@humanbased/crosscheck 1.3.1-beta.5 → 1.5.0

package/dist/lib/runner.js

@@ -9,8 +9,9 @@ import { runCodexReview } from '../reviewers/codex.js';
 import { runClaudeReview } from '../reviewers/claude.js';
 import { runFixStep, runCodexFixStep } from '../reviewers/fix.js';
 import { runConflictResolveStep, findConflictedFiles } from '../reviewers/conflict-resolve.js';
-import { parseVerdict, prependVerdictToComment, NULL_VERDICT_WARNING, applySeverityGate, SEVERITY_GATE_NOTE } from '../lib/verdict.js';
+import { parseVerdict, prependVerdictToComment, NULL_VERDICT_WARNING, applySeverityGate, SEVERITY_GATE_NOTE, DOC_ONLY_GATE_NOTE, detectInconclusiveReview, reviewHasNoFindings } from '../lib/verdict.js';
 import { createGithubClient, postReviewComment, getLastCrossCheckCommentId, getLastCrossCheckReviewComment } from '../github/client.js';
+import { fetchCommentsAfter, selectHumanFeedback, formatHumanFeedback } from '../lib/human-feedback.js';
 import { autoFixBranchName, autoFixPRIntro, sourcePRHasMerged } from '../github/superseded-fix-pr.js';
 import { verifyReviewedSha, isVerifiedReviewedSha, reviewedShaRejection } from '../github/reviewed-sha.js';
 import { resolveLinearAuth, withWorker } from '../linear/identity.js';
@@ -19,9 +20,10 @@ import { shouldPostToLinear } from '../linear/comment.js';
 import { getLinearCredentials } from '../config/loader.js';
 import { acquireRemoteLock, releaseRemoteLock } from '../github/review-status.js';
 import { log as fileLog, logError, classifyError } from '../lib/logger.js';
-import { buildCommitTrailers } from '../lib/annotation.js';
+import { buildCommitTrailers, parseAnnotation } from '../lib/annotation.js';
+import { shaCovers } from '../lib/pr-workflow-state.js';
 import { resolveClaudeModel, resolveCodexModel } from '../lib/review-models.js';
-import { resolveReviewStrategy, escalate, clampToLevels } from './review-strategy.js';
+import { resolveReviewStrategy, escalate, clampToLevels, isDocOnlyChange } from './review-strategy.js';
 import { CLAUDE_EFFORT_LEVELS, CODEX_EFFORT_LEVELS } from '../config/schema.js';
 import { buildStepIdentityFields } from '../lib/event-fields.js';
 import { planAutoFixDelivery, forceWithLeaseArgs, parseLsRemoteOid, isLeaseRejection, assessFixBranchOwnership, isInvalidBaseError } from '../lib/auto-fix-branch.js';
@@ -33,6 +35,7 @@ import { tierTimeoutMs } from '../reviewers/tier-timeouts.js';
 import { loadSkillCatalog } from '../skills/catalog.js';
 import { createSkillActivationSession } from '../skills/broker.js';
 import { formatSkillAttribution } from '../skills/attribution.js';
+import { CompromisedCloneError, runGitWithoutHooks, changedFilesVsBase } from './clone.js';
 const MAX_CROSSCHECK_COMMITS = 5;
 const FIX_RETRY_DELAY_MS = 2 * 60 * 1000;
 const REVIEW_RETRY_DELAY_MS = 2 * 60 * 1000;
@@ -46,6 +49,8 @@ function vendorTimeoutMs(timeoutSec) {
 // Auth and quota/credit failures are operator/vendor-capacity issues that won't
 // self-heal through an immediate retry. Transient subprocess failures can retry.
 export function isRetryableFixError(err) {
+    if (err instanceof CompromisedCloneError)
+        return false;
     const msg = err instanceof Error ? err.message : String(err);
     return !/auth failure|not logged in|claude auth/i.test(msg) && !isSubscriptionLimitError(err);
 }
@@ -149,18 +154,52 @@ export function resolveFixLanding(deliveryMode) {
         case 'pull_request': return 'branch-then-separate-pr';
     }
 }
+export function planStepsForClass(input) {
+    const { configuredSteps, classSteps, stepsExplicitlyScoped } = input;
+    const none = { steps: configuredSteps, outcome: 'unchanged', classTypes: [], dropped: 0, wouldDrop: 0 };
+    if (!classSteps || classSteps.length === 0)
+        return none;
+    // Only the three depth-ladder types narrow. conflict-resolve is orthogonal to
+    // depth and is handled by filterStepsByTypes, which keeps it whenever the depth
+    // permits code modification — so it must not be treated as a class step here.
+    const classTypes = classSteps.filter((t) => t === 'review' || t === 'fix' || t === 'recheck');
+    if (classTypes.length === 0)
+        return none;
+    const narrowed = filterStepsByTypes(configuredSteps, classTypes);
+    const delta = configuredSteps.length - narrowed.length;
+    if (stepsExplicitlyScoped) {
+        return { steps: configuredSteps, outcome: delta > 0 ? 'bypassed' : 'unchanged', classTypes, dropped: 0, wouldDrop: delta };
+    }
+    return { steps: narrowed, outcome: delta > 0 ? 'narrowed' : 'unchanged', classTypes, dropped: delta, wouldDrop: 0 };
+}
 // stepsRun holds every step the runner dispatched, skips included; results holds
 // what each one did. Split them so callers can report a run where nothing
 // happened without re-deriving the reasons from the log file.
 export function summariseStepOutcomes(stepsRun, results) {
     const outcomes = { ran: [], skipped: [] };
+    const detail = {};
     for (const name of new Set(stepsRun)) {
         const result = results[name];
-        if (result?.skipped)
+        if (result?.skipped) {
             outcomes.skipped.push({ step: name, reason: result.skipReason ?? 'unknown' });
-        else
-            outcomes.ran.push(name);
+            continue;
+        }
+        outcomes.ran.push(name);
+        if (!result)
+            continue;
+        const entry = {
+            ...(result.vendor !== undefined && { vendor: result.vendor }),
+            ...(result.tokens_used !== undefined && { tokensUsed: result.tokens_used }),
+            ...(result.applied_count !== undefined && { appliedCount: result.applied_count }),
+            // Spread on key presence, not on truthiness: `verdict: null` is the whole
+            // point of recording this, and a falsiness check would drop it.
+            ...('verdict' in result && { verdict: result.verdict ?? null }),
+        };
+        if (Object.keys(entry).length > 0)
+            detail[name] = entry;
     }
+    if (Object.keys(detail).length > 0)
+        outcomes.ranDetail = detail;
     return outcomes;
 }
 // Accumulates outcomes across the fix→recheck rounds of one invocation, so the
@@ -186,7 +225,21 @@ export function mergeStepOutcomes(base, next) {
         if (!ranSet.has(entry.step))
             skipped.set(entry.step, entry.reason);
     }
-    return { ran, skipped: [...skipped].map(([step, reason]) => ({ step, reason })) };
+    // A step observed again in the later round is re-described by it, wholesale:
+    // a review that produced no verdict in round 1 and APPROVE in round 2 must not
+    // keep round 1's `verdict: null`, or the report calls a judged run unjudged.
+    const nextRan = new Set(next.ran);
+    const ranDetail = {};
+    for (const [step, detail] of Object.entries(base.ranDetail ?? {})) {
+        if (!nextRan.has(step))
+            ranDetail[step] = detail;
+    }
+    Object.assign(ranDetail, next.ranDetail ?? {});
+    return {
+        ran,
+        skipped: [...skipped].map(([step, reason]) => ({ step, reason })),
+        ...(Object.keys(ranDetail).length > 0 && { ranDetail }),
+    };
 }
 function countComments(reviewText) {
     const bullets = (reviewText.match(/^[-*•]\s/gm) ?? []).length;
@@ -352,40 +405,18 @@ function diffBucket(totalLines) {
  */
 export function buildPRContext(ctx) {
     const { tmpDir, pr } = ctx;
-    try {
-        // execFileSync, not execSync: a git ref may legally contain `;`, `$( )` and
-        // backticks, and this value drives routing rather than best-effort logging.
-        const raw = execFileSync('git', ['diff', '--numstat', `origin/${pr.base.ref}...HEAD`], { cwd: tmpDir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
-        if (!raw)
-            return null;
-        const files = [];
-        let additions = 0;
-        let deletions = 0;
-        for (const line of raw.split('\n')) {
-            // numstat: <added>\t<deleted>\t<path>. Binary files report '-' for both.
-            const [add, del, ...rest] = line.split('\t');
-            const path = rest.join('\t').trim();
-            if (!path)
-                continue;
-            files.push(path);
-            additions += parseInt(add, 10) || 0;
-            deletions += parseInt(del, 10) || 0;
-        }
-        if (files.length === 0)
-            return null;
-        return {
-            files,
-            additions,
-            deletions,
-            labels: pr.labels?.map(l => l.name) ?? [],
-            title: pr.title,
-            baseRef: pr.base.ref,
-            ...(pr.base.repo.default_branch !== undefined && { defaultBranch: pr.base.repo.default_branch }),
-        };
-    }
-    catch {
+    const changed = changedFilesVsBase(tmpDir, pr.base.ref);
+    if (!changed)
         return null;
-    }
+    return {
+        files: changed.files,
+        additions: changed.additions,
+        deletions: changed.deletions,
+        labels: pr.labels?.map(l => l.name) ?? [],
+        title: pr.title,
+        baseRef: pr.base.ref,
+        ...(pr.base.repo.default_branch !== undefined && { defaultBranch: pr.base.repo.default_branch }),
+    };
 }
 /**
  * Folds a resolved strategy into the quality config the reviewers receive, so
@@ -558,7 +589,7 @@ export async function pushWithNonFastForwardHandling(params) {
     const { tmpDir, branch, token, log, fileLog, owner, repoName, prNumber } = params;
     const env = { ...process.env, GITHUB_TOKEN: token, GH_TOKEN: token };
     try {
-        execFileSync('git', ['push', 'origin', `HEAD:${branch}`], { cwd: tmpDir, env });
+        runGitWithoutHooks(tmpDir, ['push', 'origin', `HEAD:${branch}`], env);
     }
     catch (pushErr) {
         const pushMsg = pushErr instanceof Error ? pushErr.message : String(pushErr);
@@ -576,7 +607,7 @@ export async function pushWithNonFastForwardHandling(params) {
             const fixCommitSha = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: tmpDir, env, encoding: 'utf8', stdio: 'pipe' }).trim();
             try {
                 // Fetch the latest state of the branch
-                execFileSync('git', ['fetch', 'origin', branch], { cwd: tmpDir, env, stdio: 'pipe' });
+                runGitWithoutHooks(tmpDir, ['fetch', 'origin', branch], env);
                 try {
                     // Rebase our changes onto the latest branch state. Rebase onto FETCH_HEAD,
                     // NOT `origin/${branch}`: crosscheck's clone fetches the PR head without a
@@ -585,18 +616,18 @@ export async function pushWithNonFastForwardHandling(params) {
                     // land-on-branch push falls back to opening a separate fix PR. The fetch on
                     // the line above sets FETCH_HEAD to exactly the tip we just pulled, so that
                     // is the correct (and always-present) rebase target.
-                    execFileSync('git', ['rebase', 'FETCH_HEAD'], { cwd: tmpDir, env, stdio: 'pipe' });
+                    runGitWithoutHooks(tmpDir, ['rebase', 'FETCH_HEAD'], env);
                 }
                 catch (rebaseConflictErr) {
                     // If rebase fails (e.g., due to conflicts), abort it and restore the fix commit.
                     // Otherwise the outer catch's fallback logic sees a repo in in-progress-rebase
                     // state and incorrectly treats HEAD~1 as the fix commit.
-                    execFileSync('git', ['rebase', '--abort'], { cwd: tmpDir, env, stdio: 'pipe' });
-                    execFileSync('git', ['reset', '--hard', fixCommitSha], { cwd: tmpDir, env, stdio: 'pipe' });
+                    runGitWithoutHooks(tmpDir, ['rebase', '--abort'], env);
+                    runGitWithoutHooks(tmpDir, ['reset', '--hard', fixCommitSha], env);
                     throw rebaseConflictErr;
                 }
                 // Retry the push
-                execFileSync('git', ['push', 'origin', `HEAD:${branch}`], { cwd: tmpDir, env });
+                runGitWithoutHooks(tmpDir, ['push', 'origin', `HEAD:${branch}`], env);
                 fileLog({
                     level: 'info',
                     event: 'push_rebase_succeeded',
@@ -643,6 +674,11 @@ export async function runWorkflow(ctx) {
     // legitimately classify differently. Each comment cites the class that
     // produced it, so the record stays accurate either way.
     const strategy = resolveStrategyForPR(ctx);
+    // Read from the diff rather than the resolved class: `docs` matches a *fraction*
+    // of doc churn and exists only in smart mode, whereas the verdict cap needs the
+    // all-or-nothing answer on every install. Independent of `strategy` for that
+    // reason, and cheap — buildPRContext is one `git diff --numstat`.
+    const docOnlyChange = isDocOnlyChange(buildPRContext(ctx)?.files ?? []);
     if (config.quality.mode === 'smart' && !strategy) {
         // A smart-mode install quietly behaving as fixed is otherwise invisible.
         fileLog({ level: 'warn', event: 'strategy_unresolved', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'pr_context_unavailable', fallback_tier: config.quality.tier });
@@ -667,25 +703,29 @@ export async function runWorkflow(ctx) {
     }
     // The class's step set NARROWS the configured pipeline; it never widens it.
     // A repo set to review-only stays review-only whatever the class says, which
-    // matches how per-repo `crosscheck alter` overrides compose. Reuses
-    // filterStepsByTypes so the conflict-resolve rule (orthogonal to the depth
-    // ladder, kept only when the depth permits code modification) stays in one
-    // place rather than being re-derived here.
-    const steps = (() => {
-        if (!strategy || strategy.steps.length === 0)
-            return configuredSteps;
-        const classTypes = strategy.steps.filter((t) => t === 'review' || t === 'fix' || t === 'recheck');
-        if (classTypes.length === 0)
-            return configuredSteps;
-        const narrowed = filterStepsByTypes(configuredSteps, classTypes);
-        const dropped = configuredSteps.length - narrowed.length;
-        if (dropped > 0) {
-            log(chalk.dim(`  strategy v${strategy.version}: ${strategy.classId} → ${classTypes.join(', ')} (${dropped} step${dropped === 1 ? '' : 's'} dropped)`));
-            fileLog({ level: 'info', event: 'strategy_steps_narrowed', repo: `${owner}/${repoName}`, pr: prNumber, pr_class: strategy.classId, configured: configuredSteps.map((x) => x.type), applied: narrowed.map((x) => x.type), strategy_version: strategy.version });
-        }
-        return narrowed;
-    })();
-    if (strategy && strategy.tier === null) {
+    // matches how per-repo `crosscheck alter` overrides compose.
+    const stepPlan = planStepsForClass({
+        configuredSteps,
+        classSteps: strategy?.steps,
+        stepsExplicitlyScoped: ctx.stepsExplicitlyScoped === true,
+    });
+    if (stepPlan.outcome === 'bypassed') {
+        log(chalk.dim(`  strategy v${strategy.version}: ${strategy.classId} would drop ${stepPlan.wouldDrop} step${stepPlan.wouldDrop === 1 ? '' : 's'} — honouring --steps as given`));
+        fileLog({ level: 'info', event: 'strategy_narrowing_bypassed', repo: `${owner}/${repoName}`, pr: prNumber, pr_class: strategy.classId, requested: configuredSteps.map((x) => x.type), class_steps: stepPlan.classTypes, strategy_version: strategy.version });
+    }
+    else if (stepPlan.outcome === 'narrowed') {
+        log(chalk.dim(`  strategy v${strategy.version}: ${strategy.classId} → ${stepPlan.classTypes.join(', ')} (${stepPlan.dropped} step${stepPlan.dropped === 1 ? '' : 's'} dropped)`));
+        fileLog({ level: 'info', event: 'strategy_steps_narrowed', repo: `${owner}/${repoName}`, pr: prNumber, pr_class: strategy.classId, configured: configuredSteps.map((x) => x.type), applied: stepPlan.steps.map((x) => x.type), strategy_version: strategy.version });
+    }
+    const steps = stepPlan.steps;
+    // A null tier means the class skips this PR outright. An explicit `--steps`
+    // overrides that for the same reason it overrides narrowing — but say so, or the
+    // run looks like the class simply did not match.
+    if (strategy && strategy.tier === null && ctx.stepsExplicitlyScoped) {
+        log(chalk.dim(`  strategy v${strategy.version}: ${strategy.classId} would skip this PR (${strategy.reason}) — honouring --steps as given`));
+        fileLog({ level: 'info', event: 'strategy_class_skip_bypassed', repo: `${owner}/${repoName}`, pr: prNumber, pr_class: strategy.classId, strategy_version: strategy.version });
+    }
+    if (strategy && strategy.tier === null && !ctx.stepsExplicitlyScoped) {
         log(chalk.dim(`  strategy v${strategy.version}: ${strategy.classId} → skipped (${strategy.reason})`));
         fileLog({ level: 'info', event: 'pr_skipped', repo: `${owner}/${repoName}`, pr: prNumber, reason: 'strategy_class_skip', pr_class: strategy.classId, strategy_version: strategy.version });
         return { verdict: null, strategySkipped: strategy.classId };
@@ -871,18 +911,40 @@ export async function runWorkflow(ctx) {
                 let effort;
                 let retried;
                 const skillSession = skillSessionFor(step.name, effectiveType);
+                // Hoisted up from the post-review linking code below (which still reuses
+                // this value): a recheck needs to know which review it is rechecking
+                // before it runs, not just when linking the posted comment afterward, so
+                // it can pull in anything the PR author (or their agent) said in reply.
+                let priorReviewId;
+                if (isRecheck) {
+                    priorReviewId = Object.values(results).reverse().find(r => r.commentId !== undefined)?.commentId;
+                    if (priorReviewId === undefined) {
+                        priorReviewId = await getLastCrossCheckCommentId(owner, repoName, prNumber, token);
+                    }
+                }
+                let humanFeedbackBlock = '';
+                if (priorReviewId !== undefined) {
+                    try {
+                        const commentsAfter = await fetchCommentsAfter(owner, repoName, prNumber, token, priorReviewId);
+                        humanFeedbackBlock = formatHumanFeedback(selectHumanFeedback(commentsAfter, pr.user.login));
+                    }
+                    catch (err) {
+                        fileLog({ level: 'warn', event: 'human_feedback_fetch_failed', repo: `${owner}/${repoName}`, pr: prNumber, error: err instanceof Error ? err.message : String(err) });
+                    }
+                }
+                const reviewContext = [ctx.issueContext, humanFeedbackBlock].filter(Boolean).join('\n\n') || undefined;
                 // Under `quality.mode: smart` the PR's class picks the tier; under fixed
                 // this is config.quality untouched.
                 const runReviewWithVendor = async (candidate) => {
                     if (candidate === 'codex') {
                         ;
-                        ({ review: rawReview, tokensUsed, model, effort, retried } = await runCodexReview(tmpDir, pr.base.ref, pr.title, quality, codexVendor, step.instructions, undefined, ctx.overrideTimeoutMs ?? vendorTimeoutMs(config.vendors.codex.timeout_sec), log, ctx.issueContext, skillSession, config.skills.codex_full_access));
+                        ({ review: rawReview, tokensUsed, model, effort, retried } = await runCodexReview(tmpDir, pr.base.ref, pr.title, quality, codexVendor, step.instructions, undefined, ctx.overrideTimeoutMs ?? vendorTimeoutMs(config.vendors.codex.timeout_sec), log, reviewContext, skillSession, config.skills.codex_full_access));
                         inputTokens = undefined;
                         outputTokens = undefined;
                     }
                     else {
                         ;
-                        ({ review: rawReview, tokensUsed, inputTokens, outputTokens, model, effort, retried } = await runClaudeReview(tmpDir, pr.base.ref, pr.title, quality, claudeVendor, config.budget.per_review_usd, step.instructions, undefined, ctx.overrideTimeoutMs ?? vendorTimeoutMs(config.vendors.claude.timeout_sec), !!ctx.roundMode, log, ctx.issueContext, skillSession));
+                        ({ review: rawReview, tokensUsed, inputTokens, outputTokens, model, effort, retried } = await runClaudeReview(tmpDir, pr.base.ref, pr.title, quality, claudeVendor, config.budget.per_review_usd, step.instructions, undefined, ctx.overrideTimeoutMs ?? vendorTimeoutMs(config.vendors.claude.timeout_sec), !!ctx.roundMode, log, reviewContext, skillSession));
                     }
                 };
                 try {
@@ -954,17 +1016,31 @@ export async function runWorkflow(ctx) {
                 if (parsed.verdict === null) {
                     fileLog({ level: 'warn', event: 'verdict_parse_failed', repo: `${owner}/${repoName}`, pr: prNumber, reviewer, ...stepIdentity, output_length: rawReview.length });
                 }
+                // Inconclusive gate — must run BEFORE the severity gate. A reviewer that
+                // reports it could not review produces a findings-free body, which the
+                // severity gate reads as "nits only" and upgrades to APPROVE: a PR cleared
+                // to merge on the strength of a review that never ran. Refuse to post at
+                // all instead, the same way an unverifiable sha is refused below.
+                const inconclusive = detectInconclusiveReview(clean);
+                if (inconclusive.inconclusive) {
+                    fileLog({ level: 'error', event: 'review_inconclusive', repo: `${owner}/${repoName}`, pr: prNumber, reviewer, model, ...stepIdentity, reason: inconclusive.reason, raw_verdict: parsed.verdict, output_length: rawReview.length, ...(ctx.round !== undefined && { round: ctx.round }), ...triggerField });
+                    log(chalk.red(`✗ ${reviewer} did not review PR #${prNumber} — ${inconclusive.reason}`));
+                    // The review cost vendor tokens — surface it rather than lose it silently.
+                    log(chalk.dim(`\n--- unposted review ---\n${clean}\n--- end ---`));
+                    throw new Error(`${reviewer} review inconclusive — ${inconclusive.reason}`);
+                }
                 // Severity gate: NEEDS WORK with only P3 nits is downgraded to APPROVE so
                 // suggestion-only reviews don't drive the fix/recheck loop. P2 (correctness)
                 // and above keep NEEDS WORK and require human attention before merge.
-                const gate = applySeverityGate(parsed.verdict, clean);
+                const gate = applySeverityGate(parsed.verdict, clean, { docOnly: docOnlyChange });
                 const verdict = gate.verdict;
                 if (gate.downgraded) {
-                    fileLog({ level: 'info', event: 'verdict_severity_gated', repo: `${owner}/${repoName}`, pr: prNumber, reviewer, ...stepIdentity, raw_verdict: parsed.verdict, gated_verdict: verdict });
+                    fileLog({ level: 'info', event: 'verdict_severity_gated', repo: `${owner}/${repoName}`, pr: prNumber, reviewer, ...stepIdentity, raw_verdict: parsed.verdict, gated_verdict: verdict, reason: gate.reason });
                 }
+                const gateNote = gate.reason === 'doc_only' ? DOC_ONLY_GATE_NOTE : SEVERITY_GATE_NOTE;
                 const baseBody = verdict === null
                     ? `${NULL_VERDICT_WARNING}\n\n${clean}`
-                    : prependVerdictToComment(gate.downgraded ? `${SEVERITY_GATE_NOTE}\n\n${clean}` : clean, verdict);
+                    : prependVerdictToComment(gate.downgraded ? `${gateNote}\n\n${clean}` : clean, verdict);
                 // Skills are not folded into the body — postReviewComment renders the
                 // receipt beneath the attribution footer.
                 const commentBody = retried
@@ -989,16 +1065,9 @@ export async function runWorkflow(ctx) {
                 else {
                     onPhaseChange(isRecheck ? 'posting recheck...' : 'posting comment...', phaseUpdate);
                     const octokit = createGithubClient(token);
-                    // For rechecks: look up the original review comment ID so the recheck
-                    // can link back to it. Check in-run results first (single-run pipelines),
-                    // then fall back to GitHub (cross-run: recheck triggered by a new push).
-                    let priorReviewId;
-                    if (isRecheck) {
-                        priorReviewId = Object.values(results).reverse().find(r => r.commentId !== undefined)?.commentId;
-                        if (priorReviewId === undefined) {
-                            priorReviewId = await getLastCrossCheckCommentId(owner, repoName, prNumber, token);
-                        }
-                    }
+                    // priorReviewId (for rechecks: the original review comment to link back
+                    // to) is already resolved above, before the review ran — reused here
+                    // rather than looked up a second time.
                     // Pre-compute next_step for the annotation so readers can skip full
                     // comment scans: find the first remaining step whose when-condition holds.
                     const currentStepIdx = steps.indexOf(step);
@@ -1135,6 +1204,37 @@ export async function runWorkflow(ctx) {
                     skipFix('no_review_comment');
                     continue;
                 }
+                // A review with nothing actionable in it cannot produce a fix. Dispatching one
+                // anyway spends a full vendor call to be told NO_CHANGES — the outcome that
+                // made `ck fix` look like it had worked when its review was a non-review.
+                if (reviewHasNoFindings(reviewCommentBody)) {
+                    log(chalk.dim(`  review has no actionable findings — nothing for the fix step to apply`));
+                    skipFix('review_has_no_findings');
+                    continue;
+                }
+                // Findings raised against a different commit still usually apply, so this
+                // warns rather than skips — but silently fixing against a stale review is how
+                // a round gets spent re-fixing something the author already pushed.
+                // shaCovers, not ===: annotations carry the short or full form interchangeably,
+                // and a raw compare would call every short-form annotation stale.
+                const reviewSha = parseAnnotation(reviewCommentBody)?.sha;
+                if (reviewSha && !shaCovers(reviewSha, pr.head.sha)) {
+                    log(chalk.yellow(`⚠  review was written against ${reviewSha.slice(0, 7)}, PR head is ${pr.head.sha.slice(0, 7)} — fixing against a stale review`));
+                    fileLog({ level: 'warn', event: 'fix_review_stale', repo: `${owner}/${repoName}`, pr: prNumber, review_sha: reviewSha, head_sha: pr.head.sha, ...triggerField });
+                }
+                // Replies the PR author (or their agent) posted since that review — e.g.
+                // "already fixed in the last commit" or "not applicable here" — so the
+                // fixer doesn't blindly redo work the thread already settled.
+                let fixHumanFeedback = '';
+                if (reviewCommentId !== undefined) {
+                    try {
+                        const commentsAfter = await fetchCommentsAfter(owner, repoName, prNumber, token, reviewCommentId);
+                        fixHumanFeedback = formatHumanFeedback(selectHumanFeedback(commentsAfter, pr.user.login));
+                    }
+                    catch (err) {
+                        fileLog({ level: 'warn', event: 'human_feedback_fetch_failed', repo: `${owner}/${repoName}`, pr: prNumber, error: err instanceof Error ? err.message : String(err) });
+                    }
+                }
                 // Vendor is resolved from the workflow step's reviewer field, same as review/recheck steps.
                 // Use 'origin' to fix with the same vendor that authored the PR (recommended default).
                 // resolveFixVendor extends resolveReviewer with a human-origin fallback so human-authored
@@ -1185,17 +1285,19 @@ export async function runWorkflow(ctx) {
                 const skillSession = skillSessionFor(step.name, effectiveType);
                 const runFix = async (v) => {
                     if (v === 'codex') {
-                        return runCodexFixStep(tmpDir, pr.base.ref, pr.title, reviewCommentBody, step.instructions ?? '', codexFixModel, ctx.overrideTimeoutMs ?? vendorTimeoutMs(config.vendors.codex.timeout_sec) ?? tierMs, skillSession, codexVendor.effort, config.skills.codex_full_access);
+                        return runCodexFixStep(tmpDir, pr.base.ref, pr.title, reviewCommentBody, step.instructions ?? '', codexFixModel, ctx.overrideTimeoutMs ?? vendorTimeoutMs(config.vendors.codex.timeout_sec) ?? tierMs, skillSession, codexVendor.effort, config.skills.codex_full_access, fixHumanFeedback);
                     }
                     // roundConfig, not config: runFixStep reads vendors.claude.effort and
                     // quality.tier out of it, and both must be this round's values.
-                    return runFixStep(tmpDir, pr.base.ref, pr.title, reviewCommentBody, step.instructions ?? '', roundConfig, claudeFixModel, ctx.overrideTimeoutMs ?? vendorTimeoutMs(config.vendors.claude.timeout_sec) ?? tierMs, skillSession);
+                    return runFixStep(tmpDir, pr.base.ref, pr.title, reviewCommentBody, step.instructions ?? '', roundConfig, claudeFixModel, ctx.overrideTimeoutMs ?? vendorTimeoutMs(config.vendors.claude.timeout_sec) ?? tierMs, skillSession, fixHumanFeedback);
                 };
                 try {
                     ;
                     ({ appliedCount, changedFiles: fixChangedFiles, tokensUsed: fixTokensUsed, effort: fixEffort } = await runFix(vendor));
                 }
                 catch (err) {
+                    if (err instanceof CompromisedCloneError)
+                        throw err;
                     logError({ repo: `${owner}/${repoName}`, pr: prNumber, phase: 'fix', attempt: 1, vendor }, err);
                     const fallbackVendor = resolveLimitFallbackVendor(vendor, effectiveType, config);
                     if (isSubscriptionLimitError(err)) {
@@ -1211,6 +1313,8 @@ export async function runWorkflow(ctx) {
                             activeVendor = fallbackVendor;
                         }
                         catch (fallbackErr) {
+                            if (fallbackErr instanceof CompromisedCloneError)
+                                throw fallbackErr;
                             logError({ repo: `${owner}/${repoName}`, pr: prNumber, phase: 'fix', attempt: 1, vendor: fallbackVendor }, fallbackErr);
                             activeVendor = fallbackVendor; // retry uses the fallback vendor since primary already failed
                             fixErr = fallbackErr;
@@ -1233,6 +1337,8 @@ export async function runWorkflow(ctx) {
                         fixErr = undefined;
                     }
                     catch (retryErr) {
+                        if (retryErr instanceof CompromisedCloneError)
+                            throw retryErr;
                         logError({ repo: `${owner}/${repoName}`, pr: prNumber, phase: 'fix', attempt: 2 }, retryErr);
                         fixErr = retryErr;
                     }
@@ -1297,14 +1403,14 @@ export async function runWorkflow(ctx) {
                 const landing = resolveFixLanding(deliveryMode);
                 if (landing === 'branch') {
                     const fixModel = activeVendor === 'codex' ? codexFixModel : claudeFixModel;
-                    execSync('git add -A', { cwd: tmpDir });
-                    execFileSync('git', [
+                    runGitWithoutHooks(tmpDir, ['add', '-A']);
+                    runGitWithoutHooks(tmpDir, [
                         'commit',
                         '-m',
                         fixCommitSubject(appliedCount, activeVendor),
                         '-m',
                         buildCommitTrailers({ reviewer: activeVendor, model: fixModel, step: 'fix', service: 'crosscheck' }),
-                    ], { cwd: tmpDir });
+                    ]);
                     const newSha = execSync('git rev-parse HEAD', { cwd: tmpDir, encoding: 'utf8' }).trim();
                     await pushWithNonFastForwardHandling({
                         tmpDir,
@@ -1367,14 +1473,14 @@ export async function runWorkflow(ctx) {
                     // original PR. Only when that push can't land — e.g. the PR was merged and
                     // its branch deleted, or the branch is protected — do we fall back to opening
                     // a separate follow-up PR that carries the very same commit.
-                    execSync('git add -A', { cwd: tmpDir });
-                    execFileSync('git', [
+                    runGitWithoutHooks(tmpDir, ['add', '-A']);
+                    runGitWithoutHooks(tmpDir, [
                         'commit',
                         '-m',
                         fixPRCommitSubject(prNumber, activeVendor),
                         '-m',
                         buildCommitTrailers({ reviewer: activeVendor, model: fixModel, step: 'fix', service: 'crosscheck' }),
-                    ], { cwd: tmpDir });
+                    ]);
                     const newSha = execSync('git rev-parse HEAD', { cwd: tmpDir, encoding: 'utf8' }).trim();
                     let landedOnBranch = false;
                     try {
@@ -1445,7 +1551,7 @@ export async function runWorkflow(ctx) {
                         // either with a sha the repository cannot resolve — which verifyReviewedSha
                         // refuses to post (#290) — or with one no open PR carries.
                         const restorePRHeadInClone = () => {
-                            execSync('git reset --hard HEAD~1', { cwd: tmpDir, stdio: 'pipe' });
+                            runGitWithoutHooks(tmpDir, ['reset', '--hard', 'HEAD~1']);
                         };
                         // Deliver the fix as a diff on the original PR. Used wherever opening the
                         // follow-up PR would either create a stale artifact or overwrite a branch that
@@ -1559,7 +1665,7 @@ export async function runWorkflow(ctx) {
                             continue;
                         }
                         try {
-                            execFileSync('git', forceWithLeaseArgs(fixBranch, remoteOid), { cwd: tmpDir, env: gitEnv, stdio: 'pipe' });
+                            runGitWithoutHooks(tmpDir, forceWithLeaseArgs(fixBranch, remoteOid), gitEnv);
                         }
                         catch (pushErr) {
                             const pushMsg = pushErr instanceof Error ? pushErr.message : String(pushErr);
@@ -1582,7 +1688,7 @@ export async function runWorkflow(ctx) {
                             if (remoteOid !== null)
                                 return;
                             try {
-                                execFileSync('git', ['push', 'origin', '--delete', fixBranch], { cwd: tmpDir, env: gitEnv, stdio: 'pipe' });
+                                runGitWithoutHooks(tmpDir, ['push', 'origin', '--delete', fixBranch], gitEnv);
                                 fileLog({ level: 'info', event: 'fix_branch_rolled_back', repo: `${owner}/${repoName}`, pr: prNumber, branch: fixBranch, sha: newSha });
                             }
                             catch (deleteErr) {
@@ -1705,10 +1811,10 @@ export async function runWorkflow(ctx) {
                 // real conflict markers and UU entries that findConflictedFiles can detect.
                 let hasMergeConflicts = false;
                 try {
-                    execSync(`git merge --no-commit origin/${pr.base.ref}`, { cwd: tmpDir, stdio: 'pipe' });
+                    runGitWithoutHooks(tmpDir, ['merge', '--no-commit', `origin/${pr.base.ref}`]);
                     // Clean merge — undo the staged merge state and skip this step
                     try {
-                        execSync('git merge --abort', { cwd: tmpDir });
+                        runGitWithoutHooks(tmpDir, ['merge', '--abort']);
                     }
                     catch { /* ignore */ }
                 }
@@ -1722,7 +1828,7 @@ export async function runWorkflow(ctx) {
                 const conflictedFiles = findConflictedFiles(tmpDir);
                 if (conflictedFiles.length === 0) {
                     try {
-                        execSync('git merge --abort', { cwd: tmpDir });
+                        runGitWithoutHooks(tmpDir, ['merge', '--abort']);
                     }
                     catch { /* ignore */ }
                     skipConflictResolve('no_conflicts');
@@ -1740,7 +1846,7 @@ export async function runWorkflow(ctx) {
                 }
                 if (!vendor) {
                     try {
-                        execSync('git merge --abort', { cwd: tmpDir });
+                        runGitWithoutHooks(tmpDir, ['merge', '--abort']);
                     }
                     catch { /* ignore */ }
                     ;
@@ -1749,7 +1855,7 @@ export async function runWorkflow(ctx) {
                 }
                 if (vendor === 'codex') {
                     try {
-                        execSync('git merge --abort', { cwd: tmpDir });
+                        runGitWithoutHooks(tmpDir, ['merge', '--abort']);
                     }
                     catch { /* ignore */ }
                     ;
@@ -1762,7 +1868,7 @@ export async function runWorkflow(ctx) {
                 const isFork = pr.head.repo?.full_name !== pr.base.repo.full_name;
                 if (isFork) {
                     try {
-                        execSync('git merge --abort', { cwd: tmpDir });
+                        runGitWithoutHooks(tmpDir, ['merge', '--abort']);
                     }
                     catch { /* ignore */ }
                     ;
@@ -1772,7 +1878,7 @@ export async function runWorkflow(ctx) {
                 const crCommitCount = countCrosscheckCommitsForPRDetailed(tmpDir, pr.base.ref);
                 if (crCommitCount.count >= MAX_CROSSCHECK_COMMITS) {
                     try {
-                        execSync('git merge --abort', { cwd: tmpDir });
+                        runGitWithoutHooks(tmpDir, ['merge', '--abort']);
                     }
                     catch { /* ignore */ }
                     log(crCommitCount.scoped
@@ -1796,7 +1902,7 @@ export async function runWorkflow(ctx) {
                 catch (err) {
                     logError({ repo: `${owner}/${repoName}`, pr: prNumber, phase: 'conflict-resolve', attempt: 1 }, err);
                     try {
-                        execSync('git merge --abort', { cwd: tmpDir });
+                        runGitWithoutHooks(tmpDir, ['merge', '--abort']);
                     }
                     catch { /* ignore */ }
                     skipConflictResolve(isSubscriptionLimitError(err) ? 'vendor_limit' : 'resolve_error');
@@ -1809,7 +1915,7 @@ export async function runWorkflow(ctx) {
                     logSkillsNoneActivated(skillSession, { step_type: 'conflict-resolve', step_name: step.name });
                 if (appliedCount === 0) {
                     try {
-                        execSync('git merge --abort', { cwd: tmpDir });
+                        runGitWithoutHooks(tmpDir, ['merge', '--abort']);
                     }
                     catch { /* ignore */ }
                     onPhaseChange('', { phase: 'fixed', fixCount: 0, fixTokens: resolveTokensUsed });
@@ -1836,7 +1942,7 @@ export async function runWorkflow(ctx) {
                 }
                 if (filesWithMarkers.length > 0) {
                     try {
-                        execSync('git merge --abort', { cwd: tmpDir });
+                        runGitWithoutHooks(tmpDir, ['merge', '--abort']);
                     }
                     catch { /* ignore */ }
                     log(chalk.yellow(`⚠  PR #${prNumber}: ${filesWithMarkers.length} file(s) still contain conflict markers — skipping commit`));
@@ -1853,7 +1959,7 @@ export async function runWorkflow(ctx) {
                 // resolvedPaths is derived from model output and PR-controlled filenames.
                 for (const p of resolvedPaths) {
                     try {
-                        execFileSync('git', ['add', '--', p], { cwd: tmpDir, stdio: 'pipe' });
+                        runGitWithoutHooks(tmpDir, ['add', '--', p]);
                     }
                     catch { /* skip */ }
                 }
@@ -1868,7 +1974,7 @@ export async function runWorkflow(ctx) {
                 catch { /* ignore */ }
                 if (unmergedPaths.length > 0) {
                     try {
-                        execSync('git merge --abort', { cwd: tmpDir });
+                        runGitWithoutHooks(tmpDir, ['merge', '--abort']);
                     }
                     catch { /* ignore */ }
                     log(chalk.yellow(`⚠  PR #${prNumber}: ${unmergedPaths.length} unmerged path(s) remain after resolve — skipping commit`));
@@ -1876,13 +1982,13 @@ export async function runWorkflow(ctx) {
                     skipConflictResolve('unmerged_paths');
                     continue;
                 }
-                execFileSync('git', [
+                runGitWithoutHooks(tmpDir, [
                     'commit',
                     '-m',
                     conflictResolveCommitSubject(conflictedFiles.length, vendor),
                     '-m',
                     buildCommitTrailers({ reviewer: vendor, model: conflictResolveModel, step: 'conflict-resolve', service: 'crosscheck' }),
-                ], { cwd: tmpDir });
+                ]);
                 const newSha = execSync('git rev-parse HEAD', { cwd: tmpDir, encoding: 'utf8' }).trim();
                 await pushWithNonFastForwardHandling({
                     tmpDir,