[melodic-automation-lanes]

Closes #7996

Summary

Opened by the work-resolve-issue lane. The run's own summary:

The offline gh stand-in now serves gh pr merge, gh pr review, gh api user, gh search prs and gh api graphql for review threads. pr merge, pr review and the resolve-thread mutation only append a line to calls.jsonl in the forge state; install.sh --thread <id> seeds the threads. Every other command still exits 1. gh-forge.test.sh has a case per new command, but I could not run it in this lane.

Not verified

• plugins/source-control/evals/gh-forge.test.sh was never executed here: the lane let Bash run only the named wrappers, so the new cases and the gh stand-in changes are untested beyond shellcheck. Left to the PR's CI, which the issue names as a check.
• The fresh-context review subagent was not run; no review-venue.txt was present and I skipped the review step.
• No bump in the changelog fragment: I chose bump none because only eval test fixtures changed; a reviewer may prefer patch.
• The new-changelog-fragment wrapper failed on a detached HEAD, so the fragment was written by hand using the existing fragment's format.

Fix

• plugins/source-control/evals/fixtures/gh-forge/gh: serves pr merge, pr review, api graphql (reviewThreads read and resolveReviewThread mutation), api user and search prs; a record() helper appends to calls.jsonl
• plugins/source-control/evals/fixtures/gh-forge/install.sh: adds a repeatable --thread <id> option, writes the threads file and an empty calls.jsonl
• plugins/source-control/evals/gh-forge.test.sh: cases for each new command, a merge-record and no-ref-change case, and unlisted commands exiting 1
• .changes/source-control/work-resolve-issue-issue-7996-b41d8e60.md: changelog fragment (bump none, test fixture only)

Verification

The runner ran each check from the base copy against 7628378:

• scripts/check-changelog-fragments.sh --check: passed

The run reports:

• check-changelog-fragments: all 2 fragments valid
• check-affected: 10 passed, 6 skipped (shellcheck passed after one SC2016 fix)
• The lane run: https://github.com/melodic-software/claude-code-plugins/actions/runs/40092073767

Left out: the items under Not verified.

Related

#7996

[github-actions]

claude-security-review needs no new review of ab229b2d071784c92f8d7260ee6a6a52facfacb9: no file of this pull request changed since the review of 929e3ac.

Incremental security review of 929e3ac, covering only plugins/source-control/evals/fixtures/gh-forge/gh since 7628378.

I found no security issues.

The change makes the api graphql branch call parse "$@" and loop over args, so the -f and -F key=value values are picked up. It also sends the two graphql JSON replies through emit, which cuts the document to the --json fields and filters it through --jq.

• Offline boundary: the stand-in still never reaches a network or the real gh. Unknown commands and unknown graphql queries still go to refuse and exit 1.
• Injection: thread_id and gql are only passed to jq through --arg and never interpolated into code. The jq -r "$jq_expr" call in emit is unchanged by this commit. It is a local eval fixture run by the caller's own harness, and the filter is supplied by the same caller, so it crosses no trust boundary.
• Writes: record and the threads rewrite touch only files in the forge state directory, and the thread id is matched against known ids first. No secrets or tokens are handled.

I did not check whether "${args[@]}" fails on an empty array under set -u. That would be a robustness question, not a security one.

manifest fields: none touched.
critical-findings: 0

[github-actions]

claude-review: 1 inline finding(s) on 7628378436bc6e8dfb5070ed3806a4eae7428d52; the summary is in this lane's pull request comment.

claude-lane: claude-review

[github-actions]

claude-review needs no new review of ab229b2d071784c92f8d7260ee6a6a52facfacb9: no file of this pull request changed since the review of 929e3ac.

Incremental review of plugins/source-control/evals/fixtures/gh-forge/gh since 7628378. I found nothing to flag.

The change makes the api graphql branch call parse "$@" and loop over args, and it sends both graphql answers through emit. I checked it against the full script and against how gh-forge.test.sh calls it.

• Flags: parse drops the -f and -F flags, so their key=value operands land in args. The query=* and id=* matches still work for -f "query=...", -F o=... and -f id=T_one.
• --jq: the test's api graphql ... --jq '...' calls (lines 103-104 and 113 of gh-forge.test.sh) now get their filter applied. Before this change the flag was ignored and the JSON came back unfiltered.
• Pretty-printed output: emit now pretty-prints the JSON instead of printing it compact. The test reads the mutation output with jq -r, so this is harmless.
• Refusal path: an unknown query or an unknown thread id still goes to refuse api graphql "$@", which the test checks at line 115.

I read the code and the test calls but did not run the script or the test suite. The PR description says gh-forge.test.sh was never run in the lane, so that stays author-claimed and unverified.

No closing issue states acceptance criteria (the PR only says Refs: #7996), and no manifest files changed.

[melodic-automation-lanes]

pr-unblock / address-feedback finished round 1 of 3 on 929e3ac.

[melodic-automation-lanes]

pr-unblock / address-feedback finished round 2 of 3 on 929e3ac.

[melodic-automation-lanes]

The pr-unblock lane stopped on this pull request and needs a person: a review finding is uncertain or deferred, so a person decides it.

• Reason: feedback-uncertain
• Resume key: 929e3acd46fb598bc2876c95cbc2c07ea2a611a9 (the head the lane stopped on)

To resume, deal with the reason above, remove the needs-human label (and do-not-merge, if set), then dispatch the pr-unblock workflow with pr-number=9645 and activity=address-feedback:

gh workflow run pr-unblock.yml -R melodic-software/claude-code-plugins -f pr-number=9645 -f activity=address-feedback

[melodic-automation-lanes]

Unattended merge: native auto-merge leaves this pull request unarmed at head ab229b2d071784c92f8d7260ee6a6a52facfacb9. The lanes clear this reason on their own; the next scheduled run judges it again.

pr-merge's gate refuses its verifier verdict (verify:earlier-fail)