Certify pm CLI 2026.9.23 and adopt the guarded pm-ops merge-driver launcher

[unbraind]

Summary

Fleet wave of 2026-09-25 (companion epic pm-cli-website-5s6z), applied by the fleet's deterministic wave script and verified by this repository's own gates.

• Certify pm CLI 2026.9.23, exact pins in package.json and package-lock.json: @unbrained/pm-cli 2026.9.21 -> 2026.9.23, pm-ops 2026.9.18 -> 2026.9.23, pm-changelog 2026.9.18 -> 2026.9.23.
• Guarded merge-driver launcher (companion pm-cli-website-xy19): scripts/prepare-merge-driver.ts is now the template pm-ops 2026.9.23 ships, copied unchanged (it replaces the static-import launcher). It imports nothing from pm-ops, so a production install of a clone (npm ci --omit=dev) skips with one notice instead of dying on ERR_MODULE_NOT_FOUND, while a stale or broken pm-ops still fails the install. prepare-merge-driver.test.ts compares the file byte-for-byte with node_modules/pm-ops/templates/prepare-merge-driver.ts (pm-ops covers every branch of that template with real fixtures) and runs it to prove the drivers register.

pm items

• pm-starter-50az: Chore, created, closed and released by this PR

Verification

Check	Result
git config --get-regexp '^merge\.pm' after npm ci	drivers registered
CI health block (pm health ... --require-merge-drivers), executed from ci.yml	exit 0
npm run release:check	exit 0 (verify-release-publish-attestation: every publish invocation is attested.)
changelog:full then changelog:check	regenerated after the pm writes, consistent

---

Summary by cubic

Certifies the pm CLI toolchain at 2026.9.23 and replaces the static-import merge-driver launcher with the guarded launcher template pm-ops ships.

• Pins @unbrained/pm-cli, pm-ops, and pm-changelog to 2026.9.23 in package.json and package-lock.json.
• scripts/prepare-merge-driver.ts is now a byte-identical copy of the pm-ops template; it imports nothing from pm-ops, so an omit-dev install of a clone skips with one notice instead of failing, while a stale or broken pm-ops still fails the install.
• Adds test/prepare-merge-driver.test.ts to keep the script byte-identical to the pinned template and prove the drivers register in fresh checkouts.

^{Written for commit a9fd2ac. Summary will update on new commits.}

[sourcery-ai]

Sorry @unbraind, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 3 days and 21 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: c1c5a666-50d7-4913-bd57-2e3311134919

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Reviewer's Guide

Certifies the pm toolchain at 2026.9.23 and adopts its guarded merge-driver launcher, which dynamically invokes pm-ops, skips cleanly for omit-dev installs, and fails clearly for stale or broken dependencies; new integration tests validate synchronization and all key installation outcomes.

Sequence diagram for guarded merge-driver installation

sequenceDiagram
    participant npm as npm prepare
    participant Launcher as prepare-merge-driver.ts
    participant Resolver as Node module resolver
    participant PMOps as pm-ops installer
    participant Git as Git config

    npm->>Launcher: execute
    Launcher->>Resolver: resolve pm-ops/merge-driver/prepare
    alt pm-ops is absent
        Resolver-->>Launcher: MODULE_NOT_FOUND
        Launcher->>Resolver: resolve pm-ops/package.json
        Resolver-->>Launcher: package absent
        Launcher-->>npm: print skip notice
    else pm-ops is installed
        Resolver-->>Launcher: installer path
        Launcher->>PMOps: spawnSync(process.execPath, installer)
        PMOps->>Git: pm merge install
        Git-->>PMOps: drivers registered
        PMOps-->>Launcher: exit status
        Launcher-->>npm: propagate status
    end
    alt pm-ops is stale or installer fails
        Resolver-->>Launcher: resolution error
        Launcher-->>npm: fail install
    end

Loading

File-Level Changes

Change	Details	Files
Upgrade the pm toolchain to the certified 2026.9.23 release set.	Pin pm CLI, pm-ops, and pm-changelog to 2026.9.23. Refresh the corresponding lockfile resolutions and integrity metadata.	package.json package-lock.json
Replace the merge-driver hook with the guarded pm-ops launcher template.	Resolve the pm-ops installer dynamically without importing it, allowing omit-dev installs to skip when the package is absent. Fail on installed-but-incompatible pm-ops versions and propagate installer failures or termination. Keep the repository launcher byte-for-byte synchronized with the pinned pm-ops template.	scripts/prepare-merge-driver.ts README.md
Add integration coverage for merge-driver installation behavior.	Verify template byte identity and registration of every driver declared by .gitattributes. Cover absent pm-ops, stale exports, failing pm commands, and signal termination using isolated Git checkout fixtures.	test/prepare-merge-driver.test.ts
Record the fleet chore and generated release documentation.	Add the pm chore and history records. Add an Unreleased changelog entry describing the certification and launcher adoption.	.agents/pm/chores/pm-starter-50az.toon .agents/pm/history/pm-starter-50az.jsonl CHANGELOG.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[greptile-apps]

Confidence Score: 5/5

[High risk] Updates build and development toolchain versions.

The PR appears safe to merge; this review found no new actionable issue.

Summary

The PR pins the pm development toolchain to 2026.9.23 and replaces the merge-driver prepare hook with the guarded launcher shipped by pm-ops.

• Adds a template-identity check and checkout fixtures for driver registration, omission, stale packages, and installer failures.
• Records the certification work item and updates the changelog and README.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[npm prepare] --> B[Resolve pm-ops installer from checkout]
  B -->|Package absent| C[Print skip notice]
  B -->|Installer resolved| D[Run installer in child process]
  B -->|Other resolution failure| E[Fail install]
  D -->|Success| F[Merge drivers registered]
  D -->|Failure| E

Loading

_{Reviews (2) · Last reviewed commit: "Certify pm CLI 2026.9.23 and adopt the g..."}

[unbraind]

@greptileai review

[unbraind]

Review round complete before merge. All 2 inline bot threads were answered in-thread, and each was either fixed in this PR or tracked on the companion hub (launcher template: pm-cli-website-dqg7; release-workflow verifier: pm-cli-website-mxrp). Greptile's latest review covers the current head a9fd2ac with Confidence Score: 5/5. Sourcery skipped this head (its weekly diff allowance), so its earlier findings on this PR are the last it gave, and all were answered. CodeRabbit posted only its free-plan notice: this repository has fewer than 10 stars, so it doesn't review automatically, and its one-review-per-hour allowance is kept for PRs that need it. Every required check is green on a9fd2ac.