@doist/doistbot-cli 1.0.8 → 1.0.9

package/dist/actions/auth.js

@@ -1,5 +1,5 @@
 import chalk from 'chalk';
-import { deleteGeminiApiKey, deleteOpenRouterApiKey, getAuthStatus, loginOpenAICodex, logoutOpenAICodex, saveGeminiApiKey, saveOpenRouterApiKey, } from '../auth.js';
+import { createPiAuthRuntime, deleteGeminiApiKey, deleteOpenRouterApiKey, getAuthStatus, loginOpenAICodex, logoutOpenAICodex, saveGeminiApiKey, saveOpenRouterApiKey, } from '../auth.js';
 import { getEnvApiKeys } from '../env.js';
 import { FILE_STORE_PATH } from '../file-store.js';
 import { promptHiddenInput, promptMultiSelect } from '../input.js';
@@ -58,6 +58,7 @@ function formatSkipInstruction() {
 }
 export async function runAuthSetup(dependencies = {}) {
     const deps = {
+        createPiAuthRuntime,
         getAuthStatus,
         isInteractive: process.stdin.isTTY === true,
         loginOpenAICodex,
@@ -67,7 +68,8 @@ export async function runAuthSetup(dependencies = {}) {
         writeLine,
         ...dependencies,
     };
-    const status = await deps.getAuthStatus();
+    const runtime = await deps.createPiAuthRuntime();
+    const status = await deps.getAuthStatus({ runtime });
     deps.writeLine('1. OpenAI Codex');
     deps.writeLine();
     if (status.openai.configured && !status.openai.refreshFailed) {
@@ -80,7 +82,7 @@ export async function runAuthSetup(dependencies = {}) {
         if (status.openai.refreshFailed) {
             deps.writeLine('OpenAI session could not be refreshed (expired, revoked, or offline). Reconnecting.');
         }
-        await deps.loginOpenAICodex();
+        await deps.loginOpenAICodex(runtime);
         deps.writeLine();
         deps.writeLine('✓ OpenAI configured.');
     }

package/dist/auth.js

@@ -1,10 +1,12 @@
 import { spawn } from 'child_process';
 import { homedir } from 'os';
 import path from 'path';
+import {} from '@earendil-works/pi-ai';
 import { getEnvApiKeys } from './env.js';
 import { createFileStore } from './file-store.js';
 import { promptInput } from './input.js';
 import { createCompositeStore, createKeyringStore, SecureStoreUnavailableError, } from './secure-store.js';
+import { writeLine } from './terminal.js';
 const GEMINI_ACCOUNT_NAME = 'gemini-api-key';
 const OPENROUTER_ACCOUNT_NAME = 'openrouter-api-key';
 export function createGeminiKeyStore() {
@@ -15,9 +17,20 @@ export function createOpenRouterKeyStore() {
 }
 export const OPENAI_CODEX_PROVIDER_ID = 'openai-codex';
 export const PI_AUTH_API_KEY = `pi-auth://${OPENAI_CODEX_PROVIDER_ID}`;
-export async function createPiAuthStorage() {
-    const { AuthStorage } = await import('@earendil-works/pi-coding-agent');
-    return AuthStorage.create(path.join(homedir(), '.pi', 'agent', 'auth.json'));
+const OPENAI_CODEX_BROWSER_LOGIN_METHOD = 'browser';
+export async function createPiAuthRuntime() {
+    // Pi's own CLI installs its npm Undici implementation before initializing
+    // ModelRuntime. SDK consumers must do the same on Node 26 so compressed OAuth
+    // responses are decoded before response.json() parses them.
+    const { install } = await import('undici');
+    install();
+    const { ModelRuntime } = await import('@earendil-works/pi-coding-agent');
+    return await ModelRuntime.create({
+        authPath: path.join(homedir(), '.pi', 'agent', 'auth.json'),
+        allowModelNetwork: false,
+        modelsPath: null,
+        refreshOnCreate: false,
+    });
 }
 export function getBrowserOpenCommand(platform, url) {
     if (platform === 'darwin') {
@@ -30,33 +43,38 @@ export function getBrowserOpenCommand(platform, url) {
 }
 /**
  * Check that the stored OAuth session is usable, not just present.
- * getApiKey returns the cached access token when unexpired; when expired it
- * attempts one cross-process-locked refresh, persists the result, and returns
- * undefined when the refresh fails (revoked session, no network) while
- * preserving the stored credentials. Unexpected storage errors propagate.
+ * The Pi model runtime returns the cached access token when unexpired; when
+ * expired it attempts one cross-process-locked refresh and persists the result.
+ * Refresh failures preserve the stored credentials. Unexpected storage errors
+ * propagate.
  */
-export async function getOpenAICodexAuthState(storage) {
-    const resolvedStorage = storage ?? (await createPiAuthStorage());
-    if (resolvedStorage.get(OPENAI_CODEX_PROVIDER_ID)?.type !== 'oauth') {
+export async function getOpenAICodexAuthState(runtime) {
+    const resolvedRuntime = runtime ?? (await createPiAuthRuntime());
+    const credentials = await resolvedRuntime.listCredentials();
+    if (!credentials.some(({ providerId, type }) => providerId === OPENAI_CODEX_PROVIDER_ID && type === 'oauth')) {
         return 'missing';
     }
-    const apiKey = await resolvedStorage.getApiKey(OPENAI_CODEX_PROVIDER_ID, {
-        includeFallback: false,
-    });
-    return apiKey ? 'ready' : 'refresh-failed';
-}
-export async function loginOpenAICodex(storage) {
-    const resolvedStorage = storage ?? (await createPiAuthStorage());
-    const { loginOpenAICodex: loginInBrowser } = await import('@earendil-works/pi-ai/oauth');
-    const credentials = await loginInBrowser(createOpenAICodexBrowserLoginOptions());
-    saveOpenAICodexCredentials(resolvedStorage, credentials);
+    try {
+        const auth = await resolvedRuntime.getAuth(OPENAI_CODEX_PROVIDER_ID);
+        return auth?.auth.apiKey ? 'ready' : 'refresh-failed';
+    }
+    catch (error) {
+        if (typeof error === 'object' &&
+            error !== null &&
+            'code' in error &&
+            error.code === 'oauth') {
+            return 'refresh-failed';
+        }
+        throw error;
+    }
 }
-export function saveOpenAICodexCredentials(storage, credentials) {
-    storage.set(OPENAI_CODEX_PROVIDER_ID, { type: 'oauth', ...credentials });
+export async function loginOpenAICodex(runtime) {
+    const resolvedRuntime = runtime ?? (await createPiAuthRuntime());
+    await resolvedRuntime.login(OPENAI_CODEX_PROVIDER_ID, 'oauth', createOpenAICodexBrowserLoginInteraction());
 }
-export async function logoutOpenAICodex(storage) {
-    const resolvedStorage = storage ?? (await createPiAuthStorage());
-    resolvedStorage.logout(OPENAI_CODEX_PROVIDER_ID);
+export async function logoutOpenAICodex(runtime) {
+    const resolvedRuntime = runtime ?? (await createPiAuthRuntime());
+    await resolvedRuntime.logout(OPENAI_CODEX_PROVIDER_ID);
 }
 export async function readStoredGeminiApiKey(store = createGeminiKeyStore()) {
     const result = await store.getSecret();
@@ -110,7 +128,7 @@ export async function deleteOpenRouterApiKey(store = createOpenRouterKeyStore())
 export async function deleteGeminiApiKey(store = createGeminiKeyStore()) {
     return await store.deleteSecret();
 }
-export async function getAuthStatus({ env = process.env, storage, geminiStore = createGeminiKeyStore(), openRouterStore = createOpenRouterKeyStore(), } = {}) {
+export async function getAuthStatus({ env = process.env, runtime, geminiStore = createGeminiKeyStore(), openRouterStore = createOpenRouterKeyStore(), } = {}) {
     const envApiKeys = getEnvApiKeys(env);
     const geminiStored = envApiKeys.gemini
         ? { value: undefined }
@@ -118,7 +136,7 @@ export async function getAuthStatus({ env = process.env, storage, geminiStore =
     const openRouterStored = envApiKeys.openrouter
         ? { value: undefined }
         : await readStoredOpenRouterApiKey(openRouterStore).catch(() => ({ value: undefined }));
-    const openAICodexAuthState = await getOpenAICodexAuthState(storage);
+    const openAICodexAuthState = await getOpenAICodexAuthState(runtime);
     return {
         openai: openAICodexAuthState === 'missing'
             ? { configured: false, source: undefined }
@@ -149,17 +167,31 @@ export async function getAuthStatus({ env = process.env, storage, geminiStore =
             },
     };
 }
-function createOpenAICodexBrowserLoginOptions() {
+function createOpenAICodexBrowserLoginInteraction() {
     return {
-        onAuth: (info) => {
-            openUrlInBrowser(info.url);
-            process.stdout.write('Open this URL in your browser:\n');
-            process.stdout.write(`${info.url}\n`);
-            if (info.instructions) {
-                process.stdout.write(`${info.instructions}\n`);
+        notify: (event) => {
+            if (event.type === 'auth_url') {
+                openUrlInBrowser(event.url);
+                writeLine('Open this URL in your browser:');
+                writeLine(event.url);
+                if (event.instructions) {
+                    writeLine(event.instructions);
+                }
+            }
+            else if (event.type === 'info' || event.type === 'progress') {
+                writeLine(event.message);
+            }
+        },
+        prompt: async (prompt) => {
+            if (prompt.type === 'select') {
+                const browserOption = prompt.options.find(({ id }) => id === OPENAI_CODEX_BROWSER_LOGIN_METHOD);
+                if (!browserOption) {
+                    throw new Error('OpenAI Codex did not provide a browser login option');
+                }
+                return browserOption.id;
             }
+            return await promptInput(`${prompt.message} `, prompt.signal);
         },
-        onPrompt: async (prompt) => await promptInput(`${prompt.message} `),
     };
 }
 function openUrlInBrowser(url) {

package/dist/config.js

@@ -3,13 +3,15 @@ import { getEnvApiKeys } from './env.js';
 const REQUIRED_CLI_AUTH_PROVIDERS = [{ provider: 'openai', label: 'OpenAI' }];
 const ALL_REVIEW_FOCUSES = [
     'general',
+    'security',
+    'reuse',
     'quality',
     'efficiency',
     'tests',
     'standards',
 ];
 const OPENROUTER_REVIEW_MODELS = ['deepseek', 'zai'];
-const CLI_GEMINI_REVIEW_MODEL = 'gemini-3.5-flash';
+const CLI_GEMINI_REVIEW_MODEL = 'gemini-3.7-flash';
 function createCliGeminiCredential(apiKey) {
     return {
         apiKey,

package/dist/input.js

@@ -1,15 +1,15 @@
-import { createInterface } from 'node:readline';
-export function promptInput(prompt) {
-    return new Promise((resolve) => {
-        const rl = createInterface({
-            input: process.stdin,
-            output: process.stdout,
-        });
-        rl.question(prompt, (answer) => {
-            rl.close();
-            resolve(answer);
-        });
+import { createInterface } from 'node:readline/promises';
+export async function promptInput(prompt, signal) {
+    const rl = createInterface({
+        input: process.stdin,
+        output: process.stdout,
     });
+    try {
+        return await rl.question(prompt, { signal });
+    }
+    finally {
+        rl.close();
+    }
 }
 export function promptHiddenInput(prompt) {
     if (!process.stdin.isTTY) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@doist/doistbot-cli",
-    "version": "1.0.8",
+    "version": "1.0.9",
     "description": "Local self-review CLI for Doistbot",
     "type": "module",
     "main": "dist/index.js",
@@ -42,14 +42,15 @@
     "dependencies": {
         "@inquirer/checkbox": "5.2.1",
         "@inquirer/password": "5.1.1",
-        "@earendil-works/pi-ai": "0.80.6",
-        "@earendil-works/pi-coding-agent": "0.80.6",
+        "@earendil-works/pi-ai": "0.84.2",
+        "@earendil-works/pi-coding-agent": "0.84.2",
         "@napi-rs/keyring": "1.3.0",
         "ajv": "8.20.0",
         "chalk": "4.1.2",
         "commander": "14.0.3",
-        "js-yaml": "4.2.0",
+        "js-yaml": "4.3.1",
         "octokit": "5.0.5",
+        "undici": "8.9.0",
         "yocto-spinner": "1.2.0"
     },
     "devDependencies": {

package/sandbox/dist/core/pi.js

@@ -16,12 +16,12 @@ export const DEFAULT_PI_MODELS = {
     openai: 'gpt-5.6-terra',
 };
 export const DEFAULT_OPENROUTER_MODELS = {
-    deepseek: 'deepseek/deepseek-v4-pro',
+    deepseek: 'deepseek/deepseek-v4-pro-0813',
     gemini: 'google/gemini-3.1-pro-preview',
     zai: 'z-ai/glm-5.2',
 };
 // Gemini flash fallback model.
-export const DEFAULT_GEMINI_FLASH_MODEL = 'gemini-3.5-flash';
+export const DEFAULT_GEMINI_FLASH_MODEL = 'gemini-3.7-flash';
 export const MAX_PI_THINKING_BY_PROVIDER = {
     deepseek: 'high',
     gemini: 'high',
@@ -334,8 +334,14 @@ export function createPiInvoker({ provider, apiKey, piProviderId, cwd, extraEnv,
                 ...openRouterSessionExtension.args,
                 ...imageArgs,
             ];
-            const childEnv = {
+            const inheritedEnv = {
                 ...process.env,
+            };
+            // Repository-scoped credentials must be passed explicitly through
+            // extraEnv by an authorized task invocation.
+            delete inheritedEnv.GH_PACKAGES_TOKEN;
+            const childEnv = {
+                ...inheritedEnv,
                 HOME: process.env.HOME,
                 PATH: process.env.PATH,
                 GIT_TERMINAL_PROMPT: '0',

package/sandbox/dist/core/shared.js

@@ -40,16 +40,16 @@ export function optionalPositiveInt(value) {
 /**
  * Parses the base environment variables common to all sandbox tasks.
  */
-export function parseBaseContext() {
+export function parseBaseContext(env = process.env) {
     return {
-        owner: requiredEnv('REPO_OWNER'),
-        repo: requiredEnv('REPO_NAME'),
-        prNumber: requiredPositiveInt('PR_NUMBER'),
-        installationId: requiredPositiveInt('INSTALLATION_ID'),
-        appId: requiredEnv('APP_ID'),
-        privateKey: requiredEnv('PRIVATE_KEY'),
-        githubToken: process.env.GITHUB_TOKEN?.trim() || undefined,
-        deliveryId: process.env.DELIVERY_ID,
+        owner: requiredEnv('REPO_OWNER', env),
+        repo: requiredEnv('REPO_NAME', env),
+        prNumber: requiredPositiveInt('PR_NUMBER', env),
+        installationId: requiredPositiveInt('INSTALLATION_ID', env),
+        appId: requiredEnv('APP_ID', env),
+        privateKey: requiredEnv('PRIVATE_KEY', env),
+        githubToken: env.GITHUB_TOKEN?.trim() || undefined,
+        deliveryId: env.DELIVERY_ID?.trim() || undefined,
     };
 }
 export function resolveWriteOctokit({ githubToken, fallbackOctokit, }) {

package/sandbox/dist/core/span-test-helpers.js

@@ -0,0 +1,13 @@
+import { vi } from 'vitest';
+/**
+ * Shared assertion helper for the model/phase span tests, which all spy on
+ * `logger.info` and assert on the same `phase.*` envelope shape emitted by the
+ * LoggerSpanProcessor.
+ *
+ * Returns the `phase.end` envelopes for the given span name, in call order.
+ */
+export function phaseEnds(infoSpy, name) {
+    return infoSpy.mock.calls
+        .map((call) => call[1])
+        .filter((meta) => meta?.event === 'phase.end' && meta?.name === name);
+}

package/sandbox/dist/main.js

@@ -32,6 +32,9 @@ switch (taskType) {
     case 'review':
         await import('./tasks/review/review.js');
         break;
+    case 'review-slice-plan':
+        await import('./tasks/review-slice-plan/review-slice-plan.js');
+        break;
     default:
         process.stderr.write(`Unknown TASK_TYPE: ${taskType}\n`);
         process.exit(1);

package/sandbox/dist/tasks/issue-triage/autofix-capabilities.js

@@ -0,0 +1,22 @@
+const REPOSITORY_CAPABILITIES = {
+    'doist/todoist-web': ['github-packages-read'],
+};
+export function resolveAutofixCapabilities(repository) {
+    return REPOSITORY_CAPABILITIES[repository.toLowerCase()] ?? [];
+}
+export function resolveAutofixCapabilityEnv(repository, env = process.env) {
+    const capabilityEnv = {};
+    for (const capability of resolveAutofixCapabilities(repository)) {
+        if (capability === 'github-packages-read') {
+            const token = env.GH_PACKAGES_TOKEN?.trim();
+            if (!token) {
+                return {
+                    ok: false,
+                    reason: `Missing GH_PACKAGES_TOKEN for required autofix capability "${capability}" on ${repository}.`,
+                };
+            }
+            capabilityEnv.GH_PACKAGES_TOKEN = token;
+        }
+    }
+    return { ok: true, env: capabilityEnv };
+}

package/sandbox/dist/tasks/issue-triage/fix-attempt.js

@@ -1,6 +1,7 @@
 import { execFileSync } from 'child_process';
 import { logger } from '../../core/logging.js';
 import { fillPromptTemplate, loadPromptTemplateFile, resolvePromptFile, } from '../../core/prompt-template.js';
+import { resolveAutofixCapabilityEnv } from './autofix-capabilities.js';
 import { validateDiff } from './diff-validator.js';
 import { CODEX_CANNOT_FIX_REASON, FIX_LOOP_FAILED_REASON_PREFIX } from './fix-failure-reasons.js';
 import { CX_HERO_MANUAL_HANDLE, resolveHeroGroup } from './hero-group-map.js';
@@ -325,6 +326,10 @@ export async function runFixCore(input) {
             reason: buildFixAssessmentSkipReason(fixAssessment),
         };
     }
+    const capabilityEnvResult = resolveAutofixCapabilityEnv(targetRepo.repository.fullName);
+    if (!capabilityEnvResult.ok) {
+        return capabilityEnvResult;
+    }
     // Reset repo to clean state before fix attempt (triage Codex may have modified files).
     // Use `git reset --hard` to clear both the working tree and the index, since
     // captureGitDiff stages files with `git add -A`.
@@ -387,6 +392,7 @@ export async function runFixCore(input) {
         timeoutMs,
         extraEnv: {
             GH_TOKEN: input.ghToken,
+            ...capabilityEnvResult.env,
         },
     });
     if (!codexResult.ok) {

package/sandbox/dist/tasks/issue-triage/routing.js

@@ -15,21 +15,51 @@ function hasProductLabel(labels) {
 function stripMarkdownHeading(line) {
     return line.replace(/^#{1,6}\s+/, '').trim();
 }
-export function summarizeTriageReasoning(triageOutput, maxChars = 220) {
-    const summaryHeading = triageOutput.match(/^## Summary\s*$/im);
-    const summaryBody = summaryHeading?.index === undefined
-        ? triageOutput
-        : triageOutput.slice(summaryHeading.index + summaryHeading[0].length);
-    const nextHeading = summaryBody.search(/^##\s/m);
-    const candidate = nextHeading >= 0 ? summaryBody.slice(0, nextHeading) : summaryBody;
+function stripListMarker(line) {
+    return line.replace(/^\s*(?:\d+[.)]|[-*])\s+/, '').trim();
+}
+// `undefined` means the heading is absent; `''` means it is present but empty.
+// Callers depend on the difference — an empty `## Summary` has its own fallback.
+function sectionBody(triageOutput, heading) {
+    const match = triageOutput.match(new RegExp(`^## ${heading}\\s*$`, 'im'));
+    if (match?.index === undefined) {
+        return undefined;
+    }
+    const rest = triageOutput.slice(match.index + match[0].length);
+    const nextHeading = rest.search(/^##\s/m);
+    return (nextHeading >= 0 ? rest.slice(0, nextHeading) : rest).trim();
+}
+// The single sentence-boundary heuristic. Returns whole sentences or nothing —
+// a half-sentence of context is what made the old routing comment worthless, so
+// detail that doesn't fit is dropped, not clipped. Any complete sentence is worth
+// keeping, however short: the boundary check already rules out fragments.
+function sentencesWithin(text, maxChars) {
+    if (text.length <= maxChars) {
+        return text;
+    }
+    const clipped = text.slice(0, maxChars);
+    const sentenceEnd = Math.max(clipped.lastIndexOf('. '), clipped.lastIndexOf('! '), clipped.lastIndexOf('? '));
+    return sentenceEnd > 0 ? clipped.slice(0, sentenceEnd + 1) : undefined;
+}
+// As above, but for text we would rather shorten than lose. Falls back to a word
+// boundary + ellipsis when the budget holds no complete sentence at all.
+function trimToSentence(text, maxChars) {
+    const whole = sentencesWithin(text, maxChars);
+    if (whole !== undefined) {
+        return whole;
+    }
+    const capped = text.slice(0, maxChars - 3);
+    const wordEnd = capped.lastIndexOf(' ');
+    return `${(wordEnd > 0 ? capped.slice(0, wordEnd) : capped).trimEnd()}...`;
+}
+export function summarizeTriageReasoning(triageOutput, maxChars = 320) {
+    const candidate = sectionBody(triageOutput, 'Summary') ?? triageOutput;
     const firstParagraph = candidate
         .trim()
         .split(/\n\s*\n/)
         .map((paragraph) => paragraph
         .split('\n')
-        .map((line) => stripMarkdownHeading(line)
-        .replace(/^[-*]\s+/, '')
-        .trim())
+        .map((line) => stripListMarker(stripMarkdownHeading(line)))
         .filter(Boolean)
         .join(' '))
         .find(Boolean) ?? '';
@@ -37,12 +67,89 @@ export function summarizeTriageReasoning(triageOutput, maxChars = 220) {
     if (!normalized) {
         return 'See the triage summary above for details.';
     }
-    if (normalized.length <= maxChars) {
-        return normalized;
+    return trimToSentence(normalized, maxChars);
+}
+const NEXT_STEP_MAX_CHARS = 300;
+// Anchored on purpose: the verdict is the leading word of the line ("Medium — ...").
+// A loose substring search matches "low" inside "low-volume", "workflow" and "flow",
+// which turned ~25% of agreeing issues into false mismatch alerts.
+const SEVERITY_VERDICT = /^\W*(?:priority[:\s]+)?(critical|high|medium|low)\b/i;
+function severityRank(value) {
+    return value.match(SEVERITY_VERDICT)?.[1]?.toLowerCase();
+}
+function labelSeverity(labels) {
+    const label = labels.find((l) => l.trim().toLowerCase().startsWith('severity:'));
+    return label ? severityRank(label.split(':')[1] ?? '') : undefined;
+}
+function firstLineOf(triageOutput, heading) {
+    return sectionBody(triageOutput, heading)
+        ?.split('\n')
+        .map((line) => stripListMarker(line))
+        .find(Boolean);
+}
+// Triage agrees with the `Severity:*` label ~93% of the time, so restating the
+// assessed priority is noise. The 7% where it disagrees is the part worth reading
+// — and it skews toward triage rating the issue *worse* than the label.
+function buildSeverityMismatchLine(triageOutput, labels, maxChars) {
+    const priority = firstLineOf(triageOutput, 'Issue Priority Assessment');
+    const assessed = priority ? severityRank(priority) : undefined;
+    const labelled = labelSeverity(labels);
+    if (!priority || !assessed || !labelled || assessed === labelled) {
+        return undefined;
+    }
+    const alert = `Labelled \`Severity:${labelled}\`, triage assessed ${assessed}`;
+    const rationale = sentencesWithin(priority.replace(/^\W*\w+\s*[—–-]\s*/, '').trim(), maxChars);
+    return rationale ? `- ⚠️ **${alert}** — ${rationale}` : `- ⚠️ **${alert}.**`;
+}
+// The ping only fires when the fix pipeline declined the issue, but the team can't
+// see that from the outside. Naming the state plus why no PR exists saves them from
+// re-deriving it, and turns `insufficient-context` into an explicit ask.
+function buildStatusLine(assessment, maxChars) {
+    if (!assessment) {
+        return undefined;
     }
-    return `${normalized.slice(0, maxChars - 3).trimEnd()}...`;
+    const state = assessment.classification === 'insufficient-context'
+        ? 'Blocked, no PR opened'
+        : assessment.classification === 'needs-human'
+            ? 'Needs a human, no PR opened'
+            : `No PR opened (${assessment.confidence} confidence)`;
+    const scope = sentencesWithin(assessment.scope.replace(/\s+/g, ' ').trim(), maxChars);
+    return scope ? `- **${state}** — ${scope}` : `- **${state}.**`;
 }
-export function buildHeroRoutingComment({ labels, primaryRepo, triageOutput, }) {
+// ~1 in 6 triages concludes the code lives outside the repos the labels resolved to.
+// Without this the pinged team opens the issue, decides it isn't theirs, and bounces it.
+function buildRepoMismatchLine(assessment, resolvedRepos) {
+    const targetRepo = assessment?.targetRepo?.trim();
+    if (!targetRepo || resolvedRepos.length === 0) {
+        return undefined;
+    }
+    const matches = resolvedRepos.some((repo) => repo.toLowerCase() === targetRepo.toLowerCase());
+    if (matches) {
+        return undefined;
+    }
+    return `- ⚠️ **Likely in \`${targetRepo}\`**, not ${resolvedRepos.map((repo) => `\`${repo}\``).join(' / ')} — may belong to another team.`;
+}
+/**
+ * Compact recap for the hero routing ping. The full triage comment sits directly
+ * above it with `## Summary` visible, so this deliberately carries only what that
+ * summary doesn't: the exceptions worth alerting on, and the next concrete action.
+ */
+export function buildTriageRecap({ triageOutput, assessment, labels = [], resolvedRepos = [], maxChars = 220, }) {
+    const nextStep = firstLineOf(triageOutput, 'Suggested Triage Action');
+    const lines = [
+        buildSeverityMismatchLine(triageOutput, labels, maxChars),
+        buildRepoMismatchLine(assessment, resolvedRepos),
+        buildStatusLine(assessment, maxChars),
+        // The action is the payload, so it gets a wider budget than supporting
+        // detail and keeps ellipsis as a last resort rather than being dropped.
+        nextStep && `- **Next step:** ${trimToSentence(nextStep, NEXT_STEP_MAX_CHARS)}`,
+    ].filter(Boolean);
+    if (lines.length === 0) {
+        return summarizeTriageReasoning(triageOutput);
+    }
+    return lines.join('\n');
+}
+export function buildHeroRoutingComment({ labels, primaryRepo, triageOutput, assessment, resolvedRepos, }) {
     if (!hasProductLabel(labels)) {
         return CX_NO_PRODUCT_LABEL_COMMENT;
     }
@@ -52,7 +159,9 @@ export function buildHeroRoutingComment({ labels, primaryRepo, triageOutput, })
     }
     return `${HERO_ROUTING_MARKER}
 
-Routing to ${heroGroup.mention} for triage. ${summarizeTriageReasoning(triageOutput)}`;
+Routing to ${heroGroup.mention} for triage.
+
+${buildTriageRecap({ triageOutput, assessment, labels, resolvedRepos })}`;
 }
 export function shouldPostHeroRoutingComment(fixAssessment) {
     if (!fixAssessment) {

package/sandbox/dist/tasks/issue-triage/triage.js

@@ -289,6 +289,8 @@ async function runIssueTriagePipeline(ctx, mode) {
                         ? resolution.repositories[0]
                         : undefined,
                     triageOutput: validated.output,
+                    assessment: fixAssessment,
+                    resolvedRepos: resolution.repositories.map((repo) => repo.fullName),
                 });
                 await postTriageRouting({
                     octokit: writeOctokit,

package/sandbox/dist/tasks/review/engines/multi-focus.js

@@ -11,6 +11,8 @@ import { dedupeMultiFocusFindings } from './dedupe.js';
 import { buildGeminiFlashCredential, getApiKeys, getAvailableModels, getEnabledReviewModels, getOpenRouterReviewCredential, getProviderFailures, requestModelReview, } from './shared.js';
 const DEFAULT_REVIEW_MODELS_BY_FOCUS = {
     general: ['deepseek', 'zai', 'openai'],
+    security: ['deepseek', 'zai', 'openai'],
+    reuse: ['deepseek', 'zai', 'openai'],
     quality: ['deepseek', 'zai', 'openai'],
     efficiency: ['deepseek', 'zai', 'openai'],
     tests: ['deepseek', 'zai'],
@@ -20,12 +22,18 @@ const DEFAULT_REVIEW_MODELS_BY_FOCUS = {
 // a caller opts into a wider fallback set.
 const DEFAULT_GEMINI_FLASH_FALLBACK_FOCUSES = [
     'general',
+    'security',
+    'reuse',
     'quality',
     'efficiency',
 ];
 // Open models whose failed pass triggers that fallback.
 const GEMINI_FLASH_FALLBACK_MODELS = ['deepseek', 'zai'];
-const LOW_PRIORITY_SUMMARY_NOTICE = 'I also included a few optional follow-up notes in the details below.';
+function lowPrioritySummaryNotice(count) {
+    return count === 1
+        ? 'I also left one optional follow-up note in the details below.'
+        : 'I also included a few optional follow-up notes in the details below.';
+}
 // Workflow phase orchestrating the council fan-out; one model span per pass.
 const MULTI_FOCUS_PHASE = 'review.multi-focus';
 const FOCUS_PASS_PHASE = 'review.focus-pass';
@@ -203,18 +211,18 @@ function appendSummaryOnlyFindings(summary, summaryFindings) {
         return summary;
     }
     const title = `Optional follow-up note${notes.length === 1 ? '' : 's'} (${notes.length})`;
-    return `${summary.trim()}\n\n${LOW_PRIORITY_SUMMARY_NOTICE}\n\n<details>\n<summary>${title}</summary>\n\n${notes.join('\n')}\n\n</details>`;
+    return `${summary.trim()}\n\n${lowPrioritySummaryNotice(notes.length)}\n\n<details>\n<summary>${title}</summary>\n\n${notes.join('\n')}\n\n</details>`;
 }
-function buildSummarySynthesisFindings({ inlineFindings, summaryFindings, }) {
-    return Array.from(new Set([
-        ...inlineFindings.map((finding) => finding.body.trim()),
-        ...summaryFindings.map((finding) => formatSummaryOnlyFinding(finding)),
-    ].filter(Boolean)));
+// Summary-only (P3) findings are deliberately excluded: they already render in
+// the "Optional follow-up note" details block, and feeding them here made the
+// summary restate a single P3 nit under "Few things worth tightening:".
+function buildSummarySynthesisFindings(inlineFindings) {
+    return Array.from(new Set(inlineFindings.map((finding) => finding.body.trim()).filter(Boolean)));
 }
 async function buildMultiFocusReviewOutput({ inlineFindings, summaryFindings, lineLookup, prTitle, prBody, reviewObservations, summaryModel, summaryFallbackModels, workspaceDir, }) {
     const comments = convertFindingsToComments(inlineFindings, lineLookup);
     const inlineCommentFindings = Array.from(new Set(comments.map((comment) => comment.body.trim()).filter(Boolean)));
-    const findings = buildSummarySynthesisFindings({ inlineFindings, summaryFindings });
+    const findings = buildSummarySynthesisFindings(inlineFindings);
     const hasReviewFindings = inlineFindings.length > 0 || summaryFindings.length > 0;
     if (!hasReviewFindings) {
         logger.info('Review summary synthesis skipped for clean review', {

package/sandbox/dist/tasks/review/multi-focus-prompt.js

@@ -14,6 +14,8 @@ const MULTI_FOCUS_BASE_PROMPT_FILE = `${REVIEW_PROMPTS_DIR}/review-multi-focus-b
 const REVIEW_FOCUS_PROMPTS_DIR = `${REVIEW_PROMPTS_DIR}/review-focus-prompts`;
 export const REVIEW_FOCUS_DEFINITIONS = [
     { name: 'general', title: 'General', fileName: 'general.md' },
+    { name: 'security', title: 'Security', fileName: 'security.md' },
+    { name: 'reuse', title: 'Reuse', fileName: 'reuse.md' },
     { name: 'quality', title: 'Quality', fileName: 'quality.md' },
     { name: 'efficiency', title: 'Efficiency', fileName: 'efficiency.md' },
     { name: 'tests', title: 'Tests', fileName: 'tests.md' },