@jphutchins/code-review 0.1.0-alpha.62 → 0.1.0-alpha.64

package/dist/index.js

@@ -2,23 +2,32 @@
 import { defineCommand, runMain } from 'citty';
 import { readFileSync, writeFileSync, unlinkSync, copyFileSync, statSync, readdirSync, appendFileSync } from 'fs';
 import { randomBytes, createHash } from 'crypto';
-import { resolve as resolve$1, join, dirname, basename, extname, sep } from 'path';
+import { resolve, join, dirname, basename, extname, sep } from 'path';
 import { Eta } from 'eta';
 import * as t from 'io-ts';
-import parseDiff from 'parse-diff';
-import { Ajv2020 } from 'ajv/dist/2020.js';
-import _addFormats from 'ajv-formats';
 import { execFile } from 'child_process';
 import { mkdtemp, readFile, rm, writeFile } from 'fs/promises';
 import { tmpdir } from 'os';
 import { promisify } from 'util';
+import parseDiff from 'parse-diff';
+import { Ajv2020 } from 'ajv/dist/2020.js';
+import _addFormats from 'ajv-formats';
 import { performance } from 'perf_hooks';
 import { PathReporter } from 'io-ts/lib/PathReporter.js';
 
 var asRecord = (u) => typeof u === "object" && u !== null && !Array.isArray(u) ? u : null;
 var errMsg = (e) => e instanceof Error ? e.message : String(e);
 var annotationSafe = (msg) => msg.replaceAll(/[\r\n]+/g, " ");
-var modelIdentity = (configuredModelId) => configuredModelId.replace(/\[[12]m\]$/i, "");
+var CONTEXT_SUFFIX_RE = /\[[12]m\]/i;
+var MODEL_IDENTITY_SUFFIX_RE = new RegExp(CONTEXT_SUFFIX_RE.source, "gi");
+var modelIdentity = (configuredModelId) => configuredModelId.replace(MODEL_IDENTITY_SUFFIX_RE, "");
+var addModelUsage = (prior, entry) => ({
+  ...prior,
+  input_tokens: prior.input_tokens + entry.input_tokens,
+  output_tokens: prior.output_tokens + entry.output_tokens,
+  cache_read_tokens: (prior.cache_read_tokens ?? 0) + (entry.cache_read_tokens ?? 0),
+  cache_write_tokens: (prior.cache_write_tokens ?? 0) + (entry.cache_write_tokens ?? 0)
+});
 var clipText = (body, max) => {
   if (body.length <= max) return body;
   const cut = body.slice(0, max);
@@ -485,7 +494,7 @@ var incompleteFindings = (summary) => ({
 var isIncompleteFindings = (findings) => findings.verdict === "error" && findings.findings.length === 0;
 
 // src/released.ts
-var RELEASED = "2026-09-27";
+var RELEASED = "2026-10-02";
 
 // src/cost.ts
 var defaultWarn = (message) => {
@@ -533,8 +542,7 @@ var resolveFlatPrices = (model, p, pricedAt, warn) => {
   );
   return null;
 };
-var computeModelCost = (entry, prices, pricedAt, warn) => {
-  const p = Object.hasOwn(prices.models, entry.model) ? prices.models[entry.model] : void 0;
+var computeModelCost = (entry, prices, pricedAt, warn, colliding = /* @__PURE__ */ new Set()) => {
   const cacheRead = entry.cache_read_tokens ?? 0;
   const cacheWrite = entry.cache_write_tokens ?? 0;
   const zero = {
@@ -546,6 +554,14 @@ var computeModelCost = (entry, prices, pricedAt, warn) => {
     costUSD: 0,
     known: true
   };
+  const canonicalModel = modelIdentity(entry.model);
+  if (colliding.has(canonicalModel)) {
+    warn(
+      `code-review cost: model "${annotationSafe(entry.model)}" is unpriced \u2014 its price map key collides with another key after canonicalization`
+    );
+    return { ...zero, known: false };
+  }
+  const p = Object.hasOwn(prices.models, canonicalModel) ? prices.models[canonicalModel] : void 0;
   if (!p) {
     warn(
       // annotationSafe: a model id is an unvalidated t.string — a CR/LF in it must not emit a
@@ -560,7 +576,26 @@ var computeModelCost = (entry, prices, pricedAt, warn) => {
   return { ...zero, costUSD };
 };
 var computeCost = (models, prices, pricedAt, warn = defaultWarn) => {
-  const lines = models.map((entry) => computeModelCost(entry, prices, pricedAt, warn));
+  const colliding = /* @__PURE__ */ new Set();
+  const seenCanonical = /* @__PURE__ */ new Map();
+  const canonicalModels = Object.fromEntries(
+    Object.entries(prices.models).map(([key2, rate]) => {
+      const canonical = modelIdentity(key2);
+      const prior = seenCanonical.get(canonical);
+      if (prior !== void 0) {
+        colliding.add(canonical);
+        warn(
+          `code-review cost: the price map keys "${annotationSafe(prior)}" and "${annotationSafe(key2)}" both canonicalize to "${annotationSafe(canonical)}" \u2014 the model is unpriced; fix the map`
+        );
+      }
+      seenCanonical.set(canonical, key2);
+      return [canonical, rate];
+    })
+  );
+  const canonicalPrices = { ...prices, models: canonicalModels };
+  const lines = models.map(
+    (entry) => computeModelCost(entry, canonicalPrices, pricedAt, warn, colliding)
+  );
   return {
     lines,
     totalInputTokens: lines.reduce((s, l) => s + l.inputTokens, 0),
@@ -1159,6 +1194,167 @@ var reviewBodyPointer = (headSha, stickyUrl, runUrl, runHasSummary) => {
   const run2 = runUrl ? ` See the [workflow run](${runUrl}) for ${runHasSummary ? "this round's review in full, its job log," : "the job log"} and the findings artifact.` : "";
   return `\u{1F916} Automated code review for \`${sha7}\` \u2014 see ${summary} for the verdict, walkthrough, and cost.${run2}`;
 };
+var MAX_BUFFER = 100 * 1024 * 1024;
+var MAX_TIMEOUT_MS = 2147483647;
+var parseTimeoutMs = (raw, fallback) => {
+  if (raw === void 0 || !/^\d+$/.test(raw)) return fallback;
+  const parsed = Number(raw);
+  return parsed > 0 && parsed <= MAX_TIMEOUT_MS ? parsed : fallback;
+};
+var SUBPROCESS_TIMEOUT_ENV = "CODE_REVIEW_SUBPROCESS_TIMEOUT_MS";
+var DEFAULT_SUBPROCESS_TIMEOUT_MS = 12e4;
+var subprocessTimeoutMs = () => parseTimeoutMs(process.env[SUBPROCESS_TIMEOUT_ENV], DEFAULT_SUBPROCESS_TIMEOUT_MS);
+var classifyExecError = (err, stderr, timeoutMs) => {
+  const e = err;
+  const stderrStr = stderr.trim();
+  if (e.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER")
+    return `output exceeded ${String(MAX_BUFFER)} bytes (killed)`;
+  if (e.killed === true)
+    return `no response within ${String(timeoutMs)}ms (killed a hung child)${stderrStr ? `: ${stderrStr}` : ""}`;
+  return stderrStr || errMsg(err);
+};
+var execFileWithTimeout = (spec) => new Promise((resolve4, reject) => {
+  const child = execFile(
+    spec.command,
+    [...spec.args],
+    {
+      ...spec.env ? { env: { ...process.env, ...spec.env } } : {},
+      encoding: "utf-8",
+      maxBuffer: MAX_BUFFER,
+      timeout: spec.timeoutMs,
+      killSignal: "SIGKILL"
+    },
+    (err, stdout, stderr) => {
+      if (err)
+        reject(
+          new Error(`${spec.label} failed: ${classifyExecError(err, stderr, spec.timeoutMs)}`)
+        );
+      else resolve4(stdout);
+    }
+  );
+  if (spec.stdin !== void 0) {
+    child.stdin?.on("error", () => void 0);
+    child.stdin?.end(spec.stdin);
+  }
+});
+
+// src/gh.ts
+var describeEndpoint = (args) => args.find((a) => a === "graphql" || a.includes("/") && !a.startsWith("-")) ?? args[0] ?? "(no endpoint)";
+var flagFirst;
+var withEscapeRetry = async (run2, idempotent) => {
+  if (flagFirst) return run2(true);
+  try {
+    return await run2(false);
+  } catch (err) {
+    if (errMsg(err).includes("--allow-escape-sequences")) {
+      if (!idempotent) throw err;
+      flagFirst = true;
+      return run2(true);
+    }
+    throw err;
+  }
+};
+var isIdempotentCall = (args) => !args.includes("--input") && !args.includes("--method") && !args.includes("graphql");
+var runGhApi = (args, stdin, env) => withEscapeRetry(
+  (withFlag) => execFileWithTimeout({
+    command: "gh",
+    args: ["api", ...withFlag ? ["--allow-escape-sequences"] : [], ...args],
+    label: `gh api ${describeEndpoint(args)}`,
+    timeoutMs: subprocessTimeoutMs(),
+    env,
+    stdin
+  }),
+  isIdempotentCall(args)
+);
+
+// src/artifact.ts
+var run = promisify(execFile);
+var STEP_TIMEOUT_MS = 6e4;
+var MARKER_URL = /<!-- code-review:findings-json (https?:\/\/[^\s>]+) -->/;
+var findingsArtifactUrl = (body) => MARKER_URL.exec(body)?.[1] ?? null;
+var containedPath = (dir, member) => {
+  const target = resolve(dir, member);
+  return target.startsWith(`${dir}${sep}`) || target === dir ? target : null;
+};
+var hasFindingsMarker = (body) => parseFindingsMarker(body) !== null || findingsArtifactUrl(body) !== null;
+var locateFindingsMember = (listing) => listing.split("\n").map((l) => l.trim()).filter(
+  (l) => l.toLowerCase() === "findings.json" || l.toLowerCase().endsWith("/findings.json")
+).sort((a, b) => a.length - b.length)[0] ?? null;
+var readArtifactFindings = (ghApiPath) => {
+  return async (zipUrl) => {
+    try {
+      const dir = await mkdtemp(join(tmpdir(), "code-review-artifact-"));
+      const zip = join(dir, "findings.zip");
+      try {
+        await ghApiPath(zipUrl, zip);
+        const { stdout: listing } = await run("unzip", ["-Z1", zip], {
+          encoding: "utf-8",
+          maxBuffer: 4 * 1024 * 1024,
+          timeout: STEP_TIMEOUT_MS
+        });
+        const member = locateFindingsMember(listing);
+        if (member === null) return null;
+        await run("unzip", [zip, "-d", dir], {
+          maxBuffer: 64 * 1024 * 1024,
+          timeout: STEP_TIMEOUT_MS
+        });
+        const target = containedPath(dir, member);
+        if (target === null) {
+          process.stderr.write(
+            `::warning::the findings artifact names a member outside the archive directory (${member}) \u2014 the re-review seeds without the prior document`
+          );
+          return null;
+        }
+        return await readFile(target, "utf-8");
+      } finally {
+        await rm(dir, { recursive: true, force: true }).catch(() => void 0);
+      }
+    } catch (err) {
+      process.stderr.write(
+        annotationSafe(
+          `::warning::could not resolve the prior findings artifact ${zipUrl} (${errMsg(err)}) \u2014 the re-review seeds without the prior document`
+        )
+      );
+      return null;
+    }
+  };
+};
+var ghArtifactReader = readArtifactFindings(async (url, outPath) => {
+  const { stdout } = await withEscapeRetry(
+    (withFlag) => run("gh", ["api", ...withFlag ? ["--allow-escape-sequences"] : [], url], {
+      encoding: "buffer",
+      maxBuffer: 256 * 1024 * 1024,
+      timeout: STEP_TIMEOUT_MS
+    }),
+    true
+  );
+  await writeFile(outPath, stdout);
+});
+var withoutKey = (doc, key2) => Object.fromEntries(Object.entries(doc).filter(([k]) => k !== key2));
+var withStampedConvergence = (doc, body) => {
+  if (typeof doc !== "object" || doc === null || Array.isArray(doc)) return doc;
+  const stripped = withoutKey(doc, "convergence");
+  const stamped = parseConvergenceMarker(body);
+  return stamped === null ? stripped : { ...stripped, convergence: stamped };
+};
+var resolvePriorFindings = async (body, read) => {
+  const embedded = parseFindingsMarker(body);
+  if (embedded !== null) return embedded;
+  const url = findingsArtifactUrl(body);
+  if (url === null) return null;
+  const text = await read(url);
+  if (text === null) return null;
+  try {
+    return withStampedConvergence(JSON.parse(text), body);
+  } catch (err) {
+    process.stderr.write(
+      annotationSafe(
+        `::warning::could not parse the findings document fetched from ${url} (${errMsg(err)}) \u2014 the re-review seeds without the prior document`
+      )
+    );
+    return null;
+  }
+};
 
 // src/comment-chain.ts
 function* ancestors(start, parentOf) {
@@ -1512,6 +1708,24 @@ var fetchThreadComments = async (ghApi, repo, prNumber) => {
 var escapePipes = (text) => text.replace(/\|/g, "\\|");
 var encodeAutolinkParens = (url) => url.replace(/\(/g, "%28").replace(/\)/g, "%29");
 var linkSafeUrl = (url) => encodeAutolinkParens(escapeCodeBackticks(url));
+var shedNote = (count, summaryAvailable, runUrl, findingsDocLinked, thisRunArtifact) => count === 0 ? "" : `<sub>**${String(count)} finding${count === 1 ? "" : "s"} left out of this comment**${summaryAvailable && runUrl !== void 0 ? ` \u2014 the [run summary](<${runUrl}>) carries the whole review` : findingsDocLinked && thisRunArtifact ? " \u2014 the machine findings document carries them" : ""}.</sub>`;
+var terminalNotice = (i) => [
+  `## ${i.verdictBadge}`,
+  "",
+  `<sub>**Reviewed** \`${escapeCodeBackticks(i.reviewedSha.slice(0, 7))}\`${i.postedAt ? ` at ${i.postedAt}` : ""}${i.route ? ` \xB7 **route:** ${i.route}` : ""}</sub>`,
+  ...i.roundsSummary !== "" ? [`<sub>${i.roundsSummary}</sub>`] : [],
+  ...i.convergenceSummary !== "" ? [`<sub>${i.convergenceSummary}</sub>`] : [],
+  ...i.inlinePosted > 0 ? [
+    `<sub>\u2192 ${String(i.inlinePosted)} inline comment${i.inlinePosted === 1 ? "" : "s"} posted on the diff \u2014 the disposition line the terminal round otherwise skips.</sub>`
+  ] : [],
+  "",
+  `> **The review for \`${escapeCodeBackticks(i.reviewedSha.slice(0, 7))}\` exceeds GitHub's comment-size limit.**` + (i.summaryAvailable ? i.runUrl ? ` The whole review lives in the [run summary](<${i.runUrl}>).` : " The whole review lives in the workflow run's summary." : i.findingsDocLinked && i.thisRunArtifact ? " The whole review lives in the machine findings document." : "") + (i.findingsDocLinked && i.thisRunArtifact ? " The machine findings document is linked above." : ""),
+  "",
+  "> [!WARNING]",
+  `> **LLM Disclosure** \u2014 this review was produced by ${i.modelNames || "unknown model"}.`,
+  ">",
+  `> _Generated by [code-review](https://github.com/JPHutchins/code-review)${i.runUrl ? ` \xB7 [view the run & traces](<${i.runUrl}>)` : ""}._`
+].join("\n");
 var permalinkFor = (base, f, anchor) => {
   if (f.path === "" || f.side === "LEFT") return void 0;
   const path = f.path.split("/").map(
@@ -1636,6 +1850,20 @@ var computeSeverityCounts = (findings) => findings.reduce(
 );
 var isReviewVerdict = (verdict) => verdict !== "error";
 var isConvergenceRound = (route, incomplete) => route === "full review" && !incomplete;
+var verdictBadge = (v) => {
+  switch (v) {
+    case "approve":
+      return "\u2705 approved";
+    case "comment":
+      return "\u{1F4AC} comment";
+    case "changes":
+      return "\u{1F527} changes requested";
+    case "error":
+      return "\u{1F6E0}\uFE0F no review verdict";
+    default:
+      return `\u2753 ${v}`;
+  }
+};
 var render = (input) => {
   const eta = new Eta({ autoTrim: false });
   const usageAvailable = input.envelope !== null;
@@ -1748,6 +1976,8 @@ var render = (input) => {
   };
   return eta.renderString(input.template, {
     findings: input.findings,
+    shedCount: input.shedCount ?? 0,
+    terminal: input.terminal ?? false,
     envelope: input.envelope,
     usageAvailable,
     hasUsage,
@@ -1755,6 +1985,38 @@ var render = (input) => {
     costReport,
     pricesProvided,
     costProvenance,
+    // The terminal branch's "machine findings document is linked above" claim must only fire when
+    // the pointer actually carries a findings-json marker (the convergence-only marker does not).
+    // Derived from the SAME value the template renders (the jsonUrl fallback pair included).
+    findingsDocLinked: hasFindingsMarker(
+      input.findingsPointer ?? findingsMarkerPair(input.jsonUrl, input.findings.convergence)
+    ),
+    summaryAvailable: input.summaryAvailable ?? false,
+    shedNote: shedNote(
+      input.shedCount ?? 0,
+      input.summaryAvailable ?? false,
+      input.runUrl,
+      hasFindingsMarker(
+        input.findingsPointer ?? findingsMarkerPair(input.jsonUrl, input.findings.convergence)
+      ),
+      input.jsonUrl !== void 0
+    ),
+    terminalNotice: terminalNotice({
+      reviewedSha: input.reviewedSha ?? "0000000000000000000000000000000000000000",
+      verdictBadge: verdictBadge(input.findings.verdict),
+      route: route ?? void 0,
+      postedAt: input.postedAt ?? "",
+      roundsSummary: roundsSummary(trajectory, input.roundCount),
+      convergenceSummary: !isFullReviewRound ? "" : convergence ? convergenceBadge(convergence) : "",
+      inlinePosted: input.inlineDisposition?.kind === "posted" ? input.inlineDisposition.count : 0,
+      runUrl: input.runUrl,
+      summaryAvailable: input.summaryAvailable ?? false,
+      findingsDocLinked: hasFindingsMarker(
+        input.findingsPointer ?? findingsMarkerPair(input.jsonUrl, input.findings.convergence)
+      ),
+      thisRunArtifact: input.jsonUrl !== void 0,
+      modelNames
+    }),
     // The house sanitizer for untrusted template fields — collapses line breaks AND escapes
     // backticks, so a hand-edited stamp cannot break the code span or the blockquote.
     // A nonconforming stamp must not be presented as validated: the template shows a note
@@ -1819,20 +2081,7 @@ var render = (input) => {
       const s = Math.round(ms / 1e3);
       return s >= 60 ? `${String(Math.floor(s / 60))}m ${String(s % 60)}s` : `${String(s)}s`;
     },
-    verdictBadge: (v) => {
-      switch (v) {
-        case "approve":
-          return "\u2705 approved";
-        case "comment":
-          return "\u{1F4AC} comment";
-        case "changes":
-          return "\u{1F527} changes requested";
-        case "error":
-          return "\u{1F6E0}\uFE0F no review verdict";
-        default:
-          return `\u2753 ${v}`;
-      }
-    },
+    verdictBadge,
     severityEmoji,
     formatConfidence
   });
@@ -2470,7 +2719,7 @@ var defaultVersion = (kind) => {
   if (!latest) throw new Error(`Registry invariant violated \u2014 no latest entry for "${kind}"`);
   return latest.defaultVersion;
 };
-var bundledSchemaPath = (relativePath) => resolve$1(import.meta.dirname, "..", "schema", relativePath);
+var bundledSchemaPath = (relativePath) => resolve(import.meta.dirname, "..", "schema", relativePath);
 var schemaPathFor = (kind, version) => {
   const table = tableFor(kind);
   const entry = version === void 0 ? table.find((v) => v.latest) : table.find((v) => v.minor === majorMinor(version));
@@ -2503,7 +2752,7 @@ var resolvers = {
   triage: (raw) => resolveSingleVersion("triage", raw),
   prices: (raw) => resolveSingleVersion("prices", raw)
 };
-var resolve = (kind, raw) => resolvers[kind](raw);
+var resolve2 = (kind, raw) => resolvers[kind](raw);
 var resolveTolerantFindings = (doc) => {
   const r = resolveFindings(doc);
   if (r.kind === "ok") return r.value;
@@ -2511,165 +2760,6 @@ var resolveTolerantFindings = (doc) => {
   const legacy = FindingsCodecV09.decode(doc);
   return legacy._tag === "Right" ? normalizeV09(legacy.right) : null;
 };
-var MAX_BUFFER = 100 * 1024 * 1024;
-var MAX_TIMEOUT_MS = 2147483647;
-var parseTimeoutMs = (raw, fallback) => {
-  if (raw === void 0 || !/^\d+$/.test(raw)) return fallback;
-  const parsed = Number(raw);
-  return parsed > 0 && parsed <= MAX_TIMEOUT_MS ? parsed : fallback;
-};
-var SUBPROCESS_TIMEOUT_ENV = "CODE_REVIEW_SUBPROCESS_TIMEOUT_MS";
-var DEFAULT_SUBPROCESS_TIMEOUT_MS = 12e4;
-var subprocessTimeoutMs = () => parseTimeoutMs(process.env[SUBPROCESS_TIMEOUT_ENV], DEFAULT_SUBPROCESS_TIMEOUT_MS);
-var classifyExecError = (err, stderr, timeoutMs) => {
-  const e = err;
-  const stderrStr = stderr.trim();
-  if (e.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER")
-    return `output exceeded ${String(MAX_BUFFER)} bytes (killed)`;
-  if (e.killed === true)
-    return `no response within ${String(timeoutMs)}ms (killed a hung child)${stderrStr ? `: ${stderrStr}` : ""}`;
-  return stderrStr || errMsg(err);
-};
-var execFileWithTimeout = (spec) => new Promise((resolve4, reject) => {
-  const child = execFile(
-    spec.command,
-    [...spec.args],
-    {
-      ...spec.env ? { env: { ...process.env, ...spec.env } } : {},
-      encoding: "utf-8",
-      maxBuffer: MAX_BUFFER,
-      timeout: spec.timeoutMs,
-      killSignal: "SIGKILL"
-    },
-    (err, stdout, stderr) => {
-      if (err)
-        reject(
-          new Error(`${spec.label} failed: ${classifyExecError(err, stderr, spec.timeoutMs)}`)
-        );
-      else resolve4(stdout);
-    }
-  );
-  if (spec.stdin !== void 0) {
-    child.stdin?.on("error", () => void 0);
-    child.stdin?.end(spec.stdin);
-  }
-});
-
-// src/gh.ts
-var describeEndpoint = (args) => args.find((a) => a === "graphql" || a.includes("/") && !a.startsWith("-")) ?? args[0] ?? "(no endpoint)";
-var flagFirst;
-var withEscapeRetry = async (run2, idempotent) => {
-  if (flagFirst) return run2(true);
-  try {
-    return await run2(false);
-  } catch (err) {
-    if (errMsg(err).includes("--allow-escape-sequences")) {
-      if (!idempotent) throw err;
-      flagFirst = true;
-      return run2(true);
-    }
-    throw err;
-  }
-};
-var isIdempotentCall = (args) => !args.includes("--input") && !args.includes("--method") && !args.includes("graphql");
-var runGhApi = (args, stdin, env) => withEscapeRetry(
-  (withFlag) => execFileWithTimeout({
-    command: "gh",
-    args: ["api", ...withFlag ? ["--allow-escape-sequences"] : [], ...args],
-    label: `gh api ${describeEndpoint(args)}`,
-    timeoutMs: subprocessTimeoutMs(),
-    env,
-    stdin
-  }),
-  isIdempotentCall(args)
-);
-var run = promisify(execFile);
-var STEP_TIMEOUT_MS = 6e4;
-var MARKER_URL = /<!-- code-review:findings-json (https?:\/\/[^\s>]+) -->/;
-var findingsArtifactUrl = (body) => MARKER_URL.exec(body)?.[1] ?? null;
-var containedPath = (dir, member) => {
-  const target = resolve$1(dir, member);
-  return target.startsWith(`${dir}${sep}`) || target === dir ? target : null;
-};
-var hasFindingsMarker = (body) => parseFindingsMarker(body) !== null || findingsArtifactUrl(body) !== null;
-var locateFindingsMember = (listing) => listing.split("\n").map((l) => l.trim()).filter(
-  (l) => l.toLowerCase() === "findings.json" || l.toLowerCase().endsWith("/findings.json")
-).sort((a, b) => a.length - b.length)[0] ?? null;
-var readArtifactFindings = (ghApiPath) => {
-  return async (zipUrl) => {
-    try {
-      const dir = await mkdtemp(join(tmpdir(), "code-review-artifact-"));
-      const zip = join(dir, "findings.zip");
-      try {
-        await ghApiPath(zipUrl, zip);
-        const { stdout: listing } = await run("unzip", ["-Z1", zip], {
-          encoding: "utf-8",
-          maxBuffer: 4 * 1024 * 1024,
-          timeout: STEP_TIMEOUT_MS
-        });
-        const member = locateFindingsMember(listing);
-        if (member === null) return null;
-        await run("unzip", [zip, "-d", dir], {
-          maxBuffer: 64 * 1024 * 1024,
-          timeout: STEP_TIMEOUT_MS
-        });
-        const target = containedPath(dir, member);
-        if (target === null) {
-          process.stderr.write(
-            `::warning::the findings artifact names a member outside the archive directory (${member}) \u2014 the re-review seeds without the prior document`
-          );
-          return null;
-        }
-        return await readFile(target, "utf-8");
-      } finally {
-        await rm(dir, { recursive: true, force: true }).catch(() => void 0);
-      }
-    } catch (err) {
-      process.stderr.write(
-        annotationSafe(
-          `::warning::could not resolve the prior findings artifact ${zipUrl} (${errMsg(err)}) \u2014 the re-review seeds without the prior document`
-        )
-      );
-      return null;
-    }
-  };
-};
-var ghArtifactReader = readArtifactFindings(async (url, outPath) => {
-  const { stdout } = await withEscapeRetry(
-    (withFlag) => run("gh", ["api", ...withFlag ? ["--allow-escape-sequences"] : [], url], {
-      encoding: "buffer",
-      maxBuffer: 256 * 1024 * 1024,
-      timeout: STEP_TIMEOUT_MS
-    }),
-    true
-  );
-  await writeFile(outPath, stdout);
-});
-var withoutKey = (doc, key2) => Object.fromEntries(Object.entries(doc).filter(([k]) => k !== key2));
-var withStampedConvergence = (doc, body) => {
-  if (typeof doc !== "object" || doc === null || Array.isArray(doc)) return doc;
-  const stripped = withoutKey(doc, "convergence");
-  const stamped = parseConvergenceMarker(body);
-  return stamped === null ? stripped : { ...stripped, convergence: stamped };
-};
-var resolvePriorFindings = async (body, read) => {
-  const embedded = parseFindingsMarker(body);
-  if (embedded !== null) return embedded;
-  const url = findingsArtifactUrl(body);
-  if (url === null) return null;
-  const text = await read(url);
-  if (text === null) return null;
-  try {
-    return withStampedConvergence(JSON.parse(text), body);
-  } catch (err) {
-    process.stderr.write(
-      annotationSafe(
-        `::warning::could not parse the findings document fetched from ${url} (${errMsg(err)}) \u2014 the re-review seeds without the prior document`
-      )
-    );
-    return null;
-  }
-};
 
 // src/pr.ts
 var CANDIDATE_JQ = ".[] | {number: .number, state: .state, headRef: .head.ref, headSha: .head.sha}";
@@ -2812,6 +2902,9 @@ var checkRun = async (input, ghApi = runGhApi) => {
 };
 
 // src/post.ts
+var STICKY_CHAR_LIMIT = 65536;
+var SHED_RESERVE = 4e3;
+var SHED_NOTE_BUDGET = 512;
 var DEFAULT_MARKER = "<!-- code-review -->";
 var EMPTY_MECHANIC_LEAVE_MESSAGE = "The CI-fix pass found no issues and the sticky already reflects a completed full review \u2014 leaving it in place\n";
 var MAX_SUGGESTION_LINES = 10;
@@ -2835,7 +2928,7 @@ var checkLongSuggestions = (comments) => {
   return { comments: adjusted, longFiles };
 };
 var decodeFindings = (doc) => {
-  const resolution = resolve("findings", doc);
+  const resolution = resolve2("findings", doc);
   switch (resolution.kind) {
     case "ok":
       return { kind: "ok", findings: resolution.value };
@@ -3453,6 +3546,18 @@ ${dropNote}` : ""}`,
   const template = readFileSync(input.templatePath, "utf-8");
   const inlineRequested = input.inline === true;
   const envelope = loadEnvelope(input.envelopePath);
+  const effectiveRoute = input.route ?? envelope?.route;
+  const runRenderInput = {
+    prices: decodedPrices.right,
+    pricesProvided: input.pricesProvided,
+    template,
+    route: effectiveRoute,
+    reviewedSha: input.headSha,
+    effort: input.effort,
+    runUrl: input.runUrl,
+    jsonUrl: input.jsonUrl,
+    postedAt: input.postedAt
+  };
   const reachable = existingSticky !== null ? discussionRows(commentRows, existingSticky.id, input.botLogin) : [];
   const priorIsMechanic = existingSticky !== null && (parseReviewedRoute(existingSticky.body) === "mechanic" || parseMechanicAncestor(existingSticky.body));
   const noticeDiscussion = async () => {
@@ -3476,7 +3581,7 @@ ${dropNote}` : ""}`,
     };
   };
   const renderNotice = (message, discussion) => {
-    const noticeConvergence = (input.route ?? envelope?.route) === "mechanic" ? mechanicConvergence(
+    const noticeConvergence = effectiveRoute === "mechanic" ? mechanicConvergence(
       priorConv,
       input.convergenceThreshold ?? DEFAULT_CONVERGENCE_THRESHOLD
     ) : priorConv;
@@ -3489,22 +3594,14 @@ ${dropNote}` : ""}`,
     };
     return formatMarkdown(
       render({
+        ...runRenderInput,
         findings: findings2,
         envelope: null,
         incomplete: true,
-        prices: decodedPrices.right,
-        pricesProvided: input.pricesProvided,
-        template,
-        route: input.route,
-        reviewedSha: input.headSha,
-        effort: input.effort,
         sameRootNotes: {},
         roundCount: priorRoundCount,
         convergenceRound: false,
-        runUrl: input.runUrl,
-        jsonUrl: input.jsonUrl,
         findingsPointer: noticeFindingsPointer(findings2),
-        postedAt: input.postedAt,
         orphanedDiscussion: discussion.orphanedDiscussion,
         orphanedTotal: discussion.orphanedTotal,
         orphanedTruncated: discussion.orphanedTruncated,
@@ -3601,7 +3698,101 @@ ${dropNote}` : ""}`,
   const orphanedTruncated = stickyDiscussion.orphanedTruncated;
   const testReport = input.testReportPath ? loadTestReport(input.testReportPath) : void 0;
   const clocDiff = input.clocDiffPath ? loadClocDiff(input.clocDiffPath) : void 0;
-  const effectiveRoute = input.route ?? envelope?.route;
+  const shedPriority = (f) => SEVERITIES.length - 1 - SEVERITIES.indexOf(f.severity);
+  const shedOrderOf = (list) => list.map((f, index) => ({ f, index })).sort((a, b) => shedPriority(a.f) - shedPriority(b.f) || a.index - b.index).map((entry) => entry.f);
+  const sizeSticky = (renderAt, total, reserve = SHED_RESERVE) => {
+    const target = STICKY_CHAR_LIMIT - reserve - SHED_NOTE_BUDGET;
+    const base = renderAt(0);
+    if (base.length <= target) return { body: base, shedCount: 0, terminal: false };
+    const allShed = renderAt(total);
+    if (allShed.length > STICKY_CHAR_LIMIT - SHED_NOTE_BUDGET)
+      return { body: "", shedCount: total, terminal: true };
+    let low = 0;
+    let high = total;
+    let fitted = "";
+    while (low < high) {
+      const mid = low + high >> 1;
+      const body = renderAt(mid);
+      if (body.length <= target) {
+        high = mid;
+        fitted = body;
+      } else {
+        low = mid + 1;
+      }
+    }
+    return { body: fitted !== "" ? fitted : allShed, shedCount: low, terminal: false };
+  };
+  const minimalTerminalBody = (findingsPointer2, route, incomplete, summaryAvailable2, modelNames2) => [
+    DEFAULT_MARKER,
+    `<!-- reviewed-sha: ${input.headSha} -->`,
+    ...!incomplete && route !== void 0 ? [`<!-- reviewed-route: ${route.replace(/--/g, "~~").replace(/\s+/g, " ")} -->`] : [],
+    ...!incomplete ? [REVIEW_COMPLETE_MARKER] : [],
+    // The pointer's link form already begins with the directive; the convergence-only marker
+    // does not, and a terminal surface must carry the directive either way.
+    ...findingsPointer2 !== "" ? [
+      findingsPointer2.startsWith(AGENTS_STOP_DIRECTIVE) ? findingsPointer2 : `${AGENTS_STOP_DIRECTIVE}
+${findingsPointer2}`
+    ] : [],
+    "",
+    terminalNotice({
+      reviewedSha: input.headSha,
+      verdictBadge: verdictBadge(loadedFindings.verdict),
+      route: route ?? void 0,
+      postedAt: input.postedAt,
+      roundsSummary: "",
+      convergenceSummary: "",
+      inlinePosted: 0,
+      runUrl: input.runUrl,
+      summaryAvailable: summaryAvailable2,
+      findingsDocLinked: hasFindingsMarker(findingsPointer2),
+      thisRunArtifact: input.jsonUrl !== void 0,
+      modelNames: modelNames2
+    })
+  ].join("\n");
+  const terminalOrMinimal = (terminalRender, findingsPointer2, route, incomplete, summaryAvailable2, modelNames2) => terminalRender.length <= STICKY_CHAR_LIMIT ? terminalRender : minimalTerminalBody(findingsPointer2, route, incomplete, summaryAvailable2, modelNames2);
+  const summaryAvailable = (process.env["GITHUB_STEP_SUMMARY"] ?? "") !== "";
+  const modelNames = envelope !== null && envelope.models.length > 0 ? envelope.models.map((m) => m.model).join(", ") : "";
+  const withShedNote = (body, shedCount, findingsPointer2) => {
+    if (shedCount === 0) return body;
+    const note = shedNote(
+      shedCount,
+      summaryAvailable,
+      input.runUrl,
+      hasFindingsMarker(findingsPointer2),
+      input.jsonUrl !== void 0
+    );
+    return body.includes(note) ? body : `${body}
+
+${note}
+`;
+  };
+  const sharedRenderInput = {
+    ...runRenderInput,
+    repo: input.headRepo || input.repo,
+    testReport,
+    clocDiff,
+    // The answered-state honesty rules apply on EVERY surface that renders the filtered
+    // findings — the lost-envelope branch lists every VISIBLE finding (no inline review exists to
+    // carry them) so the kept re-raises' annotations actually render, and names the drops
+    // exactly like the main path (issues #151 review r1 + r2). The nit visibility floor applies
+    // here too (issue #164): below-floor nits are hidden from the human list and shown only in the
+    // collapsed aside — the floor is a human-visibility policy, not an inline-comment policy, so it
+    // must hold on the surface that lists findings without an inline review.
+    suppressedNits,
+    nitVisibilityFloor: input.nitVisibilityFloor,
+    answeredNotes: reRaisedNotes,
+    answeredReRaiseNote: answeredDropNote,
+    discussionByFinding,
+    orphanedDiscussion,
+    orphanedTotal,
+    discussionTruncated,
+    orphanedTruncated,
+    orphanedUnresolvable: orphanResolveFailed,
+    convergenceThreshold: input.convergenceThreshold,
+    unverifiedNoLogs: input.unverifiedNoLogs,
+    pricedAt: input.pricedAt,
+    summaryAvailable
+  };
   if (envelope === null) {
     const envelopelessIncomplete = isIncompleteFindings(findings);
     if (wouldBuryCompleted(envelopelessIncomplete)) {
@@ -3617,51 +3808,45 @@ ${dropNote}` : ""}`,
         input.convergenceThreshold ?? DEFAULT_CONVERGENCE_THRESHOLD
       ) : priorConv
     );
-    const body = formatMarkdown(
+    const lostInput = {
+      ...sharedRenderInput,
+      findings: stampedFindings2,
+      envelope: null,
+      incomplete: envelopelessIncomplete,
+      sameRootNotes: {},
+      roundCount: priorRoundCount,
+      convergenceRound: false,
+      findingsPointer: findingsBlob(stampedFindings2)
+    };
+    const lostRender = (opts) => formatMarkdown(
       render({
-        findings: stampedFindings2,
-        envelope: null,
-        incomplete: envelopelessIncomplete,
-        prices: decodedPrices.right,
-        pricesProvided: input.pricesProvided,
-        template,
-        route: effectiveRoute,
-        reviewedSha: input.headSha,
-        repo: input.headRepo || input.repo,
-        effort: input.effort,
-        sameRootNotes: {},
-        // The answered-state honesty rules apply on EVERY surface that renders the filtered
-        // findings — the lost-envelope branch lists every VISIBLE finding (no inline review exists to
-        // carry them) so the kept re-raises' annotations actually render, and names the drops
-        // exactly like the main path (issues #151 review r1 + r2). The nit visibility floor applies
-        // here too (issue #164): below-floor nits are hidden from the human list and shown only in the
-        // collapsed aside — the floor is a human-visibility policy, not an inline-comment policy, so it
-        // must hold on the surface that lists findings without an inline review.
-        strays: visibleFindings,
-        suppressedNits,
-        nitVisibilityFloor: input.nitVisibilityFloor,
-        answeredNotes: reRaisedNotes,
-        answeredReRaiseNote: answeredDropNote,
-        roundCount: priorRoundCount,
-        convergenceRound: false,
-        testReport,
-        clocDiff,
-        inlineDisposition: inlineRequested ? { kind: "no-envelope" } : { kind: "disabled" },
-        runUrl: input.runUrl,
-        unverifiedNoLogs: input.unverifiedNoLogs,
-        jsonUrl: input.jsonUrl,
-        findingsPointer: findingsBlob(stampedFindings2),
-        postedAt: input.postedAt,
-        discussionByFinding,
-        orphanedDiscussion,
-        orphanedTotal,
-        discussionTruncated,
-        orphanedTruncated,
-        orphanedUnresolvable: orphanResolveFailed
+        ...lostInput,
+        ...opts,
+        inlineDisposition: inlineRequested ? { kind: "no-envelope" } : { kind: "disabled" }
       })
     );
+    const lostShedOrder = shedOrderOf(visibleFindings);
+    const lostRenderAt = (shedCount) => shedCount === 0 ? lostRender({ strays: visibleFindings }) : (() => {
+      const dropped = new Set(lostShedOrder.slice(0, shedCount));
+      return lostRender({
+        strays: visibleFindings.filter((f) => !dropped.has(f)),
+        shedCount
+      });
+    })();
+    const lostSized = sizeSticky(lostRenderAt, visibleFindings.length, 0);
+    const body = lostSized.terminal ? terminalOrMinimal(
+      lostRender({ strays: visibleFindings, terminal: true }),
+      findingsBlob(stampedFindings2),
+      effectiveRoute,
+      envelopelessIncomplete,
+      summaryAvailable,
+      ""
+    ) : withShedNote(lostSized.body, lostSized.shedCount, findingsBlob(stampedFindings2));
     await upsertSticky(input.repo, prNumber, existingSticky, body, ghApi, true);
-    appendRunSummary(process.env["GITHUB_STEP_SUMMARY"], () => body);
+    appendRunSummary(
+      process.env["GITHUB_STEP_SUMMARY"],
+      () => lostSized.shedCount === 0 ? lostSized.body : lostRender({ strays: visibleFindings })
+    );
     if (inlineRequested) {
       process.stderr.write(
         "Warning: inline: true was requested, but the result envelope is missing \u2014 inline comments cannot be built; the findings are in the sticky and the run summary instead\n"
@@ -3680,6 +3865,11 @@ ${dropNote}` : ""}`,
   }
   if (emptyMechanicWouldBury(effectiveRoute, thisIncomplete) && existingSticky !== null)
     await emptyMechanicLeaveOrNote(existingSticky);
+  if (!input.jsonUrl && existingSticky !== null && parseReviewComplete(existingSticky.body) && parseReviewedRoute(existingSticky.body) === "full review" && hasFindingsMarker(existingSticky.body)) {
+    leaveInPlace(
+      "no --json-url was supplied and the existing sticky still carries the prior findings document's marker (embedded or link) \u2014 leaving it in place rather than severing the seed chain\n"
+    );
+  }
   const isRound = isConvergenceRound(effectiveRoute, thisIncomplete) && isReviewVerdict(findings.verdict);
   const sameRootNotes = isRound ? computeSameRootNotes(priorTraj, findings.findings, input.headSha.slice(0, 12)) : {};
   const {
@@ -3704,7 +3894,6 @@ ${dropNote}` : ""}`,
   }
   const botReviews = await fetchBotReviews(input.repo, prNumber, input.botLogin, ghApi);
   const initialDisposition = !inlineRequested ? { kind: "disabled" } : comments.length === 0 && strays.length > 0 ? { kind: "none-in-diff" } : void 0;
-  const currentCounts = computeSeverityCounts(findings.findings);
   const currentCodes = computeIdCounts(findings.findings, findings.systemic_problems ?? []);
   const roundNumber = priorRoundCount + 1;
   const convergence = isRound ? buildConvergence(
@@ -3724,40 +3913,15 @@ ${dropNote}` : ""}`,
   const currentRoundCount = isRound ? roundNumber : priorRoundCount;
   const findingsMarker = findingsBlob(stampedFindings);
   const commonRenderInput = {
+    ...sharedRenderInput,
     findings: stampedFindings,
     envelope,
     incomplete: thisIncomplete,
-    prices: decodedPrices.right,
-    pricesProvided: input.pricesProvided,
-    template,
-    route: effectiveRoute,
-    reviewedSha: input.headSha,
-    repo: input.headRepo || input.repo,
-    effort: input.effort,
-    testReport,
-    clocDiff,
-    severityCounts: currentCounts,
     sameRootNotes,
-    answeredNotes: reRaisedNotes,
-    answeredReRaiseNote: answeredDropNote,
-    discussionByFinding,
-    orphanedDiscussion,
-    orphanedTotal,
-    discussionTruncated,
-    orphanedTruncated,
-    orphanedUnresolvable: orphanResolveFailed,
     roundCount: currentRoundCount,
-    convergenceThreshold: input.convergenceThreshold,
-    nitVisibilityFloor: input.nitVisibilityFloor,
     convergenceRound: isRound,
     strays,
-    suppressedNits,
-    runUrl: input.runUrl,
-    unverifiedNoLogs: input.unverifiedNoLogs,
-    jsonUrl: input.jsonUrl,
-    findingsPointer: findingsMarker,
-    postedAt: input.postedAt,
-    pricedAt: input.pricedAt
+    findingsPointer: findingsMarker
   };
   const longFilesNote = longFiles.length > 0 ? `
 
@@ -3765,27 +3929,56 @@ ${dropNote}` : ""}`,
 
 > **Note:** ${String(longFiles.length)} suggestion(s) exceeded GitHub's ~10-line inline suggestion limit and were omitted from the inline comments; the affected findings remain in the review.
 ` : "";
-  const renderBody = (inlineDisposition, reviewUrl2, straysOverride, unanchoredCount2, unanchoredStrays, discussionOverride) => formatMarkdown(
+  const renderBody = (inlineDisposition, reviewUrl2, straysOverride, unanchoredCount2, unanchoredStrays, discussionOverride, terminal = false, shedCount = 0) => formatMarkdown(
     render({
       ...commonRenderInput,
       ...straysOverride ? { strays: straysOverride } : {},
       ...unanchoredCount2 !== void 0 ? { unanchoredCount: unanchoredCount2 } : {},
       ...unanchoredStrays !== void 0 && unanchoredStrays.length > 0 ? { unanchoredStrays } : {},
       ...discussionOverride ?? {},
+      ...terminal ? { terminal } : {},
+      ...shedCount > 0 ? { shedCount } : {},
       inlineDisposition,
       reviewUrl: reviewUrl2
     }) + longFilesNote
   );
-  if (!input.jsonUrl && existingSticky !== null && parseReviewComplete(existingSticky.body) && parseReviewedRoute(existingSticky.body) === "full review" && hasFindingsMarker(existingSticky.body)) {
-    leaveInPlace(
-      "no --json-url was supplied and the existing sticky still carries the prior findings document's marker (embedded or link) \u2014 leaving it in place rather than severing the seed chain\n"
-    );
-  }
+  const mainShedOrder = shedOrderOf(strays);
+  const mainRenderAt = (shedCount) => shedCount === 0 ? renderBody(initialDisposition) : renderBody(
+    initialDisposition,
+    void 0,
+    strays.filter((f) => !new Set(mainShedOrder.slice(0, shedCount)).has(f)),
+    void 0,
+    void 0,
+    void 0,
+    false,
+    shedCount
+  );
+  const mainSized = sizeSticky(
+    mainRenderAt,
+    strays.length,
+    inlineRequested && rawComments.length > 0 ? SHED_RESERVE : 0
+  );
+  const fitStickyBody = () => mainSized.terminal ? terminalOrMinimal(
+    renderBody(
+      initialDisposition,
+      void 0,
+      void 0,
+      void 0,
+      void 0,
+      void 0,
+      true
+    ),
+    findingsMarker,
+    effectiveRoute,
+    thisIncomplete,
+    summaryAvailable,
+    modelNames
+  ) : withShedNote(mainSized.body, mainSized.shedCount, findingsMarker);
   const stickyRef = await upsertSticky(
     input.repo,
     prNumber,
     existingSticky,
-    renderBody(initialDisposition),
+    fitStickyBody(),
     ghApi,
     true
   );
@@ -3827,7 +4020,6 @@ ${dropNote}` : ""}`,
     await minimizeComments(prNumber, priorInlineComments, ghApi);
   }
   const unanchoredCount = unposted.length;
-  const finalStrays = unanchoredCount > 0 ? [...unposted, ...strays] : strays;
   const finalDiscussion = unanchoredCount > 0 ? buildStickyDiscussion(
     reachable,
     [...currentIds, ...unposted.map((f) => f.id).filter((id) => id !== "")],
@@ -3842,29 +4034,75 @@ ${dropNote}` : ""}`,
   } : void 0;
   if (stickyRef !== null && (inlinePosted > 0 || unanchoredCount > 0)) {
     const finalDisposition = inlinePosted > 0 ? { kind: "posted", count: inlinePosted, sha: input.headSha } : { kind: "inline-unavailable" };
-    try {
-      await patchComment(
-        input.repo,
-        stickyRef.id,
-        renderBody(
+    if (mainSized.terminal) {
+      try {
+        const terminalPatch = renderBody(
           finalDisposition,
           reviewUrl,
-          finalStrays,
+          void 0,
           unanchoredCount,
           unposted,
-          finalDiscussionOverride
-        ),
-        ghApi
-      );
-      process.stderr.write(
-        `Updated sticky comment #${String(stickyRef.id)} to reflect the review
+          finalDiscussionOverride,
+          true
+        );
+        if (terminalPatch.length <= STICKY_CHAR_LIMIT) {
+          await patchComment(input.repo, stickyRef.id, terminalPatch, ghApi);
+          process.stderr.write(
+            `Updated sticky comment #${String(stickyRef.id)} to reflect the review
 `
-      );
-    } catch (err) {
-      process.stderr.write(
-        `Warning: failed to update the sticky summary after the review: ${errMsg(err)}
+          );
+        } else {
+          process.stderr.write(
+            `Warning: the terminal sticky patch exceeds GitHub's comment limit \u2014 the sticky stands; the run summary carries the review
 `
+          );
+        }
+      } catch (err) {
+        process.stderr.write(
+          `Warning: failed to update the terminal sticky after the review: ${errMsg(err)}
+`
+        );
+      }
+    } else {
+      const patchShedOrder = shedOrderOf(strays);
+      const patchRenderAt = (shedCount) => renderBody(
+        finalDisposition,
+        reviewUrl,
+        [
+          ...unposted,
+          ...shedCount === 0 ? strays : strays.filter((f) => !new Set(patchShedOrder.slice(0, shedCount)).has(f))
+        ],
+        unanchoredCount,
+        unposted,
+        finalDiscussionOverride,
+        false,
+        shedCount
       );
+      const patchSized = sizeSticky(patchRenderAt, strays.length, 0);
+      try {
+        if (patchSized.terminal) {
+          process.stderr.write(
+            `Warning: the final sticky patch still exceeds GitHub's comment limit \u2014 the sticky stands as posted${summaryAvailable ? "; the whole review (rejected findings included) is in the run summary" : ""}
+`
+          );
+        } else {
+          await patchComment(
+            input.repo,
+            stickyRef.id,
+            withShedNote(patchSized.body, patchSized.shedCount, findingsMarker),
+            ghApi
+          );
+          process.stderr.write(
+            `Updated sticky comment #${String(stickyRef.id)} to reflect the review
+`
+          );
+        }
+      } catch (err) {
+        process.stderr.write(
+          `Warning: failed to update the sticky summary after the review: ${errMsg(err)}
+`
+        );
+      }
     }
   }
   appendRunSummary(
@@ -4261,6 +4499,13 @@ failing_jobs=${String(result.failingJobs)}
 `;
   }
 };
+var FETCH_WITHOUT_DETACHED_CHILDREN = [
+  "-c",
+  "maintenance.auto=false",
+  "-c",
+  "gc.auto=0",
+  "fetch"
+];
 var runGit = (args) => execFileWithTimeout({
   command: "git",
   args,
@@ -4328,7 +4573,7 @@ var fetchFullDiff = async (repo, defaultBranch, headSha, ghApi, gitRun) => {
     process.stderr.write(`compare diff fetch failed (${errMsg(err)}) \u2014 falling back to git diff
 `);
   }
-  await gitRun(["fetch", "origin", headSha]);
+  await gitRun([...FETCH_WITHOUT_DETACHED_CHILDREN, "origin", headSha]);
   const base = (await gitRun(["rev-parse", "HEAD"])).trim();
   return gitRun(["diff", `${base}...${headSha}`]);
 };
@@ -4520,7 +4765,7 @@ var gather = async (input, ghApi = runGhApi, gitRun = runGit, readArtifact = ghA
       `PR diff fetch failed or was empty for ${String(meta.changed_files)} changed files \u2014 falling back to git diff
 `
     );
-    await gitRun(["fetch", "origin", input.headSha]);
+    await gitRun([...FETCH_WITHOUT_DETACHED_CHILDREN, "origin", input.headSha]);
     return gitRun(["diff", meta.base_sha, input.headSha]);
   })();
   const fullDiff = stacked ? await fetchFullDiff(input.repo, input.defaultBranch, input.headSha, ghApi, gitRun) : prDiff;
@@ -4633,7 +4878,7 @@ var gateCandidate = (kind, rawCandidate) => {
   const schemaPath = safeSchemaPathFor(kind, candidateVersion(kind, candidate));
   if (schemaPath === null) return null;
   if (!validateAgainstSchema(candidate, schemaPath).valid) return null;
-  const resolution = resolve(kind, candidate);
+  const resolution = resolve2(kind, candidate);
   return resolution.kind === "ok" ? { version: resolution.version, candidate } : null;
 };
 var candidateFromJsonText = (kind, text) => {
@@ -4756,13 +5001,6 @@ var ClaudeCodeEnvelopeCodec = t.intersection([
     structured_output: t.unknown
   })
 ]);
-var sumUsage = (into, entry) => ({
-  ...into,
-  input_tokens: into.input_tokens + entry.input_tokens,
-  output_tokens: into.output_tokens + entry.output_tokens,
-  ...into.cache_read_tokens !== void 0 || entry.cache_read_tokens !== void 0 ? { cache_read_tokens: (into.cache_read_tokens ?? 0) + (entry.cache_read_tokens ?? 0) } : {},
-  ...into.cache_write_tokens !== void 0 || entry.cache_write_tokens !== void 0 ? { cache_write_tokens: (into.cache_write_tokens ?? 0) + (entry.cache_write_tokens ?? 0) } : {}
-});
 var mapModelUsage = (modelUsage) => [
   ...Object.entries(modelUsage).reduce((byModel, [configuredModelId, entry]) => {
     const model = modelIdentity(configuredModelId);
@@ -4774,7 +5012,7 @@ var mapModelUsage = (modelUsage) => [
       ...entry.cacheCreationInputTokens !== void 0 ? { cache_write_tokens: entry.cacheCreationInputTokens } : {}
     };
     const prior = byModel.get(model);
-    return byModel.set(model, prior === void 0 ? mapped : sumUsage(prior, mapped));
+    return byModel.set(model, prior === void 0 ? mapped : addModelUsage(prior, mapped));
   }, /* @__PURE__ */ new Map()).values()
 ];
 var findingsOutcome = (native, agentFilePath, agentFileFallbackPath) => {
@@ -4786,7 +5024,7 @@ var findingsOutcome = (native, agentFilePath, agentFileFallbackPath) => {
   });
   if (ladder.kind !== "ok")
     return { kind: "telemetry-only", reason: describeLadderFailure(ladder) };
-  const resolution = resolve("findings", ladder.candidate);
+  const resolution = resolve2("findings", ladder.candidate);
   return resolution.kind === "ok" ? { kind: "ok", version: resolution.version, findings: resolution.value } : {
     kind: "telemetry-only",
     reason: "internal error: the extraction ladder validated a candidate the registry then rejected"
@@ -4895,7 +5133,6 @@ var composeReviewSettings = (opts) => {
 };
 
 // src/sandbox.ts
-var GITHUB_HOSTS = ["api.github.com", "github.com"];
 var deriveModelHost = (apiBaseUrl) => {
   const host = URL.canParse(apiBaseUrl) ? new URL(apiBaseUrl).hostname : "";
   if (host === "") {
@@ -4915,11 +5152,7 @@ var parseExtraEndpoints = (extra) => extra.split(/\s+/).map((token) => token.rep
 var buildSandboxConfig = (opts) => ({
   network: {
     allowedDomains: [
-      .../* @__PURE__ */ new Set([
-        deriveModelHost(opts.apiBaseUrl),
-        ...GITHUB_HOSTS,
-        ...parseExtraEndpoints(opts.extra ?? "")
-      ])
+      .../* @__PURE__ */ new Set([deriveModelHost(opts.apiBaseUrl), ...parseExtraEndpoints(opts.extra ?? "")])
     ],
     deniedDomains: []
   },
@@ -4945,7 +5178,7 @@ var parseScope = (raw) => {
 var resolvedPriorValue = resolveTolerantFindings;
 var readJSON = (path) => {
   try {
-    return JSON.parse(readFileSync(resolve$1(path), "utf-8"));
+    return JSON.parse(readFileSync(resolve(path), "utf-8"));
   } catch (err) {
     return fail(`Cannot read ${path}: ${errMsg(err)}`);
   }
@@ -4958,7 +5191,7 @@ var fail = (msg) => {
 var readJSONOrAbsent = (path) => {
   const read = (() => {
     try {
-      return { text: readFileSync(resolve$1(path), "utf-8") };
+      return { text: readFileSync(resolve(path), "utf-8") };
     } catch (err) {
       return { error: errMsg(err) };
     }
@@ -4988,7 +5221,7 @@ var readJSONOrAbsent = (path) => {
   }
 };
 var readSandboxConfigForNotice = (path) => {
-  const text = readFileOrNull(resolve$1(path));
+  const text = readFileOrNull(resolve(path));
   if (text === null) return void 0;
   const parsed = tryParseJson(text);
   if (!parsed.ok) {
@@ -5029,7 +5262,7 @@ var unwrapAdapt = (either) => {
   }
 };
 var transcriptFallbackFrom = (path) => {
-  const tree = readTranscriptTree(resolve$1(path));
+  const tree = readTranscriptTree(resolve(path));
   if (tree.missing)
     process.stderr.write(
       `code-review adapt: transcript ${path} is unreadable \u2014 no telemetry fallback
@@ -5038,13 +5271,13 @@ var transcriptFallbackFrom = (path) => {
   const usage = sumTranscriptUsage(tree.entries);
   return { models: usage.models, turns: usage.turns, durationMs: usage.durationMs };
 };
-var bundledPath = (...segments) => resolve$1(import.meta.dirname, "..", ...segments);
+var bundledPath = (...segments) => resolve(import.meta.dirname, "..", ...segments);
 var readPackageVersion = () => JSON.parse(readFileSync(bundledPath("package.json"), "utf-8")).version;
 var packageVersion = readPackageVersion();
-var resolveTemplatePath = (templateArg) => templateArg ? resolve$1(templateArg) : bundledPath("templates", "comment.eta");
-var resolveInlineTemplatePath = (templateArg) => templateArg ? resolve$1(templateArg) : bundledPath("templates", "inline.eta");
+var resolveTemplatePath = (templateArg) => templateArg ? resolve(templateArg) : bundledPath("templates", "comment.eta");
+var resolveInlineTemplatePath = (templateArg) => templateArg ? resolve(templateArg) : bundledPath("templates", "inline.eta");
 var resolvePrices = (pricesArg) => {
-  if (pricesArg) return { kind: "provided", path: resolve$1(pricesArg) };
+  if (pricesArg) return { kind: "provided", path: resolve(pricesArg) };
   process.stderr.write(
     "code-review: no --prices given \u2014 cost will be reported as N/A (no price map to recompute from)\n"
   );
@@ -5174,7 +5407,7 @@ var inlineCmd = defineCommand({
   },
   run: async ({ args }) => {
     const findings = decode(FindingsCodec.decode(readJSON(args.findings)), "findings");
-    const diff = readFileSync(resolve$1(args.diff), "utf-8");
+    const diff = readFileSync(resolve(args.diff), "utf-8");
     const inlineTemplate = readFileSync(resolveInlineTemplatePath(args.template), "utf-8");
     const floor = parseNitVisibilityFloor(args["nit-visibility-floor"]);
     const visibleFindings = findings.findings.filter((f) => !isBelowVisibilityFloor(f, floor));
@@ -5211,6 +5444,8 @@ var costCmd = defineCommand({
     const report = computeCost(
       envelope.models,
       prices,
+      // Price a saved envelope at the RUN's own instant (issue #170), so re-running `cost` later prices
+      // the same envelope to the same slot deterministically — not at whatever wall clock it is re-run at.
       parseInstant(envelope.generated_at) ?? /* @__PURE__ */ new Date()
     );
     process.stdout.write(JSON.stringify(report, null, 2));
@@ -5233,7 +5468,7 @@ var checkCostCmd = defineCommand({
     }
   },
   run: async ({ args }) => {
-    const tree = readTranscriptTree(resolve$1(args.transcript));
+    const tree = readTranscriptTree(resolve(args.transcript));
     if (tree.missing) {
       process.stderr.write(
         `code-review check-cost: transcript ${args.transcript} is unreadable \u2014 reporting zero spend
@@ -5267,7 +5502,7 @@ var checkCostCmd = defineCommand({
 });
 var tryReadPrices = (path) => {
   try {
-    const decoded = PriceMapCodec.decode(JSON.parse(readFileSync(resolve$1(path), "utf-8")));
+    const decoded = PriceMapCodec.decode(JSON.parse(readFileSync(resolve(path), "utf-8")));
     return decoded._tag === "Right" ? decoded.right : null;
   } catch {
     return null;
@@ -5386,10 +5621,10 @@ var budgetHookCmd = defineCommand({
   },
   run: async ({ args }) => {
     try {
-      const draftPath = resolve$1(args.draft);
+      const draftPath = resolve(args.draft);
       const input = readStdinJSON();
       const transcriptPath = transcriptPathOf(input);
-      const tree = transcriptPath ? readTranscriptTree(resolve$1(transcriptPath)) : void 0;
+      const tree = transcriptPath ? readTranscriptTree(resolve(transcriptPath)) : void 0;
       const usage = tree ? sumTranscriptUsage(tree.entries) : void 0;
       const prices = args.prices ? tryReadPrices(args.prices) : null;
       const costReport = prices !== null && usage ? (
@@ -5518,7 +5753,7 @@ var printSettingsCmd = defineCommand({
     if (args.kind && !["findings", "triage", "prices"].includes(args.kind))
       fail(`--kind must be one of findings|triage|prices (got '${args.kind}')`);
     const settings = composeReviewSettings({
-      draftPath: resolve$1(args.draft),
+      draftPath: resolve(args.draft),
       stop: {
         kind: args.kind,
         schema: args.schema,
@@ -5610,7 +5845,7 @@ var validateCmd = defineCommand({
   run: async ({ args }) => {
     const kind = requireSchemaKind(args.kind || "findings");
     const documentRaw = readJSON(args.document);
-    const schemaPath = args.schema ? resolve$1(args.schema) : requireSchemaPath(kind, args["schema-version"] || derivedSchemaVersion(kind, documentRaw));
+    const schemaPath = args.schema ? resolve(args.schema) : requireSchemaPath(kind, args["schema-version"] || derivedSchemaVersion(kind, documentRaw));
     const { valid, errors } = validateAgainstSchema(documentRaw, schemaPath);
     if (valid) {
       process.stdout.write("\u2705 valid\n");
@@ -5677,7 +5912,7 @@ var seedDraftCmd = defineCommand({
     }
   },
   run: async ({ args }) => {
-    const outPath = resolve$1(args.out);
+    const outPath = resolve(args.out);
     const kindArg = args.kind || "findings";
     const kind = isSchemaKind(kindArg) ? kindArg : "findings";
     if (kind !== kindArg) {
@@ -5706,7 +5941,7 @@ var seedDraftCmd = defineCommand({
       if (!args.prior) return null;
       const raw = (() => {
         try {
-          return JSON.parse(readFileSync(resolve$1(args.prior), "utf-8"));
+          return JSON.parse(readFileSync(resolve(args.prior), "utf-8"));
         } catch {
           return null;
         }
@@ -5716,7 +5951,7 @@ var seedDraftCmd = defineCommand({
     const stagedPrior = (() => {
       if (!args["prior-findings"]) return null;
       try {
-        return JSON.parse(readFileSync(resolve$1(args["prior-findings"]), "utf-8"));
+        return JSON.parse(readFileSync(resolve(args["prior-findings"]), "utf-8"));
       } catch {
         return null;
       }
@@ -5728,7 +5963,7 @@ var seedDraftCmd = defineCommand({
     const answeredRegistry = (() => {
       if (!args["prior-answers"]) return null;
       try {
-        const raw = JSON.parse(readFileSync(resolve$1(args["prior-answers"]), "utf-8"));
+        const raw = JSON.parse(readFileSync(resolve(args["prior-answers"]), "utf-8"));
         if (!Array.isArray(raw)) throw new Error("expected an array");
         const decoded = raw.flatMap((row) => {
           const entry = decodeAnsweredEntry(row);
@@ -5797,7 +6032,7 @@ var seedDraftCmd = defineCommand({
     }
     const seededFromPrior = priorFindings === null ? false : (() => {
       try {
-        const schemaPath = args.schema ? resolve$1(args.schema) : schemaPathFor(kind, args["schema-version"]);
+        const schemaPath = args.schema ? resolve(args.schema) : schemaPathFor(kind, args["schema-version"]);
         const barePrior = typeof priorFindings === "object" && !Array.isArray(priorFindings) ? Object.fromEntries(
           Object.entries(priorFindings).filter(
             ([key2]) => !RECOVERABLE_OPTIONAL_FIELDS.has(key2)
@@ -6014,7 +6249,7 @@ var readFileLines = (path) => {
 };
 var validateFinding = (finding, repoRoot) => {
   if (finding.patch === void 0) return finding;
-  const lines = readFileLines(resolve$1(repoRoot, finding.path));
+  const lines = readFileLines(resolve(repoRoot, finding.path));
   if (lines === null) {
     process.stderr.write(
       `validate-patches: ${finding.path}: could not read file at "${repoRoot}" \u2014 dropping patch
@@ -6054,7 +6289,7 @@ var validatePatchesCmd = defineCommand({
   },
   run: async ({ args }) => {
     const findings = decode(FindingsCodec.decode(readJSON(args.findings)), "findings");
-    const repoRoot = args["repo-root"] ? resolve$1(args["repo-root"]) : process.cwd();
+    const repoRoot = args["repo-root"] ? resolve(args["repo-root"]) : process.cwd();
     const validated = {
       ...findings,
       findings: findings.findings.map((f) => validateFinding(f, repoRoot))
@@ -6168,7 +6403,7 @@ var stopGateCmd = defineCommand({
     }
   },
   run: async ({ args }) => {
-    const draftPath = resolve$1(args.draft);
+    const draftPath = resolve(args.draft);
     if (args["print-settings"]) {
       const command = defaultHookCommand(draftPath, {
         kind: args.kind,
@@ -6184,10 +6419,10 @@ var stopGateCmd = defineCommand({
     drainStdin();
     const kind = requireSchemaKind(args.kind || "findings");
     const maxNudges = requireMaxNudges(args["max-nudges"]);
-    const counterPath = args.counter ? resolve$1(args.counter) : `${draftPath}.nudges`;
+    const counterPath = args.counter ? resolve(args.counter) : `${draftPath}.nudges`;
     const state = draftState(
       draftPath,
-      (parsed) => args.schema ? resolve$1(args.schema) : schemaPathFor(kind, args["schema-version"] || derivedSchemaVersion(kind, parsed))
+      (parsed) => args.schema ? resolve(args.schema) : schemaPathFor(kind, args["schema-version"] || derivedSchemaVersion(kind, parsed))
     );
     const nudges = readNudges(counterPath);
     const decision = decideGate(state, nudges, maxNudges, draftPath, kind);
@@ -6255,7 +6490,7 @@ var gatherCmd = defineCommand({
       runId: args["run-id"],
       conclusion: args.conclusion,
       botLogin: args["bot-login"] || "github-actions[bot]",
-      outDir: args["out-dir"] ? resolve$1(args["out-dir"]) : process.cwd()
+      outDir: args["out-dir"] ? resolve(args["out-dir"]) : process.cwd()
     });
     process.stdout.write(renderOutputs(result));
   }
@@ -6349,6 +6584,11 @@ var postCmd = defineCommand({
   },
   run: async ({ args }) => {
     const priceResolution = resolvePrices(args.prices);
+    if (/--|\s/.test(args["head-sha"])) {
+      throw new Error(
+        '--head-sha must be a commit SHA (no "--" or whitespace): ' + args["head-sha"]
+      );
+    }
     await post({
       repo: args.repo,
       // The workflow's post step threads HEAD_REPO env (the fork's owner/name) — a finding
@@ -6704,7 +6944,7 @@ var checkScopeCmd = defineCommand({
 var sandboxConfigCmd = defineCommand({
   meta: {
     name: "sandbox-config",
-    description: "Emit the sandbox-runtime (srt) settings that jail the untrusted review agent's egress: allow the model host (derived from api_base_url), the GitHub API/host, and the consumer's extra_endpoints; deny all else; filesystem isolation off"
+    description: "Emit the sandbox-runtime (srt) settings that jail the untrusted review agent's egress: allow the model host (derived from api_base_url) and the consumer's extra_endpoints; deny all else; filesystem isolation off"
   },
   args: {
     "api-base-url": {
@@ -6749,7 +6989,7 @@ var sandboxConfigCmd = defineCommand({
     const json = `${JSON.stringify(config, null, 2)}
 `;
     if (args.out) {
-      writeFileSync(resolve$1(args.out), json);
+      writeFileSync(resolve(args.out), json);
     } else {
       process.stdout.write(json);
     }