fix: address review suggestions from #1 (single-branch clone, HooksManager pinning)

[LukasParke]

Follow-up to the two review suggestions on #1, which merged before the fixes landed on the branch.

• scripts/upstream: clone the upstream reference --single-branch (ephemeral CI clone; full ref namespace doubled clone time), with a fetch fallback so a --ref outside the default branch still resolves.
• verify.sh + contract: the HooksManager check grepped for the exact TS spelling while its comment claimed the name was loose — a future Go-idiomatic rename would have falsely failed the gate and blocked state advancement. The merged 0.8.0 port chose the upstream spelling verbatim, so this pins it explicitly: the contract now names HooksManager as the required Go type, and the verify.sh comment states a rename is a contract change (update naming map + check together), not drift to tolerate. Verifier re-run: PASS: 0 failures.

🤖 Generated with Claude Code

[LukasParke]

@devin please review this PR — head is ade75b04. (Slack ping earlier today did not get picked up, so tagging here as a fallback.)

[perry-the-pr-reviewer]

Note: Perry's verdict is LGTM, but this review is posted as a comment because the maintainer GitHub App (used for APPROVE verdicts) is not installed on the OpenRouterTeam org. The review content below is an approval.

Perry's Review

Verdict: ✅ LGTM
Risk: 🟢 Low

Review details

Re-review of ade75b0 (previous review was on 69e3b8d). The new commit directly addresses the single nit from the previous review, and the original changes (single-branch clone, HooksManager pinning) remain correct. CI is green (check + verify-port, both pass). The PR is already merged.

scripts/upstream — option injection guards (the new delta)

The new commit adds --end-of-options to the rev-parse verify call and -- to the fetch origin call, exactly as suggested in the previous review. Verified empirically:

• --end-of-options is supported since git 2.24; the CI environment runs git 2.43. A dash-prefixed ref correctly fails with exit 1 (triggering the fallback) instead of being parsed as an option.
• -- on the fetch command is the standard separator to prevent refspec-as-option injection.
• The second rev-parse (FETCH_HEAD) correctly omits the guard, since FETCH_HEAD is a git-controlled string that never starts with a dash.
• At-prefixed CI refs (the npm-tag format used by the workflow) resolve correctly both with and without the guard.

scripts/upstream — single-branch clone (from the first commit)

The single-branch clone is the right optimization for an ephemeral CI checkout. Verified that tags reachable from the default branch are fetched (git clones all tags with single-branch unless no-tags is also passed), so the CI ref format resolves locally without needing the fallback. The fallback fetch covers the manual-run edge case of a branch ref not present in the single-branch clone. The existing-clone path (local development) is untouched.

verify.sh and upstreamer.md — HooksManager pinning

The grep already checked the exact HooksManager spelling; this aligns the comment and contract with that reality. Correct and well-documented.

[LukasParke]

@devin review — second request. Slack pings at ~10:52 and ~10:56 CDT and a GitHub mention at ~11:19 have all gone unanswered on this PR, and Perry has since reviewed the current head. Flagging explicitly rather than letting it sit silent.

[LukasParke]

Correction to my earlier ping — withdrawing the escalation.

Devin is not unresponsive here; it is not installed on this repo. Checked the last 20 PRs in each: zero Devin reviews on python-agent, go-agent, and agent-monorepo, versus 18 across the last 10 PRs on openrouter-web and 21 on typescript-agent. Perry is installed on all three. Devin was also actively posting in #agents at 12:07 today, so it is up — the app simply is not on these repos.

That makes Perry-at-head the complete automated coverage available here, not a partial pass waiting on a second reviewer. Apologies for the noise from the repeat @devin mentions.

If Devin coverage on these repos is wanted, that is a one-time GitHub App install rather than anything to do on this PR.