@probelabs/visor 0.1.130 → 0.1.131

package/dist/sdk/sdk.js

@@ -641,6 +641,205 @@ var init_fallback_ndjson = __esm({
   }
 });
 
+// package.json
+var require_package = __commonJS({
+  "package.json"(exports2, module2) {
+    module2.exports = {
+      name: "@probelabs/visor",
+      version: "0.1.131",
+      main: "dist/index.js",
+      bin: {
+        visor: "./dist/index.js"
+      },
+      exports: {
+        ".": {
+          require: "./dist/index.js",
+          import: "./dist/index.js"
+        },
+        "./sdk": {
+          types: "./dist/sdk/sdk.d.ts",
+          import: "./dist/sdk/sdk.mjs",
+          require: "./dist/sdk/sdk.js"
+        },
+        "./cli": {
+          require: "./dist/index.js"
+        }
+      },
+      files: [
+        "dist/",
+        "defaults/",
+        "action.yml",
+        "README.md",
+        "LICENSE"
+      ],
+      publishConfig: {
+        access: "public",
+        registry: "https://registry.npmjs.org/"
+      },
+      scripts: {
+        "build:cli": "ncc build src/index.ts -o dist && cp -r defaults dist/ && cp -r output dist/ && cp -r docs dist/ && cp -r examples dist/ && cp -r src/debug-visualizer/ui dist/debug-visualizer/ && node scripts/inject-version.js && echo '#!/usr/bin/env node' | cat - dist/index.js > temp && mv temp dist/index.js && chmod +x dist/index.js",
+        "build:sdk": "tsup src/sdk.ts --dts --sourcemap --format esm,cjs --out-dir dist/sdk",
+        build: "./scripts/build-oss.sh",
+        "build:ee": "npm run build:cli && npm run build:sdk",
+        test: "jest && npm run test:yaml",
+        "test:unit": "jest",
+        prepublishOnly: "npm run build",
+        "test:watch": "jest --watch",
+        "test:coverage": "jest --coverage",
+        "test:ee": "jest --testPathPatterns='tests/ee' --testPathIgnorePatterns='/node_modules/' --no-coverage",
+        "test:manual:bash": "RUN_MANUAL_TESTS=true jest tests/manual/bash-config-manual.test.ts",
+        lint: "eslint src tests --ext .ts",
+        "lint:fix": "eslint src tests --ext .ts --fix",
+        format: "prettier --write src tests",
+        "format:check": "prettier --check src tests",
+        clean: "",
+        prebuild: "npm run clean && node scripts/generate-config-schema.js",
+        pretest: "node scripts/generate-config-schema.js && npm run build:cli",
+        "pretest:unit": "node scripts/generate-config-schema.js && npm run build:cli",
+        "test:with-build": "npm run build:cli && jest",
+        "test:yaml": "node dist/index.js test --progress compact",
+        "test:yaml:parallel": "node dist/index.js test --progress compact --max-parallel 4",
+        prepare: "husky",
+        "pre-commit": "lint-staged",
+        "deploy:site": "cd site && npx wrangler pages deploy . --project-name=visor-site --commit-dirty=true",
+        "deploy:worker": "npx wrangler deploy",
+        deploy: "npm run deploy:site && npm run deploy:worker",
+        "publish:ee": "./scripts/publish-ee.sh",
+        release: "./scripts/release.sh",
+        "release:patch": "./scripts/release.sh patch",
+        "release:minor": "./scripts/release.sh minor",
+        "release:major": "./scripts/release.sh major",
+        "release:prerelease": "./scripts/release.sh prerelease",
+        "docs:validate": "node scripts/validate-readme-links.js",
+        "workshop:setup": "npm install -D reveal-md@6.1.2",
+        "workshop:serve": "cd workshop && reveal-md slides.md -w",
+        "workshop:export": "reveal-md workshop/slides.md --static workshop/build",
+        "workshop:pdf": "reveal-md workshop/slides.md --print workshop/Visor-Workshop.pdf --print-size letter",
+        "workshop:pdf:ci": 'reveal-md workshop/slides.md --print workshop/Visor-Workshop.pdf --print-size letter --puppeteer-launch-args="--no-sandbox --disable-dev-shm-usage"',
+        "workshop:pdf:a4": "reveal-md workshop/slides.md --print workshop/Visor-Workshop-A4.pdf --print-size A4",
+        "workshop:build": "npm run workshop:export && npm run workshop:pdf",
+        "simulate:issue": "TS_NODE_TRANSPILE_ONLY=1 ts-node scripts/simulate-gh-run.ts --event issues --action opened --debug",
+        "simulate:comment": "TS_NODE_TRANSPILE_ONLY=1 ts-node scripts/simulate-gh-run.ts --event issue_comment --action created --debug"
+      },
+      keywords: [
+        "code-review",
+        "ai",
+        "github-action",
+        "cli",
+        "pr-review",
+        "visor"
+      ],
+      author: "Probe Labs",
+      license: "MIT",
+      description: "AI-powered code review tool for GitHub Pull Requests - CLI and GitHub Action",
+      repository: {
+        type: "git",
+        url: "git+https://github.com/probelabs/visor.git"
+      },
+      bugs: {
+        url: "https://github.com/probelabs/visor/issues"
+      },
+      homepage: "https://github.com/probelabs/visor#readme",
+      dependencies: {
+        "@actions/core": "^1.11.1",
+        "@modelcontextprotocol/sdk": "^1.25.3",
+        "@nyariv/sandboxjs": "github:probelabs/SandboxJS#f1c13b8eee98734a8ea024061eada4aa9a9ff2e9",
+        "@octokit/action": "^8.0.2",
+        "@octokit/auth-app": "^8.1.0",
+        "@octokit/core": "^7.0.3",
+        "@octokit/rest": "^22.0.0",
+        "@probelabs/probe": "^0.6.0-rc232",
+        "@types/commander": "^2.12.0",
+        "@types/uuid": "^10.0.0",
+        ajv: "^8.17.1",
+        "ajv-formats": "^3.0.1",
+        "better-sqlite3": "^11.0.0",
+        blessed: "^0.1.81",
+        "cli-table3": "^0.6.5",
+        commander: "^14.0.0",
+        dotenv: "^17.2.3",
+        ignore: "^7.0.5",
+        "js-yaml": "^4.1.0",
+        liquidjs: "^10.21.1",
+        "node-cron": "^3.0.3",
+        open: "^9.1.0",
+        "simple-git": "^3.28.0",
+        uuid: "^11.1.0",
+        ws: "^8.18.3"
+      },
+      optionalDependencies: {
+        "@anthropic/claude-code-sdk": "npm:null@*",
+        "@open-policy-agent/opa-wasm": "^1.10.0",
+        "@opentelemetry/api": "^1.9.0",
+        "@opentelemetry/core": "^1.30.1",
+        "@opentelemetry/exporter-trace-otlp-grpc": "^0.203.0",
+        "@opentelemetry/exporter-trace-otlp-http": "^0.203.0",
+        "@opentelemetry/instrumentation": "^0.203.0",
+        "@opentelemetry/resources": "^1.30.1",
+        "@opentelemetry/sdk-metrics": "^1.30.1",
+        "@opentelemetry/sdk-node": "^0.203.0",
+        "@opentelemetry/sdk-trace-base": "^1.30.1",
+        "@opentelemetry/semantic-conventions": "^1.30.1",
+        knex: "^3.1.0",
+        mysql2: "^3.11.0",
+        pg: "^8.13.0",
+        tedious: "^19.0.0"
+      },
+      devDependencies: {
+        "@eslint/js": "^9.34.0",
+        "@kie/act-js": "^2.6.2",
+        "@kie/mock-github": "^2.0.1",
+        "@swc/core": "^1.13.2",
+        "@swc/jest": "^0.2.37",
+        "@types/better-sqlite3": "^7.6.0",
+        "@types/blessed": "^0.1.27",
+        "@types/jest": "^30.0.0",
+        "@types/js-yaml": "^4.0.9",
+        "@types/node": "^24.3.0",
+        "@types/node-cron": "^3.0.11",
+        "@types/ws": "^8.18.1",
+        "@typescript-eslint/eslint-plugin": "^8.42.0",
+        "@typescript-eslint/parser": "^8.42.0",
+        "@vercel/ncc": "^0.38.4",
+        eslint: "^9.34.0",
+        "eslint-config-prettier": "^10.1.8",
+        "eslint-plugin-prettier": "^5.5.4",
+        husky: "^9.1.7",
+        jest: "^30.1.3",
+        "lint-staged": "^16.1.6",
+        prettier: "^3.6.2",
+        "reveal-md": "^6.1.2",
+        "ts-json-schema-generator": "^1.5.1",
+        "ts-node": "^10.9.2",
+        tsup: "^8.5.0",
+        typescript: "^5.9.2",
+        wrangler: "^3.0.0"
+      },
+      peerDependenciesMeta: {
+        "@anthropic/claude-code-sdk": {
+          optional: true
+        }
+      },
+      directories: {
+        test: "tests"
+      },
+      "lint-staged": {
+        "src/**/*.{ts,js}": [
+          "eslint --fix",
+          "prettier --write"
+        ],
+        "tests/**/*.{ts,js}": [
+          "eslint --fix",
+          "prettier --write"
+        ],
+        "*.{json,md,yml,yaml}": [
+          "prettier --write"
+        ]
+      }
+    };
+  }
+});
+
 // src/telemetry/trace-helpers.ts
 var trace_helpers_exports = {};
 __export(trace_helpers_exports, {
@@ -648,6 +847,7 @@ __export(trace_helpers_exports, {
   _appendRunMarker: () => _appendRunMarker,
   addEvent: () => addEvent,
   getTracer: () => getTracer,
+  getVisorRunAttributes: () => getVisorRunAttributes,
   setSpanAttributes: () => setSpanAttributes,
   setSpanError: () => setSpanError,
   withActiveSpan: () => withActiveSpan
@@ -717,20 +917,37 @@ function setSpanError(err) {
   } catch {
   }
 }
+function getVisorRunAttributes() {
+  const attrs = {};
+  try {
+    attrs["visor.version"] = process.env.VISOR_VERSION || (require_package()?.version ?? "dev");
+  } catch {
+    attrs["visor.version"] = "dev";
+  }
+  const commitShort = process.env.VISOR_COMMIT_SHORT || "";
+  const commitFull = process.env.VISOR_COMMIT_SHA || process.env.VISOR_COMMIT || "";
+  if (commitShort) {
+    attrs["visor.commit"] = commitShort;
+  }
+  if (commitFull) {
+    attrs["visor.commit.sha"] = commitFull;
+  }
+  return attrs;
+}
 function __getOrCreateNdjsonPath() {
   try {
     if (process.env.VISOR_TELEMETRY_SINK && process.env.VISOR_TELEMETRY_SINK !== "file")
       return null;
     const path25 = require("path");
-    const fs22 = require("fs");
+    const fs21 = require("fs");
     if (process.env.VISOR_FALLBACK_TRACE_FILE) {
       __ndjsonPath = process.env.VISOR_FALLBACK_TRACE_FILE;
       const dir = path25.dirname(__ndjsonPath);
-      if (!fs22.existsSync(dir)) fs22.mkdirSync(dir, { recursive: true });
+      if (!fs21.existsSync(dir)) fs21.mkdirSync(dir, { recursive: true });
       return __ndjsonPath;
     }
     const outDir = process.env.VISOR_TRACE_DIR || path25.join(process.cwd(), "output", "traces");
-    if (!fs22.existsSync(outDir)) fs22.mkdirSync(outDir, { recursive: true });
+    if (!fs21.existsSync(outDir)) fs21.mkdirSync(outDir, { recursive: true });
     if (!__ndjsonPath) {
       const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
       __ndjsonPath = path25.join(outDir, `${ts}.ndjson`);
@@ -742,11 +959,11 @@ function __getOrCreateNdjsonPath() {
 }
 function _appendRunMarker() {
   try {
-    const fs22 = require("fs");
+    const fs21 = require("fs");
     const p = __getOrCreateNdjsonPath();
     if (!p) return;
     const line = { name: "visor.run", attributes: { started: true } };
-    fs22.appendFileSync(p, JSON.stringify(line) + "\n", "utf8");
+    fs21.appendFileSync(p, JSON.stringify(line) + "\n", "utf8");
   } catch {
   }
 }
@@ -3709,25 +3926,45 @@ function createExtendedLiquid(options = {}) {
   configureLiquidWithExtensions(liquid);
   return liquid;
 }
-var import_liquidjs, import_async_hooks, import_promises2, import_path2, ReadFileTag, permissionsALS;
+var import_liquidjs, import_async_hooks, import_path2, ReadFileTag, permissionsALS;
 var init_liquid_extensions = __esm({
   "src/liquid-extensions.ts"() {
     "use strict";
     import_liquidjs = require("liquidjs");
     import_async_hooks = require("async_hooks");
-    import_promises2 = __toESM(require("fs/promises"));
     import_path2 = __toESM(require("path"));
     init_author_permissions();
     init_memory_store();
     init_sandbox();
     ReadFileTag = class extends import_liquidjs.Tag {
       filepath;
+      indentValue = null;
       constructor(token, remainTokens, liquid) {
         super(token, remainTokens, liquid);
-        this.filepath = new import_liquidjs.Value(token.args, liquid);
+        const argsStr = token.args.trim();
+        const indentMatch = argsStr.match(/^(.+?)\s+indent:\s*(\d+)\s*$/);
+        if (indentMatch) {
+          this.filepath = new import_liquidjs.Value(indentMatch[1].trim(), liquid);
+          this.indentValue = new import_liquidjs.Value(indentMatch[2], liquid);
+        } else {
+          this.filepath = new import_liquidjs.Value(argsStr, liquid);
+        }
       }
       *render(ctx, emitter) {
         const filePath = yield this.filepath.value(ctx, false);
+        let indent = 0;
+        if (this.indentValue) {
+          const indentAmount = yield this.indentValue.value(ctx, false);
+          indent = typeof indentAmount === "number" ? indentAmount : parseInt(String(indentAmount), 10) || 0;
+        } else {
+          const output = emitter.buffer || "";
+          const lastNewline = output.lastIndexOf("\n");
+          if (lastNewline >= 0) {
+            const lineStart = output.substring(lastNewline + 1);
+            const match = lineStart.match(/^(\s*)/);
+            indent = match ? match[1].length : 0;
+          }
+        }
         if (!filePath || typeof filePath !== "string") {
           emitter.write("[Error: Invalid file path]");
           return;
@@ -3741,7 +3978,12 @@ var init_liquid_extensions = __esm({
           return;
         }
         try {
-          const content = yield import_promises2.default.readFile(resolvedPath, "utf-8");
+          let content = require("fs").readFileSync(resolvedPath, "utf-8");
+          if (indent > 0) {
+            const indentStr = " ".repeat(indent);
+            const lines = content.split("\n");
+            content = lines.map((line, i) => i === 0 ? line : indentStr + line).join("\n");
+          }
           emitter.write(content);
         } catch (error) {
           const errorMessage = error instanceof Error ? error.message : error?.code || "Unknown error";
@@ -5453,14 +5695,14 @@ function emitMermaidFromMarkdown(checkName, markdown, origin) {
         if (process.env.VISOR_TRACE_REPORT === "true") {
           const outDir = process.env.VISOR_TRACE_DIR || path4.join(process.cwd(), "output", "traces");
           try {
-            if (!fs4.existsSync(outDir)) fs4.mkdirSync(outDir, { recursive: true });
+            if (!fs3.existsSync(outDir)) fs3.mkdirSync(outDir, { recursive: true });
             const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
             const jsonPath = path4.join(outDir, `${ts}.trace.json`);
             const htmlPath = path4.join(outDir, `${ts}.report.html`);
             let data = { spans: [] };
-            if (fs4.existsSync(jsonPath)) {
+            if (fs3.existsSync(jsonPath)) {
               try {
-                data = JSON.parse(fs4.readFileSync(jsonPath, "utf8"));
+                data = JSON.parse(fs3.readFileSync(jsonPath, "utf8"));
               } catch {
                 data = { spans: [] };
               }
@@ -5468,9 +5710,9 @@ function emitMermaidFromMarkdown(checkName, markdown, origin) {
             data.spans.push({
               events: [{ name: "diagram.block", attrs: { check: checkName, origin, code } }]
             });
-            fs4.writeFileSync(jsonPath, JSON.stringify(data, null, 2), "utf8");
-            if (!fs4.existsSync(htmlPath)) {
-              fs4.writeFileSync(
+            fs3.writeFileSync(jsonPath, JSON.stringify(data, null, 2), "utf8");
+            if (!fs3.existsSync(htmlPath)) {
+              fs3.writeFileSync(
                 htmlPath,
                 '<!doctype html><html><head><meta charset="utf-8"/><title>Visor Trace Report</title></head><body><h2>Visor Trace Report</h2></body></html>',
                 "utf8"
@@ -5486,13 +5728,13 @@ function emitMermaidFromMarkdown(checkName, markdown, origin) {
   }
   return count;
 }
-var fs4, path4, MERMAID_RE;
+var fs3, path4, MERMAID_RE;
 var init_mermaid_telemetry = __esm({
   "src/utils/mermaid-telemetry.ts"() {
     "use strict";
     init_trace_helpers();
     init_metrics();
-    fs4 = __toESM(require("fs"));
+    fs3 = __toESM(require("fs"));
     path4 = __toESM(require("path"));
     MERMAID_RE = /```mermaid\s*\n([\s\S]*?)\n```/gi;
   }
@@ -6130,7 +6372,7 @@ var init_dependency_gating = __esm({
 async function renderTemplateContent(checkId, checkConfig, reviewSummary) {
   try {
     const { createExtendedLiquid: createExtendedLiquid2 } = await Promise.resolve().then(() => (init_liquid_extensions(), liquid_extensions_exports));
-    const fs22 = await import("fs/promises");
+    const fs21 = await import("fs/promises");
     const path25 = await import("path");
     const schemaRaw = checkConfig.schema || "plain";
     const schema = typeof schemaRaw === "string" ? schemaRaw : "code-review";
@@ -6140,7 +6382,7 @@ async function renderTemplateContent(checkId, checkConfig, reviewSummary) {
     } else if (checkConfig.template && checkConfig.template.file) {
       const file = String(checkConfig.template.file);
       const resolved = path25.resolve(process.cwd(), file);
-      templateContent = await fs22.readFile(resolved, "utf-8");
+      templateContent = await fs21.readFile(resolved, "utf-8");
     } else if (schema && schema !== "plain") {
       const sanitized = String(schema).replace(/[^a-zA-Z0-9-]/g, "");
       if (sanitized) {
@@ -6156,7 +6398,7 @@ async function renderTemplateContent(checkId, checkConfig, reviewSummary) {
         ];
         for (const p of candidatePaths) {
           try {
-            templateContent = await fs22.readFile(p, "utf-8");
+            templateContent = await fs21.readFile(p, "utf-8");
             if (templateContent) break;
           } catch {
           }
@@ -6312,8 +6554,8 @@ async function initializeTracer(sessionId, checkName) {
       const sanitizedCheckName = checkName ? path5.basename(checkName) : "check";
       const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
       const traceDir = process.env.GITHUB_WORKSPACE ? path5.join(process.env.GITHUB_WORKSPACE, "debug-artifacts") : path5.join(process.cwd(), "debug-artifacts");
-      if (!fs5.existsSync(traceDir)) {
-        fs5.mkdirSync(traceDir, { recursive: true });
+      if (!fs4.existsSync(traceDir)) {
+        fs4.mkdirSync(traceDir, { recursive: true });
       }
       const traceFilePath = path5.join(traceDir, `trace-${sanitizedCheckName}-${timestamp}.jsonl`);
       const resolvedTracePath = path5.resolve(traceFilePath);
@@ -6358,12 +6600,12 @@ async function initializeTracer(sessionId, checkName) {
     return null;
   }
 }
-var path5, fs5;
+var path5, fs4;
 var init_tracer_init = __esm({
   "src/utils/tracer-init.ts"() {
     "use strict";
     path5 = __toESM(require("path"));
-    fs5 = __toESM(require("fs"));
+    fs4 = __toESM(require("fs"));
   }
 });
 
@@ -6561,7 +6803,7 @@ async function processDiffWithOutline(diffContent) {
   }
   try {
     const originalProbePath = process.env.PROBE_PATH;
-    const fs22 = require("fs");
+    const fs21 = require("fs");
     const possiblePaths = [
       // Relative to current working directory (most common in production)
       path6.join(process.cwd(), "node_modules/@probelabs/probe/bin/probe-binary"),
@@ -6572,7 +6814,7 @@ async function processDiffWithOutline(diffContent) {
     ];
     let probeBinaryPath;
     for (const candidatePath of possiblePaths) {
-      if (fs22.existsSync(candidatePath)) {
+      if (fs21.existsSync(candidatePath)) {
         probeBinaryPath = candidatePath;
         break;
       }
@@ -7129,6 +7371,8 @@ var init_ai_review_service = __esm({
         const isCodeReviewSchema = schema === "code-review";
         const prContext = skipPRContext ? "" : await this.formatPRContext(prInfo, isCodeReviewSchema);
         const slackContextXml = skipSlackContext === true ? "" : this.formatSlackContextFromPRInfo(prInfo);
+        const traceIdXml = prInfo.otelTraceId ? `
+    <trace_id>${this.escapeXml(String(prInfo.otelTraceId))}</trace_id>` : "";
         const isIssue = prInfo.isIssue === true;
         if (isIssue) {
           if (skipPRContext && !slackContextXml) {
@@ -7142,7 +7386,7 @@ ${customInstructions}
   </instructions>
 
   <context>
-    ${getCurrentDateXml()}
+    ${getCurrentDateXml()}${traceIdXml}
 ${prContext}${slackContextXml}
   </context>
 
@@ -7184,7 +7428,7 @@ ${customInstructions}
   </instructions>
 
   <context>
-    ${getCurrentDateXml()}
+    ${getCurrentDateXml()}${traceIdXml}
 ${prContext}${slackContextXml}
   </context>
 
@@ -7212,7 +7456,7 @@ ${customInstructions}
 </instructions>
 
 <context>
-  ${getCurrentDateXml()}
+  ${getCurrentDateXml()}${traceIdXml}
 ${prContext}${slackContextXml}
 </context>`;
       }
@@ -7637,7 +7881,7 @@ ${schemaString}`);
           }
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs22 = require("fs");
+              const fs21 = require("fs");
               const path25 = require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const provider = this.config.provider || "auto";
@@ -7753,19 +7997,19 @@ ${"=".repeat(60)}
               readableVersion += `${"=".repeat(60)}
 `;
               const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path25.join(process.cwd(), "debug-artifacts");
-              if (!fs22.existsSync(debugArtifactsDir)) {
-                fs22.mkdirSync(debugArtifactsDir, { recursive: true });
+              if (!fs21.existsSync(debugArtifactsDir)) {
+                fs21.mkdirSync(debugArtifactsDir, { recursive: true });
               }
               const debugFile = path25.join(
                 debugArtifactsDir,
                 `prompt-${_checkName || "unknown"}-${timestamp}.json`
               );
-              fs22.writeFileSync(debugFile, debugJson, "utf-8");
+              fs21.writeFileSync(debugFile, debugJson, "utf-8");
               const readableFile = path25.join(
                 debugArtifactsDir,
                 `prompt-${_checkName || "unknown"}-${timestamp}.txt`
               );
-              fs22.writeFileSync(readableFile, readableVersion, "utf-8");
+              fs21.writeFileSync(readableFile, readableVersion, "utf-8");
               log(`
 \u{1F4BE} Full debug info saved to:`);
               log(`   JSON: ${debugFile}`);
@@ -7798,7 +8042,7 @@ ${"=".repeat(60)}
           log(`\u{1F4E4} Response length: ${response.length} characters`);
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs22 = require("fs");
+              const fs21 = require("fs");
               const path25 = require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const agentAny2 = agent;
@@ -7823,7 +8067,7 @@ ${"=".repeat(60)}
                 schema: effectiveSchema,
                 totalMessages: fullHistory.length
               };
-              fs22.writeFileSync(sessionBase + ".json", JSON.stringify(sessionData, null, 2), "utf-8");
+              fs21.writeFileSync(sessionBase + ".json", JSON.stringify(sessionData, null, 2), "utf-8");
               let readable = `=============================================================
 `;
               readable += `COMPLETE AI SESSION HISTORY (AFTER RESPONSE)
@@ -7850,7 +8094,7 @@ ${"=".repeat(60)}
 `;
                 readable += content + "\n";
               });
-              fs22.writeFileSync(sessionBase + ".summary.txt", readable, "utf-8");
+              fs21.writeFileSync(sessionBase + ".summary.txt", readable, "utf-8");
               log(`\u{1F4BE} Complete session history saved:`);
               log(`   - Contains ALL ${fullHistory.length} messages (prompts + responses)`);
             } catch (error) {
@@ -7859,7 +8103,7 @@ ${"=".repeat(60)}
           }
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs22 = require("fs");
+              const fs21 = require("fs");
               const path25 = require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path25.join(process.cwd(), "debug-artifacts");
@@ -7896,7 +8140,7 @@ ${"=".repeat(60)}
 `;
               responseContent += `${"=".repeat(60)}
 `;
-              fs22.writeFileSync(responseFile, responseContent, "utf-8");
+              fs21.writeFileSync(responseFile, responseContent, "utf-8");
               log(`\u{1F4BE} Response saved to: ${responseFile}`);
             } catch (error) {
               log(`\u26A0\uFE0F Could not save response file: ${error}`);
@@ -7912,9 +8156,9 @@ ${"=".repeat(60)}
                 await agentAny._telemetryConfig.shutdown();
                 log(`\u{1F4CA} OpenTelemetry trace saved to: ${agentAny._traceFilePath}`);
                 if (process.env.GITHUB_ACTIONS) {
-                  const fs22 = require("fs");
-                  if (fs22.existsSync(agentAny._traceFilePath)) {
-                    const stats = fs22.statSync(agentAny._traceFilePath);
+                  const fs21 = require("fs");
+                  if (fs21.existsSync(agentAny._traceFilePath)) {
+                    const stats = fs21.statSync(agentAny._traceFilePath);
                     console.log(
                       `::notice title=AI Trace Saved::${agentAny._traceFilePath} (${stats.size} bytes)`
                     );
@@ -8046,6 +8290,9 @@ ${"=".repeat(60)}
           if (this.config.completionPrompt !== void 0) {
             options.completionPrompt = this.config.completionPrompt;
           }
+          if (this.config.concurrencyLimiter) {
+            options.concurrencyLimiter = this.config.concurrencyLimiter;
+          }
           try {
             const cfgAny = this.config;
             const allowedFolders = cfgAny.allowedFolders;
@@ -8109,7 +8356,7 @@ ${schemaString}`);
           const model = this.config.model || "default";
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs22 = require("fs");
+              const fs21 = require("fs");
               const path25 = require("path");
               const os2 = require("os");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
@@ -8185,7 +8432,7 @@ ${"=".repeat(60)}
 `;
               const tempDir = os2.tmpdir();
               const promptFile = path25.join(tempDir, `visor-prompt-${timestamp}.txt`);
-              fs22.writeFileSync(promptFile, prompt, "utf-8");
+              fs21.writeFileSync(promptFile, prompt, "utf-8");
               log(`
 \u{1F4BE} Prompt saved to: ${promptFile}`);
               const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path25.join(process.cwd(), "debug-artifacts");
@@ -8194,8 +8441,8 @@ ${"=".repeat(60)}
                   debugArtifactsDir,
                   `prompt-${_checkName || "unknown"}-${timestamp}`
                 );
-                fs22.writeFileSync(base + ".json", debugJson, "utf-8");
-                fs22.writeFileSync(base + ".summary.txt", readableVersion, "utf-8");
+                fs21.writeFileSync(base + ".json", debugJson, "utf-8");
+                fs21.writeFileSync(base + ".summary.txt", readableVersion, "utf-8");
                 log(`
 \u{1F4BE} Full debug info saved to directory: ${debugArtifactsDir}`);
               } catch {
@@ -8240,7 +8487,7 @@ $ ${cliCommand}
           log(`\u{1F4E4} Response length: ${response.length} characters`);
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs22 = require("fs");
+              const fs21 = require("fs");
               const path25 = require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const agentAny = agent;
@@ -8265,7 +8512,7 @@ $ ${cliCommand}
                 schema: effectiveSchema,
                 totalMessages: fullHistory.length
               };
-              fs22.writeFileSync(sessionBase + ".json", JSON.stringify(sessionData, null, 2), "utf-8");
+              fs21.writeFileSync(sessionBase + ".json", JSON.stringify(sessionData, null, 2), "utf-8");
               let readable = `=============================================================
 `;
               readable += `COMPLETE AI SESSION HISTORY (AFTER RESPONSE)
@@ -8292,7 +8539,7 @@ ${"=".repeat(60)}
 `;
                 readable += content + "\n";
               });
-              fs22.writeFileSync(sessionBase + ".summary.txt", readable, "utf-8");
+              fs21.writeFileSync(sessionBase + ".summary.txt", readable, "utf-8");
               log(`\u{1F4BE} Complete session history saved:`);
               log(`   - Contains ALL ${fullHistory.length} messages (prompts + responses)`);
             } catch (error) {
@@ -8301,7 +8548,7 @@ ${"=".repeat(60)}
           }
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs22 = require("fs");
+              const fs21 = require("fs");
               const path25 = require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path25.join(process.cwd(), "debug-artifacts");
@@ -8338,7 +8585,7 @@ ${"=".repeat(60)}
 `;
               responseContent += `${"=".repeat(60)}
 `;
-              fs22.writeFileSync(responseFile, responseContent, "utf-8");
+              fs21.writeFileSync(responseFile, responseContent, "utf-8");
               log(`\u{1F4BE} Response saved to: ${responseFile}`);
             } catch (error) {
               log(`\u26A0\uFE0F Could not save response file: ${error}`);
@@ -8356,9 +8603,9 @@ ${"=".repeat(60)}
                 await telemetry.shutdown();
                 log(`\u{1F4CA} OpenTelemetry trace saved to: ${traceFilePath}`);
                 if (process.env.GITHUB_ACTIONS) {
-                  const fs22 = require("fs");
-                  if (fs22.existsSync(traceFilePath)) {
-                    const stats = fs22.statSync(traceFilePath);
+                  const fs21 = require("fs");
+                  if (fs21.existsSync(traceFilePath)) {
+                    const stats = fs21.statSync(traceFilePath);
                     console.log(
                       `::notice title=AI Trace Saved::OpenTelemetry trace file size: ${stats.size} bytes`
                     );
@@ -8396,7 +8643,7 @@ ${"=".repeat(60)}
        * Load schema content from schema files or inline definitions
        */
       async loadSchemaContent(schema) {
-        const fs22 = require("fs").promises;
+        const fs21 = require("fs").promises;
         const path25 = require("path");
         if (typeof schema === "object" && schema !== null) {
           log("\u{1F4CB} Using inline schema object from configuration");
@@ -8417,7 +8664,7 @@ ${"=".repeat(60)}
           try {
             const schemaPath = path25.resolve(process.cwd(), schema);
             log(`\u{1F4CB} Loading custom schema from file: ${schemaPath}`);
-            const schemaContent = await fs22.readFile(schemaPath, "utf-8");
+            const schemaContent = await fs21.readFile(schemaPath, "utf-8");
             return schemaContent.trim();
           } catch (error) {
             throw new Error(
@@ -8439,7 +8686,7 @@ ${"=".repeat(60)}
         ];
         for (const schemaPath of candidatePaths) {
           try {
-            const schemaContent = await fs22.readFile(schemaPath, "utf-8");
+            const schemaContent = await fs21.readFile(schemaPath, "utf-8");
             return schemaContent.trim();
           } catch {
           }
@@ -8846,11 +9093,11 @@ var issue_filter_exports = {};
 __export(issue_filter_exports, {
   IssueFilter: () => IssueFilter
 });
-var fs6, path7, IssueFilter;
+var fs5, path7, IssueFilter;
 var init_issue_filter = __esm({
   "src/issue-filter.ts"() {
     "use strict";
-    fs6 = __toESM(require("fs"));
+    fs5 = __toESM(require("fs"));
     path7 = __toESM(require("path"));
     IssueFilter = class {
       fileCache = /* @__PURE__ */ new Map();
@@ -8920,16 +9167,16 @@ var init_issue_filter = __esm({
         }
         try {
           const resolvedPath = path7.isAbsolute(filePath) ? filePath : path7.join(workingDir, filePath);
-          if (!fs6.existsSync(resolvedPath)) {
-            if (fs6.existsSync(filePath)) {
-              const content2 = fs6.readFileSync(filePath, "utf8");
+          if (!fs5.existsSync(resolvedPath)) {
+            if (fs5.existsSync(filePath)) {
+              const content2 = fs5.readFileSync(filePath, "utf8");
               const lines2 = content2.split("\n");
               this.fileCache.set(filePath, lines2);
               return lines2;
             }
             return null;
           }
-          const content = fs6.readFileSync(resolvedPath, "utf8");
+          const content = fs5.readFileSync(resolvedPath, "utf8");
           const lines = content.split("\n");
           this.fileCache.set(filePath, lines);
           return lines;
@@ -10369,11 +10616,11 @@ var init_config_merger = __esm({
 });
 
 // src/utils/config-loader.ts
-var fs8, path9, yaml2, ConfigLoader;
+var fs7, path9, yaml2, ConfigLoader;
 var init_config_loader = __esm({
   "src/utils/config-loader.ts"() {
     "use strict";
-    fs8 = __toESM(require("fs"));
+    fs7 = __toESM(require("fs"));
     path9 = __toESM(require("path"));
     yaml2 = __toESM(require("js-yaml"));
     ConfigLoader = class {
@@ -10468,7 +10715,7 @@ var init_config_loader = __esm({
         const resolvedPath = path9.resolve(basePath, filePath);
         this.validateLocalPath(resolvedPath);
         try {
-          const content = fs8.readFileSync(resolvedPath, "utf8");
+          const content = fs7.readFileSync(resolvedPath, "utf8");
           const config = yaml2.load(content);
           if (!config || typeof config !== "object") {
             throw new Error(`Invalid YAML in configuration file: ${resolvedPath}`);
@@ -10573,14 +10820,14 @@ var init_config_loader = __esm({
         ].filter((p) => p);
         let defaultConfigPath;
         for (const possiblePath of possiblePaths) {
-          if (fs8.existsSync(possiblePath)) {
+          if (fs7.existsSync(possiblePath)) {
             defaultConfigPath = possiblePath;
             break;
           }
         }
         if (defaultConfigPath) {
           console.error(`\u{1F4E6} Loading bundled default configuration from ${defaultConfigPath}`);
-          const content = fs8.readFileSync(defaultConfigPath, "utf8");
+          const content = fs7.readFileSync(defaultConfigPath, "utf8");
           let config = yaml2.load(content);
           if (!config || typeof config !== "object") {
             throw new Error("Invalid default configuration");
@@ -10701,9 +10948,9 @@ var init_config_loader = __esm({
         const root = path9.parse(currentDir).root;
         while (currentDir !== root) {
           const packageJsonPath = path9.join(currentDir, "package.json");
-          if (fs8.existsSync(packageJsonPath)) {
+          if (fs7.existsSync(packageJsonPath)) {
             try {
-              const packageJson = JSON.parse(fs8.readFileSync(packageJsonPath, "utf8"));
+              const packageJson = JSON.parse(fs7.readFileSync(packageJsonPath, "utf8"));
               if (packageJson.name === "@probelabs/visor") {
                 return currentDir;
               }
@@ -11222,6 +11469,10 @@ var init_config_schema = __esm({
               type: "string",
               description: "JavaScript expression to dynamically compute custom tools for this AI check. Expression has access to: outputs, inputs, pr, files, env, memory Must return an array of tool names (strings) or WorkflowToolReference objects ({ workflow: string, args?: Record<string, unknown> })\n\nExample: ``` const tools = []; if (outputs['route-intent'].intent === 'engineer') {   tools.push({ workflow: 'engineer', args: { projects: ['tyk'] } }); } return tools; ```"
             },
+            ai_bash_config_js: {
+              type: "string",
+              description: "JavaScript expression to dynamically compute bash configuration for this AI check. Expression has access to: outputs, inputs, pr, files, env, memory. Must return a BashConfig object with optional allow/deny string arrays.\n\nExample: ``` return outputs['build-config']?.bash_config ?? {}; ```"
+            },
             claude_code: {
               $ref: "#/definitions/ClaudeCodeConfig",
               description: "Claude Code configuration (for claude-code type checks)"
@@ -13126,12 +13377,12 @@ __export(config_exports, {
   ConfigManager: () => ConfigManager,
   VALID_EVENT_TRIGGERS: () => VALID_EVENT_TRIGGERS
 });
-var yaml3, fs9, path10, import_simple_git, import_ajv3, import_ajv_formats2, VALID_EVENT_TRIGGERS, ConfigManager, __ajvValidate, __ajvErrors;
+var yaml3, fs8, path10, import_simple_git, import_ajv3, import_ajv_formats2, VALID_EVENT_TRIGGERS, ConfigManager, __ajvValidate, __ajvErrors;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     yaml3 = __toESM(require("js-yaml"));
-    fs9 = __toESM(require("fs"));
+    fs8 = __toESM(require("fs"));
     path10 = __toESM(require("path"));
     init_logger();
     import_simple_git = __toESM(require("simple-git"));
@@ -13180,7 +13431,7 @@ var init_config = __esm({
         try {
           let configContent;
           try {
-            configContent = fs9.readFileSync(resolvedPath, "utf8");
+            configContent = fs8.readFileSync(resolvedPath, "utf8");
           } catch (readErr) {
             if (readErr && (readErr.code === "ENOENT" || readErr.code === "ENOTDIR")) {
               throw new Error(`Configuration file not found: ${resolvedPath}`);
@@ -13306,7 +13557,7 @@ var init_config = __esm({
           );
           for (const p of candidates) {
             try {
-              const st = fs9.statSync(p);
+              const st = fs8.statSync(p);
               if (!st.isFile()) continue;
               const isLegacy = path10.basename(p).startsWith(".");
               if (isLegacy) {
@@ -13390,7 +13641,7 @@ var init_config = __esm({
           }
           let bundledConfigPath;
           for (const possiblePath of possiblePaths) {
-            if (fs9.existsSync(possiblePath)) {
+            if (fs8.existsSync(possiblePath)) {
               bundledConfigPath = possiblePath;
               break;
             }
@@ -13398,7 +13649,7 @@ var init_config = __esm({
           if (bundledConfigPath) {
             console.error(`\u{1F4E6} Loading bundled default configuration from ${bundledConfigPath}`);
             const readAndParse = (p) => {
-              const raw = fs9.readFileSync(p, "utf8");
+              const raw = fs8.readFileSync(p, "utf8");
               const obj = yaml3.load(raw);
               if (!obj || typeof obj !== "object") return {};
               if (obj.include && !obj.extends) {
@@ -13446,9 +13697,9 @@ var init_config = __esm({
         let currentDir = __dirname;
         while (currentDir !== path10.dirname(currentDir)) {
           const packageJsonPath = path10.join(currentDir, "package.json");
-          if (fs9.existsSync(packageJsonPath)) {
+          if (fs8.existsSync(packageJsonPath)) {
             try {
-              const packageJson = JSON.parse(fs9.readFileSync(packageJsonPath, "utf8"));
+              const packageJson = JSON.parse(fs8.readFileSync(packageJsonPath, "utf8"));
               if (packageJson.name === "@probelabs/visor") {
                 return currentDir;
               }
@@ -14212,7 +14463,7 @@ ${errors}`);
         if (policy.engine === "local" && policy.rules) {
           const rulesPath = Array.isArray(policy.rules) ? policy.rules : [policy.rules];
           for (const rp of rulesPath) {
-            if (typeof rp === "string" && !fs9.existsSync(path10.resolve(rp))) {
+            if (typeof rp === "string" && !fs8.existsSync(path10.resolve(rp))) {
               warnings.push({
                 field: "policy.rules",
                 message: `Policy rules path does not exist: ${rp}. It will be resolved at runtime.`,
@@ -14262,7 +14513,7 @@ ${errors}`);
             });
           }
         }
-        if (policy.data && typeof policy.data === "string" && !fs9.existsSync(path10.resolve(policy.data))) {
+        if (policy.data && typeof policy.data === "string" && !fs8.existsSync(path10.resolve(policy.data))) {
           warnings.push({
             field: "policy.data",
             message: `Policy data file does not exist: ${policy.data}. It will be resolved at runtime.`,
@@ -15045,6 +15296,31 @@ var init_workflow_check_provider = __esm({
             `[WorkflowProvider]   NO WORKSPACE from parent - nested checkouts won't be added to workspace!`
           );
         }
+        const stepPrefix = config.checkName || workflow.id;
+        const parentExecCtx = parentContext?.executionContext;
+        let childExecCtx = parentExecCtx;
+        if (parentExecCtx?.hooks) {
+          const parentHooks = parentExecCtx.hooks;
+          childExecCtx = {
+            ...parentExecCtx,
+            hooks: {
+              ...parentHooks,
+              // Wrap onPromptCaptured: emit with prefixed step name so parent sees "route-intent.classify"
+              onPromptCaptured: parentHooks.onPromptCaptured ? (info) => {
+                parentHooks.onPromptCaptured({
+                  ...info,
+                  step: `${stepPrefix}.${info.step}`
+                });
+              } : void 0,
+              // Wrap mockForStep: try prefixed name first, fall back to unprefixed for backward compat
+              mockForStep: parentHooks.mockForStep ? (step) => {
+                const prefixed = parentHooks.mockForStep(`${stepPrefix}.${step}`);
+                if (prefixed !== void 0) return prefixed;
+                return parentHooks.mockForStep(step);
+              } : void 0
+            }
+          };
+        }
         const childContext = {
           mode: "state-machine",
           config: workflowConfig,
@@ -15066,9 +15342,9 @@ var init_workflow_check_provider = __esm({
           debug: parentContext?.debug || false,
           maxParallelism: parentContext?.maxParallelism,
           failFast: parentContext?.failFast,
-          // Propagate execution hooks (mocks, octokit, etc.) into the child so
-          // nested steps can be mocked/observed by the YAML test runner.
-          executionContext: parentContext?.executionContext,
+          // Propagate wrapped execution hooks (mocks, octokit, etc.) into the child so
+          // nested steps can be mocked/observed by the YAML test runner with dotted prefixes.
+          executionContext: childExecCtx,
           // Ensure all workflow steps are considered requested to avoid tag/event filtering surprises
           requestedChecks: Object.keys(checksMetadata)
         };
@@ -15082,6 +15358,26 @@ var init_workflow_check_provider = __esm({
           `[WorkflowProvider] Executing nested workflow '${workflow.id}' at depth ${currentDepth + 1}`
         );
         const result = await runner.run();
+        if (parentContext?.journal && parentContext?.sessionId) {
+          const parentJournal = parentContext.journal;
+          const childSnapshot = childJournal.beginSnapshot();
+          const childSessionId = childContext.sessionId;
+          const childEntries = childJournal.readVisible(childSessionId, childSnapshot, void 0);
+          for (const entry of childEntries) {
+            parentJournal.commitEntry({
+              sessionId: parentContext.sessionId,
+              scope: entry.scope,
+              checkId: `${stepPrefix}.${entry.checkId}`,
+              result: entry.result,
+              event: entry.event
+            });
+          }
+          if (childEntries.length > 0) {
+            logger.debug(
+              `[WorkflowProvider] Propagated ${childEntries.length} child journal entries to parent with prefix '${stepPrefix}.'`
+            );
+          }
+        }
         const bubbledEvents = childContext._bubbledEvents || [];
         if (bubbledEvents.length > 0 && parentContext) {
           if (parentContext.debug) {
@@ -15285,13 +15581,13 @@ var init_workflow_check_provider = __esm({
        */
       async loadWorkflowFromConfigPath(sourcePath, baseDir) {
         const path25 = require("path");
-        const fs22 = require("fs");
+        const fs21 = require("fs");
         const yaml5 = require("js-yaml");
         const resolved = path25.isAbsolute(sourcePath) ? sourcePath : path25.resolve(baseDir, sourcePath);
-        if (!fs22.existsSync(resolved)) {
+        if (!fs21.existsSync(resolved)) {
           throw new Error(`Workflow config not found at: ${resolved}`);
         }
-        const rawContent = fs22.readFileSync(resolved, "utf8");
+        const rawContent = fs21.readFileSync(resolved, "utf8");
         const rawData = yaml5.load(rawContent);
         if (rawData.imports && Array.isArray(rawData.imports)) {
           const configDir = path25.dirname(resolved);
@@ -15971,7 +16267,7 @@ async function migrateJsonToBackend(jsonPath, backend) {
   const resolvedPath = import_path5.default.resolve(process.cwd(), jsonPath);
   let content;
   try {
-    content = await import_promises3.default.readFile(resolvedPath, "utf-8");
+    content = await import_promises2.default.readFile(resolvedPath, "utf-8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return 0;
@@ -16018,7 +16314,7 @@ async function migrateJsonToBackend(jsonPath, backend) {
 async function renameToMigrated(resolvedPath) {
   const migratedPath = `${resolvedPath}.migrated`;
   try {
-    await import_promises3.default.rename(resolvedPath, migratedPath);
+    await import_promises2.default.rename(resolvedPath, migratedPath);
     logger.info(`[JsonMigrator] Backed up ${resolvedPath} \u2192 ${migratedPath}`);
   } catch (err) {
     logger.warn(
@@ -16026,11 +16322,11 @@ async function renameToMigrated(resolvedPath) {
     );
   }
 }
-var import_promises3, import_path5;
+var import_promises2, import_path5;
 var init_json_migrator = __esm({
   "src/scheduler/store/json-migrator.ts"() {
     "use strict";
-    import_promises3 = __toESM(require("fs/promises"));
+    import_promises2 = __toESM(require("fs/promises"));
     import_path5 = __toESM(require("path"));
     init_logger();
   }
@@ -16439,7 +16735,7 @@ function formatScheduleList(schedules) {
   if (schedules.length === 0) {
     return `You don't have any active schedules.
 
-To create one: "schedule daily-report every Monday at 9am"`;
+To create one: "remind me every Monday at 9am to check PRs" or "schedule %daily-report every Monday at 9am"`;
   }
   const lines = schedules.map((s, i) => `${i + 1}. ${formatSchedule(s)}`);
   return `**Your active schedules:**
@@ -16715,6 +17011,12 @@ function getScheduleToolDefinition() {
 
 YOU (the AI) must extract and structure all scheduling parameters. Do NOT pass natural language time expressions - convert them to cron or ISO timestamps.
 
+CRITICAL WORKFLOW RULE:
+- To schedule a WORKFLOW, the user MUST use a '%' prefix (e.g., "schedule %my-workflow daily").
+- If the '%' prefix is present, extract the word following it as the 'workflow' parameter (without the '%').
+- If the '%' prefix is NOT present, the request is a simple text reminder. The ENTIRE user request (excluding the schedule expression) MUST be placed in the 'reminder_text' parameter.
+- DO NOT guess or infer a workflow name from a user's request without the '%' prefix.
+
 ACTIONS:
 - create: Schedule a new reminder or workflow
 - list: Show user's active schedules
@@ -16722,7 +17024,9 @@ ACTIONS:
 - pause/resume: Temporarily disable/enable a schedule
 
 FOR CREATE ACTION - Extract these from user's request:
-1. WHAT: Either reminder_text (message to send) OR workflow (workflow ID to run)
+1. WHAT:
+   - If user says "schedule %some-workflow ...", populate 'workflow' with "some-workflow".
+   - Otherwise, populate 'reminder_text' with the user's full request text.
 2. WHERE: Use the CURRENT channel from context
    - target_id: The channel ID from context (C... for channels, D... for DMs)
    - target_type: "channel" for public/private channels, "dm" for direct messages
@@ -16757,7 +17061,7 @@ User in DM: "remind me to check builds every day at 9am"
     "original_expression": "every day at 9am"
   }
 
-User in #security channel: "run security-scan every Monday at 10am"
+User in #security channel: "schedule %security-scan every Monday at 10am"
 \u2192 {
     "action": "create",
     "workflow": "security-scan",
@@ -16768,6 +17072,17 @@ User in #security channel: "run security-scan every Monday at 10am"
     "original_expression": "every Monday at 10am"
   }
 
+User in #security channel: "run security-scan every Monday at 10am" (NO % prefix!)
+\u2192 {
+    "action": "create",
+    "reminder_text": "run security-scan every Monday at 10am",
+    "is_recurring": true,
+    "cron": "0 10 * * 1",
+    "target_type": "channel",
+    "target_id": "<channel ID from context, e.g., C05ABC123>",
+    "original_expression": "every Monday at 10am"
+  }
+
 User in DM: "remind me in 2 hours to review the PR"
 \u2192 {
     "action": "create",
@@ -16811,7 +17126,7 @@ User: "cancel schedule abc123"
         },
         workflow: {
           type: "string",
-          description: "For create: workflow/check ID to run (use instead of reminder_text for workflow execution)"
+          description: 'For create: workflow ID to run. ONLY populate this if the user used the % prefix (e.g., "%my-workflow"). Extract the name without the % symbol. If no % prefix, use reminder_text instead.'
         },
         workflow_inputs: {
           type: "object",
@@ -17785,16 +18100,13 @@ var init_mcp_custom_sse_server = __esm({
           logger.error(
             `[CustomToolsSSEServer:${this.sessionId}] Tool execution failed: ${toolName} - ${errorMsg}`
           );
+          const isValidationError = errorMsg.startsWith("Invalid workflow inputs:");
           return {
             jsonrpc: "2.0",
             id,
             error: {
-              code: -32603,
-              message: "Internal error",
-              data: {
-                tool: toolName,
-                error: errorMsg
-              }
+              code: isValidationError ? -32602 : -32603,
+              message: isValidationError ? `Invalid tool parameters: ${errorMsg}` : `Internal error during tool execution: ${errorMsg}`
             }
           };
         } finally {
@@ -17831,7 +18143,7 @@ var init_mcp_custom_sse_server = __esm({
 });
 
 // src/providers/ai-check-provider.ts
-var import_promises4, import_path6, AICheckProvider;
+var import_promises3, import_path6, AICheckProvider;
 var init_ai_check_provider = __esm({
   "src/providers/ai-check-provider.ts"() {
     "use strict";
@@ -17840,7 +18152,7 @@ var init_ai_check_provider = __esm({
     init_env_resolver();
     init_issue_filter();
     init_liquid_extensions();
-    import_promises4 = __toESM(require("fs/promises"));
+    import_promises3 = __toESM(require("fs/promises"));
     import_path6 = __toESM(require("path"));
     init_lazy_otel();
     init_state_capture();
@@ -18020,9 +18332,9 @@ var init_ai_check_provider = __esm({
           } else {
             resolvedPath = import_path6.default.resolve(process.cwd(), str);
           }
-          const fs22 = require("fs").promises;
+          const fs21 = require("fs").promises;
           try {
-            const stat = await fs22.stat(resolvedPath);
+            const stat = await fs21.stat(resolvedPath);
             return stat.isFile();
           } catch {
             return hasFileExtension && (isRelativePath || isAbsolutePath || hasPathSeparators);
@@ -18055,7 +18367,7 @@ var init_ai_check_provider = __esm({
           throw new Error("Invalid prompt file path: path traversal detected");
         }
         try {
-          const promptContent = await import_promises4.default.readFile(resolvedPath, "utf-8");
+          const promptContent = await import_promises3.default.readFile(resolvedPath, "utf-8");
           return promptContent;
         } catch (error) {
           throw new Error(
@@ -18560,6 +18872,10 @@ ${preview}`);
         if (config.ai_max_iterations !== void 0 && aiConfig.maxIterations === void 0) {
           aiConfig.maxIterations = config.ai_max_iterations;
         }
+        const sharedLimiter = sessionInfo?._parentContext?.sharedConcurrencyLimiter;
+        if (sharedLimiter) {
+          aiConfig.concurrencyLimiter = sharedLimiter;
+        }
         const policyEngine = sessionInfo?._parentContext?.policyEngine;
         if (policyEngine) {
           try {
@@ -18791,13 +19107,13 @@ ${preview}`);
                   `[AICheckProvider] Started custom tools SSE server '${customToolsServerName}' on port ${port} for ${customTools.size} tools`
                 );
               }
+              const workflowToolTimeout = config.ai?.timeout || 18e5;
               mcpServers[customToolsServerName] = {
                 command: "",
                 args: [],
                 url: `http://localhost:${port}/sse`,
                 transport: "sse",
-                timeout: 6e5
-                // 10 minutes for workflow tools
+                timeout: workflowToolTimeout
               };
             }
           } catch (error) {
@@ -18810,6 +19126,37 @@ ${preview}`);
           aiConfig.mcpServers = mcpServers;
         } else if (config.ai?.disableTools) {
         }
+        const bashConfigJsExpr = config.ai_bash_config_js;
+        if (bashConfigJsExpr && _dependencyResults) {
+          try {
+            const dynamicBashConfig = this.evaluateBashConfigJs(
+              bashConfigJsExpr,
+              prInfo,
+              _dependencyResults,
+              config
+            );
+            if (!aiConfig.bashConfig) aiConfig.bashConfig = {};
+            if (dynamicBashConfig.allow?.length) {
+              aiConfig.bashConfig.allow = [
+                ...aiConfig.bashConfig.allow || [],
+                ...dynamicBashConfig.allow
+              ];
+            }
+            if (dynamicBashConfig.deny?.length) {
+              aiConfig.bashConfig.deny = [
+                ...aiConfig.bashConfig.deny || [],
+                ...dynamicBashConfig.deny
+              ];
+            }
+            if (dynamicBashConfig.allow?.length || dynamicBashConfig.deny?.length) {
+              aiConfig.allowBash = true;
+            }
+          } catch (error) {
+            logger.error(
+              `[AICheckProvider] Failed to evaluate ai_bash_config_js: ${error instanceof Error ? error.message : "Unknown error"}`
+            );
+          }
+        }
         const templateContext = {
           pr: {
             number: prInfo.number,
@@ -18831,6 +19178,10 @@ ${preview}`);
           const span = trace.getSpan(context.active());
           if (span) {
             captureCheckInputContext(span, templateContext);
+            const spanTraceId = span.spanContext()?.traceId;
+            if (spanTraceId) {
+              prInfo.otelTraceId = spanTraceId;
+            }
           }
         } catch {
         }
@@ -19235,6 +19586,80 @@ ${processedPrompt}` : processedPrompt;
           return {};
         }
       }
+      /**
+       * Evaluate ai_bash_config_js expression to dynamically compute bash configuration.
+       * Returns a partial BashConfig object with optional allow/deny arrays.
+       */
+      evaluateBashConfigJs(expression, prInfo, dependencyResults, config) {
+        if (!this.sandbox) {
+          this.sandbox = createSecureSandbox();
+        }
+        const outputs = {};
+        for (const [checkId, result] of dependencyResults.entries()) {
+          const summary = result;
+          outputs[checkId] = summary.output !== void 0 ? summary.output : summary;
+        }
+        const jsContext = {
+          outputs,
+          inputs: config.inputs || {},
+          pr: {
+            number: prInfo.number,
+            title: prInfo.title,
+            description: prInfo.body,
+            author: prInfo.author,
+            branch: prInfo.head,
+            base: prInfo.base,
+            authorAssociation: prInfo.authorAssociation
+          },
+          files: prInfo.files?.map((f) => ({
+            filename: f.filename,
+            status: f.status,
+            additions: f.additions,
+            deletions: f.deletions,
+            changes: f.changes
+          })) || [],
+          env: this.buildSafeEnv(),
+          memory: config.__memoryAccessor || {}
+        };
+        try {
+          const result = compileAndRun(this.sandbox, expression, jsContext, {
+            injectLog: true,
+            wrapFunction: true,
+            logPrefix: "[ai_bash_config_js]"
+          });
+          if (typeof result !== "object" || result === null || Array.isArray(result)) {
+            logger.warn(
+              `[AICheckProvider] ai_bash_config_js must return an object, got ${Array.isArray(result) ? "array" : typeof result}`
+            );
+            return {};
+          }
+          const cfg = result;
+          const validConfig = {};
+          if (cfg.allow !== void 0) {
+            if (Array.isArray(cfg.allow) && cfg.allow.every((item) => typeof item === "string")) {
+              validConfig.allow = cfg.allow;
+            } else {
+              logger.warn(`[AICheckProvider] ai_bash_config_js: 'allow' must be a string array`);
+            }
+          }
+          if (cfg.deny !== void 0) {
+            if (Array.isArray(cfg.deny) && cfg.deny.every((item) => typeof item === "string")) {
+              validConfig.deny = cfg.deny;
+            } else {
+              logger.warn(`[AICheckProvider] ai_bash_config_js: 'deny' must be a string array`);
+            }
+          }
+          logger.debug(
+            `[AICheckProvider] ai_bash_config_js evaluated: allow=${validConfig.allow?.length ?? 0}, deny=${validConfig.deny?.length ?? 0}`
+          );
+          return validConfig;
+        } catch (error) {
+          logger.error(
+            `[AICheckProvider] Failed to evaluate ai_bash_config_js: ${error instanceof Error ? error.message : "Unknown error"}`
+          );
+          return {};
+        }
+      }
       /**
        * Build a safe subset of environment variables for sandbox access.
        * Excludes sensitive keys like API keys, secrets, tokens.
@@ -19331,6 +19756,7 @@ ${processedPrompt}` : processedPrompt;
           "ai_mcp_servers_js",
           "ai_custom_tools",
           "ai_custom_tools_js",
+          "ai_bash_config_js",
           "env"
         ];
       }
@@ -19825,7 +20251,7 @@ var init_template_context = __esm({
 });
 
 // src/providers/http-client-provider.ts
-var fs13, path15, HttpClientProvider;
+var fs12, path15, HttpClientProvider;
 var init_http_client_provider = __esm({
   "src/providers/http-client-provider.ts"() {
     "use strict";
@@ -19835,7 +20261,7 @@ var init_http_client_provider = __esm({
     init_sandbox();
     init_template_context();
     init_logger();
-    fs13 = __toESM(require("fs"));
+    fs12 = __toESM(require("fs"));
     path15 = __toESM(require("path"));
     HttpClientProvider = class extends CheckProvider {
       liquid;
@@ -19937,8 +20363,8 @@ var init_http_client_provider = __esm({
                 `[http_client] Resolved relative output_file to workspace: ${resolvedOutputFile}`
               );
             }
-            if (skipIfExists && fs13.existsSync(resolvedOutputFile)) {
-              const stats = fs13.statSync(resolvedOutputFile);
+            if (skipIfExists && fs12.existsSync(resolvedOutputFile)) {
+              const stats = fs12.statSync(resolvedOutputFile);
               logger.verbose(`[http_client] File cached: ${resolvedOutputFile} (${stats.size} bytes)`);
               return {
                 issues: [],
@@ -20150,12 +20576,12 @@ var init_http_client_provider = __esm({
             };
           }
           const parentDir = path15.dirname(outputFile);
-          if (parentDir && !fs13.existsSync(parentDir)) {
-            fs13.mkdirSync(parentDir, { recursive: true });
+          if (parentDir && !fs12.existsSync(parentDir)) {
+            fs12.mkdirSync(parentDir, { recursive: true });
           }
           const arrayBuffer = await response.arrayBuffer();
           const buffer = Buffer.from(arrayBuffer);
-          fs13.writeFileSync(outputFile, buffer);
+          fs12.writeFileSync(outputFile, buffer);
           const contentType = response.headers.get("content-type") || "application/octet-stream";
           logger.verbose(`[http_client] Downloaded: ${outputFile} (${buffer.length} bytes)`);
           return {
@@ -20914,7 +21340,7 @@ var init_claude_code_types = __esm({
 function isClaudeCodeConstructor(value) {
   return typeof value === "function";
 }
-var import_promises5, import_path7, ClaudeCodeSDKNotInstalledError, ClaudeCodeAPIKeyMissingError, ClaudeCodeCheckProvider;
+var import_promises4, import_path7, ClaudeCodeSDKNotInstalledError, ClaudeCodeAPIKeyMissingError, ClaudeCodeCheckProvider;
 var init_claude_code_check_provider = __esm({
   "src/providers/claude-code-check-provider.ts"() {
     "use strict";
@@ -20922,7 +21348,7 @@ var init_claude_code_check_provider = __esm({
     init_env_resolver();
     init_issue_filter();
     init_liquid_extensions();
-    import_promises5 = __toESM(require("fs/promises"));
+    import_promises4 = __toESM(require("fs/promises"));
     import_path7 = __toESM(require("path"));
     init_claude_code_types();
     ClaudeCodeSDKNotInstalledError = class extends Error {
@@ -21087,7 +21513,7 @@ var init_claude_code_check_provider = __esm({
             resolvedPath = import_path7.default.resolve(process.cwd(), str);
           }
           try {
-            const stat = await import_promises5.default.stat(resolvedPath);
+            const stat = await import_promises4.default.stat(resolvedPath);
             return stat.isFile();
           } catch {
             return hasFileExtension && (isRelativePath || isAbsolutePath || hasPathSeparators);
@@ -21120,7 +21546,7 @@ var init_claude_code_check_provider = __esm({
           throw new Error("Invalid prompt file path: path traversal detected");
         }
         try {
-          const promptContent = await import_promises5.default.readFile(resolvedPath, "utf-8");
+          const promptContent = await import_promises4.default.readFile(resolvedPath, "utf-8");
           return promptContent;
         } catch (error) {
           throw new Error(
@@ -21678,19 +22104,7 @@ var init_command_check_provider = __esm({
             }
           }
           const timeoutMs = config.timeout || 6e4;
-          const normalizeNodeEval = (cmd) => {
-            const re = /^(?<prefix>\s*(?:\/usr\/bin\/env\s+)?node(?:\.exe)?\s+(?:-e|--eval)\s+)(['"])([\s\S]*?)\2(?<suffix>\s|$)/;
-            const m = cmd.match(re);
-            if (!m || !m.groups) return cmd;
-            const prefix = m.groups.prefix;
-            const quote = m[2];
-            const code = m[3];
-            const suffix = m.groups.suffix || "";
-            if (!code.includes("\n")) return cmd;
-            const escaped = code.replace(/\n/g, "\\n");
-            return cmd.replace(re, `${prefix}${quote}${escaped}${quote}${suffix}`);
-          };
-          const safeCommand = normalizeNodeEval(renderedCommand);
+          const safeCommand = renderedCommand;
           const parentContext = context2?._parentContext;
           const workingDirectory = parentContext?.workingDirectory;
           const workspaceEnabled = parentContext?.workspace?.isEnabled?.();
@@ -41197,7 +41611,7 @@ var init_stdin_reader = __esm({
 });
 
 // src/providers/human-input-check-provider.ts
-var fs15, path17, HumanInputCheckProvider;
+var fs14, path17, HumanInputCheckProvider;
 var init_human_input_check_provider = __esm({
   "src/providers/human-input-check-provider.ts"() {
     "use strict";
@@ -41206,7 +41620,7 @@ var init_human_input_check_provider = __esm({
     init_prompt_state();
     init_liquid_extensions();
     init_stdin_reader();
-    fs15 = __toESM(require("fs"));
+    fs14 = __toESM(require("fs"));
     path17 = __toESM(require("path"));
     HumanInputCheckProvider = class _HumanInputCheckProvider extends CheckProvider {
       liquid;
@@ -41388,12 +41802,12 @@ var init_human_input_check_provider = __esm({
             return null;
           }
           try {
-            await fs15.promises.access(normalizedPath, fs15.constants.R_OK);
-            const stats = await fs15.promises.stat(normalizedPath);
+            await fs14.promises.access(normalizedPath, fs14.constants.R_OK);
+            const stats = await fs14.promises.stat(normalizedPath);
             if (!stats.isFile()) {
               return null;
             }
-            const content = await fs15.promises.readFile(normalizedPath, "utf-8");
+            const content = await fs14.promises.readFile(normalizedPath, "utf-8");
             return content.trim();
           } catch {
             return null;
@@ -41835,11 +42249,11 @@ var init_script_check_provider = __esm({
 });
 
 // src/utils/worktree-manager.ts
-var fs16, fsp, path18, crypto, WorktreeManager, worktreeManager;
+var fs15, fsp, path18, crypto, WorktreeManager, worktreeManager;
 var init_worktree_manager = __esm({
   "src/utils/worktree-manager.ts"() {
     "use strict";
-    fs16 = __toESM(require("fs"));
+    fs15 = __toESM(require("fs"));
     fsp = __toESM(require("fs/promises"));
     path18 = __toESM(require("path"));
     crypto = __toESM(require("crypto"));
@@ -41894,12 +42308,12 @@ var init_worktree_manager = __esm({
         }
         const reposDir = this.getReposDir();
         const worktreesDir = this.getWorktreesDir();
-        if (!fs16.existsSync(reposDir)) {
-          fs16.mkdirSync(reposDir, { recursive: true });
+        if (!fs15.existsSync(reposDir)) {
+          fs15.mkdirSync(reposDir, { recursive: true });
           logger.debug(`Created repos directory: ${reposDir}`);
         }
-        if (!fs16.existsSync(worktreesDir)) {
-          fs16.mkdirSync(worktreesDir, { recursive: true });
+        if (!fs15.existsSync(worktreesDir)) {
+          fs15.mkdirSync(worktreesDir, { recursive: true });
           logger.debug(`Created worktrees directory: ${worktreesDir}`);
         }
       }
@@ -41926,7 +42340,7 @@ var init_worktree_manager = __esm({
         const reposDir = this.getReposDir();
         const repoName = repository.replace(/\//g, "-");
         const bareRepoPath = path18.join(reposDir, `${repoName}.git`);
-        if (fs16.existsSync(bareRepoPath)) {
+        if (fs15.existsSync(bareRepoPath)) {
           logger.debug(`Bare repository already exists: ${bareRepoPath}`);
           const verifyResult = await this.verifyBareRepoRemote(bareRepoPath, repoUrl);
           if (verifyResult === "timeout") {
@@ -42049,7 +42463,7 @@ var init_worktree_manager = __esm({
         if (options.workingDirectory) {
           worktreePath = this.validatePath(options.workingDirectory);
         }
-        if (fs16.existsSync(worktreePath)) {
+        if (fs15.existsSync(worktreePath)) {
           logger.debug(`Worktree already exists: ${worktreePath}`);
           const metadata2 = await this.loadMetadata(worktreePath);
           if (metadata2) {
@@ -42290,9 +42704,9 @@ var init_worktree_manager = __esm({
         const result = await this.executeGitCommand(removeCmd, { timeout: 3e4 });
         if (result.exitCode !== 0) {
           logger.warn(`Failed to remove worktree via git: ${result.stderr}`);
-          if (fs16.existsSync(worktree_path)) {
+          if (fs15.existsSync(worktree_path)) {
             logger.debug(`Manually removing worktree directory`);
-            fs16.rmSync(worktree_path, { recursive: true, force: true });
+            fs15.rmSync(worktree_path, { recursive: true, force: true });
           }
         }
         this.activeWorktrees.delete(worktreeId);
@@ -42303,18 +42717,18 @@ var init_worktree_manager = __esm({
        */
       async saveMetadata(worktreePath, metadata) {
         const metadataPath = path18.join(worktreePath, ".visor-metadata.json");
-        fs16.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), "utf8");
+        fs15.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), "utf8");
       }
       /**
        * Load worktree metadata
        */
       async loadMetadata(worktreePath) {
         const metadataPath = path18.join(worktreePath, ".visor-metadata.json");
-        if (!fs16.existsSync(metadataPath)) {
+        if (!fs15.existsSync(metadataPath)) {
           return null;
         }
         try {
-          const content = fs16.readFileSync(metadataPath, "utf8");
+          const content = fs15.readFileSync(metadataPath, "utf8");
           return JSON.parse(content);
         } catch (error) {
           logger.warn(`Failed to load metadata: ${error}`);
@@ -42326,10 +42740,10 @@ var init_worktree_manager = __esm({
        */
       async listWorktrees() {
         const worktreesDir = this.getWorktreesDir();
-        if (!fs16.existsSync(worktreesDir)) {
+        if (!fs15.existsSync(worktreesDir)) {
           return [];
         }
-        const entries = fs16.readdirSync(worktreesDir, { withFileTypes: true });
+        const entries = fs15.readdirSync(worktreesDir, { withFileTypes: true });
         const worktrees = [];
         for (const entry of entries) {
           if (!entry.isDirectory()) continue;
@@ -44492,7 +44906,7 @@ __export(renderer_schema_exports, {
 });
 async function loadRendererSchema(name) {
   try {
-    const fs22 = await import("fs/promises");
+    const fs21 = await import("fs/promises");
     const path25 = await import("path");
     const sanitized = String(name).replace(/[^a-zA-Z0-9-]/g, "");
     if (!sanitized) return void 0;
@@ -44508,7 +44922,7 @@ async function loadRendererSchema(name) {
     ];
     for (const p of candidates) {
       try {
-        const raw = await fs22.readFile(p, "utf-8");
+        const raw = await fs21.readFile(p, "utf-8");
         return JSON.parse(raw);
       } catch {
       }
@@ -46927,7 +47341,7 @@ function updateStats2(results, state, isForEachIteration = false) {
 async function renderTemplateContent2(checkId, checkConfig, reviewSummary) {
   try {
     const { createExtendedLiquid: createExtendedLiquid2 } = await Promise.resolve().then(() => (init_liquid_extensions(), liquid_extensions_exports));
-    const fs22 = await import("fs/promises");
+    const fs21 = await import("fs/promises");
     const path25 = await import("path");
     const schemaRaw = checkConfig.schema || "plain";
     const schema = typeof schemaRaw === "string" ? schemaRaw : "code-review";
@@ -46938,7 +47352,7 @@ async function renderTemplateContent2(checkId, checkConfig, reviewSummary) {
     } else if (checkConfig.template && checkConfig.template.file) {
       const file = String(checkConfig.template.file);
       const resolved = path25.resolve(process.cwd(), file);
-      templateContent = await fs22.readFile(resolved, "utf-8");
+      templateContent = await fs21.readFile(resolved, "utf-8");
       logger.debug(`[LevelDispatch] Using template file for ${checkId}: ${resolved}`);
     } else if (schema && schema !== "plain") {
       const sanitized = String(schema).replace(/[^a-zA-Z0-9-]/g, "");
@@ -46957,7 +47371,7 @@ async function renderTemplateContent2(checkId, checkConfig, reviewSummary) {
         ];
         for (const p of candidatePaths) {
           try {
-            templateContent = await fs22.readFile(p, "utf-8");
+            templateContent = await fs21.readFile(p, "utf-8");
             if (templateContent) {
               logger.debug(`[LevelDispatch] Using schema template for ${checkId}: ${p}`);
               break;
@@ -47157,6 +47571,9 @@ var init_runner = __esm({
               break;
             }
           }
+          if (this.state.currentState === "Completed" && !this.context._parentContext && !process.env.VISOR_TEST_MODE) {
+            logger.info("All workflows finished \u2014 waiting for events");
+          }
           return this.buildExecutionResult();
         } catch (error) {
           const errorMsg = error instanceof Error ? error.message : String(error);
@@ -48195,12 +48612,12 @@ var init_sandbox_manager = __esm({
 });
 
 // src/utils/file-exclusion.ts
-var import_ignore, fs17, path19, DEFAULT_EXCLUSION_PATTERNS, FileExclusionHelper;
+var import_ignore, fs16, path19, DEFAULT_EXCLUSION_PATTERNS, FileExclusionHelper;
 var init_file_exclusion = __esm({
   "src/utils/file-exclusion.ts"() {
     "use strict";
     import_ignore = __toESM(require("ignore"));
-    fs17 = __toESM(require("fs"));
+    fs16 = __toESM(require("fs"));
     path19 = __toESM(require("path"));
     DEFAULT_EXCLUSION_PATTERNS = [
       "dist/",
@@ -48246,8 +48663,8 @@ var init_file_exclusion = __esm({
           if (additionalPatterns && additionalPatterns.length > 0) {
             this.gitignore.add(additionalPatterns);
           }
-          if (fs17.existsSync(gitignorePath)) {
-            const rawContent = fs17.readFileSync(gitignorePath, "utf8");
+          if (fs16.existsSync(gitignorePath)) {
+            const rawContent = fs16.readFileSync(gitignorePath, "utf8");
             const gitignoreContent = rawContent.replace(/[\r\n]+/g, "\n").replace(/[\x00-\x09\x0B-\x1F\x7F]/g, "").split("\n").filter((line) => line.length < 1e3).join("\n").trim();
             this.gitignore.add(gitignoreContent);
             if (process.env.VISOR_DEBUG === "true") {
@@ -48279,13 +48696,13 @@ var git_repository_analyzer_exports = {};
 __export(git_repository_analyzer_exports, {
   GitRepositoryAnalyzer: () => GitRepositoryAnalyzer
 });
-var import_simple_git2, path20, fs18, MAX_PATCH_SIZE, GitRepositoryAnalyzer;
+var import_simple_git2, path20, fs17, MAX_PATCH_SIZE, GitRepositoryAnalyzer;
 var init_git_repository_analyzer = __esm({
   "src/git-repository-analyzer.ts"() {
     "use strict";
     import_simple_git2 = require("simple-git");
     path20 = __toESM(require("path"));
-    fs18 = __toESM(require("fs"));
+    fs17 = __toESM(require("fs"));
     init_file_exclusion();
     MAX_PATCH_SIZE = 50 * 1024;
     GitRepositoryAnalyzer = class {
@@ -48550,7 +48967,7 @@ ${file.patch}`).join("\n\n");
         let content;
         let truncated = false;
         try {
-          if (includeContext && status !== "added" && fs18.existsSync(filePath)) {
+          if (includeContext && status !== "added" && fs17.existsSync(filePath)) {
             const diff = await this.git.diff(["--", filename]).catch(() => "");
             if (diff) {
               const result = this.truncatePatch(diff, filename);
@@ -48560,7 +48977,7 @@ ${file.patch}`).join("\n\n");
               additions = lines.filter((line) => line.startsWith("+")).length;
               deletions = lines.filter((line) => line.startsWith("-")).length;
             }
-          } else if (status !== "added" && fs18.existsSync(filePath)) {
+          } else if (status !== "added" && fs17.existsSync(filePath)) {
             const diff = await this.git.diff(["--", filename]).catch(() => "");
             if (diff) {
               const lines = diff.split("\n");
@@ -48568,17 +48985,17 @@ ${file.patch}`).join("\n\n");
               deletions = lines.filter((line) => line.startsWith("-")).length;
             }
           }
-          if (status === "added" && fs18.existsSync(filePath)) {
+          if (status === "added" && fs17.existsSync(filePath)) {
             try {
-              const stats = fs18.statSync(filePath);
+              const stats = fs17.statSync(filePath);
               if (stats.isFile() && stats.size < 1024 * 1024) {
                 if (includeContext) {
-                  content = fs18.readFileSync(filePath, "utf8");
+                  content = fs17.readFileSync(filePath, "utf8");
                   const result = this.truncatePatch(content, filename);
                   patch = result.patch;
                   truncated = result.truncated;
                 }
-                const fileContent = includeContext ? content : fs18.readFileSync(filePath, "utf8");
+                const fileContent = includeContext ? content : fs17.readFileSync(filePath, "utf8");
                 additions = fileContent.split("\n").length;
               }
             } catch {
@@ -49082,6 +49499,17 @@ function buildEngineContextForRun(workingDirectory, config, prInfo, debug, maxPa
   }
   const journal = new ExecutionJournal();
   const memory = MemoryStore.getInstance(clonedConfig.memory);
+  let sharedConcurrencyLimiter = void 0;
+  if (clonedConfig.max_ai_concurrency && _DelegationManager) {
+    sharedConcurrencyLimiter = new _DelegationManager({
+      maxConcurrent: clonedConfig.max_ai_concurrency,
+      maxPerSession: 999
+      // No per-session limit needed for global AI gating
+    });
+    logger.debug(
+      `[EngineContext] Created shared AI concurrency limiter (max: ${clonedConfig.max_ai_concurrency})`
+    );
+  }
   return {
     mode: "state-machine",
     config: clonedConfig,
@@ -49094,6 +49522,7 @@ function buildEngineContextForRun(workingDirectory, config, prInfo, debug, maxPa
     event: prInfo.eventType,
     debug,
     maxParallelism,
+    sharedConcurrencyLimiter,
     failFast,
     requestedChecks: requestedChecks && requestedChecks.length > 0 ? requestedChecks : void 0,
     // Store prInfo for later access (e.g., in getOutputHistorySnapshot)
@@ -49140,6 +49569,7 @@ async function initializeWorkspace(context2) {
     return context2;
   }
 }
+var _DelegationManager;
 var init_build_engine_context = __esm({
   "src/state-machine/context/build-engine-context.ts"() {
     "use strict";
@@ -49148,6 +49578,14 @@ var init_build_engine_context = __esm({
     init_human_id();
     init_logger();
     init_workspace_manager();
+    _DelegationManager = null;
+    try {
+      const probe = require("@probelabs/probe");
+      if (probe && typeof probe.DelegationManager === "function") {
+        _DelegationManager = probe.DelegationManager;
+      }
+    } catch {
+    }
   }
 });
 
@@ -50956,7 +51394,7 @@ async function renderMermaidToPng(mermaidCode) {
     `mermaid-${Date.now()}-${Math.random().toString(36).slice(2)}.png`
   );
   try {
-    fs20.writeFileSync(inputFile, mermaidCode, "utf-8");
+    fs19.writeFileSync(inputFile, mermaidCode, "utf-8");
     const chromiumPaths = [
       "/usr/bin/chromium",
       "/usr/bin/chromium-browser",
@@ -50965,7 +51403,7 @@ async function renderMermaidToPng(mermaidCode) {
     ];
     let chromiumPath;
     for (const p of chromiumPaths) {
-      if (fs20.existsSync(p)) {
+      if (fs19.existsSync(p)) {
         chromiumPath = p;
         break;
       }
@@ -51017,19 +51455,19 @@ async function renderMermaidToPng(mermaidCode) {
       console.warn(`Mermaid rendering failed: ${result.error}`);
       return null;
     }
-    if (!fs20.existsSync(outputFile)) {
+    if (!fs19.existsSync(outputFile)) {
       console.warn("Mermaid output file not created");
       return null;
     }
-    const pngBuffer = fs20.readFileSync(outputFile);
+    const pngBuffer = fs19.readFileSync(outputFile);
     return pngBuffer;
   } catch (e) {
     console.warn(`Mermaid rendering error: ${e instanceof Error ? e.message : String(e)}`);
     return null;
   } finally {
     try {
-      if (fs20.existsSync(inputFile)) fs20.unlinkSync(inputFile);
-      if (fs20.existsSync(outputFile)) fs20.unlinkSync(outputFile);
+      if (fs19.existsSync(inputFile)) fs19.unlinkSync(inputFile);
+      if (fs19.existsSync(outputFile)) fs19.unlinkSync(outputFile);
     } catch {
     }
   }
@@ -51093,12 +51531,12 @@ function markdownToSlack(text) {
 function formatSlackText(text) {
   return markdownToSlack(text);
 }
-var import_child_process5, fs20, path23, os;
+var import_child_process5, fs19, path23, os;
 var init_markdown = __esm({
   "src/slack/markdown.ts"() {
     "use strict";
     import_child_process5 = require("child_process");
-    fs20 = __toESM(require("fs"));
+    fs19 = __toESM(require("fs"));
     path23 = __toESM(require("path"));
     os = __toESM(require("os"));
   }
@@ -52040,7 +52478,7 @@ function serializeRunState(state) {
     ])
   };
 }
-var path24, fs21, StateMachineExecutionEngine;
+var path24, fs20, StateMachineExecutionEngine;
 var init_state_machine_execution_engine = __esm({
   "src/state-machine-execution-engine.ts"() {
     "use strict";
@@ -52048,7 +52486,7 @@ var init_state_machine_execution_engine = __esm({
     init_logger();
     init_sandbox_manager();
     path24 = __toESM(require("path"));
-    fs21 = __toESM(require("fs"));
+    fs20 = __toESM(require("fs"));
     StateMachineExecutionEngine = class _StateMachineExecutionEngine {
       workingDirectory;
       executionContext;
@@ -52425,7 +52863,7 @@ var init_state_machine_execution_engine = __esm({
                   const checkId = String(ev?.checkId || "unknown");
                   const threadKey = ev?.threadKey || (channel && threadTs ? `${channel}:${threadTs}` : "session");
                   const baseDir = process.env.VISOR_SNAPSHOT_DIR || path24.resolve(process.cwd(), ".visor", "snapshots");
-                  fs21.mkdirSync(baseDir, { recursive: true });
+                  fs20.mkdirSync(baseDir, { recursive: true });
                   const filePath = path24.join(baseDir, `${threadKey}-${checkId}.json`);
                   await this.saveSnapshotToFile(filePath);
                   logger.info(`[Snapshot] Saved run snapshot: ${filePath}`);
@@ -52567,7 +53005,7 @@ var init_state_machine_execution_engine = __esm({
        * Does not include secrets. Intended for debugging and future resume support.
        */
       async saveSnapshotToFile(filePath) {
-        const fs22 = await import("fs/promises");
+        const fs21 = await import("fs/promises");
         const ctx = this._lastContext;
         const runner = this._lastRunner;
         if (!ctx || !runner) {
@@ -52587,14 +53025,14 @@ var init_state_machine_execution_engine = __esm({
           journal: entries,
           requestedChecks: ctx.requestedChecks || []
         };
-        await fs22.writeFile(filePath, JSON.stringify(payload, null, 2), "utf8");
+        await fs21.writeFile(filePath, JSON.stringify(payload, null, 2), "utf8");
       }
       /**
        * Load a snapshot JSON from file and return it. Resume support can build on this.
        */
       async loadSnapshotFromFile(filePath) {
-        const fs22 = await import("fs/promises");
-        const raw = await fs22.readFile(filePath, "utf8");
+        const fs21 = await import("fs/promises");
+        const raw = await fs21.readFile(filePath, "utf8");
         return JSON.parse(raw);
       }
       /**