@toolu/opencode 6.8.0

package/plugins/jira/skills/jira/scripts/lib/project.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# project.sh — Jira project operations: list, get, versions, components. Sourced;
+# depends on http.sh (jira_curl/jira_lean). All actions are read-only GETs.
+
+_jira_project_path() { printf '/rest/api/%s/project' "${_JIRA_VER:-3}"; }
+
+jira_project() {
+  local action="${1:-}"; [[ $# -gt 0 ]] && shift
+  case "$action" in
+    list)       _jira_project_list "$@";;
+    get)        _jira_project_get "$@";;
+    versions)   _jira_project_versions "$@";;
+    components) _jira_project_components "$@";;
+    *) echo "Usage: jira project <list|get|versions|components> ..." >&2; return 1;;
+  esac
+}
+
+# list: GET the project collection (a top-level array), leaned to key/name/id.
+_jira_project_list() {
+  jira_curl GET "$(_jira_project_path)" | jira_lean '{projects:[.[]|{key, name, id}]}'
+}
+
+# get <KEY>: GET one project's full detail.
+_jira_project_get() {
+  local key="${1:-}"
+  [[ -z "$key" ]] && { echo "Usage: jira project get <KEY>" >&2; return 1; }
+  jira_curl GET "$(_jira_project_path)/$key" | jira_lean '.'
+}
+
+# versions <KEY>: GET the project's released/unreleased versions.
+_jira_project_versions() {
+  local key="${1:-}"
+  [[ -z "$key" ]] && { echo "Usage: jira project versions <KEY>" >&2; return 1; }
+  jira_curl GET "$(_jira_project_path)/$key/versions" | jira_lean '.'
+}
+
+# components <KEY>: GET the project's components.
+_jira_project_components() {
+  local key="${1:-}"
+  [[ -z "$key" ]] && { echo "Usage: jira project components <KEY>" >&2; return 1; }
+  jira_curl GET "$(_jira_project_path)/$key/components" | jira_lean '.'
+}

package/plugins/jira/skills/jira/scripts/lib/raw.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# raw.sh — escape hatch: issue an arbitrary authenticated request to any Jira
+# REST path, reaching endpoints the ergonomic families do not wrap. Sourced;
+# depends on jira_curl/jira_lean from http.sh.
+
+# jira_raw METHOD PATH [JSON_BODY]: METHOD in GET|POST|PUT|DELETE; PATH is
+# relative to JIRA_BASE_URL. Prints the response body.
+jira_raw() {
+  if [[ $# -lt 2 ]]; then
+    echo "Usage: jira raw <GET|POST|PUT|DELETE> <path> [json_body]" >&2
+    return 1
+  fi
+  local method="$1" path="$2" body="${3:-}"
+  jira_curl "$method" "$path" "$body" | jira_lean '.'
+}

package/plugins/jira/skills/jira/scripts/lib/search.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# search.sh — JQL search. v3 (Cloud) POSTs to /rest/api/3/search/jql with
+# nextPageToken paging; v2 (Server/DC) POSTs to /rest/api/2/search with startAt
+# paging. Sourced; depends on http.sh and paginate.sh.
+
+# jira_search -q <JQL> [-n MAX] [--all] [--fields f1,f2]
+jira_search() {
+  local jql="" max=50 all="false" fields=""
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      -q|--query)  jql="$2"; shift 2;;
+      -n|--num)    max="$2"; shift 2;;
+      --all)       all="true"; shift;;
+      --fields)    fields="$2"; shift 2;;
+      *) if [[ -z "$jql" ]]; then jql="$1"; shift
+         else echo "search: unknown option '$1'" >&2; return 1; fi;;
+    esac
+  done
+  [[ -z "$jql" ]] && { echo "Usage: jira search -q <JQL> [-n MAX] [--all] [--fields f1,f2]" >&2; return 1; }
+
+  local fields_json="null"
+  [[ -n "$fields" ]] && fields_json=$(jq -nc --arg f "$fields" '$f|split(",")')
+
+  local body
+  body=$(jq -nc --arg q "$jql" --argjson n "$max" --argjson f "$fields_json" \
+    '{jql:$q, maxResults:$n} | if $f then .fields=$f else . end')
+
+  local path mode
+  if [[ "${_JIRA_VER:-3}" == "2" ]]; then
+    path="/rest/api/2/search"; mode="offset"
+  else
+    path="/rest/api/3/search/jql"; mode="token"
+  fi
+
+  if [[ "$all" == "true" ]]; then
+    jira_paginate "$mode" POST "$path" issues "$body" | jira_lean '.'
+  else
+    jira_curl POST "$path" "$body" \
+      | jira_lean '{issues: [.issues[] | {key, summary: .fields.summary, status: .fields.status.name}]}'
+  fi
+}

package/plugins/jira/skills/jira/scripts/lib/sprint.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# sprint.sh — Jira Agile sprint operations: list (per board), get, issues,
+# create, move issues, start, complete. Sourced; depends on http.sh
+# (jira_curl/jira_lean). Agile endpoints always use /rest/agile/1.0 regardless
+# of API version; start/complete mutate the live sprint state.
+
+# jira_sprint <list|get|issues|create|move|start|complete> ...: dispatch a
+# sprint sub-action; unknown/missing prints usage to stderr and returns 1.
+jira_sprint() {
+  local action="${1:-}"; [[ $# -gt 0 ]] && shift
+  case "$action" in
+    list)     _jira_sprint_list "$@";;
+    get)      _jira_sprint_get "$@";;
+    issues)   _jira_sprint_issues "$@";;
+    create)   _jira_sprint_create "$@";;
+    move)     _jira_sprint_move "$@";;
+    start)    _jira_sprint_start "$@";;
+    complete) _jira_sprint_complete "$@";;
+    *) echo "Usage: jira sprint <list|get|issues|create|move|start|complete> ..." >&2; return 1;;
+  esac
+}
+
+# _jira_sprint_list BOARD_ID: list the sprints on a board.
+_jira_sprint_list() {
+  local board="${1:-}"
+  [[ -z "$board" ]] && { echo "Usage: jira sprint list <BOARD_ID>" >&2; return 1; }
+  jira_curl GET "/rest/agile/1.0/board/$board/sprint" \
+    | jira_lean '{values:[.values[]|{id,name,state}]}'
+}
+
+# _jira_sprint_get ID: fetch one sprint.
+_jira_sprint_get() {
+  local id="${1:-}"
+  [[ -z "$id" ]] && { echo "Usage: jira sprint get <ID>" >&2; return 1; }
+  jira_curl GET "/rest/agile/1.0/sprint/$id" | jira_lean '.'
+}
+
+# _jira_sprint_issues ID: list the issues in a sprint.
+_jira_sprint_issues() {
+  local id="${1:-}"
+  [[ -z "$id" ]] && { echo "Usage: jira sprint issues <ID>" >&2; return 1; }
+  jira_curl GET "/rest/agile/1.0/sprint/$id/issue" \
+    | jira_lean '{issues:[.issues[]|{key, summary:.fields.summary, status:.fields.status.name}]}'
+}
+
+# _jira_sprint_create BOARD_ID -n NAME: create a sprint on a board.
+_jira_sprint_create() {
+  local board="${1:-}"; [[ $# -gt 0 ]] && shift
+  local name=""
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      -n|--name) name="$2"; shift 2;;
+      *) echo "sprint create: unknown option '$1'" >&2; return 1;;
+    esac
+  done
+  [[ -z "$board" || -z "$name" ]] && {
+    echo "Usage: jira sprint create <BOARD_ID> -n <NAME>" >&2
+    return 1
+  }
+  local body
+  body=$(jq -nc --argjson b "$board" --arg n "$name" '{originBoardId:$b, name:$n}')
+  jira_curl POST "/rest/agile/1.0/sprint" "$body" | jira_lean '.'
+}
+
+# _jira_sprint_move SPRINT_ID KEY...: move one or more issues into a sprint.
+_jira_sprint_move() {
+  local id="${1:-}"; [[ $# -gt 0 ]] && shift
+  [[ -z "$id" || $# -eq 0 ]] && { echo "Usage: jira sprint move <SPRINT_ID> <KEY...>" >&2; return 1; }
+  local body
+  body=$(jq -nc '{issues:$ARGS.positional}' --args "$@")
+  jira_curl POST "/rest/agile/1.0/sprint/$id/issue" "$body" | jira_lean '.'
+}
+
+# _jira_sprint_start ID: start a sprint (set state active).
+_jira_sprint_start() {
+  local id="${1:-}"
+  [[ -z "$id" ]] && { echo "Usage: jira sprint start <ID>" >&2; return 1; }
+  jira_curl POST "/rest/agile/1.0/sprint/$id" '{"state":"active"}'
+  echo "started sprint $id"
+}
+
+# _jira_sprint_complete ID: complete a sprint (set state closed).
+_jira_sprint_complete() {
+  local id="${1:-}"
+  [[ -z "$id" ]] && { echo "Usage: jira sprint complete <ID>" >&2; return 1; }
+  jira_curl POST "/rest/agile/1.0/sprint/$id" '{"state":"closed"}'
+  echo "completed sprint $id"
+}

package/plugins/jira/skills/jira/scripts/lib/user.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# user.sh — Jira user operations: whoami, search, get. Sourced; depends on
+# http.sh (jira_curl/jira_lean). v3 keys users by accountId, v2 by username;
+# the user search/lookup query param is version-gated accordingly.
+
+jira_user() {
+  local action="${1:-}"; [[ $# -gt 0 ]] && shift
+  case "$action" in
+    whoami) _jira_user_whoami "$@";;
+    search) _jira_user_search "$@";;
+    get)    _jira_user_get "$@";;
+    *) echo "Usage: jira user <whoami|search|get> ..." >&2; return 1;;
+  esac
+}
+
+# whoami: GET the current user, leaned to identity essentials.
+_jira_user_whoami() {
+  jira_curl GET "/rest/api/${_JIRA_VER:-3}/myself" \
+    | jira_lean '{accountId, displayName, emailAddress}'
+}
+
+# search -q <QUERY>: find users; v3 keys on ?query, v2 on ?username.
+_jira_user_search() {
+  local query=""
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      -q|--query) query="$2"; shift 2;;
+      *) echo "user search: unknown option '$1'" >&2; return 1;;
+    esac
+  done
+  [[ -z "$query" ]] && { echo "Usage: jira user search -q <QUERY>" >&2; return 1; }
+  local param="query"
+  [[ "${_JIRA_VER:-3}" == "2" ]] && param="username"
+  jira_curl GET "/rest/api/${_JIRA_VER:-3}/user/search?${param}=$(jira_urlencode "$query")" \
+    | jira_lean '{users:[.[]|{accountId, displayName}]}'
+}
+
+# get <ACCOUNT_ID>: GET one user; v3 keys on ?accountId, v2 on ?username.
+_jira_user_get() {
+  local id="${1:-}"
+  [[ -z "$id" ]] && { echo "Usage: jira user get <ACCOUNT_ID>" >&2; return 1; }
+  local param="accountId"
+  [[ "${_JIRA_VER:-3}" == "2" ]] && param="username"
+  jira_curl GET "/rest/api/${_JIRA_VER:-3}/user?${param}=$(jira_urlencode "$id")" | jira_lean '.'
+}

package/plugins/jira/skills/jira/scripts/lib/worklog.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# worklog.sh — Jira worklog operations: add, list, delete. Sourced; depends on
+# http.sh (jira_curl/jira_lean) and adf.sh (jira_text_to_adf). The add comment
+# body is version-gated (ADF for v3, plain text for v2).
+
+_jira_worklog_path() { printf '/rest/api/%s/issue' "${_JIRA_VER:-3}"; }
+
+# jira_worklog <add|list|delete> ...: dispatch on the first arg.
+jira_worklog() {
+  local action="${1:-}"; [[ $# -gt 0 ]] && shift
+  case "$action" in
+    add)    _jira_worklog_add "$@";;
+    list)   _jira_worklog_list "$@";;
+    delete) _jira_worklog_delete "$@";;
+    *) echo "Usage: jira worklog <add|list|delete> ..." >&2; return 1;;
+  esac
+}
+
+# _jira_worklog_add <KEY> -t <TIME> [-c COMMENT]: log time against an issue.
+_jira_worklog_add() {
+  local key="${1:-}"; [[ $# -gt 0 ]] && shift
+  local time="" comment="" has_comment=""
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      -t|--time)    time="$2"; shift 2;;
+      -c|--comment) comment="$2"; has_comment=1; shift 2;;
+      *) echo "worklog add: unknown option '$1'" >&2; return 1;;
+    esac
+  done
+  [[ -z "$key" || -z "$time" ]] && {
+    echo "Usage: jira worklog add <KEY> -t <TIME> [-c COMMENT]" >&2
+    return 1
+  }
+  local body
+  body=$(jq -nc --arg ts "$time" '{timeSpent:$ts}')
+  if [[ -n "$has_comment" ]]; then
+    body=$(jq -c --argjson c "$(jira_text_to_adf "$comment")" '.comment=$c' <<<"$body")
+  fi
+  jira_curl POST "$(_jira_worklog_path)/$key/worklog" "$body" | jira_lean '.'
+}
+
+# _jira_worklog_list <KEY>: list worklog entries for an issue.
+_jira_worklog_list() {
+  local key="${1:-}"
+  [[ -z "$key" ]] && { echo "Usage: jira worklog list <KEY>" >&2; return 1; }
+  jira_curl GET "$(_jira_worklog_path)/$key/worklog" \
+    | jira_lean '{worklogs:[.worklogs[]|{id, author:.author.displayName, timeSpent, started}]}'
+}
+
+# _jira_worklog_delete <KEY> <WORKLOG_ID>: remove one worklog entry.
+_jira_worklog_delete() {
+  local key="${1:-}" wid="${2:-}"
+  [[ -z "$key" || -z "$wid" ]] && { echo "Usage: jira worklog delete <KEY> <WORKLOG_ID>" >&2; return 1; }
+  jira_curl DELETE "$(_jira_worklog_path)/$key/worklog/$wid"
+  echo "deleted worklog $wid"
+}

package/plugins/pr-babysit/.claude-plugin/plugin.json

@@ -0,0 +1,25 @@
+{
+  "name": "pr-babysit",
+  "version": "6.8.0",
+  "description": "Babysit a PR until review threads, the review-bot verdict, and CI are clear, using Claude cron or a durable Codex goal with isolated worktrees.",
+  "author": {
+    "name": "Falconiere Barbosa",
+    "email": "hello@falconiere.io"
+  },
+  "homepage": "https://github.com/falconiere/toolu",
+  "repository": "https://github.com/falconiere/toolu.git",
+  "license": "MIT",
+  "keywords": [
+    "claude-code",
+    "pr",
+    "review",
+    "ci",
+    "automation"
+  ],
+  "dependencies": [
+    {
+      "name": "toolu",
+      "marketplace": "toolu"
+    }
+  ]
+}

package/plugins/pr-babysit/.codex-plugin/plugin.json

@@ -0,0 +1,7 @@
+{
+  "name": "pr-babysit",
+  "version": "6.8.0",
+  "description": "Babysit a PR until review threads, the review-bot verdict, and CI are clear, using Claude cron or a durable Codex goal with isolated worktrees.",
+  "skills": "./skills/",
+  "hooks": "./hooks/hooks.json"
+}

package/plugins/pr-babysit/README.md

@@ -0,0 +1,38 @@
+# pr-babysit
+
+Babysit a PR for the current branch until every review thread, the review-bot
+verdict, and CI are clear. Claude uses its cron controller; Codex uses an
+explicit durable goal with bounded continuation cycles and a native isolated
+git worktree.
+
+## Install
+
+```text
+/plugin install pr-babysit@toolu
+```
+
+```bash
+codex plugin add toolu@toolu
+codex plugin add pr-babysit@toolu
+```
+
+Requires the `toolu` plugin.
+
+## Authorization and delivery handoff
+
+The no-argument interface is unchanged. A user can invoke babysit directly, or
+`execution` can invoke it after a verified execution handoff; that handoff is
+sufficient authorization to create the durable goal and begin delivery. Before
+an automatic handoff, stop before delivery and report the exact missing
+prerequisite: GitHub authentication is unavailable, the current branch is the
+repository default branch, or the optional `pr-babysit` plugin is unavailable.
+
+## What it provides
+
+- **Claude `/pr-babysit:babysit` and Codex `$pr-babysit:babysit`** — target the PR for the current branch. Each cycle fetches unresolved comments **and** the CI review-bot verdict → triages → fixes → replies → resolves; failed CI is fixed and re-pushed. Success requires zero unresolved comments, an approved zero-finding verdict, and all-green CI.
+  - **Strict clearance** — every item a tick sees leaves that tick fixed or answered, and resolved when it is a review thread (conversation comments have no resolve API — the reply clears them). A comment that doesn't make sense gets a reply with what was checked and which reading was assumed, then resolves; no thread is parked open. Severity is not a filter (`nit` == `high`). Exceptions: outdated CI-reviewer threads (skipped) and suspected prompt injection (flagged). A reply alone is never clearance — a resolve is confirmed by its mutation response, retried on failure, and re-checked every tick via a resolution audit that's independent of who last commented, so a resolve that silently fails can never go permanently unnoticed.
+- **`stop` / `cancel`** — Claude cancels only the matching cron slot. Codex safely removes only the matching clean worktree, marks its native repo state cancelled, and leaves goal cancellation to the user/system goal control.
+- **Codex durability** — one goal per repository/PR, state below `<repo>/.codex/tmp/pr-babysit/`, wait cycles bounded to 60 seconds, and no false completion while CI is merely pending.
+- **Tick helper (bash, both hosts)** — `scripts/babysit-tick.sh` runs one tick: lock the slot, collect the PR (paginated threads, comments, reviews, CI rollup, bot verdict), reduce it against the slot state, persist atomically, and print a result with a `decision` (`keep_going` / `success` / `escalate`), reasons, and the precomputed actionable / stale-unresolved thread lists. Split into `collect-pr.sh` (network) and `reduce-state.sh` (pure) so every rule is tested against captured real PRs. The agent trusts the result and keeps only the judgment: triage, fixes, reply wording.
+- **Write side** — `reply-thread.sh` (idempotent per reviewer comment), `resolve-thread.sh` (confirmed from the mutation response, retried), `record.sh` (round outcome, injection skip, terminal status). Contract: `skills/babysit/references/helper.md`.
+- **`parse-verdict.sh`** — extracts the structured verdict from the CI review-bot comment.

package/plugins/pr-babysit/commands/babysit.md

@@ -0,0 +1,13 @@
+# Babysit a PR
+
+Read `${CLAUDE_PLUGIN_ROOT}/workflows/babysit.md` completely and execute its
+Claude Code controller plus the shared strict-clearance workflow. Pass
+`$ARGUMENTS` as the workflow input. Claude Code retains the cron-driven
+continuation mechanism defined there.
+
+Each tick is one command: `bash "${CLAUDE_PLUGIN_ROOT}/scripts/babysit-tick.sh"`
+with `--state-file /tmp/pr-babysit-<slot>.json`; its result contract is
+`${CLAUDE_PLUGIN_ROOT}/skills/babysit/references/helper.md`. Trust that
+result — never write a polling script or controller of your own, and
+never re-fetch with ad-hoc `gh` calls what it already reports — and act through
+`reply-thread.sh`, `resolve-thread.sh` and `record.sh`.

package/plugins/pr-babysit/hooks/check-toolu.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Codex lacks a plugin-dependency manifest field. Warn when this dependent
+# plugin is installed without the toolu core, using Codex's authoritative list.
+set -u
+
+[ "${TOOLU_HOST_OVERRIDE:-}" != claude ] || exit 0
+[ -n "${PLUGIN_ROOT:-}" ] || exit 0
+command -v codex >/dev/null 2>&1 || exit 0
+command -v jq >/dev/null 2>&1 || exit 0
+
+installed=$(codex plugin list --json 2>/dev/null) || exit 0
+jq -e 'any(.installed[]?; .pluginId == "toolu@toolu" and
+  ((has("installed") | not) or (.installed == true)) and
+  ((has("enabled") | not) or (.enabled == true)))' \
+  <<<"$installed" >/dev/null 2>&1 && exit 0
+
+jq -n '{hookSpecificOutput:{
+  hookEventName:"SessionStart",
+  additionalContext:"WARN: this plugin requires the toolu core. Install it first with: codex plugin add toolu@toolu"
+}}'

package/plugins/pr-babysit/hooks/hooks.json

@@ -0,0 +1,15 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "startup|resume|clear|compact",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/check-toolu.sh"
+          }
+        ]
+      }
+    ]
+  }
+}

package/plugins/pr-babysit/scripts/babysit-tick.sh

@@ -0,0 +1,133 @@
+#!/usr/bin/env bash
+# babysit-tick.sh — the one command a babysit tick runs, on either host.
+#
+#   lock the slot → (validate prior state) → collect → reduce → persist → print
+#
+# Usage: babysit-tick.sh --repo <owner/repo> --pr <n> --state-file <path>
+#                        [--snapshot-out <path>] [--snapshot-in <path>]
+#                        [--page-size N] [--timeout SECONDS] [--now <iso8601>]
+#   --state-file    the host's slot path, passed verbatim by the workflow
+#                   (/tmp/pr-babysit-<slot>.json on Claude,
+#                    <repo>/.codex/tmp/pr-babysit/<slot>.json on Codex)
+#   --snapshot-out  full snapshot location (default: beside the state file)
+#   --snapshot-in   skip collection and reduce a captured snapshot (tests,
+#                   replay); its repo/number must match the arguments
+#   --now           timestamp override for tests (default: UTC now)
+#
+# stdout: exactly one JSON document — the result (exit 0) or a structured
+# error (non-zero). stderr: diagnostics only.
+# Exit: 0 result · 2 usage · 3 structured error, prior state preserved
+#       (pr.lastError updated when a prior state exists) · 75 slot locked.
+# Nothing here reads a session-specific environment variable for the repo,
+# PR, home directory or plugin root: the root comes from this file's path.
+set -euo pipefail
+
+PB_SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)
+# shellcheck source=lib/common.sh
+. "$PB_SCRIPT_DIR/lib/common.sh"
+# shellcheck source=lib/lock.sh
+. "$PB_SCRIPT_DIR/lib/lock.sh"
+
+repo=""; number=""; state_file=""; snapshot_out=""; snapshot_in=""; page_size=""; timeout=""; now=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --repo)         repo="${2:-}"; shift 2 ;;
+    --pr)           number="${2:-}"; shift 2 ;;
+    --state-file)   state_file="${2:-}"; shift 2 ;;
+    --snapshot-out) snapshot_out="${2:-}"; shift 2 ;;
+    --snapshot-in)  snapshot_in="${2:-}"; shift 2 ;;
+    --page-size)    page_size="${2:-}"; shift 2 ;;
+    --timeout)      timeout="${2:-}"; shift 2 ;;
+    --now)          now="${2:-}"; shift 2 ;;
+    *) pb_fail usage "babysit-tick.sh: unknown argument: $1" ;;
+  esac
+done
+[[ "$repo" =~ ^[^/[:space:]]+/[^/[:space:]]+$ ]] || pb_fail usage "babysit-tick.sh: --repo <owner/repo> required"
+[[ "$number" =~ ^[0-9]+$ ]] || pb_fail usage "babysit-tick.sh: --pr <n> required"
+[ -n "$state_file" ] || pb_fail usage "babysit-tick.sh: --state-file <path> required"
+[ -z "$page_size" ] || [[ "$page_size" =~ ^[0-9]+$ ]] || pb_fail usage "babysit-tick.sh: --page-size must be an integer"
+[ -z "$timeout" ] || [[ "$timeout" =~ ^[0-9]+$ ]] || pb_fail usage "babysit-tick.sh: --timeout must be an integer"
+[ -n "$now" ] || now=$(pb_now)
+[[ "$now" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ ]] || pb_fail usage "babysit-tick.sh: --now must be YYYY-MM-DDTHH:MM:SSZ"
+[ -n "$snapshot_out" ] || snapshot_out="${state_file%.json}.snapshot.json"
+
+pb_require jq
+[ -n "$snapshot_in" ] || pb_require gh
+pb_init
+pb_mktmpdir
+mkdir -p "$(dirname "$state_file")" || pb_fail usage "babysit-tick.sh: cannot create $(dirname "$state_file")"
+pb_lock_acquire "$state_file" || pb_lock_fail "$state_file"
+
+# --- prior state: validate before touching the network ----------------------
+# reduce-state.sh repeats these checks; running them first means a malformed
+# or foreign state file fails in milliseconds and never costs API calls.
+have_state=0
+if [ -e "$state_file" ]; then
+  have_state=1
+  pb_json_valid "$state_file" || pb_fail state_malformed "babysit-tick.sh: state file is not valid JSON: $state_file" '{"source":"state"}'
+  jq -e '.version == 2' "$state_file" >/dev/null 2>&1 \
+    || pb_fail state_malformed "babysit-tick.sh: state file is not version 2: $state_file" "$(jq -c '{source:"state", version:(.version // null)}' "$state_file")"
+  jq -e --arg repo "$repo" --argjson number "$number" '.repo == $repo and .number == $number' "$state_file" >/dev/null 2>&1 \
+    || pb_fail slot_mismatch "babysit-tick.sh: state file belongs to $(jq -r '"\(.repo)#\(.number)"' "$state_file"), asked for $repo#$number" \
+         "$(jq -c --arg repo "$repo" --argjson number "$number" '{source:"state", state:{repo, number}, requested:{repo:$repo, number:$number}}' "$state_file")"
+fi
+
+# _record_error DOC — on a collection failure, keep the prior state but stamp
+# pr.lastError so the next reader sees what happened and when.
+_record_error() {
+  local doc="$1" entry
+  [ "$have_state" -eq 1 ] || return 0
+  # A structured error always carries errors[0]; anything else is recorded as
+  # an api_error with the raw text so the failure is never lost.
+  entry=$(jq -c '.errors[0] // empty' <<<"$doc" 2>/dev/null || true)
+  [ -n "$entry" ] || entry=$(jq -nc --arg m "$doc" '{code:"api_error", message:$m}')
+  pb_atomic_write_json "$state_file" jq -c --argjson e "$entry" --arg now "$now" \
+    '.pr.lastError = {code: ($e.code // "api_error"), message: ($e.message // ""), at: $now}' "$state_file" \
+    || echo "babysit-tick.sh: could not record lastError in $state_file" >&2
+}
+
+# _exit_with_doc DOC — print a structured error and exit with the code its
+# errors[0].code maps to, so the exit code and the document never disagree.
+_exit_with_doc() {
+  local doc="$1"
+  printf '%s\n' "$doc"
+  exit "$(pb_exit_code "$(jq -r '.errors[0].code // "api_error"' <<<"$doc")")"
+}
+
+# --- snapshot: collect, or take the one handed in ----------------------------
+snap="$PB_TMPDIR/snapshot.json"
+if [ -n "$snapshot_in" ]; then
+  [ -f "$snapshot_in" ] && pb_json_valid "$snapshot_in" || pb_fail invalid_json "babysit-tick.sh: --snapshot-in is not a JSON file: $snapshot_in" '{"source":"snapshot"}'
+  jq -e --arg repo "$repo" --argjson number "$number" '.repo == $repo and .number == $number' "$snapshot_in" >/dev/null 2>&1 \
+    || pb_fail slot_mismatch "babysit-tick.sh: --snapshot-in is for $(jq -r '"\(.repo)#\(.number)"' "$snapshot_in"), asked for $repo#$number" '{"source":"snapshot"}'
+  cp "$snapshot_in" "$snap"
+else
+  collect_args=(--repo "$repo" --pr "$number" --out "$snap")
+  [ -z "$page_size" ] || collect_args+=(--page-size "$page_size")
+  [ -z "$timeout" ] || collect_args+=(--timeout "$timeout")
+  rc=0
+  bash "$PB_SCRIPT_DIR/collect-pr.sh" "${collect_args[@]}" >"$PB_TMPDIR/collect.out" || rc=$?
+  if [ "$rc" -ne 0 ]; then
+    doc=$(grep '^{' "$PB_TMPDIR/collect.out" | tail -n 1 || true)
+    [ -n "$doc" ] || doc=$(pb_error api_error "babysit-tick.sh: collect-pr.sh exited $rc without a structured error" '{"source":"collect"}')
+    _record_error "$doc"
+    _exit_with_doc "$doc"
+  fi
+fi
+
+# --- reduce -------------------------------------------------------------------
+rc=0
+bash "$PB_SCRIPT_DIR/reduce-state.sh" --snapshot "$snap" --state "$state_file" --now "$now" \
+  --state-out "$PB_TMPDIR/state.next.json" --result-out "$PB_TMPDIR/result.json" \
+  --state-path "$state_file" --snapshot-path "$snapshot_out" >"$PB_TMPDIR/reduce.out" || rc=$?
+if [ "$rc" -ne 0 ]; then
+  doc=$(grep '^{' "$PB_TMPDIR/reduce.out" | tail -n 1 || true)
+  [ -n "$doc" ] || doc=$(pb_error invalid_json "babysit-tick.sh: reduce-state.sh exited $rc without a structured error" '{"source":"reduce"}')
+  _record_error "$doc"
+  _exit_with_doc "$doc"
+fi
+
+# --- persist: snapshot first (the state points at it), then state -----------
+pb_atomic_write_json "$snapshot_out" cat "$snap" || pb_fail invalid_json "babysit-tick.sh: could not write $snapshot_out" '{"source":"snapshot_out"}'
+pb_atomic_write_json "$state_file" cat "$PB_TMPDIR/state.next.json" || pb_fail invalid_json "babysit-tick.sh: could not write $state_file" '{"source":"state"}'
+cat "$PB_TMPDIR/result.json"