techunter 0.1.1 → 0.1.2

package/dist/index.js

@@ -24,6 +24,7 @@ __export(github_exports, {
   getBaseBranch: () => getBaseBranch,
   getDefaultBranch: () => getDefaultBranch,
   getTask: () => getTask,
+  isCollaborator: () => isCollaborator,
   listComments: () => listComments,
   listMyTasks: () => listMyTasks,
   listTasks: () => listTasks,
@@ -50,6 +51,7 @@ function parseIssue(issue) {
     title: issue.title,
     body: issue.body ?? null,
     state: issue.state,
+    author: issue.user?.login ?? null,
     assignee: issue.assignee?.login ?? null,
     labels: (issue.labels ?? []).map(
       (l) => typeof l === "string" ? l : l.name ?? ""
@@ -226,6 +228,16 @@ async function getAuthenticatedUser(config) {
   const { data } = await octokit.users.getAuthenticated();
   return data.login;
 }
+async function isCollaborator(config, username) {
+  const octokit = createOctokit(config.githubToken);
+  const { owner, repo } = config.github;
+  try {
+    const { data } = await octokit.repos.getCollaboratorPermissionLevel({ owner, repo, username });
+    return data.permission === "admin" || data.permission === "write" || data.permission === "maintain";
+  } catch {
+    return false;
+  }
+}
 async function listMyTasks(config, username) {
   const octokit = createOctokit(config.githubToken);
   const { owner, repo } = config.github;
@@ -360,7 +372,11 @@ var configSchema = z.object({
     owner: z.string().min(1),
     repo: z.string().min(1),
     baseBranch: z.string().optional()
-  })
+  }),
+  taskState: z.object({
+    activeIssueNumber: z.number().optional(),
+    baseCommit: z.string().optional()
+  }).optional()
 });
 var store = new Conf({
   projectName: "techunter",
@@ -397,6 +413,12 @@ function setConfig(partial) {
   if (partial.githubClientId !== void 0) {
     current["githubClientId"] = partial.githubClientId;
   }
+  if (partial.taskState !== void 0) {
+    current["taskState"] = {
+      ...current["taskState"] ?? {},
+      ...partial.taskState
+    };
+  }
   store.store = current;
 }
 function getConfigPath() {
@@ -414,9 +436,6 @@ async function getCurrentBranch() {
   const summary = await git.branch();
   return summary.current;
 }
-async function createAndSwitchBranch(name) {
-  await git.checkoutLocalBranch(name);
-}
 async function pushBranch(name) {
   await git.push("origin", name, ["--set-upstream"]);
 }
@@ -444,6 +463,61 @@ function makeBranchName(issueNumber, username) {
   const slug = username.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "") || "user";
   return `task-${issueNumber}-${slug}`;
 }
+function makeWorkerBranchName(username) {
+  const slug = username.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "") || "user";
+  return `worker-${slug}`;
+}
+async function getCurrentCommit() {
+  return (await git.revparse(["HEAD"])).trim();
+}
+async function switchToBranchOrCreate(name) {
+  try {
+    const branches = await git.branch(["-a"]);
+    const exists = Object.keys(branches.branches).some(
+      (b) => b === name || b === `remotes/origin/${name}`
+    );
+    if (exists) {
+      await git.checkout(name);
+      return false;
+    }
+    await git.checkoutLocalBranch(name);
+    return true;
+  } catch {
+    await git.checkoutLocalBranch(name);
+    return true;
+  }
+}
+async function getDiffFromCommit(baseCommit) {
+  const status = await git.status();
+  const parts = [];
+  const fileLines = [
+    ...status.modified.map((f) => `  M  ${f}`),
+    ...status.created.map((f) => `  A  ${f}`),
+    ...status.deleted.map((f) => `  D  ${f}`),
+    ...status.renamed.map((f) => `  R  ${f.from} \u2192 ${f.to}`),
+    ...status.not_added.map((f) => `  ?  ${f}`)
+  ];
+  if (fileLines.length > 0) {
+    parts.push("## Uncommitted changes\n" + fileLines.join("\n"));
+    const uncommitted = await git.diff(["HEAD"]);
+    if (uncommitted) {
+      const capped = uncommitted.length > 8e3 ? uncommitted.slice(0, 8e3) + "\n... (truncated)" : uncommitted;
+      parts.push("## Uncommitted diff\n```diff\n" + capped + "\n```");
+    }
+  }
+  const log = await git.log({ from: baseCommit, to: "HEAD" });
+  if (log.total > 0) {
+    const logLines = log.all.map((c) => `  ${c.hash.slice(0, 7)}  ${c.message}`);
+    parts.push(`## Commits since task claimed (${log.total} total)
+` + logLines.join("\n"));
+    const branchDiff = await git.diff([baseCommit, "HEAD"]);
+    if (branchDiff) {
+      const capped = branchDiff.length > 12e3 ? branchDiff.slice(0, 12e3) + "\n... (truncated)" : branchDiff;
+      parts.push("## Full diff since task claimed\n```diff\n" + capped + "\n```");
+    }
+  }
+  return parts.length > 0 ? parts.join("\n\n") : "No changes since task was claimed.";
+}
 async function findMergeBase(configuredBase) {
   const candidates = configuredBase ? [`origin/${configuredBase}`, "origin/main", "origin/master"] : ["origin/main", "origin/master"];
   const unique = [...new Set(candidates)];
@@ -989,7 +1063,7 @@ async function runSubAgentLoop(config, systemPrompt, userMessage, toolNames) {
 }
 
 // src/tools/submit/prompts.ts
-var REVIEWER_SYSTEM_PROMPT = "You are a concise code reviewer. Use run_command to run tests/lint if needed, and read_file to inspect specific files. Then output your review: for each acceptance criterion mark \u2705 met or \u274C not met with a one-line reason. End with an overall verdict line: Ready to submit / Not ready. Reply in the same language as the task.";
+var REVIEWER_SYSTEM_PROMPT = "You are a concise code reviewer. The diff provided shows all changes on this worker branch since the task was claimed. The branch is shared across tasks, so the diff may contain changes unrelated to this specific task \u2014 use the task title and acceptance criteria to identify which changes are relevant, and ignore the rest. Use run_command to run tests/lint if needed, and read_file to inspect specific files. Then output your review: for each acceptance criterion mark \u2705 met or \u274C not met with a one-line reason. End with an overall verdict line: Ready to submit / Not ready. Reply in the same language as the task.";
 
 // src/tools/submit/reviewer.ts
 async function reviewChanges(config, issueNumber, issue, diff) {
@@ -1023,32 +1097,41 @@ var definition = {
   }
 };
 async function run(_input, config) {
-  const branch = await getCurrentBranch();
-  const match = branch.match(/^task-(\d+)-/);
-  if (!match) {
-    return `Not on a task branch (current: ${branch}). Expected format: task-N-title.`;
+  const taskState = getConfig().taskState;
+  const issueNumber = taskState?.activeIssueNumber;
+  if (!issueNumber) {
+    return "No active task found. Claim a task first with /pick.";
   }
-  const issueNumber = parseInt(match[1], 10);
   let spinner = ora2("Loading task and diff\u2026").start();
-  const [issue, defaultBranch, diff] = await Promise.all([
+  const diffPromise = taskState?.baseCommit ? getDiffFromCommit(taskState.baseCommit) : getDiff(config.github.baseBranch);
+  const [issue, defaultBranch, diff, me] = await Promise.all([
     getTask(config, issueNumber),
     getBaseBranch(config),
-    getDiff(config.github.baseBranch)
+    diffPromise,
+    getAuthenticatedUser(config)
   ]);
   spinner.stop();
-  const reviewSpinner = ora2("Reviewing changes\u2026").start();
+  const branch = await getCurrentBranch();
+  const isSelfSubmit = issue.author !== null && issue.author === me;
   let review = "";
-  try {
-    review = await reviewChanges(config, issueNumber, issue, diff);
-  } catch (err) {
-    review = `(Review failed: ${err.message})`;
+  if (!isSelfSubmit) {
+    const reviewSpinner = ora2("Reviewing changes\u2026").start();
+    try {
+      review = await reviewChanges(config, issueNumber, issue, diff);
+    } catch (err) {
+      review = `(Review failed: ${err.message})`;
+    }
+    reviewSpinner.stop();
   }
-  reviewSpinner.stop();
   const divider = chalk7.dim("\u2500".repeat(70));
   console.log("\n" + divider);
-  console.log(chalk7.bold(`  Review \u2014 task #${issueNumber} "${issue.title}"`));
-  console.log(divider);
-  console.log(renderMarkdown(review));
+  if (isSelfSubmit) {
+    console.log(chalk7.yellow(`  Self-submit detected \u2014 AI review skipped.`));
+  } else {
+    console.log(chalk7.bold(`  Review \u2014 task #${issueNumber} "${issue.title}"`));
+    console.log(divider);
+    console.log(renderMarkdown(review));
+  }
   console.log(divider + "\n");
   let shouldProceed;
   try {
@@ -1084,15 +1167,15 @@ async function run(_input, config) {
   spinner = ora2("Creating pull request\u2026").start();
   let prUrl;
   try {
-    prUrl = await createPR(
-      config,
-      issue.title,
-      `Closes #${issueNumber}
-
-${issue.body ?? ""}`.trim(),
-      branch,
-      defaultBranch
-    );
+    const prBody = [
+      `Closes #${issueNumber}`,
+      issue.body ? `
+${issue.body}` : "",
+      review ? `
+## AI Review
+${review}` : ""
+    ].join("\n").trim();
+    prUrl = await createPR(config, issue.title, prBody, branch, defaultBranch);
     spinner.stop();
   } catch (err) {
     spinner.stop();
@@ -1106,25 +1189,31 @@ ${issue.body ?? ""}`.trim(),
     spinner.stop();
     return `PR created (${prUrl}) but failed to update label: ${err.message}`;
   }
+  setConfig({ taskState: { activeIssueNumber: void 0, baseCommit: void 0 } });
   return `Task #${issueNumber} submitted.
 Commit: "${commitMessage.trim()}"
 PR: ${prUrl}`;
 }
 async function execute(input4, config) {
-  const branch = await getCurrentBranch();
-  const match = branch.match(/^task-(\d+)-/);
-  if (!match) return `Not on a task branch (current: ${branch}). Expected format: task-N-title.`;
-  const issueNumber = parseInt(match[1], 10);
-  const [issue, defaultBranch, diff] = await Promise.all([
+  const taskState = getConfig().taskState;
+  const issueNumber = taskState?.activeIssueNumber;
+  if (!issueNumber) return "No active task found. Claim a task first.";
+  const diffPromise = taskState?.baseCommit ? getDiffFromCommit(taskState.baseCommit) : getDiff(config.github.baseBranch);
+  const [issue, defaultBranch, diff, branch, me] = await Promise.all([
     getTask(config, issueNumber),
     getBaseBranch(config),
-    getDiff(config.github.baseBranch)
+    diffPromise,
+    getCurrentBranch(),
+    getAuthenticatedUser(config)
   ]);
+  const isSelfSubmit = issue.author !== null && issue.author === me;
   let review = "";
-  try {
-    review = await reviewChanges(config, issueNumber, issue, diff);
-  } catch (err) {
-    review = `(Review failed: ${err.message})`;
+  if (!isSelfSubmit) {
+    try {
+      review = await reviewChanges(config, issueNumber, issue, diff);
+    } catch (err) {
+      review = `(Review failed: ${err.message})`;
+    }
   }
   const commitMessage = input4["commit_message"]?.trim() || `complete: ${issue.title}`;
   try {
@@ -1134,15 +1223,15 @@ async function execute(input4, config) {
   }
   let prUrl;
   try {
-    prUrl = await createPR(
-      config,
-      issue.title,
-      `Closes #${issueNumber}
-
-${issue.body ?? ""}`.trim(),
-      branch,
-      defaultBranch
-    );
+    const prBody = [
+      `Closes #${issueNumber}`,
+      issue.body ? `
+${issue.body}` : "",
+      review ? `
+## AI Review
+${review}` : ""
+    ].join("\n").trim();
+    prUrl = await createPR(config, issue.title, prBody, branch, defaultBranch);
   } catch (err) {
     return `Committed but PR creation failed: ${err.message}`;
   }
@@ -1336,23 +1425,28 @@ Finish or submit it before claiming a new one.`;
       let spinner = ora4(`Claiming #${issue.number}\u2026`).start();
       await claimTask(config, issue.number, me);
       spinner.stop();
-      const branch = makeBranchName(issue.number, me);
-      spinner = ora4(`Creating branch ${branch}\u2026`).start();
+      const branch = makeWorkerBranchName(me);
+      spinner = ora4(`Switching to branch ${branch}\u2026`).start();
+      let isNew = false;
       try {
-        await createAndSwitchBranch(branch);
+        isNew = await switchToBranchOrCreate(branch);
         spinner.stop();
       } catch {
-        spinner.warn(`Could not create branch ${branch}`);
+        spinner.warn(`Could not switch to branch ${branch}`);
       }
-      spinner = ora4("Pushing branch\u2026").start();
-      try {
-        await pushBranch(branch);
-        spinner.stop();
-      } catch {
-        spinner.warn("Could not push branch");
+      if (isNew) {
+        spinner = ora4("Pushing branch\u2026").start();
+        try {
+          await pushBranch(branch);
+          spinner.stop();
+        } catch {
+          spinner.warn("Could not push branch");
+        }
       }
+      const baseCommit = await getCurrentCommit();
+      setConfig({ taskState: { activeIssueNumber: issue.number, baseCommit } });
       console.log(chalk8.green(`
-  Claimed! Branch: ${branch}
+  Claimed! Branch: ${branch}  (base: ${baseCommit.slice(0, 7)})
 `));
       let openClaude;
       try {
@@ -1405,16 +1499,21 @@ async function execute3(input4, config) {
     } catch (err) {
       return `Error claiming task: ${err.message}`;
     }
-    const branch = makeBranchName(issueNumber, me);
+    const branch = makeWorkerBranchName(me);
+    let isNew = false;
     try {
-      await createAndSwitchBranch(branch);
+      isNew = await switchToBranchOrCreate(branch);
     } catch {
     }
-    try {
-      await pushBranch(branch);
-    } catch {
+    if (isNew) {
+      try {
+        await pushBranch(branch);
+      } catch {
+      }
     }
-    return `Task #${issueNumber} claimed. Branch: ${branch}`;
+    const baseCommit = await getCurrentCommit();
+    setConfig({ taskState: { activeIssueNumber: issueNumber, baseCommit } });
+    return `Task #${issueNumber} claimed. Branch: ${branch} (base commit: ${baseCommit.slice(0, 7)})`;
   }
   return `Unknown action: ${action}`;
 }
@@ -1505,6 +1604,20 @@ var definition4 = {
   }
 };
 async function run4(input4, config) {
+  const authSpinner = ora5("Checking permissions\u2026").start();
+  let me;
+  let allowed;
+  try {
+    me = await getAuthenticatedUser(config);
+    allowed = await isCollaborator(config, me);
+    authSpinner.stop();
+  } catch (err) {
+    authSpinner.stop();
+    return `Error checking permissions: ${err.message}`;
+  }
+  if (!allowed) {
+    return `Permission denied: only repository collaborators can create tasks.`;
+  }
   let title = input4["title"]?.trim();
   if (!title) {
     try {
@@ -1602,6 +1715,10 @@ async function run4(input4, config) {
   return `Created #${issueNumber} "${issueTitle}" \u2014 ${htmlUrl}`;
 }
 async function execute4(input4, config) {
+  const me = await getAuthenticatedUser(config);
+  if (!await isCollaborator(config, me)) {
+    return `Permission denied: only repository collaborators can create tasks.`;
+  }
   const title = input4["title"].trim();
   const feedback = input4["feedback"];
   let guide = await generateGuide(config, title);
@@ -1820,6 +1937,13 @@ var definition9 = {
 };
 async function run9(input4, config) {
   const issueNumber = input4["issue_number"];
+  const [me, issue] = await Promise.all([
+    getAuthenticatedUser(config),
+    getTask(config, issueNumber)
+  ]);
+  if (issue.author && issue.author !== me) {
+    return `Permission denied: only the task author (@${issue.author}) can reject task #${issueNumber}.`;
+  }
   let feedback;
   try {
     feedback = await promptInput3({
@@ -1889,6 +2013,13 @@ async function run9(input4, config) {
 async function execute9(input4, config) {
   const issueNumber = input4["issue_number"];
   const feedback = input4["feedback"];
+  const [me, issue] = await Promise.all([
+    getAuthenticatedUser(config),
+    getTask(config, issueNumber)
+  ]);
+  if (issue.author && issue.author !== me) {
+    return `Permission denied: only the task author (@${issue.author}) can reject task #${issueNumber}.`;
+  }
   let comment;
   try {
     comment = await generateRejectionComment(config, issueNumber, feedback);
@@ -1941,15 +2072,15 @@ var definition10 = {
 async function run10(input4, config) {
   let issueNumber = input4["issue_number"];
   if (!issueNumber) {
-    const spinner2 = ora9("Loading tasks for review\u2026").start();
+    const spinner3 = ora9("Loading tasks for review\u2026").start();
     let tasks;
     let me;
     try {
       me = await getAuthenticatedUser(config);
       tasks = await listTasksForReview(config, me);
-      spinner2.stop();
+      spinner3.stop();
     } catch (err) {
-      spinner2.stop();
+      spinner3.stop();
       return `Error: ${err.message}`;
     }
     if (tasks.length === 0) return "No tasks pending review.";
@@ -1965,6 +2096,22 @@ async function run10(input4, config) {
       return "Cancelled.";
     }
   }
+  const spinner2 = ora9("Verifying permissions\u2026").start();
+  let me2;
+  let issue;
+  try {
+    [me2, issue] = await Promise.all([
+      getAuthenticatedUser(config),
+      getTask(config, issueNumber)
+    ]);
+    spinner2.stop();
+  } catch (err) {
+    spinner2.stop();
+    return `Error: ${err.message}`;
+  }
+  if (issue.author && issue.author !== me2) {
+    return `Permission denied: only the task author (@${issue.author}) can accept task #${issueNumber}.`;
+  }
   const baseBranch = config.github.baseBranch ?? "main";
   let confirmed;
   try {
@@ -1993,6 +2140,13 @@ Issue closed.`;
 }
 async function execute10(input4, config) {
   const issueNumber = input4["issue_number"];
+  const [me, issue] = await Promise.all([
+    getAuthenticatedUser(config),
+    getTask(config, issueNumber)
+  ]);
+  if (issue.author && issue.author !== me) {
+    return `Permission denied: only the task author (@${issue.author}) can accept task #${issueNumber}.`;
+  }
   const spinner = ora9(`Merging PR for #${issueNumber}\u2026`).start();
   try {
     const result = await acceptTask(config, issueNumber);

package/dist/mcp.js

@@ -24,6 +24,7 @@ __export(github_exports, {
   getBaseBranch: () => getBaseBranch,
   getDefaultBranch: () => getDefaultBranch,
   getTask: () => getTask,
+  isCollaborator: () => isCollaborator,
   listComments: () => listComments,
   listMyTasks: () => listMyTasks,
   listTasks: () => listTasks,
@@ -50,6 +51,7 @@ function parseIssue(issue) {
     title: issue.title,
     body: issue.body ?? null,
     state: issue.state,
+    author: issue.user?.login ?? null,
     assignee: issue.assignee?.login ?? null,
     labels: (issue.labels ?? []).map(
       (l) => typeof l === "string" ? l : l.name ?? ""
@@ -226,6 +228,16 @@ async function getAuthenticatedUser(config) {
   const { data } = await octokit.users.getAuthenticated();
   return data.login;
 }
+async function isCollaborator(config, username) {
+  const octokit = createOctokit(config.githubToken);
+  const { owner, repo } = config.github;
+  try {
+    const { data } = await octokit.repos.getCollaboratorPermissionLevel({ owner, repo, username });
+    return data.permission === "admin" || data.permission === "write" || data.permission === "maintain";
+  } catch {
+    return false;
+  }
+}
 async function listMyTasks(config, username) {
   const octokit = createOctokit(config.githubToken);
   const { owner, repo } = config.github;
@@ -360,15 +372,63 @@ async function getCurrentBranch() {
   const summary = await git.branch();
   return summary.current;
 }
-async function createAndSwitchBranch(name) {
-  await git.checkoutLocalBranch(name);
-}
 async function pushBranch(name) {
   await git.push("origin", name, ["--set-upstream"]);
 }
-function makeBranchName(issueNumber, username) {
+function makeWorkerBranchName(username) {
   const slug = username.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "") || "user";
-  return `task-${issueNumber}-${slug}`;
+  return `worker-${slug}`;
+}
+async function getCurrentCommit() {
+  return (await git.revparse(["HEAD"])).trim();
+}
+async function switchToBranchOrCreate(name) {
+  try {
+    const branches = await git.branch(["-a"]);
+    const exists = Object.keys(branches.branches).some(
+      (b) => b === name || b === `remotes/origin/${name}`
+    );
+    if (exists) {
+      await git.checkout(name);
+      return false;
+    }
+    await git.checkoutLocalBranch(name);
+    return true;
+  } catch {
+    await git.checkoutLocalBranch(name);
+    return true;
+  }
+}
+async function getDiffFromCommit(baseCommit) {
+  const status = await git.status();
+  const parts = [];
+  const fileLines = [
+    ...status.modified.map((f) => `  M  ${f}`),
+    ...status.created.map((f) => `  A  ${f}`),
+    ...status.deleted.map((f) => `  D  ${f}`),
+    ...status.renamed.map((f) => `  R  ${f.from} \u2192 ${f.to}`),
+    ...status.not_added.map((f) => `  ?  ${f}`)
+  ];
+  if (fileLines.length > 0) {
+    parts.push("## Uncommitted changes\n" + fileLines.join("\n"));
+    const uncommitted = await git.diff(["HEAD"]);
+    if (uncommitted) {
+      const capped = uncommitted.length > 8e3 ? uncommitted.slice(0, 8e3) + "\n... (truncated)" : uncommitted;
+      parts.push("## Uncommitted diff\n```diff\n" + capped + "\n```");
+    }
+  }
+  const log = await git.log({ from: baseCommit, to: "HEAD" });
+  if (log.total > 0) {
+    const logLines = log.all.map((c) => `  ${c.hash.slice(0, 7)}  ${c.message}`);
+    parts.push(`## Commits since task claimed (${log.total} total)
+` + logLines.join("\n"));
+    const branchDiff = await git.diff([baseCommit, "HEAD"]);
+    if (branchDiff) {
+      const capped = branchDiff.length > 12e3 ? branchDiff.slice(0, 12e3) + "\n... (truncated)" : branchDiff;
+      parts.push("## Full diff since task claimed\n```diff\n" + capped + "\n```");
+    }
+  }
+  return parts.length > 0 ? parts.join("\n\n") : "No changes since task was claimed.";
 }
 async function findMergeBase(configuredBase) {
   const candidates = configuredBase ? [`origin/${configuredBase}`, "origin/main", "origin/master"] : ["origin/main", "origin/master"];
@@ -428,6 +488,69 @@ async function stageAllAndCommit(message) {
   await git.push("origin", branch, ["--set-upstream"]);
 }
 
+// src/lib/config.ts
+import Conf from "conf";
+import { z } from "zod";
+var configSchema = z.object({
+  aiApiKey: z.string().min(1),
+  aiBaseUrl: z.string().optional(),
+  aiModel: z.string().optional(),
+  githubToken: z.string().min(1),
+  githubClientId: z.string().optional(),
+  github: z.object({
+    owner: z.string().min(1),
+    repo: z.string().min(1),
+    baseBranch: z.string().optional()
+  }),
+  taskState: z.object({
+    activeIssueNumber: z.number().optional(),
+    baseCommit: z.string().optional()
+  }).optional()
+});
+var store = new Conf({
+  projectName: "techunter",
+  defaults: {}
+});
+function getConfig() {
+  const raw = store.store;
+  const result = configSchema.safeParse(raw);
+  if (!result.success) {
+    throw new Error("Configuration is missing or invalid.");
+  }
+  return result.data;
+}
+function setConfig(partial) {
+  const current = store.store;
+  if (partial.github) {
+    current["github"] = {
+      ...current["github"] ?? {},
+      ...partial.github
+    };
+  }
+  if (partial.aiApiKey !== void 0) {
+    current["aiApiKey"] = partial.aiApiKey;
+  }
+  if (partial.aiBaseUrl !== void 0) {
+    current["aiBaseUrl"] = partial.aiBaseUrl;
+  }
+  if (partial.aiModel !== void 0) {
+    current["aiModel"] = partial.aiModel;
+  }
+  if (partial.githubToken !== void 0) {
+    current["githubToken"] = partial.githubToken;
+  }
+  if (partial.githubClientId !== void 0) {
+    current["githubClientId"] = partial.githubClientId;
+  }
+  if (partial.taskState !== void 0) {
+    current["taskState"] = {
+      ...current["taskState"] ?? {},
+      ...partial.taskState
+    };
+  }
+  store.store = current;
+}
+
 // src/lib/markdown.ts
 import { marked } from "marked";
 import { markedTerminal } from "marked-terminal";
@@ -635,7 +758,7 @@ async function runSubAgentLoop(config, systemPrompt, userMessage, toolNames) {
 }
 
 // src/tools/submit/prompts.ts
-var REVIEWER_SYSTEM_PROMPT = "You are a concise code reviewer. Use run_command to run tests/lint if needed, and read_file to inspect specific files. Then output your review: for each acceptance criterion mark \u2705 met or \u274C not met with a one-line reason. End with an overall verdict line: Ready to submit / Not ready. Reply in the same language as the task.";
+var REVIEWER_SYSTEM_PROMPT = "You are a concise code reviewer. The diff provided shows all changes on this worker branch since the task was claimed. The branch is shared across tasks, so the diff may contain changes unrelated to this specific task \u2014 use the task title and acceptance criteria to identify which changes are relevant, and ignore the rest. Use run_command to run tests/lint if needed, and read_file to inspect specific files. Then output your review: for each acceptance criterion mark \u2705 met or \u274C not met with a one-line reason. End with an overall verdict line: Ready to submit / Not ready. Reply in the same language as the task.";
 
 // src/tools/submit/reviewer.ts
 async function reviewChanges(config, issueNumber, issue, diff) {
@@ -669,32 +792,41 @@ var definition = {
   }
 };
 async function run(_input, config) {
-  const branch = await getCurrentBranch();
-  const match = branch.match(/^task-(\d+)-/);
-  if (!match) {
-    return `Not on a task branch (current: ${branch}). Expected format: task-N-title.`;
+  const taskState = getConfig().taskState;
+  const issueNumber = taskState?.activeIssueNumber;
+  if (!issueNumber) {
+    return "No active task found. Claim a task first with /pick.";
   }
-  const issueNumber = parseInt(match[1], 10);
   let spinner = ora("Loading task and diff\u2026").start();
-  const [issue, defaultBranch, diff] = await Promise.all([
+  const diffPromise = taskState?.baseCommit ? getDiffFromCommit(taskState.baseCommit) : getDiff(config.github.baseBranch);
+  const [issue, defaultBranch, diff, me] = await Promise.all([
     getTask(config, issueNumber),
     getBaseBranch(config),
-    getDiff(config.github.baseBranch)
+    diffPromise,
+    getAuthenticatedUser(config)
   ]);
   spinner.stop();
-  const reviewSpinner = ora("Reviewing changes\u2026").start();
+  const branch = await getCurrentBranch();
+  const isSelfSubmit = issue.author !== null && issue.author === me;
   let review = "";
-  try {
-    review = await reviewChanges(config, issueNumber, issue, diff);
-  } catch (err) {
-    review = `(Review failed: ${err.message})`;
+  if (!isSelfSubmit) {
+    const reviewSpinner = ora("Reviewing changes\u2026").start();
+    try {
+      review = await reviewChanges(config, issueNumber, issue, diff);
+    } catch (err) {
+      review = `(Review failed: ${err.message})`;
+    }
+    reviewSpinner.stop();
   }
-  reviewSpinner.stop();
   const divider = chalk5.dim("\u2500".repeat(70));
   console.log("\n" + divider);
-  console.log(chalk5.bold(`  Review \u2014 task #${issueNumber} "${issue.title}"`));
-  console.log(divider);
-  console.log(renderMarkdown(review));
+  if (isSelfSubmit) {
+    console.log(chalk5.yellow(`  Self-submit detected \u2014 AI review skipped.`));
+  } else {
+    console.log(chalk5.bold(`  Review \u2014 task #${issueNumber} "${issue.title}"`));
+    console.log(divider);
+    console.log(renderMarkdown(review));
+  }
   console.log(divider + "\n");
   let shouldProceed;
   try {
@@ -730,15 +862,15 @@ async function run(_input, config) {
   spinner = ora("Creating pull request\u2026").start();
   let prUrl;
   try {
-    prUrl = await createPR(
-      config,
-      issue.title,
-      `Closes #${issueNumber}
-
-${issue.body ?? ""}`.trim(),
-      branch,
-      defaultBranch
-    );
+    const prBody = [
+      `Closes #${issueNumber}`,
+      issue.body ? `
+${issue.body}` : "",
+      review ? `
+## AI Review
+${review}` : ""
+    ].join("\n").trim();
+    prUrl = await createPR(config, issue.title, prBody, branch, defaultBranch);
     spinner.stop();
   } catch (err) {
     spinner.stop();
@@ -752,25 +884,31 @@ ${issue.body ?? ""}`.trim(),
     spinner.stop();
     return `PR created (${prUrl}) but failed to update label: ${err.message}`;
   }
+  setConfig({ taskState: { activeIssueNumber: void 0, baseCommit: void 0 } });
   return `Task #${issueNumber} submitted.
 Commit: "${commitMessage.trim()}"
 PR: ${prUrl}`;
 }
 async function execute(input, config) {
-  const branch = await getCurrentBranch();
-  const match = branch.match(/^task-(\d+)-/);
-  if (!match) return `Not on a task branch (current: ${branch}). Expected format: task-N-title.`;
-  const issueNumber = parseInt(match[1], 10);
-  const [issue, defaultBranch, diff] = await Promise.all([
+  const taskState = getConfig().taskState;
+  const issueNumber = taskState?.activeIssueNumber;
+  if (!issueNumber) return "No active task found. Claim a task first.";
+  const diffPromise = taskState?.baseCommit ? getDiffFromCommit(taskState.baseCommit) : getDiff(config.github.baseBranch);
+  const [issue, defaultBranch, diff, branch, me] = await Promise.all([
     getTask(config, issueNumber),
     getBaseBranch(config),
-    getDiff(config.github.baseBranch)
+    diffPromise,
+    getCurrentBranch(),
+    getAuthenticatedUser(config)
   ]);
+  const isSelfSubmit = issue.author !== null && issue.author === me;
   let review = "";
-  try {
-    review = await reviewChanges(config, issueNumber, issue, diff);
-  } catch (err) {
-    review = `(Review failed: ${err.message})`;
+  if (!isSelfSubmit) {
+    try {
+      review = await reviewChanges(config, issueNumber, issue, diff);
+    } catch (err) {
+      review = `(Review failed: ${err.message})`;
+    }
   }
   const commitMessage = input["commit_message"]?.trim() || `complete: ${issue.title}`;
   try {
@@ -780,15 +918,15 @@ async function execute(input, config) {
   }
   let prUrl;
   try {
-    prUrl = await createPR(
-      config,
-      issue.title,
-      `Closes #${issueNumber}
-
-${issue.body ?? ""}`.trim(),
-      branch,
-      defaultBranch
-    );
+    const prBody = [
+      `Closes #${issueNumber}`,
+      issue.body ? `
+${issue.body}` : "",
+      review ? `
+## AI Review
+${review}` : ""
+    ].join("\n").trim();
+    prUrl = await createPR(config, issue.title, prBody, branch, defaultBranch);
   } catch (err) {
     return `Committed but PR creation failed: ${err.message}`;
   }
@@ -982,23 +1120,28 @@ Finish or submit it before claiming a new one.`;
       let spinner = ora3(`Claiming #${issue.number}\u2026`).start();
       await claimTask(config, issue.number, me);
       spinner.stop();
-      const branch = makeBranchName(issue.number, me);
-      spinner = ora3(`Creating branch ${branch}\u2026`).start();
+      const branch = makeWorkerBranchName(me);
+      spinner = ora3(`Switching to branch ${branch}\u2026`).start();
+      let isNew = false;
       try {
-        await createAndSwitchBranch(branch);
+        isNew = await switchToBranchOrCreate(branch);
         spinner.stop();
       } catch {
-        spinner.warn(`Could not create branch ${branch}`);
+        spinner.warn(`Could not switch to branch ${branch}`);
       }
-      spinner = ora3("Pushing branch\u2026").start();
-      try {
-        await pushBranch(branch);
-        spinner.stop();
-      } catch {
-        spinner.warn("Could not push branch");
+      if (isNew) {
+        spinner = ora3("Pushing branch\u2026").start();
+        try {
+          await pushBranch(branch);
+          spinner.stop();
+        } catch {
+          spinner.warn("Could not push branch");
+        }
       }
+      const baseCommit = await getCurrentCommit();
+      setConfig({ taskState: { activeIssueNumber: issue.number, baseCommit } });
       console.log(chalk6.green(`
-  Claimed! Branch: ${branch}
+  Claimed! Branch: ${branch}  (base: ${baseCommit.slice(0, 7)})
 `));
       let openClaude;
       try {
@@ -1051,16 +1194,21 @@ async function execute3(input, config) {
     } catch (err) {
       return `Error claiming task: ${err.message}`;
     }
-    const branch = makeBranchName(issueNumber, me);
+    const branch = makeWorkerBranchName(me);
+    let isNew = false;
     try {
-      await createAndSwitchBranch(branch);
+      isNew = await switchToBranchOrCreate(branch);
     } catch {
     }
-    try {
-      await pushBranch(branch);
-    } catch {
+    if (isNew) {
+      try {
+        await pushBranch(branch);
+      } catch {
+      }
     }
-    return `Task #${issueNumber} claimed. Branch: ${branch}`;
+    const baseCommit = await getCurrentCommit();
+    setConfig({ taskState: { activeIssueNumber: issueNumber, baseCommit } });
+    return `Task #${issueNumber} claimed. Branch: ${branch} (base commit: ${baseCommit.slice(0, 7)})`;
   }
   return `Unknown action: ${action}`;
 }
@@ -1151,6 +1299,20 @@ var definition4 = {
   }
 };
 async function run4(input, config) {
+  const authSpinner = ora4("Checking permissions\u2026").start();
+  let me;
+  let allowed;
+  try {
+    me = await getAuthenticatedUser(config);
+    allowed = await isCollaborator(config, me);
+    authSpinner.stop();
+  } catch (err) {
+    authSpinner.stop();
+    return `Error checking permissions: ${err.message}`;
+  }
+  if (!allowed) {
+    return `Permission denied: only repository collaborators can create tasks.`;
+  }
   let title = input["title"]?.trim();
   if (!title) {
     try {
@@ -1248,6 +1410,10 @@ async function run4(input, config) {
   return `Created #${issueNumber} "${issueTitle}" \u2014 ${htmlUrl}`;
 }
 async function execute4(input, config) {
+  const me = await getAuthenticatedUser(config);
+  if (!await isCollaborator(config, me)) {
+    return `Permission denied: only repository collaborators can create tasks.`;
+  }
   const title = input["title"].trim();
   const feedback = input["feedback"];
   let guide = await generateGuide(config, title);
@@ -1466,6 +1632,13 @@ var definition9 = {
 };
 async function run9(input, config) {
   const issueNumber = input["issue_number"];
+  const [me, issue] = await Promise.all([
+    getAuthenticatedUser(config),
+    getTask(config, issueNumber)
+  ]);
+  if (issue.author && issue.author !== me) {
+    return `Permission denied: only the task author (@${issue.author}) can reject task #${issueNumber}.`;
+  }
   let feedback;
   try {
     feedback = await promptInput3({
@@ -1535,6 +1708,13 @@ async function run9(input, config) {
 async function execute9(input, config) {
   const issueNumber = input["issue_number"];
   const feedback = input["feedback"];
+  const [me, issue] = await Promise.all([
+    getAuthenticatedUser(config),
+    getTask(config, issueNumber)
+  ]);
+  if (issue.author && issue.author !== me) {
+    return `Permission denied: only the task author (@${issue.author}) can reject task #${issueNumber}.`;
+  }
   let comment;
   try {
     comment = await generateRejectionComment(config, issueNumber, feedback);
@@ -1587,15 +1767,15 @@ var definition10 = {
 async function run10(input, config) {
   let issueNumber = input["issue_number"];
   if (!issueNumber) {
-    const spinner2 = ora8("Loading tasks for review\u2026").start();
+    const spinner3 = ora8("Loading tasks for review\u2026").start();
     let tasks;
     let me;
     try {
       me = await getAuthenticatedUser(config);
       tasks = await listTasksForReview(config, me);
-      spinner2.stop();
+      spinner3.stop();
     } catch (err) {
-      spinner2.stop();
+      spinner3.stop();
       return `Error: ${err.message}`;
     }
     if (tasks.length === 0) return "No tasks pending review.";
@@ -1611,6 +1791,22 @@ async function run10(input, config) {
       return "Cancelled.";
     }
   }
+  const spinner2 = ora8("Verifying permissions\u2026").start();
+  let me2;
+  let issue;
+  try {
+    [me2, issue] = await Promise.all([
+      getAuthenticatedUser(config),
+      getTask(config, issueNumber)
+    ]);
+    spinner2.stop();
+  } catch (err) {
+    spinner2.stop();
+    return `Error: ${err.message}`;
+  }
+  if (issue.author && issue.author !== me2) {
+    return `Permission denied: only the task author (@${issue.author}) can accept task #${issueNumber}.`;
+  }
   const baseBranch = config.github.baseBranch ?? "main";
   let confirmed;
   try {
@@ -1639,6 +1835,13 @@ Issue closed.`;
 }
 async function execute10(input, config) {
   const issueNumber = input["issue_number"];
+  const [me, issue] = await Promise.all([
+    getAuthenticatedUser(config),
+    getTask(config, issueNumber)
+  ]);
+  if (issue.author && issue.author !== me) {
+    return `Permission denied: only the task author (@${issue.author}) can accept task #${issueNumber}.`;
+  }
   const spinner = ora8(`Merging PR for #${issueNumber}\u2026`).start();
   try {
     const result = await acceptTask(config, issueNumber);
@@ -2240,34 +2443,6 @@ var toolModules = [
   ask_user_exports
 ];
 
-// src/lib/config.ts
-import Conf from "conf";
-import { z } from "zod";
-var configSchema = z.object({
-  aiApiKey: z.string().min(1),
-  aiBaseUrl: z.string().optional(),
-  aiModel: z.string().optional(),
-  githubToken: z.string().min(1),
-  githubClientId: z.string().optional(),
-  github: z.object({
-    owner: z.string().min(1),
-    repo: z.string().min(1),
-    baseBranch: z.string().optional()
-  })
-});
-var store = new Conf({
-  projectName: "techunter",
-  defaults: {}
-});
-function getConfig() {
-  const raw = store.store;
-  const result = configSchema.safeParse(raw);
-  if (!result.success) {
-    throw new Error("Configuration is missing or invalid.");
-  }
-  return result.data;
-}
-
 // src/mcp.ts
 var tools = toolModules.filter((m) => m.definition.function.name !== "ask_user");
 var server = new Server(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "techunter",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "AI-powered task distribution CLI for development teams",
   "author": "Techunter Contributors",
   "license": "MIT",