@oss-scout/mcp 0.10.0 → 0.10.2

package/dist/mcp-server.bundle.cjs

@@ -3100,15 +3100,16 @@ var require_data = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/utils.js
+// ../../node_modules/.pnpm/fast-uri@4.1.2/node_modules/fast-uri/lib/utils.js
 var require_utils = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/utils.js"(exports2, module2) {
+  "../../node_modules/.pnpm/fast-uri@4.1.2/node_modules/fast-uri/lib/utils.js"(exports2, module2) {
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
     var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
     var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
     var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
+    var isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/?]$/iu);
     function stringArrayToHexStripped(input) {
       let acc = "";
       let code = 0;
@@ -3251,7 +3252,7 @@ var require_utils = __commonJS({
               continue;
             }
           } else if (input[0] === "/") {
-            if (input[1] === "." || input[1] === "/") {
+            if (input[1] === ".") {
               output.push("/");
               break;
             }
@@ -3333,10 +3334,30 @@ var require_utils = __commonJS({
       }
       return output;
     }
+    var BYTE_HEX = new Array(256);
+    {
+      const HEX_DIGITS = "0123456789ABCDEF";
+      for (let i = 0; i < 256; i++) {
+        BYTE_HEX[i] = "%" + HEX_DIGITS[i >> 4] + HEX_DIGITS[i & 15];
+      }
+    }
+    function isEscapeSafe(cp) {
+      return cp >= 48 && cp <= 57 || cp >= 65 && cp <= 90 || cp >= 97 && cp <= 122 || cp === 42 || cp === 43 || cp === 45 || cp === 46 || cp === 47 || cp === 64 || cp === 95;
+    }
+    function percentEncodeNonAscii(cp) {
+      if (cp < 2048) {
+        return BYTE_HEX[192 | cp >> 6] + BYTE_HEX[128 | cp & 63];
+      }
+      if (cp < 65536) {
+        return BYTE_HEX[224 | cp >> 12] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+      }
+      return BYTE_HEX[240 | cp >> 18] + BYTE_HEX[128 | cp >> 12 & 63] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+    }
     function normalizePathEncoding(input) {
       let output = "";
       for (let i = 0; i < input.length; i++) {
-        if (input[i] === "%" && i + 2 < input.length) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
           const hex3 = input.slice(i + 1, i + 3);
           if (isHexPair(hex3)) {
             const normalizedHex = hex3.toUpperCase();
@@ -3350,10 +3371,66 @@ var require_utils = __commonJS({
             continue;
           }
         }
-        if (isPathCharacter(input[i])) {
-          output += input[i];
+        if (isPathCharacter(ch)) {
+          output += ch;
         } else {
-          output += escape(input[i]);
+          const code = input.charCodeAt(i);
+          if (code < 128) {
+            output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i + 1 < input.length) {
+            const low = input.charCodeAt(i + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        }
+      }
+      return output;
+    }
+    function normalizeQueryFragmentEncoding(input) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
+          const hex3 = input.slice(i + 1, i + 3);
+          if (isHexPair(hex3)) {
+            const normalizedHex = hex3.toUpperCase();
+            const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+            if (isUnreserved(decoded)) {
+              output += decoded;
+            } else {
+              output += "%" + normalizedHex;
+            }
+            i += 2;
+            continue;
+          }
+        }
+        if (isQueryFragmentCharacter(ch)) {
+          output += ch;
+        } else {
+          const code = input.charCodeAt(i);
+          if (code < 128) {
+            output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i + 1 < input.length) {
+            const low = input.charCodeAt(i + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
         }
       }
       return output;
@@ -3361,7 +3438,8 @@ var require_utils = __commonJS({
     function escapePreservingEscapes(input) {
       let output = "";
       for (let i = 0; i < input.length; i++) {
-        if (input[i] === "%" && i + 2 < input.length) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
           const hex3 = input.slice(i + 1, i + 3);
           if (isHexPair(hex3)) {
             output += "%" + hex3.toUpperCase();
@@ -3369,7 +3447,22 @@ var require_utils = __commonJS({
             continue;
           }
         }
-        output += escape(input[i]);
+        const code = input.charCodeAt(i);
+        if (code < 128) {
+          output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+        } else if (code < 55296 || code > 57343) {
+          output += percentEncodeNonAscii(code);
+        } else if (code <= 56319 && i + 1 < input.length) {
+          const low = input.charCodeAt(i + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+            i++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
       }
       return output;
     }
@@ -3403,6 +3496,7 @@ var require_utils = __commonJS({
       reescapeHostDelimiters,
       normalizePercentEncoding,
       normalizePathEncoding,
+      normalizeQueryFragmentEncoding,
       escapePreservingEscapes,
       removeDotSegments,
       isIPv4,
@@ -3413,9 +3507,9 @@ var require_utils = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/schemes.js
+// ../../node_modules/.pnpm/fast-uri@4.1.2/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/schemes.js"(exports2, module2) {
+  "../../node_modules/.pnpm/fast-uri@4.1.2/node_modules/fast-uri/lib/schemes.js"(exports2, module2) {
     "use strict";
     var { isUUID } = require_utils();
     var URN_REG = /([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu;
@@ -3623,11 +3717,11 @@ var require_schemes = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/index.js
+// ../../node_modules/.pnpm/fast-uri@4.1.2/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/index.js"(exports2, module2) {
+  "../../node_modules/.pnpm/fast-uri@4.1.2/node_modules/fast-uri/index.js"(exports2, module2) {
     "use strict";
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
+    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, normalizeQueryFragmentEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
     function normalize(uri, options) {
       if (typeof uri === "string") {
@@ -3641,7 +3735,12 @@ var require_fast_uri = __commonJS({
     }
     function resolve(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-      const resolved = resolveComponent(parse4(baseURI, schemelessOptions), parse4(relativeURI, schemelessOptions), schemelessOptions, true);
+      const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
+      const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
+      if (baseMalformed || relativeMalformed) {
+        throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed.");
+      }
+      const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
@@ -3766,6 +3865,8 @@ var require_fast_uri = __commonJS({
       return uriTokens.join("");
     }
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
+    var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
+    var AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/;
     function getParseError(parsed, matches) {
       if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
         return 'URI path must start with "/" when authority is present.';
@@ -3795,9 +3896,28 @@ var require_fast_uri = __commonJS({
           uri = "//" + uri;
         }
       }
+      const authorityMatch = uri.match(AUTHORITY_PREFIX);
+      if (authorityMatch !== null && authorityMatch[1].indexOf("\\") !== -1) {
+        parsed.error = "URI authority must not contain a literal backslash.";
+        malformedAuthorityOrPort = true;
+      }
+      const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION);
+      if (introducerMatch !== null) {
+        const region = introducerMatch[1];
+        const normalizedRegion = region.replace(/[\t\n\r]/g, "");
+        if (normalizedRegion.length >= 2) {
+          if (normalizedRegion.slice(0, 2) !== "//") {
+            parsed.error = parsed.error || "URI authority must not contain a literal backslash.";
+            malformedAuthorityOrPort = true;
+          } else if (region.length !== normalizedRegion.length) {
+            parsed.error = parsed.error || "URI authority introducer must not contain whitespace.";
+            malformedAuthorityOrPort = true;
+          }
+        }
+      }
       const matches = uri.match(URI_PARSE);
       if (matches) {
-        parsed.scheme = matches[1];
+        parsed.scheme = matches[1] === void 0 ? void 0 : matches[1].toLowerCase();
         parsed.userinfo = matches[3];
         parsed.host = matches[4];
         parsed.port = parseInt(matches[5], 10);
@@ -3838,7 +3958,7 @@ var require_fast_uri = __commonJS({
         if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
           if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
             try {
-              parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
+              parsed.host = new URL("http://" + parsed.host).hostname;
             } catch (e) {
               parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
             }
@@ -3856,12 +3976,11 @@ var require_fast_uri = __commonJS({
           if (parsed.path) {
             parsed.path = normalizePathEncoding(parsed.path);
           }
+          if (parsed.query) {
+            parsed.query = normalizeQueryFragmentEncoding(parsed.query);
+          }
           if (parsed.fragment) {
-            try {
-              parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
-            } catch {
-              parsed.error = parsed.error || "URI malformed";
-            }
+            parsed.fragment = normalizeQueryFragmentEncoding(parsed.fragment);
           }
         }
         if (schemeHandler && schemeHandler.parse) {
@@ -7356,11 +7475,11 @@ var require_light = __commonJS({
           return this._onFailure(error48, eventInfo, clearGlobalState, run, free);
         }
         async _onFailure(error48, eventInfo, clearGlobalState, run, free) {
-          var retry, retryAfter;
+          var retry2, retryAfter;
           if (clearGlobalState()) {
-            retry = await this.Events.trigger("failed", error48, eventInfo);
-            if (retry != null) {
-              retryAfter = ~~retry;
+            retry2 = await this.Events.trigger("failed", error48, eventInfo);
+            if (retry2 != null) {
+              retryAfter = ~~retry2;
               this.Events.trigger("retry", `Retrying ${this.options.id} after ${retryAfter} ms`, eventInfo);
               this.retryCount++;
               return run(retryAfter);
@@ -7875,7 +7994,7 @@ var require_light = __commonJS({
       var Batcher_1 = Batcher;
       var require$$4$1 = () => console.log("You must import the full version of Bottleneck in order to use this feature.");
       var require$$8 = getCjsExportFromNamespace(version$2);
-      var Bottleneck, DEFAULT_PRIORITY$1, Events$4, Job$1, LocalDatastore$1, NUM_PRIORITIES$1, Queues$1, RedisDatastore$1, States$1, Sync$1, parser$5, splice = [].splice;
+      var Bottleneck2, DEFAULT_PRIORITY$1, Events$4, Job$1, LocalDatastore$1, NUM_PRIORITIES$1, Queues$1, RedisDatastore$1, States$1, Sync$1, parser$5, splice = [].splice;
       NUM_PRIORITIES$1 = 10;
       DEFAULT_PRIORITY$1 = 5;
       parser$5 = parser;
@@ -7886,8 +8005,8 @@ var require_light = __commonJS({
       Events$4 = Events_1;
       States$1 = States_1;
       Sync$1 = Sync_1;
-      Bottleneck = (function() {
-        class Bottleneck2 {
+      Bottleneck2 = (function() {
+        class Bottleneck3 {
           constructor(options = {}, ...invalid) {
             var storeInstanceOptions, storeOptions;
             this._addToQueue = this._addToQueue.bind(this);
@@ -7909,7 +8028,7 @@ var require_light = __commonJS({
                 storeInstanceOptions = parser$5.load(options, this.localStoreDefaults, {});
                 return new LocalDatastore$1(this, storeOptions, storeInstanceOptions);
               } else {
-                throw new Bottleneck2.prototype.BottleneckError(`Invalid datastore type: ${this.datastore}`);
+                throw new Bottleneck3.prototype.BottleneckError(`Invalid datastore type: ${this.datastore}`);
               }
             }).call(this);
             this._queues.on("leftzero", () => {
@@ -7923,7 +8042,7 @@ var require_light = __commonJS({
           }
           _validateOptions(options, invalid) {
             if (!(options != null && typeof options === "object" && invalid.length === 0)) {
-              throw new Bottleneck2.prototype.BottleneckError("Bottleneck v2 takes a single object argument. Refer to https://github.com/SGrondin/bottleneck#upgrading-to-v2 if you're upgrading from Bottleneck v1.");
+              throw new Bottleneck3.prototype.BottleneckError("Bottleneck v2 takes a single object argument. Refer to https://github.com/SGrondin/bottleneck#upgrading-to-v2 if you're upgrading from Bottleneck v1.");
             }
           }
           ready() {
@@ -8120,10 +8239,10 @@ var require_light = __commonJS({
               return waitForExecuting(1);
             });
             this._receive = function(job) {
-              return job._reject(new Bottleneck2.prototype.BottleneckError(options.enqueueErrorMessage));
+              return job._reject(new Bottleneck3.prototype.BottleneckError(options.enqueueErrorMessage));
             };
             this.stop = () => {
-              return this.Promise.reject(new Bottleneck2.prototype.BottleneckError("stop() has already been called"));
+              return this.Promise.reject(new Bottleneck3.prototype.BottleneckError("stop() has already been called"));
             };
             return done;
           }
@@ -8142,11 +8261,11 @@ var require_light = __commonJS({
               job.doDrop();
               return true;
             } else if (reachedHWM) {
-              shifted = strategy === Bottleneck2.prototype.strategy.LEAK ? this._queues.shiftLastFrom(options.priority) : strategy === Bottleneck2.prototype.strategy.OVERFLOW_PRIORITY ? this._queues.shiftLastFrom(options.priority + 1) : strategy === Bottleneck2.prototype.strategy.OVERFLOW ? job : void 0;
+              shifted = strategy === Bottleneck3.prototype.strategy.LEAK ? this._queues.shiftLastFrom(options.priority) : strategy === Bottleneck3.prototype.strategy.OVERFLOW_PRIORITY ? this._queues.shiftLastFrom(options.priority + 1) : strategy === Bottleneck3.prototype.strategy.OVERFLOW ? job : void 0;
               if (shifted != null) {
                 shifted.doDrop();
               }
-              if (shifted == null || strategy === Bottleneck2.prototype.strategy.OVERFLOW) {
+              if (shifted == null || strategy === Bottleneck3.prototype.strategy.OVERFLOW) {
                 if (shifted == null) {
                   job.doDrop();
                 }
@@ -8160,7 +8279,7 @@ var require_light = __commonJS({
           }
           _receive(job) {
             if (this._states.jobStatus(job.options.id) != null) {
-              job._reject(new Bottleneck2.prototype.BottleneckError(`A job with the same id already exists (id=${job.options.id})`));
+              job._reject(new Bottleneck3.prototype.BottleneckError(`A job with the same id already exists (id=${job.options.id})`));
               return false;
             } else {
               job.doReceive();
@@ -8230,31 +8349,31 @@ var require_light = __commonJS({
             return this._store.__incrementReservoir__(incr);
           }
         }
-        Bottleneck2.default = Bottleneck2;
-        Bottleneck2.Events = Events$4;
-        Bottleneck2.version = Bottleneck2.prototype.version = require$$8.version;
-        Bottleneck2.strategy = Bottleneck2.prototype.strategy = {
+        Bottleneck3.default = Bottleneck3;
+        Bottleneck3.Events = Events$4;
+        Bottleneck3.version = Bottleneck3.prototype.version = require$$8.version;
+        Bottleneck3.strategy = Bottleneck3.prototype.strategy = {
           LEAK: 1,
           OVERFLOW: 2,
           OVERFLOW_PRIORITY: 4,
           BLOCK: 3
         };
-        Bottleneck2.BottleneckError = Bottleneck2.prototype.BottleneckError = BottleneckError_1;
-        Bottleneck2.Group = Bottleneck2.prototype.Group = Group_1;
-        Bottleneck2.RedisConnection = Bottleneck2.prototype.RedisConnection = require$$2;
-        Bottleneck2.IORedisConnection = Bottleneck2.prototype.IORedisConnection = require$$3;
-        Bottleneck2.Batcher = Bottleneck2.prototype.Batcher = Batcher_1;
-        Bottleneck2.prototype.jobDefaults = {
+        Bottleneck3.BottleneckError = Bottleneck3.prototype.BottleneckError = BottleneckError_1;
+        Bottleneck3.Group = Bottleneck3.prototype.Group = Group_1;
+        Bottleneck3.RedisConnection = Bottleneck3.prototype.RedisConnection = require$$2;
+        Bottleneck3.IORedisConnection = Bottleneck3.prototype.IORedisConnection = require$$3;
+        Bottleneck3.Batcher = Bottleneck3.prototype.Batcher = Batcher_1;
+        Bottleneck3.prototype.jobDefaults = {
           priority: DEFAULT_PRIORITY$1,
           weight: 1,
           expiration: null,
           id: "<no-id>"
         };
-        Bottleneck2.prototype.storeDefaults = {
+        Bottleneck3.prototype.storeDefaults = {
           maxConcurrent: null,
           minTime: 0,
           highWater: null,
-          strategy: Bottleneck2.prototype.strategy.LEAK,
+          strategy: Bottleneck3.prototype.strategy.LEAK,
           penalty: null,
           reservoir: null,
           reservoirRefreshInterval: null,
@@ -8263,12 +8382,12 @@ var require_light = __commonJS({
           reservoirIncreaseAmount: null,
           reservoirIncreaseMaximum: null
         };
-        Bottleneck2.prototype.localStoreDefaults = {
+        Bottleneck3.prototype.localStoreDefaults = {
           Promise,
           timeout: null,
           heartbeatInterval: 250
         };
-        Bottleneck2.prototype.redisStoreDefaults = {
+        Bottleneck3.prototype.redisStoreDefaults = {
           Promise,
           timeout: null,
           heartbeatInterval: 5e3,
@@ -8279,7 +8398,7 @@ var require_light = __commonJS({
           clearDatastore: false,
           connection: null
         };
-        Bottleneck2.prototype.instanceDefaults = {
+        Bottleneck3.prototype.instanceDefaults = {
           datastore: "local",
           connection: null,
           id: "<no-id>",
@@ -8287,14 +8406,14 @@ var require_light = __commonJS({
           trackDoneStatus: false,
           Promise
         };
-        Bottleneck2.prototype.stopDefaults = {
+        Bottleneck3.prototype.stopDefaults = {
           enqueueErrorMessage: "This limiter has been stopped and cannot accept new jobs.",
           dropWaitingJobs: true,
           dropErrorMessage: "This limiter has been stopped."
         };
-        return Bottleneck2;
+        return Bottleneck3;
       }).call(commonjsGlobal);
-      var Bottleneck_1 = Bottleneck;
+      var Bottleneck_1 = Bottleneck2;
       var lib = Bottleneck_1;
       return lib;
     }));
@@ -35311,30 +35430,30 @@ function routeMatcher(paths) {
 var regex = routeMatcher(triggers_notification_paths_default);
 var triggersNotification = regex.test.bind(regex);
 var groups = {};
-var createGroups = function(Bottleneck, common) {
-  groups.global = new Bottleneck.Group({
+var createGroups = function(Bottleneck2, common) {
+  groups.global = new Bottleneck2.Group({
     id: "octokit-global",
     maxConcurrent: 10,
     ...common
   });
-  groups.auth = new Bottleneck.Group({
+  groups.auth = new Bottleneck2.Group({
     id: "octokit-auth",
     maxConcurrent: 1,
     ...common
   });
-  groups.search = new Bottleneck.Group({
+  groups.search = new Bottleneck2.Group({
     id: "octokit-search",
     maxConcurrent: 1,
     minTime: 2e3,
     ...common
   });
-  groups.write = new Bottleneck.Group({
+  groups.write = new Bottleneck2.Group({
     id: "octokit-write",
     maxConcurrent: 1,
     minTime: 1e3,
     ...common
   });
-  groups.notifications = new Bottleneck.Group({
+  groups.notifications = new Bottleneck2.Group({
     id: "octokit-notifications",
     maxConcurrent: 1,
     minTime: 3e3,
@@ -35344,7 +35463,7 @@ var createGroups = function(Bottleneck, common) {
 function throttling(octokit, octokitOptions) {
   const {
     enabled = true,
-    Bottleneck = import_light.default,
+    Bottleneck: Bottleneck2 = import_light.default,
     id = "no-id",
     timeout = 1e3 * 60 * 2,
     // Redis TTL: 2 minutes
@@ -35358,7 +35477,7 @@ function throttling(octokit, octokitOptions) {
     common.connection = connection;
   }
   if (groups.global == null) {
-    createGroups(Bottleneck, common);
+    createGroups(Bottleneck2, common);
   }
   const state = Object.assign(
     {
@@ -35366,7 +35485,7 @@ function throttling(octokit, octokitOptions) {
       triggersNotification,
       fallbackSecondaryRateRetryAfter: 60,
       retryAfterBaseValue: 1e3,
-      retryLimiter: new Bottleneck(),
+      retryLimiter: new Bottleneck2(),
       id,
       ...groups
     },
@@ -35386,7 +35505,7 @@ function throttling(octokit, octokitOptions) {
     `);
   }
   const events = {};
-  const emitter = new Bottleneck.Events(events);
+  const emitter = new Bottleneck2.Events(events);
   events.on("secondary-limit", state.onSecondaryRateLimit);
   events.on("rate-limit", state.onRateLimit);
   events.on(
@@ -35449,6 +35568,80 @@ function throttling(octokit, octokitOptions) {
 throttling.VERSION = VERSION9;
 throttling.triggersNotification = triggersNotification;
 
+// ../../node_modules/.pnpm/@octokit+plugin-retry@8.1.0_@octokit+core@7.0.6/node_modules/@octokit/plugin-retry/dist-bundle/index.js
+var import_light2 = __toESM(require_light(), 1);
+var VERSION10 = "0.0.0-development";
+function isRequestError(error48) {
+  return error48.request !== void 0;
+}
+async function errorRequest(state, octokit, error48, options) {
+  if (!isRequestError(error48) || !error48?.request.request) {
+    throw error48;
+  }
+  if (error48.status >= 400 && !state.doNotRetry.includes(error48.status)) {
+    const retries = options.request.retries != null ? options.request.retries : state.retries;
+    const retryAfter = Math.pow((options.request.retryCount || 0) + 1, 2);
+    throw octokit.retry.retryRequest(error48, retries, retryAfter);
+  }
+  throw error48;
+}
+async function wrapRequest2(state, octokit, request2, options) {
+  const limiter = new import_light2.default();
+  limiter.on("failed", function(error48, info2) {
+    const maxRetries = ~~error48.request.request?.retries;
+    const after = ~~error48.request.request?.retryAfter;
+    options.request.retryCount = info2.retryCount + 1;
+    if (maxRetries > info2.retryCount) {
+      return after * state.retryAfterBaseValue;
+    }
+  });
+  return limiter.schedule(
+    requestWithGraphqlErrorHandling.bind(null, state, octokit, request2),
+    options
+  );
+}
+async function requestWithGraphqlErrorHandling(state, octokit, request2, options) {
+  const response = await request2(options);
+  if (response.data && response.data.errors && response.data.errors.length > 0 && /Something went wrong while executing your query/.test(
+    response.data.errors[0].message
+  )) {
+    const error48 = new RequestError(response.data.errors[0].message, 500, {
+      request: options,
+      response
+    });
+    return errorRequest(state, octokit, error48, options);
+  }
+  return response;
+}
+function retry(octokit, octokitOptions) {
+  const state = Object.assign(
+    {
+      enabled: true,
+      retryAfterBaseValue: 1e3,
+      doNotRetry: [400, 401, 403, 404, 410, 422, 451],
+      retries: 3
+    },
+    octokitOptions.retry
+  );
+  const retryPlugin = {
+    retry: {
+      retryRequest: (error48, retries, retryAfter) => {
+        error48.request.request = Object.assign({}, error48.request.request, {
+          retries,
+          retryAfter
+        });
+        return error48;
+      }
+    }
+  };
+  if (state.enabled) {
+    octokit.hook.error("request", errorRequest.bind(null, state, retryPlugin));
+    octokit.hook.wrap("request", wrapRequest2.bind(null, state, retryPlugin));
+  }
+  return retryPlugin;
+}
+retry.VERSION = VERSION10;
+
 // ../core/dist/core/logger.js
 var LEVEL_RANK = {
   silent: 0,
@@ -35484,7 +35677,7 @@ function warn(module2, message, ...args) {
 
 // ../core/dist/core/github.js
 var MODULE = "github";
-var ThrottledOctokit = Octokit2.plugin(throttling);
+var ThrottledOctokit = Octokit2.plugin(throttling, retry);
 var _octokit = null;
 var _currentToken = null;
 function formatResetTime(date5) {
@@ -35552,8 +35745,10 @@ var OssScoutError = class extends Error {
   }
 };
 var ValidationError = class extends OssScoutError {
-  constructor(message) {
+  strategiesUsed;
+  constructor(message, strategiesUsed) {
     super(message, "VALIDATION_ERROR");
+    this.strategiesUsed = strategiesUsed;
     this.name = "ValidationError";
   }
 };
@@ -35567,6 +35762,12 @@ function getHttpStatusCode(error48) {
   }
   return void 0;
 }
+function isAuthError(error48) {
+  const status = getHttpStatusCode(error48);
+  if (status === 401)
+    return true;
+  return status === 403 && !isRateLimitError(error48);
+}
 function isRateLimitError(error48) {
   const status = getHttpStatusCode(error48);
   if (status === 429)
@@ -35702,6 +35903,13 @@ var SearchBudgetTracker = class {
   totalCalls = 0;
   /** Calls made since the last known quota reset (external accounting). */
   callsSinceReset = 0;
+  /**
+   * Slots handed out by waitForBudget() but not yet recorded. Without this,
+   * concurrent callers (vetting runs 3 tasks) could all pass waitForBudget()
+   * on an effective budget of 1 before any recordCall() landed, overshooting
+   * the external quota into real 429s (#287).
+   */
+  reservedCalls = 0;
   /**
    * Initialize with pre-flight rate limit data from GitHub.
    */
@@ -35711,12 +35919,17 @@ var SearchBudgetTracker = class {
     this.callTimestamps = [];
     this.totalCalls = 0;
     this.callsSinceReset = 0;
+    this.reservedCalls = 0;
     debug(MODULE3, `Initialized: ${remaining} remaining, resets at ${new Date(this.resetAt).toLocaleTimeString()}`);
   }
   /**
-   * Record that a Search API call was just made.
+   * Record that a Search API call was just made. Releases the reservation
+   * taken by the preceding waitForBudget() (every call site pairs them, with
+   * recordCall in a finally).
    */
   recordCall() {
+    if (this.reservedCalls > 0)
+      this.reservedCalls--;
     this.callTimestamps.push(Date.now());
     this.totalCalls++;
     this.callsSinceReset++;
@@ -35763,8 +35976,8 @@ var SearchBudgetTracker = class {
    */
   getEffectiveBudget() {
     this.refreshExternalBudget();
-    const localBudget = EFFECTIVE_BUDGET - this.callTimestamps.length;
-    const externalBudget = this.knownRemaining - this.callsSinceReset;
+    const localBudget = EFFECTIVE_BUDGET - this.callTimestamps.length - this.reservedCalls;
+    const externalBudget = this.knownRemaining - this.callsSinceReset - this.reservedCalls;
     return Math.max(0, Math.min(localBudget, externalBudget));
   }
   /**
@@ -35775,7 +35988,9 @@ var SearchBudgetTracker = class {
     return this.getEffectiveBudget() >= n;
   }
   /**
-   * Wait if necessary to stay within the Search API rate limit.
+   * Wait if necessary to stay within the Search API rate limit, then reserve
+   * one call slot. The reservation is released by the paired recordCall(), so
+   * concurrent callers cannot all claim the same last remaining slot (#287).
    * If the sliding window is at capacity, sleeps until the oldest
    * call ages out of the window.
    */
@@ -35783,16 +35998,22 @@ var SearchBudgetTracker = class {
     while (true) {
       this.pruneOldTimestamps();
       if (this.getEffectiveBudget() > 0) {
+        this.reservedCalls++;
         return;
       }
       const oldestInWindow = this.callTimestamps[0];
       if (!oldestInWindow) {
+        if (this.reservedCalls > 0) {
+          await sleep(250);
+          continue;
+        }
         const untilReset = this.resetAt - Date.now();
         if (this.resetAt > 0 && untilReset > 0) {
           debug(MODULE3, `External quota exhausted, waiting ${untilReset}ms for reset`);
           await sleep(untilReset + 100);
           continue;
         }
+        this.reservedCalls++;
         return;
       }
       const waitUntil = oldestInWindow + SEARCH_WINDOW_MS;
@@ -36018,7 +36239,11 @@ var ScoutPreferencesSchema = external_exports3.looseObject({
   // Soft boost for candidates whose issue labels match one of these types,
   // case-insensitive (e.g. "bug", "good first issue") (#168).
   boostIssueTypes: external_exports3.array(external_exports3.string()).default([]),
-  broadPhaseDelayMs: external_exports3.number().min(0).max(3e5).default(9e4),
+  // Broad-phase cooldown. Now that the broad phase runs on GraphQL (points
+  // bucket, 5000/hr) rather than the REST Search bucket (30/min), the long
+  // secondary-rate-limit cooldown is no longer needed; defaults to 0 (no extra
+  // pause). Retained as a knob for hosts that still want to throttle the phase.
+  broadPhaseDelayMs: external_exports3.number().min(0).max(3e5).default(0),
   /**
    * Skip the expensive broad phase once this many candidates were found by
    * the cheaper phases. Clamped at runtime to maxResults - 1 so it stays
@@ -36081,7 +36306,20 @@ var ScoutStateSchema = external_exports3.looseObject({
   preferencesUpdatedAt: external_exports3.string().optional(),
   lastSearchAt: external_exports3.string().optional(),
   lastRunAt: external_exports3.string().default(() => (/* @__PURE__ */ new Date()).toISOString()),
-  gistId: external_exports3.string().optional()
+  gistId: external_exports3.string().optional(),
+  /**
+   * Diversity cursor for Phase 2's broad search (#249 follow-up). Without
+   * this, every run started the language-variant fan-out at index 0, so the
+   * broad phase only ever queried the first configured language before
+   * moving on. Not a rate-limit mechanism — purely rotates which language
+   * variant leads each run. `languageOffset` advances (no modulo; the
+   * consumer wraps at use time so a shrinking language list never needs
+   * clamping here).
+   */
+  searchRotation: external_exports3.looseObject({
+    languageOffset: external_exports3.number().int().min(0).default(0),
+    lastRotatedAt: external_exports3.string().optional()
+  }).default(() => ({ languageOffset: 0 }))
 });
 function parseScoutState(raw) {
   return ScoutStateSchema.parse(raw);
@@ -36734,9 +36972,12 @@ async function checkNoExistingPR(octokit, owner, repo, issueNumber) {
   }
 }
 var MERGED_PR_CACHE_TTL_MS = 15 * 60 * 1e3;
+function mergedPRsCacheKey(owner, repo) {
+  return versionedCacheKey(`merged-prs:${owner}/${repo}`);
+}
 async function checkUserMergedPRsInRepo(octokit, owner, repo, tracker = getSearchBudgetTracker()) {
   const cache = getHttpCache();
-  const cacheKey = versionedCacheKey(`merged-prs:${owner}/${repo}`);
+  const cacheKey = mergedPRsCacheKey(owner, repo);
   return withInflightDedup(cache, cacheKey, async () => {
     const cached2 = cache.getIfFresh(cacheKey, MERGED_PR_CACHE_TTL_MS);
     if (cached2 != null && typeof cached2 === "number") {
@@ -36781,6 +37022,17 @@ async function checkNotClaimed(octokit, owner, repo, issueNumber, commentCount)
       });
       recentComments.push(...response.data);
     }
+    const lastFetched = recentComments.length % PER_PAGE;
+    if (recentComments.length > 0 && lastFetched === 0) {
+      const response = await octokit.issues.listComments({
+        owner,
+        repo,
+        issue_number: issueNumber,
+        per_page: PER_PAGE,
+        page: lastPage + 1
+      });
+      recentComments.push(...response.data);
+    }
     for (const comment of recentComments) {
       if (commentClaimsIssue(comment.body || "")) {
         return { passed: false };
@@ -36813,7 +37065,7 @@ function analyzeRequirements(body) {
 var MODULE6 = "probe-repo-file";
 async function probeRepoFile(octokit, owner, repo, path5) {
   try {
-    const { data } = await octokit.repos.getContent({ owner, repo, path: path5 });
+    const data = await cachedRequest(getHttpCache(), `/repos/${owner}/${repo}/contents/${path5}`, (headers) => octokit.repos.getContent({ owner, repo, path: path5, headers }));
     if (data && typeof data === "object" && "content" in data && typeof data.content === "string") {
       return {
         text: Buffer.from(data.content, "base64").toString("utf-8"),
@@ -36833,6 +37085,30 @@ async function probeRepoFile(octokit, owner, repo, path5) {
 
 // ../core/dist/core/repo-health.js
 var MODULE7 = "repo-health";
+var MERGE_WINDOW_DAYS = 90;
+async function fetchRepoMergeStats(octokit, owner, repo, tracker) {
+  const since = new Date(Date.now() - MERGE_WINDOW_DAYS * 24 * 60 * 60 * 1e3).toISOString().slice(0, 10);
+  const count = async (qualifiers) => {
+    await tracker.waitForBudget();
+    try {
+      const { data } = await octokit.search.issuesAndPullRequests({
+        q: `repo:${owner}/${repo} ${qualifiers} closed:>=${since}`,
+        per_page: 1
+        // only total_count is needed
+      });
+      return data.total_count;
+    } finally {
+      tracker.recordCall();
+    }
+  };
+  const merged = await count("is:pr is:merged");
+  const closedUnmerged = await count("is:pr is:unmerged is:closed");
+  const denom = merged + closedUnmerged;
+  return {
+    recentMergedPRCount: merged,
+    recentMergeRate: denom > 0 ? merged / denom : null
+  };
+}
 var guidelinesCache = /* @__PURE__ */ new Map();
 var CACHE_TTL_MS = 60 * 60 * 1e3;
 var HEALTH_CACHE_TTL_MS = 4 * 60 * 60 * 1e3;
@@ -36852,22 +37128,25 @@ function pruneCache() {
     }
   }
 }
-async function checkProjectHealth(octokit, owner, repo) {
+async function checkProjectHealth(octokit, owner, repo, tracker = getSearchBudgetTracker()) {
   const cache = getHttpCache();
-  const healthCacheKey = `health:${owner}/${repo}`;
+  const healthCacheKey = versionedCacheKey(`health:${owner}/${repo}`);
   try {
     return await cachedTimeBased(cache, healthCacheKey, HEALTH_CACHE_TTL_MS, async () => {
       const url2 = `/repos/${owner}/${repo}`;
       const repoData = await cachedRequest(cache, url2, (headers) => octokit.repos.get({ owner, repo, headers }));
-      const { data: commits } = await octokit.repos.listCommits({
+      const commitsUrl = `/repos/${owner}/${repo}/commits?per_page=1`;
+      const commits = await cachedRequest(cache, commitsUrl, (headers) => octokit.repos.listCommits({
         owner,
         repo,
-        per_page: 1
-      });
+        per_page: 1,
+        headers
+      }));
       const lastCommit = commits[0];
       const lastCommitAt = lastCommit?.commit?.author?.date || repoData.pushed_at;
       const daysSinceLastCommit = daysBetween(new Date(lastCommitAt));
       const ciStatus = "unknown";
+      const mergeStats = await fetchRepoMergeStats(octokit, owner, repo, tracker);
       return {
         repo: `${owner}/${repo}`,
         lastCommitAt,
@@ -36879,7 +37158,9 @@ async function checkProjectHealth(octokit, owner, repo) {
         isActive: daysSinceLastCommit < 30,
         stargazersCount: repoData.stargazers_count,
         forksCount: repoData.forks_count,
-        language: repoData.language
+        language: repoData.language,
+        recentMergedPRCount: mergeStats.recentMergedPRCount,
+        recentMergeRate: mergeStats.recentMergeRate
       };
     });
   } catch (error48) {
@@ -37184,8 +37465,133 @@ ${selections.join("\n")}
   });
   return result;
 }
+var GH_NAME_PATTERN = /^[A-Za-z0-9_.-]+$/;
+var MERGED_PR_BATCH_SIZE = 15;
+async function prefetchMergedPRCounts(octokit, username, repos) {
+  if (repos.length === 0)
+    return;
+  if (!GH_NAME_PATTERN.test(username)) {
+    warn(MODULE8, `Skipping merged-PR prefetch: username failed validation (falling back to REST)`);
+    return;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const valid = [];
+  for (const r of repos) {
+    const full = `${r.owner}/${r.repo}`;
+    if (seen.has(full))
+      continue;
+    seen.add(full);
+    if (!GH_NAME_PATTERN.test(r.owner) || !GH_NAME_PATTERN.test(r.repo)) {
+      warn(MODULE8, `Skipping merged-PR prefetch for "${full}": failed validation (falling back to REST)`);
+      continue;
+    }
+    valid.push(r);
+  }
+  if (valid.length === 0)
+    return;
+  const cache = getHttpCache();
+  const batches = [];
+  for (let i = 0; i < valid.length; i += MERGED_PR_BATCH_SIZE) {
+    batches.push(fetchMergedPRBatch(octokit, username, valid.slice(i, i + MERGED_PR_BATCH_SIZE), cache));
+  }
+  await Promise.all(batches);
+}
+async function fetchMergedPRBatch(octokit, username, repos, cache) {
+  const varDefs = [];
+  const selections = ["viewer { login }"];
+  const variables = {};
+  repos.forEach((r, i) => {
+    varDefs.push(`$q${i}: String!`);
+    variables[`q${i}`] = `is:pr is:merged author:${username} repo:${r.owner}/${r.repo}`;
+    selections.push(`r${i}: search(query: $q${i}, type: ISSUE, first: 1) { issueCount }`);
+  });
+  const query = `query batchMergedPRCounts(${varDefs.join(", ")}) {
+${selections.join("\n")}
+}`;
+  let data;
+  try {
+    data = await octokit.graphql(query, variables);
+  } catch (err) {
+    rethrowIfFatal(err);
+    const partial2 = err.data;
+    if (partial2) {
+      data = partial2;
+    } else {
+      warn(MODULE8, `Merged-PR prefetch batch failed, falling back to REST: ${errorMessage(err)}`);
+      return;
+    }
+  }
+  const viewerLogin = data?.viewer?.login;
+  if (!viewerLogin || viewerLogin.toLowerCase() !== username.toLowerCase()) {
+    if (viewerLogin) {
+      warn(MODULE8, `Merged-PR prefetch identity mismatch (configured username != authenticated login); leaving cache cold so REST @me answers`);
+    }
+    return;
+  }
+  repos.forEach((r, i) => {
+    const alias = data?.[`r${i}`];
+    const count = alias && "issueCount" in alias ? alias.issueCount : void 0;
+    if (typeof count !== "number")
+      return;
+    cache.set(mergedPRsCacheKey(r.owner, r.repo), "", count);
+  });
+}
+async function graphqlSearchIssues(octokit, query, first) {
+  const clampedFirst = Math.min(Math.max(Math.trunc(first) || 1, 1), 100);
+  const document = `query searchIssuesBroad($q: String!, $first: Int!) {
+    search(query: $q, type: ISSUE, first: $first) {
+      issueCount
+      nodes {
+        ... on Issue {
+          url
+          title
+          updatedAt
+          labels(first: 20) { nodes { name } }
+          repository { nameWithOwner }
+        }
+      }
+    }
+  }`;
+  let data;
+  try {
+    data = await octokit.graphql(document, {
+      q: query,
+      first: clampedFirst
+    });
+  } catch (err) {
+    rethrowIfFatal(err);
+    const partial2 = err.data;
+    if (partial2) {
+      data = partial2;
+    } else {
+      warn(MODULE8, `GraphQL broad search failed, falling back to REST: ${errorMessage(err)}`);
+      return null;
+    }
+  }
+  const search = data?.search;
+  if (!search)
+    return null;
+  const items = [];
+  for (const node of search.nodes ?? []) {
+    if (!node?.url)
+      continue;
+    const nameWithOwner = node.repository?.nameWithOwner;
+    if (!nameWithOwner)
+      continue;
+    items.push({
+      html_url: node.url,
+      // Same construction as the REST search adapter (search-phases.ts).
+      repository_url: `https://api.github.com/repos/${nameWithOwner}`,
+      updated_at: node.updatedAt ?? "",
+      title: node.title,
+      labels: node.labels?.nodes ?? []
+    });
+  }
+  return { total_count: search.issueCount ?? 0, items };
+}
 
 // ../core/dist/core/slm-triage.js
+var MODULE9 = "slm-triage";
 var DEFAULT_OLLAMA_HOST = "http://127.0.0.1:11434";
 var DEFAULT_TIMEOUT_MS = 15e3;
 var MAX_BODY_CHARS = 2e3;
@@ -37222,10 +37628,48 @@ function buildPrompt(input) {
     `Linked PR exists: ${linkedPRExists}`
   ].join("\n");
 }
+function isAllowedTriageHost(raw) {
+  let url2;
+  try {
+    url2 = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (url2.protocol !== "http:" && url2.protocol !== "https:")
+    return false;
+  const host = url2.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (host === "localhost" || host === "::1")
+    return true;
+  const v4 = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (v4) {
+    const a = Number(v4[1]);
+    const b = Number(v4[2]);
+    if (a === 127 || a === 10)
+      return true;
+    if (a === 192 && b === 168)
+      return true;
+    if (a === 172 && b >= 16 && b <= 31)
+      return true;
+    return false;
+  }
+  if (host.includes(":")) {
+    return host.startsWith("fc") || host.startsWith("fd") || host.startsWith("fe80");
+  }
+  return !host.includes(".") || host.endsWith(".local");
+}
+function assertValidTriageHost(value) {
+  if (value === "" || isAllowedTriageHost(value))
+    return;
+  throw new ValidationError(`slmTriageHost must be an http(s) URL pointing at localhost or a private/LAN address (got "${value}"). Example: http://192.168.1.20:11434`);
+}
 async function triageWithSLM(input, options) {
   if (!options.model)
     return null;
   const host = options.host ?? DEFAULT_OLLAMA_HOST;
+  if (!isAllowedTriageHost(host)) {
+    warn(MODULE9, `slmTriageHost "${host}" is not a local/private address; skipping SLM triage`);
+    return null;
+  }
   const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const fetchFn = options.fetchImpl ?? fetch;
   let response;
@@ -37240,7 +37684,11 @@ async function triageWithSLM(input, options) {
         format: SLM_TRIAGE_SCHEMA,
         options: { temperature: 0.1 }
       }),
-      signal: AbortSignal.timeout(timeoutMs)
+      signal: AbortSignal.timeout(timeoutMs),
+      // No redirect following: an allowed private host could otherwise
+      // 307/308-redirect the issue-text POST body to a public origin (#310).
+      // Ollama never redirects, so this costs nothing.
+      redirect: "error"
     });
   } catch {
     return null;
@@ -37297,15 +37745,23 @@ function isValidTriageShape(value) {
 }
 
 // ../core/dist/core/issue-vetting.js
-var MODULE9 = "issue-vetting";
+var MODULE10 = "issue-vetting";
 var MAX_CONCURRENT_VETTING = 3;
 var VETTING_CACHE_TTL_MS = 15 * 60 * 1e3;
+function repoAcceptsContributionsFromHealth(projectHealth) {
+  if (projectHealth.checkFailed || projectHealth.recentMergedPRCount == null) {
+    return null;
+  }
+  if (projectHealth.recentMergedPRCount > 0)
+    return true;
+  return projectHealth.recentMergeRate == null ? null : false;
+}
 function deriveRecommendation(input) {
   const notes = [];
   const reasonsToApprove = [];
   const reasonsToSkip = [];
   if (!input.noExistingPR)
-    notes.push(input.ownPR ? "Your PR is already in flight for this issue" : "Existing PR found for this issue");
+    notes.push(input.ownPR ? "Your PR is already in flight for this issue" : input.linkedPRMerged ? "A PR for this issue was already merged" : input.linkedPRClosed ? "A PR for this issue was closed without merging" : "Existing PR found for this issue");
   if (!input.notClaimed)
     notes.push("Issue appears to be claimed by someone");
   if (input.existingPRInconclusive) {
@@ -37323,14 +37779,28 @@ function deriveRecommendation(input) {
     notes.push("Issue requirements are unclear");
   if (!input.contributionGuidelinesFound)
     notes.push("No CONTRIBUTING.md found");
-  if (!input.noExistingPR)
-    reasonsToSkip.push(input.ownPR ? "You already have a PR in flight" : "Has existing PR");
+  if (input.repoAcceptsContributions === false)
+    notes.push("Repo has merged no PRs in the last 90 days");
+  else if (input.repoAcceptsContributions === null)
+    notes.push("Could not verify whether the repo merges PRs");
+  if (!input.noExistingPR) {
+    if (input.ownPR)
+      reasonsToSkip.push("You already have a PR in flight");
+    else if (input.linkedPRMerged)
+      reasonsToSkip.push("Linked PR already merged");
+    else if (input.linkedPRClosed)
+      reasonsToSkip.push("Linked PR closed without merge");
+    else
+      reasonsToSkip.push("Has existing PR");
+  }
   if (!input.notClaimed)
     reasonsToSkip.push("Already claimed");
   if (!input.projectIsActive && !input.projectCheckFailed)
     reasonsToSkip.push("Inactive project");
   if (!input.clearRequirements)
     reasonsToSkip.push("Unclear requirements");
+  if (input.repoAcceptsContributions === false)
+    reasonsToSkip.push("Repo has no recent merged PRs");
   if (input.noExistingPR)
     reasonsToApprove.push("No existing PR");
   if (input.notClaimed)
@@ -37356,16 +37826,18 @@ function deriveRecommendation(input) {
   let recommendation;
   if (input.issueClosed) {
     recommendation = "skip";
+  } else if (input.linkedPRMerged || input.linkedPRClosed) {
+    recommendation = "skip";
   } else if (input.ownPR) {
     recommendation = "skip";
-  } else if (input.passedAllChecks) {
+  } else if (input.passedAllChecks && input.repoAcceptsContributions !== false) {
     recommendation = "approve";
   } else if (reasonsToSkip.length > 2) {
     recommendation = "skip";
   } else {
     recommendation = "needs_review";
   }
-  const hasInconclusiveChecks = input.projectCheckFailed || input.existingPRInconclusive || input.claimInconclusive || input.mergedCountInconclusive;
+  const hasInconclusiveChecks = input.projectCheckFailed || input.existingPRInconclusive || input.claimInconclusive || input.mergedCountInconclusive || input.repoAcceptsContributions === null;
   if (recommendation === "approve" && hasInconclusiveChecks) {
     recommendation = "needs_review";
     notes.push("Recommendation downgraded: one or more checks were inconclusive");
@@ -37403,7 +37875,7 @@ var IssueVetter = class {
     const cacheKey = versionedCacheKey(`vet:${issueUrl}${sigKey}`);
     const cached2 = cache.getIfFresh(cacheKey, VETTING_CACHE_TTL_MS);
     if (cached2 && typeof cached2 === "object" && "issue" in cached2 && "viabilityScore" in cached2) {
-      debug(MODULE9, `Vetting cache hit for ${issueUrl}`);
+      debug(MODULE10, `Vetting cache hit for ${issueUrl}`);
       return cached2;
     }
     const parsed = parseGitHubUrl(issueUrl);
@@ -37418,7 +37890,7 @@ var IssueVetter = class {
     const [existingPRCheck, claimCheck, projectHealth, contributionGuidelines, userMergedPRCount] = await Promise.all([
       checkNoExistingPR(this.octokit, owner, repo, number4),
       checkNotClaimed(this.octokit, owner, repo, number4, core.commentCount),
-      checkProjectHealth(this.octokit, owner, repo),
+      checkProjectHealth(this.octokit, owner, repo, this.budgetTracker),
       fetchContributionGuidelines(this.octokit, owner, repo),
       hasMergedPRsInRepo ? Promise.resolve(0) : checkUserMergedPRsInRepo(this.octokit, owner, repo, this.budgetTracker)
     ]);
@@ -37428,8 +37900,11 @@ var IssueVetter = class {
     const username = this.stateReader.getGitHubUsername?.() ?? "";
     const linkedPR = existingPRCheck.linkedPR;
     const ownPR = !noExistingPR && !!linkedPR && linkedPR.state === "open" && !linkedPR.merged && username !== "" && linkedPR.author.toLowerCase() === username.toLowerCase();
+    const linkedPRMerged = !!linkedPR && linkedPR.merged;
+    const linkedPRClosed = !!linkedPR && linkedPR.state === "closed" && !linkedPR.merged;
     const clearRequirements = analyzeRequirements(core.body);
     const projectActive = projectHealth.checkFailed ? true : projectHealth.isActive;
+    const repoAcceptsContributions = repoAcceptsContributionsFromHealth(projectHealth);
     const vettingResult = {
       passedAllChecks: noExistingPR && notClaimed && projectActive && clearRequirements,
       checks: {
@@ -37465,10 +37940,12 @@ var IssueVetter = class {
     }
     const matchesCategory = repoBelongsToCategory(repoFullName, this.stateReader.getProjectCategories());
     const issueClosed = core.state === "closed";
-    const hasInconclusiveChecks = projectHealth.checkFailed || !!existingPRCheck.inconclusive || !!claimCheck.inconclusive || mergedCountInconclusive;
+    const hasInconclusiveChecks = projectHealth.checkFailed || !!existingPRCheck.inconclusive || !!claimCheck.inconclusive || mergedCountInconclusive || repoAcceptsContributions === null;
     const { notes, reasonsToApprove, reasonsToSkip, recommendation } = deriveRecommendation({
       noExistingPR,
       ownPR,
+      linkedPRMerged,
+      linkedPRClosed,
       notClaimed,
       clearRequirements,
       contributionGuidelinesFound: !!contributionGuidelines,
@@ -37485,7 +37962,8 @@ var IssueVetter = class {
       orgHasMergedPRs,
       matchesCategory,
       issueClosed,
-      passedAllChecks: vettingResult.passedAllChecks
+      passedAllChecks: vettingResult.passedAllChecks,
+      repoAcceptsContributions
     });
     vettingResult.notes = notes;
     const repoQualityBonus = projectHealth.checkFailed ? 0 : calculateRepoQualityBonus(projectHealth.stargazersCount ?? 0, projectHealth.forksCount ?? 0);
@@ -37565,6 +38043,36 @@ var IssueVetter = class {
       updatedAt: ghIssue.updated_at
     };
   }
+  /**
+   * Batch-prefetch merged-PR counts for the repos in a vetting batch (#182),
+   * warming the cache `checkUserMergedPRsInRepo` reads so each per-repo Search
+   * API call becomes a cache hit.
+   *
+   * Two repos are intentionally excluded:
+   * - Repos already known to have the user's merged PRs
+   *   (`getReposWithMergedPRs`): `vetIssue` short-circuits those to a merged
+   *   count of 1 and never calls the Search API, so prefetching them is waste.
+   * - Everything, when the GitHub username is unknown: the GraphQL `author:`
+   *   filter needs a concrete login and the REST path falls back to `@me`.
+   */
+  async prefetchMergedPRCounts(issueRefs) {
+    const username = this.stateReader.getGitHubUsername?.() ?? "";
+    if (!username)
+      return;
+    const alreadyKnown = new Set(this.stateReader.getReposWithMergedPRs());
+    const seen = /* @__PURE__ */ new Set();
+    const repos = [];
+    for (const { owner, repo } of issueRefs) {
+      const full = `${owner}/${repo}`;
+      if (alreadyKnown.has(full) || seen.has(full))
+        continue;
+      seen.add(full);
+      repos.push({ owner, repo });
+    }
+    if (repos.length === 0)
+      return;
+    await prefetchMergedPRCounts(this.octokit, username, repos);
+  }
   /**
    * Vet multiple issues in parallel with concurrency limit
    */
@@ -37575,11 +38083,18 @@ var IssueVetter = class {
     let rateLimitFailures = 0;
     let attemptedCount = 0;
     let firstAuthError = null;
+    let firstForbiddenError = null;
+    let forbiddenCount = 0;
+    const forbiddenRepos = /* @__PURE__ */ new Set();
     const uniqueUrls = [...new Set(urls)];
-    const prefetched = await prefetchIssueCores(this.octokit, uniqueUrls.flatMap((url2) => {
+    const issueRefs = uniqueUrls.flatMap((url2) => {
       const p = parseGitHubUrl(url2);
       return p && p.type === "issues" ? [{ owner: p.owner, repo: p.repo, number: p.number }] : [];
-    }));
+    });
+    const [prefetched] = await Promise.all([
+      prefetchIssueCores(this.octokit, issueRefs),
+      this.prefetchMergedPRCounts(issueRefs)
+    ]);
     const prefetchFor = (url2) => {
       const p = parseGitHubUrl(url2);
       return p && p.type === "issues" ? prefetched.get(issueCoreKey(p.owner, p.repo, p.number)) : void 0;
@@ -37589,6 +38104,12 @@ var IssueVetter = class {
         break;
       if (firstAuthError)
         break;
+      const parsedUrl = parseGitHubUrl(url2);
+      const repoKey = parsedUrl ? `${parsedUrl.owner}/${parsedUrl.repo}` : null;
+      if (repoKey && forbiddenRepos.has(repoKey)) {
+        debug(MODULE10, `Skipping ${url2}: repo already returned 403`);
+        continue;
+      }
       attemptedCount++;
       const core = prefetchFor(url2);
       const task = this.vetIssue(url2, core ? { prefetched: core } : void 0).then((candidate) => {
@@ -37603,11 +38124,20 @@ var IssueVetter = class {
           firstAuthError ??= error48;
           return;
         }
+        if (isAuthError(error48)) {
+          firstForbiddenError ??= error48;
+          forbiddenCount++;
+          failedVettingCount++;
+          if (repoKey)
+            forbiddenRepos.add(repoKey);
+          warn(MODULE10, `Access forbidden for ${url2} (SAML/token scope?) \u2014 skipping this repo:`, errorMessage(error48));
+          return;
+        }
         failedVettingCount++;
         if (isRateLimitError(error48)) {
           rateLimitFailures++;
         }
-        warn(MODULE9, `Error vetting issue ${url2}:`, errorMessage(error48));
+        warn(MODULE10, `Error vetting issue ${url2}:`, errorMessage(error48));
       }).finally(() => pending.delete(url2));
       pending.set(url2, task);
       if (pending.size >= MAX_CONCURRENT_VETTING) {
@@ -37617,13 +38147,16 @@ var IssueVetter = class {
     await Promise.allSettled(pending.values());
     if (firstAuthError) {
       if (candidates.length > 0) {
-        warn(MODULE9, `Auth failed mid-batch after ${candidates.length} successful vet(s) \u2014 discarding partial results`);
+        warn(MODULE10, `Auth failed mid-batch after ${candidates.length} successful vet(s) \u2014 discarding partial results`);
       }
       throw firstAuthError;
     }
+    if (firstForbiddenError && attemptedCount > 0 && forbiddenCount === attemptedCount) {
+      throw firstForbiddenError;
+    }
     const allFailed = failedVettingCount === attemptedCount && attemptedCount > 0;
     if (allFailed) {
-      warn(MODULE9, `All ${attemptedCount} issue(s) failed vetting. This may indicate a systemic issue (rate limit, auth, network).`);
+      warn(MODULE10, `All ${attemptedCount} issue(s) failed vetting. This may indicate a systemic issue (rate limit, auth, network).`);
     }
     return {
       candidates: candidates.slice(0, maxResults),
@@ -37634,14 +38167,22 @@ var IssueVetter = class {
 };
 
 // ../core/dist/core/search-phases.js
-var MODULE10 = "search-phases";
+var MODULE11 = "search-phases";
 var GITHUB_MAX_BOOLEAN_OPS = 5;
 var INTER_QUERY_DELAY_MS = 2e3;
+var GRAPHQL_INTER_QUERY_DELAY_MS = 500;
+var graphqlSearchQueryCount = 0;
+function getGraphQLSearchQueryCount() {
+  return graphqlSearchQueryCount;
+}
+function resetGraphQLSearchQueryCount() {
+  graphqlSearchQueryCount = 0;
+}
 function chunkLabels(labels, reservedOps = 0) {
   const maxPerChunk = GITHUB_MAX_BOOLEAN_OPS - reservedOps + 1;
   if (maxPerChunk < 1) {
     if (labels.length > 0) {
-      warn(MODULE10, `Label filtering disabled: ${reservedOps} repo/org ORs exceed GitHub's ${GITHUB_MAX_BOOLEAN_OPS} operator limit. All ${labels.length} label(s) dropped from query.`);
+      warn(MODULE11, `Label filtering disabled: ${reservedOps} repo/org ORs exceed GitHub's ${GITHUB_MAX_BOOLEAN_OPS} operator limit. All ${labels.length} label(s) dropped from query.`);
     }
     return [[]];
   }
@@ -37651,7 +38192,7 @@ function chunkLabels(labels, reservedOps = 0) {
   for (let i = 0; i < labels.length; i += maxPerChunk) {
     chunks.push(labels.slice(i, i + maxPerChunk));
   }
-  debug(MODULE10, `Split ${labels.length} labels into ${chunks.length} chunks (${reservedOps} ops reserved, max ${maxPerChunk} per chunk)`);
+  debug(MODULE11, `Split ${labels.length} labels into ${chunks.length} chunks (${reservedOps} ops reserved, max ${maxPerChunk} per chunk)`);
   return chunks;
 }
 function buildLabelQuery(labels) {
@@ -37688,7 +38229,7 @@ async function cachedSearchIssues(octokit, params, tracker = getSearchBudgetTrac
   const cache = getHttpCache();
   const cached2 = cache.getIfFresh(cacheKey, SEARCH_CACHE_TTL_MS);
   if (cached2) {
-    debug(MODULE10, `Search cache hit for query`);
+    debug(MODULE11, `Search cache hit for query`);
     return cached2;
   }
   await tracker.waitForBudget();
@@ -37702,10 +38243,32 @@ async function cachedSearchIssues(octokit, params, tracker = getSearchBudgetTrac
   if (data.items.length > 0) {
     cache.set(cacheKey, "", data);
   } else {
-    debug(MODULE10, `Skipping cache for empty search result (possible rate limit artifact)`);
+    debug(MODULE11, `Skipping cache for empty search result (possible rate limit artifact)`);
   }
   return data;
 }
+async function searchIssuesGraphQLFirst(octokit, params, tracker = getSearchBudgetTracker()) {
+  const cacheKey = versionedCacheKey(`gqlsearch:${params.q}:${params.sort}:${params.order}:${params.per_page}`);
+  const cache = getHttpCache();
+  const cached2 = cache.getIfFresh(cacheKey, SEARCH_CACHE_TTL_MS);
+  if (cached2) {
+    debug(MODULE11, `GraphQL search cache hit for query`);
+    return cached2;
+  }
+  const gqlQuery = `${params.q} sort:${params.sort}-${params.order}`;
+  const gql = await graphqlSearchIssues(octokit, gqlQuery, Math.min(params.per_page, 100));
+  if (gql) {
+    graphqlSearchQueryCount++;
+    if (gql.items.length > 0) {
+      cache.set(cacheKey, "", gql);
+    } else {
+      debug(MODULE11, `Skipping cache for empty GraphQL search result (possible transient artifact)`);
+    }
+    return gql;
+  }
+  warn(MODULE11, `GraphQL broad search unavailable; falling back to REST search API`);
+  return cachedSearchIssues(octokit, params, tracker);
+}
 async function fetchIssuesFromMaintainedRepos(octokit, repos, minStars, maxResults) {
   const items = [];
   for (const repoFullName of repos) {
@@ -37750,15 +38313,15 @@ async function fetchIssuesFromMaintainedRepos(octokit, repos, minStars, maxResul
       if (getHttpStatusCode(error48) === 401)
         throw error48;
       if (isRateLimitError(error48)) {
-        warn(MODULE10, `Rate limit hit fetching issues from ${repoFullName}:`, errorMessage(error48));
+        warn(MODULE11, `Rate limit hit fetching issues from ${repoFullName}:`, errorMessage(error48));
         break;
       }
-      warn(MODULE10, `Error fetching issues from ${repoFullName}:`, errorMessage(error48));
+      warn(MODULE11, `Error fetching issues from ${repoFullName}:`, errorMessage(error48));
     }
   }
   return items;
 }
-async function fetchIssuesFromKnownRepos(octokit, vetter, repos, labels, maxResults, priority, filterFn) {
+async function fetchIssuesFromKnownRepos(octokit, vetter, repos, labels, maxResults, priority, filterFn, perPage = 5) {
   const candidates = [];
   let failedRepos = 0;
   let rateLimitFailures = 0;
@@ -37780,7 +38343,7 @@ async function fetchIssuesFromKnownRepos(octokit, vetter, repos, labels, maxResu
           state: "open",
           sort: "created",
           direction: "desc",
-          per_page: 5,
+          per_page: perPage,
           ...label !== void 0 ? { labels: label } : {}
         });
         for (const issue2 of response.data) {
@@ -37815,13 +38378,13 @@ async function fetchIssuesFromKnownRepos(octokit, vetter, repos, labels, maxResu
       if (isRateLimitError(error48)) {
         rateLimitFailures++;
       }
-      warn(MODULE10, `Error fetching issues from ${repoFullName}:`, errorMessage(error48));
+      warn(MODULE11, `Error fetching issues from ${repoFullName}:`, errorMessage(error48));
     }
   }
   const allReposFailed = failedRepos === repos.length && repos.length > 0;
   const rateLimitHit = rateLimitFailures > 0;
   if (allReposFailed) {
-    warn(MODULE10, `All ${repos.length} repo(s) failed for ${priority} phase. This may indicate a systemic issue (rate limit, auth, network).`);
+    warn(MODULE11, `All ${repos.length} repo(s) failed for ${priority} phase. This may indicate a systemic issue (rate limit, auth, network).`);
   }
   return { candidates, allReposFailed, rateLimitHit };
 }
@@ -37831,9 +38394,9 @@ async function searchWithChunkedLabels(octokit, labels, reservedOps, buildQuery,
   const allItems = [];
   for (let i = 0; i < labelChunks.length; i++) {
     if (i > 0)
-      await sleep(INTER_QUERY_DELAY_MS);
+      await sleep(GRAPHQL_INTER_QUERY_DELAY_MS);
     const query = buildQuery(buildLabelQuery(labelChunks[i]));
-    const data = await cachedSearchIssues(octokit, {
+    const data = await searchIssuesGraphQLFirst(octokit, {
       q: query,
       sort: "created",
       order: "desc",
@@ -37857,13 +38420,15 @@ function buildLanguageVariants(languages, isAnyLanguage, hasLabels) {
     return [languages.map((l) => `language:${l}`).join(" ")];
   return languages.map((l) => `language:${l}`);
 }
-async function searchAcrossLanguagesAndLabels(octokit, languages, isAnyLanguage, labels, buildBaseQuery, perPage, tracker = getSearchBudgetTracker()) {
-  const langVariants = buildLanguageVariants(languages, isAnyLanguage, labels.length > 0);
+async function searchAcrossLanguagesAndLabels(octokit, languages, isAnyLanguage, labels, buildBaseQuery, perPage, tracker = getSearchBudgetTracker(), startOffset = 0) {
+  const variants = buildLanguageVariants(languages, isAnyLanguage, labels.length > 0);
+  const k = variants.length > 0 ? startOffset % variants.length : 0;
+  const langVariants = [...variants.slice(k), ...variants.slice(0, k)];
   const seenUrls = /* @__PURE__ */ new Set();
   const allItems = [];
   for (let i = 0; i < langVariants.length; i++) {
     if (i > 0)
-      await sleep(INTER_QUERY_DELAY_MS);
+      await sleep(GRAPHQL_INTER_QUERY_DELAY_MS);
     const items = await searchWithChunkedLabels(octokit, labels, 0, (labelQ) => `${buildBaseQuery(langVariants[i])} ${labelQ}`.replace(/  +/g, " ").trim(), perPage, tracker);
     for (const item of items) {
       if (!seenUrls.has(item.html_url)) {
@@ -37878,7 +38443,7 @@ async function filterVetAndScore(vetter, items, filterIssues, excludedRepoSets,
   const spamRepos = detectLabelFarmingRepos(items);
   if (spamRepos.size > 0) {
     const spamCount = items.filter((i) => spamRepos.has(extractRepoFromUrl(i.repository_url) ?? "")).length;
-    debug(MODULE10, `[SPAM_FILTER] Filtered ${spamCount} issues from ${spamRepos.size} label-farming repos: ${[...spamRepos].join(", ")}`);
+    debug(MODULE11, `[SPAM_FILTER] Filtered ${spamCount} issues from ${spamRepos.size} label-farming repos: ${[...spamRepos].join(", ")}`);
   }
   const itemsToVet = filterIssues(items).filter((item) => {
     const repoFullName = extractRepoFromUrl(item.repository_url);
@@ -37889,7 +38454,7 @@ async function filterVetAndScore(vetter, items, filterIssues, excludedRepoSets,
     return excludedRepoSets.every((s) => !s.has(repoFullName));
   }).slice(0, remainingNeeded * 2);
   if (itemsToVet.length === 0) {
-    debug(MODULE10, `[${phaseLabel}] All ${items.length} items filtered before vetting`);
+    debug(MODULE11, `[${phaseLabel}] All ${items.length} items filtered before vetting`);
     return { candidates: [], allVetFailed: false, rateLimitHit: false };
   }
   const { candidates: results, allFailed: allVetFailed, rateLimitHit } = await vetter.vetIssuesParallel(itemsToVet.map((i) => i.html_url), remainingNeeded, "normal");
@@ -37901,7 +38466,7 @@ async function filterVetAndScore(vetter, items, filterIssues, excludedRepoSets,
   });
   const starFilteredCount = results.length - starFiltered.length;
   if (starFilteredCount > 0) {
-    debug(MODULE10, `[STAR_FILTER] Filtered ${starFilteredCount} ${phaseLabel} candidates below ${minStars} stars`);
+    debug(MODULE11, `[STAR_FILTER] Filtered ${starFilteredCount} ${phaseLabel} candidates below ${minStars} stars`);
   }
   return { candidates: starFiltered, allVetFailed, rateLimitHit };
 }
@@ -37994,9 +38559,12 @@ function applyDiversityRatio(candidates, maxResults, diversityRatio) {
 }
 
 // ../core/dist/core/issue-discovery.js
-var MODULE11 = "issue-discovery";
+var MODULE12 = "issue-discovery";
 var LOW_BUDGET_THRESHOLD = 20;
 var CRITICAL_BUDGET_THRESHOLD = 10;
+var PHASE0_PER_PAGE = 30;
+var CONTRIBUTED_REPO_MAX_AGE_DAYS = 365;
+var PHASE0_MAX_SHARE = 0.5;
 function buildIssueFilter(config2) {
   return (items) => {
     return items.filter((item) => {
@@ -38018,6 +38586,8 @@ function buildIssueFilter(config2) {
       if (config2.skippedUrls.has(item.html_url))
         return false;
       const updatedAt = new Date(item.updated_at);
+      if (Number.isNaN(updatedAt.getTime()))
+        return false;
       const ageDays = daysBetween(updatedAt, config2.now);
       if (ageDays > config2.maxAgeDays)
         return false;
@@ -38028,9 +38598,9 @@ function buildIssueFilter(config2) {
   };
 }
 async function runPhase0(octokit, vetter, repos, maxResults, filterIssues) {
-  info(MODULE11, `Phase 0: Searching issues in ${repos.length} merged-PR repos (no label filter)...`);
-  const { candidates, allReposFailed, rateLimitHit } = await fetchIssuesFromKnownRepos(octokit, vetter, repos, [], maxResults, "merged_pr", filterIssues);
-  info(MODULE11, `Found ${candidates.length} candidates from merged-PR repos`);
+  info(MODULE12, `Phase 0: Searching issues in ${repos.length} merged-PR repos (no label filter, ${PHASE0_PER_PAGE}/repo)...`);
+  const { candidates, allReposFailed, rateLimitHit } = await fetchIssuesFromKnownRepos(octokit, vetter, repos, [], maxResults, "merged_pr", filterIssues, PHASE0_PER_PAGE);
+  info(MODULE12, `Found ${candidates.length} candidates from merged-PR repos`);
   return {
     candidates,
     error: allReposFailed ? "All merged-PR repo fetches failed" : null,
@@ -38038,26 +38608,26 @@ async function runPhase0(octokit, vetter, repos, maxResults, filterIssues) {
   };
 }
 async function runPhase1(octokit, vetter, repos, labels, maxResults, filterIssues) {
-  info(MODULE11, `Phase 1: Searching issues in ${repos.length} starred repos...`);
+  info(MODULE12, `Phase 1: Searching issues in ${repos.length} starred repos...`);
   const phase1Labels = labels.slice(0, 3);
   const reposToSearch = repos.slice(0, 10);
   const { candidates, allReposFailed, rateLimitHit } = await fetchIssuesFromKnownRepos(octokit, vetter, reposToSearch, phase1Labels, maxResults, "starred", filterIssues);
-  info(MODULE11, `Found ${candidates.length} candidates from starred repos`);
+  info(MODULE12, `Found ${candidates.length} candidates from starred repos`);
   return {
     candidates,
     error: allReposFailed ? "All starred repo fetches failed" : null,
     rateLimitHit
   };
 }
-async function runPhase2(octokit, vetter, scopes, labels, configLabels, languages, isAnyLanguage, maxResults, minStars, phase0RepoSet, starredRepoSet, existingCandidates, filterIssues, tracker) {
-  info(MODULE11, "Phase 2: General issue search...");
+async function runPhase2(octokit, vetter, scopes, labels, configLabels, languages, isAnyLanguage, maxResults, minStars, phase0RepoSet, starredRepoSet, existingCandidates, filterIssues, tracker, languageRotationOffset = 0) {
+  info(MODULE12, "Phase 2: General issue search...");
   const seenRepos = new Set(existingCandidates.map((c) => c.issue.repo));
   const tierLabelGroups = [];
   if (scopes && scopes.length > 1) {
     for (const scope of scopes) {
       const scopeLabels = SCOPE_LABELS[scope] ?? [];
       if (scopeLabels.length === 0) {
-        warn(MODULE11, `Scope "${scope}" has no labels, skipping tier`);
+        warn(MODULE12, `Scope "${scope}" has no labels, skipping tier`);
         continue;
       }
       tierLabelGroups.push({ tier: scope, tierLabels: scopeLabels });
@@ -38076,8 +38646,8 @@ async function runPhase2(octokit, vetter, scopes, labels, configLabels, language
   let rateLimitHit = false;
   for (const { tier, tierLabels } of tierLabelGroups) {
     try {
-      const allItems = await searchAcrossLanguagesAndLabels(octokit, languages, isAnyLanguage, tierLabels, (langQ) => `is:issue is:open ${langQ} no:assignee`.replace(/  +/g, " ").trim(), budgetPerTier * 3, tracker);
-      info(MODULE11, `Phase 2 [${tier}]: processing ${allItems.length} items...`);
+      const allItems = await searchAcrossLanguagesAndLabels(octokit, languages, isAnyLanguage, tierLabels, (langQ) => `is:issue is:open ${langQ} no:assignee`.replace(/  +/g, " ").trim(), budgetPerTier * 3, tracker, languageRotationOffset);
+      info(MODULE12, `Phase 2 [${tier}]: processing ${allItems.length} items...`);
       const { candidates: tierCandidates, allVetFailed, rateLimitHit: vetRateLimitHit } = await filterVetAndScore(vetter, allItems, filterIssues, [phase0RepoSet, starredRepoSet, seenRepos], budgetPerTier, minStars, `Phase 2 [${tier}]`);
       tierResults.push(tierCandidates);
       for (const c of tierCandidates)
@@ -38088,7 +38658,7 @@ async function runPhase2(octokit, vetter, scopes, labels, configLabels, language
       if (vetRateLimitHit) {
         rateLimitHit = true;
       }
-      info(MODULE11, `Found ${tierCandidates.length} candidates from ${tier} tier`);
+      info(MODULE12, `Found ${tierCandidates.length} candidates from ${tier} tier`);
     } catch (err) {
       if (getHttpStatusCode(err) === 401)
         throw err;
@@ -38097,13 +38667,13 @@ async function runPhase2(octokit, vetter, scopes, labels, configLabels, language
       if (isRateLimitError(err)) {
         rateLimitHit = true;
       }
-      warn(MODULE11, `Error in ${tier} tier search: ${errMsg}`);
+      warn(MODULE12, `Error in ${tier} tier search: ${errMsg}`);
       tierResults.push([]);
     }
   }
   const interleaved = interleaveArrays(tierResults);
   if (interleaved.length === 0 && error48) {
-    warn(MODULE11, `All ${tierLabelGroups.length} scope tiers failed in Phase 2: ${error48}`);
+    warn(MODULE12, `All ${tierLabelGroups.length} scope tiers failed in Phase 2: ${error48}`);
   }
   return {
     candidates: interleaved.slice(0, maxResults),
@@ -38112,17 +38682,17 @@ async function runPhase2(octokit, vetter, scopes, labels, configLabels, language
   };
 }
 async function runPhase3(octokit, vetter, langQuery, minStars, projectCategories, maxResults, phase0RepoSet, starredRepoSet, starredRepos, existingCandidates, filterIssues, tracker) {
-  info(MODULE11, "Phase 3: Searching actively maintained repos...");
+  info(MODULE12, "Phase 3: Searching actively maintained repos...");
   const seenRepos = new Set(existingCandidates.map((c) => c.issue.repo));
   const eligibleStarred = starredRepos.filter((r) => !phase0RepoSet.has(r) && !seenRepos.has(r));
   if (eligibleStarred.length > 0) {
-    info(MODULE11, `Phase 3: Checking ${eligibleStarred.length} starred repos via REST API...`);
+    info(MODULE12, `Phase 3: Checking ${eligibleStarred.length} starred repos via REST API...`);
     const restItems = await fetchIssuesFromMaintainedRepos(octokit, eligibleStarred.slice(0, 15), minStars, maxResults);
     if (restItems.length > 0) {
       try {
         const { candidates, allVetFailed, rateLimitHit: vetRateLimitHit } = await filterVetAndScore(vetter, restItems, filterIssues, [phase0RepoSet, seenRepos], maxResults, minStars, "Phase 3 (REST)");
         if (candidates.length > 0) {
-          info(MODULE11, `Found ${candidates.length} candidates from maintained-repo REST search`);
+          info(MODULE12, `Found ${candidates.length} candidates from maintained-repo REST search`);
           return {
             candidates,
             error: allVetFailed ? "all vetting failed" : null,
@@ -38132,11 +38702,11 @@ async function runPhase3(octokit, vetter, langQuery, minStars, projectCategories
       } catch (error48) {
         if (getHttpStatusCode(error48) === 401)
           throw error48;
-        warn(MODULE11, `Phase 3 REST vetting failed, falling back to Search API:`, errorMessage(error48));
+        warn(MODULE12, `Phase 3 REST vetting failed, falling back to Search API:`, errorMessage(error48));
       }
     }
   }
-  info(MODULE11, "Phase 3: Falling back to Search API...");
+  info(MODULE12, "Phase 3: Falling back to Search API...");
   const thirtyDaysAgo = /* @__PURE__ */ new Date();
   thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
   const pushedSince = thirtyDaysAgo.toISOString().split("T")[0];
@@ -38144,15 +38714,15 @@ async function runPhase3(octokit, vetter, langQuery, minStars, projectCategories
   const topicQuery = categoryTopics.length > 0 ? `topic:${categoryTopics[0]}` : "";
   const phase3Query = `is:issue is:open no:assignee ${langQuery} ${topicQuery} stars:>=${minStars} pushed:>=${pushedSince} archived:false`.replace(/  +/g, " ").trim();
   try {
-    const data = await cachedSearchIssues(octokit, {
+    const data = await searchIssuesGraphQLFirst(octokit, {
       q: phase3Query,
       sort: "updated",
       order: "desc",
       per_page: maxResults * 3
     }, tracker);
-    info(MODULE11, `Found ${data.total_count} issues in maintained-repo search, processing top ${data.items.length}...`);
+    info(MODULE12, `Found ${data.total_count} issues in maintained-repo search, processing top ${data.items.length}...`);
     const { candidates, allVetFailed, rateLimitHit: vetRateLimitHit } = await filterVetAndScore(vetter, data.items, filterIssues, [phase0RepoSet, starredRepoSet, seenRepos], maxResults, minStars, "Phase 3");
-    info(MODULE11, `Found ${candidates.length} candidates from maintained-repo search`);
+    info(MODULE12, `Found ${candidates.length} candidates from maintained-repo search`);
     return {
       candidates,
       error: allVetFailed ? "all vetting failed" : null,
@@ -38162,7 +38732,7 @@ async function runPhase3(octokit, vetter, langQuery, minStars, projectCategories
     if (getHttpStatusCode(error48) === 401)
       throw error48;
     const errMsg = errorMessage(error48);
-    warn(MODULE11, `Error in maintained-repo search: ${errMsg}`);
+    warn(MODULE12, `Error in maintained-repo search: ${errMsg}`);
     return {
       candidates: [],
       error: errMsg,
@@ -38246,7 +38816,7 @@ var IssueDiscovery = class {
     let rateLimitHitDuringSearch = false;
     const applyInterPhaseDelay = async () => {
       if (interPhaseDelay > 0) {
-        info(MODULE11, `Waiting ${(interPhaseDelay / 1e3).toFixed(0)}s between phases for rate limit management...`);
+        info(MODULE12, `Waiting ${(interPhaseDelay / 1e3).toFixed(0)}s between phases for rate limit management...`);
         await sleep(interPhaseDelay);
       }
     };
@@ -38256,9 +38826,12 @@ var IssueDiscovery = class {
       if (result.rateLimitHit)
         rateLimitHitDuringSearch = true;
     };
+    const viableCandidateCount = () => allCandidates.filter((c) => c.recommendation !== "skip").length;
     this.rateLimitWarning = null;
+    resetGraphQLSearchQueryCount();
     const tracker = this.budgetTracker;
-    let searchBudget = LOW_BUDGET_THRESHOLD - 1;
+    let searchBudget = CRITICAL_BUDGET_THRESHOLD - 1;
+    let preflightFailed = false;
     try {
       const rateLimit = await checkRateLimit(this.githubToken);
       searchBudget = rateLimit.remaining;
@@ -38266,22 +38839,23 @@ var IssueDiscovery = class {
       if (rateLimit.remaining < 5) {
         const resetTime = new Date(rateLimit.resetAt).toLocaleTimeString("en-US", { hour12: false });
         this.rateLimitWarning = `GitHub search API quota low (${rateLimit.remaining}/${rateLimit.limit} remaining, resets at ${resetTime}). Search may be slow.`;
-        warn(MODULE11, this.rateLimitWarning);
+        warn(MODULE12, this.rateLimitWarning);
       }
       if (searchBudget < CRITICAL_BUDGET_THRESHOLD) {
-        info(MODULE11, `Search budget critical (${searchBudget} remaining) \u2014 running only Phase 0`);
+        info(MODULE12, `Search budget critical (${searchBudget} remaining) \u2014 skipping the starred phase; broad/maintained still run on GraphQL (points bucket)`);
       } else if (searchBudget < LOW_BUDGET_THRESHOLD) {
-        info(MODULE11, `Search budget low (${searchBudget} remaining) \u2014 skipping heavy phases (2, 3)`);
+        info(MODULE12, `Search budget low (${searchBudget} remaining) \u2014 broad/maintained run on GraphQL (points bucket), unaffected by REST search quota`);
       }
     } catch (error48) {
       if (getHttpStatusCode(error48) === 401)
         throw error48;
+      preflightFailed = true;
       tracker.init(CRITICAL_BUDGET_THRESHOLD, new Date(Date.now() + 6e4).toISOString());
-      warn(MODULE11, "Could not check rate limit \u2014 using conservative budget, skipping heavy phases:", errorMessage(error48));
+      warn(MODULE12, "Could not check rate limit \u2014 using conservative budget, skipping the starred phase:", errorMessage(error48));
     }
     if (searchBudget <= 0) {
-      this.rateLimitWarning = "GitHub search API quota exhausted. Try again after the rate limit resets.";
-      return { candidates: [], strategiesUsed: [] };
+      this.rateLimitWarning = "GitHub search API quota exhausted \u2014 skipping the starred phase; other phases don't use it.";
+      warn(MODULE12, this.rateLimitWarning);
     }
     const mergedPRRepos = this.stateReader.getReposWithMergedPRs();
     const openPRRepos = this.stateReader.getReposWithOpenPRs();
@@ -38292,17 +38866,24 @@ var IssueDiscovery = class {
     const langQuery = isAnyLanguage ? "" : languages.map((l) => `language:${l}`).join(" ");
     const aiBlocklisted = new Set(config2.aiPolicyBlocklist.map((r) => r.toLowerCase()));
     if (aiBlocklisted.size > 0) {
-      debug(MODULE11, `[AI_POLICY_FILTER] Filtering issues from ${aiBlocklisted.size} blocklisted repo(s): ${[...aiBlocklisted].join(", ")}`);
+      debug(MODULE12, `[AI_POLICY_FILTER] Filtering issues from ${aiBlocklisted.size} blocklisted repo(s): ${[...aiBlocklisted].join(", ")}`);
     }
-    const filterIssues = buildIssueFilter({
+    const baseFilterConfig = {
       excludedRepos: new Set(config2.excludeRepos.map((r) => r.toLowerCase())),
       excludeOrgs: new Set((config2.excludeOrgs ?? []).map((o) => o.toLowerCase())),
       aiBlocklisted,
       lowScoringRepos,
       skippedUrls: options.skippedUrls ?? /* @__PURE__ */ new Set(),
-      maxAgeDays: config2.maxIssueAgeDays || 90,
       now: /* @__PURE__ */ new Date(),
       includeDocIssues: config2.includeDocIssues ?? true
+    };
+    const filterIssues = buildIssueFilter({
+      ...baseFilterConfig,
+      maxAgeDays: config2.maxIssueAgeDays || 90
+    });
+    const filterIssuesPhase0 = buildIssueFilter({
+      ...baseFilterConfig,
+      maxAgeDays: CONTRIBUTED_REPO_MAX_AGE_DAYS
     });
     const seenPhase0 = /* @__PURE__ */ new Set();
     const phase0Repos = [];
@@ -38315,10 +38896,12 @@ var IssueDiscovery = class {
         break;
     }
     const phase0RepoSet = new Set(phase0Repos);
+    const otherStrategiesCanRun = starredRepos.length > 0 && enabledStrategies.has("starred") || enabledStrategies.has("broad") || enabledStrategies.has("maintained");
     if (phase0Repos.length > 0 && enabledStrategies.has("merged")) {
-      const remaining = maxResults - allCandidates.length;
+      const phase0Cap = otherStrategiesCanRun ? Math.max(1, Math.ceil(maxResults * PHASE0_MAX_SHARE)) : maxResults;
+      const remaining = Math.min(maxResults - allCandidates.length, phase0Cap);
       if (remaining > 0) {
-        const result = await runPhase0(this.octokit, this.vetter, phase0Repos, remaining, filterIssues);
+        const result = await runPhase0(this.octokit, this.vetter, phase0Repos, remaining, filterIssuesPhase0);
         recordPhaseResult("0", result);
       }
       strategiesUsed.push("merged");
@@ -38338,37 +38921,39 @@ var IssueDiscovery = class {
     const broadDelay = options.broadPhaseDelayMs ?? config2.broadPhaseDelayMs ?? 9e4;
     const configuredSkipThreshold = config2.skipBroadWhenSufficientResults ?? 8;
     const skipThreshold = configuredSkipThreshold > 0 ? Math.min(configuredSkipThreshold, maxResults - 1) : 0;
-    if (allCandidates.length < maxResults && searchBudget >= LOW_BUDGET_THRESHOLD && enabledStrategies.has("broad")) {
-      if (skipThreshold > 0 && allCandidates.length >= skipThreshold) {
-        info(MODULE11, `Skipping broad search: already found ${allCandidates.length} candidates (threshold: ${skipThreshold})`);
+    const viableBeforeBroad = viableCandidateCount();
+    if (viableBeforeBroad >= maxResults && enabledStrategies.has("broad")) {
+      info(MODULE12, `Skipping broad search: ${viableBeforeBroad} viable candidate(s) already meet maxResults (${maxResults})`);
+    } else if (enabledStrategies.has("broad")) {
+      const newRepoCandidateCount = allCandidates.filter((c) => c.recommendation !== "skip" && !phase0RepoSet.has(c.issue.repo) && !starredRepoSet.has(c.issue.repo)).length;
+      if (skipThreshold > 0 && newRepoCandidateCount >= skipThreshold) {
+        info(MODULE12, `Skipping broad search: already found ${newRepoCandidateCount} viable candidate(s) from new repos (threshold: ${skipThreshold})`);
       } else {
         await applyInterPhaseDelay();
         if (allCandidates.length > 0 && broadDelay > 0) {
-          info(MODULE11, `Waiting ${(broadDelay / 1e3).toFixed(0)}s for rate limit cooldown before broad search...`);
+          info(MODULE12, `Waiting ${(broadDelay / 1e3).toFixed(0)}s for rate limit cooldown before broad search...`);
           await sleep(broadDelay);
         } else if (allCandidates.length === 0) {
-          info(MODULE11, `Skipping broad phase delay: no results from previous phases, proceeding immediately`);
+          info(MODULE12, `Skipping broad phase delay: no results from previous phases, proceeding immediately`);
         }
-        const remaining = maxResults - allCandidates.length;
-        const result = await runPhase2(this.octokit, this.vetter, scopes, labels, config2.labels, languages, isAnyLanguage, remaining, minStars, phase0RepoSet, starredRepoSet, allCandidates, filterIssues, tracker);
+        const remaining = maxResults - viableBeforeBroad;
+        const result = await runPhase2(this.octokit, this.vetter, scopes, labels, config2.labels, languages, isAnyLanguage, remaining, minStars, phase0RepoSet, starredRepoSet, allCandidates, filterIssues, tracker, options.languageRotationOffset ?? 0);
         recordPhaseResult("2", result);
         strategiesUsed.push("broad");
       }
     }
-    if (allCandidates.length < maxResults && searchBudget >= LOW_BUDGET_THRESHOLD && enabledStrategies.has("maintained")) {
+    const viableBeforeMaintained = viableCandidateCount();
+    if (viableBeforeMaintained >= maxResults && enabledStrategies.has("maintained")) {
+      info(MODULE12, `Skipping maintained search: ${viableBeforeMaintained} viable candidate(s) already meet maxResults (${maxResults})`);
+    } else if (enabledStrategies.has("maintained")) {
       await applyInterPhaseDelay();
-      const remaining = maxResults - allCandidates.length;
+      const remaining = maxResults - viableBeforeMaintained;
       const result = await runPhase3(this.octokit, this.vetter, langQuery, minStars, config2.projectCategories ?? [], remaining, phase0RepoSet, starredRepoSet, starredRepos, allCandidates, filterIssues, tracker);
       recordPhaseResult("3", result);
       strategiesUsed.push("maintained");
     }
-    const phasesSkippedForBudget = searchBudget < LOW_BUDGET_THRESHOLD;
-    let budgetNote = "";
-    if (searchBudget < CRITICAL_BUDGET_THRESHOLD) {
-      budgetNote = ` Most search phases were skipped due to critically low API quota (${searchBudget} remaining).`;
-    } else if (phasesSkippedForBudget) {
-      budgetNote = ` Some search phases were skipped due to low API quota (${searchBudget} remaining).`;
-    }
+    const phasesSkippedForBudget = searchBudget < CRITICAL_BUDGET_THRESHOLD;
+    const budgetNote = phasesSkippedForBudget ? preflightFailed ? " The starred-repo phase was skipped as a precaution because the rate-limit check failed (quota unknown); broad and maintained phases still ran on GraphQL." : ` The starred-repo phase was skipped due to critically low API quota (${searchBudget} remaining); broad and maintained phases still ran on GraphQL.` : "";
     if (allCandidates.length === 0) {
       const errorDetails = [
         phaseErrors["0"] ? `Phase 0 (merged-PR repos): ${phaseErrors["0"]}` : null,
@@ -38381,7 +38966,7 @@ var IssueDiscovery = class {
         this.rateLimitWarning = `Search returned no results due to GitHub API rate limits.${details}${budgetNote} Try again after the rate limit resets.`;
         return { candidates: [], strategiesUsed };
       }
-      throw new ValidationError(`No issue candidates found across all search phases.${details} Try adjusting your search criteria (languages, labels) or check your network connection.`);
+      throw new ValidationError(`No issue candidates found across all search phases.${details} Try adjusting your search criteria (languages, labels) or check your network connection.`, strategiesUsed);
     }
     if (rateLimitHitDuringSearch || phasesSkippedForBudget) {
       this.rateLimitWarning = `Search results may be incomplete: GitHub API rate limits were hit during search.${budgetNote} Found ${allCandidates.length} candidate${allCandidates.length === 1 ? "" : "s"} but some search phases were limited. Try again after the rate limit resets for complete results.`;
@@ -38410,9 +38995,13 @@ var IssueDiscovery = class {
         return boostDiff;
       return b.viabilityScore - a.viabilityScore;
     });
-    const capped = applyPerRepoCap(ranked, 2);
+    const viableFirst = [
+      ...ranked.filter((c) => c.recommendation !== "skip"),
+      ...ranked.filter((c) => c.recommendation === "skip")
+    ];
+    const capped = applyPerRepoCap(viableFirst, 2);
     const finalPicks = applyDiversityRatio(capped, maxResults, options.diversityRatio ?? 0);
-    info(MODULE11, `Search complete: ${tracker.getTotalCalls()} Search API calls used, ${finalPicks.length} candidates returned`);
+    info(MODULE12, `Search complete: ${tracker.getTotalCalls()} REST Search API call(s) + ${getGraphQLSearchQueryCount()} GraphQL broad-search query/queries used, ${finalPicks.length} candidates returned`);
     return { candidates: finalPicks, strategiesUsed };
   }
   /**
@@ -38464,18 +39053,25 @@ function pruneCache2() {
 function parseRoadmapIssueRefs(content, owner, repo) {
   const refs = /* @__PURE__ */ new Set();
   const ownerRepoLower = `${owner}/${repo}`.toLowerCase();
-  const escape2 = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const fullRefPattern = new RegExp(`\\b${escape2(owner)}/${escape2(repo)}#(\\d+)\\b`, "gi");
+  const escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const fullRefPattern = new RegExp(`\\b${escape(owner)}/${escape(repo)}#(\\d+)\\b`, "gi");
   for (const m of content.matchAll(fullRefPattern)) {
     const n = Number.parseInt(m[1], 10);
     if (n > 0)
       refs.add(n);
   }
   const fullRefStripPattern = /\b[\w.-]+\/[\w.-]+#\d+\b/gi;
+  let inFence = false;
   for (const line of content.split("\n")) {
+    if (/^\s*(```|~~~)/.test(line)) {
+      inFence = !inFence;
+      continue;
+    }
+    if (inFence)
+      continue;
     if (/^\s*#+\s/.test(line))
       continue;
-    const stripped = line.replace(fullRefStripPattern, "");
+    const stripped = line.replace(fullRefStripPattern, "").replace(/`[^`]*`/g, "");
     for (const m of stripped.matchAll(/(?:^|[^&\w])#(\d+)\b/g)) {
       const n = Number.parseInt(m[1], 10);
       if (n > 0)
@@ -38527,7 +39123,7 @@ async function fetchRoadmapIssueRefsUncached(octokit, owner, repo, cacheKey) {
 }
 
 // ../core/dist/core/feature-discovery.js
-var MODULE12 = "feature-discovery";
+var MODULE13 = "feature-discovery";
 var INTER_REPO_DELAY_MS = 2e3;
 var MIN_VIABILITY_SCORE = 40;
 var ANCHOR_THRESHOLD = 3;
@@ -38552,7 +39148,8 @@ function classifyHorizon(input) {
 function splitByHorizon(candidates, count, ratio = DEFAULT_SPLIT_RATIO) {
   const allQuick = candidates.filter((c) => c.horizon === "quick-win").sort((a, b) => b.viabilityScore - a.viabilityScore);
   const allBigger = candidates.filter((c) => c.horizon === "bigger-bet").sort((a, b) => b.viabilityScore - a.viabilityScore);
-  const targetQuick = Math.round(count * ratio);
+  const clampedRatio = Math.max(0, Math.min(1, ratio));
+  const targetQuick = Math.round(count * clampedRatio);
   const targetBigger = count - targetQuick;
   const quickTaken = Math.min(allQuick.length, targetQuick);
   const biggerTaken = Math.min(allBigger.length, targetBigger);
@@ -38606,6 +39203,17 @@ function detectWontfixNoContributor(input) {
 }
 var NO_ANCHORS_MESSAGE = "No anchor repos yet (need 3+ merged PRs in a repo). Try `scout search` to build relationships first.";
 var NO_RESULTS_MESSAGE = "No open feature opportunities in your anchor repos right now. Check back next week, or try `scout search` for fix-mode work.";
+function buildRepoExclusionFilter(opts) {
+  const excluded = new Set([...opts.excludeRepos ?? [], ...opts.aiPolicyBlocklist ?? []].map((r) => r.toLowerCase()));
+  const excludedOrgs = new Set((opts.excludeOrgs ?? []).map((o) => o.toLowerCase()));
+  return (repoFullName) => {
+    const lower = repoFullName.toLowerCase();
+    if (excluded.has(lower))
+      return false;
+    const org = lower.split("/")[0];
+    return !(org && excludedOrgs.has(org));
+  };
+}
 function extractLabels(item) {
   if (!Array.isArray(item.labels))
     return [];
@@ -38640,7 +39248,7 @@ async function vetAndClassify(item, vetter, roadmapRefs) {
     });
   } catch (err) {
     rethrowIfFatal(err);
-    warn(MODULE12, `vet failed for ${item.html_url}: ${errorMessage(err)}`);
+    warn(MODULE13, `vet failed for ${item.html_url}: ${errorMessage(err)}`);
     return null;
   }
   const horizon = classifyHorizon({
@@ -38651,7 +39259,8 @@ async function vetAndClassify(item, vetter, roadmapRefs) {
   return { ...candidate, horizon };
 }
 async function discoverFeatures(opts) {
-  const anchorRepos = resolveAnchorRepos(opts.repoScores, opts.anchorThreshold);
+  const includeRepo = buildRepoExclusionFilter(opts);
+  const anchorRepos = resolveAnchorRepos(opts.repoScores, opts.anchorThreshold).filter(includeRepo);
   if (anchorRepos.length === 0) {
     return {
       quickWins: [],
@@ -38683,7 +39292,7 @@ async function discoverFeatures(opts) {
       roadmapRefs = refs;
     } catch (err) {
       rethrowIfFatal(err);
-      warn(MODULE12, `failed to list issues for ${anchorRepos[i]}: ${errorMessage(err)}`);
+      warn(MODULE13, `failed to list issues for ${anchorRepos[i]}: ${errorMessage(err)}`);
       continue;
     }
     const items = response.data.filter((it) => !it.pull_request && !it.assignee && isFeatureIssue(it));
@@ -38758,10 +39367,14 @@ async function discoverFeaturesBroad(opts) {
         merged.push(raw);
       }
     }
-    items = merged.filter((it) => !it.pull_request && !it.assignee && isFeatureIssue(it)).slice(0, maxToVet);
+    const includeRepo = buildRepoExclusionFilter(opts);
+    items = merged.filter((it) => !it.pull_request && !it.assignee && isFeatureIssue(it)).filter((it) => {
+      const repo = extractRepoFromUrl(it.html_url);
+      return repo === null || includeRepo(repo);
+    }).slice(0, maxToVet);
   } catch (err) {
     rethrowIfFatal(err);
-    warn(MODULE12, `broad feature search failed: ${errorMessage(err)}`);
+    warn(MODULE13, `broad feature search failed: ${errorMessage(err)}`);
     return {
       quickWins: [],
       biggerBets: [],
@@ -38788,7 +39401,7 @@ async function discoverFeaturesBroad(opts) {
 // ../core/dist/core/gist-state-store.js
 var fs3 = __toESM(require("fs"), 1);
 var path3 = __toESM(require("path"), 1);
-var MODULE13 = "gist-state";
+var MODULE14 = "gist-state";
 var GIST_DESCRIPTION = "oss-scout-state";
 var GIST_FILENAME = "state.json";
 var GIST_ID_FILE = "gist-id";
@@ -38833,7 +39446,7 @@ var GistStateStore = class {
     } catch (err) {
       if (getHttpStatusCode(err) === 401)
         throw err;
-      warn(MODULE13, `API bootstrap failed: ${errorMessage(err)}`);
+      warn(MODULE14, `API bootstrap failed: ${errorMessage(err)}`);
       return this.bootstrapFromCache(classifyDegradedReason(err));
     }
   }
@@ -38842,24 +39455,28 @@ var GistStateStore = class {
    */
   async push(state) {
     if (!this.gistId) {
-      warn(MODULE13, "No gist ID \u2014 cannot push");
+      warn(MODULE14, "No gist ID \u2014 cannot push");
       this.writeCache(state);
       return false;
     }
     let toWrite = state;
     try {
       const remote = await this.fetchGistState(this.gistId);
-      if (remote) {
-        toWrite = mergeStates(state, remote);
+      if (remote.kind === "ok") {
+        toWrite = mergeStates(state, remote.state);
+      } else if (remote.kind === "invalid") {
+        this.writeCache(state);
+        warn(MODULE14, "Remote gist content failed validation \u2014 not overwriting it. Changes saved locally; gist sync skipped.");
+        return false;
       }
     } catch (err) {
       rethrowIfFatal(err);
-      warn(MODULE13, `Could not fetch gist before push, writing local snapshot: ${errorMessage(err)}`);
+      warn(MODULE14, `Could not fetch gist before push, writing local snapshot: ${errorMessage(err)}`);
     }
     this.writeCache(toWrite);
     const json2 = JSON.stringify(toWrite, null, 2);
     if (json2.length > 9e5) {
-      warn(MODULE13, `State too large for gist (${Math.round(json2.length / 1024)}KB). Consider clearing old results with 'oss-scout results clear'.`);
+      warn(MODULE14, `State too large for gist (${Math.round(json2.length / 1024)}KB). Consider clearing old results with 'oss-scout results clear'.`);
       return false;
     }
     try {
@@ -38869,11 +39486,11 @@ var GistStateStore = class {
           [GIST_FILENAME]: { content: json2 }
         }
       });
-      debug(MODULE13, "State pushed to gist");
+      debug(MODULE14, "State pushed to gist");
       return true;
     } catch (err) {
       rethrowIfFatal(err);
-      warn(MODULE13, `Failed to push: ${errorMessage(err)}`);
+      warn(MODULE14, `Failed to push: ${errorMessage(err)}`);
       return false;
     }
   }
@@ -38885,40 +39502,40 @@ var GistStateStore = class {
   async bootstrapFromApi() {
     const cachedId = this.readCachedGistId();
     if (cachedId) {
-      debug(MODULE13, `Trying cached gist ID: ${cachedId}`);
+      debug(MODULE14, `Trying cached gist ID: ${cachedId}`);
       try {
         const fetched = await this.fetchGistState(cachedId);
-        if (fetched) {
+        if (fetched.kind === "ok") {
           this.gistId = cachedId;
-          const state = this.mergeCacheInto(fetched);
+          const state = this.mergeCacheInto(fetched.state);
           this.writeCache(state);
           return { gistId: cachedId, state, created: false };
         }
       } catch (err) {
         if (getHttpStatusCode(err) !== 404)
           throw err;
-        debug(MODULE13, `Cached gist gone (404): ${errorMessage(err)}`);
+        debug(MODULE14, `Cached gist gone (404): ${errorMessage(err)}`);
       }
-      debug(MODULE13, "Cached gist ID invalid, searching...");
+      debug(MODULE14, "Cached gist ID invalid, searching...");
     }
     const search = await this.searchForGist();
     if (search.id) {
-      debug(MODULE13, `Found gist via search: ${search.id}`);
+      debug(MODULE14, `Found gist via search: ${search.id}`);
       this.saveGistId(search.id);
       this.gistId = search.id;
       const fetched = await this.fetchGistState(search.id);
-      if (fetched) {
-        const state = this.mergeCacheInto(fetched);
+      if (fetched.kind === "ok") {
+        const state = this.mergeCacheInto(fetched.state);
         this.writeCache(state);
         return { gistId: search.id, state, created: false };
       }
-      warn(MODULE13, `Found existing gist ${search.id} but content failed validation. Using local cache to avoid data loss.`);
+      warn(MODULE14, `Found existing gist ${search.id} but content failed validation. Using local cache to avoid data loss.`);
       return this.bootstrapFromCache("unknown");
     }
     if (!search.exhaustive) {
-      warn(MODULE13, `Scanned the first ${SEARCH_MAX_PAGES * 100} gists without finding an oss-scout state gist, but the account has more. Creating a new state gist; if one already exists, copy its id into the gist-id file in the oss-scout data directory to avoid a duplicate.`);
+      warn(MODULE14, `Scanned the first ${SEARCH_MAX_PAGES * 100} gists without finding an oss-scout state gist, but the account has more. Creating a new state gist; if one already exists, copy its id into the gist-id file in the oss-scout data directory to avoid a duplicate.`);
     }
-    debug(MODULE13, "No existing gist found, creating new one");
+    debug(MODULE14, "No existing gist found, creating new one");
     const freshState = ScoutStateSchema.parse({ version: 1 });
     const newId = await this.createGist(freshState);
     this.saveGistId(newId);
@@ -38929,7 +39546,7 @@ var GistStateStore = class {
   bootstrapFromCache(reason) {
     const cached2 = this.readCache();
     if (cached2) {
-      debug(MODULE13, "Bootstrapped from local cache (degraded mode)");
+      debug(MODULE14, "Bootstrapped from local cache (degraded mode)");
       const cachedId = this.readCachedGistId();
       if (cachedId)
         this.gistId = cachedId;
@@ -38941,7 +39558,7 @@ var GistStateStore = class {
         degradedReason: reason
       };
     }
-    debug(MODULE13, "No cache available, using fresh state (degraded mode)");
+    debug(MODULE14, "No cache available, using fresh state (degraded mode)");
     const fresh = ScoutStateSchema.parse({ version: 1 });
     return {
       gistId: "",
@@ -38952,17 +39569,24 @@ var GistStateStore = class {
     };
   }
   // ── Gist API operations ──────────────────────────────────────────────
+  /**
+   * "missing" (no file/content) and "invalid" (content that fails parse or
+   * schema validation) are distinct outcomes: an invalid remote may be a
+   * corrupted-but-recoverable state or a newer state version written by a
+   * newer binary, so callers must not treat it as "nothing there" and
+   * overwrite it (#286).
+   */
   async fetchGistState(gistId) {
     const { data } = await this.octokit.gists.get({ gist_id: gistId });
     const file2 = data.files?.[GIST_FILENAME];
     if (!file2?.content)
-      return null;
+      return { kind: "missing" };
     try {
       const parsed = JSON.parse(file2.content);
-      return parseScoutState(parsed);
+      return { kind: "ok", state: parseScoutState(parsed) };
     } catch (err) {
-      warn(MODULE13, `Gist content failed validation: ${errorMessage(err)}`);
-      return null;
+      warn(MODULE14, `Gist content failed validation: ${errorMessage(err)}`);
+      return { kind: "invalid" };
     }
   }
   /**
@@ -39004,7 +39628,7 @@ var GistStateStore = class {
     } catch (err) {
       const code = err?.code;
       if (code !== "ENOENT") {
-        warn(MODULE13, `Failed to read cached gist ID: ${errorMessage(err)}`);
+        warn(MODULE14, `Failed to read cached gist ID: ${errorMessage(err)}`);
       }
       return null;
     }
@@ -39030,7 +39654,7 @@ var GistStateStore = class {
     } catch (err) {
       const code = err?.code;
       if (code !== "ENOENT") {
-        warn(MODULE13, `Failed to read state cache: ${errorMessage(err)}`);
+        warn(MODULE14, `Failed to read state cache: ${errorMessage(err)}`);
       }
       return null;
     }
@@ -39041,7 +39665,7 @@ var GistStateStore = class {
         mode: 384
       });
     } catch (err) {
-      warn(MODULE13, `Failed to write cache: ${errorMessage(err)}`);
+      warn(MODULE14, `Failed to write cache: ${errorMessage(err)}`);
     }
   }
 };
@@ -39056,7 +39680,7 @@ function mergeTombstones(local, remote) {
   }
   return [...byUrl.values()].filter((t) => {
     const ts = new Date(t.removedAt).getTime();
-    return !Number.isFinite(ts) || ts >= cutoff;
+    return Number.isFinite(ts) && ts >= cutoff;
   });
 }
 function applyTombstones(items, tombstones, urlOf, touchedAtOf) {
@@ -39081,6 +39705,13 @@ function mergeStates(local, remote) {
   const localPrefsWin = localPrefsTs !== void 0 && (remotePrefsTs === void 0 || localPrefsTs > remotePrefsTs);
   const preferences = localPrefsWin ? local.preferences : remote.preferences;
   const preferencesUpdatedAt = pickFresherTimestamp(localPrefsTs, remotePrefsTs);
+  const mergedPRsFinal = unionByUrl(local.mergedPRs, remote.mergedPRs);
+  const closedPRsFinal = unionByUrl(local.closedPRs, remote.closedPRs);
+  const resolvedUrls = /* @__PURE__ */ new Set([
+    ...mergedPRsFinal.map((p) => p.url),
+    ...closedPRsFinal.map((p) => p.url)
+  ]);
+  const openPRsFinal = unionByUrl(local.openPRs ?? [], remote.openPRs ?? []).filter((p) => !resolvedUrls.has(p.url));
   return {
     ...local,
     ...remote,
@@ -39091,18 +39722,33 @@ function mergeStates(local, remote) {
     repoScores: mergeRepoScores(local.repoScores, remote.repoScores),
     starredRepos: mergeStarredRepos(local, remote),
     starredReposLastFetched: pickFresherTimestamp(local.starredReposLastFetched, remote.starredReposLastFetched),
-    mergedPRs: unionByUrl(local.mergedPRs, remote.mergedPRs),
-    closedPRs: unionByUrl(local.closedPRs, remote.closedPRs),
-    openPRs: unionByUrl(local.openPRs ?? [], remote.openPRs ?? []),
+    mergedPRs: mergedPRsFinal,
+    closedPRs: closedPRsFinal,
+    openPRs: openPRsFinal,
     savedResults: savedResultsFinal,
     skippedIssues,
     lastSearchAt: pickFresherTimestamp(local.lastSearchAt, remote.lastSearchAt),
     lastRunAt: pickFresherTimestamp(local.lastRunAt, remote.lastRunAt) ?? (/* @__PURE__ */ new Date()).toISOString(),
-    gistId: remote.gistId ?? local.gistId
+    gistId: remote.gistId ?? local.gistId,
+    searchRotation: mergeSearchRotation(local.searchRotation, remote.searchRotation)
   };
 }
+function mergeSearchRotation(local, remote) {
+  const localRotation = local ?? { languageOffset: 0 };
+  const remoteRotation = remote ?? { languageOffset: 0 };
+  const localTs = localRotation.lastRotatedAt;
+  const remoteTs = remoteRotation.lastRotatedAt;
+  if (localTs && remoteTs) {
+    return localTs >= remoteTs ? localRotation : remoteRotation;
+  }
+  if (localTs)
+    return localRotation;
+  if (remoteTs)
+    return remoteRotation;
+  return remoteRotation.languageOffset >= localRotation.languageOffset ? remoteRotation : localRotation;
+}
 function mergeRepoScores(local, remote) {
-  const merged = { ...local };
+  const merged = Object.assign(/* @__PURE__ */ Object.create(null), local);
   for (const [repo, remoteScore] of Object.entries(remote)) {
     const localScore = merged[repo];
     if (!localScore) {
@@ -39169,7 +39815,7 @@ function pickFresherTimestamp(a, b) {
 // ../core/dist/core/local-state.js
 var fs4 = __toESM(require("fs"), 1);
 var path4 = __toESM(require("path"), 1);
-var MODULE14 = "local-state";
+var MODULE15 = "local-state";
 function getStatePath() {
   return path4.join(getDataDir(), "state.json");
 }
@@ -39183,13 +39829,13 @@ function loadLocalState() {
     if (code === "ENOENT") {
       return ScoutStateSchema.parse({ version: 1 });
     }
-    warn(MODULE14, `Failed to load state from ${statePath}: ${errorMessage(err)}. Using defaults.`);
+    warn(MODULE15, `Failed to load state from ${statePath}: ${errorMessage(err)}. Using defaults.`);
     try {
       const backupPath = `${statePath}.corrupt.${Date.now()}`;
       fs4.copyFileSync(statePath, backupPath);
-      warn(MODULE14, `Corrupt state backed up to ${backupPath}`);
+      warn(MODULE15, `Corrupt state backed up to ${backupPath}`);
     } catch (backupErr) {
-      warn(MODULE14, `Failed to back up corrupt state: ${errorMessage(backupErr)}`);
+      warn(MODULE15, `Failed to back up corrupt state: ${errorMessage(backupErr)}`);
     }
     return ScoutStateSchema.parse({ version: 1 });
   }
@@ -39209,7 +39855,7 @@ function saveLocalState(state) {
     }
     throw err;
   }
-  debug(MODULE14, "State saved");
+  debug(MODULE15, "State saved");
 }
 
 // ../core/dist/scout.js
@@ -39322,6 +39968,15 @@ var OssScout = class {
     this.evictStaleCacheEntries();
     this.cullExpiredSkips();
     const skippedUrls = new Set((this.state.skippedIssues ?? []).map((s) => s.url));
+    if (options?.excludeRecentlySurfaced ?? true) {
+      const ttlDays = options?.recentlySurfacedTtlDays ?? 7;
+      const cutoff = Date.now() - ttlDays * 24 * 60 * 60 * 1e3;
+      for (const r of this.state.savedResults ?? []) {
+        const seen = Date.parse(r.lastSeenAt);
+        if (!Number.isNaN(seen) && seen >= cutoff)
+          skippedUrls.add(r.issueUrl);
+      }
+    }
     const discovery = new IssueDiscovery(this.githubToken, this.state.preferences, this);
     const prefs = this.state.preferences;
     const prefLangs = prefs.preferLanguages ?? [];
@@ -39333,18 +39988,30 @@ var OssScout = class {
     const avoidRepos = options?.avoidRepos ?? (prefAvoid.length > 0 ? prefAvoid : void 0);
     const boostIssueTypes = options?.boostIssueTypes ?? (prefBoostTypes.length > 0 ? prefBoostTypes : void 0);
     const diversityRatio = options?.diversityRatio ?? prefs.diversityRatio ?? 0;
-    const { candidates, strategiesUsed } = await discovery.searchIssues({
-      maxResults: options?.maxResults,
-      strategies: options?.strategies,
-      skippedUrls,
-      preferLanguages,
-      preferRepos,
-      avoidRepos,
-      boostIssueTypes,
-      diversityRatio,
-      interPhaseDelayMs: options?.interPhaseDelayMs,
-      broadPhaseDelayMs: options?.broadPhaseDelayMs
-    });
+    const rotation = this.state.searchRotation ?? { languageOffset: 0 };
+    let candidates;
+    let strategiesUsed;
+    try {
+      ({ candidates, strategiesUsed } = await discovery.searchIssues({
+        maxResults: options?.maxResults,
+        strategies: options?.strategies,
+        skippedUrls,
+        preferLanguages,
+        preferRepos,
+        avoidRepos,
+        boostIssueTypes,
+        diversityRatio,
+        interPhaseDelayMs: options?.interPhaseDelayMs,
+        broadPhaseDelayMs: options?.broadPhaseDelayMs,
+        languageRotationOffset: rotation.languageOffset
+      }));
+    } catch (err) {
+      if (err instanceof ValidationError) {
+        this.advanceRotationIfBroadRan(rotation, err.strategiesUsed ?? []);
+      }
+      throw err;
+    }
+    this.advanceRotationIfBroadRan(rotation, strategiesUsed);
     for (const c of candidates) {
       this.updateRepoSignalsFromHealth(c.projectHealth);
     }
@@ -39358,6 +40025,23 @@ var OssScout = class {
       strategiesUsed
     };
   }
+  /**
+   * Advance the language-rotation cursor when the broad phase actually ran.
+   * Called on both the success path and the zero-candidate ValidationError
+   * path — a broad phase that ran and found nothing must still rotate, or the
+   * same barren language slice would lead every subsequent run (#249
+   * follow-up). Skipped/gated broad phases don't burn a rotation slot.
+   */
+  advanceRotationIfBroadRan(rotation, strategiesUsed) {
+    if (!strategiesUsed.includes("broad"))
+      return;
+    this.state.searchRotation = {
+      ...rotation,
+      languageOffset: rotation.languageOffset + 1,
+      lastRotatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    this.dirty = true;
+  }
   /**
    * Populate the `hasActiveMaintainers` repo-score signal from a freshly
    * computed projectHealth (#167). It was initialized false and never set, so
@@ -39412,12 +40096,16 @@ var OssScout = class {
       languages: this.state.preferences.languages,
       excludeRepos: this.state.preferences.excludeRepos,
       excludeOrgs: this.state.preferences.excludeOrgs,
+      aiPolicyBlocklist: this.state.preferences.aiPolicyBlocklist,
       splitRatio: options?.splitRatio ?? this.state.preferences.featuresSplitRatio
     }) : await discoverFeatures({
       octokit,
       vetter,
       repoScores: this.state.repoScores ?? {},
       count,
+      excludeRepos: this.state.preferences.excludeRepos,
+      excludeOrgs: this.state.preferences.excludeOrgs,
+      aiPolicyBlocklist: this.state.preferences.aiPolicyBlocklist,
       anchorThreshold: options?.anchorThreshold ?? this.state.preferences.featuresAnchorThreshold,
       splitRatio: options?.splitRatio ?? this.state.preferences.featuresSplitRatio
     });
@@ -39902,6 +40590,7 @@ var OssScout = class {
     }
     if (this.persistLocal) {
       try {
+        this.state = mergeStates(this.state, loadLocalState());
         saveLocalState(this.state);
       } catch {
         return false;
@@ -40038,6 +40727,8 @@ function applyPreferenceField(preferences, key, value) {
   const prefs = { ...preferences };
   switch (field.type) {
     case "string":
+      if (key === "slmTriageHost")
+        assertValidTriageHost(value);
       prefs[key] = value;
       break;
     case "boolean":
@@ -40117,7 +40808,7 @@ function registerTools(server, scout) {
     "search",
     "Search for open source issues matching your preferences",
     {
-      maxResults: external_exports3.number().optional().describe("Maximum number of results to return (default 10)"),
+      maxResults: external_exports3.number().int().min(1).max(100).optional().describe("Maximum number of results to return (1-100, default 10)"),
       strategies: external_exports3.string().optional().describe(
         "Comma-separated search strategies: merged, starred, broad, maintained, all"
       ),
@@ -40147,7 +40838,16 @@ function registerTools(server, scout) {
       diversityRatio
     }) => {
       try {
-        const parsedStrategies = strategies ? strategies.split(",").map((s) => SearchStrategySchema.parse(s.trim())) : void 0;
+        const parsedStrategies = strategies ? strategies.split(",").map((s) => {
+          const trimmed = s.trim();
+          const parsed = SearchStrategySchema.safeParse(trimmed);
+          if (!parsed.success) {
+            throw new Error(
+              `Invalid strategy "${trimmed}". Valid strategies: ${SearchStrategySchema.options.join(", ")}`
+            );
+          }
+          return parsed.data;
+        }) : void 0;
         const result = await withTimeout(
           scout.search({
             maxResults: maxResults ?? 10,
@@ -40190,7 +40890,7 @@ function registerTools(server, scout) {
     "scout-features",
     "Surface feature-scoped contribution opportunities in repos where you have 3+ merged PRs",
     {
-      maxResults: external_exports3.number().optional().describe("Maximum number of results to return (default 10)"),
+      maxResults: external_exports3.number().int().min(1).max(50).optional().describe("Maximum number of results to return (1-50, default 10)"),
       anchorThreshold: external_exports3.number().int().min(1).max(50).optional().describe("Anchor threshold override (default 3)"),
       splitRatio: external_exports3.number().min(0).max(1).optional().describe("Quick-wins/bigger-bets split ratio (default 0.6)")
     },
@@ -40457,7 +41157,7 @@ function registerResources(server, scout) {
 // src/index.ts
 var SERVER_INFO = {
   name: "oss-scout-mcp",
-  version: "0.10.0"
+  version: "0.10.2"
   // x-release-please-version
 };
 function createServer(scout) {