--tests] [--match REGEX]\n  pr-shepherd apply journal [PR] <item> [--dry-run] [--format text|json]\n  pr-shepherd journal extract --body-file <path>\n  pr-shepherd build-suggestion-patches [PR] --thread-id ID --message MSG [groups...]\n  pr-shepherd admin clean <pr|branch|current|repo|all> [value] [flags]\n  pr-shepherd admin log-file [--format text|json]\n\nCommands:\n  [PR]                 Poll until non-WAIT or timeout. This is the default command.\n  iterate              Run one iterate tick (single-tick alias).\n  apply review         Apply review-state mutations after fixes.\n  apply files          Mark selected changed files as viewed.\n  apply journal        Append a list item to the Shepherd Journal details block of a PR body.\n  journal extract      Extract a validated Shepherd Journal from a local PR-body file as JSON.\n  build-suggestion-patches\n                       Convert ordered GitHub suggestion threads into patches and commit instructions.\n  admin clean          Remove pr-shepherd state files.\n  admin log-file       Print the per-worktree debug log path.\n\nPR argument:\n  PR may be a number such as 42 or a GitHub pull request URL.\n  When omitted, pr-shepherd infers the current branch's pull request.\n\nCommon flags:\n  --format text|json   Output Markdown text or JSON. Default: text.\n  --verbose            Include verbose iterate fields and detailed poll-tick lines.\n  --help, -h           Print help and exit before any GitHub, git, config, or log I/O.\n\nIterate flags:\n  --ready-delay <duration>       Settle window before a clean PR cancels. Bare number = minutes. Example: 15m.\n  --stall-timeout <duration>     Escalate repeated unchanged failures after this duration. Bare number = minutes. 0 disables.\n  --no-auto-mark-ready           Do not convert draft PRs to ready for review.\n  --no-auto-cancel-actionable    Legacy no-op; workflow runs are never cancelled.\n\nPolling flags:\n  --interval <duration>          Delay between WAIT ticks. Bare number = seconds. Default: 60s.\n  --timeout <duration>           Poll wall-clock cap for WAIT ticks. Bare number = seconds. Default: 4.5m.\n  --debounce <duration>          Settle window after first FIX_CODE before returning. Bare number = seconds. Default: 60s. 0 disables.\n  --quiet-status                 During WAIT polling, print only changed status snapshots.\n  --until-terminal               Continue through WAIT/MARK_READY until FIX_CODE/CANCEL/ESCALATE.\n\nClean variants:\n  pr [number]          Remove state for one PR. Defaults to current branch PR.\n  branch [name]        Remove state for a branch's PR. Defaults to current branch.\n  current              Alias for branch against the current branch.\n  repo                 Remove all state for the current repository.\n  all                  Remove all pr-shepherd state.\n\nExit codes: 0 done, 10-19 PR state, 64-78 shepherd failed (sysexits.h).\n  0   CANCEL (merged or ready-delay elapsed)\n  10  WAIT\n  11  MARK_READY\n  12  FIX_CODE\n  13  ESCALATE\n  14  CANCEL (closed without merging)\nSee docs/exit-codes.md for the full sysexits.h error-code table.\n\nDuration examples: 30s, 4.5m, 1h. A bare number uses each flag's default unit (see above); decimals are allowed with an explicit unit (4.5m).\n\nRun 'pr-shepherd <command> --help' for command-specific details.";
 };
 /** Resolve help keys for nested public commands before any command I/O. */
 export declare function helpKeyForArgs(args: string[]): keyof typeof USAGE;

package/bin/cli/help.mjs

@@ -13,6 +13,8 @@ export function helpKeyForArgs(args) {
         return "apply files";
     if (args[0] === "apply" && args[1] === "journal")
         return "apply journal";
+    if (args[0] === "journal" && args[1] === "extract")
+        return "journal extract";
     if (args[0] === "admin" && args[1] === "clean")
         return "admin clean";
     if (args[0] === "admin" && args[1] === "log-file")

package/bin/cli/iterate-checks-formatter.d.mts

@@ -0,0 +1,2 @@
+import type { RelevantCheck } from "../types.mts";
+export declare function formatRelevantChecks(checks: RelevantCheck[]): string | null;

package/bin/cli/iterate-checks-formatter.mjs

@@ -0,0 +1,55 @@
+import { renderCheckAnnotation } from "./fix-formatter-extra.mjs";
+export function formatRelevantChecks(checks) {
+    if (checks.length === 0)
+        return null;
+    const lines = ["## Checks", ""];
+    for (const check of checks) {
+        lines.push(...formatRelevantCheck(check));
+    }
+    return lines.join("\n");
+}
+function formatRelevantCheck(check) {
+    const workflow = check.workflowName ? `${check.workflowName} › ` : "";
+    const job = check.jobName ?? check.name;
+    const lines = [`- \`${workflow}${job}\` [conclusion: ${check.conclusion}]`];
+    appendCheckFields(lines, check);
+    appendLogExcerpt(lines, check.logExcerpt);
+    appendAnnotations(lines, check.annotations);
+    return lines;
+}
+function appendCheckFields(lines, check) {
+    const codeFields = [
+        ["run", check.runId],
+        ["URL", check.detailsUrl],
+        ["scope", check.scope],
+        ["commit", check.commitOid],
+    ];
+    for (const [label, value] of codeFields) {
+        if (value)
+            lines.push(`  - ${label}: \`${value}\``);
+    }
+    const textFields = [
+        ["failed step", check.failedStep],
+        ["summary", check.summary],
+    ];
+    for (const [label, value] of textFields) {
+        if (value)
+            lines.push(`  - ${label}: ${value}`);
+    }
+}
+function appendLogExcerpt(lines, logExcerpt) {
+    if (!logExcerpt)
+        return;
+    for (const line of logExcerpt.split("\n"))
+        lines.push(`  > ${line}`);
+}
+function appendAnnotations(lines, annotations) {
+    if (!annotations || annotations.length === 0)
+        return;
+    lines.push("  - annotations:");
+    for (const annotation of annotations) {
+        for (const line of renderCheckAnnotation(annotation).split("\n")) {
+            lines.push(`    ${line}`);
+        }
+    }
+}

package/bin/cli/iterate-formatter.mjs

@@ -1,4 +1,5 @@
 import { formatFixCodeResult } from "./fix-formatter.mjs";
+import { formatRelevantChecks } from "./iterate-checks-formatter.mjs";
 import { joinSections } from "../util/markdown.mjs";
 import { adaptIterateLog, buildSimpleIterateInstructions, numberInstructions, } from "./iterate-instructions.mjs";
 import { formatMergeRequirementLines } from "../merge-status/requirements-format.mjs";
@@ -26,7 +27,8 @@ export function formatIterateResult(result, opts) {
     const reviewDecisionSeg = result.mergeStatus === "BLOCKED" && result.reviewDecision
         ? ` · **reviewDecision** \`${result.reviewDecision}\``
         : "";
-    const baseLine = `**status** \`${result.status}\` · **merge** \`${result.mergeStateStatus}\`${reviewDecisionSeg} · **state** \`${result.state}\` · **repo** \`${result.repo}\``;
+    const baseBranchSeg = verbose && result.baseBranch ? ` · **baseBranch** \`${result.baseBranch}\`` : "";
+    const baseLine = `**status** \`${result.status}\` · **merge** \`${result.mergeStateStatus}\`${reviewDecisionSeg} · **state** \`${result.state}\` · **repo** \`${result.repo}\`${baseBranchSeg}`;
     let summaryLine;
     if (verbose) {
         let verboseBranch = "";
@@ -110,7 +112,8 @@ export function formatIterateResult(result, opts) {
     const header = headerLines.join("\n");
     const quotaWarning = formatQuotaWarning(result.quotaWarning);
     const apiUsage = verbose ? formatApiUsage(result.apiUsage) : null;
-    const telemetrySections = [quotaWarning, apiUsage];
+    const verboseChecks = verbose ? formatRelevantChecks(result.checks) : null;
+    const telemetrySections = [quotaWarning, apiUsage, verboseChecks];
     switch (result.action) {
         case "wait":
             return joinSections([
@@ -149,6 +152,7 @@ export function formatIterateResult(result, opts) {
             return joinSections([
                 cancelHeaderLines.join("\n"),
                 ...(apiUsage ? [apiUsage] : []),
+                ...(verboseChecks ? [verboseChecks] : []),
                 adaptIterateLog(result.log),
                 `## Instructions\n\n${numberInstructions(buildSimpleIterateInstructions(result))}`,
             ]);
@@ -157,6 +161,7 @@ export function formatIterateResult(result, opts) {
             return joinSections([
                 header,
                 ...(apiUsage ? [apiUsage] : []),
+                ...(verboseChecks ? [verboseChecks] : []),
                 result.escalate.humanMessage,
                 `## Instructions\n\n${numberInstructions(buildSimpleIterateInstructions(result))}`,
             ]);

package/bin/cli/iterate-lean.mjs

@@ -158,6 +158,10 @@ export function projectIterateLean(result, opts) {
                     ...(result.escalate.changesRequestedReviews.length > 0 && {
                         changesRequestedReviews: result.escalate.changesRequestedReviews,
                     }),
+                    ...(result.escalate.checks &&
+                        result.escalate.checks.length > 0 && {
+                        checks: result.escalate.checks,
+                    }),
                     ...(result.escalate.stalledChecks &&
                         result.escalate.stalledChecks.length > 0 && {
                         stalledChecks: result.escalate.stalledChecks,

package/bin/cli/journal-extract-handler.d.mts

@@ -0,0 +1,2 @@
+/** Extracts a checked Shepherd Journal from a local PR-body file without external I/O. */
+export declare function handleJournalExtract(args: string[]): Promise<void>;

package/bin/cli/journal-extract-handler.mjs

@@ -0,0 +1,48 @@
+import { extractShepherdJournal } from "../journal/index.mjs";
+import { EXIT, ShepherdError } from "../exit-codes.mjs";
+import { USAGE, maybePrintHelp } from "./help.mjs";
+import { readSafeBodyFile } from "./safe-body-file.mjs";
+/** Extracts a checked Shepherd Journal from a local PR-body file without external I/O. */
+export async function handleJournalExtract(args) {
+    if (maybePrintHelp(args, "journal extract"))
+        return;
+    const bodyFile = parseBodyFile(args);
+    if (bodyFile === null)
+        return;
+    try {
+        const body = await readSafeBodyFile(bodyFile);
+        process.stdout.write(`${JSON.stringify(extractShepherdJournal(body))}\n`);
+    }
+    catch (error) {
+        process.stderr.write(`pr-shepherd: journal extract: ${String(error)}\n`);
+        process.exitCode = error instanceof ShepherdError ? error.exitCode : EXIT.NOINPUT;
+    }
+}
+function parseBodyFile(args) {
+    let bodyFile;
+    for (let index = 0; index < args.length; index++) {
+        const arg = args[index];
+        if (arg === "--body-file") {
+            const value = args[++index];
+            if (value === undefined || bodyFile !== undefined) {
+                return printUsage();
+            }
+            bodyFile = value;
+            continue;
+        }
+        if (arg.startsWith("--body-file=")) {
+            const value = arg.slice("--body-file=".length);
+            if (value === "" || bodyFile !== undefined)
+                return printUsage();
+            bodyFile = value;
+            continue;
+        }
+        return printUsage();
+    }
+    return bodyFile ?? printUsage();
+}
+function printUsage() {
+    process.stderr.write(`${USAGE["journal extract"]}\n`);
+    process.exitCode = EXIT.USAGE;
+    return null;
+}

package/bin/cli/mark-files-as-viewed-formatter.mjs

@@ -3,12 +3,11 @@ export function formatMarkFilesAsViewedResult(result) {
     lines.push(`# PR #${result.prNumber} — File-view selection (${result.matchedPaths.length} selected)`);
     lines.push("");
     lines.push(`repo: ${result.repo}`);
-    if (result.authorizationSkipped) {
-        lines.push("");
-        lines.push("## Authorization");
-        lines.push("");
-        lines.push("- Not marked: GitHub does not expose a capability that confirms the current viewer may mark PR files as viewed.");
-    }
+    lines.push(`pullRequestId: ${result.pullRequestId}`);
+    appendPathSection(lines, "Requested exact paths", result.requestedPaths);
+    if (result.testSelector)
+        appendTextSection(lines, "Selectors", ["--tests"]);
+    appendTextSection(lines, "Match selectors", result.matchPatterns.map((pattern) => `--match ${pattern}`));
     appendPathSection(lines, "Matched files", result.matchedPaths);
     appendPathSection(lines, "Marked viewed", result.markedPaths);
     appendPathSection(lines, "Already viewed", result.alreadyViewedPaths);
@@ -22,9 +21,11 @@ export function formatMarkFilesAsViewedResult(result) {
             result.rateLimit.remaining !== undefined && result.rateLimit.limit !== undefined
                 ? `remaining ${result.rateLimit.remaining}/${result.rateLimit.limit}`
                 : null,
+            result.rateLimit.used !== undefined ? `used ${result.rateLimit.used}` : null,
             result.rateLimit.resetAt !== undefined
                 ? `reset at ${new Date(result.rateLimit.resetAt * 1000).toISOString()}`
                 : null,
+            result.rateLimit.resource !== undefined ? `resource ${result.rateLimit.resource}` : null,
         ]
             .filter(Boolean)
             .join(", ");

package/bin/cli/safe-body-file.d.mts

@@ -0,0 +1,14 @@
+import { open } from "node:fs/promises";
+type FileHandle = Awaited<ReturnType<typeof open>>;
+export interface SafeBodyFileReaderDependencies {
+    platform: NodeJS.Platform;
+    noFollow: number | undefined;
+    nonBlock: number | undefined;
+    open: (filePath: string, flags: number) => Promise<FileHandle>;
+}
+/**
+ * Reads a regular file after rejecting unsafe final path entries without exposing its contents.
+ * Callers must trust parent directories: O_NOFOLLOW only protects the final path entry.
+ */
+export declare function readSafeBodyFile(filePath: string, dependencies?: SafeBodyFileReaderDependencies): Promise<string>;
+export {};