0.129.0: Git changes, review, issues and comparison client (#171)

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex a23121c..6d7a4e6 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -1,5 +1,11 @@
  # Changelog
  
++## 0.129.0 — 2026-11-09
++
++- `openvibe-sdk/git` (G2): changes and review — `changes.list/get/create/comment/approve/merge/close/summary`,
++  `issues.list/get/create/labels/close`, `compare()`, `blame()`, `search()` and `reviewModel()`. Review requests
++  carry the expected head SHA, merge methods are checked, and mutations are POSTs with retries disabled.
++
  ## 0.128.0 (2026-11-09)
  
  - ov.ai: tasks(), choices.get/set, run(task, input, {choice}) and admin.defaults(); runs.create accepts `task` and `choice`
ddiff --git a/README.md b/README.md
iindex d356e23..5a4c838 100644
---- a/README.md
++++ b/README.md
@@@ -10,7 +10,7 @@ npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags
  
  > Supported browser and server clients for the OpenVibe platform.
  
--**Status:** alpha, v0.128.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
++**Status:** alpha, v0.129.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30.  
  **License:** MIT ([LICENSE](LICENSE)). This package is a library that apps outside the network embed, so it uses MIT. The OpenVibe services themselves stay AGPL-3.0.
  
@@@ -19,7 +19,7 @@ npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags
  After v0.97.1 is tagged:
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.128.0
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.129.0
  ```
  
  It has no runtime dependencies. It needs Node ≥ 20, or any browser with `fetch`, Web Crypto and `TextDecoder`. There is no build step. The package is CommonJS with ESM entry points (`import` works). Each subpath has its own `.d.ts`. For a page with no bundler, `browser/openvibe-sdk.mjs` is one self-contained ES module of the browser-safe subpaths (see [Browser without a bundler](#browser-without-a-bundler)). It does not depend on `openvibe-contracts` at runtime: it copies the contract types it uses (from the temporary Contracts sharing branch, a devDependency the tests check them against).
ddiff --git a/STATUS.json b/STATUS.json
iindex 6624ae4..abf3852 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -3,7 +3,7 @@
    "stage": "alpha",
    "code": true,
    "wave": "W2",
--  "version": "0.128.0",
++  "version": "0.129.0",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), \u00a73.2; roadmap \u00a730",
    "deployed": false,
    "deployment": "none: a package released as git tags; services and apps pin a tag",
ddiff --git a/browser/openvibe-sdk.mjs b/browser/openvibe-sdk.mjs
iindex 9fdfb94..ebb606d 100644
---- a/browser/openvibe-sdk.mjs
++++ b/browser/openvibe-sdk.mjs
@@@ -1,4 +1,4 @@
--// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.128.0, MIT). Do not edit.
++// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.129.0, MIT). Do not edit.
  // One self-contained ES module: core at the top level plus the browser-safe subpaths as namespaces
  // (auth, locker, registry, trust, modules, realtime, media, cam, mediaUpload, ui, community, homeFeed, bot, search, bench, meme, vision, themes, design, redact, chat, ai, credentials, jobs, tools, projects, geo). No server-only code: no service tokens, JWT verification, events, identity.
  /* eslint-disable */
@@@ -56,7 +56,7 @@ const { paginate, offsetPager } = __load(7);
  const semver = __load(6);
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.128.0';
++const SDK_VERSION = '0.129.0';
  
  module.exports = {
      createClient,
ddiff --git a/package-lock.json b/package-lock.json
iindex 2eca6b6..302501a 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.128.0",
++  "version": "0.129.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-sdk",
--      "version": "0.128.0",
++      "version": "0.129.0",
        "license": "MIT",
        "bin": {
          "openvibe-download": "bin/openvibe-download.js"
ddiff --git a/package.json b/package.json
iindex 86f169b..512a247 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.128.0",
++  "version": "0.129.0",
    "description": "Supported browser and server clients for the OpenVibe platform: auth (incl. developer apps), registry discovery, identity, user modules, events, realtime, media, community, Bot robots, search, chat, AI runs, Tools (registry, run API and jobs), VIP memberships and developer projects, the async PostgreSQL data layer (db) and the Valkey cache, limits store, queue and pub/sub, with deadlines, safe retries, problem errors and trace propagation.",
    "main": "index.js",
    "types": "types/index.d.ts",
ddiff --git a/src/core/index.js b/src/core/index.js
iindex 259b512..b0fb27b 100644
---- a/src/core/index.js
++++ b/src/core/index.js
@@@ -8,7 +8,7 @@ const { paginate, offsetPager } = require('./paginate');
  const semver = require('./semver');
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.128.0';
++const SDK_VERSION = '0.129.0';
  
  module.exports = {
      createClient,
ddiff --git a/src/git.js b/src/git.js
iindex 250b333..8d2ea0d 100644
---- a/src/git.js
++++ b/src/git.js
@@@ -36,8 +36,39 @@ function createGitClient(client, { baseUrl } = {}) {
      const call = (opts) => client.json({ ...at, ...opts });
      const repo = (full, where) => `/api/v1/repos/${fullName(full, where).split('/').map(enc).join('/')}`;
      const repoAt = (full, tail, where) => `${repo(full, where)}/${tail}`;
++    const number = (n) => {
++        if (!/^[1-9][0-9]{0,14}$/.test(String(n))) throw new TypeError('Invalid change number');
++        return String(n);
++    };
++    const entry = (full, kind, n) => repoAt(full, `${kind}/${number(n)}`, `git.${kind}`);
++    const mutate = (path, json, o = {}) => call({ method: 'POST', path, json, signal: o.signal, retries: 0, idempotencyKey: false });
  
      return {
++        changes: {
++            list: (full, { signal } = {}) => call({ path: repoAt(full, 'changes', 'git.changes.list'), signal }),
++            get: (full, n, { signal } = {}) => call({ path: entry(full, 'changes', n), signal }),
++            create: (full, input, o = {}) => mutate(repoAt(full, 'changes', 'git.changes.create'), input, o),
++            comment: (full, n, input, o = {}) => mutate(`${entry(full, 'changes', n)}/comments`, input, o),
++            approve: (full, n, headSha, o = {}) => mutate(`${entry(full, 'changes', n)}/approve`, { head_sha: headSha }, o),
++            merge: (full, n, { head_sha, method = 'merge' } = {}, o = {}) => {
++                if (!['merge', 'squash', 'rebase'].includes(method)) throw new TypeError('Invalid merge method');
++                return mutate(`${entry(full, 'changes', n)}/merge`, { head_sha, method }, o);
++            },
++            close: (full, n, o = {}) => mutate(`${entry(full, 'changes', n)}/close`, {}, o),
++            summary: (full, n, headSha, o = {}) => mutate(`${entry(full, 'changes', n)}/summary`, { head_sha: headSha }, o),
++        },
++        issues: {
++            list: (full, { signal } = {}) => call({ path: repoAt(full, 'issues', 'git.issues.list'), signal }),
++            get: (full, n, { signal } = {}) => call({ path: entry(full, 'issues', n), signal }),
++            create: (full, input, o = {}) => mutate(repoAt(full, 'issues', 'git.issues.create'), input, o),
++            labels: (full, n, labels, o = {}) => mutate(`${entry(full, 'issues', n)}/labels`, { labels }, o),
++            close: (full, n, o = {}) => mutate(`${entry(full, 'issues', n)}/close`, {}, o),
++        },
++        compare: (full, base, head, { signal } = {}) => call({ path: repoAt(full, `compare/${enc(base)}...${enc(head)}`, 'git.compare'), signal }),
++        blame: (full, ref, path, { signal } = {}) => call({ path: repoAt(full, 'blame', 'git.blame'), query: { ref, path }, signal }),
++        search: (full, q, { signal } = {}) => call({ path: repoAt(full, 'search', 'git.search'), query: { q }, signal }),
++        reviewModel: (full, model, o = {}) => mutate(repoAt(full, 'review-model', 'git.reviewModel'), { model }, o),
++
          repos: {
              /** Search and filter: q, language, official, mirror, mine, starred; sort trending|pushed|stars|new. */
              list: ({ q, language, official, mirror, mine, starred, sort, limit, cursor, signal } = {}) => {
ddiff --git a/test/git.test.js b/test/git.test.js
iindex d05d7fe..fc67fab 100644
---- a/test/git.test.js
++++ b/test/git.test.js
@@@ -58,5 +58,38 @@ function fake() {
      ok(raw === 'raw text' && client.calls.at(-1).responseType === 'text', 'raw text');
      assert.throws(() => git.repos.get('Not A Repo'), /owner\/name/); n += 1;
  
++    await git.changes.list('openvibers/openvibe.sdk');
++    ok(client.calls.at(-1).path === '/api/v1/repos/openvibers/openvibe.sdk/changes', 'changes list path');
++    await git.changes.get('openvibers/openvibe.sdk', 7);
++    ok(client.calls.at(-1).path.endsWith('/changes/7'), 'change path');
++    await git.changes.create('openvibers/openvibe.sdk', { title: 'Title', base_ref: 'main', head_ref: 'feature' });
++    ok(client.calls.at(-1).method === 'POST' && client.calls.at(-1).retries === 0 && client.calls.at(-1).idempotencyKey === false, 'a change is a no-retry POST');
++    await git.changes.comment('openvibers/openvibe.sdk', 7, { head_sha: 'a'.repeat(40), path: 'src/x.js', line: 3, side: 'new', message: 'hello' });
++    ok(client.calls.at(-1).path.endsWith('/changes/7/comments') && client.calls.at(-1).json.line === 3, 'line comment');
++    await git.changes.approve('openvibers/openvibe.sdk', 7, 'a'.repeat(40));
++    ok(client.calls.at(-1).path.endsWith('/changes/7/approve') && client.calls.at(-1).json.head_sha === 'a'.repeat(40), 'approval pins the head');
++    await git.changes.merge('openvibers/openvibe.sdk', 7, { head_sha: 'a'.repeat(40), method: 'rebase' });
++    ok(client.calls.at(-1).json.method === 'rebase', 'merge method');
++    await git.changes.summary('openvibers/openvibe.sdk', 7, 'a'.repeat(40));
++    ok(client.calls.at(-1).path.endsWith('/changes/7/summary') && client.calls.at(-1).json.head_sha === 'a'.repeat(40), 'summary pins the head');
++    await git.changes.close('openvibers/openvibe.sdk', 7);
++    ok(client.calls.at(-1).path.endsWith('/changes/7/close'), 'close');
++    await git.issues.create('openvibers/openvibe.sdk', { title: 'Bug' });
++    ok(client.calls.at(-1).path.endsWith('/issues') && client.calls.at(-1).json.title === 'Bug', 'issue create');
++    await git.issues.labels('openvibers/openvibe.sdk', 2, ['bug']);
++    ok(JSON.stringify(client.calls.at(-1).json) === JSON.stringify({ labels: ['bug'] }), 'issue labels');
++    await git.issues.close('openvibers/openvibe.sdk', 2);
++    ok(client.calls.at(-1).path.endsWith('/issues/2/close'), 'issue close');
++    await git.compare('openvibers/openvibe.sdk', 'main', 'agent/run');
++    ok(client.calls.at(-1).path === '/api/v1/repos/openvibers/openvibe.sdk/compare/main...agent%2Frun', 'comparison path');
++    await git.blame('openvibers/openvibe.sdk', 'main', 'README.md');
++    ok(client.calls.at(-1).query.path === 'README.md' && client.calls.at(-1).query.ref === 'main', 'blame query');
++    await git.search('openvibers/openvibe.sdk', 'two words');
++    ok(client.calls.at(-1).query.q === 'two words', 'search query');
++    await git.reviewModel('openvibers/openvibe.sdk', 'local/review');
++    ok(client.calls.at(-1).json.model === 'local/review', 'review model');
++    assert.throws(() => git.changes.get('openvibers/openvibe.sdk', '../x'), /Invalid change number/); n += 1;
++    assert.throws(() => git.changes.merge('openvibers/openvibe.sdk', 7, { method: 'shell' }), /merge method/); n += 1;
++
      console.log(`git: ${n} checks passed`);
  })().catch((err) => { console.error(err); process.exit(1); });
ddiff --git a/types/git.d.ts b/types/git.d.ts
iindex 8439bfd..086d193 100644
---- a/types/git.d.ts
++++ b/types/git.d.ts
@@@ -47,6 +47,27 @@ export interface GitRepos {
  }
  
  export interface GitClient {
++    changes: {
++        list(full: string, opts?: Opts): Promise<GitJson>;
++        get(full: string, number: number | string, opts?: Opts): Promise<GitJson>;
++        create(full: string, input: { title: string; body?: string; base_ref: string; head_ref: string; source_repo?: string }, opts?: Opts): Promise<GitJson>;
++        comment(full: string, number: number | string, input: { head_sha: string; path: string; line: number; side: 'old' | 'new'; message: string }, opts?: Opts): Promise<GitJson>;
++        approve(full: string, number: number | string, headSha: string, opts?: Opts): Promise<GitJson>;
++        merge(full: string, number: number | string, input: { head_sha: string; method?: 'merge' | 'squash' | 'rebase' }, opts?: Opts): Promise<GitJson>;
++        close(full: string, number: number | string, opts?: Opts): Promise<GitJson>;
++        summary(full: string, number: number | string, headSha: string, opts?: Opts): Promise<GitJson>;
++    };
++    issues: {
++        list(full: string, opts?: Opts): Promise<GitJson>;
++        get(full: string, number: number | string, opts?: Opts): Promise<GitJson>;
++        create(full: string, input: { title: string; body?: string }, opts?: Opts): Promise<GitJson>;
++        labels(full: string, number: number | string, labels: string[], opts?: Opts): Promise<GitJson>;
++        close(full: string, number: number | string, opts?: Opts): Promise<GitJson>;
++    };
++    compare(full: string, base: string, head: string, opts?: Opts): Promise<GitJson>;
++    blame(full: string, ref: string, path: string, opts?: Opts): Promise<GitJson>;
++    search(full: string, query: string, opts?: Opts): Promise<GitJson>;
++    reviewModel(full: string, model: string, opts?: Opts): Promise<GitJson>;
      repos: GitRepos;
      commits: {
          create(full: string, fields: { branch: string; message: string; files: { path: string; content: string; encoding?: 'utf8' | 'base64' }[]; base?: string; author?: { name: string; email: string } }, opts?: Opts): Promise<GitJson>;