@usepipr/runtime 0.1.3 → 0.2.1

package/dist/{commands-BC2fTZsi.mjs → commands-Cj8p5IQF.mjs}

@@ -1,134 +1,55 @@
-import { i as piReadOnlyToolNames, r as piProviderProfileSchema, t as parsePiProviderInvocation } from "./contract-BsL98-bI.mjs";
 import { c as resolveReadAtRefRequest, l as unavailableReadAtRefResult, n as boundedLineSlice, r as parseManifestPath, u as createDiffRangeIndex } from "./runtime-tools-core-CW1xenzy.mjs";
 import { createRequire } from "node:module";
 import { chmod, cp, lstat, mkdir, mkdtemp, readdir, rm } from "node:fs/promises";
 import path from "node:path";
 import { z } from "zod";
-import { buildPiprPlan, embeddedSdkDeclaration, isBuiltinReadOnlyTool, isPiprConfigFactory, readSdkDeclarationSourceWithChunk, renderPromptValue, reviewOutputSchemaId } from "@usepipr/sdk/internal";
-import { parseReviewResult, reviewFindingSchema, reviewResultSchema, reviewSchemaExample } from "@usepipr/sdk/review";
+import { parseReviewResult, reviewFindingSchema, reviewResultSchema, reviewSchemaExample } from "@usepipr/sdk";
+import { buildPiprPlan, commandPatternParts, embeddedSdkDeclaration, isBuiltinReadOnlyTool, isCommandCaptureToken, isCommandRestCaptureToken, isOptionalCommandPatternPart, isPiprConfigFactory, readSdkDeclarationSourceWithChunk, renderPromptValue, reviewOutputSchemaId, tokenizeCommandPattern, unsupportedCommandRestCaptureError } from "@usepipr/sdk/internal";
 import os from "node:os";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { Buffer as Buffer$1 } from "node:buffer";
 import { compact, isPlainObject, uniq, uniqBy } from "lodash-es";
-import { spawn } from "node:child_process";
-import pino from "pino";
 import picomatch from "picomatch";
+import { Buffer as Buffer$1 } from "node:buffer";
+import { spawn } from "node:child_process";
 import { Octokit } from "@octokit/rest";
 import { existsSync, mkdirSync } from "node:fs";
-//#region src/commands/grammar.ts
-const piprCommandPrefix = "@pipr";
-function firstNonEmptyLine(value) {
-	return value.split(/\r?\n/).map((line) => line.trim()).find((line) => line.length > 0);
-}
-function isPiprCommandLine(line) {
-	return line === piprCommandPrefix || line.startsWith(`${piprCommandPrefix} `);
-}
-function parseCommandPattern(pattern, line) {
-	const patternParts = patternPartsFor(pattern);
-	const validationError = unsupportedRestCaptureError(patternParts);
-	if (validationError) return {
-		ok: false,
-		error: validationError
-	};
-	const lineTokens = tokenize(line);
-	const captures = {};
-	let index = 0;
-	for (const part of patternParts) {
-		if (isOptionalPart(part)) {
-			const nextIndex = parseOptionalPatternPart(part.slice(1, -1), lineTokens, index, captures);
-			if (nextIndex !== void 0) index = nextIndex;
-			continue;
-		}
-		if (isRestCaptureToken(part)) {
-			const value = lineTokens.slice(index).join(" ");
-			if (!value) return {
-				ok: false,
-				error: `Expected '${part}'`
-			};
-			captures[part.slice(1, -4)] = value;
-			index = lineTokens.length;
-			continue;
-		}
-		const nextIndex = parsePatternToken(part, lineTokens, index, captures);
-		if (nextIndex === void 0) return {
-			ok: false,
-			error: `Expected '${part}'`
-		};
-		index = nextIndex;
-	}
-	if (index !== lineTokens.length) return {
-		ok: false,
-		error: `Unexpected argument '${lineTokens[index]}'`
-	};
-	return {
-		ok: true,
-		value: captures
-	};
-}
-function commandPatternPrefixMatches(pattern, line) {
-	const patternTokens = patternPartsFor(pattern);
-	if (unsupportedRestCaptureError(patternTokens)) return false;
-	const lineTokens = tokenize(line);
-	let index = 0;
-	for (const token of patternTokens) {
-		if (isCaptureToken(token) || isOptionalPart(token)) return true;
-		if (lineTokens[index] !== token) return false;
-		index += 1;
-	}
-	return true;
-}
-function parseOptionalPatternPart(pattern, lineTokens, startIndex, captures) {
-	const patternTokens = tokenize(pattern);
-	if (patternTokens.length === 0 || lineTokens[startIndex] !== patternTokens[0]) return;
-	const snapshot = { ...captures };
-	let index = startIndex;
-	for (const token of patternTokens) {
-		const nextIndex = parsePatternToken(token, lineTokens, index, captures);
-		if (nextIndex === void 0) {
-			for (const key of Object.keys(captures)) delete captures[key];
-			Object.assign(captures, snapshot);
-			return;
-		}
-		index = nextIndex;
-	}
-	return index;
-}
-function parsePatternToken(patternToken, lineTokens, index, captures) {
-	if (isCaptureToken(patternToken)) {
-		const value = lineTokens[index];
-		if (!value) return;
-		captures[patternToken.slice(1, -1)] = value;
-		return index + 1;
-	}
-	return lineTokens[index] === patternToken ? index + 1 : void 0;
+//#region src/config/config-deps.ts
+const runtimeProvidedPackages = new Set(["@usepipr/sdk", "@types/bun"]);
+async function installConfigDependencies(configDir, options = {}) {
+	const packageJsonPath = path.join(configDir, "package.json");
+	if (!await fileExists$1(packageJsonPath)) return;
+	if (shouldSkipConfigInstall(JSON.parse(await Bun.file(packageJsonPath).text()))) return;
+	const bunLockPath = path.join(configDir, "bun.lock");
+	if (options.frozen && !await fileExists$1(bunLockPath)) throw new Error(`${configDir}: bun.lock is required when .pipr/package.json declares dependencies. Run \`bun install\` in .pipr/ and commit bun.lock.`);
+	await assertBunAvailable();
+	const args = ["install", "--ignore-scripts"];
+	if (options.frozen) args.push("--frozen-lockfile");
+	const proc = Bun.spawn(["bun", ...args], {
+		cwd: configDir,
+		env: process.env,
+		stdout: "pipe",
+		stderr: "pipe"
+	});
+	const [exitCode, stderr] = await Promise.all([proc.exited, new Response(proc.stderr).text()]);
+	if (exitCode !== 0) throw new Error(`${configDir}: bun install failed (exit ${exitCode}).` + (stderr.trim().length > 0 ? `\n${stderr.trim()}` : ""));
 }
-function patternPartsFor(pattern) {
-	return pattern.match(/\[[^\]]+\]|[^\s]+/g) ?? [];
+function shouldSkipConfigInstall(manifest) {
+	const packages = [...Object.keys(manifest.dependencies ?? {}), ...Object.keys(manifest.devDependencies ?? {})];
+	return packages.length === 0 || packages.every((name) => runtimeProvidedPackages.has(name));
 }
-function unsupportedRestCaptureError(parts) {
-	for (const [index, part] of parts.entries()) {
-		if (isOptionalPart(part)) {
-			const optionalRest = tokenize(part.slice(1, -1)).find(isRestCaptureToken);
-			if (optionalRest) return finalRequiredRestCaptureError(optionalRest);
-			continue;
-		}
-		if (isRestCaptureToken(part) && index !== parts.length - 1) return finalRequiredRestCaptureError(part);
+async function assertBunAvailable() {
+	try {
+		if (await Bun.spawn(["bun", "--version"], {
+			env: process.env,
+			stdout: "pipe",
+			stderr: "pipe"
+		}).exited !== 0) throw new Error("bun is required on PATH to install .pipr/package.json dependencies. Install Bun from https://bun.sh");
+	} catch {
+		throw new Error("bun is required on PATH to install .pipr/package.json dependencies. Install Bun from https://bun.sh");
 	}
 }
-function finalRequiredRestCaptureError(token) {
-	return `Rest capture '${token}' must be the final required command pattern token`;
-}
-function isOptionalPart(value) {
-	return value.startsWith("[") && value.endsWith("]");
-}
-function isCaptureToken(value) {
-	return /^<[a-z0-9-]+(\.\.\.)?>$/.test(value);
-}
-function isRestCaptureToken(value) {
-	return /^<[a-z0-9-]+\.\.\.>$/.test(value);
-}
-function tokenize(value) {
-	return value.trim().split(/\s+/).filter(Boolean);
+async function fileExists$1(filePath) {
+	return await Bun.file(filePath).exists();
 }
 //#endregion
 //#region src/config/paths.ts
@@ -153,46 +74,86 @@ function toGitPath(filePath) {
 	return filePath === "." ? "." : filePath.split(path.sep).join("/");
 }
 //#endregion
-//#region src/review/contract.ts
-const prReviewSchemaId = reviewOutputSchemaId;
-const prReviewSchema = reviewResultSchema;
-z.toJSONSchema(prReviewSchema);
-function parsePrReview(value) {
-	return prReviewSchema.parse(parseReviewResult(value));
+//#region src/pi/contract.ts
+const piThinkingLevels = [
+	"off",
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh"
+];
+const piBuiltinToolNames = [
+	"read",
+	"bash",
+	"edit",
+	"write",
+	"grep",
+	"find",
+	"ls"
+];
+const piReadOnlyToolNames = [
+	"read",
+	"grep",
+	"find",
+	"ls"
+];
+const piRequiredCliFlags = [
+	"--provider",
+	"--model",
+	"--system-prompt",
+	"--mode",
+	"--print",
+	"--no-session",
+	"--session-dir",
+	"--tools",
+	"--extension",
+	"--no-context-files",
+	"--no-approve",
+	"--no-extensions",
+	"--no-skills",
+	"--no-prompt-templates",
+	"--no-themes",
+	"--thinking"
+];
+const nonEmptyStringSchema$1 = z.string().min(1);
+const piProviderIdSchema = z.string().regex(/^[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_.-]+)*$/);
+const piApiKeyEnvNameSchema = z.string().regex(/^[A-Z_][A-Z0-9_]*$/);
+const piThinkingLevelSchema = z.enum(piThinkingLevels);
+const piReadOnlyToolNamesSchema = z.tuple([
+	z.literal("read"),
+	z.literal("grep"),
+	z.literal("find"),
+	z.literal("ls")
+]);
+const piProviderProfileSchema = z.strictObject({
+	id: piProviderIdSchema,
+	provider: nonEmptyStringSchema$1,
+	model: nonEmptyStringSchema$1,
+	apiKeyEnv: piApiKeyEnvNameSchema,
+	thinking: piThinkingLevelSchema.optional()
+});
+const piProviderInvocationSchema = z.strictObject({
+	provider: nonEmptyStringSchema$1,
+	model: nonEmptyStringSchema$1,
+	apiKeyEnv: piApiKeyEnvNameSchema,
+	thinking: piThinkingLevelSchema,
+	tools: piReadOnlyToolNamesSchema
+});
+function parsePiProviderInvocation(value) {
+	return piProviderInvocationSchema.parse(value);
 }
+//#endregion
+//#region src/review/contract.ts
+const reviewResultSchemaId = reviewOutputSchemaId;
+z.toJSONSchema(reviewResultSchema);
 function reviewSchemaExample$1() {
-	return parsePrReview(reviewSchemaExample());
+	return parseReviewResult(reviewSchemaExample());
 }
 //#endregion
 //#region src/types.ts
 const nonEmptyStringSchema = z.string().min(1);
 const providerConfigSchema = piProviderProfileSchema;
-const pathGlobPatternSchema = z.string().min(1).superRefine((pattern, context) => {
-	if (pattern.includes("\0")) context.addIssue({
-		code: "custom",
-		message: "must not contain NUL bytes"
-	});
-	if (pattern.includes("\\")) context.addIssue({
-		code: "custom",
-		message: "must use POSIX '/' separators"
-	});
-	if (pattern.startsWith("/") || /^[A-Za-z]:\//.test(pattern)) context.addIssue({
-		code: "custom",
-		message: "must be repo-relative"
-	});
-	if (pattern.startsWith("!")) context.addIssue({
-		code: "custom",
-		message: "must use paths.exclude instead of negation"
-	});
-	if (pattern.split("/").includes("..")) context.addIssue({
-		code: "custom",
-		message: "must not contain '..' segments"
-	});
-});
-z.strictObject({
-	include: z.array(pathGlobPatternSchema).min(1).optional(),
-	exclude: z.array(pathGlobPatternSchema).min(1).optional()
-});
 const diffManifestLimitsConfigSchema = z.strictObject({
 	fullMaxBytes: z.number().int().positive().optional(),
 	fullMaxEstimatedTokens: z.number().int().positive().optional(),
@@ -330,7 +291,7 @@ const droppedFindingSchema = z.strictObject({
 	reason: nonEmptyStringSchema
 });
 const validatedReviewSchema = z.strictObject({
-	review: prReviewSchema,
+	review: reviewResultSchema,
 	validFindings: z.array(reviewFindingSchema),
 	droppedFindings: z.array(droppedFindingSchema)
 });
@@ -368,64 +329,64 @@ function embeddedSdkAssets() {
 	};
 }
 //#endregion
-//#region src/config/type-support.ts
-const starterTsconfig = `{
-  "compilerOptions": {
-    "strict": true,
-    "noEmit": true,
-    "target": "ES2022",
-    "module": "ESNext",
-    "moduleResolution": "Bundler"
-  },
-  "include": ["./**/*.ts"]
+//#region src/config/sdk-module.ts
+function resolvedSdkModulePath() {
+	try {
+		return fileURLToPath(import.meta.resolve("@usepipr/sdk"));
+	} catch {
+		return;
+	}
 }
-`;
-async function generatedTypeSupportFiles(relativeConfigDir, options = {}) {
-	const files = [];
-	if (options.tsconfig !== false) files.push({
-		relativePath: path.join(relativeConfigDir, "tsconfig.json"),
-		contents: starterTsconfig
-	});
-	files.push({
-		relativePath: path.join(relativeConfigDir, "types", "pipr-sdk.d.ts"),
-		contents: await sdkDeclaration()
-	});
-	return files;
+function resolvedSdkPackageRoot() {
+	return sdkPackageRootFromResolvedModule(resolvedSdkModulePath());
 }
-async function writeGeneratedTypeSupport(configDir, options = {}) {
-	for (const file of await generatedTypeSupportFiles("", options)) {
-		const target = path.join(configDir, file.relativePath);
-		await mkdir(path.dirname(target), { recursive: true });
-		await Bun.write(target, file.contents);
-	}
+function sdkPackageRootFromResolvedModule(modulePath) {
+	if (!modulePath) return;
+	const moduleDir = path.dirname(modulePath);
+	return path.basename(moduleDir) === "src" || path.basename(moduleDir) === "dist" ? path.dirname(moduleDir) : moduleDir;
+}
+function sdkModuleStubSource(modulePath, embeddedModule) {
+	if (modulePath) return `export * from ${JSON.stringify(pathToFileURL(modulePath).href)};\n`;
+	if (embeddedModule) return embeddedModule;
+	throw new Error("Unable to locate @usepipr/sdk runtime module");
+}
+//#endregion
+//#region src/config/sdk-stub.ts
+const sdkDeclarationModules = [{
+	moduleName: "@usepipr/sdk",
+	fileName: "index.d.mts"
+}];
+async function installTypedSdkStub(configDir) {
+	const sdkRoot = path.join(configDir, "node_modules", "@usepipr", "sdk");
+	await rm(sdkRoot, {
+		recursive: true,
+		force: true
+	});
+	await mkdir(sdkRoot, { recursive: true });
+	await Bun.write(path.join(sdkRoot, "package.json"), JSON.stringify({
+		type: "module",
+		types: "./index.d.ts",
+		exports: { ".": {
+			types: "./index.d.ts",
+			default: "./index.mjs"
+		} }
+	}));
+	await Bun.write(path.join(sdkRoot, "index.mjs"), sdkModuleStubSource(resolvedSdkModulePath(), embeddedSdkAssets().module));
+	await Bun.write(path.join(sdkRoot, "index.d.ts"), await sdkStubDeclaration());
 }
-async function sdkDeclaration() {
+async function sdkStubDeclaration() {
 	const embedded = embeddedSdkAssets().declaration;
 	if (embedded?.includes("declare module \"@usepipr/sdk\"")) {
 		assertStandaloneSdkDeclaration(embedded);
-		return embedded;
+		return embedded.endsWith("\n") ? embedded : `${embedded}\n`;
 	}
 	const declaration = embeddedSdkDeclaration(await rawSdkDeclarations());
 	assertStandaloneSdkDeclaration(declaration);
-	return declaration;
+	return declaration.endsWith("\n") ? declaration : `${declaration}\n`;
 }
 function assertStandaloneSdkDeclaration(declaration) {
 	if (declaration.includes("from \"zod\"") || declaration.includes("z.ZodType")) throw new Error("generated SDK declaration must be standalone and must not import zod");
 }
-const sdkDeclarationModules = [
-	{
-		moduleName: "@usepipr/sdk",
-		fileName: "index.d.mts"
-	},
-	{
-		moduleName: "@usepipr/sdk/review",
-		fileName: "review.d.mts"
-	},
-	{
-		moduleName: "@usepipr/sdk/tools",
-		fileName: "tools.d.mts"
-	}
-];
 async function rawSdkDeclarations() {
 	const declarations = await Promise.all(sdkDeclarationModules.map(async (module) => {
 		const declarationPath = await sdkDeclarationPath(module.fileName);
@@ -440,13 +401,28 @@ async function rawSdkDeclarations() {
 		moduleName: sdkDeclarationModules[0].moduleName,
 		source: embedded
 	}];
-	throw new Error("Unable to locate @usepipr/sdk declaration file. Build @usepipr/sdk before pipr init.");
+	throw new Error("Unable to locate @usepipr/sdk declaration file. Build @usepipr/sdk before loading config.");
 }
 async function sdkDeclarationPath(fileName) {
-	const moduleDir = path.dirname(fileURLToPath(import.meta.url));
-	const candidates = [path.resolve(moduleDir, "../../sdk/dist", fileName), path.resolve(moduleDir, "../../../sdk/dist", fileName)];
-	for (const candidate of candidates) if (await Bun.file(candidate).exists()) return candidate;
+	const sdkRoot = resolvedSdkPackageRoot();
+	if (!sdkRoot) return;
+	const candidate = path.join(sdkRoot, "dist", fileName);
+	return await Bun.file(candidate).exists() ? candidate : void 0;
+}
+//#endregion
+//#region src/config/starter-tsconfig.ts
+const starterTsconfig = `{
+  "compilerOptions": {
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true,
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler"
+  },
+  "include": ["./**/*.ts"]
 }
+`;
 //#endregion
 //#region src/config/ts-loader.ts
 async function loadTypescriptConfig(options) {
@@ -457,13 +433,8 @@ async function loadTypescriptConfig(options) {
 	const tempRoot = await mkdtemp(path.join(os.tmpdir(), "pipr-config-"));
 	try {
 		const tempConfigDir = path.join(tempRoot, relativeConfigDir);
-		await cp(projectDir, tempConfigDir, {
-			recursive: true,
-			errorOnExist: false,
-			force: true,
-			filter: (source) => !isIgnoredConfigCopyPath(source, projectDir)
-		});
-		await installSdkStub(tempConfigDir);
+		await copyConfigDirectory(projectDir, tempConfigDir);
+		await prepareConfigDirectory(tempConfigDir, { frozen: true });
 		const factory = (await import(`${pathToFileURL(path.join(tempConfigDir, "config.ts")).href}?pipr=${Date.now()}`)).default;
 		if (!isPiprConfigFactory(factory)) throw new Error(`${sourceConfigPath}: default export must be created by definePipr()`);
 		return {
@@ -478,27 +449,15 @@ async function loadTypescriptConfig(options) {
 		});
 	}
 }
-async function installSdkStub(configDir) {
-	const sdkRoot = path.join(configDir, "node_modules", "@usepipr", "sdk");
-	await mkdir(sdkRoot, { recursive: true });
-	await Bun.write(path.join(sdkRoot, "package.json"), JSON.stringify({
-		type: "module",
-		exports: {
-			".": "./index.mjs",
-			"./review": "./review.mjs",
-			"./tools": "./tools.mjs"
-		}
-	}));
-	await Bun.write(path.join(sdkRoot, "index.mjs"), await sdkStubSource());
-	await Bun.write(path.join(sdkRoot, "review.mjs"), "export * from \"./index.mjs\";\n");
-	await Bun.write(path.join(sdkRoot, "tools.mjs"), "export * from \"./index.mjs\";\n");
+async function prepareConfigDirectory(configDir, options = {}) {
+	await installConfigDependencies(configDir, options);
+	await installTypedSdkStub(configDir);
 }
 async function typecheckTypescriptConfig(rootDir, relativeConfigDir) {
 	const tempRoot = await mkdtemp(path.join(os.tmpdir(), "pipr-config-check-"));
 	try {
 		const tempProjectDir = path.join(tempRoot, "project");
 		const tempConfigDir = path.join(tempProjectDir, relativeConfigDir);
-		const configTypesPath = path.join(relativeConfigDir, "types");
 		await cp(rootDir, tempProjectDir, {
 			recursive: true,
 			errorOnExist: false,
@@ -506,11 +465,15 @@ async function typecheckTypescriptConfig(rootDir, relativeConfigDir) {
 			filter: (source) => {
 				const relative = path.relative(rootDir, source);
 				const first = relative.split(path.sep)[0] ?? "";
-				return !ignoredTypecheckRootEntries.has(first) && relative !== "bun.lock" && relative !== configTypesPath && !relative.startsWith(`${configTypesPath}${path.sep}`);
+				return !ignoredTypecheckRootEntries.has(first) && relative !== "bun.lock";
 			}
 		});
+		await prepareConfigDirectory(tempConfigDir, { frozen: true });
 		const tsconfigPath = path.join(tempConfigDir, "tsconfig.json");
-		await writeGeneratedTypeSupport(tempConfigDir, { tsconfig: !await fileExists(tsconfigPath) });
+		if (!await fileExists(tsconfigPath)) {
+			await mkdir(tempConfigDir, { recursive: true });
+			await Bun.write(tsconfigPath, starterTsconfig);
+		}
 		await typecheckTypescriptConfigWithApi(tempConfigDir, tsconfigPath);
 	} finally {
 		await rm(tempRoot, {
@@ -524,28 +487,17 @@ async function typecheckTypescriptConfigWithApi(configDir, tsconfigPath) {
 	const config = ts.readConfigFile(tsconfigPath, ts.sys.readFile);
 	if (config.error) throw new Error(formatTypeScriptDiagnostics(ts, [config.error], configDir));
 	const parsed = ts.parseJsonConfigFileContent(config.config, ts.sys, configDir);
-	const typeRoot = path.join(configDir, "types");
 	const bundledTypeRoots = [];
-	try {
+	if (!await fileExists(path.join(configDir, "node_modules", "@types", "bun", "package.json"))) try {
 		const require = createRequire(import.meta.url);
 		bundledTypeRoots.push(path.dirname(path.dirname(require.resolve("@types/bun/package.json"))));
 	} catch {}
-	const fileNames = [path.join(configDir, "config.ts"), ...parsed.fileNames.filter((fileName) => {
-		const relative = path.relative(typeRoot, fileName);
-		return relative.startsWith("..") || path.isAbsolute(relative);
-	})];
-	const program = ts.createProgram(fileNames, {
+	const configPath = path.join(configDir, "config.ts");
+	const program = ts.createProgram([configPath, ...parsed.fileNames], {
 		...parsed.options,
-		typeRoots: [...new Set([
-			typeRoot,
-			...bundledTypeRoots,
-			...parsed.options.typeRoots ?? []
-		])],
-		types: [...new Set([
-			...parsed.options.types ?? [],
-			"pipr-sdk",
-			...bundledTypeRoots.length ? ["bun"] : []
-		])]
+		skipLibCheck: true,
+		typeRoots: [...new Set([...parsed.options.typeRoots ?? [], ...bundledTypeRoots])],
+		types: [...new Set([...parsed.options.types ?? [], ...bundledTypeRoots.length ? ["bun"] : []])]
 	});
 	const diagnostics = [...parsed.errors, ...ts.getPreEmitDiagnostics(program)];
 	if (diagnostics.length > 0) throw new Error(`TypeScript config check failed for ${path.join(configDir, "config.ts")}:\n` + formatTypeScriptDiagnostics(ts, diagnostics, configDir));
@@ -557,26 +509,17 @@ function formatTypeScriptDiagnostics(ts, diagnostics, configDir) {
 		getNewLine: () => "\n"
 	});
 }
-async function sdkStubSource() {
-	const sourcePath = await sdkSourcePath();
-	if (sourcePath) return `export * from ${JSON.stringify(pathToFileURL(sourcePath).href)};\n`;
-	const embedded = embeddedSdkAssets().module;
-	if (embedded) return embedded;
-	throw new Error("Unable to locate @usepipr/sdk runtime module");
-}
-async function sdkSourcePath() {
-	const moduleDir = path.dirname(fileURLToPath(import.meta.url));
-	const candidates = [
-		path.resolve(moduleDir, "../../../sdk/src/index.ts"),
-		path.resolve(moduleDir, "../../sdk/src/index.ts"),
-		path.resolve(moduleDir, "../../../sdk/dist/index.mjs"),
-		path.resolve(moduleDir, "../../sdk/dist/index.mjs")
-	];
-	for (const candidate of candidates) if (await fileExists(candidate)) return candidate;
+async function copyConfigDirectory(sourceDir, targetDir) {
+	await cp(sourceDir, targetDir, {
+		recursive: true,
+		errorOnExist: false,
+		force: true,
+		filter: (source) => !isIgnoredConfigCopyPath(source, sourceDir)
+	});
 }
 function isIgnoredConfigCopyPath(source, configDir) {
 	const relative = path.relative(configDir, source);
-	return relative === "node_modules" || relative.startsWith(`node_modules${path.sep}`) || relative === "bun.lock";
+	return relative === "node_modules" || relative.startsWith(`node_modules${path.sep}`);
 }
 const ignoredTypecheckRootEntries = new Set([
 	".fallow",
@@ -747,6 +690,8 @@ export default definePipr((pipr) => {
     options: { thinking: "medium" },
   });
 
+  pipr.config({ publication: { maxInlineComments: 8 } });
+
   const reviewer = pipr.reviewer({
     name: "bug-hunter",
     model: primary,
@@ -765,7 +710,6 @@ export default definePipr((pipr) => {
     paths: {
       exclude: ["docs/**", "**/*.md"],
     },
-    inlineComments: { max: 8 },
     timeout: "7m",
     entrypoints: {
       changeRequest: ["opened", "updated", "reopened", "ready"],
@@ -913,6 +857,8 @@ export default definePipr((pipr) => {
     options: { thinking: "high" },
   });
 
+  pipr.config({ publication: { maxInlineComments: 5 } });
+
   pipr.review({
     id: "review",
     model,
@@ -921,8 +867,7 @@ export default definePipr((pipr) => {
       maintainability, and test coverage.
       Return only actionable findings that target valid diff ranges.
     \`,
-    inlineComments: { max: 5 },
-    timeout: "5m",
+    timeout: "10m",
     comment: (result, context) => ({
       main:
         context.platform.id === "local"
@@ -1547,6 +1492,8 @@ export default definePipr((pipr) => {
     options: { thinking: "medium" },
   });
 
+  pipr.config({ publication: { maxInlineComments: 0 } });
+
   pipr.review({
     id: "pr-briefing",
     model,
@@ -1555,7 +1502,6 @@ export default definePipr((pipr) => {
       classify the PR type, explain review risk, and include a concise file walkthrough.
       Return no inline findings unless there is a concrete blocker.
     \`,
-    inlineComments: false,
     comment: (result, context) => [
       "## PR Briefing",
       "",
@@ -1646,18 +1592,6 @@ export default definePipr((pipr) => {
     options: { thinking: "high" },
   });
 
-  pipr.checks({
-    aggregate: { enabled: true, name: "pipr quality gate" },
-  });
-
-  pipr.limits({
-    timeoutSeconds: 420,
-    diffManifest: {
-      fullMaxEstimatedTokens: 32000,
-      condensedMaxEstimatedTokens: 64000,
-    },
-  });
-
   pipr.config({
     publication: {
       maxInlineComments: 6,
@@ -1669,6 +1603,16 @@ export default definePipr((pipr) => {
         userReplies: { enabled: true, allowedActors: "write" },
       },
     },
+    checks: {
+      aggregate: { enabled: true, name: "pipr quality gate" },
+    },
+    limits: {
+      timeoutSeconds: 420,
+      diffManifest: {
+        fullMaxEstimatedTokens: 32000,
+        condensedMaxEstimatedTokens: 64000,
+      },
+    },
   });
 
   pipr.review({
@@ -1680,7 +1624,6 @@ export default definePipr((pipr) => {
       If no blocking issue exists, state that no blocking issue exists.
     \`,
     check: { enabled: true, name: "quality gate", required: true },
-    inlineComments: { max: 6 },
     comment: (result) => ({
       main: \`## Quality Gate\\n\\n\${result.summary.body}\`,
       inlineFindings: result.inlineFindings,
@@ -1860,7 +1803,9 @@ function isOfficialInitRecipeId(recipe) {
 //#endregion
 //#region src/config/init.ts
 const supportedOfficialInitAdapters = ["github"];
-const defaultWorkflowActionRef = "somus/pipr@v0.1.3";
+const defaultWorkflowActionRef = "somus/pipr@v0.2.1";
+const defaultSdkVersion = "0.2.1";
+const defaultTypesBunVersion = "1.3.14";
 function resolveOfficialInitAdapters(adapters) {
 	if (adapters === void 0) return [...supportedOfficialInitAdapters];
 	if (adapters.length === 0) return [];
@@ -1880,25 +1825,38 @@ function unsupportedAdapterError(adapter) {
 	return /* @__PURE__ */ new Error(`Unsupported pipr init adapter '${adapter}'. Supported adapters: ${supportedOfficialInitAdapters.join(", ")}; use 'none' to skip adapter files.`);
 }
 async function initOfficialMinimalProject(options) {
-	const { configDir, relativeConfigDir } = resolveContainedConfigDir(options);
+	const { configDir, relativeConfigDir, projectDir } = resolveContainedConfigDir(options);
 	const adapters = resolveOfficialInitAdapters(options.adapters);
 	const rootDir = path.resolve(options.rootDir);
-	const typeSupport = options.typeSupport ?? "include";
-	const targets = (typeSupport === "only" ? await generatedTypeSupportFiles(relativeConfigDir) : await starterFiles(relativeConfigDir, adapters, options.recipe, typeSupport !== "skip")).map((file) => ({
+	const minimal = options.minimal === true;
+	const targets = (await starterFiles(relativeConfigDir, adapters, options.recipe, minimal)).map((file) => ({
 		...file,
 		absolutePath: path.join(rootDir, file.relativePath)
 	}));
 	await assertSafeTargetAncestors(targets, rootDir);
 	const existing = await findExistingTargets(targets);
-	if (existing.length > 0 && !options.force) {
-		if (typeSupport === "only") return {
-			configDir,
-			...await writeTargets(targets, existing, { skipExisting: true })
-		};
-		throw new Error(`Project already contains pipr files: ${existing.join(", ")}. Use --force to replace existing .pipr files.`);
-	}
+	if (existing.length > 0 && !options.force) throw new Error(`Project already contains pipr files: ${existing.join(", ")}. Use --force to replace existing .pipr files.`);
 	const result = await writeTargets(targets, existing, { skipExisting: false });
-	if (typeSupport !== "only") await loadRuntimeProject({
+	if (!minimal) {
+		await assertBunAvailable();
+		const install = Bun.spawn([
+			"bun",
+			"install",
+			"--ignore-scripts"
+		], {
+			cwd: projectDir,
+			env: process.env,
+			stdout: "pipe",
+			stderr: "pipe"
+		});
+		const [exitCode, stderr] = await Promise.all([install.exited, new Response(install.stderr).text()]);
+		if (exitCode !== 0) throw new Error(`${configDir}: bun install failed (exit ${exitCode}).` + (stderr.trim().length > 0 ? `\n${stderr.trim()}` : ""));
+		if (await Bun.file(path.join(projectDir, "bun.lock")).exists()) {
+			const lockRelative = path.join(relativeConfigDir, "bun.lock");
+			if (!existing.includes(lockRelative) && !result.created.includes(lockRelative)) result.created.push(lockRelative);
+		}
+	}
+	await loadRuntimeProject({
 		rootDir: options.rootDir,
 		configDir
 	});
@@ -1907,7 +1865,7 @@ async function initOfficialMinimalProject(options) {
 		...result
 	};
 }
-async function starterFiles(relativeConfigDir, adapters, recipe, includeTypeSupport = true) {
+async function starterFiles(relativeConfigDir, adapters, recipe, minimal = false) {
 	const files = [{
 		relativePath: path.join(relativeConfigDir, "config.ts"),
 		contents: officialInitRecipeConfigTs(recipe)
@@ -1915,13 +1873,29 @@ async function starterFiles(relativeConfigDir, adapters, recipe, includeTypeSupp
 		relativePath: path.join(relativeConfigDir, file.relativePath),
 		contents: file.contents
 	}))];
-	if (includeTypeSupport) files.push(...await generatedTypeSupportFiles(relativeConfigDir));
+	if (!minimal) files.push({
+		relativePath: path.join(relativeConfigDir, "package.json"),
+		contents: starterPackageJson()
+	}, {
+		relativePath: path.join(relativeConfigDir, "tsconfig.json"),
+		contents: starterTsconfig
+	}, {
+		relativePath: path.join(relativeConfigDir, ".gitignore"),
+		contents: "node_modules\n"
+	});
 	if (adapters.includes("github")) files.push({
 		relativePath: path.join(".github", "workflows", "pipr.yml"),
-		contents: starterWorkflow(relativeConfigDir.split(path.sep).join("/"), recipe)
+		contents: starterWorkflow(relativeConfigDir.split(path.sep).join("/"), recipe, minimal)
 	});
 	return files;
 }
+function starterPackageJson() {
+	return `${JSON.stringify({
+		private: true,
+		dependencies: { "@usepipr/sdk": process.env.PIPR_INTERNAL_INIT_SDK_VERSION ?? defaultSdkVersion },
+		devDependencies: { "@types/bun": defaultTypesBunVersion }
+	}, null, 2)}\n`;
+}
 async function writeTargets(targets, existing, options) {
 	const created = [];
 	const overwritten = [];
@@ -1975,7 +1949,7 @@ async function maybeLstat(filePath) {
 		return;
 	}
 }
-function starterWorkflow(relativeConfigDir, recipe) {
+function starterWorkflow(relativeConfigDir, recipe, minimal = false) {
 	const lines = [
 		"name: pipr",
 		"",
@@ -1998,20 +1972,25 @@ function starterWorkflow(relativeConfigDir, recipe) {
 		"    steps:",
 		"      - uses: actions/checkout@v6",
 		"        with:",
-		"          fetch-depth: 0",
-		`      - uses: ${defaultWorkflowActionRef}`,
-		"        env:",
-		`          DEEPSEEK_API_KEY: $${[
-			"{{ ",
-			"secrets.DEEPSEEK_API_KEY",
-			" }}"
-		].join("")}`,
-		`          GITHUB_TOKEN: $${[
-			"{{ ",
-			"github.token",
-			" }}"
-		].join("")}`
+		"          fetch-depth: 0"
 	];
+	if (!minimal) lines.push("      - uses: actions/cache@v4", "        with:", "          path: /home/runner/work/_temp/_github_home/.bun/install/cache", `          key: pipr-bun-${[
+		"{{ ",
+		`hashFiles('${relativeConfigDir}/bun.lock')`,
+		" }}"
+	].join("")}`);
+	lines.push(`      - uses: ${defaultWorkflowActionRef}`);
+	lines.push("        env:");
+	lines.push(`          DEEPSEEK_API_KEY: $${[
+		"{{ ",
+		"secrets.DEEPSEEK_API_KEY",
+		" }}"
+	].join("")}`);
+	lines.push(`          GITHUB_TOKEN: $${[
+		"{{ ",
+		"github.token",
+		" }}"
+	].join("")}`);
 	for (const secret of officialInitRecipeWorkflowEnvSecrets(recipe)) lines.push(`          ${secret.env}: $${[
 		"{{ ",
 		`secrets.${secret.secret}`,
@@ -2386,44 +2365,452 @@ function createLocalChangeRequestEvent(options) {
 	});
 }
 //#endregion
-//#region src/pi/runtime-tools.ts
-const piRuntimeReadToolNames = ["pipr_read_diff", "pipr_read_at_ref"];
-async function preparePiRuntimeReadTools(options) {
-	const toolRoot = path.join(options.root, "runtime-tools");
-	const baseRoot = path.join(toolRoot, "base");
-	await mkdir(baseRoot, { recursive: true });
-	const baseRanges = await materializeBaseRangeSnapshots({
-		baseRoot,
-		manifest: options.request.manifest,
-		sourceWorkspace: options.sourceWorkspace,
-		maxBytes: options.request.toolResponseMaxBytes
-	});
-	const data = {
-		manifest: options.request.manifest,
-		toolResponseMaxBytes: options.request.toolResponseMaxBytes,
-		baseRanges
-	};
-	const dataPath = path.join(toolRoot, "data.json");
-	await Bun.write(dataPath, JSON.stringify(data));
-	return {
-		extensionPath: await piRuntimeToolsExtensionPath(),
-		dataPath,
-		toolNames: piRuntimeReadToolNames
-	};
+//#region src/commands/grammar.ts
+const piprCommandPrefix = "@pipr";
+function firstNonEmptyLine(value) {
+	return value.split(/\r?\n/).map((line) => line.trim()).find((line) => line.length > 0);
 }
-async function piRuntimeToolsExtensionPath() {
-	const moduleDir = path.dirname(fileURLToPath(import.meta.url));
-	const candidates = [
-		path.join(moduleDir, "pi", "runtime-tools-extension.mjs"),
-		path.join(moduleDir, "runtime-tools-extension.mjs"),
-		path.join(moduleDir, "..", "..", "dist", "pi", "runtime-tools-extension.mjs"),
-		path.join(moduleDir, "runtime-tools-extension.ts")
-	];
-	for (const candidate of candidates) if (await pathExists(candidate)) return candidate;
-	throw new Error("Unable to locate pipr runtime tools extension");
+function isPiprCommandLine(line) {
+	return line === piprCommandPrefix || line.startsWith(`${piprCommandPrefix} `);
 }
-async function pathExists(filePath) {
-	return await Bun.file(filePath).exists();
+function parseCommandPattern(pattern, line) {
+	const patternParts = commandPatternParts(pattern);
+	const validationError = unsupportedCommandRestCaptureError(pattern);
+	if (validationError) return {
+		ok: false,
+		error: validationError
+	};
+	const lineTokens = tokenizeCommandPattern(line);
+	const captures = {};
+	let index = 0;
+	for (const part of patternParts) {
+		if (isOptionalCommandPatternPart(part)) {
+			const nextIndex = parseOptionalPatternPart(part.slice(1, -1), lineTokens, index, captures);
+			if (nextIndex !== void 0) index = nextIndex;
+			continue;
+		}
+		if (isCommandRestCaptureToken(part)) {
+			const value = lineTokens.slice(index).join(" ");
+			if (!value) return {
+				ok: false,
+				error: `Expected '${part}'`
+			};
+			captures[part.slice(1, -4)] = value;
+			index = lineTokens.length;
+			continue;
+		}
+		const nextIndex = parsePatternToken(part, lineTokens, index, captures);
+		if (nextIndex === void 0) return {
+			ok: false,
+			error: `Expected '${part}'`
+		};
+		index = nextIndex;
+	}
+	if (index !== lineTokens.length) return {
+		ok: false,
+		error: `Unexpected argument '${lineTokens[index]}'`
+	};
+	return {
+		ok: true,
+		value: captures
+	};
+}
+function commandPatternPrefixMatches(pattern, line) {
+	const patternTokens = commandPatternParts(pattern);
+	if (unsupportedCommandRestCaptureError(pattern)) return false;
+	const lineTokens = tokenizeCommandPattern(line);
+	let index = 0;
+	for (const token of patternTokens) {
+		if (isCommandCaptureToken(token) || isOptionalCommandPatternPart(token)) return true;
+		if (lineTokens[index] !== token) return false;
+		index += 1;
+	}
+	return true;
+}
+function parseOptionalPatternPart(pattern, lineTokens, startIndex, captures) {
+	const patternTokens = tokenizeCommandPattern(pattern);
+	if (patternTokens.length === 0 || lineTokens[startIndex] !== patternTokens[0]) return;
+	const snapshot = { ...captures };
+	let index = startIndex;
+	for (const token of patternTokens) {
+		const nextIndex = parsePatternToken(token, lineTokens, index, captures);
+		if (nextIndex === void 0) {
+			for (const key of Object.keys(captures)) delete captures[key];
+			Object.assign(captures, snapshot);
+			return;
+		}
+		index = nextIndex;
+	}
+	return index;
+}
+function parsePatternToken(patternToken, lineTokens, index, captures) {
+	if (isCommandCaptureToken(patternToken)) {
+		const value = lineTokens[index];
+		if (!value) return;
+		captures[patternToken.slice(1, -1)] = value;
+		return index + 1;
+	}
+	return lineTokens[index] === patternToken ? index + 1 : void 0;
+}
+//#endregion
+//#region src/action/entry-dispatch.ts
+const permissionOrder = [
+	"read",
+	"triage",
+	"write",
+	"maintain",
+	"admin"
+];
+const changeRequestActions = [
+	"opened",
+	"updated",
+	"reopened",
+	"ready",
+	"closed"
+];
+function dispatchRuntimeEntry(options) {
+	if (options.kind === "change-request") return {
+		kind: "change-request",
+		tasks: selectRuntimeTasks({
+			plan: options.plan,
+			event: options.event,
+			taskName: options.taskName
+		}),
+		taskName: options.taskName
+	};
+	return resolvePlanCommand(options.plan, options.line);
+}
+function selectRuntimeTasks(options) {
+	if (options.taskName) return options.plan.tasks.filter((task) => task.name === options.taskName);
+	return selectChangeRequestTasks(options.plan, options.event);
+}
+function selectLocalReviewTasks(plan) {
+	return uniqBy(plan.changeRequestTriggers.map((trigger) => trigger.task), (task) => task.name).filter((task) => task.local !== false);
+}
+function selectChangeRequestTasks(plan, event) {
+	if (!changeRequestActions.includes(event.action)) return [];
+	const action = event.action;
+	return uniqBy(plan.changeRequestTriggers.filter((trigger) => trigger.actions.includes(action)).map((trigger) => trigger.task), (task) => task.name);
+}
+function selectPlanCommand(plan, line) {
+	let firstInvalid;
+	for (const command of plan.commands) {
+		const parsed = parseCommandPattern(command.pattern, line);
+		if (!parsed.ok) {
+			if (commandPatternPrefixMatches(command.pattern, line) && !firstInvalid) firstInvalid = {
+				kind: "invalid",
+				command,
+				error: parsed.error
+			};
+			continue;
+		}
+		return {
+			kind: "matched",
+			command,
+			commandName: command.pattern.replace(/^@pipr\s+/, "").split(/\s+/)[0] ?? command.pattern,
+			line,
+			arguments: parsed.value
+		};
+	}
+	return firstInvalid;
+}
+function resolvePlanCommand(plan, line) {
+	if (!line) return {
+		kind: "ignored",
+		reason: "comment did not contain a command line"
+	};
+	if (!isPiprCommandLine(line)) return {
+		kind: "ignored",
+		reason: "comment did not target pipr"
+	};
+	const selected = selectPlanCommand(plan, line);
+	if (selected?.kind === "matched") return {
+		kind: "matched",
+		invocation: {
+			taskName: selected.command.task.name,
+			commandName: selected.commandName,
+			requiredPermission: selected.command.permission,
+			line: selected.line,
+			pattern: selected.command.pattern,
+			arguments: selected.arguments
+		}
+	};
+	if (selected?.kind === "invalid") return {
+		kind: "invalid",
+		reason: selected.error,
+		requiredPermission: selected.command.permission,
+		body: renderPlanCommandHelp(plan, selected.error)
+	};
+	return {
+		kind: "help",
+		reason: `unknown pipr command '${line}'`,
+		requiredPermission: "read",
+		body: renderPlanCommandHelp(plan, `Unknown command: ${line}`)
+	};
+}
+function parsePlanCommandInputs(plan, invocation) {
+	const matchingCommand = plan.commands.find((candidate) => candidate.task.name === invocation.taskName && candidate.pattern === invocation.pattern) ?? plan.commands.find((candidate) => candidate.task.name === invocation.taskName);
+	if (!matchingCommand) return {
+		kind: "invalid",
+		reason: `No command registered for task '${invocation.taskName}'`,
+		requiredPermission: invocation.requiredPermission,
+		body: renderPlanCommandHelp(plan)
+	};
+	try {
+		return {
+			kind: "matched",
+			invocation: {
+				...invocation,
+				inputs: matchingCommand.parse ? matchingCommand.parse(invocation.arguments) : invocation.arguments
+			}
+		};
+	} catch (error) {
+		const reason = error instanceof Error ? error.message : String(error);
+		return {
+			kind: "invalid",
+			reason,
+			requiredPermission: invocation.requiredPermission,
+			body: renderPlanCommandHelp(plan, reason)
+		};
+	}
+}
+function hasRequiredRepositoryPermission(actual, required) {
+	if (actual === "none") return false;
+	return permissionOrder.indexOf(actual) >= permissionOrder.indexOf(required);
+}
+function permissionDeniedHelp(plan, required) {
+	return renderPlanCommandHelp(plan, `Permission denied: requires ${required}.`);
+}
+function renderPlanCommandHelp(plan, reason) {
+	const lines = ["# pipr commands", ""];
+	if (reason) lines.push(reason, "");
+	for (const command of plan.commands) lines.push(`- ${command.pattern} (${command.permission})`);
+	return lines.join("\n");
+}
+//#endregion
+//#region src/diff/path-filter.ts
+const matcherOptions = {
+	dot: true,
+	nonegate: true,
+	windows: false
+};
+const compiledFilters = /* @__PURE__ */ new WeakMap();
+function filterDiffManifestByPaths(manifest, filter) {
+	if (!filter) return manifest;
+	return {
+		...manifest,
+		files: manifest.files.filter((file) => diffFileMatchesPathFilter(file, filter))
+	};
+}
+function diffFileMatchesPathFilter(file, filter) {
+	if (!filter) return true;
+	const paths = [...new Set([file.path, file.previousPath].filter((item) => item !== void 0))].map((item) => item.replaceAll("\\", "/").replace(/^\.\/+/, ""));
+	const compiled = readCompiledFilter(filter);
+	const include = compiled.include;
+	const exclude = compiled.exclude;
+	const included = include ? paths.some((filePath) => include.some((pattern) => pattern.matches(pattern.matchBasename ? path.posix.basename(filePath) : filePath))) : true;
+	const excluded = exclude ? paths.some((filePath) => exclude.some((pattern) => pattern.matches(pattern.matchBasename ? path.posix.basename(filePath) : filePath))) : false;
+	return included && !excluded;
+}
+function pathMatchesFilter(filePath, filter) {
+	if (!filter) return true;
+	const normalizedPath = filePath.replaceAll("\\", "/").replace(/^\.\/+/, "");
+	const compiled = readCompiledFilter(filter);
+	if (!(compiled.include ? compiled.include.some((pattern) => pattern.matches(pattern.matchBasename ? path.posix.basename(normalizedPath) : normalizedPath)) : true)) return false;
+	return compiled.exclude ? !compiled.exclude.some((pattern) => pattern.matches(pattern.matchBasename ? path.posix.basename(normalizedPath) : normalizedPath)) : true;
+}
+function readCompiledFilter(filter) {
+	const existing = compiledFilters.get(filter);
+	if (existing) return existing;
+	const compiled = {
+		include: filter.include?.map(compilePattern),
+		exclude: filter.exclude?.map(compilePattern)
+	};
+	compiledFilters.set(filter, compiled);
+	return compiled;
+}
+function compilePattern(pattern) {
+	return {
+		matches: picomatch(pattern, matcherOptions),
+		matchBasename: !pattern.includes("/")
+	};
+}
+//#endregion
+//#region src/diff/manifest-projection.ts
+const defaultDiffManifestPromptLimits = {
+	fullMaxBytes: 128 * 1024,
+	fullMaxEstimatedTokens: 32e3,
+	condensedMaxBytes: 256 * 1024,
+	condensedMaxEstimatedTokens: 64e3,
+	toolResponseMaxBytes: 64 * 1024
+};
+function projectDiffManifest(manifest, options) {
+	if (!manifestOptionsHaveEffect(options)) return manifest;
+	const manifestOptions = options ?? {};
+	const scopedManifest = filterDiffManifestByPaths(manifest, manifestOptions.paths);
+	return parseDiffManifest({
+		...scopedManifest,
+		files: scopedManifest.files.map((file) => ({
+			...withoutCompressedFileFields(file, manifestOptions.compressed === true),
+			commentableRanges: file.commentableRanges.map((range) => ({
+				...rangeFieldsForOptions(range, manifestOptions),
+				...manifestOptions.includePreviews === false ? {} : { preview: truncatePreview(range.preview, manifestOptions.maxPreviewLines) }
+			}))
+		}))
+	});
+}
+function cloneDiffManifest(manifest) {
+	return parseDiffManifest(structuredClone(manifest));
+}
+function prepareDiffManifestPrompt(manifest, config) {
+	const limits = resolveDiffManifestPromptLimits(config);
+	const full = measureDiffManifestPrompt(manifest);
+	if (fitsLimit(full, limits.fullMaxBytes, limits.fullMaxEstimatedTokens)) return {
+		mode: "full",
+		manifest,
+		metrics: {
+			full,
+			selected: full
+		},
+		limits
+	};
+	const condensedManifest = condenseDiffManifest(manifest);
+	const condensed = measureDiffManifestPrompt(condensedManifest);
+	if (!fitsLimit(condensed, limits.condensedMaxBytes, limits.condensedMaxEstimatedTokens)) throw new Error([
+		"Diff Manifest payload exceeds condensed limit before Pi execution",
+		`selected=${condensed.bytes} bytes/${condensed.estimatedTokens} estimated tokens`,
+		`limit=${limits.condensedMaxBytes} bytes/${limits.condensedMaxEstimatedTokens} estimated tokens`
+	].join("; "));
+	return {
+		mode: "condensed",
+		manifest: condensedManifest,
+		metrics: {
+			full,
+			selected: condensed
+		},
+		limits
+	};
+}
+function condenseDiffManifest(manifest) {
+	return {
+		baseSha: manifest.baseSha,
+		headSha: manifest.headSha,
+		mergeBaseSha: manifest.mergeBaseSha,
+		files: manifest.files.map(condenseDiffManifestFile)
+	};
+}
+function measureDiffManifestPrompt(manifest) {
+	const json = JSON.stringify(manifest, null, 2);
+	const bytes = Buffer.byteLength(json, "utf8");
+	return {
+		bytes,
+		estimatedTokens: Math.ceil(bytes / 4)
+	};
+}
+function resolveDiffManifestPromptLimits(config) {
+	return {
+		...defaultDiffManifestPromptLimits,
+		...Object.fromEntries(Object.entries(config ?? {}).filter((entry) => entry[1] !== void 0))
+	};
+}
+function manifestOptionsHaveEffect(options) {
+	return Boolean(options?.compressed || options?.includePreviews === false || options?.maxPreviewLines !== void 0 || options?.paths);
+}
+function withoutCompressedFileFields(file, compressed) {
+	if (!compressed) return file;
+	const { signals: _signals, changedSymbols: _changedSymbols, ...rest } = file;
+	return rest;
+}
+function withoutCompressedRangeFields(range, compressed) {
+	if (!compressed) return range;
+	const { summary: _summary, ...rest } = range;
+	return rest;
+}
+function rangeFieldsForOptions(range, options) {
+	const fields = withoutCompressedRangeFields(range, options.compressed === true);
+	if (options.includePreviews === false) {
+		const { preview: _preview, ...rest } = fields;
+		return rest;
+	}
+	return fields;
+}
+function truncatePreview(preview, maxLines) {
+	if (preview === void 0 || maxLines === void 0) return preview;
+	return preview.split("\n").slice(0, maxLines).join("\n");
+}
+function condenseDiffManifestFile(file) {
+	return {
+		path: file.path,
+		previousPath: file.previousPath,
+		status: file.status,
+		language: file.language,
+		additions: file.additions,
+		deletions: file.deletions,
+		hunks: file.hunks.map((hunk) => ({
+			hunkIndex: hunk.hunkIndex,
+			header: hunk.header,
+			oldStart: hunk.oldStart,
+			oldLines: hunk.oldLines,
+			newStart: hunk.newStart,
+			newLines: hunk.newLines,
+			contentHash: hunk.contentHash
+		})),
+		commentableRanges: file.commentableRanges.map((range) => ({
+			id: range.id,
+			path: range.path,
+			side: range.side,
+			startLine: range.startLine,
+			endLine: range.endLine,
+			kind: range.kind,
+			hunkIndex: range.hunkIndex,
+			hunkHeader: range.hunkHeader,
+			hunkContentHash: range.hunkContentHash
+		})),
+		excludedReason: file.excludedReason
+	};
+}
+function fitsLimit(metrics, maxBytes, maxEstimatedTokens) {
+	return metrics.bytes <= maxBytes && metrics.estimatedTokens <= maxEstimatedTokens;
+}
+//#endregion
+//#region src/pi/runtime-tools.ts
+const piRuntimeReadToolNames = ["pipr_read_diff", "pipr_read_at_ref"];
+async function preparePiRuntimeReadTools(options) {
+	const toolRoot = path.join(options.root, "runtime-tools");
+	const baseRoot = path.join(toolRoot, "base");
+	await mkdir(baseRoot, { recursive: true });
+	const baseRanges = await materializeBaseRangeSnapshots({
+		baseRoot,
+		manifest: options.request.manifest,
+		sourceWorkspace: options.sourceWorkspace,
+		maxBytes: options.request.toolResponseMaxBytes
+	});
+	const data = {
+		manifest: options.request.manifest,
+		toolResponseMaxBytes: options.request.toolResponseMaxBytes,
+		baseRanges
+	};
+	const dataPath = path.join(toolRoot, "data.json");
+	await Bun.write(dataPath, JSON.stringify(data));
+	return {
+		extensionPath: await piRuntimeToolsExtensionPath(),
+		dataPath,
+		toolNames: piRuntimeReadToolNames
+	};
+}
+async function piRuntimeToolsExtensionPath() {
+	const moduleDir = path.dirname(fileURLToPath(import.meta.url));
+	const candidates = [
+		path.join(moduleDir, "pi", "runtime-tools-extension.mjs"),
+		path.join(moduleDir, "runtime-tools-extension.mjs"),
+		path.join(moduleDir, "..", "..", "dist", "pi", "runtime-tools-extension.mjs"),
+		path.join(moduleDir, "runtime-tools-extension.ts")
+	];
+	for (const candidate of candidates) if (await pathExists(candidate)) return candidate;
+	throw new Error("Unable to locate pipr runtime tools extension");
+}
+async function pathExists(filePath) {
+	return await Bun.file(filePath).exists();
 }
 async function materializeBaseRangeSnapshots(options) {
 	const ranges = {};
@@ -2853,51 +3240,31 @@ function createRuntimeActionLog(options) {
 	for (const [key, value] of Object.entries(options.env ?? process.env)) if (sensitiveEnvNamePattern.test(key)) addSecret(secrets, value);
 	const debugEnabled = (options.env ?? process.env).ACTIONS_STEP_DEBUG === "true" || (options.env ?? process.env).PIPR_LOG_LEVEL === "debug";
 	const sink = options.logSink ?? noopActionLogSink;
-	const writer = structuredLogWriter(sink, secrets);
-	const logger = pino({
-		base: void 0,
-		level: debugEnabled ? "debug" : "info",
-		timestamp: false,
-		messageKey: "event",
-		customLevels: { notice: 35 },
-		formatters: { level(label) {
-			return { level: label };
-		} }
-	}, writer.stream);
 	return {
 		debugEnabled,
 		writesToSink: options.logSink !== void 0,
 		info(event, fields) {
-			writer.level = "info";
-			logger.info(compactFields(fields, secrets), redact(event, secrets));
+			emitRecord(sink, secrets, "info", event, fields);
 		},
 		notice(event, fields) {
-			writer.level = "notice";
-			logger.notice(compactFields(fields, secrets), redact(event, secrets));
+			emitRecord(sink, secrets, "notice", event, fields);
 		},
 		warning(event, fields) {
-			writer.level = "warning";
-			logger.warn(compactFields(fields, secrets), redact(event, secrets));
+			emitRecord(sink, secrets, "warning", event, fields);
 		},
 		error(event, fields) {
-			writer.level = "error";
-			logger.error(compactFields(fields, secrets), redact(event, secrets));
+			emitRecord(sink, secrets, "error", event, fields);
 		},
 		debug(event, fields) {
-			if (debugEnabled) {
-				writer.level = "debug";
-				logger.debug(compactFields(fields, secrets), redact(event, secrets));
-			}
+			if (debugEnabled) emitRecord(sink, secrets, "debug", event, fields);
 		},
 		text(level, event, text) {
 			if (level === "debug" && !debugEnabled) return;
-			const message = `${structuredLine(logger, writer, level, redact(event, secrets))}\n${redact(text, secrets)}`;
-			sinkForLevel(sink, level)(message);
+			emitRecord(sink, secrets, level, event, void 0, redact(text, secrets));
 		},
 		textSnippet(level, event, text, snippetOptions) {
 			if (level === "debug" && !debugEnabled) return;
-			const message = `${structuredLine(logger, writer, level, redact(event, secrets))}\n${formatTextSnippet(text, secrets, snippetOptions)}`;
-			sinkForLevel(sink, level)(message);
+			emitRecord(sink, secrets, level, event, void 0, formatTextSnippet(text, secrets, snippetOptions));
 		},
 		formatTextSnippet(text, snippetOptions) {
 			return formatTextSnippet(text, secrets, snippetOptions);
@@ -2941,93 +3308,21 @@ function compactFields(fields, secrets) {
 function formatTextSnippet(text, secrets, options) {
 	return boundedLogSnippet(redact(text, secrets), options);
 }
-function structuredLogWriter(sink, secrets) {
-	const writer = {
-		level: "info",
-		stream: { write(line) {
-			sinkForLevel(sink, writer.level)(redact(line.trimEnd(), secrets));
-		} }
-	};
-	return writer;
-}
-function structuredLine(logger, writer, level, event) {
-	let line = "";
-	const previousStream = writer.stream.write;
-	writer.stream.write = (value) => {
-		line = value.trimEnd();
-	};
-	writer.level = level;
-	logger[logMethod(level)]({}, event);
-	writer.stream.write = previousStream;
-	return line;
-}
-function logMethod(level) {
-	if (level === "warning") return "warn";
-	return level;
-}
-function sinkForLevel(sink, level) {
-	if (level === "warning") return sink.warning.bind(sink);
-	return sink[level].bind(sink);
+function emitRecord(sink, secrets, level, event, fields, text) {
+	sink.log({
+		level,
+		event: redact(event, secrets),
+		fields: compactFields(fields, secrets),
+		text
+	});
 }
 const noopActionLogSink = {
-	info() {},
-	notice() {},
-	warning() {},
-	error() {},
-	debug() {},
+	log() {},
 	async group(_name, run) {
 		return await run();
 	}
 };
 //#endregion
-//#region src/diff/path-filter.ts
-const matcherOptions = {
-	dot: true,
-	nonegate: true,
-	windows: false
-};
-const compiledFilters = /* @__PURE__ */ new WeakMap();
-function filterDiffManifestByPaths(manifest, filter) {
-	if (!filter) return manifest;
-	return {
-		...manifest,
-		files: manifest.files.filter((file) => diffFileMatchesPathFilter(file, filter))
-	};
-}
-function diffFileMatchesPathFilter(file, filter) {
-	if (!filter) return true;
-	const paths = [...new Set([file.path, file.previousPath].filter((item) => item !== void 0))].map((item) => item.replaceAll("\\", "/").replace(/^\.\/+/, ""));
-	const compiled = readCompiledFilter(filter);
-	const include = compiled.include;
-	const exclude = compiled.exclude;
-	const included = include ? paths.some((filePath) => include.some((pattern) => pattern.matches(pattern.matchBasename ? path.posix.basename(filePath) : filePath))) : true;
-	const excluded = exclude ? paths.some((filePath) => exclude.some((pattern) => pattern.matches(pattern.matchBasename ? path.posix.basename(filePath) : filePath))) : false;
-	return included && !excluded;
-}
-function pathMatchesFilter(filePath, filter) {
-	if (!filter) return true;
-	const normalizedPath = filePath.replaceAll("\\", "/").replace(/^\.\/+/, "");
-	const compiled = readCompiledFilter(filter);
-	if (!(compiled.include ? compiled.include.some((pattern) => pattern.matches(pattern.matchBasename ? path.posix.basename(normalizedPath) : normalizedPath)) : true)) return false;
-	return compiled.exclude ? !compiled.exclude.some((pattern) => pattern.matches(pattern.matchBasename ? path.posix.basename(normalizedPath) : normalizedPath)) : true;
-}
-function readCompiledFilter(filter) {
-	const existing = compiledFilters.get(filter);
-	if (existing) return existing;
-	const compiled = {
-		include: filter.include?.map(compilePattern),
-		exclude: filter.exclude?.map(compilePattern)
-	};
-	compiledFilters.set(filter, compiled);
-	return compiled;
-}
-function compilePattern(pattern) {
-	return {
-		matches: picomatch(pattern, matcherOptions),
-		matchBasename: !pattern.includes("/")
-	};
-}
-//#endregion
 //#region src/review/range-validation.ts
 function assertFindingMatchesRange(finding, range) {
 	const reason = findingRangeMismatchReason(finding, range);
@@ -3043,7 +3338,7 @@ function findingRangeMismatchReason(finding, range) {
 }
 //#endregion
 //#region src/review/review.ts
-function validatePrReview(review, manifest, options) {
+function validateReviewResult(review, manifest, options) {
 	if (options.expectedHeadSha && manifest.headSha !== options.expectedHeadSha) throw new Error(`Diff Manifest head SHA '${manifest.headSha}' does not match expected head SHA '${options.expectedHeadSha}'`);
 	const ranges = createDiffRangeIndex(manifest);
 	const seenFingerprints = /* @__PURE__ */ new Set();
@@ -3111,7 +3406,7 @@ function findingFingerprint(finding) {
 //#endregion
 //#region src/review/agent/agent-prompt.ts
 async function renderAgentPrompt(options) {
-	const prompt = await options.agent.definition.prompt(options.input, { ...options.agentRunContext.prompt });
+	const prompt = await renderAgentDefinitionPrompt(options.agent, options.input, options.agentRunContext.prompt);
 	const toolMode = options.toolMode ?? "read-only";
 	return compact([
 		promptSection("Role", "You are pipr's read-only change request agent."),
@@ -3126,6 +3421,9 @@ async function renderAgentPrompt(options) {
 		promptSection("Prompt", renderPromptValue(prompt))
 	]).join("\n\n");
 }
+function renderAgentDefinitionPrompt(agent, input, context) {
+	return agent.definition.prompt(input, { ...context });
+}
 function promptSection(title, body) {
 	if (!body?.trim()) return;
 	return `${title}:\n${body}`;
@@ -3142,12 +3440,12 @@ function outputPrompt(schema) {
 	return compact([
 		`Schema ID: ${schema.id}.`,
 		schema.jsonSchema ? `JSON Schema:\n${JSON.stringify(schema.jsonSchema, null, 2)}` : void 0,
-		schema.id === prReviewSchemaId ? `Example:\n${JSON.stringify(reviewSchemaExample$1(), null, 2)}` : void 0,
-		schema.id === prReviewSchemaId ? "`suggestedFix` is exact replacement code for the selected range. Do not include Markdown fences, prose, or labels in `suggestedFix`." : void 0,
+		schema.id === reviewResultSchemaId ? `Example:\n${JSON.stringify(reviewSchemaExample$1(), null, 2)}` : void 0,
+		schema.id === reviewResultSchemaId ? "`suggestedFix` is exact replacement code for the selected range. Do not include Markdown fences, prose, or labels in `suggestedFix`." : void 0,
 		"Return exactly one JSON value matching the schema.",
 		"The first non-whitespace character must be { or [ and the last non-whitespace character must be } or ].",
 		"Do not include Markdown, code fences, prose, explanations, or leading/trailing text.",
-		schema.id === prReviewSchemaId ? "For inlineFindings, use only fields shown in the schema and only exact Diff Manifest commentable ranges. If no exact range applies, omit the finding." : void 0
+		schema.id === reviewResultSchemaId ? "For inlineFindings, use only fields shown in the schema and only exact Diff Manifest commentable ranges. If no exact range applies, omit the finding." : void 0
 	]).join("\n\n");
 }
 function pathScopePrompt(paths) {
@@ -3184,143 +3482,6 @@ function customToolPrompt(agentTools) {
 	return ["Custom plugin tools:", ...agentTools.customTools.map((tool) => `${tool.name}: ${tool.description ?? "No description."}`)].join("\n");
 }
 //#endregion
-//#region src/diff/manifest-projection.ts
-const defaultDiffManifestPromptLimits = {
-	fullMaxBytes: 128 * 1024,
-	fullMaxEstimatedTokens: 32e3,
-	condensedMaxBytes: 256 * 1024,
-	condensedMaxEstimatedTokens: 64e3,
-	toolResponseMaxBytes: 64 * 1024
-};
-function projectDiffManifest(manifest, options) {
-	if (!manifestOptionsHaveEffect(options)) return manifest;
-	const manifestOptions = options ?? {};
-	const scopedManifest = filterDiffManifestByPaths(manifest, manifestOptions.paths);
-	return parseDiffManifest({
-		...scopedManifest,
-		files: scopedManifest.files.map((file) => ({
-			...withoutCompressedFileFields(file, manifestOptions.compressed === true),
-			commentableRanges: file.commentableRanges.map((range) => ({
-				...rangeFieldsForOptions(range, manifestOptions),
-				...manifestOptions.includePreviews === false ? {} : { preview: truncatePreview(range.preview, manifestOptions.maxPreviewLines) }
-			}))
-		}))
-	});
-}
-function cloneDiffManifest(manifest) {
-	return parseDiffManifest(structuredClone(manifest));
-}
-function prepareDiffManifestPrompt(manifest, config) {
-	const limits = resolveDiffManifestPromptLimits(config);
-	const full = measureDiffManifestPrompt(manifest);
-	if (fitsLimit(full, limits.fullMaxBytes, limits.fullMaxEstimatedTokens)) return {
-		mode: "full",
-		manifest,
-		metrics: {
-			full,
-			selected: full
-		},
-		limits
-	};
-	const condensedManifest = condenseDiffManifest(manifest);
-	const condensed = measureDiffManifestPrompt(condensedManifest);
-	if (!fitsLimit(condensed, limits.condensedMaxBytes, limits.condensedMaxEstimatedTokens)) throw new Error([
-		"Diff Manifest payload exceeds condensed limit before Pi execution",
-		`selected=${condensed.bytes} bytes/${condensed.estimatedTokens} estimated tokens`,
-		`limit=${limits.condensedMaxBytes} bytes/${limits.condensedMaxEstimatedTokens} estimated tokens`
-	].join("; "));
-	return {
-		mode: "condensed",
-		manifest: condensedManifest,
-		metrics: {
-			full,
-			selected: condensed
-		},
-		limits
-	};
-}
-function condenseDiffManifest(manifest) {
-	return {
-		baseSha: manifest.baseSha,
-		headSha: manifest.headSha,
-		mergeBaseSha: manifest.mergeBaseSha,
-		files: manifest.files.map(condenseDiffManifestFile)
-	};
-}
-function measureDiffManifestPrompt(manifest) {
-	const json = JSON.stringify(manifest, null, 2);
-	const bytes = Buffer.byteLength(json, "utf8");
-	return {
-		bytes,
-		estimatedTokens: Math.ceil(bytes / 4)
-	};
-}
-function resolveDiffManifestPromptLimits(config) {
-	return {
-		...defaultDiffManifestPromptLimits,
-		...Object.fromEntries(Object.entries(config ?? {}).filter((entry) => entry[1] !== void 0))
-	};
-}
-function manifestOptionsHaveEffect(options) {
-	return Boolean(options?.compressed || options?.includePreviews === false || options?.maxPreviewLines !== void 0 || options?.paths);
-}
-function withoutCompressedFileFields(file, compressed) {
-	if (!compressed) return file;
-	const { signals: _signals, changedSymbols: _changedSymbols, ...rest } = file;
-	return rest;
-}
-function withoutCompressedRangeFields(range, compressed) {
-	if (!compressed) return range;
-	const { summary: _summary, ...rest } = range;
-	return rest;
-}
-function rangeFieldsForOptions(range, options) {
-	const fields = withoutCompressedRangeFields(range, options.compressed === true);
-	if (options.includePreviews === false) {
-		const { preview: _preview, ...rest } = fields;
-		return rest;
-	}
-	return fields;
-}
-function truncatePreview(preview, maxLines) {
-	if (preview === void 0 || maxLines === void 0) return preview;
-	return preview.split("\n").slice(0, maxLines).join("\n");
-}
-function condenseDiffManifestFile(file) {
-	return {
-		path: file.path,
-		previousPath: file.previousPath,
-		status: file.status,
-		language: file.language,
-		additions: file.additions,
-		deletions: file.deletions,
-		hunks: file.hunks.map((hunk) => ({
-			hunkIndex: hunk.hunkIndex,
-			header: hunk.header,
-			oldStart: hunk.oldStart,
-			oldLines: hunk.oldLines,
-			newStart: hunk.newStart,
-			newLines: hunk.newLines,
-			contentHash: hunk.contentHash
-		})),
-		commentableRanges: file.commentableRanges.map((range) => ({
-			id: range.id,
-			path: range.path,
-			side: range.side,
-			startLine: range.startLine,
-			endLine: range.endLine,
-			kind: range.kind,
-			hunkIndex: range.hunkIndex,
-			hunkHeader: range.hunkHeader,
-			hunkContentHash: range.hunkContentHash
-		})),
-		excludedReason: file.excludedReason
-	};
-}
-function fitsLimit(metrics, maxBytes, maxEstimatedTokens) {
-	return metrics.bytes <= maxBytes && metrics.estimatedTokens <= maxEstimatedTokens;
-}
-//#endregion
 //#region src/review/agent/diff-manifest-context.ts
 function prepareDiffManifestContext(options) {
 	const manifest = readReservedInputManifest(options.input);
@@ -3419,7 +3580,8 @@ function resolveProvider(config, providerId) {
 	return provider;
 }
 function createAgentRunContext(runtime) {
-	const runId = crypto.randomUUID();
+	const runId = runtime.runId ?? runtime.taskContext?.run.id;
+	if (!runId) throw new Error("runId is required for stable review run identity");
 	const repositorySlugParts = runtime.event.repository.slug.split("/");
 	const repository = {
 		root: runtime.workspace,
@@ -3652,9 +3814,9 @@ function parseAgentOutput(output, agent) {
 	let lastError = "";
 	for (const payload of jsonPayloadCandidates(output)) try {
 		const json = JSON.parse(payload);
-		if (agent.definition.output.id === prReviewSchemaId) return {
+		if (agent.definition.output.id === reviewResultSchemaId) return {
 			ok: true,
-			value: parsePrReview(json),
+			value: parseReviewResult(json),
 			repairAttempted: false
 		};
 		return {
@@ -3690,6 +3852,9 @@ function buildRepairPrompt(options) {
 	].join("\n\n");
 }
 //#endregion
+//#region package.json
+var version = "0.2.1";
+//#endregion
 //#region src/review/prior-state.ts
 const mainCommentMarker = "pipr:main-comment";
 const inlineFindingMarkerPrefix = "pipr:finding";
@@ -3732,7 +3897,7 @@ function buildPriorReviewState(options) {
 		const prior = priorFindings.get(id);
 		if (prior) usedPriorIds.add(prior.id);
 		currentFindingIds.add(id);
-		nextFindings.set(id, priorFindingRecordSchema.parse({
+		const record = {
 			id,
 			status: "open",
 			path: finding.path,
@@ -3742,29 +3907,30 @@ function buildPriorReviewState(options) {
 			endLine: finding.endLine,
 			firstSeenHeadSha: prior?.firstSeenHeadSha ?? options.reviewedHeadSha,
 			lastSeenHeadSha: options.reviewedHeadSha,
-			lastCommentedHeadSha: prior?.lastCommentedHeadSha
-		}));
+			...prior?.lastCommentedHeadSha ? { lastCommentedHeadSha: prior.lastCommentedHeadSha } : {}
+		};
+		nextFindings.set(id, record);
 	}
 	for (const prior of priorFindings.values()) {
 		if (nextFindings.has(prior.id)) continue;
-		nextFindings.set(prior.id, priorFindingRecordSchema.parse(prior));
+		nextFindings.set(prior.id, prior);
 	}
-	return { state: priorReviewStateSchema.parse({
+	return {
 		version: 1,
 		reviewedHeadSha: options.reviewedHeadSha,
 		selectedTasks: options.selectedTasks,
 		findings: cappedFindings([...nextFindings.values()], currentFindingIds)
-	}) };
+	};
 }
 function resolvePriorFindings(state, findingIds) {
 	const resolved = new Set(findingIds);
-	return priorReviewStateSchema.parse({
+	return {
 		...state,
 		findings: state.findings.map((finding) => ({
 			...finding,
 			status: resolved.has(finding.id) ? "resolved" : finding.status
 		}))
-	});
+	};
 }
 function priorReviewStateForSelectedTasks(state, selectedTasks) {
 	if (!state || state.selectedTasks.length !== selectedTasks.length || !state.selectedTasks.every((taskName, index) => taskName === selectedTasks[index])) return;
@@ -3818,26 +3984,26 @@ function renderVerifierResponseMarker(findingId, responseKey) {
 	return `<!-- ${verifierResponseMarkerPrefix} id=${findingId} key=${responseKey} -->`;
 }
 function extractInlineFindingMarkerRecords(commentBodies) {
-	return commentBodies.flatMap((body) => [parseFindingHeadMarker(firstNonEmptyLine(body), inlineFindingMarkerPrefix)].filter((marker) => marker !== void 0));
+	return extractMarkerRecords(commentBodies, inlineFindingMarkerPrefix);
 }
 function extractInlineFindingMarkers(commentBodies) {
 	return new Set(extractInlineFindingMarkerRecords(commentBodies).map((record) => record.marker));
 }
 function extractResolvedFindingMarkerRecords(commentBodies) {
-	return commentBodies.flatMap((body) => [parseFindingHeadMarker(firstNonEmptyLine(body), resolvedFindingMarkerPrefix)].filter((marker) => marker !== void 0));
+	return extractMarkerRecords(commentBodies, resolvedFindingMarkerPrefix);
 }
 function applyResolvedFindingMarkers(state, commentBodies) {
 	const resolvedMarkers = new Set(extractResolvedFindingMarkerRecords(commentBodies).map((record) => `${record.id}:${record.head}`));
-	return priorReviewStateSchema.parse({
+	return {
 		...state,
 		findings: state.findings.map((finding) => ({
 			...finding,
 			status: finding.lastCommentedHeadSha && resolvedMarkers.has(`${finding.id}:${finding.lastCommentedHeadSha}`) ? "resolved" : finding.status
 		}))
-	});
+	};
 }
 function extractVerifierResponseMarkers(commentBodies) {
-	return new Set(commentBodies.flatMap((body) => [parseFindingHeadMarker(firstNonEmptyLine(body), verifierResponseMarkerPrefix)].filter((marker) => marker !== void 0)).map((record) => record.marker));
+	return new Set(extractMarkerRecords(commentBodies, verifierResponseMarkerPrefix).map((record) => record.marker));
 }
 function isPiprThreadActionReplyBody(body) {
 	const parsed = parsePiprMarker(body ? firstNonEmptyLine(body) : void 0);
@@ -3849,13 +4015,17 @@ function applyInlineFindingMarkers(state, commentBodies) {
 		const [, , findingId, headSha] = marker.split(":");
 		if (findingId && headSha) markerById.set(findingId, headSha);
 	}
-	return priorReviewStateSchema.parse({
+	return {
 		...state,
-		findings: state.findings.map((finding) => ({
-			...finding,
-			lastCommentedHeadSha: markerById.get(finding.id)
-		}))
-	});
+		findings: state.findings.map((finding) => {
+			const headSha = markerById.get(finding.id);
+			const { lastCommentedHeadSha: _lastCommentedHeadSha, ...rest } = finding;
+			return headSha ? {
+				...rest,
+				lastCommentedHeadSha: headSha
+			} : rest;
+		})
+	};
 }
 function findingIdFor(finding, state) {
 	return (state ? matchFindingRecord(state, finding) : void 0)?.id ?? newFindingId(finding);
@@ -3904,8 +4074,11 @@ function parseFindingHeadMarker(comment, prefix) {
 		marker: prefix === inlineFindingMarkerPrefix ? inlineFindingMarker(id, head) : prefix === resolvedFindingMarkerPrefix ? `${resolvedFindingMarkerPrefix}:${id}:${head}` : `${verifierResponseMarkerPrefix}:${id}:${head}`
 	};
 }
+function extractMarkerRecords(commentBodies, prefix) {
+	return commentBodies.flatMap((body) => [parseFindingHeadMarker(firstNonEmptyLine(body), prefix)].filter((marker) => marker !== void 0));
+}
 function encodeReviewState(state) {
-	return Buffer$1.from(JSON.stringify(priorReviewStateSchema.parse(state))).toString("base64url");
+	return Buffer$1.from(JSON.stringify(state)).toString("base64url");
 }
 function decodeReviewState(value) {
 	if (!value) return;
@@ -3939,143 +4112,8 @@ function hashParts(parts) {
 	return new Bun.CryptoHasher("sha256").update(parts.join("\n")).digest("hex").slice(0, 16);
 }
 //#endregion
-//#region src/action/entry-dispatch.ts
-const permissionOrder = [
-	"read",
-	"triage",
-	"write",
-	"maintain",
-	"admin"
-];
-const changeRequestActions = [
-	"opened",
-	"updated",
-	"reopened",
-	"ready",
-	"closed"
-];
-function dispatchRuntimeEntry(options) {
-	if (options.kind === "change-request") return {
-		kind: "change-request",
-		tasks: selectRuntimeTasks({
-			plan: options.plan,
-			event: options.event,
-			taskName: options.taskName
-		}),
-		taskName: options.taskName
-	};
-	return resolvePlanCommand(options.plan, options.line);
-}
-function selectRuntimeTasks(options) {
-	if (options.taskName) return options.plan.tasks.filter((task) => task.name === options.taskName);
-	return selectChangeRequestTasks(options.plan, options.event);
-}
-function selectLocalReviewTasks(plan) {
-	return uniqBy(plan.changeRequestTriggers.map((trigger) => trigger.task), (task) => task.name).filter((task) => task.local !== false);
-}
-function selectChangeRequestTasks(plan, event) {
-	if (!changeRequestActions.includes(event.action)) return [];
-	const action = event.action;
-	return uniqBy(plan.changeRequestTriggers.filter((trigger) => trigger.actions.includes(action)).map((trigger) => trigger.task), (task) => task.name);
-}
-function selectPlanCommand(plan, line) {
-	let firstInvalid;
-	for (const command of plan.commands) {
-		const parsed = parseCommandPattern(command.pattern, line);
-		if (!parsed.ok) {
-			if (commandPatternPrefixMatches(command.pattern, line) && !firstInvalid) firstInvalid = {
-				kind: "invalid",
-				command,
-				error: parsed.error
-			};
-			continue;
-		}
-		return {
-			kind: "matched",
-			command,
-			commandName: command.pattern.replace(/^@pipr\s+/, "").split(/\s+/)[0] ?? command.pattern,
-			line,
-			arguments: parsed.value
-		};
-	}
-	return firstInvalid;
-}
-function resolvePlanCommand(plan, line) {
-	if (!line) return {
-		kind: "ignored",
-		reason: "comment did not contain a command line"
-	};
-	if (!isPiprCommandLine(line)) return {
-		kind: "ignored",
-		reason: "comment did not target pipr"
-	};
-	const selected = selectPlanCommand(plan, line);
-	if (selected?.kind === "matched") return {
-		kind: "matched",
-		invocation: {
-			taskName: selected.command.task.name,
-			commandName: selected.commandName,
-			requiredPermission: selected.command.permission,
-			line: selected.line,
-			pattern: selected.command.pattern,
-			arguments: selected.arguments
-		}
-	};
-	if (selected?.kind === "invalid") return {
-		kind: "invalid",
-		reason: selected.error,
-		requiredPermission: selected.command.permission,
-		body: renderPlanCommandHelp(plan, selected.error)
-	};
-	return {
-		kind: "help",
-		reason: `unknown pipr command '${line}'`,
-		requiredPermission: "read",
-		body: renderPlanCommandHelp(plan, `Unknown command: ${line}`)
-	};
-}
-function parsePlanCommandInputs(plan, invocation) {
-	const matchingCommand = plan.commands.find((candidate) => candidate.task.name === invocation.taskName && candidate.pattern === invocation.pattern) ?? plan.commands.find((candidate) => candidate.task.name === invocation.taskName);
-	if (!matchingCommand) return {
-		kind: "invalid",
-		reason: `No command registered for task '${invocation.taskName}'`,
-		requiredPermission: invocation.requiredPermission,
-		body: renderPlanCommandHelp(plan)
-	};
-	try {
-		return {
-			kind: "matched",
-			invocation: {
-				...invocation,
-				inputs: matchingCommand.parse ? matchingCommand.parse(invocation.arguments) : invocation.arguments
-			}
-		};
-	} catch (error) {
-		const reason = error instanceof Error ? error.message : String(error);
-		return {
-			kind: "invalid",
-			reason,
-			requiredPermission: invocation.requiredPermission,
-			body: renderPlanCommandHelp(plan, reason)
-		};
-	}
-}
-function hasRequiredRepositoryPermission(actual, required) {
-	if (actual === "none") return false;
-	return permissionOrder.indexOf(actual) >= permissionOrder.indexOf(required);
-}
-function permissionDeniedHelp(plan, required) {
-	return renderPlanCommandHelp(plan, `Permission denied: requires ${required}.`);
-}
-function renderPlanCommandHelp(plan, reason) {
-	const lines = ["# pipr commands", ""];
-	if (reason) lines.push(reason, "");
-	for (const command of plan.commands) lines.push(`- ${command.pattern} (${command.permission})`);
-	return lines.join("\n");
-}
-//#endregion
 //#region src/review/comment.ts
-const runtimeVersion = "0.1.3";
+const runtimeVersion = version;
 const inlinePublicationItemSchema = z.strictObject({
 	finding: reviewFindingSchema,
 	range: commentableRangeSchema,
@@ -4146,7 +4184,7 @@ function buildPublicationPlan(options) {
 		findings: options.inlineItems.map((item) => item.finding),
 		reviewedHeadSha: options.metadata.reviewedHeadSha,
 		selectedTasks: options.metadata.selectedTasks
-	}).state;
+	});
 	const cappedInlineItems = options.maxInlineComments === void 0 ? options.inlineItems : options.inlineItems.slice(0, options.maxInlineComments);
 	const metadata = publicationMetadataSchema.parse({
 		...options.metadata,
@@ -4227,7 +4265,7 @@ function buildCommentPublishingPlan(options) {
 		findings: options.validated.validFindings,
 		reviewedHeadSha: options.event.change.head.sha,
 		selectedTasks: options.metadata.selectedTasks
-	}).state;
+	});
 	const inlineCommentDrafts = prepareInlinePublicationItems({
 		validated: options.validated,
 		manifest: options.manifest,
@@ -4249,6 +4287,30 @@ function buildCommentPublishingPlan(options) {
 	};
 }
 //#endregion
+//#region src/review/run-identity.ts
+function stableReviewRunId(options) {
+	return `pipr-${new Bun.CryptoHasher("sha256").update(JSON.stringify({
+		platform: options.event.platform.id,
+		repository: options.event.repository.slug,
+		changeNumber: options.event.change.number,
+		baseSha: options.event.change.base.sha,
+		headSha: options.event.change.head.sha,
+		trustedConfigHash: options.trustedConfigHash,
+		trustedConfigSha: options.trustedConfigSha,
+		selectedTasks: options.selectedTasks,
+		command: options.commandInvocation ? {
+			name: options.commandInvocation.name,
+			line: options.commandInvocation.line,
+			arguments: sortedCommandArguments(options.commandInvocation.arguments),
+			sourceCommentId: options.commandInvocation.sourceCommentId
+		} : void 0,
+		verifier: options.verifierInvocation
+	})).digest("hex").slice(0, 24)}`;
+}
+function sortedCommandArguments(arguments_) {
+	return Object.fromEntries(Object.entries(arguments_).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0));
+}
+//#endregion
 //#region src/review/verifier.ts
 const verifierFindingSchema = z.strictObject({
 	id: z.string().min(1),
@@ -4313,6 +4375,7 @@ async function runInternalVerifier(options) {
 				env: options.env,
 				piExecutable: options.piExecutable,
 				piRunner: options.piRunner,
+				runId: options.runId,
 				log: options.log
 			}
 		});
@@ -4329,6 +4392,7 @@ async function runInternalVerifier(options) {
 function verifierInput(options, prior, candidates) {
 	return {
 		manifest: options.diffManifest,
+		runId: options.runId,
 		mode: options.mode.kind,
 		reviewedHeadSha: prior.reviewedHeadSha,
 		currentHeadSha: options.event.change.head.sha,
@@ -4469,7 +4533,7 @@ function boundedVerifierText(value) {
 }
 //#endregion
 //#region src/review/task/task-output.ts
-const findingScopeMarker = Symbol("pipr.findingScope");
+const agentInlineFindingsOutputSchema = z.custom((value) => z.looseObject({ inlineFindings: z.array(reviewFindingSchema) }).safeParse(value).success);
 function createOutputState() {
 	return {
 		findings: [],
@@ -4491,16 +4555,19 @@ function mergeTaskOutputs(results) {
 }
 function mergeCommentContribution(merged, comment) {
 	if (!comment) return;
-	if (merged.comment) throw new Error(`ctx.comment(...) may be called once per selected run; received comments from '${merged.comment.taskName}' and '${comment.taskName}'`);
-	if (merged.commandResponse) throw new Error("ctx.comment(...) and ctx.command.reply(...) cannot both be called");
+	assertOutputContributionAllowed(merged, "comment", comment.taskName, (existing, next) => `ctx.comment(...) may be called once per selected run; received comments from '${existing}' and '${next}'`);
 	merged.comment = comment;
 }
 function mergeCommandResponseContribution(merged, commandResponse) {
 	if (!commandResponse) return;
-	if (merged.commandResponse) throw new Error(`ctx.command.reply(...) may be called once per selected run; received replies from '${merged.commandResponse.taskName}' and '${commandResponse.taskName}'`);
-	if (merged.comment) throw new Error("ctx.comment(...) and ctx.command.reply(...) cannot both be called");
+	assertOutputContributionAllowed(merged, "commandResponse", commandResponse.taskName, (existing, next) => `ctx.command.reply(...) may be called once per selected run; received replies from '${existing}' and '${next}'`);
 	merged.commandResponse = commandResponse;
 }
+function assertOutputContributionAllowed(state, kind, taskName, duplicateMessage) {
+	const existing = kind === "comment" ? state.comment : state.commandResponse;
+	if (existing) throw new Error(duplicateMessage(existing.taskName, taskName));
+	if (kind === "comment" ? state.commandResponse : state.comment) throw new Error("ctx.comment(...) and ctx.command.reply(...) cannot both be called");
+}
 function createCheckHandle(state) {
 	return {
 		pass(summary) {
@@ -4532,8 +4599,7 @@ function runtimeTaskCheckResult(taskName, check) {
 	};
 }
 function collectComment(state, value, taskName) {
-	if (state.commandResponse) throw new Error("ctx.comment(...) and ctx.command.reply(...) cannot both be called");
-	if (state.comment) throw new Error(`ctx.comment(...) may be called once per selected run; '${taskName}' called it more than once`);
+	assertOutputContributionAllowed(state, "comment", taskName, () => `ctx.comment(...) may be called once per selected run; '${taskName}' called it more than once`);
 	state.comment = {
 		taskName,
 		value
@@ -4542,8 +4608,7 @@ function collectComment(state, value, taskName) {
 	collectInlineFindings(state, value.inlineFindings);
 }
 function collectCommandResponse(state, value, taskName) {
-	if (state.comment) throw new Error("ctx.comment(...) and ctx.command.reply(...) cannot both be called");
-	if (state.commandResponse) throw new Error(`ctx.command.reply(...) may be called once per selected run; '${taskName}' called it more than once`);
+	assertOutputContributionAllowed(state, "commandResponse", taskName, () => `ctx.command.reply(...) may be called once per selected run; '${taskName}' called it more than once`);
 	state.commandResponse = {
 		taskName,
 		value
@@ -4576,30 +4641,13 @@ function collectInlineFindings(state, findings) {
 	const arrayScope = state.findingScopes.get(findings);
 	state.findings.push(...findings.map((finding) => ({
 		finding,
-		paths: finding[findingScopeMarker] ?? arrayScope
+		paths: arrayScope
 	})));
 }
 function trackResultFindingScope(state, value, paths) {
-	if (!hasInlineFindings(value)) return;
 	if (!paths) return;
-	state.findingScopes.set(value.inlineFindings, paths);
-	for (const finding of value.inlineFindings) {
-		if (!isReviewFindingLike(finding)) continue;
-		markFindingScope(finding, paths);
-	}
-}
-function markFindingScope(finding, paths) {
-	Object.defineProperty(finding, findingScopeMarker, {
-		value: paths,
-		enumerable: true,
-		configurable: true
-	});
-}
-function hasInlineFindings(value) {
-	return typeof value === "object" && value !== null && Array.isArray(value.inlineFindings);
-}
-function isReviewFindingLike(value) {
-	return typeof value === "object" && value !== null && typeof value.body === "string" && typeof value.path === "string" && typeof value.rangeId === "string";
+	const parsed = agentInlineFindingsOutputSchema.safeParse(value);
+	if (parsed.success) state.findingScopes.set(parsed.data.inlineFindings, paths);
 }
 function collectedReview(output) {
 	return {
@@ -4652,13 +4700,21 @@ async function runTaskRuntime(options) {
 		selectedTasks,
 		taskCount: tasks.length
 	});
+	const runId = stableReviewRunId({
+		event: options.event,
+		selectedTasks,
+		trustedConfigSha: options.trustedConfigSha,
+		trustedConfigHash: options.trustedConfigHash,
+		commandInvocation: options.commandInvocation
+	});
 	const loadedPriorReviewState = options.priorReviewState ?? await options.loadPriorReviewState?.();
 	const priorMainComment = options.priorMainComment ?? await options.loadPriorMainComment?.();
 	const priorReviewState = priorReviewStateForSelectedTasks(loadedPriorReviewState, selectedTasks);
 	const runtimeOptions = {
 		...options,
 		priorReviewState,
-		priorMainComment
+		priorMainComment,
+		runId
 	};
 	const manifestCache = /* @__PURE__ */ new Map();
 	const taskResults = await Promise.all(tasks.map(async (task, taskOrder) => {
@@ -4731,7 +4787,7 @@ async function runTaskRuntime(options) {
 	});
 	if (commandResponse) return commandResponse;
 	assertReviewCommentOutput(output, options.commandInvocation !== void 0);
-	const validated = validatePrReview(collectedReview(output), diffManifest, {
+	const validated = validateReviewResult(collectedReview(output), diffManifest, {
 		expectedHeadSha: options.event.change.head.sha,
 		pathScopeForFinding: (_finding, index) => output.findings[index]?.paths
 	});
@@ -4740,7 +4796,8 @@ async function runTaskRuntime(options) {
 		config,
 		provider,
 		diffManifest,
-		priorReviewState
+		priorReviewState,
+		runId
 	});
 	const publishing = buildCommentPublishingPlan({
 		event: options.event,
@@ -4817,14 +4874,15 @@ async function runSynchronizeVerifier(options) {
 		diffManifest: options.diffManifest,
 		priorReviewState: options.priorReviewState,
 		threadContexts: await options.options.loadInlineThreadContexts?.() ?? [],
-		mode: { kind: "synchronize" }
+		mode: { kind: "synchronize" },
+		runId: options.runId
 	});
 }
 function createTaskContext(options) {
 	const repositorySlugParts = options.event.repository.slug.split("/");
 	let taskContext;
 	taskContext = {
-		run: { id: crypto.randomUUID() },
+		run: { id: options.runId },
 		repository: {
 			root: options.workspace,
 			owner: repositorySlugParts.length > 1 ? repositorySlugParts[0] : void 0,
@@ -4877,13 +4935,14 @@ function createTaskContext(options) {
 				runOptions,
 				runtime: {
 					...options,
-					taskContext
+					taskContext,
+					runId: options.runId
 				}
 			});
 			options.output.providerModels.push(...result.providerModels);
 			if (result.repairAttempted) options.output.repairAttempted = true;
 			trackResultFindingScope(options.output, result.value, runOptions?.paths);
-			return result.value;
+			return agentOutputForTaskContext(agent, result.value);
 		} },
 		review: { async prior() {
 			return priorReviewForTask(options.priorMainComment, options.priorReviewState);
@@ -4896,6 +4955,9 @@ function createTaskContext(options) {
 	};
 	return taskContext;
 }
+function agentOutputForTaskContext(_agent, value) {
+	return value;
+}
 function resolveTaskSecret(secret, options) {
 	if (secret.kind !== "pipr.secret" || typeof secret.name !== "string") throw new Error("ctx.secret(...) requires a pipr.secret reference");
 	const value = (options.env ?? process.env)[secret.name];
@@ -6248,100 +6310,26 @@ function logEventContext(log, event) {
 		platform: event.platform.id,
 		eventName: event.eventName,
 		action: event.action,
-		rawAction: event.rawAction,
-		repo: event.repository.slug,
-		change: event.change.number,
-		base: shortSha(event.change.base.sha),
-		head: shortSha(event.change.head.sha),
-		fork: event.change.isFork
-	});
-}
-function logTrustedRuntime(log, runtime) {
-	log.notice("trusted config", {
-		source: runtime.settings.source,
-		trustedConfigSha: shortSha(runtime.trustedConfigSha),
-		trustedConfigHash: runtime.trustedConfigHash.slice(0, 12),
-		providers: runtime.settings.config.providers.map((provider) => `${provider.id}:${provider.model}`).join(","),
-		tasks: runtime.plan.tasks.length,
-		commands: runtime.plan.commands.length
-	});
-}
-function addProviderSecrets(log, config, env) {
-	for (const provider of config.providers) log.addSecret((env ?? process.env)[provider.apiKeyEnv]);
-}
-//#endregion
-//#region src/action/git-project.ts
-async function loadRuntimeProjectFromGitCommit(options) {
-	const configDir = resolveContainedConfigDir(options);
-	const files = listConfigFilesAtCommit(options.rootDir, options.commitSha, configDir.gitPath);
-	if (files.length === 0) throw new Error(`${configDir.configDir}/config.ts is required at base commit ${options.commitSha}`);
-	const tempRoot = await mkdtemp(path.join(os.tmpdir(), "pipr-base-config-"));
-	try {
-		const hash = new Bun.CryptoHasher("sha256");
-		for (const file of files) {
-			assertRegularFile(file, options.commitSha);
-			const relativePath = relativeGitPath(configDir.gitPath, file.path);
-			const targetPath = path.join(tempRoot, configDir.relativeConfigDir, ...relativePath.split("/"));
-			const contents = showFileAtCommit(options.rootDir, options.commitSha, file.path);
-			hash.update(relativePath);
-			hash.update("\0");
-			hash.update(contents);
-			hash.update("\0");
-			await mkdir(path.dirname(targetPath), { recursive: true });
-			await Bun.write(targetPath, contents);
-		}
-		return {
-			...await loadRuntimeProject({
-				rootDir: tempRoot,
-				configDir: configDir.relativeConfigDir,
-				env: options.env,
-				requireProviderEnv: false
-			}),
-			trustedConfigSha: options.commitSha,
-			trustedConfigHash: hash.digest("hex")
-		};
-	} finally {
-		await rm(tempRoot, {
-			recursive: true,
-			force: true
-		});
-	}
-}
-function listConfigFilesAtCommit(rootDir, commitSha, gitPath) {
-	return runGit$1([
-		"ls-tree",
-		"-r",
-		"-z",
-		commitSha,
-		"--",
-		gitPath
-	], rootDir).split("\0").filter(Boolean).map((entry) => parseGitTreeEntry(entry, commitSha));
-}
-function parseGitTreeEntry(entry, commitSha) {
-	const separatorIndex = entry.indexOf("	");
-	if (separatorIndex === -1) throw new Error(`Could not parse git tree entry at ${commitSha}: ${entry}`);
-	const metadata = entry.slice(0, separatorIndex);
-	const filePath = entry.slice(separatorIndex + 1);
-	const [mode = ""] = metadata.split(" ");
-	if (!mode || !filePath) throw new Error(`Could not parse git tree entry at ${commitSha}: ${entry}`);
-	return {
-		mode,
-		path: filePath
-	};
-}
-function assertRegularFile(file, commitSha) {
-	if (file.mode !== "100644" && file.mode !== "100755") throw new Error(`${file.path}: only regular config files are supported at ${commitSha}`);
-}
-function relativeGitPath(root, filePath) {
-	const relative = root === "." ? filePath : path.posix.relative(root, filePath);
-	assertRelativeGitPath(root, filePath, relative);
-	return relative;
+		rawAction: event.rawAction,
+		repo: event.repository.slug,
+		change: event.change.number,
+		base: shortSha(event.change.base.sha),
+		head: shortSha(event.change.head.sha),
+		fork: event.change.isFork
+	});
 }
-function assertRelativeGitPath(root, filePath, relative) {
-	if (!relative || relative.startsWith("..") || path.posix.isAbsolute(relative)) throw new Error(`${filePath}: git path escaped configDir ${root}`);
+function logTrustedRuntime(log, runtime) {
+	log.notice("trusted config", {
+		source: runtime.settings.source,
+		trustedConfigSha: shortSha(runtime.trustedConfigSha),
+		trustedConfigHash: runtime.trustedConfigHash.slice(0, 12),
+		providers: runtime.settings.config.providers.map((provider) => `${provider.id}:${provider.model}`).join(","),
+		tasks: runtime.plan.tasks.length,
+		commands: runtime.plan.commands.length
+	});
 }
-function showFileAtCommit(rootDir, commitSha, filePath) {
-	return runGit$1(["show", `${commitSha}:${filePath}`], rootDir);
+function addProviderSecrets(log, config, env) {
+	for (const provider of config.providers) log.addSecret((env ?? process.env)[provider.apiKeyEnv]);
 }
 //#endregion
 //#region src/action/runtime-checks.ts
@@ -6601,146 +6589,287 @@ async function runTrustedReviewAndPublish(options) {
 	}
 }
 //#endregion
-//#region src/action/commands.ts
-/** Initializes the official minimal `.pipr` project files. */
-async function runInitCommand(options) {
-	return await initOfficialMinimalProject({
+//#region src/action/git-project.ts
+async function loadRuntimeProjectFromGitCommit(options) {
+	const configDir = resolveContainedConfigDir(options);
+	const files = listConfigFilesAtCommit(options.rootDir, options.commitSha, configDir.gitPath);
+	if (files.length === 0) throw new Error(`${configDir.configDir}/config.ts is required at base commit ${options.commitSha}`);
+	const tempRoot = await mkdtemp(path.join(os.tmpdir(), "pipr-base-config-"));
+	try {
+		const hash = new Bun.CryptoHasher("sha256");
+		for (const file of files) {
+			assertRegularFile(file, options.commitSha);
+			const relativePath = relativeGitPath(configDir.gitPath, file.path);
+			const targetPath = path.join(tempRoot, configDir.relativeConfigDir, ...relativePath.split("/"));
+			const contents = showFileAtCommit(options.rootDir, options.commitSha, file.path);
+			hash.update(relativePath);
+			hash.update("\0");
+			hash.update(contents);
+			hash.update("\0");
+			await mkdir(path.dirname(targetPath), { recursive: true });
+			await Bun.write(targetPath, contents);
+		}
+		return {
+			...await loadRuntimeProject({
+				rootDir: tempRoot,
+				configDir: configDir.relativeConfigDir,
+				env: options.env,
+				requireProviderEnv: false
+			}),
+			trustedConfigSha: options.commitSha,
+			trustedConfigHash: hash.digest("hex")
+		};
+	} finally {
+		await rm(tempRoot, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+function listConfigFilesAtCommit(rootDir, commitSha, gitPath) {
+	return runGit$1([
+		"ls-tree",
+		"-r",
+		"-z",
+		commitSha,
+		"--",
+		gitPath
+	], rootDir).split("\0").filter(Boolean).map((entry) => parseGitTreeEntry(entry, commitSha)).filter((file) => !isIgnoredGitConfigPath(gitPath, file.path));
+}
+function isIgnoredGitConfigPath(gitPath, filePath) {
+	const relative = gitPath === "." ? filePath : path.posix.relative(gitPath, filePath);
+	return relative === "node_modules" || relative.startsWith("node_modules/");
+}
+function parseGitTreeEntry(entry, commitSha) {
+	const separatorIndex = entry.indexOf("	");
+	if (separatorIndex === -1) throw new Error(`Could not parse git tree entry at ${commitSha}: ${entry}`);
+	const metadata = entry.slice(0, separatorIndex);
+	const filePath = entry.slice(separatorIndex + 1);
+	const [mode = ""] = metadata.split(" ");
+	if (!mode || !filePath) throw new Error(`Could not parse git tree entry at ${commitSha}: ${entry}`);
+	return {
+		mode,
+		path: filePath
+	};
+}
+function assertRegularFile(file, commitSha) {
+	if (file.mode !== "100644" && file.mode !== "100755") throw new Error(`${file.path}: only regular config files are supported at ${commitSha}`);
+}
+function relativeGitPath(root, filePath) {
+	const relative = root === "." ? filePath : path.posix.relative(root, filePath);
+	assertRelativeGitPath(root, filePath, relative);
+	return relative;
+}
+function assertRelativeGitPath(root, filePath, relative) {
+	if (!relative || relative.startsWith("..") || path.posix.isAbsolute(relative)) throw new Error(`${filePath}: git path escaped configDir ${root}`);
+}
+function showFileAtCommit(rootDir, commitSha, filePath) {
+	return runGit$1(["show", `${commitSha}:${filePath}`], rootDir);
+}
+//#endregion
+//#region src/action/trusted-runtime.ts
+async function loadTrustedRuntimeForEvent(options, event, log) {
+	const trustedRuntime = await logPhase(log, "load trusted config", async () => loadRuntimeProjectFromGitCommit({
 		rootDir: options.rootDir,
 		configDir: options.configDir,
-		force: options.force,
-		adapters: options.adapters,
-		recipe: options.recipe,
-		typeSupport: options.typeSupport
+		commitSha: event.change.base.sha,
+		env: options.env
+	}));
+	logTrustedRuntime(log, trustedRuntime);
+	return trustedRuntime;
+}
+async function prepareTrustedHeadCheckout(options, adapter, config, event, log) {
+	addProviderSecrets(log, config, options.env);
+	assertTrustedActionProviderEnv(options, config);
+	await logPhase(log, "checkout head", async () => {
+		adapter.workspace.ensureHeadCheckout({
+			rootDir: options.rootDir,
+			change: event
+		});
 	});
 }
-/** Loads and validates the runtime project configuration. */
-async function runValidateCommand(options) {
-	return (await validateProject({
-		...options,
-		requireProviderEnv: options.requireProviderEnv ?? false
-	})).settings;
+//#endregion
+//#region src/action/command-entry.ts
+async function runIssueCommentActionCommand(options, adapter, log) {
+	const prepared = await prepareIssueCommentCommand(options, adapter, log);
+	if (prepared.kind === "ignored") {
+		log.notice("action ignored", { reason: prepared.reason });
+		return prepared;
+	}
+	return await dispatchIssueCommentCommand(options, adapter, prepared, log);
 }
-/** Returns an inspectable summary of the configured runtime plan. */
-async function runInspectCommand(options) {
-	const runtime = await loadRuntimeProject({
-		...options,
-		requireProviderEnv: false
+async function prepareIssueCommentCommand(options, adapter, log) {
+	const comment = await logPhase(log, "parse issue comment", async () => adapter.events.resolveCommandComment({
+		eventPath: options.eventPath,
+		env: options.env ?? process.env,
+		workspace: options.rootDir
+	}));
+	const runnable = runnableIssueCommentCommand(comment, options.dryRun);
+	if (runnable.kind === "ignored") return runnable;
+	const loaded = await logPhase(log, "load change request", async () => adapter.events.loadChangeRequest({
+		repository: comment.repository,
+		changeNumber: comment.changeNumber,
+		workspace: comment.workspace,
+		eventName: comment.eventName,
+		action: comment.action,
+		rawAction: comment.rawAction
+	}));
+	const event = parseChangeRequestEventContext({
+		eventName: loaded.eventName ?? comment.eventName,
+		action: loaded.action ?? comment.action,
+		rawAction: loaded.rawAction ?? comment.rawAction,
+		platform: { id: adapter.id },
+		repository: loaded.repository,
+		change: loaded.change,
+		workspace: loaded.workspace ?? comment.workspace
+	});
+	logEventContext(log, event);
+	const trustedRuntime = await loadTrustedRuntimeForEvent(options, event, log);
+	const resolution = resolvePlanCommand(trustedRuntime.plan, runnable.line);
+	if (resolution.kind === "ignored") return {
+		kind: "ignored",
+		reason: resolution.reason
+	};
+	return {
+		kind: "prepared",
+		comment,
+		line: runnable.line,
+		event,
+		trustedRuntime,
+		resolution
+	};
+}
+function runnableIssueCommentCommand(comment, dryRun) {
+	if (!comment.isChangeRequest) return {
+		kind: "ignored",
+		reason: "issue_comment did not target a pull request"
+	};
+	if (comment.action !== "created") return {
+		kind: "ignored",
+		reason: `issue_comment action '${comment.action}' is not supported`
+	};
+	const line = firstNonEmptyLine(comment.body);
+	if (!line || !isPiprCommandLine(line)) return {
+		kind: "ignored",
+		reason: "issue_comment did not target pipr"
+	};
+	return dryRun ? {
+		kind: "ignored",
+		reason: "PIPR_DRY_RUN=1; command dispatch skipped"
+	} : {
+		kind: "runnable",
+		line
+	};
+}
+async function dispatchIssueCommentCommand(options, adapter, prepared, log) {
+	const requiredPermission = prepared.resolution.kind === "matched" ? prepared.resolution.invocation.requiredPermission : prepared.resolution.requiredPermission;
+	const permission = await logPhase(log, "check command permission", async () => adapter.permissions.getRepositoryPermission({
+		repository: prepared.comment.repository,
+		actor: prepared.comment.actor
+	}));
+	log.notice("command dispatch", {
+		resolution: prepared.resolution.kind,
+		requiredPermission,
+		actualPermission: permission
+	});
+	if (!hasRequiredRepositoryPermission(permission, requiredPermission)) return {
+		kind: "command-help",
+		event: prepared.event,
+		configSource: prepared.trustedRuntime.settings.source,
+		body: permissionDeniedHelp(prepared.trustedRuntime.plan, requiredPermission),
+		reason: `permission denied for '${prepared.line}'`
+	};
+	if (prepared.resolution.kind === "help" || prepared.resolution.kind === "invalid") return {
+		kind: "command-help",
+		event: prepared.event,
+		configSource: prepared.trustedRuntime.settings.source,
+		body: prepared.resolution.body,
+		reason: prepared.resolution.reason
+	};
+	const parsedResolution = parsePlanCommandInputs(prepared.trustedRuntime.plan, prepared.resolution.invocation);
+	if (parsedResolution.kind === "invalid") return {
+		kind: "command-help",
+		event: prepared.event,
+		configSource: prepared.trustedRuntime.settings.source,
+		body: parsedResolution.body,
+		reason: parsedResolution.reason
+	};
+	if (parsedResolution.kind !== "matched") return {
+		kind: "ignored",
+		reason: "command dispatch did not resolve to a runnable task"
+	};
+	await prepareTrustedHeadCheckout(options, adapter, prepared.trustedRuntime.settings.config, prepared.event, log);
+	const dispatch = dispatchRuntimeEntry({
+		kind: "change-request",
+		plan: prepared.trustedRuntime.plan,
+		event: prepared.event,
+		taskName: parsedResolution.invocation.taskName
+	});
+	return await issueCommentCommandResult({
+		adapter,
+		completed: await runTrustedReviewAndPublish({
+			options,
+			adapter,
+			trustedRuntime: prepared.trustedRuntime,
+			event: prepared.event,
+			taskName: parsedResolution.invocation.taskName,
+			taskInput: parsedResolution.invocation.inputs,
+			selectedTasks: dispatch.kind === "change-request" ? dispatch.tasks : [],
+			commandInvocation: {
+				name: parsedResolution.invocation.commandName,
+				line: parsedResolution.invocation.line,
+				arguments: parsedResolution.invocation.arguments,
+				sourceCommentId: prepared.comment.commentId
+			},
+			log
+		}),
+		event: prepared.event,
+		commandName: parsedResolution.invocation.commandName,
+		sourceCommentId: prepared.comment.commentId,
+		configSource: prepared.trustedRuntime.settings.source
 	});
-	return inspectRuntimePlan(runtime.plan, runtime.settings.source);
 }
-/** Loads the runtime config and pull request event without running review publication. */
-async function runDryRunCommand(options) {
-	const runtime = await loadRuntimeProject({
-		...options,
-		requireProviderEnv: false
-	});
-	const event = await createActionHostAdapter(options).events.parseEvent({
-		eventPath: options.eventPath,
-		env: {
-			...options.env,
-			GITHUB_WORKSPACE: options.rootDir,
-			GITHUB_EVENT_NAME: "pull_request"
-		},
-		workspace: options.rootDir
+async function issueCommentCommandResult(options) {
+	if (options.completed.kind === "skipped") return {
+		kind: "ignored",
+		reason: options.completed.reason
+	};
+	if (options.completed.kind === "command-response") return await publishCommandResponseActionResult({
+		adapter: options.adapter,
+		completed: options.completed,
+		event: options.event,
+		sourceCommentId: options.sourceCommentId,
+		configSource: options.configSource
 	});
 	return {
-		configSource: runtime.settings.source,
-		event
+		kind: "review",
+		event: options.event,
+		command: options.commandName,
+		configSource: options.configSource,
+		review: options.completed.review,
+		publication: options.completed.publication
 	};
 }
-/** Runs configured change-request tasks against local Git base and head revisions. */
-async function runLocalReviewCommand(options) {
-	const log = options.logSink ? createRuntimeActionLog({
-		logSink: options.logSink,
-		env: options.env
-	}) : void 0;
-	log?.notice("local review start", {
-		root: options.rootDir,
-		configDir: options.configDir,
-		base: options.baseSha.slice(0, 12),
-		head: options.headSha?.slice(0, 12)
-	});
-	const runtime = await loadRuntimeProject({
-		...options,
-		requireProviderEnv: true
-	});
-	log?.notice("local config loaded", {
-		source: runtime.settings.source,
-		providers: runtime.settings.config.providers.map((provider) => `${provider.id}:${provider.model}`).join(","),
-		tasks: runtime.plan.tasks.length,
-		commands: runtime.plan.commands.length
-	});
-	const selectedTasks = selectLocalReviewTasks(runtime.plan);
-	const includeWorkingTree = options.headSha === void 0;
-	const headSha = options.headSha ?? runGit$1(["rev-parse", "HEAD"], options.rootDir).trim();
-	const event = parseChangeRequestEventContext({ ...createLocalChangeRequestEvent({
-		rootDir: options.rootDir,
-		baseSha: options.baseSha,
-		headSha
-	}) });
-	if (log) {
-		logEventContext(log, event);
-		log.notice("local dispatch", {
-			selectedTasks: selectedTasks.map((task) => task.name),
-			skippedLocalTasks: runtime.plan.tasks.filter((task) => task.local === false).map((task) => task.name),
-			diffTarget: includeWorkingTree ? "working-tree" : "head-ref"
-		});
-	}
-	const result = await runTaskRuntime({
-		workspace: options.rootDir,
-		config: runtime.settings.config,
-		event,
-		env: options.env,
-		plan: runtime.plan,
-		selectedTasks,
-		emptyTasksReason: "No change-request tasks are configured for local review",
-		piExecutable: options.piExecutable,
-		diffManifestBuilder: includeWorkingTree ? (diffOptions) => buildDiffManifest({
-			...diffOptions,
-			includeWorkingTree: true
-		}) : void 0,
-		log,
-		taskLog: options.taskLog
-	});
-	if (result.kind === "command-response") throw new Error("command response result is only supported for issue_comment commands");
-	log?.notice("local review complete", {
-		kind: result.kind,
-		taskChecks: result.taskChecks.length,
-		validFindings: result.kind === "review" ? result.validated.validFindings.length : void 0,
-		droppedFindings: result.kind === "review" ? result.validated.droppedFindings.length : void 0,
-		inlineDrafts: result.kind === "review" ? result.inlineCommentDrafts.length : void 0
-	});
-	return result;
-}
-/** Runs the GitHub Action workflow for pull request and issue-comment events. */
-async function runActionCommand(options) {
-	return await runActionCommandWithDependencies(options);
-}
-async function runActionCommandWithDependencies(options) {
-	const log = createRuntimeActionLog({
-		logSink: options.logSink,
-		env: options.env
-	});
-	return await log.group("pipr action", async () => {
-		const eventName = (options.env ?? process.env).GITHUB_EVENT_NAME ?? "pull_request";
-		log.notice("action start", {
-			eventName,
-			dryRun: options.dryRun,
-			root: options.rootDir,
-			configDir: options.configDir
-		});
-		const adapter = createActionHostAdapter(options);
-		await logPhase(log, "workspace", async () => {
-			adapter.workspace.ensureWorkspaceSafeDirectory?.({
-				rootDir: options.rootDir,
-				env: options.env
-			});
-		});
-		if (eventName === "issue_comment") return await runIssueCommentActionCommand(options, adapter, log);
-		if (eventName === "pull_request_review_comment") return await runReviewCommentReplyActionCommand(options, adapter, log);
-		return await runPullRequestActionCommand(options, adapter, log);
+async function publishCommandResponseActionResult(options) {
+	const publishCommandResponse = options.adapter.publication?.publishCommandResponse;
+	if (!publishCommandResponse) throw new Error("command response publication is not available for this code host");
+	const publication = await publishCommandResponse({
+		change: options.event,
+		sourceCommentId: options.sourceCommentId,
+		commandName: options.completed.response.commandName,
+		body: options.completed.response.body
 	});
+	return {
+		kind: "command-response",
+		event: options.event,
+		command: options.completed.response.commandName,
+		configSource: options.configSource,
+		response: { body: options.completed.response.body },
+		publication
+	};
 }
+//#endregion
+//#region src/action/pull-request-entry.ts
 async function runPullRequestActionCommand(options, adapter, log) {
 	const event = await logPhase(log, "parse event", async () => adapter.events.parseEvent({
 		eventPath: options.eventPath,
@@ -6789,34 +6918,8 @@ async function runPullRequestActionCommand(options, adapter, log) {
 		publication: completed.publication
 	};
 }
-async function loadTrustedRuntimeForEvent(options, event, log) {
-	const trustedRuntime = await logPhase(log, "load trusted config", async () => loadRuntimeProjectFromGitCommit({
-		rootDir: options.rootDir,
-		configDir: options.configDir,
-		commitSha: event.change.base.sha,
-		env: options.env
-	}));
-	logTrustedRuntime(log, trustedRuntime);
-	return trustedRuntime;
-}
-async function prepareTrustedHeadCheckout(options, adapter, config, event, log) {
-	addProviderSecrets(log, config, options.env);
-	assertTrustedActionProviderEnv(options, config);
-	await logPhase(log, "checkout head", async () => {
-		adapter.workspace.ensureHeadCheckout({
-			rootDir: options.rootDir,
-			change: event
-		});
-	});
-}
-async function runIssueCommentActionCommand(options, adapter, log) {
-	const prepared = await prepareIssueCommentCommand(options, adapter, log);
-	if (prepared.kind === "ignored") {
-		log.notice("action ignored", { reason: prepared.reason });
-		return prepared;
-	}
-	return await dispatchIssueCommentCommand(options, adapter, prepared, log);
-}
+//#endregion
+//#region src/action/verifier-entry.ts
 async function runReviewCommentReplyActionCommand(options, adapter, log) {
 	const capabilities = reviewCommentReplyDispatchCapabilities(options, adapter);
 	if (capabilities.kind === "ignored") {
@@ -6960,207 +7063,190 @@ async function runReviewCommentVerifier(options, adapter, prepared, log) {
 				actor: reply.actor
 			},
 			respondWhenStillValid: config.publication.autoResolve.userReplies.respondWhenStillValid
-		}
+		},
+		runId: stableReviewRunId({
+			event,
+			selectedTasks: ["pipr-internal-verifier"],
+			trustedConfigSha: trustedRuntime.trustedConfigSha,
+			trustedConfigHash: trustedRuntime.trustedConfigHash,
+			verifierInvocation: {
+				mode: "user-reply",
+				commentId: reply.commentId,
+				parentCommentId: reply.parentCommentId
+			}
+		})
 	});
 }
 function runnableReviewCommentReply(reply) {
-	if (reply.action !== "created") return {
-		kind: "ignored",
-		reason: `review comment action '${reply.action}' is not supported`
-	};
-	if (!reply.parentCommentId) return {
-		kind: "ignored",
-		reason: "review comment was not a reply"
-	};
-	if (reply.actor === "github-actions[bot]") return {
-		kind: "ignored",
-		reason: "review comment reply was authored by pipr"
-	};
-	if (isPiprThreadActionReplyBody(reply.body)) return {
-		kind: "ignored",
-		reason: "review comment reply was authored by pipr"
-	};
-	return { kind: "runnable" };
-}
-async function verifierActorAllowed(adapter, event, reply, config) {
-	const allowed = config.publication.autoResolve.userReplies.allowedActors;
-	if (allowed === "any") return true;
-	if (allowed === "author-or-write" && event.change.author?.login === reply.actor) return true;
-	return hasRequiredRepositoryPermission(await adapter.permissions.getRepositoryPermission({
-		repository: event.repository,
-		actor: reply.actor
-	}), "write");
-}
-async function prepareIssueCommentCommand(options, adapter, log) {
-	const comment = await logPhase(log, "parse issue comment", async () => adapter.events.resolveCommandComment({
-		eventPath: options.eventPath,
-		env: options.env ?? process.env,
-		workspace: options.rootDir
-	}));
-	const runnable = runnableIssueCommentCommand(comment, options.dryRun);
-	if (runnable.kind === "ignored") return runnable;
-	const loaded = await logPhase(log, "load change request", async () => adapter.events.loadChangeRequest({
-		repository: comment.repository,
-		changeNumber: comment.changeNumber,
-		workspace: comment.workspace,
-		eventName: comment.eventName,
-		action: comment.action,
-		rawAction: comment.rawAction
-	}));
-	const event = parseChangeRequestEventContext({
-		eventName: loaded.eventName ?? comment.eventName,
-		action: loaded.action ?? comment.action,
-		rawAction: loaded.rawAction ?? comment.rawAction,
-		platform: { id: adapter.id },
-		repository: loaded.repository,
-		change: loaded.change,
-		workspace: loaded.workspace ?? comment.workspace
-	});
-	logEventContext(log, event);
-	const trustedRuntime = await loadTrustedRuntimeForEvent(options, event, log);
-	const resolution = resolvePlanCommand(trustedRuntime.plan, runnable.line);
-	if (resolution.kind === "ignored") return {
-		kind: "ignored",
-		reason: resolution.reason
-	};
-	return {
-		kind: "prepared",
-		comment,
-		line: runnable.line,
-		event,
-		trustedRuntime,
-		resolution
-	};
-}
-function runnableIssueCommentCommand(comment, dryRun) {
-	if (!comment.isChangeRequest) return {
+	if (reply.action !== "created") return {
 		kind: "ignored",
-		reason: "issue_comment did not target a pull request"
+		reason: `review comment action '${reply.action}' is not supported`
 	};
-	if (comment.action !== "created") return {
+	if (!reply.parentCommentId) return {
 		kind: "ignored",
-		reason: `issue_comment action '${comment.action}' is not supported`
+		reason: "review comment was not a reply"
 	};
-	const line = firstNonEmptyLine(comment.body);
-	if (!line || !isPiprCommandLine(line)) return {
+	if (reply.actor === "github-actions[bot]") return {
 		kind: "ignored",
-		reason: "issue_comment did not target pipr"
+		reason: "review comment reply was authored by pipr"
 	};
-	return dryRun ? {
+	if (isPiprThreadActionReplyBody(reply.body)) return {
 		kind: "ignored",
-		reason: "PIPR_DRY_RUN=1; command dispatch skipped"
-	} : {
-		kind: "runnable",
-		line
+		reason: "review comment reply was authored by pipr"
 	};
+	return { kind: "runnable" };
 }
-async function dispatchIssueCommentCommand(options, adapter, prepared, log) {
-	const requiredPermission = prepared.resolution.kind === "matched" ? prepared.resolution.invocation.requiredPermission : prepared.resolution.requiredPermission;
-	const permission = await logPhase(log, "check command permission", async () => adapter.permissions.getRepositoryPermission({
-		repository: prepared.comment.repository,
-		actor: prepared.comment.actor
-	}));
-	log.notice("command dispatch", {
-		resolution: prepared.resolution.kind,
-		requiredPermission,
-		actualPermission: permission
-	});
-	if (!hasRequiredRepositoryPermission(permission, requiredPermission)) return {
-		kind: "command-help",
-		event: prepared.event,
-		configSource: prepared.trustedRuntime.settings.source,
-		body: permissionDeniedHelp(prepared.trustedRuntime.plan, requiredPermission),
-		reason: `permission denied for '${prepared.line}'`
-	};
-	if (prepared.resolution.kind === "help" || prepared.resolution.kind === "invalid") return {
-		kind: "command-help",
-		event: prepared.event,
-		configSource: prepared.trustedRuntime.settings.source,
-		body: prepared.resolution.body,
-		reason: prepared.resolution.reason
-	};
-	const parsedResolution = parsePlanCommandInputs(prepared.trustedRuntime.plan, prepared.resolution.invocation);
-	if (parsedResolution.kind === "invalid") return {
-		kind: "command-help",
-		event: prepared.event,
-		configSource: prepared.trustedRuntime.settings.source,
-		body: parsedResolution.body,
-		reason: parsedResolution.reason
-	};
-	if (parsedResolution.kind !== "matched") return {
-		kind: "ignored",
-		reason: "command dispatch did not resolve to a runnable task"
-	};
-	await prepareTrustedHeadCheckout(options, adapter, prepared.trustedRuntime.settings.config, prepared.event, log);
-	const dispatch = dispatchRuntimeEntry({
-		kind: "change-request",
-		plan: prepared.trustedRuntime.plan,
-		event: prepared.event,
-		taskName: parsedResolution.invocation.taskName
+async function verifierActorAllowed(adapter, event, reply, config) {
+	const allowed = config.publication.autoResolve.userReplies.allowedActors;
+	if (allowed === "any") return true;
+	if (allowed === "author-or-write" && event.change.author?.login === reply.actor) return true;
+	return hasRequiredRepositoryPermission(await adapter.permissions.getRepositoryPermission({
+		repository: event.repository,
+		actor: reply.actor
+	}), "write");
+}
+//#endregion
+//#region src/action/commands.ts
+/** Initializes the official minimal `.pipr` project files. */
+async function runInitCommand(options) {
+	return await initOfficialMinimalProject({
+		rootDir: options.rootDir,
+		configDir: options.configDir,
+		force: options.force,
+		adapters: options.adapters,
+		recipe: options.recipe,
+		minimal: options.minimal
 	});
-	return await issueCommentCommandResult({
-		adapter,
-		completed: await runTrustedReviewAndPublish({
-			options,
-			adapter,
-			trustedRuntime: prepared.trustedRuntime,
-			event: prepared.event,
-			taskName: parsedResolution.invocation.taskName,
-			taskInput: parsedResolution.invocation.inputs,
-			selectedTasks: dispatch.kind === "change-request" ? dispatch.tasks : [],
-			commandInvocation: {
-				name: parsedResolution.invocation.commandName,
-				line: parsedResolution.invocation.line,
-				arguments: parsedResolution.invocation.arguments
-			},
-			log
-		}),
-		event: prepared.event,
-		commandName: parsedResolution.invocation.commandName,
-		sourceCommentId: prepared.comment.commentId,
-		configSource: prepared.trustedRuntime.settings.source
+}
+/** Loads and validates the runtime project configuration. */
+async function runValidateCommand(options) {
+	return (await validateProject({
+		...options,
+		requireProviderEnv: options.requireProviderEnv ?? false
+	})).settings;
+}
+/** Returns an inspectable summary of the configured runtime plan. */
+async function runInspectCommand(options) {
+	const runtime = await loadRuntimeProject({
+		...options,
+		requireProviderEnv: false
 	});
+	return inspectRuntimePlan(runtime.plan, runtime.settings.source);
 }
-async function issueCommentCommandResult(options) {
-	if (options.completed.kind === "skipped") return {
-		kind: "ignored",
-		reason: options.completed.reason
-	};
-	if (options.completed.kind === "command-response") return await publishCommandResponseActionResult({
-		adapter: options.adapter,
-		completed: options.completed,
-		event: options.event,
-		sourceCommentId: options.sourceCommentId,
-		configSource: options.configSource
+/** Loads the runtime config and pull request event without running review publication. */
+async function runDryRunCommand(options) {
+	const runtime = await loadRuntimeProject({
+		...options,
+		requireProviderEnv: false
+	});
+	const event = await createActionHostAdapter(options).events.parseEvent({
+		eventPath: options.eventPath,
+		env: {
+			...options.env,
+			GITHUB_WORKSPACE: options.rootDir,
+			GITHUB_EVENT_NAME: "pull_request"
+		},
+		workspace: options.rootDir
 	});
 	return {
-		kind: "review",
-		event: options.event,
-		command: options.commandName,
-		configSource: options.configSource,
-		review: options.completed.review,
-		publication: options.completed.publication
+		configSource: runtime.settings.source,
+		event
 	};
 }
-async function publishCommandResponseActionResult(options) {
-	const publishCommandResponse = options.adapter.publication?.publishCommandResponse;
-	if (!publishCommandResponse) throw new Error("command response publication is not available for this code host");
-	const publication = await publishCommandResponse({
-		change: options.event,
-		sourceCommentId: options.sourceCommentId,
-		commandName: options.completed.response.commandName,
-		body: options.completed.response.body
+/** Runs configured change-request tasks against local Git base and head revisions. */
+async function runLocalReviewCommand(options) {
+	const log = options.logSink ? createRuntimeActionLog({
+		logSink: options.logSink,
+		env: options.env
+	}) : void 0;
+	log?.notice("local review start", {
+		root: options.rootDir,
+		configDir: options.configDir,
+		base: options.baseSha.slice(0, 12),
+		head: options.headSha?.slice(0, 12)
+	});
+	const runtime = await loadRuntimeProject({
+		...options,
+		requireProviderEnv: true
+	});
+	log?.notice("local config loaded", {
+		source: runtime.settings.source,
+		providers: runtime.settings.config.providers.map((provider) => `${provider.id}:${provider.model}`).join(","),
+		tasks: runtime.plan.tasks.length,
+		commands: runtime.plan.commands.length
+	});
+	const selectedTasks = selectLocalReviewTasks(runtime.plan);
+	const includeWorkingTree = options.headSha === void 0;
+	const headSha = options.headSha ?? runGit$1(["rev-parse", "HEAD"], options.rootDir).trim();
+	const event = parseChangeRequestEventContext({ ...createLocalChangeRequestEvent({
+		rootDir: options.rootDir,
+		baseSha: options.baseSha,
+		headSha
+	}) });
+	if (log) {
+		logEventContext(log, event);
+		log.notice("local dispatch", {
+			selectedTasks: selectedTasks.map((task) => task.name),
+			skippedLocalTasks: runtime.plan.tasks.filter((task) => task.local === false).map((task) => task.name),
+			diffTarget: includeWorkingTree ? "working-tree" : "head-ref"
+		});
+	}
+	const result = await runTaskRuntime({
+		workspace: options.rootDir,
+		config: runtime.settings.config,
+		event,
+		env: options.env,
+		plan: runtime.plan,
+		selectedTasks,
+		emptyTasksReason: "No change-request tasks are configured for local review",
+		piExecutable: options.piExecutable,
+		diffManifestBuilder: includeWorkingTree ? (diffOptions) => buildDiffManifest({
+			...diffOptions,
+			includeWorkingTree: true
+		}) : void 0,
+		log,
+		taskLog: options.taskLog
+	});
+	if (result.kind === "command-response") throw new Error("command response result is only supported for issue_comment commands");
+	log?.notice("local review complete", {
+		kind: result.kind,
+		taskChecks: result.taskChecks.length,
+		validFindings: result.kind === "review" ? result.validated.validFindings.length : void 0,
+		droppedFindings: result.kind === "review" ? result.validated.droppedFindings.length : void 0,
+		inlineDrafts: result.kind === "review" ? result.inlineCommentDrafts.length : void 0
+	});
+	return result;
+}
+/** Runs the GitHub Action workflow for pull request and issue-comment events. */
+async function runActionCommand(options) {
+	return await runActionCommandWithDependencies(options);
+}
+async function runActionCommandWithDependencies(options) {
+	const log = createRuntimeActionLog({
+		logSink: options.logSink,
+		env: options.env
+	});
+	return await log.group("pipr action", async () => {
+		const eventName = (options.env ?? process.env).GITHUB_EVENT_NAME ?? "pull_request";
+		log.notice("action start", {
+			eventName,
+			dryRun: options.dryRun,
+			root: options.rootDir,
+			configDir: options.configDir
+		});
+		const adapter = createActionHostAdapter(options);
+		await logPhase(log, "workspace", async () => {
+			adapter.workspace.ensureWorkspaceSafeDirectory?.({
+				rootDir: options.rootDir,
+				env: options.env
+			});
+		});
+		if (eventName === "issue_comment") return await runIssueCommentActionCommand(options, adapter, log);
+		if (eventName === "pull_request_review_comment") return await runReviewCommentReplyActionCommand(options, adapter, log);
+		return await runPullRequestActionCommand(options, adapter, log);
 	});
-	return {
-		kind: "command-response",
-		event: options.event,
-		command: options.completed.response.commandName,
-		configSource: options.configSource,
-		response: { body: options.completed.response.body },
-		publication
-	};
 }
 //#endregion
-export { runInspectCommand as a, PublicationError as c, supportedOfficialInitRecipes as d, runInitCommand as i, supportedOfficialInitAdapters as l, runActionCommandWithDependencies as n, runLocalReviewCommand as o, runDryRunCommand as r, runValidateCommand as s, runActionCommand as t, listOfficialInitRecipes as u };
+export { runInspectCommand as a, PublicationError as c, supportedOfficialInitRecipes as d, piBuiltinToolNames as f, piThinkingLevels as h, runInitCommand as i, supportedOfficialInitAdapters as l, piRequiredCliFlags as m, runActionCommandWithDependencies as n, runLocalReviewCommand as o, piReadOnlyToolNames as p, runDryRunCommand as r, runValidateCommand as s, runActionCommand as t, listOfficialInitRecipes as u };
 
-//# sourceMappingURL=commands-BC2fTZsi.mjs.map
+//# sourceMappingURL=commands-Cj8p5IQF.mjs.map