@probelabs/visor 0.1.186 → 0.1.187

package/dist/sdk/{chunk-NPOVLLKH.mjs → chunk-TGQBEM3Y.mjs}

@@ -16,26 +16,37 @@ import {
   extractFileSections,
   init_markdown,
   replaceFileSections
-} from "./chunk-PDQTEBOJ.mjs";
+} from "./chunk-QT766ZLD.mjs";
 import {
   init_task_trace_resolution,
   resolveTaskTraceReference
-} from "./chunk-WZQMTD7W.mjs";
+} from "./chunk-2LLKENYD.mjs";
+import {
+  formatUserFacingExecutionError,
+  formatUserFacingExecutionMessage,
+  init_user_facing_error
+} from "./chunk-TL3ZTYFY.mjs";
+import {
+  OAuth2TokenCache,
+  init_oauth2_token_cache
+} from "./chunk-PGBV3VZB.mjs";
 import {
   CheckProvider,
-  EnvironmentResolver,
   UtcpCheckProvider,
   buildSandboxEnv,
   env_exposure_exports,
   extractIssuesFromOutput,
   init_check_provider_interface,
   init_env_exposure,
-  init_env_resolver,
   init_issue_normalizer,
   init_utcp_check_provider,
   normalizeIssue,
   normalizeIssueArray
-} from "./chunk-TSX3YS3F.mjs";
+} from "./chunk-HW4MPCOW.mjs";
+import {
+  EnvironmentResolver,
+  init_env_resolver
+} from "./chunk-7QI6F66G.mjs";
 import {
   getPromptStateManager,
   init_prompt_state
@@ -48,7 +59,7 @@ import {
   SessionRegistry,
   init_session_registry,
   session_registry_exports
-} from "./chunk-XXAEN5KU.mjs";
+} from "./chunk-77AKSSW2.mjs";
 import {
   commandExecutor,
   init_command_executor
@@ -62,7 +73,7 @@ import {
 import {
   config_exports,
   init_config
-} from "./chunk-XX6WT332.mjs";
+} from "./chunk-YTG5DN72.mjs";
 import {
   ExecutionJournal,
   checkLoopBudget,
@@ -71,11 +82,11 @@ import {
   init_routing,
   init_snapshot_store,
   snapshot_store_exports
-} from "./chunk-4UMDSYC7.mjs";
+} from "./chunk-VS3JE2DL.mjs";
 import {
   FailureConditionEvaluator,
   init_failure_condition_evaluator
-} from "./chunk-5TXIAPRA.mjs";
+} from "./chunk-S3GSZRYC.mjs";
 import {
   addEvent,
   emitImmediateSpan,
@@ -88,11 +99,11 @@ import {
   setSpanAttributes,
   trace_helpers_exports,
   withActiveSpan
-} from "./chunk-A4WHMRK2.mjs";
+} from "./chunk-YETG675X.mjs";
 import {
   generateHumanId,
   init_human_id
-} from "./chunk-NEZY2MXM.mjs";
+} from "./chunk-B2LQT6QU.mjs";
 import {
   addDiagramBlock,
   init_metrics,
@@ -148,7 +159,7 @@ async function processDiffWithOutline(diffContent) {
   }
   try {
     const originalProbePath = process.env.PROBE_PATH;
-    const fs13 = __require("fs");
+    const fs14 = __require("fs");
     const possiblePaths = [
       // Relative to current working directory (most common in production)
       path.join(process.cwd(), "node_modules/@probelabs/probe/bin/probe-binary"),
@@ -159,7 +170,7 @@ async function processDiffWithOutline(diffContent) {
     ];
     let probeBinaryPath;
     for (const candidatePath of possiblePaths) {
-      if (fs13.existsSync(candidatePath)) {
+      if (fs14.existsSync(candidatePath)) {
         probeBinaryPath = candidatePath;
         break;
       }
@@ -284,16 +295,36 @@ function createProbeTracerAdapter(fallbackTracer) {
     "negotiated_timeout.observer_exhausted",
     "negotiated_timeout.abort_summary"
   ]);
+  const isSpanWorthyEvent = (name) => SPAN_WORTHY_EVENTS.has(name) || name.startsWith("task.");
   const emitEvent = (name, attrs) => {
     try {
       const flat = flattenAttrs(attrs);
-      if (SPAN_WORTHY_EVENTS.has(name)) {
+      if (isSpanWorthyEvent(name)) {
         try {
+          const startHr = process.hrtime();
           const tracer = trace.getTracer("visor");
           const childSpan = tracer.startSpan(`probe.event.${name}`, {
             attributes: { "probe.event.name": name, ...flat }
           });
           childSpan.end();
+          try {
+            const activeParent = trace.getActiveSpan?.();
+            const parentCtx = activeParent?.spanContext?.();
+            const childCtx = childSpan.spanContext?.();
+            const endHr = process.hrtime();
+            emitNdjsonFullSpan({
+              name: `probe.event.${name}`,
+              traceId: childCtx?.traceId || parentCtx?.traceId,
+              spanId: childCtx?.spanId,
+              parentSpanId: parentCtx?.spanId,
+              startTime: [startHr[0], startHr[1]],
+              endTime: [endHr[0], endHr[1]],
+              attributes: { "probe.event.name": name, ...flat },
+              events: [],
+              status: { code: 1 }
+            });
+          } catch {
+          }
         } catch {
         }
       }
@@ -484,6 +515,15 @@ function createProbeTracerAdapter(fallbackTracer) {
         }
       }
     },
+    recordTaskEvent: (phase, attrs) => {
+      emitEvent(`task.${phase}`, attrs);
+      if (fallback && typeof fallback.recordTaskEvent === "function") {
+        try {
+          fallback.recordTaskEvent(phase, attrs);
+        } catch {
+        }
+      }
+    },
     createToolSpan: (toolName, attrs) => {
       let fallbackSpan = null;
       if (fallback && typeof fallback.createToolSpan === "function") {
@@ -690,6 +730,7 @@ var init_ai_review_service = __esm({
     init_tracer_init();
     init_diff_processor();
     init_comment_metadata();
+    init_user_facing_error();
     init_markdown();
     PROBE_GRACEFUL_MARGIN_MS = 9e4;
     MIN_TIMEOUT_FOR_MARGIN_MS = PROBE_GRACEFUL_MARGIN_MS + 3e4;
@@ -1108,8 +1149,8 @@ var init_ai_review_service = __esm({
       /**
        * Cleanup a session from the registry
        */
-      cleanupSession(sessionId) {
-        this.sessionRegistry.unregisterSession(sessionId);
+      async cleanupSession(sessionId) {
+        await this.sessionRegistry.unregisterSession(sessionId);
       }
       /**
        * Build a custom prompt for AI review with XML-formatted data
@@ -1687,7 +1728,7 @@ ${schemaString}`);
           }
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs13 = __require("fs");
+              const fs14 = __require("fs");
               const path15 = __require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const provider = this.config.provider || "auto";
@@ -1803,19 +1844,19 @@ ${"=".repeat(60)}
               readableVersion += `${"=".repeat(60)}
 `;
               const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path15.join(process.cwd(), "debug-artifacts");
-              if (!fs13.existsSync(debugArtifactsDir)) {
-                fs13.mkdirSync(debugArtifactsDir, { recursive: true });
+              if (!fs14.existsSync(debugArtifactsDir)) {
+                fs14.mkdirSync(debugArtifactsDir, { recursive: true });
               }
               const debugFile = path15.join(
                 debugArtifactsDir,
                 `prompt-${_checkName || "unknown"}-${timestamp}.json`
               );
-              fs13.writeFileSync(debugFile, debugJson, "utf-8");
+              fs14.writeFileSync(debugFile, debugJson, "utf-8");
               const readableFile = path15.join(
                 debugArtifactsDir,
                 `prompt-${_checkName || "unknown"}-${timestamp}.txt`
               );
-              fs13.writeFileSync(readableFile, readableVersion, "utf-8");
+              fs14.writeFileSync(readableFile, readableVersion, "utf-8");
               log(`
 \u{1F4BE} Full debug info saved to:`);
               log(`   JSON: ${debugFile}`);
@@ -1853,7 +1894,7 @@ ${"=".repeat(60)}
           log(`\u{1F4E4} Response length: ${response.length} characters`);
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs13 = __require("fs");
+              const fs14 = __require("fs");
               const path15 = __require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const agentAny2 = agent;
@@ -1878,7 +1919,7 @@ ${"=".repeat(60)}
                 schema: effectiveSchema,
                 totalMessages: fullHistory.length
               };
-              fs13.writeFileSync(sessionBase + ".json", JSON.stringify(sessionData, null, 2), "utf-8");
+              fs14.writeFileSync(sessionBase + ".json", JSON.stringify(sessionData, null, 2), "utf-8");
               let readable = `=============================================================
 `;
               readable += `COMPLETE AI SESSION HISTORY (AFTER RESPONSE)
@@ -1905,7 +1946,7 @@ ${"=".repeat(60)}
 `;
                 readable += content + "\n";
               });
-              fs13.writeFileSync(sessionBase + ".summary.txt", readable, "utf-8");
+              fs14.writeFileSync(sessionBase + ".summary.txt", readable, "utf-8");
               log(`\u{1F4BE} Complete session history saved:`);
               log(`   - Contains ALL ${fullHistory.length} messages (prompts + responses)`);
             } catch (error) {
@@ -1914,7 +1955,7 @@ ${"=".repeat(60)}
           }
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs13 = __require("fs");
+              const fs14 = __require("fs");
               const path15 = __require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path15.join(process.cwd(), "debug-artifacts");
@@ -1951,7 +1992,7 @@ ${"=".repeat(60)}
 `;
               responseContent += `${"=".repeat(60)}
 `;
-              fs13.writeFileSync(responseFile, responseContent, "utf-8");
+              fs14.writeFileSync(responseFile, responseContent, "utf-8");
               log(`\u{1F4BE} Response saved to: ${responseFile}`);
             } catch (error) {
               log(`\u26A0\uFE0F Could not save response file: ${error}`);
@@ -1967,9 +2008,9 @@ ${"=".repeat(60)}
                 await agentAny._telemetryConfig.shutdown();
                 log(`\u{1F4CA} OpenTelemetry trace saved to: ${agentAny._traceFilePath}`);
                 if (process.env.GITHUB_ACTIONS) {
-                  const fs13 = __require("fs");
-                  if (fs13.existsSync(agentAny._traceFilePath)) {
-                    const stats = fs13.statSync(agentAny._traceFilePath);
+                  const fs14 = __require("fs");
+                  if (fs14.existsSync(agentAny._traceFilePath)) {
+                    const stats = fs14.statSync(agentAny._traceFilePath);
                     console.log(
                       `::notice title=AI Trace Saved::${agentAny._traceFilePath} (${stats.size} bytes)`
                     );
@@ -2239,7 +2280,7 @@ ${schemaString}`);
           const model = this.config.model || "default";
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs13 = __require("fs");
+              const fs14 = __require("fs");
               const path15 = __require("path");
               const os = __require("os");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
@@ -2315,7 +2356,7 @@ ${"=".repeat(60)}
 `;
               const tempDir = os.tmpdir();
               const promptFile = path15.join(tempDir, `visor-prompt-${timestamp}.txt`);
-              fs13.writeFileSync(promptFile, prompt, "utf-8");
+              fs14.writeFileSync(promptFile, prompt, "utf-8");
               log(`
 \u{1F4BE} Prompt saved to: ${promptFile}`);
               const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path15.join(process.cwd(), "debug-artifacts");
@@ -2324,8 +2365,8 @@ ${"=".repeat(60)}
                   debugArtifactsDir,
                   `prompt-${_checkName || "unknown"}-${timestamp}`
                 );
-                fs13.writeFileSync(base + ".json", debugJson, "utf-8");
-                fs13.writeFileSync(base + ".summary.txt", readableVersion, "utf-8");
+                fs14.writeFileSync(base + ".json", debugJson, "utf-8");
+                fs14.writeFileSync(base + ".summary.txt", readableVersion, "utf-8");
                 log(`
 \u{1F4BE} Full debug info saved to directory: ${debugArtifactsDir}`);
               } catch {
@@ -2375,7 +2416,7 @@ $ ${cliCommand}
           log(`\u{1F4E4} Response length: ${response.length} characters`);
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs13 = __require("fs");
+              const fs14 = __require("fs");
               const path15 = __require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const agentAny = agent;
@@ -2400,7 +2441,7 @@ $ ${cliCommand}
                 schema: effectiveSchema,
                 totalMessages: fullHistory.length
               };
-              fs13.writeFileSync(sessionBase + ".json", JSON.stringify(sessionData, null, 2), "utf-8");
+              fs14.writeFileSync(sessionBase + ".json", JSON.stringify(sessionData, null, 2), "utf-8");
               let readable = `=============================================================
 `;
               readable += `COMPLETE AI SESSION HISTORY (AFTER RESPONSE)
@@ -2427,7 +2468,7 @@ ${"=".repeat(60)}
 `;
                 readable += content + "\n";
               });
-              fs13.writeFileSync(sessionBase + ".summary.txt", readable, "utf-8");
+              fs14.writeFileSync(sessionBase + ".summary.txt", readable, "utf-8");
               log(`\u{1F4BE} Complete session history saved:`);
               log(`   - Contains ALL ${fullHistory.length} messages (prompts + responses)`);
             } catch (error) {
@@ -2436,7 +2477,7 @@ ${"=".repeat(60)}
           }
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs13 = __require("fs");
+              const fs14 = __require("fs");
               const path15 = __require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path15.join(process.cwd(), "debug-artifacts");
@@ -2473,7 +2514,7 @@ ${"=".repeat(60)}
 `;
               responseContent += `${"=".repeat(60)}
 `;
-              fs13.writeFileSync(responseFile, responseContent, "utf-8");
+              fs14.writeFileSync(responseFile, responseContent, "utf-8");
               log(`\u{1F4BE} Response saved to: ${responseFile}`);
             } catch (error) {
               log(`\u26A0\uFE0F Could not save response file: ${error}`);
@@ -2491,9 +2532,9 @@ ${"=".repeat(60)}
                 await telemetry.shutdown();
                 log(`\u{1F4CA} OpenTelemetry trace saved to: ${traceFilePath}`);
                 if (process.env.GITHUB_ACTIONS) {
-                  const fs13 = __require("fs");
-                  if (fs13.existsSync(traceFilePath)) {
-                    const stats = fs13.statSync(traceFilePath);
+                  const fs14 = __require("fs");
+                  if (fs14.existsSync(traceFilePath)) {
+                    const stats = fs14.statSync(traceFilePath);
                     console.log(
                       `::notice title=AI Trace Saved::OpenTelemetry trace file size: ${stats.size} bytes`
                     );
@@ -2514,9 +2555,7 @@ ${"=".repeat(60)}
           return { response, effectiveSchema, sessionId };
         } catch (error) {
           console.error("\u274C ProbeAgent failed:", error);
-          throw new Error(
-            `ProbeAgent execution failed: ${error instanceof Error ? error.message : "Unknown error"}`
-          );
+          throw new Error(formatUserFacingExecutionError(error));
         } finally {
           Object.keys(originalEnv).forEach((key) => {
             if (originalEnv[key] === void 0) {
@@ -2531,7 +2570,7 @@ ${"=".repeat(60)}
        * Load schema content from schema files or inline definitions
        */
       async loadSchemaContent(schema) {
-        const fs13 = __require("fs").promises;
+        const fs14 = __require("fs").promises;
         const path15 = __require("path");
         if (typeof schema === "object" && schema !== null) {
           log("\u{1F4CB} Using inline schema object from configuration");
@@ -2552,7 +2591,7 @@ ${"=".repeat(60)}
           try {
             const schemaPath = path15.resolve(process.cwd(), schema);
             log(`\u{1F4CB} Loading custom schema from file: ${schemaPath}`);
-            const schemaContent = await fs13.readFile(schemaPath, "utf-8");
+            const schemaContent = await fs14.readFile(schemaPath, "utf-8");
             return schemaContent.trim();
           } catch (error) {
             throw new Error(
@@ -2574,7 +2613,7 @@ ${"=".repeat(60)}
         ];
         for (const schemaPath of candidatePaths) {
           try {
-            const schemaContent = await fs13.readFile(schemaPath, "utf-8");
+            const schemaContent = await fs14.readFile(schemaPath, "utf-8");
             return schemaContent.trim();
           } catch {
           }
@@ -4502,7 +4541,7 @@ function createWorkflowToolDefinition(workflow, argsOverrides, nameOverride) {
     for (const key of Object.keys(argsOverrides)) {
       delete filteredProperties[key];
     }
-    const filteredRequired = baseRequired ? baseRequired.filter((r) => !argsOverrides[r]) : void 0;
+    const filteredRequired = baseRequired ? baseRequired.filter((r) => !(r in argsOverrides)) : void 0;
     inputSchema = {
       ...baseSchema,
       properties: filteredProperties,
@@ -4538,7 +4577,7 @@ async function executeWorkflowAsTool(workflowId, args, context2, argsOverrides)
     ...args,
     ...argsOverrides
   };
-  const { WorkflowCheckProvider: WorkflowCheckProvider2 } = await import("./workflow-check-provider-N6KSDPWU.mjs");
+  const { WorkflowCheckProvider: WorkflowCheckProvider2 } = await import("./workflow-check-provider-G7A67EPP.mjs");
   const provider = new WorkflowCheckProvider2();
   const checkConfig = {
     type: "workflow",
@@ -8386,6 +8425,126 @@ var init_policy_gate = __esm({
   }
 });
 
+// src/state-machine/dispatch/debounce-manager.ts
+function effectiveDebounceMs(requested) {
+  const override = process.env.VISOR_DEBOUNCE_OVERRIDE;
+  if (override !== void 0) {
+    const ms = parseInt(override, 10);
+    if (!isNaN(ms) && ms >= 0) return ms;
+  }
+  return requested;
+}
+function getDebounceManager() {
+  if (!__instance) __instance = new DebounceManager();
+  return __instance;
+}
+var DebounceManager, __instance;
+var init_debounce_manager = __esm({
+  "src/state-machine/dispatch/debounce-manager.ts"() {
+    "use strict";
+    init_logger();
+    DebounceManager = class {
+      pending = /* @__PURE__ */ new Map();
+      /** Waiters that were superseded and should resolve as 'debounced' */
+      superseded = /* @__PURE__ */ new Map();
+      /** Keys currently executing — prevents parallel runs */
+      executing = /* @__PURE__ */ new Set();
+      /**
+       * Enqueue an execution. Returns 'executed' if this invocation won the
+       * debounce race, or 'debounced' if it was superseded by a later one
+       * or if the function is already executing for this key.
+       */
+      enqueue(key, debounceMs, fn) {
+        if (this.executing.has(key)) {
+          logger.info(`[DebounceManager] ${key}: already executing, skipping this invocation`);
+          return Promise.resolve({ outcome: "debounced" });
+        }
+        const actualMs = effectiveDebounceMs(debounceMs);
+        return new Promise(
+          (resolve10, reject) => {
+            const existing = this.pending.get(key);
+            if (existing) {
+              clearTimeout(existing.timer);
+              if (!this.superseded.has(key)) {
+                this.superseded.set(key, []);
+              }
+              this.superseded.get(key).push(existing.resolve);
+              existing.invocations++;
+              logger.info(
+                `[DebounceManager] ${key}: invocation #${existing.invocations}, resetting ${actualMs}ms timer`
+              );
+            } else {
+              logger.info(
+                `[DebounceManager] ${key}: first invocation, starting ${actualMs}ms debounce`
+              );
+            }
+            const invocations = existing ? existing.invocations : 1;
+            const firstTime = existing ? existing.firstInvocationTime : Date.now();
+            const timer = setTimeout(async () => {
+              this.pending.delete(key);
+              const waiters2 = this.superseded.get(key) || [];
+              this.superseded.delete(key);
+              for (const w of waiters2) {
+                w({ outcome: "debounced" });
+              }
+              const elapsed = Date.now() - firstTime;
+              logger.info(
+                `[DebounceManager] ${key}: executing after ${invocations} invocation(s) over ${elapsed}ms`
+              );
+              this.executing.add(key);
+              try {
+                const result = await fn();
+                resolve10({ outcome: "executed", result });
+              } catch (err) {
+                reject(err);
+              } finally {
+                this.executing.delete(key);
+                logger.info(`[DebounceManager] ${key}: execution finished`);
+              }
+            }, actualMs);
+            this.pending.set(key, {
+              timer,
+              invocations,
+              firstInvocationTime: firstTime,
+              resolve: resolve10,
+              reject,
+              fn
+            });
+          }
+        );
+      }
+      /** Cancel a pending debounce. All waiters resolve as 'debounced'. */
+      cancel(key) {
+        const entry = this.pending.get(key);
+        if (!entry) return false;
+        clearTimeout(entry.timer);
+        this.pending.delete(key);
+        entry.resolve({ outcome: "debounced" });
+        const waiters2 = this.superseded.get(key) || [];
+        this.superseded.delete(key);
+        for (const w of waiters2) {
+          w({ outcome: "debounced" });
+        }
+        return true;
+      }
+      /** Cancel all pending debounces. */
+      clear() {
+        for (const [key] of this.pending) {
+          this.cancel(key);
+        }
+      }
+      /** Number of pending debounce keys. */
+      get size() {
+        return this.pending.size;
+      }
+      /** Check if a key is currently executing. */
+      isExecuting(key) {
+        return this.executing.has(key);
+      }
+    };
+  }
+});
+
 // src/state-machine/dispatch/history-snapshot.ts
 var history_snapshot_exports = {};
 __export(history_snapshot_exports, {
@@ -8557,7 +8716,7 @@ var init_dependency_gating = __esm({
 async function renderTemplateContent(checkId, checkConfig, reviewSummary) {
   try {
     const { createExtendedLiquid: createExtendedLiquid2 } = await import("./liquid-extensions-KZIRR4OY.mjs");
-    const fs13 = await import("fs/promises");
+    const fs14 = await import("fs/promises");
     const path15 = await import("path");
     const schemaRaw = checkConfig.schema || "plain";
     const schema = typeof schemaRaw === "string" ? schemaRaw : "code-review";
@@ -8568,7 +8727,7 @@ async function renderTemplateContent(checkId, checkConfig, reviewSummary) {
     } else if (checkConfig.template && checkConfig.template.file) {
       const file = String(checkConfig.template.file);
       const resolved = path15.resolve(process.cwd(), file);
-      templateContent = await fs13.readFile(resolved, "utf-8");
+      templateContent = await fs14.readFile(resolved, "utf-8");
       logger.debug(`[TemplateRenderer] Using template file for ${checkId}: ${resolved}`);
     } else if (schema && schema !== "plain") {
       const sanitized = String(schema).replace(/[^a-zA-Z0-9-]/g, "");
@@ -8585,7 +8744,7 @@ async function renderTemplateContent(checkId, checkConfig, reviewSummary) {
         ];
         for (const p of candidatePaths) {
           try {
-            templateContent = await fs13.readFile(p, "utf-8");
+            templateContent = await fs14.readFile(p, "utf-8");
             if (templateContent) {
               logger.debug(`[TemplateRenderer] Using schema template for ${checkId}: ${p}`);
               break;
@@ -11003,6 +11162,36 @@ async function executeCheckWithForEachItems2(checkId, forEachParent, forEachItem
             wave: state.wave
           },
           async (span) => {
+            if (checkConfig.debounce && checkConfig.debounce > 0) {
+              const debounceKey = checkConfig.debounce_key || checkId;
+              const debounceResult = await getDebounceManager().enqueue(
+                debounceKey,
+                checkConfig.debounce,
+                async () => {
+                  const r = await executeWithSandboxRouting(
+                    checkId,
+                    checkConfig,
+                    context2,
+                    prInfo,
+                    dependencyResults,
+                    checkConfig.timeout || checkConfig.ai?.timeout || 18e5,
+                    () => provider.execute(prInfo, providerConfig, dependencyResults, executionContext)
+                  );
+                  try {
+                    captureCheckOutput(span, r.output);
+                  } catch {
+                  }
+                  return r;
+                }
+              );
+              if (debounceResult.outcome === "debounced") {
+                logger.info(
+                  `[LevelDispatch] ${checkId}: debounced (superseded by later invocation)`
+                );
+                return { issues: [], output: { debounced: true } };
+              }
+              return debounceResult.result;
+            }
             const res = await executeWithSandboxRouting(
               checkId,
               checkConfig,
@@ -11428,7 +11617,7 @@ async function executeCheckWithForEachItems2(checkId, forEachParent, forEachItem
           }
         }
         try {
-          const { evaluateTransitions } = await import("./routing-IB2PXYFC.mjs");
+          const { evaluateTransitions } = await import("./routing-Q647KUMO.mjs");
           const transTarget = await evaluateTransitions(
             onFinish.transitions,
             forEachParent,
@@ -11488,7 +11677,7 @@ async function executeCheckWithForEachItems2(checkId, forEachParent, forEachItem
             `[LevelDispatch] Error evaluating on_finish transitions for ${forEachParent}: ${e instanceof Error ? e.message : String(e)}`
           );
         }
-        const { evaluateGoto: evaluateGoto2 } = await import("./routing-IB2PXYFC.mjs");
+        const { evaluateGoto: evaluateGoto2 } = await import("./routing-Q647KUMO.mjs");
         if (context2.debug) {
           logger.info(
             `[LevelDispatch] Evaluating on_finish.goto_js for forEach parent: ${forEachParent}`
@@ -12154,6 +12343,34 @@ async function executeSingleCheck2(checkId, context2, state, emitEvent, transiti
           wave: state.wave
         },
         async (span) => {
+          if (checkConfig2.debounce && checkConfig2.debounce > 0) {
+            const debounceKey = checkConfig2.debounce_key || checkId;
+            const debounceResult = await getDebounceManager().enqueue(
+              debounceKey,
+              checkConfig2.debounce,
+              async () => {
+                const r = await executeWithSandboxRouting(
+                  checkId,
+                  checkConfig2,
+                  context2,
+                  prInfo,
+                  dependencyResults,
+                  checkConfig2.timeout || checkConfig2.ai?.timeout || 18e5,
+                  () => provider.execute(prInfo, providerConfig, dependencyResults, executionContext)
+                );
+                try {
+                  captureCheckOutput(span, r.output);
+                } catch {
+                }
+                return r;
+              }
+            );
+            if (debounceResult.outcome === "debounced") {
+              logger.info(`[LevelDispatch] ${checkId}: debounced (superseded by later invocation)`);
+              return { issues: [], output: { debounced: true } };
+            }
+            return debounceResult.result;
+          }
           const res = await executeWithSandboxRouting(
             checkId,
             checkConfig2,
@@ -12287,13 +12504,10 @@ async function executeSingleCheck2(checkId, context2, state, emitEvent, transiti
     }
     let isForEach = result.isForEach;
     let forEachItems2 = result.forEachItems;
-    logger.info(
-      `[LevelDispatch][DEBUG] After execution ${checkId}: checkConfig.forEach=${checkConfig2.forEach}, output type=${typeof result.output}, isArray=${Array.isArray(result.output)}`
-    );
     if (checkConfig2.forEach === true) {
       const output = result.output;
-      logger.info(
-        `[LevelDispatch][DEBUG] Processing forEach=true for ${checkId}, output=${JSON.stringify(output)?.substring(0, 200)}`
+      logger.debug(
+        `[LevelDispatch] Processing forEach=true for ${checkId}, output=${JSON.stringify(output)?.substring(0, 200)}`
       );
       if (output === void 0) {
         logger.error(`[LevelDispatch] forEach check "${checkId}" produced undefined output`);
@@ -12793,7 +13007,7 @@ function updateStats2(results, state, isForEachIteration = false) {
 async function renderTemplateContent2(checkId, checkConfig, reviewSummary) {
   try {
     const { createExtendedLiquid: createExtendedLiquid2 } = await import("./liquid-extensions-KZIRR4OY.mjs");
-    const fs13 = await import("fs/promises");
+    const fs14 = await import("fs/promises");
     const path15 = await import("path");
     const schemaRaw = checkConfig.schema || "plain";
     const schema = typeof schemaRaw === "string" && !schemaRaw.includes("{{") && !schemaRaw.includes("{%") ? schemaRaw : typeof schemaRaw === "object" ? "code-review" : "plain";
@@ -12804,7 +13018,7 @@ async function renderTemplateContent2(checkId, checkConfig, reviewSummary) {
     } else if (checkConfig.template && checkConfig.template.file) {
       const file = String(checkConfig.template.file);
       const resolved = path15.resolve(process.cwd(), file);
-      templateContent = await fs13.readFile(resolved, "utf-8");
+      templateContent = await fs14.readFile(resolved, "utf-8");
       logger.debug(`[LevelDispatch] Using template file for ${checkId}: ${resolved}`);
     } else if (schema && schema !== "plain") {
       const sanitized = String(schema).replace(/[^a-zA-Z0-9-]/g, "");
@@ -12823,7 +13037,7 @@ async function renderTemplateContent2(checkId, checkConfig, reviewSummary) {
         ];
         for (const p of candidatePaths) {
           try {
-            templateContent = await fs13.readFile(p, "utf-8");
+            templateContent = await fs14.readFile(p, "utf-8");
             if (templateContent) {
               logger.debug(`[LevelDispatch] Using schema template for ${checkId}: ${p}`);
               break;
@@ -12891,6 +13105,7 @@ var init_level_dispatch = __esm({
     init_workflow_inputs();
     init_sandbox_routing();
     init_policy_gate();
+    init_debounce_manager();
     init_liquid_extensions();
   }
 });
@@ -13438,6 +13653,7 @@ var init_runner = __esm({
 });
 
 // src/utils/workspace-manager.ts
+import * as fs6 from "fs";
 import * as fsp from "fs/promises";
 import * as path7 from "path";
 function shellEscape(str) {
@@ -13650,12 +13866,7 @@ var init_workspace_manager = __esm({
           }
         }
         try {
-          const entries = await fsp.readdir(this.workspacePath, { withFileTypes: true });
-          for (const entry of entries) {
-            if (entry.name !== mainProjectName) {
-              this.usedNames.add(entry.name);
-            }
-          }
+          await this.loadExistingProjects(mainProjectName);
         } catch {
         }
         this.registerCleanupHandlers();
@@ -13800,6 +14011,41 @@ var init_workspace_manager = __esm({
           return false;
         }
       }
+      /**
+       * Rehydrate existing symlinked projects in a persisted workspace so future
+       * runs update them in place instead of allocating project-2, project-3, etc.
+       */
+      async loadExistingProjects(mainProjectName) {
+        const entries = await fsp.readdir(this.workspacePath, { withFileTypes: true });
+        for (const entry of entries) {
+          if (entry.name === mainProjectName) {
+            continue;
+          }
+          const entryPath = path7.join(this.workspacePath, entry.name);
+          this.usedNames.add(entry.name);
+          if (!entry.isSymbolicLink()) {
+            continue;
+          }
+          try {
+            const targetPath = await fsp.realpath(entryPath);
+            const metadataPath = `${targetPath.replace(/\/?$/, "")}.metadata.json`;
+            if (!fs6.existsSync(metadataPath)) {
+              continue;
+            }
+            const metadata = JSON.parse(await fsp.readFile(metadataPath, "utf8"));
+            if (!metadata.repository) {
+              continue;
+            }
+            this.projects.set(entry.name, {
+              name: entry.name,
+              path: entryPath,
+              worktreePath: metadata.worktree_path || targetPath,
+              repository: metadata.repository
+            });
+          } catch {
+          }
+        }
+      }
       /**
        * Clean up stale workspace directories older than maxAge.
        * Call periodically (e.g. at socket-runner startup) to prevent disk bloat.
@@ -13815,6 +14061,17 @@ var init_workspace_manager = __esm({
             try {
               const stat2 = await fsp.stat(dirPath);
               if (now - stat2.mtimeMs > maxAgeMs) {
+                const topGitPath = path7.join(dirPath, ".git");
+                try {
+                  const topGitStat = await fsp.stat(topGitPath);
+                  if (topGitStat.isDirectory()) {
+                    logger.warn(
+                      `[Workspace] Skipping ${dirPath} \u2014 it is a real git repository, not a visor workspace`
+                    );
+                    continue;
+                  }
+                } catch {
+                }
                 try {
                   const subdirs = await fsp.readdir(dirPath, { withFileTypes: true });
                   for (const sub of subdirs) {
@@ -13826,7 +14083,19 @@ var init_workspace_manager = __esm({
                       const match = gitContent.match(/gitdir:\s*(.+)/);
                       if (match) {
                         const worktreeGitDir = match[1].trim();
+                        if (!worktreeGitDir.includes("/.git/worktrees/")) {
+                          logger.warn(
+                            `[Workspace] Skipping worktree removal for ${subPath} \u2014 gitdir does not point to a worktree`
+                          );
+                          continue;
+                        }
                         const repoGitDir = worktreeGitDir.replace(/\/\.git\/worktrees\/.*$/, "");
+                        if (!repoGitDir.startsWith(basePath)) {
+                          logger.warn(
+                            `[Workspace] Skipping worktree removal for ${subPath} \u2014 parent repo ${repoGitDir} is outside workspace`
+                          );
+                          continue;
+                        }
                         await commandExecutor.execute(
                           `git -C ${shellEscape(repoGitDir)} worktree remove ${shellEscape(subPath)} --force`,
                           { timeout: 1e4 }
@@ -14526,7 +14795,7 @@ var init_summary = __esm({
 
 // src/state-machine-execution-engine.ts
 import * as path8 from "path";
-import * as fs6 from "fs";
+import * as fs7 from "fs";
 function serializeRunState(state) {
   return {
     ...state,
@@ -14590,7 +14859,7 @@ var init_state_machine_execution_engine = __esm({
           const gitAnalyzer = new GitRepositoryAnalyzer(options.workingDirectory);
           logger.info("Analyzing local git repository...");
           const repositoryInfo = await gitAnalyzer.analyzeRepository();
-          const hasConversation = !!this.executionContext?.conversation;
+          const hasConversation = !!this.executionContext?.conversation || this.webhookContextHasConversation(options?.webhookContext);
           if (!repositoryInfo.isGitRepository && !hasConversation) {
             return this.createErrorResult(
               repositoryInfo,
@@ -14624,7 +14893,7 @@ var init_state_machine_execution_engine = __esm({
           try {
             const map = options?.webhookContext?.webhookData;
             if (map) {
-              const { CheckProviderRegistry: CheckProviderRegistry2 } = await import("./check-provider-registry-RQYIEQLJ.mjs");
+              const { CheckProviderRegistry: CheckProviderRegistry2 } = await import("./check-provider-registry-2D3MCWP3.mjs");
               const reg = CheckProviderRegistry2.getInstance();
               const p = reg.getProvider("http_input");
               if (p && typeof p.setWebhookContext === "function") p.setWebhookContext(map);
@@ -14737,7 +15006,7 @@ var init_state_machine_execution_engine = __esm({
           logger.info("[StateMachine] Using state machine engine");
         }
         if (!config) {
-          const { ConfigManager } = await import("./config-BCYAVJ5S.mjs");
+          const { ConfigManager } = await import("./config-H5IOLBFA.mjs");
           const configManager = new ConfigManager();
           config = await configManager.getDefaultConfig();
           logger.debug("[StateMachine] Using default configuration (no config provided)");
@@ -14747,7 +15016,7 @@ var init_state_machine_execution_engine = __esm({
           tag_filter: tagFilter
         } : config;
         try {
-          const { CheckProviderRegistry: CheckProviderRegistry2 } = await import("./check-provider-registry-RQYIEQLJ.mjs");
+          const { CheckProviderRegistry: CheckProviderRegistry2 } = await import("./check-provider-registry-2D3MCWP3.mjs");
           const registry = CheckProviderRegistry2.getInstance();
           registry.setCustomTools(configWithTagFilter.tools || {});
         } catch (error) {
@@ -14811,7 +15080,7 @@ var init_state_machine_execution_engine = __esm({
           try {
             const webhookData = this.executionContext?.webhookContext?.webhookData;
             if (webhookData instanceof Map) {
-              const { extractSlackContext: extractSlackContext2 } = await import("./schedule-tool-handler-KYWZHKSS.mjs");
+              const { extractSlackContext: extractSlackContext2 } = await import("./schedule-tool-handler-JMDHCGZ2.mjs");
               const slackCtx = extractSlackContext2(webhookData);
               if (slackCtx) {
                 const payload = Array.from(webhookData.values())[0];
@@ -14840,7 +15109,7 @@ var init_state_machine_execution_engine = __esm({
         if (Array.isArray(configWithTagFilter.frontends) && configWithTagFilter.frontends.length > 0) {
           try {
             const { EventBus } = await import("./event-bus-5K3Y2FCS.mjs");
-            const { FrontendsHost } = await import("./host-FKR7H26C.mjs");
+            const { FrontendsHost } = await import("./host-UQRZDLT7.mjs");
             const bus = new EventBus();
             context2.eventBus = bus;
             frontendsHost = new FrontendsHost(bus, logger);
@@ -14944,7 +15213,7 @@ var init_state_machine_execution_engine = __esm({
                   const checkId = String(ev?.checkId || "unknown");
                   const threadKey = ev?.threadKey || (channel && threadTs ? `${channel}:${threadTs}` : "session");
                   const baseDir = process.env.VISOR_SNAPSHOT_DIR || path8.resolve(process.cwd(), ".visor", "snapshots");
-                  fs6.mkdirSync(baseDir, { recursive: true });
+                  fs7.mkdirSync(baseDir, { recursive: true });
                   const filePath = path8.join(baseDir, `${threadKey}-${checkId}.json`);
                   await this.saveSnapshotToFile(filePath);
                   logger.info(`[Snapshot] Saved run snapshot: ${filePath}`);
@@ -14987,9 +15256,9 @@ var init_state_machine_execution_engine = __esm({
             logger.info("[StateMachine] Execution complete");
           }
           try {
-            const { SessionRegistry: SessionRegistry2 } = await import("./session-registry-6PV6SGEJ.mjs");
+            const { SessionRegistry: SessionRegistry2 } = await import("./session-registry-CENXWIFR.mjs");
             const sessionRegistry = SessionRegistry2.getInstance();
-            sessionRegistry.clearAllSessions();
+            await sessionRegistry.clearAllSessions();
           } catch (error) {
             logger.debug(`[StateMachine] Failed to cleanup sessions: ${error}`);
           }
@@ -15086,7 +15355,7 @@ var init_state_machine_execution_engine = __esm({
        * Does not include secrets. Intended for debugging and future resume support.
        */
       async saveSnapshotToFile(filePath) {
-        const fs13 = await import("fs/promises");
+        const fs14 = await import("fs/promises");
         const ctx = this._lastContext;
         const runner = this._lastRunner;
         if (!ctx || !runner) {
@@ -15106,14 +15375,14 @@ var init_state_machine_execution_engine = __esm({
           journal: entries,
           requestedChecks: ctx.requestedChecks || []
         };
-        await fs13.writeFile(filePath, JSON.stringify(payload, null, 2), "utf8");
+        await fs14.writeFile(filePath, JSON.stringify(payload, null, 2), "utf8");
       }
       /**
        * Load a snapshot JSON from file and return it. Resume support can build on this.
        */
       async loadSnapshotFromFile(filePath) {
-        const fs13 = await import("fs/promises");
-        const raw = await fs13.readFile(filePath, "utf8");
+        const fs14 = await import("fs/promises");
+        const raw = await fs14.readFile(filePath, "utf8");
         return JSON.parse(raw);
       }
       /**
@@ -15178,6 +15447,20 @@ var init_state_machine_execution_engine = __esm({
         const { convertToReviewSummary: convertToReviewSummary2 } = (init_summary(), __toCommonJS(summary_exports));
         return convertToReviewSummary2(groupedResults, statistics);
       }
+      webhookContextHasConversation(webhookContext) {
+        try {
+          const webhookData = webhookContext?.webhookData;
+          if (!(webhookData instanceof Map)) return false;
+          for (const payload of webhookData.values()) {
+            const value = payload;
+            if (value?.conversation || value?.slack_conversation || value?.mcp_conversation || value?.telegram_conversation || value?.teams_conversation || value?.whatsapp_conversation || value?.email_conversation) {
+              return true;
+            }
+          }
+        } catch {
+        }
+        return false;
+      }
       /**
        * Evaluate failure conditions for a check result
        *
@@ -15192,9 +15475,9 @@ var init_state_machine_execution_engine = __esm({
        * @returns Array of failure condition evaluation results
        */
       async evaluateFailureConditions(checkName, reviewSummary, config, previousOutputs, authorAssociation) {
-        const { FailureConditionEvaluator: FailureConditionEvaluator2 } = await import("./failure-condition-evaluator-ZBOSD574.mjs");
+        const { FailureConditionEvaluator: FailureConditionEvaluator2 } = await import("./failure-condition-evaluator-66PWLV3D.mjs");
         const evaluator = new FailureConditionEvaluator2();
-        const { addEvent: addEvent3 } = await import("./trace-helpers-AMZ2524G.mjs");
+        const { addEvent: addEvent3 } = await import("./trace-helpers-AIUGQLK5.mjs");
         const { addFailIfTriggered } = await import("./metrics-MYUPQBBV.mjs");
         const checkConfig = config.checks?.[checkName];
         if (!checkConfig) {
@@ -15597,7 +15880,11 @@ var init_scheduler = __esm({
         if (!cron.validate(job.schedule)) {
           throw new Error(`Invalid cron expression: ${job.schedule}`);
         }
-        if (job.workflow !== "default") {
+        if (!job.workflow) {
+          if (!job.inputs?.text) {
+            throw new Error("Cron job without a workflow must have inputs.text set");
+          }
+        } else if (job.workflow !== "default") {
           const allChecks = Object.keys(this.visorConfig.checks || {});
           if (!allChecks.includes(job.workflow)) {
             throw new Error(`Workflow "${job.workflow}" not found in configuration`);
@@ -15620,7 +15907,7 @@ var init_scheduler = __esm({
           const nextRun = getNextRunTime(job.schedule, job.timezone || this.defaultTimezone);
           const description = job.description ? ` (${job.description})` : "";
           logger.debug(
-            `[Scheduler] Scheduled static cron job '${jobId}'${description}: ${job.schedule} \u2192 ${job.workflow}, next run: ${nextRun.toISOString()}`
+            `[Scheduler] Scheduled static cron job '${jobId}'${description}: ${job.schedule} \u2192 ${job.workflow || "(reminder)"}, next run: ${nextRun.toISOString()}`
           );
         } catch {
         }
@@ -16030,7 +16317,7 @@ var init_scheduler = __esm({
           inputs: schedule.workflowInputs
         });
         if (this.taskStore) {
-          const { trackExecution } = await import("./track-execution-VW6P3OYO.mjs");
+          const { trackExecution } = await import("./track-execution-CFRZXMEC.mjs");
           await trackExecution(
             {
               taskStore: this.taskStore,
@@ -16159,7 +16446,7 @@ Please provide an updated response based on the reminder above. You may referenc
             debug: process.env.VISOR_DEBUG === "true"
           });
           if (this.taskStore) {
-            const { trackExecution } = await import("./track-execution-VW6P3OYO.mjs");
+            const { trackExecution } = await import("./track-execution-CFRZXMEC.mjs");
             await trackExecution(
               {
                 taskStore: this.taskStore,
@@ -17315,7 +17602,7 @@ async function handleTrace(taskId, taskStore) {
       ].filter(Boolean).join("\n")
     };
   }
-  const { serializeTraceForPrompt } = await import("./trace-serializer-EBHTHZYT.mjs");
+  const { serializeTraceForPrompt } = await import("./trace-serializer-4TOIAVQL.mjs");
   const taskResponse = task.status?.message?.parts?.[0]?.text;
   const traceTree = await serializeTraceForPrompt(
     resolvedTrace.primaryRef || "",
@@ -17523,7 +17810,7 @@ var init_schedule_tool_handler = __esm({
 });
 
 // src/providers/mcp-custom-sse-server.ts
-import fs7 from "fs";
+import fs8 from "fs";
 import http from "http";
 import { EventEmitter } from "events";
 function isHttpClientTool(tool) {
@@ -18098,9 +18385,24 @@ var init_mcp_custom_sse_server = __esm({
           }
           return record;
         };
+        const fixRequiredFields = (obj) => {
+          if (!obj || typeof obj !== "object" || Array.isArray(obj)) return obj;
+          const record = obj;
+          if (Array.isArray(record.required) && record.properties && typeof record.properties === "object") {
+            const validProps = Object.keys(record.properties);
+            record.required = record.required.filter((r) => validProps.includes(r));
+          }
+          for (const key of Object.keys(record)) {
+            if (typeof record[key] === "object" && record[key] !== null) {
+              fixRequiredFields(record[key]);
+            }
+          }
+          return record;
+        };
         const normalizeInputSchema = (schema) => {
           if (schema && schema.type === "object") {
             fixArraySchemas(schema);
+            fixRequiredFields(schema);
             return schema;
           }
           return {
@@ -18109,7 +18411,10 @@ var init_mcp_custom_sse_server = __esm({
             required: []
           };
         };
-        const regularTools = await this.toolExecutor.listMcpTools();
+        const regularTools = (await this.toolExecutor.listMcpTools()).map((tool) => ({
+          ...tool,
+          inputSchema: normalizeInputSchema(tool.inputSchema)
+        }));
         const workflowTools = Array.from(this.tools.values()).filter(isWorkflowTool).map((tool) => ({
           name: tool.name,
           description: tool.description || `Execute ${tool.name}`,
@@ -18424,7 +18729,7 @@ var init_mcp_custom_sse_server = __esm({
             const contentType = r.content_type || r.output?.content_type || r.result?.content_type || "";
             if (filePath && typeof filePath === "string" && contentType.startsWith("image/")) {
               try {
-                const imageBuffer = fs7.readFileSync(filePath);
+                const imageBuffer = fs8.readFileSync(filePath);
                 contentBlocks.push({
                   type: "image",
                   data: imageBuffer.toString("base64"),
@@ -18494,6 +18799,11 @@ var init_mcp_custom_sse_server = __esm({
           if (authType === "bearer" && tool.auth.token) {
             const token = String(EnvironmentResolver.resolveValue(tool.auth.token));
             resolvedHeaders["Authorization"] = `Bearer ${token}`;
+          } else if (authType === "oauth2_client_credentials" && tool.auth.token_url) {
+            const { OAuth2TokenCache: OAuth2TokenCache2 } = await import("./oauth2-token-cache-OS7WHLDI.mjs");
+            const tokenCache = OAuth2TokenCache2.getInstance();
+            const token = await tokenCache.getToken(tool.auth);
+            resolvedHeaders["Authorization"] = `Bearer ${token}`;
           }
         }
         if (this.debug) {
@@ -18592,7 +18902,7 @@ var init_mcp_custom_sse_server = __esm({
             `[CustomToolsSSEServer:${this.sessionId}] Executing UTCP tool '${utcpToolName}' with args: ${JSON.stringify(args)}`
           );
         }
-        const { UtcpCheckProvider: UtcpCheckProvider2 } = await import("./utcp-check-provider-Q4PD5EP2.mjs");
+        const { UtcpCheckProvider: UtcpCheckProvider2 } = await import("./utcp-check-provider-WDTSQ7DZ.mjs");
         return UtcpCheckProvider2.callTool(manual, utcpToolName, args, {
           variables: tool.__utcpVariables || {},
           plugins: tool.__utcpPlugins || ["http"],
@@ -18753,7 +19063,7 @@ var init_tool_resolver = __esm({
 });
 
 // src/providers/ai-check-provider.ts
-import fs8 from "fs/promises";
+import fs9 from "fs/promises";
 import path9 from "path";
 var AICheckProvider;
 var init_ai_check_provider = __esm({
@@ -18774,6 +19084,7 @@ var init_ai_check_provider = __esm({
     init_schedule_tool();
     init_task_progress_tool();
     init_schedule_tool_handler();
+    init_user_facing_error();
     AICheckProvider = class _AICheckProvider extends CheckProvider {
       aiReviewService;
       liquidEngine;
@@ -18953,9 +19264,9 @@ var init_ai_check_provider = __esm({
           } else {
             resolvedPath = path9.resolve(process.cwd(), str);
           }
-          const fs13 = __require("fs").promises;
+          const fs14 = __require("fs").promises;
           try {
-            const stat2 = await fs13.stat(resolvedPath);
+            const stat2 = await fs14.stat(resolvedPath);
             return stat2.isFile();
           } catch {
             return hasFileExtension && (isRelativePath || isAbsolutePath || hasPathSeparators);
@@ -18988,7 +19299,7 @@ var init_ai_check_provider = __esm({
           throw new Error("Invalid prompt file path: path traversal detected");
         }
         try {
-          const promptContent = await fs8.readFile(resolvedPath, "utf-8");
+          const promptContent = await fs9.readFile(resolvedPath, "utf-8");
           return promptContent;
         } catch (error) {
           throw new Error(
@@ -19904,7 +20215,7 @@ ${preview}`);
             if (utcpEntriesFromMcp.length > 0) {
               for (const entry of utcpEntriesFromMcp) {
                 try {
-                  const { UtcpCheckProvider: UtcpCheckProvider2 } = await import("./utcp-check-provider-Q4PD5EP2.mjs");
+                  const { UtcpCheckProvider: UtcpCheckProvider2 } = await import("./utcp-check-provider-WDTSQ7DZ.mjs");
                   const manual = entry.config.manual;
                   const variables = entry.config.variables;
                   const plugins = entry.config.plugins || ["http"];
@@ -20376,13 +20687,14 @@ ${processedPrompt}` : processedPrompt;
           }
         } catch (error) {
           const errorMessage = error instanceof Error ? error.message : String(error);
+          const userFacingMessage = formatUserFacingExecutionError(error);
           console.error(`\u274C AI Check Provider Error for check: ${errorMessage}`);
           const isCriticalError = errorMessage.includes("API rate limit") || errorMessage.includes("403") || errorMessage.includes("401") || errorMessage.includes("authentication") || errorMessage.includes("API key");
           if (isCriticalError) {
             console.error(`\u{1F6A8} CRITICAL ERROR: AI provider authentication or rate limit issue detected`);
             console.error(`\u{1F6A8} This check cannot proceed without valid API credentials`);
           }
-          throw new Error(`AI analysis failed: ${errorMessage}`);
+          throw new Error(userFacingMessage);
         } finally {
           if (customToolsServer) {
             try {
@@ -21277,114 +21589,8 @@ var init_template_context = __esm({
   }
 });
 
-// src/utils/oauth2-token-cache.ts
-var OAuth2TokenCache;
-var init_oauth2_token_cache = __esm({
-  "src/utils/oauth2-token-cache.ts"() {
-    "use strict";
-    init_logger();
-    init_env_resolver();
-    OAuth2TokenCache = class _OAuth2TokenCache {
-      static instance;
-      cache = /* @__PURE__ */ new Map();
-      static getInstance() {
-        if (!_OAuth2TokenCache.instance) {
-          _OAuth2TokenCache.instance = new _OAuth2TokenCache();
-        }
-        return _OAuth2TokenCache.instance;
-      }
-      /** Visible for testing */
-      static resetInstance() {
-        _OAuth2TokenCache.instance = void 0;
-      }
-      /**
-       * Get a valid Bearer token for the given config.
-       * Returns a cached token if still valid, otherwise fetches a new one.
-       */
-      async getToken(config) {
-        const clientId = String(EnvironmentResolver.resolveValue(config.client_id));
-        const clientSecret = String(EnvironmentResolver.resolveValue(config.client_secret));
-        const tokenUrl = String(EnvironmentResolver.resolveValue(config.token_url));
-        const bufferMs = (config.token_ttl_buffer ?? 300) * 1e3;
-        const cacheKey = `${tokenUrl}|${clientId}`;
-        const cached = this.cache.get(cacheKey);
-        if (cached && cached.expires_at - bufferMs > Date.now()) {
-          logger.verbose("[oauth2] Using cached token");
-          return cached.access_token;
-        }
-        if (cached?.refreshPromise) {
-          logger.verbose("[oauth2] Awaiting in-flight token refresh");
-          return cached.refreshPromise;
-        }
-        const refreshPromise = this.fetchToken(tokenUrl, clientId, clientSecret, config.scopes);
-        if (cached) {
-          cached.refreshPromise = refreshPromise;
-        } else {
-          this.cache.set(cacheKey, {
-            access_token: "",
-            expires_at: 0,
-            refreshPromise
-          });
-        }
-        try {
-          const token = await refreshPromise;
-          return token;
-        } finally {
-          const entry = this.cache.get(cacheKey);
-          if (entry) {
-            entry.refreshPromise = void 0;
-          }
-        }
-      }
-      async fetchToken(tokenUrl, clientId, clientSecret, scopes) {
-        logger.verbose(`[oauth2] Fetching token from ${tokenUrl}`);
-        const credentials = Buffer.from(`${clientId}:${clientSecret}`).toString("base64");
-        const bodyParams = new URLSearchParams({ grant_type: "client_credentials" });
-        if (scopes?.length) {
-          bodyParams.set("scope", scopes.join(" "));
-        }
-        const response = await fetch(tokenUrl, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/x-www-form-urlencoded",
-            Authorization: `Basic ${credentials}`
-          },
-          body: bodyParams.toString()
-        });
-        if (!response.ok) {
-          let errorDetail = "";
-          try {
-            errorDetail = await response.text();
-          } catch {
-          }
-          throw new Error(
-            `OAuth2 token request failed: HTTP ${response.status} ${response.statusText}${errorDetail ? ` - ${errorDetail.substring(0, 200)}` : ""}`
-          );
-        }
-        const data = await response.json();
-        if (!data.access_token) {
-          throw new Error("OAuth2 token response missing access_token");
-        }
-        const expiresIn = data.expires_in ?? 3600;
-        const expiresAt = Date.now() + expiresIn * 1e3;
-        const cacheKey = `${tokenUrl}|${clientId}`;
-        this.cache.set(cacheKey, {
-          access_token: data.access_token,
-          expires_at: expiresAt
-        });
-        logger.verbose(`[oauth2] Token acquired, expires in ${expiresIn}s`);
-        return data.access_token;
-      }
-      /** Clear all cached tokens (for testing or credential rotation) */
-      clear() {
-        this.cache.clear();
-      }
-    };
-  }
-});
-
 // src/providers/http-client-provider.ts
-import * as fs9 from "fs";
+import * as fs10 from "fs";
 import * as path10 from "path";
 var HttpClientProvider;
 var init_http_client_provider = __esm({
@@ -21530,8 +21736,8 @@ var init_http_client_provider = __esm({
                 `[http_client] Resolved relative output_file to workspace: ${resolvedOutputFile}`
               );
             }
-            if (skipIfExists && fs9.existsSync(resolvedOutputFile)) {
-              const stats = fs9.statSync(resolvedOutputFile);
+            if (skipIfExists && fs10.existsSync(resolvedOutputFile)) {
+              const stats = fs10.statSync(resolvedOutputFile);
               logger.verbose(`[http_client] File cached: ${resolvedOutputFile} (${stats.size} bytes)`);
               return {
                 issues: [],
@@ -21762,12 +21968,12 @@ var init_http_client_provider = __esm({
             };
           }
           const parentDir = path10.dirname(outputFile);
-          if (parentDir && !fs9.existsSync(parentDir)) {
-            fs9.mkdirSync(parentDir, { recursive: true });
+          if (parentDir && !fs10.existsSync(parentDir)) {
+            fs10.mkdirSync(parentDir, { recursive: true });
           }
           const arrayBuffer = await response.arrayBuffer();
           const buffer = Buffer.from(arrayBuffer);
-          fs9.writeFileSync(outputFile, buffer);
+          fs10.writeFileSync(outputFile, buffer);
           const contentType = response.headers.get("content-type") || "application/octet-stream";
           logger.verbose(`[http_client] Downloaded: ${outputFile} (${buffer.length} bytes)`);
           return {
@@ -22534,7 +22740,7 @@ var init_claude_code_types = __esm({
 });
 
 // src/providers/claude-code-check-provider.ts
-import fs10 from "fs/promises";
+import fs11 from "fs/promises";
 import path11 from "path";
 function isClaudeCodeConstructor(value) {
   return typeof value === "function";
@@ -22710,7 +22916,7 @@ var init_claude_code_check_provider = __esm({
             resolvedPath = path11.resolve(process.cwd(), str);
           }
           try {
-            const stat2 = await fs10.stat(resolvedPath);
+            const stat2 = await fs11.stat(resolvedPath);
             return stat2.isFile();
           } catch {
             return hasFileExtension && (isRelativePath || isAbsolutePath || hasPathSeparators);
@@ -22743,7 +22949,7 @@ var init_claude_code_check_provider = __esm({
           throw new Error("Invalid prompt file path: path traversal detected");
         }
         try {
-          const promptContent = await fs10.readFile(resolvedPath, "utf-8");
+          const promptContent = await fs11.readFile(resolvedPath, "utf-8");
           return promptContent;
         } catch (error) {
           throw new Error(
@@ -41997,6 +42203,14 @@ var init_mcp_check_provider = __esm({
             }
           );
           const transport = createTransport();
+          if ("stderr" in transport && transport.stderr) {
+            const stderrStream = transport.stderr;
+            if (typeof stderrStream.on === "function") {
+              stderrStream.on("error", (err) => {
+                logger.debug(`MCP transport stderr error (${transportName}): ${err.message}`);
+              });
+            }
+          }
           try {
             let timeoutId;
             try {
@@ -42557,7 +42771,7 @@ var init_stdin_reader = __esm({
 });
 
 // src/providers/human-input-check-provider.ts
-import * as fs11 from "fs";
+import * as fs12 from "fs";
 import * as path12 from "path";
 var HumanInputCheckProvider;
 var init_human_input_check_provider = __esm({
@@ -42748,12 +42962,12 @@ var init_human_input_check_provider = __esm({
             return null;
           }
           try {
-            await fs11.promises.access(normalizedPath, fs11.constants.R_OK);
-            const stats = await fs11.promises.stat(normalizedPath);
+            await fs12.promises.access(normalizedPath, fs12.constants.R_OK);
+            const stats = await fs12.promises.stat(normalizedPath);
             if (!stats.isFile()) {
               return null;
             }
-            const content = await fs11.promises.readFile(normalizedPath, "utf-8");
+            const content = await fs12.promises.readFile(normalizedPath, "utf-8");
             return content.trim();
           } catch {
             return null;
@@ -43321,8 +43535,8 @@ function buildBuiltinGlobals(opts) {
   const asyncFunctionNames = /* @__PURE__ */ new Set();
   const scheduleFn = async (args = {}) => {
     try {
-      const { handleScheduleAction: handleScheduleAction2, buildScheduleToolContext: buildScheduleToolContext2 } = await import("./schedule-tool-LB33KL2W.mjs");
-      const { extractSlackContext: extractSlackContext2 } = await import("./schedule-tool-handler-KYWZHKSS.mjs");
+      const { handleScheduleAction: handleScheduleAction2, buildScheduleToolContext: buildScheduleToolContext2 } = await import("./schedule-tool-WMGSM6IT.mjs");
+      const { extractSlackContext: extractSlackContext2 } = await import("./schedule-tool-handler-JMDHCGZ2.mjs");
       const parentCtx = opts.sessionInfo?._parentContext;
       const webhookData = parentCtx?.prInfo?.eventContext?.webhookData;
       const webhookEventType = parentCtx?.webhookContext?.eventType || parentCtx?.prInfo?.eventContext?.eventType;
@@ -43810,6 +44024,11 @@ var init_script_check_provider = __esm({
                 env,
                 stderr: "pipe"
               });
+              if (transport.stderr) {
+                transport.stderr.on("error", (err) => {
+                  logger.debug(`MCP transport stderr error: ${err.message}`);
+                });
+              }
               await Promise.race([
                 client.connect(transport),
                 new Promise(
@@ -43907,8 +44126,39 @@ var init_script_check_provider = __esm({
   }
 });
 
+// src/utils/child-process-error-handler.ts
+function isChildProcessIOError(error) {
+  if (!(error instanceof Error)) return false;
+  const errno = error.code;
+  if (errno && TRANSIENT_IO_CODES.has(errno)) return true;
+  const msg = error.message;
+  if (msg.includes("read EIO") || msg.includes("write EPIPE")) return true;
+  if (msg.includes("ERR_STREAM_DESTROYED")) return true;
+  return false;
+}
+var TRANSIENT_IO_CODES, GUARD;
+var init_child_process_error_handler = __esm({
+  "src/utils/child-process-error-handler.ts"() {
+    "use strict";
+    init_logger();
+    TRANSIENT_IO_CODES = /* @__PURE__ */ new Set(["EIO", "EPIPE", "ECONNRESET"]);
+    GUARD = Symbol.for("visor.childProcessErrorHandler");
+    if (!globalThis[GUARD]) {
+      globalThis[GUARD] = true;
+      process.on("uncaughtException", (error, origin) => {
+        if (isChildProcessIOError(error)) {
+          logger.warn(
+            `[child-process-error-handler] Suppressed transient I/O error (${origin}): ${error.message}`
+          );
+          return;
+        }
+      });
+    }
+  }
+});
+
 // src/utils/worktree-manager.ts
-import * as fs12 from "fs";
+import * as fs13 from "fs";
 import * as fsp2 from "fs/promises";
 import * as path13 from "path";
 import * as crypto from "crypto";
@@ -43917,6 +44167,7 @@ var init_worktree_manager = __esm({
   "src/utils/worktree-manager.ts"() {
     "use strict";
     init_command_executor();
+    init_child_process_error_handler();
     init_logger();
     WorktreeManager = class _WorktreeManager {
       static instance;
@@ -43967,12 +44218,12 @@ var init_worktree_manager = __esm({
         }
         const reposDir = this.getReposDir();
         const worktreesDir = this.getWorktreesDir();
-        if (!fs12.existsSync(reposDir)) {
-          fs12.mkdirSync(reposDir, { recursive: true });
+        if (!fs13.existsSync(reposDir)) {
+          fs13.mkdirSync(reposDir, { recursive: true });
           logger.debug(`Created repos directory: ${reposDir}`);
         }
-        if (!fs12.existsSync(worktreesDir)) {
-          fs12.mkdirSync(worktreesDir, { recursive: true });
+        if (!fs13.existsSync(worktreesDir)) {
+          fs13.mkdirSync(worktreesDir, { recursive: true });
           logger.debug(`Created worktrees directory: ${worktreesDir}`);
         }
       }
@@ -44006,7 +44257,7 @@ var init_worktree_manager = __esm({
         const reposDir = this.getReposDir();
         const repoName = repository.replace(/\//g, "-");
         const bareRepoPath = path13.join(reposDir, `${repoName}.git`);
-        if (fs12.existsSync(bareRepoPath)) {
+        if (fs13.existsSync(bareRepoPath)) {
           logger.debug(`Bare repository already exists: ${bareRepoPath}`);
           const verifyResult = await this.verifyBareRepoRemote(bareRepoPath, repoUrl);
           if (verifyResult === "timeout") {
@@ -44075,6 +44326,7 @@ var init_worktree_manager = __esm({
             const result = await this.executeGitCommand(updateCmd, { timeout: 9e4 });
             if (result.exitCode === 0) {
               logger.debug(`Successfully updated bare repository`);
+              await this.gcBareRepo(bareRepoPath);
               return;
             }
             logger.warn(`Bare repo update attempt ${attempt}/2 failed: ${result.stderr}`);
@@ -44088,6 +44340,36 @@ var init_worktree_manager = __esm({
         }
         logger.warn(`Failed to update bare repository after 2 attempts (will rely on per-ref fetch)`);
       }
+      /**
+       * Consolidate pack files after fetch to prevent unbounded pack accumulation.
+       * Each `git fetch` creates a new pack file; without periodic repacking these
+       * pile up and waste disk (especially on COW filesystems like BTRFS).
+       */
+      async gcBareRepo(bareRepoPath) {
+        try {
+          const packDir = path13.join(bareRepoPath, "objects", "pack");
+          if (!fs13.existsSync(packDir)) return;
+          const packFiles = fs13.readdirSync(packDir).filter((f) => f.endsWith(".pack"));
+          if (packFiles.length <= 3) return;
+          if (packFiles.length > 10) {
+            logger.info(`Repacking bare repo (${packFiles.length} packs): ${bareRepoPath}`);
+            const repackCmd = `git -C ${this.escapeShellArg(bareRepoPath)} repack -a -d --unpack-unreachable=now`;
+            const result = await this.executeGitCommand(repackCmd, { timeout: 3e5 });
+            if (result.exitCode === 0) {
+              logger.info(`Repack complete for ${bareRepoPath}`);
+              const pruneCmd = `git -C ${this.escapeShellArg(bareRepoPath)} prune --expire=now`;
+              await this.executeGitCommand(pruneCmd, { timeout: 6e4 });
+            } else {
+              logger.warn(`Repack failed: ${result.stderr}`);
+            }
+          } else {
+            const gcCmd = `git -C ${this.escapeShellArg(bareRepoPath)} gc --auto`;
+            await this.executeGitCommand(gcCmd, { timeout: 12e4 });
+          }
+        } catch (error) {
+          logger.debug(`gc/repack non-fatal error: ${error}`);
+        }
+      }
       /**
        * Verify that a bare repository has the correct remote URL.
        * This prevents reusing corrupted repos that were cloned from a different repository.
@@ -44180,7 +44462,7 @@ var init_worktree_manager = __esm({
           worktreePath = this.validatePath(options.workingDirectory);
         }
         let refreshFailedNeedsRecreate = false;
-        if (fs12.existsSync(worktreePath)) {
+        if (fs13.existsSync(worktreePath)) {
           logger.debug(`Worktree already exists: ${worktreePath}`);
           const metadata2 = await this.loadMetadata(worktreePath);
           if (metadata2) {
@@ -44509,9 +44791,13 @@ var init_worktree_manager = __esm({
        * Remove a worktree
        */
       async removeWorktree(worktreeId) {
-        const metadata = this.activeWorktrees.get(worktreeId);
+        let metadata = this.activeWorktrees.get(worktreeId);
         if (!metadata) {
-          logger.warn(`Worktree not found in active list: ${worktreeId}`);
+          const worktreePath = path13.join(this.getWorktreesDir(), worktreeId);
+          metadata = await this.loadMetadata(worktreePath) || void 0;
+        }
+        if (!metadata) {
+          logger.warn(`Worktree metadata not found: ${worktreeId}`);
           return;
         }
         const { bare_repo_path, worktree_path } = metadata;
@@ -44520,15 +44806,15 @@ var init_worktree_manager = __esm({
         const result = await this.executeGitCommand(removeCmd, { timeout: 3e4 });
         if (result.exitCode !== 0) {
           logger.warn(`Failed to remove worktree via git: ${result.stderr}`);
-          if (fs12.existsSync(worktree_path)) {
+          if (fs13.existsSync(worktree_path)) {
             logger.debug(`Manually removing worktree directory`);
-            fs12.rmSync(worktree_path, { recursive: true, force: true });
+            fs13.rmSync(worktree_path, { recursive: true, force: true });
           }
         }
         const metadataPath = this.getMetadataPath(worktree_path);
         try {
-          if (fs12.existsSync(metadataPath)) {
-            fs12.unlinkSync(metadataPath);
+          if (fs13.existsSync(metadataPath)) {
+            fs13.unlinkSync(metadataPath);
           }
         } catch {
         }
@@ -44548,7 +44834,7 @@ var init_worktree_manager = __esm({
        */
       async saveMetadata(worktreePath, metadata) {
         const metadataPath = this.getMetadataPath(worktreePath);
-        fs12.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), "utf8");
+        fs13.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), "utf8");
       }
       /**
        * Load worktree metadata
@@ -44556,12 +44842,12 @@ var init_worktree_manager = __esm({
       async loadMetadata(worktreePath) {
         const metadataPath = this.getMetadataPath(worktreePath);
         const legacyPath = path13.join(worktreePath, ".visor-metadata.json");
-        const pathToRead = fs12.existsSync(metadataPath) ? metadataPath : fs12.existsSync(legacyPath) ? legacyPath : null;
+        const pathToRead = fs13.existsSync(metadataPath) ? metadataPath : fs13.existsSync(legacyPath) ? legacyPath : null;
         if (!pathToRead) {
           return null;
         }
         try {
-          const content = fs12.readFileSync(pathToRead, "utf8");
+          const content = fs13.readFileSync(pathToRead, "utf8");
           return JSON.parse(content);
         } catch (error) {
           logger.warn(`Failed to load metadata: ${error}`);
@@ -44573,10 +44859,10 @@ var init_worktree_manager = __esm({
        */
       async listWorktrees() {
         const worktreesDir = this.getWorktreesDir();
-        if (!fs12.existsSync(worktreesDir)) {
+        if (!fs13.existsSync(worktreesDir)) {
           return [];
         }
-        const entries = fs12.readdirSync(worktreesDir, { withFileTypes: true });
+        const entries = fs13.readdirSync(worktreesDir, { withFileTypes: true });
         const worktrees = [];
         for (const entry of entries) {
           if (!entry.isDirectory()) continue;
@@ -44664,6 +44950,10 @@ var init_worktree_manager = __esm({
             process.exit(143);
           });
           process.on("uncaughtException", async (error) => {
+            if (isChildProcessIOError(error)) {
+              logger.warn(`Ignoring transient child-process I/O error: ${error.message}`);
+              return;
+            }
             logger.error(`Uncaught exception, cleaning up worktrees: ${error}`);
             await this.cleanupProcessWorktrees();
             process.exit(1);
@@ -45731,7 +46021,7 @@ var init_workflow_executor = __esm({
             if (step.if) {
               const shouldRun = this.evaluateCondition(step.if, {
                 inputs: executionContext.inputs,
-                outputs: Object.fromEntries(stepResults),
+                outputs: this.unwrapOutputs(stepResults),
                 pr: runOptions.prInfo
               });
               if (!shouldRun) {
@@ -45894,18 +46184,14 @@ var init_workflow_executor = __esm({
                 throw new Error("Expression mapping requires expression field");
               }
               const sandbox = createSecureSandbox();
+              const unwrappedExpr = this.unwrapOutputs(stepResults);
               return compileAndRun(
                 sandbox,
                 typedMapping.expression,
                 {
                   inputs: executionContext.inputs,
-                  outputs: Object.fromEntries(stepResults),
-                  steps: Object.fromEntries(
-                    Array.from(stepResults.entries()).map(([id, result]) => [
-                      id,
-                      result.output
-                    ])
-                  )
+                  outputs: unwrappedExpr,
+                  steps: unwrappedExpr
                 },
                 { injectLog: true, logPrefix: "workflow.input.expression" }
               );
@@ -45918,7 +46204,7 @@ var init_workflow_executor = __esm({
           if (typedMapping.template) {
             return await this.liquid.parseAndRender(typedMapping.template, {
               inputs: executionContext.inputs,
-              outputs: Object.fromEntries(stepResults)
+              outputs: this.unwrapOutputs(stepResults)
             });
           }
         }
@@ -45945,32 +46231,44 @@ var init_workflow_executor = __esm({
         for (const output of workflow.outputs) {
           if (output.value_js) {
             const sandbox = createSecureSandbox();
+            const unwrapped = this.unwrapOutputs(stepResults);
             outputs[output.name] = compileAndRun(
               sandbox,
               output.value_js,
               {
                 inputs: executionContext.inputs,
-                steps: Object.fromEntries(
-                  Array.from(stepResults.entries()).map(([id, result]) => [id, result.output])
-                ),
-                outputs: Object.fromEntries(stepResults),
+                steps: unwrapped,
+                outputs: unwrapped,
                 pr: prInfo
               },
               { injectLog: true, logPrefix: `workflow.output.${output.name}` }
             );
           } else if (output.value) {
+            const unwrappedLiquid = this.unwrapOutputs(stepResults);
             outputs[output.name] = await this.liquid.parseAndRender(output.value, {
               inputs: executionContext.inputs,
-              steps: Object.fromEntries(
-                Array.from(stepResults.entries()).map(([id, result]) => [id, result.output])
-              ),
-              outputs: Object.fromEntries(stepResults),
+              steps: unwrappedLiquid,
+              outputs: unwrappedLiquid,
               pr: prInfo
             });
           }
         }
         return outputs;
       }
+      /**
+       * Unwrap step outputs from ReviewSummary wrappers.
+       * Script steps and MCP steps store results as { issues: [], output: <actual> }.
+       * Workflow value_js/if/Liquid should see the unwrapped output, consistent with
+       * how script step contexts already unwrap via buildProviderTemplateContext.
+       */
+      unwrapOutputs(stepResults) {
+        const unwrapped = {};
+        for (const [id, result] of stepResults.entries()) {
+          const summary = result;
+          unwrapped[id] = summary.output !== void 0 ? summary.output : summary;
+        }
+        return unwrapped;
+      }
       /**
        * Aggregate results from all steps
        */
@@ -46162,6 +46460,7 @@ var init_workflow_check_provider = __esm({
     init_toolkit_expander();
     init_human_id();
     init_liquid_extensions();
+    init_user_facing_error();
     WorkflowCheckProvider = class extends CheckProvider {
       registry;
       executor;
@@ -46779,6 +47078,18 @@ var init_workflow_check_provider = __esm({
             scoreCount++;
           }
         }
+        for (const checkStats of result.statistics?.checks || []) {
+          if (checkStats.errorMessage) {
+            allIssues.push({
+              file: "system",
+              line: 0,
+              ruleId: "system/error",
+              message: formatUserFacingExecutionMessage(checkStats.errorMessage),
+              severity: "error",
+              category: "logic"
+            });
+          }
+        }
         const outputs = await this.computeWorkflowOutputsFromState(
           workflow,
           inputs,
@@ -46973,13 +47284,13 @@ var init_workflow_check_provider = __esm({
        */
       async loadWorkflowFromConfigPath(sourcePath, baseDir) {
         const path15 = __require("path");
-        const fs13 = __require("fs");
+        const fs14 = __require("fs");
         const yaml3 = __require("js-yaml");
         const resolved = path15.isAbsolute(sourcePath) ? sourcePath : path15.resolve(baseDir, sourcePath);
-        if (!fs13.existsSync(resolved)) {
+        if (!fs14.existsSync(resolved)) {
           throw new Error(`Workflow config not found at: ${resolved}`);
         }
-        const rawContent = fs13.readFileSync(resolved, "utf8");
+        const rawContent = fs14.readFileSync(resolved, "utf8");
         const rawData = yaml3.load(rawContent);
         if (rawData.imports && Array.isArray(rawData.imports)) {
           const configDir = path15.dirname(resolved);
@@ -47061,4 +47372,4 @@ undici/lib/fetch/body.js:
 undici/lib/websocket/frame.js:
   (*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> *)
 */
-//# sourceMappingURL=chunk-NPOVLLKH.mjs.map
+//# sourceMappingURL=chunk-TGQBEM3Y.mjs.map