@blogic-cz/agent-tools 1.10.0 → 1.11.1

package/dist/shared/secret-env.d.ts

@@ -0,0 +1,22 @@
+import { Context, Layer } from "effect";
+export type LookupResult = {
+    readonly _tag: "found";
+    readonly value: string;
+} | {
+    readonly _tag: "absent";
+} | {
+    readonly _tag: "failed";
+    readonly reason: string;
+};
+export type ZshRunner = (name: string, timeoutMs: number) => Promise<LookupResult>;
+declare const SecretEnvResolver_base: Context.ServiceClass<SecretEnvResolver, "@agent-tools/SecretEnvResolver", {
+    readonly resolveSecretEnv: (name: string) => Promise<string>;
+    readonly lookupConfigEnv: (name: string) => Promise<LookupResult>;
+}>;
+export declare class SecretEnvResolver extends SecretEnvResolver_base {
+    static get liveLayer(): Layer.Layer<SecretEnvResolver, never, never>;
+    static readonly testLayer: (runner?: ZshRunner) => Layer.Layer<SecretEnvResolver, never, never>;
+}
+export declare function makeSecretEnvResolverLayer(runner?: ZshRunner, timeoutMs?: number): Layer.Layer<SecretEnvResolver, never, never>;
+export {};
+//# sourceMappingURL=secret-env.d.ts.map

package/dist/shared/secret-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-env.d.ts","sourceRoot":"","sources":["../../src/shared/secret-env.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAqBxC,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;;+BAmJpD,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;8BAClC,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC;;AAJrE,qBAAa,iBAAkB,SAAQ,sBAMF;IACnC,MAAM,KAAK,SAAS,iDAEnB;IACD,MAAM,CAAC,QAAQ,CAAC,SAAS,YAAY,SAAS,kDACT;CACtC;AAED,wBAAgB,0BAA0B,CACxC,MAAM,GAAE,SAA6B,EACrC,SAAS,SAAqB,gDAwC/B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.10.0",
+  "version": "1.11.1",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/db-tool/main.ts

@@ -14,6 +14,7 @@ import {
   VERSION,
 } from "#shared";
 import { AuditServiceLayer, withAudit } from "#shared/audit";
+import { SecretEnvResolver } from "#shared/secret-env";
 import { withRedactedOutput } from "#shared/output-boundary";
 import { ConfigService, ConfigServiceLayer, getDefaultEnvironment } from "#config";
 import { DbConfigService, makeDbConfigLayer } from "./config-service";
@@ -248,6 +249,7 @@ const MainLayer = DbService.layer.pipe(
   // provideMerge (not provide) so DbConfigService stays in the program context for the `envs` command,
   // which reads it directly rather than going through DbService.
   Layer.provideMerge(DbSqlClient.layer),
+  Layer.provideMerge(SecretEnvResolver.liveLayer),
   Layer.provideMerge(dbConfigLayer),
   Layer.provideMerge(ConfigServiceLayer),
   Layer.provideMerge(BunServices.layer),

package/src/db-tool/service.ts

@@ -1,5 +1,5 @@
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
-import { Clock, Context, Duration, Effect, Layer, Ref, Result, Stream } from "effect";
+import { Clock, Context, Duration, Effect, Layer, Result, Stream } from "effect";
 
 import type { DbConfig, DbMutationOperation, QueryResult, SchemaMode } from "./types";
 
@@ -7,6 +7,7 @@ import { ConfigService } from "#config";
 import { isPrerequisiteRunError } from "#shared/prerequisites/errors";
 import { resolveEnvTemplate } from "#shared/env-template";
 import { registerResolvedSecret, unsafeOutboundTextReason } from "#shared/content-security";
+import { SecretEnvResolver } from "#shared/secret-env";
 import { resolveEnvironmentScopedPrerequisites } from "#shared/prerequisites/config";
 import { runWithProfilePrerequisites } from "#shared/prerequisites/runtime";
 import { buildApiProbeArgs } from "#shared/k8s-probe";
@@ -43,12 +44,6 @@ const MIN_TCP_PORT = 1;
 const MAX_TCP_PORT = 65535;
 const INTEGER_ONLY = /^\d+$/;
 
-// Bun.env is the primary source: it carries the values Bun loads from a .env file, which is where
-// a per-worktree host/port lives. It aliases process.env, which is also the only one that exists
-// when this module runs outside Bun (the vitest runner).
-const readProcessEnv = (envVar: string): string | undefined =>
-  (typeof Bun === "undefined" ? process.env : Bun.env)[envVar];
-
 export type ResolvedPortOverride =
   | { readonly ok: true; readonly port: number }
   | { readonly ok: false; readonly message: string };
@@ -159,6 +154,7 @@ export class DbService extends Context.Service<
       Effect.gen(function* () {
         const executor = yield* ChildProcessSpawner.ChildProcessSpawner;
         const sqlClient = yield* DbSqlClient;
+        const secretEnvResolver = yield* SecretEnvResolver;
         const agentToolsConfig = yield* ConfigService;
         const dbConfig = yield* DbConfigService;
 
@@ -185,152 +181,138 @@ export class DbService extends Context.Service<
         const apiProbeTimeoutMs = dbConfig.apiProbeTimeoutMs ?? 2000;
         const remotePort = dbConfig.remotePort ?? 5432;
 
-        const zshrcEnvCache = yield* Ref.make<Record<string, string> | null>(null);
         const envTemplateRegex = /^\$\{([A-Za-z0-9_]+)\}$/;
+        const lookupConfigEnv = (name: string) =>
+          Effect.tryPromise({
+            try: () => secretEnvResolver.lookupConfigEnv(name),
+            catch: () => new Error(`${name} lookup failed`),
+          });
 
-        const loadEnvFromZshrc = Effect.fn("DbService.loadEnvFromZshrc")(function* () {
-          const cached = yield* Ref.get(zshrcEnvCache);
-          if (cached !== null) {
-            return cached;
-          }
-
-          const home = process.env.HOME;
-          if (!home || home.trim() === "") {
-            yield* Ref.set(zshrcEnvCache, {});
-            return {};
-          }
-
-          const zshrcPath = `${home}/.zshrc`;
-          const content = yield* Effect.tryPromise(async () => {
-            const file = Bun.file(zshrcPath);
-            if (!(await file.exists())) {
-              return "";
+        const resolvePassword = (config: DbConfig, env: string) =>
+          Effect.gen(function* () {
+            if (config.password) {
+              registerResolvedSecret(config.password);
+              return config.password;
             }
-            return await file.text();
-          }).pipe(Effect.orElseSucceed(() => ""));
 
-          const envVars: Record<string, string> = {};
-          const regex = /^export\s+([A-Z_][A-Z0-9_]*)=["']?([^"'\n]+)["']?/gm;
-          let match = regex.exec(content);
-
-          while (match !== null) {
-            envVars[match[1]] = match[2];
-            match = regex.exec(content);
-          }
-
-          yield* Ref.set(zshrcEnvCache, envVars);
-          return envVars;
-        });
+            const passwordEnvVar = config.passwordEnvVar;
+            if (passwordEnvVar) {
+              return yield* Effect.tryPromise({
+                try: () => secretEnvResolver.resolveSecretEnv(passwordEnvVar),
+                catch: () =>
+                  new Error(
+                    `${passwordEnvVar} is not in the environment or in the interactive zsh`,
+                  ),
+              }).pipe(
+                Effect.mapError(
+                  () =>
+                    new DbConnectionError({
+                      message: `${passwordEnvVar} is not in the environment or in the interactive zsh`,
+                      environment: env,
+                    }),
+                ),
+              );
+            }
 
-        const resolvePassword = Effect.fn("DbService.resolvePassword")(function* (
-          config: DbConfig,
-          env: string,
-        ) {
-          if (config.password) {
-            registerResolvedSecret(config.password);
-            return config.password;
-          }
+            // Local databases typically don't need a password
+            return "";
+          });
 
-          if (config.passwordEnvVar) {
-            const fromEnv = process.env[config.passwordEnvVar];
-            if (fromEnv) {
-              registerResolvedSecret(fromEnv);
-              return fromEnv;
+        const resolveConfigString = (value: string, env: string, label: string) =>
+          Effect.gen(function* () {
+            const match = value.match(envTemplateRegex);
+            if (!match) return value;
+
+            const envVar = match[1];
+            const result = yield* lookupConfigEnv(envVar).pipe(
+              Effect.mapError(
+                () =>
+                  new DbConnectionError({
+                    message: `${envVar} lookup failed (required for '${label}' config field) in environment ${env}.`,
+                    environment: env,
+                  }),
+              ),
+            );
+            if (result._tag === "failed") {
+              return yield* new DbConnectionError({
+                message: `${envVar} lookup failed (required for '${label}' config field) in environment ${env}.`,
+                environment: env,
+              });
             }
-
-            const zshrcEnv = yield* loadEnvFromZshrc();
-            const fromZsh = zshrcEnv[config.passwordEnvVar];
-            if (fromZsh) {
-              registerResolvedSecret(fromZsh);
-              return fromZsh;
+            if (result._tag === "absent") {
+              return yield* new DbConnectionError({
+                message: `${envVar} is not in the environment or in the interactive zsh (required for '${label}' config field) in environment ${env}.`,
+                environment: env,
+              });
             }
-
-            return yield* new DbConnectionError({
-              message: `Environment variable ${config.passwordEnvVar} is not set.`,
-              environment: env,
-            });
-          }
-
-          // Local databases typically don't need a password
-          return "";
-        });
-
-        const resolveConfigString = Effect.fn("DbService.resolveConfigString")(function* (
-          value: string,
-          env: string,
-          label: string,
-          zshrcEnv: Record<string, string>,
-        ) {
-          const match = value.match(envTemplateRegex);
-          if (!match) return value;
-
-          const envVar = match[1];
-          const fromEnv = Bun.env[envVar];
-          if (fromEnv !== undefined) return fromEnv;
-
-          const fromZsh = zshrcEnv[envVar];
-          if (fromZsh !== undefined) return fromZsh;
-
-          return yield* new DbConnectionError({
-            message: `Environment variable ${envVar} (required for '${label}' config field) is not set in environment ${env}.`,
-            environment: env,
+            return result.value;
           });
-        });
 
-        const lookupEnvOverride = (envVar: string, zshrcEnv: Record<string, string>) =>
-          readProcessEnv(envVar) ?? zshrcEnv[envVar];
-
-        const resolveDbConfig = Effect.fn("DbService.resolveDbConfig")(function* (
-          config: DbConfig,
-          env: string,
-        ) {
-          const needsEnvResolution =
-            envTemplateRegex.test(config.user) ||
-            envTemplateRegex.test(config.database) ||
-            config.hostEnvVar !== undefined ||
-            config.portEnvVar !== undefined;
-          const zshrcEnv = needsEnvResolution ? yield* loadEnvFromZshrc() : {};
-
-          const host = resolveHostOverride(
-            config.host,
-            config.hostEnvVar,
-            config.hostEnvVar ? lookupEnvOverride(config.hostEnvVar, zshrcEnv) : undefined,
-          );
-          const portOverride = resolvePortOverride(
-            env,
-            config.port,
-            config.portEnvVar,
-            config.portEnvVar ? lookupEnvOverride(config.portEnvVar, zshrcEnv) : undefined,
-          );
+        const resolveDbConfig = (config: DbConfig, env: string) =>
+          Effect.gen(function* () {
+            const resolveOverride = (name: string | undefined) => {
+              if (!name) return Effect.succeed(undefined);
+              return lookupConfigEnv(name).pipe(
+                Effect.flatMap((result) => {
+                  if (result._tag === "absent") return Effect.succeed(undefined);
+                  if (result._tag === "failed") {
+                    return Effect.fail(
+                      new DbConnectionError({
+                        message: `${name} lookup failed in environment ${env}.`,
+                        environment: env,
+                      }),
+                    );
+                  }
+                  return Effect.succeed(result.value);
+                }),
+                Effect.mapError(
+                  () =>
+                    new DbConnectionError({
+                      message: `${name} lookup failed in environment ${env}.`,
+                      environment: env,
+                    }),
+                ),
+              );
+            };
+            const hostValue = yield* resolveOverride(config.hostEnvVar);
+            const portValue = yield* resolveOverride(config.portEnvVar);
+
+            const host = resolveHostOverride(config.host, config.hostEnvVar, hostValue);
+            const portOverride = resolvePortOverride(
+              env,
+              config.port,
+              config.portEnvVar,
+              portValue,
+            );
 
-          if (!portOverride.ok) {
-            return yield* new DbConnectionError({
-              message: portOverride.message,
-              environment: env,
-            });
-          }
+            if (!portOverride.ok) {
+              return yield* new DbConnectionError({
+                message: portOverride.message,
+                environment: env,
+              });
+            }
 
-          // A host override can flip the tunnel decision (a forwarded localhost port vs a directly
-          // reachable host), so re-derive the access mode whenever the override changed the host.
-          const needsTunnel =
-            host === config.host
-              ? config.needsTunnel
-              : resolveDbAccessMode(
-                  env,
-                  host,
-                  dbConfig.kubectl !== undefined,
-                  config.allowedMutations,
-                ).needsTunnel;
+            // A host override can flip the tunnel decision (a forwarded localhost port vs a directly
+            // reachable host), so re-derive the access mode whenever the override changed the host.
+            const needsTunnel =
+              host === config.host
+                ? config.needsTunnel
+                : resolveDbAccessMode(
+                    env,
+                    host,
+                    dbConfig.kubectl !== undefined,
+                    config.allowedMutations,
+                  ).needsTunnel;
 
-          return {
-            ...config,
-            host,
-            port: portOverride.port,
-            needsTunnel,
-            user: yield* resolveConfigString(config.user, env, "user", zshrcEnv),
-            database: yield* resolveConfigString(config.database, env, "database", zshrcEnv),
-          };
-        });
+            return {
+              ...config,
+              host,
+              port: portOverride.port,
+              needsTunnel,
+              user: yield* resolveConfigString(config.user, env, "user"),
+              database: yield* resolveConfigString(config.database, env, "database"),
+            };
+          });
 
         const executeShellCommand = (command: ChildProcess.Command) =>
           Effect.scoped(

package/src/db-tool/sql-client.ts

@@ -1,6 +1,7 @@
 import { Context, Effect, Layer } from "effect";
 
 import { DbQueryError } from "./errors";
+import { redactSensitiveText } from "#shared/content-security";
 
 export type DbConnection = {
   readonly host: string;
@@ -22,6 +23,11 @@ type BunQueryResult = unknown[] & { count?: number; command?: string };
 export const toErrorMessage = (cause: unknown): string =>
   cause instanceof Error ? cause.message : String(cause);
 
+export const toDbQueryError = (cause: unknown, sql: string): DbQueryError => {
+  const message = redactSensitiveText(toErrorMessage(cause));
+  return new DbQueryError({ message, sql, stderr: message });
+};
+
 const runWithBunSql = (connection: DbConnection, sql: string) =>
   Effect.tryPromise({
     try: async (): Promise<DbQueryOutcome> => {
@@ -61,10 +67,7 @@ const runWithBunSql = (connection: DbConnection, sql: string) =>
         await client.close().catch(() => undefined);
       }
     },
-    catch: (cause) => {
-      const message = toErrorMessage(cause);
-      return new DbQueryError({ message, sql, stderr: message });
-    },
+    catch: (cause) => toDbQueryError(cause, sql),
   });
 
 export class DbSqlClient extends Context.Service<

package/src/gh-tool/pr/commands.ts

@@ -41,7 +41,7 @@ import {
   detectPRStatus,
   editPR,
   fetchPRView,
-  fetchChecks,
+  fetchCheckReport,
   fetchChecksBatch,
   fetchChecksForCommand,
   fetchFailedChecks,
@@ -191,8 +191,10 @@ type ReviewTriageClassification = {
 export const classifyReviewTriage = (
   summary: ReviewTriageSummary,
   checks: readonly CheckResult[],
+  checksStatus: "reported" | "none_reported" = "reported",
 ): ReviewTriageClassification => {
   const reasons = [
+    ...(checksStatus === "none_reported" ? ["checks_not_reported"] : []),
     ...(checks.some((check) => check.bucket === "fail") ? ["failed_checks"] : []),
     ...(checks.some((check) => check.bucket === "cancel") ? ["cancelled_checks"] : []),
     ...(checks.some(
@@ -397,7 +399,6 @@ const countFeedbackOrigins = (items: ReadonlyArray<{ feedbackOrigin: string }>)
 
 export const fetchReviewTriage = Effect.fn("pr.fetchReviewTriage")(function* (
   prNumber: number | null,
-  format: "toon" | "json" = "toon",
 ) {
   const { info, value } = yield* withStableHead(
     prNumber,
@@ -405,16 +406,17 @@ export const fetchReviewTriage = Effect.fn("pr.fetchReviewTriage")(function* (
       Effect.all([
         fetchThreads(number, false, false, headSha),
         fetchDiscussionSummary(number),
-        fetchChecks(number, false, false, 0, format === "json"),
+        fetchCheckReport(number),
         fetchReviews(number, null, null, null, headSha),
         fetchComments(number, null, headSha),
       ]),
     { operation: "review triage", command: "gh-tool pr review-triage" },
   );
-  const [allThreads, summary, checks, reviews, inlineComments] = value;
+  const [allThreads, summary, checkReport, reviews, inlineComments] = value;
+  const checks = checkReport.checks ?? [];
   const unresolvedThreads = allThreads.filter((thread) => !thread.isResolved);
   const visibleOpenThreads = allThreads.filter((thread) => thread.isVisibleOpen);
-  const classification = classifyReviewTriage(summary, checks);
+  const classification = classifyReviewTriage(summary, checks, checkReport.checksStatus);
 
   // Single merge-readiness verdict so agents stop re-stitching mergeable + checks + threads +
   // review state across separate calls (F2). `blocking` names exactly what's left to do.
@@ -423,6 +425,7 @@ export const fetchReviewTriage = Effect.fn("pr.fetchReviewTriage")(function* (
   if (checks.some((check) => check.bucket === "fail")) blocking.push("failing_checks");
   if (checks.some((check) => check.bucket === "pending")) blocking.push("pending_checks");
   if (checks.some((check) => check.bucket === "cancel")) blocking.push("cancelled_checks");
+  if (checkReport.checksStatus === "none_reported") blocking.push("checks_not_reported");
   if (
     checks.some(
       (check) => !["pass", "fail", "pending", "skipping", "cancel"].includes(check.bucket),
@@ -466,6 +469,8 @@ export const fetchReviewTriage = Effect.fn("pr.fetchReviewTriage")(function* (
     visibleOpenThreads,
     summary,
     checks,
+    checksStatus: checkReport.checksStatus,
+    ...(checkReport.checksStatus === "none_reported" ? { checksReason: checkReport.reason } : {}),
     reviews,
     inlineComments,
     feedbackOriginCounts: {
@@ -1609,7 +1614,7 @@ export const prReviewTriageCommand = Command.make(
       repo,
       Effect.gen(function* () {
         const prNumber = Option.getOrNull(pr);
-        const result = yield* fetchReviewTriage(prNumber, format);
+        const result = yield* fetchReviewTriage(prNumber);
         yield* logFormatted(
           omitTriageSections(result, Option.getOrNull(omit)?.split(",") ?? []),
           format,
@@ -1654,7 +1659,7 @@ export const prReviewTriageBatchCommand = Command.make(
       Effect.gen(function* () {
         const numbers = yield* parsePrNumbers(prs);
         const results = yield* Effect.all(
-          numbers.map((prNumber) => fetchReviewTriage(prNumber, format)),
+          numbers.map((prNumber) => fetchReviewTriage(prNumber)),
           { concurrency: "unbounded" },
         );
         yield* logFormatted(results, format);

package/src/gh-tool/pr/core.ts

@@ -257,6 +257,8 @@ export const NO_CHECKS_REPORTED_RE = /no checks reported/i;
 // for the caller's whole --timeout.
 const CHECK_REGISTRATION_POLL_SECONDS = 5;
 const CHECK_REGISTRATION_GRACE_SECONDS = 60;
+const CHECK_POLL_INTERVAL_MS = 15_000;
+const CHECK_POLL_MAX_INTERVAL_MS = 60_000;
 const NO_CHECKS_REPORTED_REASON =
   "gh reported no checks for this head. Checks may not be registered yet, the PR may have no CI, or GitHub returned an empty rollup. This is not a CI verdict.";
 
@@ -1469,9 +1471,21 @@ export const fetchChecks = Effect.fn("pr.fetchChecks")(function* (
     const started = Number(yield* Clock.currentTimeMillis);
     const graceDeadlineMs =
       started + Math.min(CHECK_REGISTRATION_GRACE_SECONDS, timeoutSeconds) * 1000;
+    let previousChecks = "";
+    let intervalMs = CHECK_POLL_INTERVAL_MS;
     const poll = Effect.gen(function* () {
       const checks = yield* fetchCheckResults(pr);
-      return { checks, at: Number(yield* Clock.currentTimeMillis) };
+      const signature = JSON.stringify(checks);
+      intervalMs =
+        signature === previousChecks
+          ? Math.min(CHECK_POLL_MAX_INTERVAL_MS, intervalMs * 2)
+          : CHECK_POLL_INTERVAL_MS;
+      previousChecks = signature;
+      return {
+        checks,
+        at: Number(yield* Clock.currentTimeMillis),
+        intervalMs: checks.length === 0 ? CHECK_REGISTRATION_POLL_SECONDS * 1000 : intervalMs,
+      };
     });
     const watchOutcome = yield* waits
       .until(
@@ -1481,7 +1495,7 @@ export const fetchChecks = Effect.fn("pr.fetchChecks")(function* (
             ? at >= graceDeadlineMs
             : (failFast && checks.some((check) => check.bucket === "fail")) ||
               checks.every((check) => check.bucket !== "pending"),
-        { intervalMs: CHECK_REGISTRATION_POLL_SECONDS * 1000, timeoutMs: timeoutSeconds * 1000 },
+        { intervalMs: (value) => value.intervalMs, timeoutMs: timeoutSeconds * 1000 },
       )
       .pipe(
         Effect.timeoutOrElse({
@@ -1504,6 +1518,16 @@ export const fetchChecks = Effect.fn("pr.fetchChecks")(function* (
         stderr: "",
       });
     const results = yield* fetchCheckResults(pr);
+    if (
+      results.some((check) => check.bucket === "fail") &&
+      (failFast || !results.some((check) => check.bucket === "pending"))
+    )
+      return yield* new GitHubCommandError({
+        command: buildChecksCommand(pr, true),
+        exitCode: 1,
+        message: "",
+        stderr: "",
+      });
     if (!quiet && graceExpired) {
       const prRef = pr === null ? "<number>" : String(pr);
       yield* Console.warn(
@@ -1608,7 +1632,7 @@ export const fetchFailedChecks = Effect.fn("pr.fetchFailedChecks")(function* (
   const initial = yield* viewPR(pr);
   const snapshot = yield* collectWithStableState(
     initial,
-    (info) => fetchCheckResults(info.number),
+    (info) => fetchCheckReport(info.number),
     (info) =>
       fetchPRView(info.number, "origin").pipe(
         Effect.map((refreshed) => ({ ...refreshed, baseSha: initial.baseSha })),
@@ -1616,7 +1640,20 @@ export const fetchFailedChecks = Effect.fn("pr.fetchFailedChecks")(function* (
     (before, after) => after.headSha === before.headSha,
   );
   if (snapshot !== null) {
-    return yield* buildFailedChecksReport(snapshot.state.number, snapshot.value, {
+    if (snapshot.value.checksStatus === "none_reported") {
+      return {
+        evidence: { headSha: snapshot.state.headSha, baseSha: snapshot.state.baseSha },
+        status: "none_reported",
+        reason: snapshot.value.reason,
+        message: "No checks were reported for this PR head.",
+        summary: { total: 0, failed: 0, pending: 0, passed: 0 },
+        failedChecks: [],
+        pendingChecks: [],
+        hint: "This is not a CI verdict. Check whether CI exists or has registered for this head.",
+        nextCommands: [`bun agent-tools-gh pr checks --pr ${snapshot.state.number}`],
+      };
+    }
+    return yield* buildFailedChecksReport(snapshot.state.number, snapshot.value.checks, {
       withLogs: withLogs || fullLogs,
       fullLogs,
       evidence: { headSha: snapshot.state.headSha, baseSha: snapshot.state.baseSha },

package/src/gh-tool/pr/review.ts

@@ -113,6 +113,9 @@ const enrichThreads = (
         feedbackOrigin: feedbackOrigin(comment.commit?.oid ?? null, currentHeadSha),
         path: comment.path,
         line: comment.line,
+        originalLine: root?.originalLine ?? null,
+        originalCommitSha: root?.originalCommitSha ?? null,
+        diffHunk: root?.diffHunk ?? null,
         body: comment.body,
         isResolved: node.isResolved,
         hasReply,
@@ -131,7 +134,18 @@ const enrichThreads = (
   const dedupedByKey = new Map<string, number>();
   const deduped: ReviewThread[] = [];
   for (const thread of mapped) {
-    const key = `${thread.path}\u0000${thread.line}\u0000${thread.body.trim()}`;
+    const originalLocation =
+      thread.line === null
+        ? JSON.stringify([
+            thread.originalLine,
+            thread.originalCommitSha,
+            thread.diffHunk,
+            thread.originalLine === null || thread.originalCommitSha === null
+              ? thread.commentId
+              : null,
+          ])
+        : "";
+    const key = `${thread.path}\u0000${thread.line}\u0000${thread.body.trim()}\u0000${originalLocation}`;
     const existingIndex = dedupedByKey.get(key);
     if (existingIndex === undefined) {
       dedupedByKey.set(key, deduped.length);
@@ -224,6 +238,9 @@ export const fetchComments = Effect.fn("pr.fetchComments")(function* (
     body: c.body,
     path: c.path,
     line: c.line,
+    originalLine: c.original_line ?? null,
+    originalCommitSha: c.original_commit_id ?? null,
+    diffHunk: c.diff_hunk ?? null,
     createdAt: c.created_at,
     reviewId: c.pull_request_review_id ?? null,
     updatedAt: c.updated_at,

package/src/gh-tool/pr/stack.ts

@@ -10,7 +10,7 @@ import { GitHubMergeError } from "#gh/errors";
 
 import type { MergeStrategy, StackMember, StackMergeBlocker, StackMergeResult } from "#gh/types";
 
-import { fetchCheckResults, fetchPRView } from "./core";
+import { fetchCheckReport, fetchPRView } from "./core";
 import { readStack } from "./stack-read";
 
 export { readStack };
@@ -62,7 +62,17 @@ const collectBlockers = Effect.fn("pr.collectStackBlockers")(function* (members:
       continue;
     }
 
-    const checks = yield* fetchCheckResults(member.number);
+    const report = yield* fetchCheckReport(member.number);
+    if (report.checksStatus === "none_reported") {
+      blockers.push({
+        number: member.number,
+        reason: "checks_none_reported",
+        detail: `checks: none_reported. ${report.reason}`,
+      });
+      continue;
+    }
+
+    const checks = report.checks;
     const failing = checks.filter((check) => check.bucket === "fail");
     if (failing.length > 0) {
       blockers.push({

package/src/gh-tool/read/api.ts

@@ -208,6 +208,12 @@ const githubApiAttempt = Effect.fn("gh.githubApiAttempt")(function* <T>(
     command: `${method} ${opts.path}`,
     exitCode: response.status,
     stderr: text,
+    ...(rateLimit
+      ? {
+          hint: "Wait for the reset before retrying. Check the remaining quota once with the shown command; it does not consume the quota.",
+          nextCommand: "gh api rate_limit",
+        }
+      : {}),
     ...(response.status >= 500 || (rateLimit && canWait) ? { retryable: true } : {}),
   });
   if (rateLimit && canWait && waitMs !== undefined) rateLimitRetryDelays.set(error, waitMs);

package/src/gh-tool/read/pulls.ts

@@ -227,7 +227,10 @@ export const prChecks = Effect.fn("reads.prChecks")(function* (
   const sha = head.headSha;
   let verified = true;
   const stableFetch = Effect.gen(function* () {
-    const before = yield* prHead(repo, number, "origin").pipe(Effect.orElseSucceed(() => null));
+    const before =
+      headSha === null
+        ? head
+        : yield* prHead(repo, number, "origin").pipe(Effect.orElseSucceed(() => null));
     if (before !== null && before.headSha !== sha) return yield* movedHead(number);
     const value = yield* gh.runGhJson<CheckResult[]>([
       "pr",