@humanbased/crosscheck 0.15.1-beta.0 → 0.16.0-beta.16

package/dist/lib/clone.js

@@ -1,4 +1,4 @@
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 // Bypass `gh repo clone` so gh's keyring auth (which may bridge to VS Code's
 // GitHub extension) is never invoked. HTTPS embeds the token in the URL.
 function buildCloneUrl(owner, repo, token, protocol) {
@@ -6,22 +6,38 @@ function buildCloneUrl(owner, repo, token, protocol) {
         ? `https://x-access-token:${token}@github.com/${owner}/${repo}.git`
         : `git@github.com:${owner}/${repo}.git`;
 }
+export function redactCloneSecrets(value) {
+    return value.replace(/https:\/\/x-access-token:[^@\s]+@github\.com\//g, 'https://x-access-token:[REDACTED]@github.com/');
+}
+function runGit(args, cwd) {
+    try {
+        execFileSync('git', args, { cwd, stdio: 'pipe' });
+    }
+    catch (err) {
+        if (!(err instanceof Error))
+            throw err;
+        const redacted = redactCloneSecrets(err.message);
+        const wrapped = new Error(redacted);
+        wrapped.stack = err.stack ? redactCloneSecrets(err.stack) : undefined;
+        throw wrapped;
+    }
+}
 // Clone the repo, fetch & checkout the PR head, and fetch the base ref into
 // refs/remotes/origin/<base>. onBaseFetchFailed lets callers log a warning;
 // other failures bubble up.
 export function clonePRForReview(params) {
     const { owner, repo, prNumber, baseRef, tmpDir, token, protocol, onBaseFetchFailed } = params;
     const cloneUrl = buildCloneUrl(owner, repo, token, protocol);
-    execSync(`git clone --depth=50 --quiet ${cloneUrl} ${tmpDir}`, { stdio: 'pipe' });
-    execSync(`git fetch origin pull/${prNumber}/head:pr-${prNumber}`, { cwd: tmpDir, stdio: 'pipe' });
-    execSync(`git checkout pr-${prNumber}`, { cwd: tmpDir, stdio: 'pipe' });
+    runGit(['clone', '--depth=50', '--quiet', cloneUrl, tmpDir]);
+    runGit(['fetch', 'origin', `pull/${prNumber}/head:pr-${prNumber}`], tmpDir);
+    runGit(['checkout', `pr-${prNumber}`], tmpDir);
     // Fetch base after PR checkout so we are never on the base branch during the fetch
     // (git refuses to update a checked-out ref). Explicit refs/remotes/origin/<base>
     // target so the remote-tracking ref is always created — `git fetch origin <branch>`
     // alone only writes FETCH_HEAD in shallow clones when the branch is absent from
     // the default refspec mapping.
     try {
-        execSync(`git fetch origin ${baseRef}:refs/remotes/origin/${baseRef}`, { cwd: tmpDir, stdio: 'pipe' });
+        runGit(['fetch', 'origin', `${baseRef}:refs/remotes/origin/${baseRef}`], tmpDir);
     }
     catch {
         onBaseFetchFailed?.();

package/dist/lib/clone.js.map

@@ -1 +1 @@
-{"version":3,"file":"clone.js","sourceRoot":"","sources":["../../src/lib/clone.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAGxC,6EAA6E;AAC7E,yEAAyE;AACzE,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY,EAAE,KAAa,EAAE,QAAkC;IACnG,OAAO,QAAQ,KAAK,OAAO;QACzB,CAAC,CAAC,0BAA0B,KAAK,eAAe,KAAK,IAAI,IAAI,MAAM;QACnE,CAAC,CAAC,kBAAkB,KAAK,IAAI,IAAI,MAAM,CAAA;AAC3C,CAAC;AAED,4EAA4E;AAC5E,4EAA4E;AAC5E,4BAA4B;AAC5B,MAAM,UAAU,gBAAgB,CAAC,MAShC;IACC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAA;IAC7F,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC5D,QAAQ,CAAC,gCAAgC,QAAQ,IAAI,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACjF,QAAQ,CAAC,yBAAyB,QAAQ,YAAY,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACjG,QAAQ,CAAC,mBAAmB,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,mFAAmF;IACnF,iFAAiF;IACjF,oFAAoF;IACpF,gFAAgF;IAChF,+BAA+B;IAC/B,IAAI,CAAC;QACH,QAAQ,CAAC,oBAAoB,OAAO,wBAAwB,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACxG,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB,EAAE,EAAE,CAAA;IACvB,CAAC;AACH,CAAC"}
+{"version":3,"file":"clone.js","sourceRoot":"","sources":["../../src/lib/clone.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAG5C,6EAA6E;AAC7E,yEAAyE;AACzE,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY,EAAE,KAAa,EAAE,QAAkC;IACnG,OAAO,QAAQ,KAAK,OAAO;QACzB,CAAC,CAAC,0BAA0B,KAAK,eAAe,KAAK,IAAI,IAAI,MAAM;QACnE,CAAC,CAAC,kBAAkB,KAAK,IAAI,IAAI,MAAM,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,iDAAiD,EAAE,+CAA+C,CAAC,CAAA;AAC1H,CAAC;AAED,SAAS,MAAM,CAAC,IAAc,EAAE,GAAY;IAC1C,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;YAAE,MAAM,GAAG,CAAA;QACtC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAChD,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAA;QACnC,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACrE,MAAM,OAAO,CAAA;IACf,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,4EAA4E;AAC5E,4BAA4B;AAC5B,MAAM,UAAU,gBAAgB,CAAC,MAShC;IACC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAA;IAC7F,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC5D,MAAM,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAA;IAC5D,MAAM,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,QAAQ,YAAY,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAA;IAC3E,MAAM,CAAC,CAAC,UAAU,EAAE,MAAM,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAA;IAC9C,mFAAmF;IACnF,iFAAiF;IACjF,oFAAoF;IACpF,gFAAgF;IAChF,+BAA+B;IAC/B,IAAI,CAAC;QACH,MAAM,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,wBAAwB,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAA;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB,EAAE,EAAE,CAAA;IACvB,CAAC;AACH,CAAC"}

package/dist/lib/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,MAAM,aAAa,GACrB,MAAM,GACN,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,QAAQ,GACR,SAAS,GACT,SAAS,GACT,YAAY,GACZ,SAAS,CAAA;AAQb,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAsBnD;AAED,wBAAgB,GAAG,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAKzC;AAWD,wBAAgB,WAAW,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAKjD;AAED,wBAAgB,wBAAwB,IAAI,OAAO,CAElD;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAmB5D;AAuBD,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,GAAG,IAAI,CAE7E;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,eAAe,IAAI,MAAM,CAGxC;AAGD,wBAAgB,WAAW,CAAC,MAAM,EAAE,mBAAmB,GAAG,oBAAoB,EAAE,GAAG,EAAE,OAAO,GAAG,IAAI,CAElG"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,MAAM,aAAa,GACrB,MAAM,GACN,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,QAAQ,GACR,SAAS,GACT,SAAS,GACT,YAAY,GACZ,SAAS,CAAA;AAQb,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAsBnD;AAED,wBAAgB,GAAG,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAKzC;AAWD,wBAAgB,WAAW,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAKjD;AAED,wBAAgB,wBAAwB,IAAI,OAAO,CAElD;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAoB5D;AAuBD,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,GAAG,IAAI,CAE7E;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,eAAe,IAAI,MAAM,CAGxC;AAGD,wBAAgB,WAAW,CAAC,MAAM,EAAE,mBAAmB,GAAG,oBAAoB,EAAE,GAAG,EAAE,OAAO,GAAG,IAAI,CAElG"}

package/dist/lib/logger.js

@@ -71,13 +71,14 @@ export function classifyError(message) {
         return 'overloaded';
     if (/maximum budget|budget (?:exhausted|exceeded)|error_max_budget|reached maximum budget/.test(m))
         return 'budget';
-    if (/bad credentials|401|not logged in|not authenticated|github_token|authentication required|token/.test(m))
+    if (/bad credentials|401|not logged in|not authenticated|github_token|authentication required|token|auth failure/.test(m))
         return 'auth';
     if (/admin:org|admin:repo|forbidden|403|insufficient scope|requires.*scope|write:org/.test(m))
         return 'permission';
     // Network check must precede timeout: subprocess stderr containing 'fetch failed'
     // would otherwise be shadowed by '--no-timeout' in the CLI command string.
-    if (/fetch failed|econnrefused|enotfound|network error|socket hang|socket timeout/.test(m))
+    // ssl_error_syscall / libressl covers macOS LibreSSL errors on git clone/fetch.
+    if (/fetch failed|econnrefused|enotfound|network error|socket hang|socket timeout|ssl_error_syscall|libressl/.test(m))
         return 'network';
     if (/timeout|timed out|etimedout|deadline/.test(m))
         return 'timeout';

package/dist/lib/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAc,MAAM,IAAI,CAAA;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAA;AAoB5B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,CAAA;AAEtD,IAAI,QAAQ,GAAG,KAAK,CAAA;AACpB,IAAI,gBAAgB,GAAG,KAAK,CAAA;AAC5B,IAAI,QAAQ,GAAG,EAAE,CAAA;AAEjB,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAA;IACzB,yEAAyE;IACzE,8EAA8E;IAC9E,gBAAgB,GAAG,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,IAAI,KAAK,CAAC,CAAA;IAClE,IAAI,CAAC,QAAQ;QAAE,OAAM;IAErB,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEvC,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IACzE,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,SAAQ;YACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAA;YACxC,IAAI,KAAK,GAAG,QAAQ;gBAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAE7B,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACnD,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,SAAS,CAAC,CAAA;AAC7C,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,KAAe;IACjC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAM;IAClC,IAAI,CAAC;QACH,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;IAC7F,CAAC;IAAC,MAAM,CAAC,CAAC,gDAAgD,CAAC,CAAC;AAC9D,CAAC;AAED,oFAAoF;AACpF,iFAAiF;AACjF,EAAE;AACF,4EAA4E;AAC5E,uEAAuE;AACvE,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,qFAAqF;AACrF,MAAM,UAAU,WAAW,CAAC,KAAe;IACzC,IAAI,CAAC,gBAAgB,IAAI,CAAC,QAAQ;QAAE,OAAM;IAC1C,IAAI,CAAC;QACH,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;IAC9G,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,gBAAgB,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;IAC/B,6EAA6E;IAC7E,+EAA+E;IAC/E,+EAA+E;IAC/E,qFAAqF;IACrF,yEAAyE;IACzE,+EAA+E;IAC/E,IAAI,mCAAmC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,YAAY,CAAA;IACpE,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,YAAY,CAAA;IACrD,IAAI,sFAAsF,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAA;IACnH,IAAI,gGAAgG,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAA;IAC3H,IAAI,iFAAiF,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,YAAY,CAAA;IAClH,kFAAkF;IAClF,2EAA2E;IAC3E,IAAI,8EAA8E,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IAC5G,IAAI,sCAAsC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IACpE,IAAI,2DAA2D,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,YAAY,CAAA;IAC5F,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,8FAA8F;AAC9F,SAAS,kBAAkB,CAAC,GAAY;IACtC,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IAEhD,MAAM,UAAU,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACnE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,UAAU,CAAA;IACnG,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1E,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;IAE1C,0EAA0E;IAC1E,MAAM,UAAU,GAAG,GAA8B,CAAA;IACjD,MAAM,QAAQ,GAAG,OAAO,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1F,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IAChE,MAAM,MAAM,GAAG,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE;QAC9E,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAE,qBAAqB;QAC/D,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,OAAO,GAAG,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAEvF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AAC1E,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAgC,EAAE,GAAY;IACrE,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACnD,OAAO,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,SAAS,CAAC,CAAA;AACzC,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,MAAkD,EAAE,GAAY;IAC1F,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;AACrF,CAAC"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAc,MAAM,IAAI,CAAA;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAA;AAoB5B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,CAAA;AAEtD,IAAI,QAAQ,GAAG,KAAK,CAAA;AACpB,IAAI,gBAAgB,GAAG,KAAK,CAAA;AAC5B,IAAI,QAAQ,GAAG,EAAE,CAAA;AAEjB,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAA;IACzB,yEAAyE;IACzE,8EAA8E;IAC9E,gBAAgB,GAAG,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,IAAI,KAAK,CAAC,CAAA;IAClE,IAAI,CAAC,QAAQ;QAAE,OAAM;IAErB,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEvC,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IACzE,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,SAAQ;YACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAA;YACxC,IAAI,KAAK,GAAG,QAAQ;gBAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAE7B,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACnD,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,SAAS,CAAC,CAAA;AAC7C,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,KAAe;IACjC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAM;IAClC,IAAI,CAAC;QACH,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;IAC7F,CAAC;IAAC,MAAM,CAAC,CAAC,gDAAgD,CAAC,CAAC;AAC9D,CAAC;AAED,oFAAoF;AACpF,iFAAiF;AACjF,EAAE;AACF,4EAA4E;AAC5E,uEAAuE;AACvE,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,qFAAqF;AACrF,MAAM,UAAU,WAAW,CAAC,KAAe;IACzC,IAAI,CAAC,gBAAgB,IAAI,CAAC,QAAQ;QAAE,OAAM;IAC1C,IAAI,CAAC;QACH,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;IAC9G,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,gBAAgB,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;IAC/B,6EAA6E;IAC7E,+EAA+E;IAC/E,+EAA+E;IAC/E,qFAAqF;IACrF,yEAAyE;IACzE,+EAA+E;IAC/E,IAAI,mCAAmC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,YAAY,CAAA;IACpE,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,YAAY,CAAA;IACrD,IAAI,sFAAsF,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAA;IACnH,IAAI,6GAA6G,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAA;IACxI,IAAI,iFAAiF,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,YAAY,CAAA;IAClH,kFAAkF;IAClF,2EAA2E;IAC3E,gFAAgF;IAChF,IAAI,yGAAyG,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IACvI,IAAI,sCAAsC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IACpE,IAAI,2DAA2D,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,YAAY,CAAA;IAC5F,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,8FAA8F;AAC9F,SAAS,kBAAkB,CAAC,GAAY;IACtC,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IAEhD,MAAM,UAAU,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACnE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,UAAU,CAAA;IACnG,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1E,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;IAE1C,0EAA0E;IAC1E,MAAM,UAAU,GAAG,GAA8B,CAAA;IACjD,MAAM,QAAQ,GAAG,OAAO,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1F,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IAChE,MAAM,MAAM,GAAG,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE;QAC9E,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAE,qBAAqB;QAC/D,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,OAAO,GAAG,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAEvF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AAC1E,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAgC,EAAE,GAAY;IACrE,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACnD,OAAO,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,SAAS,CAAC,CAAA;AACzC,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,MAAkD,EAAE,GAAY;IAC1F,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;AACrF,CAAC"}

package/dist/lib/remediation.d.ts

@@ -0,0 +1,3 @@
+import type { ErrorCategory } from './logger.js';
+export declare function hintForError(category: ErrorCategory, message: string): string;
+//# sourceMappingURL=remediation.d.ts.map

package/dist/lib/remediation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediation.d.ts","sourceRoot":"","sources":["../../src/lib/remediation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAKhD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CA0B7E"}

package/dist/lib/remediation.js

@@ -0,0 +1,34 @@
+// Returns a short one-line remediation hint for the operator given an error
+// category and the raw error message. Returns empty string when no specific
+// action can be suggested (subprocess / unknown — too varied to generalise).
+export function hintForError(category, message) {
+    const m = message.toLowerCase();
+    switch (category) {
+        case 'auth':
+            if (/codex/.test(m))
+                return 'run: codex login';
+            if (/claude/.test(m))
+                return 'run: claude auth login';
+            if (/github_token|bad credentials/.test(m))
+                return 'check env: GITHUB_TOKEN';
+            return 'run: claude auth login  (or codex login, or check GITHUB_TOKEN)';
+        case 'network':
+            if (/ssl_error_syscall|libressl|ssl_connect/.test(m))
+                return 'transient macOS/LibreSSL SSL error — retry in a moment; or set clone_protocol: ssh in crosscheck.config.yml';
+            return 'check network connectivity to github.com';
+        case 'timeout':
+            return 'raise vendor.<reviewer>.timeout_sec in config, or pass --timeout 600s';
+        case 'rate_limit':
+            return 'GitHub or model API rate limit — wait a few minutes and retry';
+        case 'overloaded':
+            return 'model API temporarily overloaded — retry in ~1 minute';
+        case 'budget':
+            return 'raise per_review_budget_usd in config, or run with --no-timeout for uncapped mode';
+        case 'permission':
+            return 'check GITHUB_TOKEN scopes — requires: repo, read:org';
+        case 'subprocess':
+        case 'unknown':
+            return '';
+    }
+}
+//# sourceMappingURL=remediation.js.map

package/dist/lib/remediation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediation.js","sourceRoot":"","sources":["../../src/lib/remediation.ts"],"names":[],"mappings":"AAEA,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,QAAuB,EAAE,OAAe;IACnE,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;IAC/B,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,MAAM;YACT,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,kBAAkB,CAAA;YAC9C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,wBAAwB,CAAA;YACrD,IAAI,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,yBAAyB,CAAA;YAC5E,OAAO,iEAAiE,CAAA;QAC1E,KAAK,SAAS;YACZ,IAAI,wCAAwC,CAAC,IAAI,CAAC,CAAC,CAAC;gBAClD,OAAO,6GAA6G,CAAA;YACtH,OAAO,0CAA0C,CAAA;QACnD,KAAK,SAAS;YACZ,OAAO,uEAAuE,CAAA;QAChF,KAAK,YAAY;YACf,OAAO,+DAA+D,CAAA;QACxE,KAAK,YAAY;YACf,OAAO,uDAAuD,CAAA;QAChE,KAAK,QAAQ;YACX,OAAO,mFAAmF,CAAA;QAC5F,KAAK,YAAY;YACf,OAAO,sDAAsD,CAAA;QAC/D,KAAK,YAAY,CAAC;QAClB,KAAK,SAAS;YACZ,OAAO,EAAE,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/lib/reviewer-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reviewer-error.d.ts","sourceRoot":"","sources":["../../src/lib/reviewer-error.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAU7D,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,kBAAkB,CAAA;IAE1B,OAAO,EAAE,MAAM,CAAA;IAEf,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAmDlF"}
+{"version":3,"file":"reviewer-error.d.ts","sourceRoot":"","sources":["../../src/lib/reviewer-error.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAU7D,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,kBAAkB,CAAA;IAE1B,OAAO,EAAE,MAAM,CAAA;IAEf,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAmElF"}

package/dist/lib/reviewer-error.js

@@ -44,11 +44,26 @@ export function classifyReviewerError(err) {
             details: `Vendor: \`${vendor}\`\nError: ${stripVendorPrefix(err.message)}`,
         };
     }
-    // Catch-all: auth failure, network, subprocess crash, garbled output, etc.
+    // Auth failure — surface a specific login command rather than a generic message.
+    const msgBody = stripVendorPrefix(err.message);
+    if (/not logged in|auth failure|authentication required|bad credentials|unauthorized/i.test(msgBody)) {
+        const loginCmd = vendor === 'claude' ? 'claude auth login' : 'codex login';
+        return {
+            reason: 'subprocess_error',
+            summary: `${vendor} auth expired — run \`${loginCmd}\` on the crosscheck host`,
+            details: [
+                `Vendor: \`${vendor}\``,
+                `Fix: run \`${loginCmd}\` on the machine running crosscheck to re-authenticate.`,
+                '',
+                `Error: ${msgBody}`,
+            ].join('\n'),
+        };
+    }
+    // Catch-all: network, subprocess crash, garbled output, etc.
     const detailLines = [`Vendor: \`${vendor}\``];
     if (ann.exitCode !== undefined)
         detailLines.push(`Exit code: ${ann.exitCode}`);
-    detailLines.push(`Error: ${stripVendorPrefix(err.message)}`);
+    detailLines.push(`Error: ${msgBody}`);
     if (ann.stderr && ann.stderr.trim().length > 0) {
         const tail = ann.stderr.trim().split('\n').slice(-5).join('\n');
         detailLines.push('', '```', tail, '```');

package/dist/lib/reviewer-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"reviewer-error.js","sourceRoot":"","sources":["../../src/lib/reviewer-error.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AACzE,4CAA4C;AAC5C,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAC9E,8EAA8E;AAC9E,4BAA4B;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAmB5D,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACxC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IAExD,MAAM,GAAG,GAAG,GAAuC,CAAA;IACnD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAA;IAErE,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,GAAG,CAAC,kBAAkB,KAAK,SAAS;YACrD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,GAAG,IAAI,CAAC;YAC3C,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,KAAK,SAAS;YAClD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC;YACrC,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,OAAO,GAAG,UAAU,KAAK,SAAS;YACtC,CAAC,CAAC,GAAG,MAAM,wCAAwC,UAAU,GAAG;YAChE,CAAC,CAAC,GAAG,MAAM,gCAAgC,CAAA;QAC7C,MAAM,WAAW,GAAG;YAClB,aAAa,MAAM,IAAI;SACxB,CAAA;QACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,WAAW,CAAC,IAAI,CAAC,uBAAuB,UAAU,GAAG,CAAC,CAAA;QACxD,CAAC;QACD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,WAAW,CAAC,IAAI,CAAC,wBAAwB,aAAa,yCAAyC,CAAC,CAAA;QAClG,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,kGAAkG,CAAC,CAAA;QACxH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;IACxE,CAAC;IAED,IAAI,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,GAAG,MAAM,oCAAoC;YACtD,OAAO,EAAE,aAAa,MAAM,cAAc,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;SAC3E,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,WAAW,GAAG,CAAC,aAAa,MAAM,IAAI,CAAC,CAAA;IAC7C,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;QAAE,WAAW,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC9E,WAAW,CAAC,IAAI,CAAC,UAAU,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5D,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/D,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO;QACL,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,GAAG,MAAM,6BAA6B;QAC/C,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;KAChC,CAAA;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAA;AAC/C,CAAC"}
+{"version":3,"file":"reviewer-error.js","sourceRoot":"","sources":["../../src/lib/reviewer-error.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AACzE,4CAA4C;AAC5C,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAC9E,8EAA8E;AAC9E,4BAA4B;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAmB5D,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACxC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IAExD,MAAM,GAAG,GAAG,GAAuC,CAAA;IACnD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAA;IAErE,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,GAAG,CAAC,kBAAkB,KAAK,SAAS;YACrD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,GAAG,IAAI,CAAC;YAC3C,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,KAAK,SAAS;YAClD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC;YACrC,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,OAAO,GAAG,UAAU,KAAK,SAAS;YACtC,CAAC,CAAC,GAAG,MAAM,wCAAwC,UAAU,GAAG;YAChE,CAAC,CAAC,GAAG,MAAM,gCAAgC,CAAA;QAC7C,MAAM,WAAW,GAAG;YAClB,aAAa,MAAM,IAAI;SACxB,CAAA;QACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,WAAW,CAAC,IAAI,CAAC,uBAAuB,UAAU,GAAG,CAAC,CAAA;QACxD,CAAC;QACD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,WAAW,CAAC,IAAI,CAAC,wBAAwB,aAAa,yCAAyC,CAAC,CAAA;QAClG,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,kGAAkG,CAAC,CAAA;QACxH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;IACxE,CAAC;IAED,IAAI,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,GAAG,MAAM,oCAAoC;YACtD,OAAO,EAAE,aAAa,MAAM,cAAc,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;SAC3E,CAAA;IACH,CAAC;IAED,iFAAiF;IACjF,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC9C,IAAI,kFAAkF,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrG,MAAM,QAAQ,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,aAAa,CAAA;QAC1E,OAAO;YACL,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,GAAG,MAAM,yBAAyB,QAAQ,2BAA2B;YAC9E,OAAO,EAAE;gBACP,aAAa,MAAM,IAAI;gBACvB,cAAc,QAAQ,0DAA0D;gBAChF,EAAE;gBACF,UAAU,OAAO,EAAE;aACpB,CAAC,IAAI,CAAC,IAAI,CAAC;SACb,CAAA;IACH,CAAC;IAED,6DAA6D;IAC7D,MAAM,WAAW,GAAG,CAAC,aAAa,MAAM,IAAI,CAAC,CAAA;IAC7C,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;QAAE,WAAW,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC9E,WAAW,CAAC,IAAI,CAAC,UAAU,OAAO,EAAE,CAAC,CAAA;IACrC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/D,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO;QACL,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,GAAG,MAAM,6BAA6B;QAC/C,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;KAChC,CAAA;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAA;AAC/C,CAAC"}

package/dist/lib/runner.d.ts

@@ -20,6 +20,8 @@ export interface WorkflowCompleteInputs {
     round?: number;
     trigger?: WorkflowTrigger;
     qualityTier?: string;
+    workflowError?: unknown;
+    failedStep?: string;
     now?: number;
 }
 export type WorkflowEndedReason = 'completed' | 'error' | 'progress_gate' | 'max_iterations' | 'manual_abort';
@@ -70,6 +72,7 @@ export interface WorkflowContext {
 export interface WorkflowResult {
     verdict: string | null;
     fixAppliedCount?: number;
+    fixSkipReason?: string;
     latestReviewComment?: {
         id?: number;
         body: string;

package/dist/lib/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/lib/runner.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAa9C,OAAO,EAA8B,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAChF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAgB9C,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGzD;AAID,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,MAAM,CAEpF;AAWD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAqBnF;AAOD,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,CAAA;AAE7F,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IACnC,cAAc,EAAE,OAAO,CAAA;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAOD,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,OAAO,GACP,eAAe,GACf,gBAAgB,GAChB,cAAc,CAAA;AAElB,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,sBAAsB,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgCzB;AAKD,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,MAAM,EACrB,gBAAgB,EAAE,MAAM,EACxB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAOT;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,EAAE,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,QAAQ,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IAC1B,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,IAAI,CAAA;IAE1D,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAG3B,YAAY,CAAC,EAAE,OAAO,CAAA;IAEtB,KAAK,CAAC,EAAE,MAAM,CAAA;IAGd,MAAM,CAAC,EAAE,OAAO,CAAA;IAGhB,KAAK,CAAC,EAAE,OAAO,eAAe,EAAE,YAAY,EAAE,CAAA;IAG9C,mBAAmB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;IAMxC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IAIrB,oBAAoB,CAAC,EAAE;QACrB,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;IAID,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAG1B,SAAS,CAAC,EAAE,OAAO,GAAG,WAAW,CAAA;IAGjC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAE1B,OAAO,CAAC,EAAE,eAAe,CAAA;IAIzB,aAAa,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAA;CAChH;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAGtB,eAAe,CAAC,EAAE,MAAM,CAAA;IAIxB,mBAAmB,CAAC,EAAE;QACpB,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;CACF;AAkDD,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,GAC5B;IAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,GAAG,IAAI,CAAC;IAAC,iBAAiB,EAAE,OAAO,CAAA;CAAE,CAenE;AA4ED,wBAAsB,WAAW,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CA8tB/E"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/lib/runner.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAa9C,OAAO,EAA8B,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAChF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAiB9C,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGzD;AAID,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,MAAM,CAEpF;AAWD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAqBnF;AAOD,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,CAAA;AAE7F,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IACnC,cAAc,EAAE,OAAO,CAAA;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAOD,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,OAAO,GACP,eAAe,GACf,gBAAgB,GAChB,cAAc,CAAA;AAElB,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,sBAAsB,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsCzB;AAKD,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,MAAM,EACrB,gBAAgB,EAAE,MAAM,EACxB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAOT;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,EAAE,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,QAAQ,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IAC1B,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,IAAI,CAAA;IAE1D,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAG3B,YAAY,CAAC,EAAE,OAAO,CAAA;IAEtB,KAAK,CAAC,EAAE,MAAM,CAAA;IAGd,MAAM,CAAC,EAAE,OAAO,CAAA;IAGhB,KAAK,CAAC,EAAE,OAAO,eAAe,EAAE,YAAY,EAAE,CAAA;IAG9C,mBAAmB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;IAMxC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IAIrB,oBAAoB,CAAC,EAAE;QACrB,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;IAID,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAG1B,SAAS,CAAC,EAAE,OAAO,GAAG,WAAW,CAAA;IAGjC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAE1B,OAAO,CAAC,EAAE,eAAe,CAAA;IAIzB,aAAa,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAA;CAChH;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAGtB,eAAe,CAAC,EAAE,MAAM,CAAA;IAIxB,aAAa,CAAC,EAAE,MAAM,CAAA;IAItB,mBAAmB,CAAC,EAAE;QACpB,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;CACF;AAkDD,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,GAC5B;IAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,GAAG,IAAI,CAAC;IAAC,iBAAiB,EAAE,OAAO,CAAA;CAAE,CAenE;AA4ED,wBAAsB,WAAW,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAyvB/E"}

package/dist/lib/runner.js

@@ -10,13 +10,14 @@ import { runConflictResolveStep, findConflictedFiles } from '../reviewers/confli
 import { parseVerdict, prependVerdictToComment, NULL_VERDICT_WARNING, applySeverityGate, SEVERITY_GATE_NOTE } from '../lib/verdict.js';
 import { createGithubClient, postReviewComment, getLastCrossCheckCommentId, getLastCrossCheckReviewComment } from '../github/client.js';
 import { acquireRemoteLock, releaseRemoteLock } from '../github/review-status.js';
-import { log as fileLog, logError } from '../lib/logger.js';
+import { log as fileLog, logError, classifyError } from '../lib/logger.js';
 import { buildCommitTrailers } from '../lib/annotation.js';
 import { resolveClaudeModel, resolveCodexModel } from '../lib/review-models.js';
 import { buildStepIdentityFields } from '../lib/event-fields.js';
 import { buildFixAppliedCommentBody, buildConflictResolvedCommentBody, buildRetriedReviewBanner } from '../lib/comment-bodies.js';
 import { loadWorkflow, evaluateWhen } from '../lib/workflow.js';
 import { isSubscriptionLimitError } from '../lib/smart-switch.js';
+import { tierTimeoutMs } from '../reviewers/tier-timeouts.js';
 const MAX_CROSSCHECK_COMMITS = 5;
 const FIX_RETRY_DELAY_MS = 2 * 60 * 1000;
 // Per-vendor configured timeout (seconds) → execa milliseconds, or undefined when
@@ -70,6 +71,10 @@ export function buildWorkflowCompleteEvent(inputs) {
     const lastStep = inputs.stepsRun.length > 0 ? inputs.stepsRun[inputs.stepsRun.length - 1] : null;
     const endedReason = inputs.workflowFailed ? 'error' : 'completed';
     const now = inputs.now ?? Date.now();
+    const rawErrorMessage = inputs.workflowError instanceof Error ? inputs.workflowError.message : inputs.workflowError !== undefined ? String(inputs.workflowError) : undefined;
+    const errorMessage = rawErrorMessage !== undefined && rawErrorMessage.length > 500
+        ? `${rawErrorMessage.slice(0, 500)} …[truncated]`
+        : rawErrorMessage;
     const totalTokens = stepValues.reduce((s, r) => s + (r.tokens_used ?? 0), 0);
     // Only emit split fields when at least one step actually recorded them — avoid
     // emitting 0/0 for codex-only or fix-only workflows where splits are unavailable.
@@ -93,6 +98,8 @@ export function buildWorkflowCompleteEvent(inputs) {
         ...(inputs.qualityTier !== undefined && { quality_tier: inputs.qualityTier }),
         ...(inputs.round !== undefined && { round: inputs.round }),
         ...(inputs.trigger !== undefined && { trigger: inputs.trigger }),
+        ...(inputs.failedStep !== undefined && { failed_step: inputs.failedStep }),
+        ...(errorMessage !== undefined && { error_message: errorMessage, error_category: classifyError(rawErrorMessage ?? '') }),
     };
 }
 // Returns true when fix/recheck steps should be skipped because the configured
@@ -269,11 +276,14 @@ export async function runWorkflow(ctx) {
     // mid-workflow (process.exit there bypasses our finally below).
     const pushedShasNeedingRelease = ctx.pushedShas ?? [];
     let workflowFailed = false;
+    let workflowError = undefined;
+    let failedStep = undefined;
     // When a fix commits and a structural review/recheck step follows, we acquire
     // the remote lock on the pushed SHA. Track it here so the finally can detect
     // whether the recheck was actually skipped (by `when`, no_reviewer, etc.) and
     // release the SHA as `failure` rather than `success` in that case.
     let fixPushedShaRequiresRecheck = null;
+    let lastFixSkipReason;
     // workflow_complete event accumulators. Each step the runner dispatches is
     // recorded in stepsRun (including ones that get logged as step_skipped —
     // the event records the workflow's declared shape, the per-step skip
@@ -281,9 +291,11 @@ export async function runWorkflow(ctx) {
     const workflowId = randomUUID();
     const workflowStart = Date.now();
     const stepsRun = [];
+    let currentStepName;
     emitPRComplexity(ctx, triggerField);
     try {
         for (const step of steps) {
+            currentStepName = step.name;
             stepsRun.push(step.name);
             const effectiveType = getEffectiveStepType(step.type, ctx.isRecheckRun === true);
             if (exceedsMaxRounds(effectiveType, step.type, ctx.overrideMaxRounds ?? step.max_rounds, ctx.round)) {
@@ -351,29 +363,39 @@ export async function runWorkflow(ctx) {
                     await runReviewWithVendor(reviewer);
                 }
                 catch (err) {
-                    if (!isSubscriptionLimitError(err))
-                        throw err;
-                    const failedVendor = reviewer;
-                    const fallbackVendor = resolveLimitFallbackVendor(failedVendor, effectiveType, config);
-                    const reason = err instanceof Error ? err.message : String(err);
-                    ctx.onVendorLimit?.(failedVendor, fallbackVendor, reason, step.name);
-                    if (!fallbackVendor)
+                    const isReconnect = err instanceof Error && /reconnect/i.test(err.message);
+                    if (isReconnect) {
+                        fileLog({ level: 'warn', event: 'review_reconnect_retry', repo: `${owner}/${repoName}`, pr: prNumber, reviewer, ...stepIdentity });
+                        log(chalk.yellow(`⚠  codex connection dropped — retrying in 30s...`));
+                        await new Promise(r => setTimeout(r, 30_000));
+                        await runReviewWithVendor(reviewer);
+                    }
+                    else if (!isSubscriptionLimitError(err)) {
                         throw err;
-                    fileLog({
-                        level: 'warn',
-                        event: 'vendor_fallback',
-                        repo: `${owner}/${repoName}`,
-                        pr: prNumber,
-                        step: step.name,
-                        step_type: effectiveType,
-                        failed_vendor: failedVendor,
-                        fallback_vendor: fallbackVendor,
-                        reason: reason.slice(0, 300),
-                    });
-                    log(chalk.yellow(`⚠  ${failedVendor} hit a usage limit — switching ${effectiveType} step to ${fallbackVendor}`));
-                    reviewer = fallbackVendor;
-                    onPhaseChange(`${reviewer} ${isRecheck ? 'rechecking' : 'reviewing'}...`, { phase: startPhase });
-                    await runReviewWithVendor(reviewer);
+                    }
+                    else {
+                        const failedVendor = reviewer;
+                        const fallbackVendor = resolveLimitFallbackVendor(failedVendor, effectiveType, config);
+                        const reason = err instanceof Error ? err.message : String(err);
+                        ctx.onVendorLimit?.(failedVendor, fallbackVendor, reason, step.name);
+                        if (!fallbackVendor)
+                            throw err;
+                        fileLog({
+                            level: 'warn',
+                            event: 'vendor_fallback',
+                            repo: `${owner}/${repoName}`,
+                            pr: prNumber,
+                            step: step.name,
+                            step_type: effectiveType,
+                            failed_vendor: failedVendor,
+                            fallback_vendor: fallbackVendor,
+                            reason: reason.slice(0, 300),
+                        });
+                        log(chalk.yellow(`⚠  ${failedVendor} hit a usage limit — switching ${effectiveType} step to ${fallbackVendor}`));
+                        reviewer = fallbackVendor;
+                        onPhaseChange(`${reviewer} ${isRecheck ? 'rechecking' : 'reviewing'}...`, { phase: startPhase });
+                        await runReviewWithVendor(reviewer);
+                    }
                 }
                 // First attempt timed out but the delayed retry succeeded — surface a
                 // soft notice on the review comment so the author knows it was a transient blip.
@@ -385,8 +407,9 @@ export async function runWorkflow(ctx) {
                 if (parsed.verdict === null) {
                     fileLog({ level: 'warn', event: 'verdict_parse_failed', repo: `${owner}/${repoName}`, pr: prNumber, reviewer, ...stepIdentity, output_length: rawReview.length });
                 }
-                // Severity gate: a NEEDS WORK review with no blocking (Critical/High) finding is
-                // approved-with-comments so warning-only reviews stop driving the fix/recheck loop.
+                // Severity gate: NEEDS WORK with only P3 nits is downgraded to APPROVE so
+                // suggestion-only reviews don't drive the fix/recheck loop. P2 (correctness)
+                // and above keep NEEDS WORK and require human attention before merge.
                 const gate = applySeverityGate(parsed.verdict, clean);
                 const verdict = gate.verdict;
                 if (gate.downgraded) {
@@ -446,6 +469,7 @@ export async function runWorkflow(ctx) {
             }
             else if (effectiveType === 'fix') {
                 const skipFix = (reason) => {
+                    lastFixSkipReason = reason;
                     onPhaseChange('', { phase: 'fixed', fixCount: 0 });
                     results[step.name] = { skipped: true };
                     fileLog({ level: 'info', event: 'step_skipped', repo: `${owner}/${repoName}`, pr: prNumber, step: step.name, reason });
@@ -504,9 +528,11 @@ export async function runWorkflow(ctx) {
                 // Guard: don't push more than MAX_CROSSCHECK_COMMITS per PR.
                 // Scope to commits ahead of base so long-lived branches (e.g. staging)
                 // don't count [crosscheck] commits from previously merged PRs.
+                // Crazy/halfcrazy mode doubles the cap since it deliberately loops.
                 const existingCount = countCrosscheckCommitsForPR(tmpDir, pr.base.ref);
-                if (existingCount >= MAX_CROSSCHECK_COMMITS) {
-                    log(chalk.yellow(`⚠  PR #${prNumber}: ${MAX_CROSSCHECK_COMMITS} [crosscheck] commits already — stopping auto-fix`));
+                const effectiveCommitLimit = ctx.roundMode ? MAX_CROSSCHECK_COMMITS * 2 : MAX_CROSSCHECK_COMMITS;
+                if (existingCount >= effectiveCommitLimit) {
+                    log(chalk.yellow(`⚠  PR #${prNumber}: ${effectiveCommitLimit} [crosscheck] commits already — stopping auto-fix`));
                     skipFix('commit_limit_reached');
                     continue;
                 }
@@ -516,11 +542,12 @@ export async function runWorkflow(ctx) {
                 let fixTokensUsed;
                 let fixErr = undefined;
                 let activeVendor = vendor;
+                const tierMs = tierTimeoutMs(config.quality.tier);
                 const runFix = async (v) => {
                     if (v === 'codex') {
-                        return runCodexFixStep(tmpDir, pr.base.ref, pr.title, reviewCommentBody, step.instructions ?? '', codexFixModel, ctx.overrideTimeoutMs ?? vendorTimeoutMs(config.vendors.codex.timeout_sec));
+                        return runCodexFixStep(tmpDir, pr.base.ref, pr.title, reviewCommentBody, step.instructions ?? '', codexFixModel, ctx.overrideTimeoutMs ?? vendorTimeoutMs(config.vendors.codex.timeout_sec) ?? tierMs);
                     }
-                    return runFixStep(tmpDir, pr.base.ref, pr.title, reviewCommentBody, step.instructions ?? '', config, 'default', ctx.overrideTimeoutMs ?? vendorTimeoutMs(config.vendors.claude.timeout_sec));
+                    return runFixStep(tmpDir, pr.base.ref, pr.title, reviewCommentBody, step.instructions ?? '', config, 'default', ctx.overrideTimeoutMs ?? vendorTimeoutMs(config.vendors.claude.timeout_sec) ?? tierMs);
                 };
                 try {
                     ;
@@ -543,6 +570,7 @@ export async function runWorkflow(ctx) {
                         }
                         catch (fallbackErr) {
                             logError({ repo: `${owner}/${repoName}`, pr: prNumber, phase: 'fix', attempt: 1, vendor: fallbackVendor }, fallbackErr);
+                            activeVendor = fallbackVendor; // retry uses the fallback vendor since primary already failed
                             fixErr = fallbackErr;
                         }
                     }
@@ -581,6 +609,9 @@ export async function runWorkflow(ctx) {
                         }
                         catch { /* best-effort notification */ }
                     }
+                    // The review was already posted — treat fix failure as a skipped step so the
+                    // workflow completes with the review's verdict rather than exiting non-zero and
+                    // releasing the remote lock as a workflow failure.
                     continue;
                 }
                 if (appliedCount === 0) {
@@ -941,6 +972,7 @@ export async function runWorkflow(ctx) {
         return {
             verdict: verdict ?? null,
             fixAppliedCount,
+            ...(fixAppliedCount === undefined && lastFixSkipReason !== undefined && { fixSkipReason: lastFixSkipReason }),
             ...(latestReviewResult?.commentBody && {
                 latestReviewComment: {
                     body: latestReviewResult.commentBody,
@@ -951,6 +983,8 @@ export async function runWorkflow(ctx) {
     }
     catch (err) {
         workflowFailed = true;
+        workflowError = err;
+        failedStep = currentStepName;
         throw err;
     }
     finally {
@@ -1001,6 +1035,8 @@ export async function runWorkflow(ctx) {
         fileLog(buildWorkflowCompleteEvent({
             owner, repoName, prNumber,
             workflowId, workflowStart, stepsRun, results, workflowFailed,
+            workflowError,
+            failedStep,
             round: ctx.round,
             trigger: ctx.trigger,
             qualityTier: config.quality.tier,