fix: make JetBrains release merge optional

.kilo/skills/release-jetbrains/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: release-jetbrains
-description: Use when releasing the Kilo JetBrains plugin -- resolve a version ("next rc" or explicit), run the prepare workflow, edit and commit a filtered human-readable changelog on the release PR, merge it, and watch publish to completion.
+description: Use when releasing the Kilo JetBrains plugin -- resolve a version ("next rc" or explicit), run the prepare workflow, edit and commit a filtered human-readable changelog on the release PR, then watch publish to completion.
 ---
 
 # JetBrains Release
@@ -12,7 +12,8 @@ This skill drives the existing JetBrains release workflows. It must not move, de
 ## Preconditions
 
 - Run from the repository root.
-- `gh` must be authenticated for `Kilo-Org/kilocode` with permission to dispatch workflows, edit PRs, merge PRs, and write contents.
+- `gh` must be authenticated for `Kilo-Org/kilocode` with permission to dispatch workflows, read PRs, and write contents. Merge permission is only required if the user asks the skill to merge the release PR automatically.
+- Check auth with `gh auth status`. For GitHub CLI OAuth, refresh common release scopes with `gh auth refresh -s repo -s workflow`; `repo` covers private-repo contents and PR operations, and `workflow` allows workflow dispatch. If using a fine-grained token instead, grant repository permissions for Actions read/write, Contents read/write, and Pull requests read/write. Merging still requires normal repository collaborator permission or a token/user allowed by branch protection.
 - Reference `packages/kilo-jetbrains/RELEASING.md` for manual recovery rules.
 - Do not locally check out the generated release branch. The helper scripts update the release branch through GitHub to avoid disturbing the current worktree.
 
@@ -102,14 +103,20 @@ The script updates `packages/kilo-jetbrains/CHANGELOG.md` on `jetbrains/release/
 docs(jetbrains): edit changelog for v<version>
 ```
 
-## Approve, Merge, Publish
+## Approve And Publish
 
-Ask the user to approve the release. After approval, merge the PR and watch the publish workflow:
+Ask the user to approve the release changelog and metadata. By default, have the user merge the release PR manually in GitHub, then watch the publish workflow:
 
 ```bash
 bun .kilo/skills/release-jetbrains/script/watch-publish.ts --pr <number> --version 7.0.1-rc.7
 ```
 
+Only merge automatically when the user explicitly asks for it and `gh` has merge permission:
+
+```bash
+bun .kilo/skills/release-jetbrains/script/watch-publish.ts --pr <number> --version 7.0.1-rc.7 --merge
+```
+
 Pass a generous Bash timeout, such as `1800000` ms. If the shell times out, re-attach with:
 
 ```bash

.kilo/skills/release-jetbrains/script/watch-publish.ts

@@ -10,13 +10,14 @@ const { values } = parseArgs({
   options: {
     pr: { type: "string" },
     version: { type: "string" },
+    merge: { type: "boolean", default: false },
     "run-id": { type: "string" },
     help: { type: "boolean", short: "h", default: false },
   },
 })
 
 if (values.help) {
-  console.log(`Usage: bun .kilo/skills/release-jetbrains/script/watch-publish.ts --pr <number> --version <version> [--run-id <id>]`)
+  console.log(`Usage: bun .kilo/skills/release-jetbrains/script/watch-publish.ts --pr <number> --version <version> [--merge] [--run-id <id>]`)
   process.exit(0)
 }
 
@@ -26,7 +27,7 @@ if (!pr) throw new Error("--pr is required")
 if (!ver) throw new Error("--version is required")
 
 const branch = `jetbrains/release/v${ver}`
-const id = values["run-id"] ?? (await merge())
+const id = values["run-id"] ?? (values.merge ? await merge() : await find())
 const url = `https://github.com/${repo}/actions/runs/${id}`
 
 console.log(`publishRunId=${id}`)
@@ -63,6 +64,15 @@ async function merge() {
   throw new Error(`No new ${workflow} run appeared after merging PR ${pr}`)
 }
 
+async function find() {
+  for (const _ of Array.from({ length: 120 })) {
+    const run = (await runs()).find((item) => item.headBranch === branch)
+    if (run) return String(run.databaseId)
+    await Bun.sleep(1000)
+  }
+  throw new Error(`No ${workflow} run found for ${branch}. Merge PR ${pr} first, or pass --merge to merge it automatically.`)
+}
+
 async function runs() {
   return (await $`gh run list --repo ${repo} --workflow ${workflow} --event pull_request --json databaseId,createdAt,headBranch,status --limit 100`.json()) as {
     databaseId: number