@opengsd/gsd-core 1.18.0 → 1.20.0

package/gsd-core/bin/lib/review-lane-descriptor.cjs

@@ -58,6 +58,7 @@ exports.DOCS_PARITY_VIOLATION = exports.LANE_SLUG_RE = exports.PARITY_VIOLATION
 exports.mergeReviewerLanes = mergeReviewerLanes;
 exports.checkReviewerLaneParity = checkReviewerLaneParity;
 exports.checkReviewerDocsParity = checkReviewerDocsParity;
+const text_lines_cjs_1 = require("./text-lines.cjs");
 /**
  * Argv placeholders (Phase 5b, #2799).
  *
@@ -134,6 +135,8 @@ exports.REVIEWER_LANES = Object.freeze([
         evidenceClass: 'source-grounded',
         requiresBinaries: [],
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.claude',
+        contextWindowTokens: 200000,
+        contextWindowConfigKey: 'review.context_window_tokens.claude',
         modelConfigKey: 'review.models.claude',
         effortConfigKey: 'review.effort.claude',
         defaultEffort: 'high',
@@ -165,6 +168,8 @@ exports.REVIEWER_LANES = Object.freeze([
         evidenceClass: 'source-grounded',
         requiresBinaries: [],
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.codex',
+        contextWindowTokens: 272000,
+        contextWindowConfigKey: 'review.context_window_tokens.codex',
         modelConfigKey: 'review.models.codex',
         effortConfigKey: 'review.effort.codex',
         defaultEffort: 'high',
@@ -193,6 +198,8 @@ exports.REVIEWER_LANES = Object.freeze([
         evidenceClass: 'diff-only',
         requiresBinaries: [],
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.coderabbit',
+        contextWindowTokens: null,
+        contextWindowConfigKey: null,
         // Accepts no model flag at all (review.md:367) — not merely "none configured".
         modelConfigKey: null,
         effortConfigKey: null,
@@ -223,6 +230,8 @@ exports.REVIEWER_LANES = Object.freeze([
         // stock Windows/Git-Bash (#2589) — is no longer a prerequisite for this lane.
         requiresBinaries: [],
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.opencode',
+        contextWindowTokens: null,
+        contextWindowConfigKey: 'review.context_window_tokens.opencode',
         modelConfigKey: 'review.models.opencode',
         effortConfigKey: 'review.effort.opencode',
         defaultEffort: 'high',
@@ -249,6 +258,8 @@ exports.REVIEWER_LANES = Object.freeze([
         evidenceClass: 'source-grounded',
         requiresBinaries: [],
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.qwen',
+        contextWindowTokens: 131072,
+        contextWindowConfigKey: 'review.context_window_tokens.qwen',
         modelConfigKey: null,
         effortConfigKey: null,
         defaultEffort: null,
@@ -277,6 +288,8 @@ exports.REVIEWER_LANES = Object.freeze([
         evidenceClass: 'source-grounded',
         requiresBinaries: [],
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.cursor',
+        contextWindowTokens: null,
+        contextWindowConfigKey: 'review.context_window_tokens.cursor',
         // #3653: cursor-agent exposes --model (204 selectable models); wired the same as codex.
         modelConfigKey: 'review.models.cursor',
         effortConfigKey: null,
@@ -313,6 +326,8 @@ exports.REVIEWER_LANES = Object.freeze([
         // Phase 5b: the handler reads the transcript with JSON.parse per line, not `jq`.
         requiresBinaries: [],
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.antigravity',
+        contextWindowTokens: null,
+        contextWindowConfigKey: 'review.context_window_tokens.antigravity',
         // NOT `review.models.antigravity` — the shipped key is `review.models.agy` (review.md:291) and
         // Phase 4 federated it under that name. This lane is why the key is declared, not derived.
         modelConfigKey: 'review.models.agy',
@@ -347,6 +362,8 @@ exports.REVIEWER_LANES = Object.freeze([
         // neither `jq` nor `curl` is a prerequisite any more (#2589's stated Windows hazard).
         requiresBinaries: [],
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.ollama',
+        contextWindowTokens: null,
+        contextWindowConfigKey: 'review.context_window_tokens.ollama',
         modelConfigKey: 'review.models.ollama',
         effortConfigKey: null,
         defaultEffort: null,
@@ -377,6 +394,8 @@ exports.REVIEWER_LANES = Object.freeze([
         evidenceClass: 'source-grounded',
         requiresBinaries: [],
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.lm_studio',
+        contextWindowTokens: null,
+        contextWindowConfigKey: 'review.context_window_tokens.lm_studio',
         modelConfigKey: 'review.models.lm_studio',
         effortConfigKey: null,
         defaultEffort: null,
@@ -407,6 +426,8 @@ exports.REVIEWER_LANES = Object.freeze([
         evidenceClass: 'source-grounded',
         requiresBinaries: [],
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.llama_cpp',
+        contextWindowTokens: null,
+        contextWindowConfigKey: 'review.context_window_tokens.llama_cpp',
         modelConfigKey: 'review.models.llama_cpp',
         effortConfigKey: null,
         defaultEffort: null,
@@ -455,6 +476,8 @@ exports.REVIEWER_LANES = Object.freeze([
         evidenceClass: 'source-grounded',
         requiresBinaries: [],
         promptBudgetKey: 'review.max_prompt_tokens_per_reviewer.kimi-code',
+        contextWindowTokens: 262144,
+        contextWindowConfigKey: 'review.context_window_tokens.kimi-code',
         modelConfigKey: 'review.models.kimi-code',
         effortConfigKey: null,
         defaultEffort: null,
@@ -576,6 +599,7 @@ exports.PARITY_VIOLATION = Object.freeze({
     REGISTRY_LANE_UNDECLARED: 'registry_lane_undeclared',
     DESCRIPTOR_LANE_NOT_IN_REGISTRY: 'descriptor_lane_not_in_registry',
     BESPOKE_LEG_PRESENT: 'bespoke_leg_present',
+    AVAILABILITY_FALLBACK_MISMATCH: 'availability_fallback_mismatch',
     DUPLICATE_SLUG: 'duplicate_slug',
     DUPLICATE_FLAG: 'duplicate_flag',
     DUPLICATE_SECTION: 'duplicate_section',
@@ -607,6 +631,10 @@ const LEG_MARKER_RE = /<!--\s*reviewer-lane:\s*([a-z0-9_-]+)\s*-->/g;
  * design principle of this module.
  */
 exports.LANE_SLUG_RE = /^[a-z0-9][a-z0-9_-]*$/;
+/** The workflow's availability call: `gsd_run review-lane availability ...` at command position. */
+const AVAILABILITY_CALL_RE = /^\s*gsd_run review-lane availability(?:\s|$)/;
+/** One `<slug>:missing` row in the printf fallback; slug is LANE_SLUG_RE's grammar capped at 32 chars. */
+const AVAILABILITY_FALLBACK_ROW_RE = /(?:'|\\n)([a-z0-9][a-z0-9_-]{0,31}):missing/g;
 /** Bounds of the step a bespoke leg marker could appear inside. */
 const INVOKE_STEP_RE = /<step name="invoke_reviewers">([\s\S]*?)<\/step>/;
 function sliceStep(workflowText, re) {
@@ -627,8 +655,10 @@ function countOccurrences(haystack, re) {
 }
 /**
  * Bidirectional parity across three surfaces: the descriptor, the roster
- * (`KNOWN_REVIEWER_SLUGS`), and the generated capability **registry** — plus one anti-parity
- * assertion against the workflow.
+ * (`KNOWN_REVIEWER_SLUGS`), and the generated capability **registry** — plus two assertions
+ * against the workflow: the anti-parity check, and the availability-fallback check (the workflow
+ * makes the availability call, has a fallback row per lane, and the fallback slug set equals the
+ * openai-http lanes).
  *
  * **Re-pointed by Phase 5b (#2799).** Through Phase 5a this function also required a literal
  * `<!-- reviewer-lane: <slug> -->` per lane inside `invoke_reviewers` and a literal
@@ -671,6 +701,7 @@ function checkReviewerLaneParity(input) {
     const seenSlug = new Set();
     const seenFlag = new Set();
     const seenSection = new Set();
+    const httpSlugs = new Set();
     // The declared parameter type says `ReviewerLane[]`, but this function is a
     // trust boundary — narrow from `unknown` rather than believing the annotation.
     const rawLanes = Array.isArray(descriptor) ? descriptor : [];
@@ -689,6 +720,8 @@ function checkReviewerLaneParity(input) {
         if (seenSlug.has(slug))
             add(exports.PARITY_VIOLATION.DUPLICATE_SLUG, slug);
         seenSlug.add(slug);
+        if (lane.transport === 'openai-http')
+            httpSlugs.add(slug);
         const flags = Array.isArray(lane.flags) ? lane.flags : [];
         for (const flag of flags) {
             if (typeof flag !== 'string')
@@ -740,6 +773,28 @@ function checkReviewerLaneParity(input) {
     for (const slug of markerSlugs.keys()) {
         add(exports.PARITY_VIOLATION.BESPOKE_LEG_PRESENT, slug);
     }
+    // --- the availability call's `||` fallback must name exactly the openai-http lanes ---
+    //
+    // review.md prints these rows only when an older gsd-tools lacks `review-lane availability`, so
+    // they are a second hand-kept copy of the roster. Checked only when the call is present.
+    // Anchored to the command position so a comment or prose mention cannot shadow the real call;
+    // a missing call is itself a violation (otherwise deleting it would silently skip this check).
+    const availabilityLine = (0, text_lines_cjs_1.splitLines)(workflowText).find((line) => AVAILABILITY_CALL_RE.test(line));
+    if (availabilityLine === undefined) {
+        add(exports.PARITY_VIOLATION.AVAILABILITY_FALLBACK_MISMATCH, 'no-call');
+    }
+    else {
+        if (!availabilityLine.includes('review-lane availability ||')) {
+            add(exports.PARITY_VIOLATION.AVAILABILITY_FALLBACK_MISMATCH, 'no-fallback');
+        }
+        const fallback = new Set(Array.from(availabilityLine.matchAll(AVAILABILITY_FALLBACK_ROW_RE), (m) => m[1]));
+        for (const slug of fallback)
+            if (!httpSlugs.has(slug))
+                add(exports.PARITY_VIOLATION.AVAILABILITY_FALLBACK_MISMATCH, slug);
+        for (const slug of httpSlugs)
+            if (!fallback.has(slug))
+                add(exports.PARITY_VIOLATION.AVAILABILITY_FALLBACK_MISMATCH, slug);
+    }
     return { ok: violations.length === 0, violations };
 }
 /* ------------------------------------------------------------------ *

package/gsd-core/bin/lib/review-lane-invocation.cjs

@@ -23,7 +23,7 @@
  * third-party overlay manifests (ADR-2782 D4).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LANE_UNAVAILABLE = void 0;
+exports.CONTEXT_WINDOW_HEADROOM = exports.LANE_UNAVAILABLE = void 0;
 exports.configString = configString;
 exports.normalizeHost = normalizeHost;
 exports.resolveLaneEffort = resolveLaneEffort;
@@ -33,7 +33,10 @@ exports.isEmptyReview = isEmptyReview;
 exports.fileRefPrompt = fileRefPrompt;
 exports.applyPromptOverride = applyPromptOverride;
 exports.artifactPaths = artifactPaths;
-exports.resolveLaneBudget = resolveLaneBudget;
+exports.resolveLaneCap = resolveLaneCap;
+exports.checkPromptAgainstCap = checkPromptAgainstCap;
+exports.refuseIfOverCap = refuseIfOverCap;
+exports.renderPromptRefusalStub = renderPromptRefusalStub;
 exports.resolveLanePlan = resolveLanePlan;
 const review_lane_descriptor_cjs_1 = require("./review-lane-descriptor.cjs");
 /* ------------------------------------------------------------------ *
@@ -60,8 +63,12 @@ exports.LANE_UNAVAILABLE = Object.freeze({
     PROBE_TIMEOUT: 'probe_timeout',
     HOST_UNREACHABLE: 'host_unreachable',
     EGRESS_HOST_CHANGED: 'egress_host_changed',
-    BUDGET_TOO_SMALL: 'budget_too_small',
-    BUDGET_TOOL_FAILED: 'budget_tool_failed',
+    /**
+     * #4559: the prompt a lane would receive is larger than its prompt cap (an explicit cap, or the
+     * default derived from the lane's context window). The lane is REFUSED — never trimmed, because a
+     * silently truncated plan set is a review of something other than the plans.
+     */
+    PROMPT_EXCEEDS_CONTEXT: 'prompt_exceeds_context',
 });
 /** Every handler name the runner can dispatch. Mirrors `LaneHandler` (D6's closed enum). */
 const KNOWN_HANDLERS = new Set(['antigravity', 'openai-compatible', 'opencode']);
@@ -233,7 +240,8 @@ function fileRefPrompt(promptPath, repoRoot) {
 /**
  * Re-point a resolved plan at a different prompt file (`review-lane invoke --prompt-file`, #5049).
  *
- * The override carries a budget-trimmed prompt, so it has to land wherever THIS lane actually
+ * The override carries a caller-substituted prompt (a section subset, say; nothing trims a prompt
+ * to fit a lane since #4559), so it has to land wherever THIS lane actually
  * reads its prompt, and that differs by channel:
  *   - `stdin`: the runner streams the file `plan.stdin` names.
  *   - `argv-file-ref`: the prompt PATH is embedded in a sentence in argv (`fileRefPrompt`), already
@@ -279,25 +287,124 @@ function artifactPaths(runDir, slug) {
     };
 }
 /**
- * Per-lane prompt budget (#2797 semantics, preserved exactly).
+ * Fraction of a lane's declared context window a prompt may occupy (#4559). The remaining 35%
+ * absorbs the system prompt, the reply, and `estimateTokens` being a chars/4 estimate rather than
+ * a tokenizer (code tokenizes denser than prose).
+ */
+exports.CONTEXT_WINDOW_HEADROOM = 0.65;
+/**
+ * Per-lane prompt cap (#2797 semantics, extended by #4559).
  *
- * `-1` is the UNSET sentinel and falls back to the central `review.max_prompt_tokens`, because
- * `0` is a legitimate value meaning "do not trim this lane". Treating 0 as unset would silently
- * switch a user who deliberately disabled trimming onto the global budget.
+ * Precedence: per-lane `promptBudgetKey` → global `review.max_prompt_tokens` → the default derived
+ * from the lane's context window (`floor(window * CONTEXT_WINDOW_HEADROOM)`). `-1` is the UNSET
+ * sentinel for the per-lane key, because `0` is a legitimate value meaning "no cap for this lane".
+ * An explicit `0` at either explicit level also turns the derived default off.
+ *
+ * The window is the operator's `contextWindowConfigKey` value when that is a positive finite number
+ * (`0` disables the derived cap), else the lane's declared `contextWindowTokens`. Both are narrowed
+ * from `unknown` — overlay lanes and config values cross a trust boundary — and anything that is not
+ * a positive finite number narrows to "unset".
  *
  * Single source of truth: `gsd-core/bin/gsd-tools.cjs`'s `review-lane plan`/`invoke` and
- * `src/reviewer-step-dispatch.cts`'s `dispatchReviewerLanes` both resolve a lane's budget through
+ * `src/reviewer-step-dispatch.cts`'s `dispatchReviewerLanes` both resolve a lane's cap through
  * this function rather than each carrying their own copy (#4209 R3 — two verbatim copies drift).
  */
-function resolveLaneBudget(lane, configGet) {
-    if (!lane.promptBudgetKey)
-        return null;
-    const per = configGet(lane.promptBudgetKey);
+function resolveLaneCap(lane, configGet) {
+    // A spawn lane whose prompt channel is `none` (coderabbit) is fed no prompt, so there is nothing
+    // to cap: no key — explicit, global or derived — may ever refuse it (#4559, design row 18).
+    const laneRaw = lane;
+    if (laneRaw?.transport === 'spawn' && laneRaw.invoke?.promptChannel === 'none') {
+        return { cap: null, source: 'none', contextWindowTokens: null };
+    }
     const isNum = (v) => typeof v === 'number' && Number.isFinite(v);
-    if (isNum(per) && per !== -1)
-        return per;
-    const global = configGet('review.max_prompt_tokens');
-    return isNum(global) ? global : null;
+    const isPositive = (v) => isNum(v) && v > 0;
+    const raw = lane;
+    const budgetKey = typeof raw?.promptBudgetKey === 'string' && raw.promptBudgetKey ? raw.promptBudgetKey : null;
+    if (budgetKey) {
+        const per = configGet(budgetKey);
+        if (isNum(per) && per !== -1)
+            return { cap: per, source: 'lane', contextWindowTokens: null };
+        const global = configGet('review.max_prompt_tokens');
+        if (isNum(global))
+            return { cap: global, source: 'global', contextWindowTokens: null };
+    }
+    const windowKey = typeof raw?.contextWindowConfigKey === 'string' && raw.contextWindowConfigKey ? raw.contextWindowConfigKey : null;
+    const override = windowKey ? configGet(windowKey) : undefined;
+    if (override === 0)
+        return { cap: null, source: 'none', contextWindowTokens: null };
+    const windowTokens = isPositive(override)
+        ? override
+        : isPositive(raw?.contextWindowTokens)
+            ? raw.contextWindowTokens
+            : null;
+    if (windowTokens === null)
+        return { cap: null, source: 'none', contextWindowTokens: null };
+    return {
+        cap: Math.floor(windowTokens * exports.CONTEXT_WINDOW_HEADROOM),
+        source: 'context-window',
+        contextWindowTokens: windowTokens,
+    };
+}
+/**
+ * The ONE refuse-or-run decision (#4559), shared by `review-lane invoke` and `dispatchReviewerLanes`.
+ * Refuses only when a positive cap is STRICTLY exceeded: a prompt exactly at the cap runs, and a
+ * cap of `0` or `null` never refuses. `detail` names the estimate, the cap, where the cap came from
+ * and the key to change, so the refusal is actionable rather than a bare "too big".
+ */
+function checkPromptAgainstCap(estimatedTokens, capInfo, lane) {
+    const { cap, source, contextWindowTokens } = capInfo;
+    if (cap === null || !(cap > 0) || !(estimatedTokens > cap))
+        return { ok: true };
+    const raw = lane;
+    const slug = typeof raw?.slug === 'string' ? raw.slug : '';
+    const budgetKey = typeof raw?.promptBudgetKey === 'string' && raw.promptBudgetKey ? raw.promptBudgetKey : null;
+    const windowKey = typeof raw?.contextWindowConfigKey === 'string' && raw.contextWindowConfigKey ? raw.contextWindowConfigKey : null;
+    // Remedy keys are the lane's DECLARED keys (an overlay lane's differ from the slug convention).
+    const remedy = source === 'lane'
+        ? `raise ${budgetKey ?? 'the lane prompt cap'} or set it to 0 to remove the cap`
+        : source === 'global'
+            ? `raise review.max_prompt_tokens${budgetKey ? ` or set ${budgetKey}` : ''}`
+            : windowKey
+                ? `raise ${windowKey} if this lane's model has a larger window, or set it to 0 to remove the cap`
+                : budgetKey
+                    ? `this lane's context window is fixed by its declaration; set review.max_prompt_tokens or ${budgetKey} to override`
+                    : `this lane's cap comes from its declared contextWindowTokens and the lane declares no key to override it`;
+    const windowNote = contextWindowTokens !== null ? `, ${contextWindowTokens}-token context window` : '';
+    return {
+        ok: false,
+        reason: exports.LANE_UNAVAILABLE.PROMPT_EXCEEDS_CONTEXT,
+        detail: `estimated ${estimatedTokens} tokens exceeds the ${cap}-token cap for lane '${slug}' ` +
+            `(source: ${source}${windowNote}); ${remedy}`,
+    };
+}
+/**
+ * Resolve the lane's cap and decide refuse-or-run in one pure step (#4559): `null` = run, otherwise
+ * the structured refusal. `review-lane invoke` and `dispatchReviewerLanes` both call this, so the
+ * two surfaces cannot disagree about whether, or how, a lane is refused.
+ */
+function refuseIfOverCap(input) {
+    const capInfo = resolveLaneCap(input.lane, input.configGet);
+    const verdict = checkPromptAgainstCap(input.estimatedTokens, capInfo, input.lane);
+    if (verdict.ok)
+        return null;
+    return {
+        ok: false,
+        reason: verdict.reason,
+        detail: verdict.detail,
+        refusal: {
+            estimatedTokens: input.estimatedTokens,
+            cap: capInfo.cap,
+            capSource: capInfo.source,
+            contextWindowTokens: capInfo.contextWindowTokens,
+        },
+    };
+}
+/**
+ * The text written to a refused lane's review file (#4559). The marker
+ * `review did not run: prompt exceeds` is stable: `review.md`'s skip gate and coverage loop key on it.
+ */
+function renderPromptRefusalStub(slug, detail) {
+    return `${slug} review did not run: prompt exceeds this lane's context cap (${detail})\n`;
 }
 /* ------------------------------------------------------------------ *
  * Resolution

package/gsd-core/bin/lib/review-lane-runner.cjs

@@ -32,6 +32,7 @@ exports.parseModelBanner = parseModelBanner;
 exports.parseTranscriptModel = parseTranscriptModel;
 exports.checkEgressHost = checkEgressHost;
 exports.probeLane = probeLane;
+exports.probeHttpLanes = probeHttpLanes;
 exports.writeReviewOrStub = writeReviewOrStub;
 exports.emptyOutputDiagnosis = emptyOutputDiagnosis;
 exports.handleOpencodeOutput = handleOpencodeOutput;
@@ -318,14 +319,18 @@ async function probeLane(plan, deps) {
             // Only a STRING config value names a host. `String(unknown)` would turn an object into the
             // literal '[object Object]' and probe that as a URL — a nonsense destination reported as
             // "unreachable" rather than as the misconfiguration it is.
+            // For openai-http, `plan.host` is already resolved by `resolveLanePlan` (config → default,
+            // unset sentinels like "null" handled) — probe the destination the run would use.
             const configured = deps.configGet(probe.hostConfigKey);
-            const base = (0, review_lane_invocation_cjs_1.normalizeHost)((typeof configured === 'string' ? configured : '') ||
-                (plan.transport === 'openai-http' ? plan.host : ''));
+            const base = (0, review_lane_invocation_cjs_1.normalizeHost)((plan.transport === 'openai-http' ? plan.host : '') || (typeof configured === 'string' ? configured : ''));
             if (!base) {
                 return { available: false, reason: review_lane_invocation_cjs_1.LANE_UNAVAILABLE.HOST_UNREACHABLE, detail: 'no host resolved' };
             }
-            const r = await deps.httpJson(`${base}${probe.path}`, { method: 'GET', timeoutMs: probe.timeoutMs });
-            return r.ok
+            // D7: reachable ⇒ available. Any HTTP answer (401 behind an auth proxy, 404, 3xx) proves a
+            // server is there; only a transport failure (status 0) does not. Redirects are not followed:
+            // a probe must not issue a request to a host the descriptor never named.
+            const r = await deps.httpJson(`${base}${probe.path}`, { method: 'GET', timeoutMs: probe.timeoutMs, probe: true });
+            return r.status > 0
                 ? { available: true }
                 : {
                     available: false,
@@ -341,6 +346,25 @@ async function probeLane(plan, deps) {
             };
     }
 }
+/**
+ * `<slug>:available|missing` rows for the openai-http lanes in `lanes` (all, or those in `selected`).
+ * Prerequisite binaries are not folded in: the caller reports `jq` separately. An unresolvable lane
+ * reads `missing` and its reason is returned in `warnings` rather than swallowed.
+ */
+async function probeHttpLanes(lanes, selected, resolve, deps) {
+    // Probes run concurrently (each has its own timeout); Promise.all keeps descriptor order, and
+    // warnings are collected from the results afterwards so their order never depends on resolve timing.
+    const results = await Promise.all(lanes
+        .filter((l) => l.transport === 'openai-http' && (selected.length === 0 || selected.includes(l.slug)))
+        .map(async (lane) => {
+        const r = resolve(lane);
+        const up = r.ok && (await probeLane({ ...r.plan, requiresBinaries: [] }, deps)).available;
+        return { row: `${lane.slug}:${up ? 'available' : 'missing'}`, warning: r.ok ? null : `${lane.slug}: ${r.detail}` };
+    }));
+    const rows = results.map((x) => x.row);
+    const warnings = results.flatMap((x) => (x.warning === null ? [] : [x.warning]));
+    return { rows, warnings };
+}
 /* ------------------------------------------------------------------ *
  * Empty-output policy (#2494 / #2605 / #2794)
  * ------------------------------------------------------------------ */
@@ -940,6 +964,11 @@ async function runOpenAiCompatible(plan, promptText, deps) {
     let model = plan.model;
     if (!model && plan.modelsUrl) {
         const listed = await deps.httpJson(plan.modelsUrl, { method: 'GET', timeoutMs: 2_000 });
+        // A redirect is a lane failure, not "discovery found nothing" (#5433): the host answered with
+        // somewhere else to go, so the configured URL is wrong and the completions request would be too.
+        if (listed.status >= 300 && listed.status < 400 && listed.error) {
+            return { review: '', rawBody: listed.error, model: recordedModel(plan.fallbackModel, exports.MODEL_SOURCE.REQUESTED) };
+        }
         if (listed.ok) {
             try {
                 const parsed = JSON.parse(listed.body);

package/gsd-core/bin/lib/reviewer-step-dispatch.cjs

@@ -29,8 +29,9 @@
  *
  * The bounded source-review prompt built here is METADATA ONLY — repository root, canonical
  * file paths, review depth, base SHA, and four fixed prohibitions. It never embeds file
- * contents. If the assembled prompt exceeds a lane's resolved budget, that lane's dispatch
- * hard-fails before `invoke` runs for it — no silent truncation of the file list.
+ * contents. If the assembled prompt exceeds a lane's resolved prompt cap (an explicit cap or the
+ * default derived from its context window, #4559), that lane's dispatch hard-fails with reason
+ * `prompt_exceeds_context` before `invoke` runs for it — no silent truncation of the file list.
  */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -125,9 +126,8 @@ function validatePaths(repoRoot, paths) {
     }
     return { ok: true };
 }
-// `resolveLaneBudget` (review-lane-invocation.cjs) resolves the number; `null` and a resolved
-// `0` both mean unbounded (#2797) — the caller's overflow check must test both `!== null` and
-// `!== 0`. See the call site below.
+// `resolveLaneCap` (review-lane-invocation.cjs) resolves the cap; `null` and a resolved `0` both
+// mean unbounded (#2797), and `checkPromptAgainstCap` owns that test. See the call site below.
 /**
  * One-line depth definition for an external reviewer lane, condensed from `<depth_levels>` in
  * `agents/gsd-code-reviewer.md` (#4209 review: a bare `quick`/`standard`/`deep` label means
@@ -296,13 +296,15 @@ async function dispatchReviewerLanes(input, deps) {
             anyFailed = true;
             continue;
         }
-        const budget = (0, review_lane_invocation_cjs_1.resolveLaneBudget)(lane, configGet);
-        if (budget !== null && budget !== 0 && estimatedTokens > budget) {
+        // #4559: refuse-not-trim, through the same check `review-lane invoke` uses.
+        const refused = (0, review_lane_invocation_cjs_1.refuseIfOverCap)({ lane, estimatedTokens, configGet });
+        if (refused) {
             results.push({
                 slug,
                 ok: false,
-                reason: 'budget_exceeded',
-                detail: `estimated ${estimatedTokens} tokens exceeds resolved budget ${budget} for lane '${slug}'`,
+                reason: refused.reason,
+                detail: refused.detail,
+                refusal: refused.refusal,
             });
             anyFailed = true;
             continue;