chore(cli): vendor v3.6.2 and release plugin v1.2.6

[ravern]

Vendor the published npm greptile@3.6.2 bundle and bump the plugin from 1.2.5 to 1.2.6 so plugin users receive the updated CLI.

Validation: the vendored bundle reports 3.6.2, matches npm SHA-256 82e04c3f76fe06780b41dce5ca81163ca60dd5e53084269a4fdeee3e588c0a28, and the metadata passes git diff --check. The published generated bundle contains whitespace flagged by Git; it is preserved verbatim to match npm. Require CLI Check and MCP Check before merging.

CLI release notes.

[greptile-apps]

Confidence Score: 5/5

[Low impact] This distribution PR appears safe to merge under the supplied maintainer-approved scope decision.

Summary

Vendors CLI 3.6.2 and releases plugin 1.2.6.

• The Greptile plugin now ships CLI 3.6.2.

_{Reviews (2) · Last reviewed commit: "chore(cli): vendor v3.6.2 and release pl..." · Reviewed by Greptile}

[greptile-apps]

Comments Outside Diff

These findings could not be posted inline.

•  Simulation responses go unchecked plugins/greptile/scripts/greptile.mjs:895 ▶

  The new trexSimulations and startTrexSimulations methods return unchecked server responses. Their callers immediately read simulations, pullRequest.number, and simulation results. This violates the repository requirement to parse external values before using their fields.

  Add response schemas to both methods before merging. Unexpected responses should produce a clear error rather than fail later in the command.

[ravern]

@greptile please re-review current head 6a829e16063254145f808ed628dcd7e79353972d with this proposed resolution of Simulation responses go unchecked.

The missing response validation in trexSimulations and startTrexSimulations is a valid source-level hardening finding. It has not been fixed. The maintainer has explicitly chosen to keep this rollout on CLI 3.6.2 and handle response validation separately in the CLI source, with a future release if that code changes.

This PR distributes the already-published npm greptile@3.6.2 bundle and bumps the plugin to 1.2.6. The vendored file must remain byte-identical to npm: SHA-256 82e04c3f76fe06780b41dce5ca81163ca60dd5e53084269a4fdeee3e588c0a28. CLI Check enforces that identity; editing generated code here would fail CI and create a plugin-only divergence from the released CLI. CLI Check and MCP Check both passed on this head.

Proposed disposition: defer the acknowledged response-validation work to the CLI source and preserve the published bundle in this distribution PR. Please reassess whether it should block this release-distribution PR given the maintainer's scope decision, and report any remaining actionable distribution or metadata defects. Do not treat the validation work as fixed.

[greptile-apps]

TREX

Tested 1 flow, found no issues.

What we tested

• Pass — Signed-out review request ▶

[ravern]

@greptile review this PR again in full on current head 6a829e16063254145f808ed628dcd7e79353972d.

Consider the maintainer-approved proposed disposition: defer API response-validation hardening to the CLI source and a future release, while preserving the immutable npm 3.6.2 artifact in this distribution PR. That source issue is acknowledged and remains unfixed; please reassess whether it blocks distribution under that scope decision and check for any remaining distribution or metadata defects.

The bundle is unchanged and byte-identical to published npm 3.6.2. Both CLI Check and MCP Check passed. This is a request for a full code re-review and updated merge-readiness assessment.

[ravern]

Gravernloop summary

• PR: chore(cli): vendor v3.6.2 and release plugin v1.2.6 #10
• Head: 6a829e16063254145f808ed628dcd7e79353972d
• Remediation pushes: 0/5; no bundle or metadata changes during re-review
• Greptile bots: production greptile-apps[bot] (5/5), with formal approval of this exact head
• Deslopify: not requested for this distribution PR
• Migrations: none
• CI: CLI Check and MCP Check passing on this head
• E2B: not applicable; no build templates changed or E2B checks present
• Runtime check: terminal neutral; one signed-out review-request flow passed with no findings
• Unresolved review threads: zero
• Bundle: SHA-256 82e04c3f76fe06780b41dce5ca81163ca60dd5e53084269a4fdeee3e588c0a28, matching published npm CLI 3.6.2
• Gravernloop: complete for this distribution PR
• Ready for merge: yes

Review comments addressed

• Simulation responses go unchecked by greptile-apps[bot]: Valid source-level hardening; deferred by explicit maintainer decision.
  • Disposition: preserve the immutable published CLI 3.6.2 bundle in this distribution PR; handle response validation separately in the CLI source and a future release.
  • The source issue remains unfixed. The full re-review accepted that scope decision, returned 5/5, and formally approved this head. No generated code was patched, and no finding is represented as fixed.