levior pr: list, view, checks, edit, review, close, merge and more, as the user #25

Merged

simlau merged 11 commits from simlau/pr-commands into main

2026-10-27 06:36:52 +00:00

simlau commented

2026-10-27 06:33:00 +00:00

Owner

levior pr gets most of what gh pr does, acting as the user on code.levior.io instead of levior-bot, so Claude can close the PRs it replaces itself and every action shows who did it.

New: list, view, diff, checkout, checks, edit, ready, comment, review, close, reopen, merge (flags as in gh, persistent -R). levior login now also signs in to code.levior.io (OAuth app from infra #138, PKCE on the same loopback ports); whoami shows the Forgejo login, logout forgets both tokens. Design: docs/superpowers/specs/2026-10-26-pr-commands-design.md, plan next to it.

Changed behaviour:

pr create opens the PR as the user, not levior-bot. Same-repo branch PRs still get Actions secrets (checked on infra #139). Needs the new login: after upgrading, everyone runs levior login once.
levior login --device skips code.levior.io (Forgejo has no device grant), so levior pr doesn't work after a device-only login. The cli-api pulls route stays for older CLIs.
Without a session (or after 30 days, when Forgejo needs a browser login to sync teams) every pr command says a person must run levior login; an agent can't.
The token carries the user's full rights, admins included; infra #137 puts admins under branch protection (apply_to_admins) and the CLI never sends force_merge.

Tested: go test ./... green. Live against code.levior.io: whoami, list, view (--json, -c), diff, checks, ready/--undo, comment, edit, review --comment, create --draft, close -c -d, AGit topics. Not live: merge, reopen, a real token refresh.

Follow-ups: release with the client id; drop the cli-api pulls route later; CLAUDE.md/skills still say levior-bot opens pr create PRs.

`levior pr` gets most of what `gh pr` does, acting as the user on code.levior.io instead of levior-bot, so Claude can close the PRs it replaces itself and every action shows who did it. **New:** `list`, `view`, `diff`, `checkout`, `checks`, `edit`, `ready`, `comment`, `review`, `close`, `reopen`, `merge` (flags as in gh, persistent `-R`). `levior login` now also signs in to code.levior.io (OAuth app from infra #138, PKCE on the same loopback ports); `whoami` shows the Forgejo login, `logout` forgets both tokens. Design: `docs/superpowers/specs/2026-10-26-pr-commands-design.md`, plan next to it. **Changed behaviour:** - `pr create` opens the PR as the user, not levior-bot. Same-repo branch PRs still get Actions secrets (checked on infra #139). Needs the new login: after upgrading, everyone runs `levior login` once. - `levior login --device` skips code.levior.io (Forgejo has no device grant), so `levior pr` doesn't work after a device-only login. The cli-api `pulls` route stays for older CLIs. - Without a session (or after 30 days, when Forgejo needs a browser login to sync teams) every `pr` command says a person must run `levior login`; an agent can't. - The token carries the user's full rights, admins included; infra #137 puts admins under branch protection (`apply_to_admins`) and the CLI never sends `force_merge`. **Tested:** `go test ./...` green. Live against code.levior.io: whoami, list, view (`--json`, `-c`), diff, checks, ready/`--undo`, comment, edit, review `--comment`, create `--draft`, close `-c -d`, AGit topics. Not live: `merge`, `reopen`, a real token refresh. **Follow-ups:** release with the client id; drop the cli-api `pulls` route later; CLAUDE.md/skills still say levior-bot opens `pr create` PRs.

simlau added 11 commits

2026-10-27 06:33:00 +00:00