Certify pm CLI 2026.9.23 and adopt the guarded pm-ops merge-driver launcher

[unbraind]

Summary

Fleet wave of 2026-09-25 (companion epic pm-cli-website-5s6z), applied by the fleet's deterministic wave script and verified by this repository's own gates.

• Certify pm CLI 2026.9.23, exact pins in package.json and package-lock.json: @unbrained/pm-cli 2026.9.21 -> 2026.9.23, pm-ops 2026.9.18 -> 2026.9.23, pm-changelog 2026.9.18 -> 2026.9.23.
• Guarded merge-driver launcher (companion pm-cli-website-xy19): scripts/prepare-merge-driver.ts is now the template pm-ops 2026.9.23 ships, copied unchanged (it replaces the static-import launcher). It imports nothing from pm-ops, so a production install of a clone (npm ci --omit=dev) skips with one notice instead of dying on ERR_MODULE_NOT_FOUND, while a stale or broken pm-ops still fails the install. prepare-merge-driver.test.ts compares the file byte-for-byte with node_modules/pm-ops/templates/prepare-merge-driver.ts (pm-ops covers every branch of that template with real fixtures) and runs it to prove the drivers register.

pm items

• pm-ts-starter-r5s2: Chore, created, closed and released by this PR

Verification

Check	Result
git config --get-regexp '^merge\.pm' after npm ci	drivers registered
CI health block (pm health ... --require-merge-drivers), executed from ci.yml	exit 0
npm run release:check	exit 0 (ok - the flag changes the heading: '## 2026.1.2 - 2026-01-02' with it, '## 2026.1.2' witho)
changelog:full then changelog:check	regenerated after the pm writes, consistent

Summary by Sourcery

Certify the 2026.9.23 pm tooling and adopt its guarded merge-driver launcher for reliable clone installation.

Bug Fixes:

• Make production clone installs succeed when the development-only pm-ops package is absent while still failing for stale or broken pm-ops installations.

Enhancements:

• Adopt the guarded pm-ops merge-driver launcher and document its behavior for full and production installs.
• Certify the pm CLI, pm-ops, and pm-changelog dependencies at version 2026.9.23.

Documentation:

• Update the README to describe the canonical guarded merge-driver launcher and its install behavior.

Tests:

• Add coverage for launcher-template parity, merge-driver registration, omitted dependencies, stale pm-ops packages, installer failures, and signal termination.

Chores:

• Record the completed project-management chore and update the changelog.

---

Summary by cubic

Certifies the pm CLI toolchain to 2026.9.23 and replaces the merge-driver prepare hook with the guarded launcher template pm-ops ships.

• Pins @unbrained/pm-cli 2026.9.21 → 2026.9.23, pm-ops 2026.9.18 → 2026.9.23, and pm-changelog 2026.9.18 → 2026.9.23 in package.json and package-lock.json.
• The launcher imports nothing from pm-ops, so an omit-dev production install of a clone skips merge-driver registration with one notice instead of failing on ERR_MODULE_NOT_FOUND; a stale or broken pm-ops still fails the install.
• The test suite keeps the launcher byte-identical to the pinned pm-ops template and runs it in fresh checkouts to confirm every declared driver registers.

^{Written for commit 749f23d. Summary will update on new commits.}

[sourcery-ai]

Sorry @unbraind, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 3 days and 21 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a0ca8567-5487-4f90-aedd-bfff1cf22e4c

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Reviewer's Guide

This PR upgrades the pm toolchain to 2026.9.23 and adopts its guarded merge-driver template, resolving pm-ops dynamically so omit-dev installs skip safely while stale packages and installer failures remain fatal. Tests model fresh consumer checkouts and validate template identity, driver registration, and failure propagation.

Sequence diagram for guarded merge-driver installation

sequenceDiagram
    participant NPM
    participant Launcher as prepare-merge-driver.ts
    participant Resolver as Node module resolver
    participant PMOps as pm-ops installer
    participant Git as Git config

    NPM->>Launcher: run prepare script
    Launcher->>Resolver: resolve pm-ops/merge-driver/prepare
    alt pm-ops absent
        Resolver-->>Launcher: MODULE_NOT_FOUND
        Launcher->>Resolver: probe pm-ops/package.json
        Resolver-->>Launcher: package absent
        Launcher-->>NPM: print notice and skip
    else pm-ops available
        Resolver-->>Launcher: installer path
        Launcher->>PMOps: spawn installer
        PMOps->>Git: register merge drivers
        Git-->>PMOps: registration result
        PMOps-->>Launcher: exit status
        Launcher-->>NPM: propagate status
    end

Loading

File-Level Changes

Change	Details	Files
Certify the repository against the 2026.9.23 pm toolchain.	Pin pm CLI, pm-ops, and pm-changelog to 2026.9.23 in manifests and lockfile. Record the pm chore and generated changelog entry. Update release and project-management documentation for the new launcher behavior.	package.json package-lock.json CHANGELOG.md README.md .agents/pm/chores/pm-ts-starter-r5s2.toon .agents/pm/history/pm-ts-starter-r5s2.jsonl
Replace the static pm-ops import with a guarded child-process launcher.	Resolve the pm-ops prepare entry at runtime without importing pm-ops. Skip only when pm-ops is absent, with a single notice for omit-dev installs. Propagate package-resolution failures and installer exit or signal failures. Keep the launcher byte-for-byte aligned with the pinned pm-ops template.	scripts/prepare-merge-driver.ts
Expand merge-driver launcher coverage around real install scenarios.	Compare the repository launcher byte-for-byte with the installed pm-ops template. Exercise pinned, absent, stale, failing, and signal-terminated pm-ops/pm fixtures. Verify fresh checkout Git configuration registers exactly the drivers declared by .gitattributes.	test/prepare-merge-driver.test.ts

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[greptile-apps]

Confidence Score: 5/5

[High risk] Updates build toolchain and replaces merge-driver launcher implementation.

The PR appears safe to merge based on the current review.

Summary

The PR pins the pm CLI toolchain to 2026.9.23 and replaces the static-import prepare hook with the guarded pm-ops launcher.

• Adds fresh-checkout tests for driver registration and launcher failure paths.
• Updates the installation guidance, changelog, and project-management record.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[npm prepare] --> B{pm-ops installer resolves?}
  B -- Yes --> C[Run installer]
  C --> D[Preserve installer exit status]
  B -- No --> E{pm-ops absent?}
  E -- Yes --> F[Skip with notice]
  E -- No --> G[Fail installation]

Loading

_{Reviews (2) · Last reviewed commit: "Certify pm CLI 2026.9.23 and adopt the g..."}

[unbraind]

@greptileai review

[unbraind]

Review round complete before merge. All 2 inline bot threads were answered in-thread, and each was either fixed in this PR or tracked on the companion hub (launcher template: pm-cli-website-dqg7; release-workflow verifier: pm-cli-website-mxrp). Greptile's latest review covers the current head 749f23d with Confidence Score: 5/5. Sourcery skipped this head (its weekly diff allowance), so its earlier findings on this PR are the last it gave, and all were answered. CodeRabbit posted only its free-plan notice: this repository has fewer than 10 stars, so it doesn't review automatically, and its one-review-per-hour allowance is kept for PRs that need it. Every required check is green on 749f23d.