@usepipr/runtime 0.3.8 → 0.4.0

package/dist/{commands-RY37Y0rG.mjs → commands-ZZkXwqEn.mjs}

@@ -295,6 +295,31 @@ const repositoryRefSchema = z.strictObject({
 	slug: nonEmptyStringSchema,
 	url: nonEmptyStringSchema.optional()
 });
+const codeHostCoordinatesSchema = z.discriminatedUnion("provider", [
+	z.strictObject({
+		provider: z.literal("github"),
+		owner: nonEmptyStringSchema,
+		repository: nonEmptyStringSchema
+	}),
+	z.strictObject({
+		provider: z.literal("gitlab"),
+		projectId: nonEmptyStringSchema,
+		projectPath: nonEmptyStringSchema
+	}),
+	z.strictObject({
+		provider: z.literal("bitbucket"),
+		workspace: nonEmptyStringSchema,
+		repository: nonEmptyStringSchema,
+		repositoryUuid: nonEmptyStringSchema.optional()
+	}),
+	z.strictObject({
+		provider: z.literal("azure-devops"),
+		organization: nonEmptyStringSchema,
+		project: nonEmptyStringSchema,
+		projectId: nonEmptyStringSchema.optional(),
+		repositoryId: nonEmptyStringSchema
+	})
+]);
 const changeEndpointSchema = z.strictObject({
 	sha: nonEmptyStringSchema,
 	ref: nonEmptyStringSchema.optional(),
@@ -310,7 +335,8 @@ const changeRequestRefSchema = z.strictObject({
 	author: z.strictObject({ login: nonEmptyStringSchema }).optional(),
 	base: changeEndpointSchema,
 	head: changeEndpointSchema,
-	isFork: z.boolean().optional()
+	isFork: z.boolean().optional(),
+	isDraft: z.boolean().optional()
 });
 const changeRequestEventContextSchema = z.strictObject({
 	eventName: nonEmptyStringSchema,
@@ -318,6 +344,7 @@ const changeRequestEventContextSchema = z.strictObject({
 	rawAction: nonEmptyStringSchema.optional(),
 	platform: platformInfoSchema,
 	repository: repositoryRefSchema,
+	coordinates: codeHostCoordinatesSchema.optional(),
 	change: changeRequestRefSchema,
 	workspace: nonEmptyStringSchema
 });
@@ -529,7 +556,7 @@ function compareStableSemver(left, right) {
 }
 //#endregion
 //#region src/shared/version.ts
-const runtimeVersion = "0.3.8";
+const runtimeVersion = "0.4.0";
 //#endregion
 //#region src/config/version-compat.ts
 async function resolveConfigVersionCompatibility(options) {
@@ -3549,11 +3576,17 @@ function isOfficialInitRecipeId(recipe) {
 }
 //#endregion
 //#region src/config/init.ts
-const supportedOfficialInitAdapters = ["github"];
-const defaultWorkflowActionRef = "somus/pipr@v0.3.8";
-const defaultSdkVersion = "0.3.8";
+const supportedOfficialInitAdapters = [
+	"github",
+	"gitlab",
+	"azure-devops",
+	"bitbucket"
+];
+const defaultWorkflowActionRef = "somus/pipr@v0.4.0";
+const defaultGitLabImageRef = "ghcr.io/somus/pipr:v0.4.0";
+const defaultSdkVersion = "0.4.0";
 function resolveOfficialInitAdapters(adapters) {
-	if (adapters === void 0) return [...supportedOfficialInitAdapters];
+	if (adapters === void 0) return ["github"];
 	if (adapters.length === 0) return [];
 	const selected = /* @__PURE__ */ new Set();
 	for (const adapter of adapters) {
@@ -3562,7 +3595,7 @@ function resolveOfficialInitAdapters(adapters) {
 			if (adapters.length > 1) throw new Error("Adapter 'none' cannot be mixed with other init adapters.");
 			return [];
 		}
-		if (adapter !== "github") throw unsupportedAdapterError(adapter);
+		if (!supportedOfficialInitAdapters.includes(adapter)) throw unsupportedAdapterError(adapter);
 		selected.add(adapter);
 	}
 	return [...selected];
@@ -3633,8 +3666,66 @@ async function starterFiles(relativeConfigDir, adapters, recipe, minimal = false
 		relativePath: path.join(".github", "workflows", "pipr.yml"),
 		contents: starterWorkflow(relativeConfigDir.split(path.sep).join("/"), recipe, minimal)
 	});
+	if (adapters.includes("gitlab")) files.push({
+		relativePath: ".gitlab-ci.yml",
+		contents: starterGitLabPipeline(relativeConfigDir.split(path.sep).join("/"), recipe)
+	});
+	if (adapters.includes("azure-devops")) files.push({
+		relativePath: "azure-devops.pipr.env.example",
+		contents: starterAzureDevOpsWebhookEnvironment(recipe)
+	});
+	if (adapters.includes("bitbucket")) files.push({
+		relativePath: "bitbucket.pipr.env.example",
+		contents: starterBitbucketWebhookEnvironment(recipe)
+	});
 	return files;
 }
+function starterGitLabPipeline(relativeConfigDir, recipe) {
+	const lines = [
+		"pipr:",
+		"  image:",
+		`    name: ${defaultGitLabImageRef}`,
+		"    entrypoint: [\"\"]",
+		"  rules:",
+		"    - if: '$CI_PIPELINE_SOURCE == \"merge_request_event\"'",
+		"  variables:",
+		"    GIT_DEPTH: \"0\"",
+		"    PIPR_CODE_HOST: \"gitlab\"",
+		"  script:",
+		`    - pipr host-run --host gitlab --config-dir ${relativeConfigDir}`
+	];
+	for (const secret of officialInitRecipeWorkflowEnvSecrets(recipe)) lines.push(`    # Configure ${secret.env} as a masked GitLab CI/CD variable.`);
+	lines.push("");
+	return lines.join("\n");
+}
+function starterAzureDevOpsWebhookEnvironment(recipe) {
+	const lines = [
+		"# Copy these names into the trusted webhook runner's secret store.",
+		"AZURE_DEVOPS_ORGANIZATION=",
+		"AZURE_DEVOPS_PROJECT=",
+		"AZURE_DEVOPS_BEARER_TOKEN=",
+		"PIPR_AZURE_SUBSCRIPTION_ID=",
+		"PIPR_WEBHOOK_SECRET="
+	];
+	for (const secret of officialInitRecipeWorkflowEnvSecrets(recipe)) lines.push(`${secret.env}=`);
+	lines.push("");
+	return lines.join("\n");
+}
+function starterBitbucketWebhookEnvironment(recipe) {
+	const lines = [
+		"# Copy these names into the trusted webhook runner's secret store.",
+		"BITBUCKET_WORKSPACE=",
+		"BITBUCKET_REPO_SLUG=",
+		"BITBUCKET_EMAIL=",
+		"BITBUCKET_API_TOKEN=",
+		"BITBUCKET_PERMISSION_EMAIL=",
+		"BITBUCKET_PERMISSION_API_TOKEN=",
+		"PIPR_WEBHOOK_SECRET="
+	];
+	for (const secret of officialInitRecipeWorkflowEnvSecrets(recipe)) lines.push(`${secret.env}=`);
+	lines.push("");
+	return lines.join("\n");
+}
 function starterPackageJson() {
 	return `${JSON.stringify({
 		private: true,
@@ -3753,6 +3844,797 @@ function starterWorkflow(relativeConfigDir, recipe, minimal = false) {
 	return lines.join("\n");
 }
 //#endregion
+//#region src/shared/redaction.ts
+const secretLikeTokenPattern = /\b[A-Za-z0-9][A-Za-z0-9_.:/+=-]*(?:secret|token|api[_-]?key|apikey)[A-Za-z0-9_.:/+=-]{8,}\b/gi;
+function redactPotentialSecrets(value) {
+	return value.replace(secretLikeTokenPattern, "[redacted secret]");
+}
+//#endregion
+//#region src/hosts/http.ts
+var CodeHostHttpError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.name = "CodeHostHttpError";
+		this.status = status;
+	}
+};
+function createCodeHostHttpClient(options) {
+	const fetchRequest = options.fetch ?? fetch;
+	const sleep = options.sleep ?? ((milliseconds) => Bun.sleep(milliseconds));
+	const maxRetries = options.maxRetries ?? 2;
+	const requestTimeoutMilliseconds = options.requestTimeoutMilliseconds ?? 3e4;
+	const secrets = [...new Headers(options.headers).values()].flatMap((value) => [value, value.split(/\s+/).at(-1)].filter((candidate) => candidate !== void 0 && candidate.length >= 8));
+	let delayBeforeNextRequest = 0;
+	return { async json(path, schema, init = {}) {
+		if (delayBeforeNextRequest > 0) {
+			await sleep(delayBeforeNextRequest);
+			delayBeforeNextRequest = 0;
+		}
+		const method = init.method?.toUpperCase() ?? "GET";
+		for (let attempt = 0;; attempt += 1) {
+			const timeoutSignal = AbortSignal.timeout(requestTimeoutMilliseconds);
+			const response = await fetchRequest(new URL(path, options.baseUrl), {
+				...init,
+				headers: {
+					...Object.fromEntries(new Headers(options.headers)),
+					...Object.fromEntries(new Headers(init.headers))
+				},
+				signal: init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal
+			});
+			const retryAfter = retryAfterMilliseconds(response.headers.get("Retry-After"));
+			if (response.ok) {
+				delayBeforeNextRequest = retryAfter;
+				return schema.parse(await response.json());
+			}
+			if (shouldRetryCodeHostRequest({
+				method,
+				attempt,
+				maxRetries,
+				response,
+				retryStatuses: options.retryNonIdempotentStatuses
+			})) {
+				await sleep(retryAfter || 250 * 2 ** attempt);
+				continue;
+			}
+			const body = (await response.text()).slice(0, 1024);
+			throw new CodeHostHttpError(redact$1(`Code host request failed (${response.status} ${response.statusText}): ${body}`, secrets), response.status);
+		}
+	} };
+}
+function shouldRetryCodeHostRequest(options) {
+	return (options.method === "GET" || options.method === "HEAD" || options.retryStatuses?.includes(options.response.status) === true) && options.attempt < options.maxRetries && (options.response.status === 429 || options.response.status >= 500 || options.retryStatuses?.includes(options.response.status) === true);
+}
+function retryAfterMilliseconds(value) {
+	if (!value) return 0;
+	const seconds = Number(value);
+	if (Number.isFinite(seconds) && seconds >= 0) return seconds * 1e3;
+	const date = Date.parse(value);
+	return Number.isFinite(date) ? Math.max(0, date - Date.now()) : 0;
+}
+function redact$1(value, secrets) {
+	let redacted = value;
+	for (const secret of secrets) redacted = redacted.split(secret).join("***");
+	return redactPotentialSecrets(redacted);
+}
+//#endregion
+//#region src/hosts/azure-devops/coordinates.ts
+function azureOrganizationFromUrl(value) {
+	const url = new URL(value);
+	return url.hostname === "dev.azure.com" ? url.pathname.split("/").filter(Boolean)[0] : url.hostname.split(".")[0];
+}
+//#endregion
+//#region src/hosts/azure-devops/client.ts
+const identitySchema = z.looseObject({
+	displayName: z.string().optional(),
+	providerDisplayName: z.string().optional(),
+	uniqueName: z.string().optional(),
+	id: z.string().optional(),
+	properties: z.looseObject({ Account: z.looseObject({ $value: z.string().optional() }).optional() }).optional()
+}).transform((identity) => {
+	const displayName = identity.displayName ?? identity.providerDisplayName;
+	const uniqueName = identity.uniqueName ?? identity.properties?.Account?.$value;
+	return {
+		...identity,
+		...displayName ? { displayName } : {},
+		...uniqueName ? { uniqueName } : {}
+	};
+});
+const commitSchema = z.looseObject({ commitId: z.string().min(1) });
+const forkRepositorySchema = z.looseObject({ remoteUrl: z.string().min(1) });
+const pullRequestSchema$1 = z.looseObject({
+	pullRequestId: z.number().int().positive(),
+	isDraft: z.boolean().optional(),
+	title: z.string(),
+	description: z.string().nullish(),
+	url: z.string().optional(),
+	sourceRefName: z.string().min(1),
+	targetRefName: z.string().min(1),
+	createdBy: identitySchema.optional(),
+	lastMergeSourceCommit: commitSchema,
+	lastMergeTargetCommit: commitSchema,
+	forkSource: z.looseObject({ repository: forkRepositorySchema }).optional(),
+	repository: z.looseObject({
+		id: z.string().min(1),
+		name: z.string().min(1),
+		url: z.string().optional(),
+		project: z.looseObject({
+			id: z.string().min(1),
+			name: z.string().min(1)
+		})
+	})
+});
+const repositorySchema$1 = z.looseObject({
+	id: z.string().min(1),
+	name: z.string().min(1),
+	project: z.looseObject({
+		id: z.string().min(1),
+		name: z.string().min(1)
+	})
+});
+const iterationSchema = z.looseObject({
+	id: z.number().int().positive(),
+	sourceRefCommit: commitSchema
+});
+const iterationChangeSchema = z.looseObject({
+	changeTrackingId: z.number().int(),
+	changeType: z.string(),
+	item: z.looseObject({
+		path: z.string().min(1),
+		originalPath: z.string().min(1).optional()
+	})
+});
+const threadCommentSchema = z.looseObject({
+	id: z.union([z.number(), z.string()]).transform(String),
+	parentCommentId: z.number().int().optional(),
+	content: z.string().default(""),
+	author: identitySchema.optional(),
+	isDeleted: z.boolean().optional()
+});
+const pointSchema = z.looseObject({
+	line: z.number().int(),
+	offset: z.number().int()
+});
+const threadSchema = z.looseObject({
+	id: z.union([z.number(), z.string()]).transform(String),
+	status: z.string().optional(),
+	comments: z.array(threadCommentSchema).default([]),
+	threadContext: z.looseObject({
+		filePath: z.string().optional(),
+		leftFileStart: pointSchema.nullish(),
+		leftFileEnd: pointSchema.nullish(),
+		rightFileStart: pointSchema.nullish(),
+		rightFileEnd: pointSchema.nullish()
+	}).nullish(),
+	pullRequestThreadContext: z.looseObject({
+		changeTrackingId: z.number().int().optional(),
+		iterationContext: z.looseObject({
+			firstComparingIteration: z.number().int(),
+			secondComparingIteration: z.number().int()
+		}).optional()
+	}).nullish()
+});
+const statusSchema$1 = z.looseObject({ id: z.union([z.number(), z.string()]).transform(String) });
+const aclSchema = collectionSchema(z.looseObject({
+	inheritPermissions: z.boolean().default(true),
+	acesDictionary: z.record(z.string(), z.looseObject({
+		allow: z.number().int().default(0),
+		deny: z.number().int().default(0),
+		extendedInfo: z.looseObject({
+			effectiveAllow: z.number().int().default(0),
+			effectiveDeny: z.number().int().default(0)
+		}).optional()
+	}))
+}));
+function createAzureDevOpsClient(env = process.env, fetch = globalThis.fetch) {
+	const organization = env.AZURE_DEVOPS_ORGANIZATION ?? organizationFromCollectionUri$1(env.SYSTEM_COLLECTIONURI);
+	const project = env.AZURE_DEVOPS_PROJECT ?? env.SYSTEM_TEAMPROJECT;
+	const pat = env.AZURE_DEVOPS_TOKEN;
+	const bearerToken = env.AZURE_DEVOPS_BEARER_TOKEN ?? env.SYSTEM_ACCESSTOKEN;
+	if (!organization) throw new Error("AZURE_DEVOPS_ORGANIZATION is required for Azure DevOps API calls");
+	if (!project) throw new Error("AZURE_DEVOPS_PROJECT or SYSTEM_TEAMPROJECT is required for Azure DevOps API calls");
+	if (!pat && !bearerToken) throw new Error("AZURE_DEVOPS_TOKEN, AZURE_DEVOPS_BEARER_TOKEN, or SYSTEM_ACCESSTOKEN is required for Azure DevOps API calls");
+	const headers = pat ? { Authorization: `Basic ${Buffer.from(`:${pat}`).toString("base64")}` } : { Authorization: `Bearer ${bearerToken}` };
+	const api = createCodeHostHttpClient({
+		baseUrl: `https://dev.azure.com/${encodeURIComponent(organization)}/${encodeURIComponent(project)}/_apis/`,
+		headers,
+		fetch
+	});
+	const organizationApi = createCodeHostHttpClient({
+		baseUrl: `https://dev.azure.com/${encodeURIComponent(organization)}/_apis/`,
+		headers,
+		fetch
+	});
+	const identityApi = createCodeHostHttpClient({
+		baseUrl: `https://vssps.dev.azure.com/${encodeURIComponent(organization)}/_apis/`,
+		headers,
+		fetch
+	});
+	const pullRequestPath = (repositoryId, changeNumber) => `git/repositories/${encodeURIComponent(repositoryId)}/pullRequests/${changeNumber}`;
+	return {
+		organization,
+		project,
+		async currentUser() {
+			return (await organizationApi.json("connectionData?connectOptions=1&lastChangeId=-1&lastChangeId64=-1", z.looseObject({ authenticatedUser: identitySchema }))).authenticatedUser;
+		},
+		async getRepository(repository) {
+			const value = await api.json(withApiVersion(`git/repositories/${encodeURIComponent(repository)}`), repositorySchema$1);
+			return {
+				id: value.id,
+				name: value.name,
+				projectId: value.project.id,
+				project: value.project.name
+			};
+		},
+		async getRepositoryPermission(actor, projectId, repositoryId) {
+			const candidates = (await identityApi.json(`identities?searchFilter=General&filterValue=${encodeURIComponent(actor)}&queryMembership=ExpandedUp&api-version=7.1`, collectionSchema(z.looseObject({
+				descriptor: z.string().min(1),
+				isActive: z.boolean().optional(),
+				isContainer: z.boolean().optional(),
+				memberOf: z.array(z.union([z.string().min(1), z.looseObject({ descriptor: z.string().min(1) })])).default([])
+			})))).value.filter((identity) => identity.isActive !== false && identity.isContainer !== true);
+			if (candidates.length !== 1) return "none";
+			const identity = candidates[0];
+			if (!identity) return "none";
+			const descriptors = [identity.descriptor, ...identity.memberOf.map((group) => typeof group === "string" ? group : group.descriptor)];
+			const loadAcls = (token) => {
+				const query = new URLSearchParams({
+					token,
+					descriptors: descriptors.join(","),
+					includeExtendedInfo: "true",
+					recurse: "false",
+					"api-version": "7.1"
+				});
+				return organizationApi.json(`accesscontrollists/2e9eb7ed-3c0a-47d4-87c1-0ffdd275fd87?${query}`, aclSchema);
+			};
+			const [projectAcls, repositoryAcls] = await Promise.all([loadAcls(`repoV2/${projectId}`), loadAcls(`repoV2/${projectId}/${repositoryId}`)]);
+			return azurePermissionFromAcls(repositoryAcls.value.every((acl) => acl.inheritPermissions) ? [...projectAcls.value, ...repositoryAcls.value] : repositoryAcls.value);
+		},
+		getPullRequest: (repositoryId, changeNumber) => api.json(withApiVersion(pullRequestPath(repositoryId, changeNumber)), pullRequestSchema$1),
+		async listIterations(repositoryId, changeNumber) {
+			return (await api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/iterations`), collectionSchema(iterationSchema))).value.map((iteration) => ({
+				id: iteration.id,
+				headSha: iteration.sourceRefCommit.commitId
+			}));
+		},
+		async loadChange(options) {
+			if (options.organization !== organization || options.project !== project) throw new Error("Azure DevOps client coordinates do not match its configured organization and project");
+			const pullRequest = await this.getPullRequest(options.repositoryId, options.changeNumber);
+			const iterations = await this.listIterations(options.repositoryId, options.changeNumber);
+			const headSha = pullRequest.lastMergeSourceCommit.commitId;
+			const iteration = iterations.findLast((candidate) => candidate.headSha === headSha);
+			if (!iteration) throw new Error(`Azure DevOps has no pull request iteration for head ${headSha}`);
+			const sourceRef = branchName(pullRequest.sourceRefName);
+			const targetRef = branchName(pullRequest.targetRefName);
+			return {
+				repository: {
+					slug: `${organization}/${pullRequest.repository.project.name}/${pullRequest.repository.name}`,
+					url: repositoryWebUrl(organization, pullRequest.repository.project.name, pullRequest.repository.name)
+				},
+				coordinates: {
+					provider: "azure-devops",
+					organization,
+					project: pullRequest.repository.project.name,
+					projectId: pullRequest.repository.project.id,
+					repositoryId: pullRequest.repository.id
+				},
+				change: {
+					number: pullRequest.pullRequestId,
+					isDraft: pullRequest.isDraft,
+					title: pullRequest.title,
+					description: pullRequest.description ?? "",
+					url: `${repositoryWebUrl(organization, pullRequest.repository.project.name, pullRequest.repository.name)}/pullrequest/${pullRequest.pullRequestId}`,
+					author: pullRequest.createdBy?.uniqueName ? { login: pullRequest.createdBy.uniqueName } : void 0,
+					base: {
+						sha: pullRequest.lastMergeTargetCommit.commitId,
+						ref: targetRef
+					},
+					head: {
+						sha: headSha,
+						ref: sourceRef,
+						...pullRequest.forkSource?.repository.remoteUrl ? { url: pullRequest.forkSource.repository.remoteUrl } : {}
+					},
+					...pullRequest.forkSource ? { isFork: true } : {}
+				},
+				iterationId: iteration.id
+			};
+		},
+		async listIterationChanges(repositoryId, changeNumber, iterationId) {
+			const changes = [];
+			let skip = 0;
+			let top = 2e3;
+			for (;;) {
+				const path = `${pullRequestPath(repositoryId, changeNumber)}/iterations/${iterationId}/changes?compareTo=0&$skip=${skip}&$top=${top}`;
+				const page = await api.json(withApiVersion(path), z.looseObject({
+					changeEntries: z.array(iterationChangeSchema),
+					nextSkip: z.number().int().nonnegative().optional(),
+					nextTop: z.number().int().nonnegative().max(2e3).optional()
+				}));
+				changes.push(...page.changeEntries.map((change) => ({
+					changeTrackingId: change.changeTrackingId,
+					changeType: change.changeType,
+					path: trimLeadingSlash(change.item.path),
+					...change.item.originalPath ? { originalPath: trimLeadingSlash(change.item.originalPath) } : {}
+				})));
+				if (!page.nextSkip) return changes;
+				skip = page.nextSkip;
+				if (page.nextTop) top = page.nextTop;
+			}
+		},
+		async listThreads(repositoryId, changeNumber) {
+			return (await api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads`), collectionSchema(threadSchema))).value;
+		},
+		createThread: (repositoryId, changeNumber, body) => api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads`), threadSchema, jsonRequest$2("POST", body)),
+		updateComment: (repositoryId, changeNumber, threadId, commentId, content) => api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads/${encodeURIComponent(threadId)}/comments/${encodeURIComponent(commentId)}`), threadCommentSchema, jsonRequest$2("PATCH", { content })),
+		createThreadComment: (repositoryId, changeNumber, threadId, body) => api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads/${encodeURIComponent(threadId)}/comments`), threadCommentSchema, jsonRequest$2("POST", body)),
+		updateThreadStatus: (repositoryId, changeNumber, threadId, status) => api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads/${encodeURIComponent(threadId)}`), threadSchema, jsonRequest$2("PATCH", { status })),
+		async createStatus(repositoryId, changeNumber, body) {
+			return (await api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/statuses`), statusSchema$1, jsonRequest$2("POST", body))).id;
+		}
+	};
+}
+function azureDevOpsStatusState(state) {
+	switch (state) {
+		case "pending": return "pending";
+		case "success": return "succeeded";
+		case "failure": return "failed";
+		case "neutral": return "notApplicable";
+	}
+}
+function azureRepositoryPermission(bits) {
+	if ((bits & 2) === 0) return "none";
+	if ((bits & 8192) !== 0) return "admin";
+	if ((bits & 2048) !== 0) return "maintain";
+	if ((bits & 4) !== 0) return "write";
+	if ((bits & 16384) !== 0) return "triage";
+	return "read";
+}
+function azurePermissionFromAcls(acls) {
+	let allow = 0;
+	let deny = 0;
+	for (const acl of acls) for (const ace of Object.values(acl.acesDictionary)) {
+		allow |= ace.extendedInfo?.effectiveAllow ?? ace.allow;
+		deny |= ace.extendedInfo?.effectiveDeny ?? ace.deny;
+	}
+	return azureRepositoryPermission(allow & ~deny);
+}
+function collectionSchema(item) {
+	return z.looseObject({
+		count: z.number().int().nonnegative(),
+		value: z.array(item)
+	});
+}
+function withApiVersion(path) {
+	return `${path}${path.includes("?") ? "&" : "?"}api-version=7.1`;
+}
+function jsonRequest$2(method, body) {
+	return {
+		method,
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body)
+	};
+}
+function organizationFromCollectionUri$1(value) {
+	return value ? azureOrganizationFromUrl(value) : void 0;
+}
+function branchName(ref) {
+	return ref.replace(/^refs\/heads\//, "");
+}
+function repositoryWebUrl(organization, project, repository) {
+	return `https://dev.azure.com/${encodeURIComponent(organization)}/${encodeURIComponent(project)}/_git/${encodeURIComponent(repository)}`;
+}
+function trimLeadingSlash(value) {
+	return value.replace(/^\/+/, "");
+}
+//#endregion
+//#region src/hosts/bitbucket/schema.ts
+const bitbucketRepositorySchema = z.looseObject({
+	uuid: z.string().min(1),
+	name: z.string().min(1),
+	full_name: z.string().min(1),
+	slug: z.string().min(1).optional(),
+	links: z.looseObject({ html: z.looseObject({ href: z.string().url() }) })
+}).transform((repository) => ({
+	...repository,
+	slug: repository.slug ?? repository.full_name.split("/").at(-1) ?? repository.full_name
+}));
+//#endregion
+//#region src/hosts/bitbucket/client.ts
+const userSchema$1 = z.looseObject({
+	uuid: z.string().optional(),
+	nickname: z.string().optional(),
+	display_name: z.string().optional()
+});
+const endpointSchema = z.looseObject({
+	branch: z.looseObject({ name: z.string().min(1) }),
+	commit: z.looseObject({ hash: z.string().min(1) }),
+	repository: bitbucketRepositorySchema
+});
+const pullRequestSchema = z.looseObject({
+	id: z.number().int().positive(),
+	draft: z.boolean().optional(),
+	title: z.string(),
+	description: z.string().default(""),
+	author: userSchema$1.optional(),
+	source: endpointSchema,
+	destination: endpointSchema,
+	links: z.looseObject({ html: z.looseObject({ href: z.string().url() }) })
+});
+const inlineSchema = z.looseObject({
+	path: z.string().optional(),
+	from: z.number().int().nullable().optional(),
+	to: z.number().int().nullable().optional(),
+	start_from: z.number().int().nullable().optional(),
+	start_to: z.number().int().nullable().optional()
+});
+const commentSchema = z.looseObject({
+	id: z.union([z.number(), z.string()]).transform(String),
+	content: z.looseObject({ raw: z.string().default("") }),
+	user: userSchema$1.optional(),
+	parent: z.looseObject({ id: z.union([z.number(), z.string()]).transform(String) }).optional(),
+	inline: inlineSchema.optional(),
+	deleted: z.boolean().optional(),
+	resolution: z.looseObject({}).optional()
+});
+function createBitbucketClient(env = process.env, fetch = globalThis.fetch) {
+	const workspace = env.BITBUCKET_WORKSPACE;
+	const repository = env.BITBUCKET_REPO_SLUG;
+	const token = env.BITBUCKET_API_TOKEN;
+	const email = env.BITBUCKET_EMAIL;
+	if (!workspace) throw new Error("BITBUCKET_WORKSPACE is required for Bitbucket Cloud API calls");
+	if (!repository) throw new Error("BITBUCKET_REPO_SLUG is required for Bitbucket Cloud API calls");
+	if (!token || !email) throw new Error("BITBUCKET_EMAIL and BITBUCKET_API_TOKEN are required");
+	const authorization = `Basic ${Buffer.from(`${email}:${token}`).toString("base64")}`;
+	const repositoryApiPath = `/2.0/repositories/${encodeURIComponent(workspace)}/${encodeURIComponent(repository)}/`;
+	const api = createCodeHostHttpClient({
+		baseUrl: `https://api.bitbucket.org${repositoryApiPath}`,
+		headers: { Authorization: authorization },
+		fetch
+	});
+	const rootApi = createCodeHostHttpClient({
+		baseUrl: "https://api.bitbucket.org/2.0/",
+		headers: { Authorization: authorization },
+		fetch
+	});
+	const prPath = (id) => `pullrequests/${id}`;
+	return {
+		workspace,
+		repository,
+		async currentUser() {
+			const value = await rootApi.json("user", userSchema$1);
+			return {
+				uuid: value.uuid,
+				nickname: value.nickname,
+				displayName: value.display_name
+			};
+		},
+		async getRepository() {
+			const value = await api.json("", bitbucketRepositorySchema);
+			return {
+				uuid: value.uuid,
+				slug: value.slug,
+				fullName: value.full_name,
+				url: value.links.html.href
+			};
+		},
+		async getRepositoryPermission(actor, repositoryUuid) {
+			const permissionEmail = env.BITBUCKET_PERMISSION_EMAIL;
+			const permissionToken = env.BITBUCKET_PERMISSION_API_TOKEN;
+			if (!permissionEmail || !permissionToken) throw new Error("BITBUCKET_PERMISSION_EMAIL and BITBUCKET_PERMISSION_API_TOKEN are required for Bitbucket permission checks");
+			const permissionApi = createCodeHostHttpClient({
+				baseUrl: "https://api.bitbucket.org/2.0/",
+				headers: { Authorization: `Basic ${Buffer.from(`${permissionEmail}:${permissionToken}`).toString("base64")}` },
+				fetch
+			});
+			const query = encodeURIComponent(`repository.uuid="${escapeBitbucketQueryValue(repositoryUuid)}" AND user.nickname="${escapeBitbucketQueryValue(actor)}"`);
+			return (await permissionApi.json(`workspaces/${encodeURIComponent(workspace)}/permissions/repositories?q=${query}&pagelen=100`, pagedSchema(z.looseObject({
+				permission: z.enum([
+					"read",
+					"write",
+					"admin"
+				]),
+				user: userSchema$1
+			})))).values.find((entry) => entry.user.nickname === actor)?.permission ?? "none";
+		},
+		getPullRequest: (id) => api.json(prPath(id), pullRequestSchema),
+		async loadChange(options) {
+			if (options.workspace !== workspace || options.repository !== repository) throw new Error("Bitbucket client coordinates do not match the requested repository");
+			const pullRequest = await this.getPullRequest(options.changeNumber);
+			return {
+				repository: {
+					slug: pullRequest.destination.repository.full_name,
+					url: pullRequest.destination.repository.links.html.href
+				},
+				coordinates: {
+					provider: "bitbucket",
+					workspace,
+					repository,
+					repositoryUuid: pullRequest.destination.repository.uuid
+				},
+				change: {
+					number: pullRequest.id,
+					isDraft: pullRequest.draft,
+					title: pullRequest.title,
+					description: pullRequest.description,
+					url: pullRequest.links.html.href,
+					author: pullRequest.author?.nickname ? { login: pullRequest.author.nickname } : void 0,
+					base: {
+						sha: pullRequest.destination.commit.hash,
+						ref: pullRequest.destination.branch.name,
+						url: pullRequest.destination.repository.links.html.href
+					},
+					head: {
+						sha: pullRequest.source.commit.hash,
+						ref: pullRequest.source.branch.name,
+						url: pullRequest.source.repository.links.html.href
+					},
+					isFork: pullRequest.source.repository.uuid !== pullRequest.destination.repository.uuid
+				}
+			};
+		},
+		async listComments(id) {
+			return (await listAll(api, `${prPath(id)}/comments`, commentSchema, repositoryApiPath)).filter((comment) => !comment.deleted);
+		},
+		createComment: (id, body) => api.json(`${prPath(id)}/comments`, commentSchema, jsonRequest$1("POST", body)),
+		updateComment: (id, commentId, content) => api.json(`${prPath(id)}/comments/${encodeURIComponent(commentId)}`, commentSchema, jsonRequest$1("PUT", { content: { raw: content } })),
+		async replyToComment(id, commentId, content) {
+			const parentId = positiveCommentId(commentId);
+			return await api.json(`${prPath(id)}/comments`, commentSchema, jsonRequest$1("POST", {
+				content: { raw: content },
+				parent: { id: parentId }
+			}));
+		},
+		async resolveComment(id, commentId) {
+			positiveCommentId(commentId);
+			await api.json(`${prPath(id)}/comments/${encodeURIComponent(commentId)}/resolve`, z.unknown(), { method: "POST" });
+		},
+		async setStatus(sha, key, body) {
+			return (await api.json(`commit/${encodeURIComponent(sha)}/statuses/build`, z.looseObject({ key: z.string().default(key) }), jsonRequest$1("POST", {
+				...body,
+				key
+			}))).key;
+		}
+	};
+}
+function positiveCommentId(value) {
+	const id = Number(value);
+	if (!Number.isSafeInteger(id) || id <= 0) throw new Error("Bitbucket comment ID must be a positive integer");
+	return id;
+}
+function bitbucketStatusState(state) {
+	if (state === "pending") return "INPROGRESS";
+	if (state === "failure") return "FAILED";
+	if (state === "neutral") return "STOPPED";
+	return "SUCCESSFUL";
+}
+function escapeBitbucketQueryValue(value) {
+	return value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"");
+}
+function pagedSchema(item) {
+	return z.looseObject({
+		values: z.array(item),
+		next: z.string().url().optional()
+	});
+}
+async function listAll(api, path, schema, allowedPathPrefix) {
+	const values = [];
+	let next = path;
+	while (next) {
+		const page = await api.json(next, pagedSchema(schema));
+		values.push(...page.values);
+		if (page.next) {
+			const url = new URL(page.next);
+			if (url.origin !== "https://api.bitbucket.org" || !url.pathname.startsWith(allowedPathPrefix)) throw new Error("Bitbucket pagination URL must stay inside the configured repository API");
+		}
+		next = page.next;
+	}
+	return values;
+}
+function jsonRequest$1(method, body) {
+	return {
+		method,
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body)
+	};
+}
+//#endregion
+//#region src/hosts/gitlab/client.ts
+const userSchema = z.looseObject({
+	id: z.number().int().positive(),
+	username: z.string().min(1)
+});
+const noteSchema = z.looseObject({
+	id: z.union([z.number(), z.string()]).transform(String),
+	body: z.string(),
+	author: userSchema.optional()
+});
+const positionSchema = z.looseObject({
+	new_path: z.string().optional(),
+	old_path: z.string().optional(),
+	new_line: z.number().int().positive().nullish().transform((value) => value ?? void 0),
+	old_line: z.number().int().positive().nullish().transform((value) => value ?? void 0)
+});
+const discussionNoteSchema = noteSchema.extend({
+	resolvable: z.boolean().optional(),
+	resolved: z.boolean().optional(),
+	position: positionSchema.nullable().optional()
+});
+const discussionSchema = z.looseObject({
+	id: z.string().min(1),
+	individual_note: z.boolean().optional(),
+	notes: z.array(discussionNoteSchema)
+});
+const diffRefsSchema = z.looseObject({
+	base_sha: z.string().min(1),
+	start_sha: z.string().min(1),
+	head_sha: z.string().min(1)
+});
+const mergeRequestResponseSchema = z.looseObject({
+	iid: z.number().int().positive(),
+	title: z.string().default(""),
+	description: z.string().nullable().optional(),
+	web_url: z.string().url().optional(),
+	source_branch: z.string().min(1),
+	target_branch: z.string().min(1),
+	source_project_id: z.number().int().positive(),
+	target_project_id: z.number().int().positive(),
+	sha: z.string().min(1),
+	draft: z.boolean().optional(),
+	author: userSchema.optional(),
+	references: z.looseObject({ full: z.string().optional() }).optional(),
+	diff_refs: diffRefsSchema.nullable().optional()
+});
+const mergeRequestSchema = mergeRequestResponseSchema.extend({ diff_refs: diffRefsSchema });
+const memberSchema = z.looseObject({ access_level: z.number().int().min(0) });
+const statusSchema = z.looseObject({ id: z.union([z.number(), z.string()]).optional() });
+function createGitLabClient(env = process.env, fetch = globalThis.fetch, sleep = (milliseconds) => Bun.sleep(milliseconds)) {
+	const token = env.GITLAB_TOKEN ?? env.CI_JOB_TOKEN;
+	if (!token) throw new Error("GITLAB_TOKEN or CI_JOB_TOKEN is required for GitLab API calls");
+	const headers = env.GITLAB_TOKEN ? { "PRIVATE-TOKEN": token } : { "JOB-TOKEN": token };
+	const clientOptions = {
+		baseUrl: `${(env.CI_API_V4_URL ?? "https://gitlab.com/api/v4").replace(/\/$/, "")}/`,
+		headers,
+		fetch,
+		sleep: async (milliseconds) => void await sleep(milliseconds)
+	};
+	const api = createCodeHostHttpClient(clientOptions);
+	const statusApi = createCodeHostHttpClient({
+		...clientOptions,
+		retryNonIdempotentStatuses: [409]
+	});
+	return {
+		async getProject(project) {
+			const value = await api.json(`projects/${encodeURIComponent(project)}`, z.looseObject({
+				id: z.union([z.number(), z.string()]).transform(String),
+				path_with_namespace: z.string().min(1)
+			}));
+			return {
+				id: value.id,
+				path: value.path_with_namespace
+			};
+		},
+		currentUser: () => api.json("user", userSchema),
+		async loadChange(options) {
+			const mergeRequest = await this.getMergeRequest(options.projectId, options.changeNumber);
+			return {
+				repository: {
+					slug: options.projectPath,
+					url: projectWebUrl(mergeRequest.web_url)
+				},
+				coordinates: {
+					provider: "gitlab",
+					projectId: String(mergeRequest.target_project_id),
+					projectPath: options.projectPath
+				},
+				change: {
+					number: mergeRequest.iid,
+					title: mergeRequest.title,
+					description: mergeRequest.description ?? "",
+					url: mergeRequest.web_url,
+					author: mergeRequest.author ? { login: mergeRequest.author.username } : void 0,
+					base: {
+						sha: mergeRequest.diff_refs.start_sha,
+						ref: mergeRequest.target_branch
+					},
+					head: {
+						sha: mergeRequest.diff_refs.head_sha,
+						ref: mergeRequest.source_branch
+					},
+					isFork: mergeRequest.source_project_id !== mergeRequest.target_project_id,
+					isDraft: mergeRequest.draft
+				}
+			};
+		},
+		async getMergeRequest(projectId, changeNumber) {
+			const requestPath = `projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}`;
+			for (let attempt = 0;; attempt += 1) {
+				const response = await api.json(requestPath, mergeRequestResponseSchema);
+				const prepared = mergeRequestSchema.safeParse(response);
+				if (prepared.success) return prepared.data;
+				if (attempt >= 4) throw new Error("GitLab merge request diff refs were not prepared after 5 attempts");
+				await sleep(250 * 2 ** attempt);
+			}
+		},
+		async getRepositoryPermission(projectId, username) {
+			const user = (await api.json(`users?username=${encodeURIComponent(username)}`, z.array(userSchema))).find((candidate) => candidate.username === username);
+			if (!user) return "none";
+			try {
+				return accessLevelPermission((await api.json(`projects/${encodeURIComponent(projectId)}/members/all/${user.id}`, memberSchema)).access_level);
+			} catch (error) {
+				if (error instanceof CodeHostHttpError && error.status === 404) return "none";
+				throw error;
+			}
+		},
+		listNotes: (projectId, changeNumber) => paginated(api, `projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/notes`, noteSchema),
+		createNote: (projectId, changeNumber, body) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/notes`, noteSchema, jsonRequest("POST", { body })),
+		updateNote: (projectId, changeNumber, noteId, body) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/notes/${encodeURIComponent(noteId)}`, noteSchema, jsonRequest("PUT", { body })),
+		listDiscussions: (projectId, changeNumber) => paginated(api, `projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions`, discussionSchema),
+		getDiscussion: (projectId, changeNumber, discussionId) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions/${encodeURIComponent(discussionId)}`, discussionSchema),
+		async findReplyParent(projectId, changeNumber, noteId, discussionId) {
+			if (!discussionId) return void 0;
+			const discussion = await this.getDiscussion(projectId, changeNumber, discussionId);
+			if (!discussion.notes.some((note) => note.id === noteId) || discussion.notes[0]?.id === noteId) return;
+			return discussion.notes[0]?.id;
+		},
+		createDiscussion: (projectId, changeNumber, body, position) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions`, discussionSchema, jsonRequest("POST", {
+			body,
+			position
+		})),
+		replyDiscussion: (projectId, changeNumber, discussionId, body) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions/${encodeURIComponent(discussionId)}/notes`, noteSchema, jsonRequest("POST", { body })),
+		async resolveDiscussion(projectId, changeNumber, discussionId) {
+			await api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions/${encodeURIComponent(discussionId)}`, discussionSchema, jsonRequest("PUT", { resolved: true }));
+		},
+		async setStatus(projectId, sha, name, state, description) {
+			const status = await statusApi.json(`projects/${encodeURIComponent(projectId)}/statuses/${encodeURIComponent(sha)}`, statusSchema, jsonRequest("POST", {
+				state: gitLabStatusState(state),
+				name,
+				description: boundedStatusDescription(description)
+			}));
+			return String(status.id ?? name);
+		}
+	};
+}
+const MAX_PAGINATION_PAGES = 100;
+async function paginated(client, path, schema) {
+	const values = [];
+	for (let page = 1; page <= MAX_PAGINATION_PAGES; page += 1) {
+		const separator = path.includes("?") ? "&" : "?";
+		const batch = await client.json(`${path}${separator}per_page=100&page=${page}`, z.array(schema));
+		values.push(...batch);
+		if (batch.length < 100) return values;
+	}
+	throw new Error(`GitLab pagination exceeded ${MAX_PAGINATION_PAGES} pages for ${path}`);
+}
+function jsonRequest(method, body) {
+	return {
+		method,
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body)
+	};
+}
+function accessLevelPermission(level) {
+	if (level >= 50) return "admin";
+	if (level >= 40) return "maintain";
+	if (level >= 30) return "write";
+	if (level >= 15) return "triage";
+	if (level >= 10) return "read";
+	return "none";
+}
+function boundedStatusDescription(description) {
+	return description && description.length > 255 ? `${description.slice(0, 252).trimEnd()}...` : description;
+}
+function gitLabStatusState(state) {
+	switch (state) {
+		case "pending": return "pending";
+		case "success": return "success";
+		case "failure": return "failed";
+		case "neutral": return "skipped";
+	}
+}
+function projectWebUrl(mergeRequestUrl) {
+	return mergeRequestUrl?.replace(/\/-\/merge_requests\/\d+$/, "");
+}
+//#endregion
 //#region src/diff/git.ts
 function runGit$1(args, cwd, maxBuffer) {
 	const result = Bun.spawnSync(["git", ...args], {
@@ -4114,32 +4996,217 @@ function createLocalChangeRequestEvent(options) {
 	});
 }
 //#endregion
-//#region src/commands/grammar.ts
-const piprCommandPrefix = "@pipr";
-function firstNonEmptyLine(value) {
-	return value.split(/\r?\n/).map((line) => line.trim()).find((line) => line.length > 0);
+//#region src/diff/path-filter.ts
+const matcherOptions = {
+	dot: true,
+	nonegate: true,
+	windows: false
+};
+const compiledFilters = /* @__PURE__ */ new WeakMap();
+function filterDiffManifestByPaths(manifest, filter) {
+	if (!filter) return manifest;
+	return {
+		...manifest,
+		files: manifest.files.filter((file) => diffFileMatchesPathFilter(file, filter))
+	};
 }
-function isPiprCommandLine(line) {
-	return line === piprCommandPrefix || line.startsWith(`${piprCommandPrefix} `);
+function diffFileMatchesPathFilter(file, filter) {
+	if (!filter) return true;
+	const paths = [...new Set([file.path, file.previousPath].filter((item) => item !== void 0))].map((item) => item.replaceAll("\\", "/").replace(/^\.\/+/, ""));
+	const compiled = readCompiledFilter(filter);
+	const include = compiled.include;
+	const exclude = compiled.exclude;
+	const included = include ? paths.some((filePath) => include.some((pattern) => pattern.matches(pattern.matchBasename ? path.posix.basename(filePath) : filePath))) : true;
+	const excluded = exclude ? paths.some((filePath) => exclude.some((pattern) => pattern.matches(pattern.matchBasename ? path.posix.basename(filePath) : filePath))) : false;
+	return included && !excluded;
 }
-function parseCommandPattern(pattern, line) {
-	const patternParts = commandPatternParts(pattern);
-	const validationError = unsupportedCommandRestCaptureError(pattern);
-	if (validationError) return {
-		ok: false,
-		error: validationError
-	};
-	const lineTokens = tokenizeCommandPattern(line);
-	const captures = {};
-	let index = 0;
-	for (const part of patternParts) {
-		if (isOptionalCommandPatternPart(part)) {
-			const nextIndex = parseOptionalPatternPart(part.slice(1, -1), lineTokens, index, captures);
-			if (nextIndex !== void 0) index = nextIndex;
-			continue;
-		}
-		if (isCommandRestCaptureToken(part)) {
-			const value = lineTokens.slice(index).join(" ");
+function pathMatchesFilter(filePath, filter) {
+	if (!filter) return true;
+	const normalizedPath = filePath.replaceAll("\\", "/").replace(/^\.\/+/, "");
+	const compiled = readCompiledFilter(filter);
+	if (!(compiled.include ? compiled.include.some((pattern) => pattern.matches(pattern.matchBasename ? path.posix.basename(normalizedPath) : normalizedPath)) : true)) return false;
+	return compiled.exclude ? !compiled.exclude.some((pattern) => pattern.matches(pattern.matchBasename ? path.posix.basename(normalizedPath) : normalizedPath)) : true;
+}
+function readCompiledFilter(filter) {
+	const existing = compiledFilters.get(filter);
+	if (existing) return existing;
+	const compiled = {
+		include: filter.include?.map(compilePattern),
+		exclude: filter.exclude?.map(compilePattern)
+	};
+	compiledFilters.set(filter, compiled);
+	return compiled;
+}
+function compilePattern(pattern) {
+	return {
+		matches: picomatch(pattern, matcherOptions),
+		matchBasename: !pattern.includes("/")
+	};
+}
+//#endregion
+//#region src/diff/manifest-projection.ts
+const defaultDiffManifestPromptLimits = {
+	fullMaxBytes: 128 * 1024,
+	fullMaxEstimatedTokens: 32e3,
+	condensedMaxBytes: 256 * 1024,
+	condensedMaxEstimatedTokens: 64e3,
+	toolResponseMaxBytes: 64 * 1024
+};
+function projectDiffManifest(manifest, options) {
+	if (!manifestOptionsHaveEffect(options)) return manifest;
+	const manifestOptions = options ?? {};
+	const scopedManifest = filterDiffManifestByPaths(manifest, manifestOptions.paths);
+	return parseDiffManifest({
+		...scopedManifest,
+		files: scopedManifest.files.map((file) => ({
+			...withoutCompressedFileFields(file, manifestOptions.compressed === true),
+			commentableRanges: file.commentableRanges.map((range) => ({
+				...rangeFieldsForOptions(range, manifestOptions),
+				...manifestOptions.includePreviews === false ? {} : { preview: truncatePreview(range.preview, manifestOptions.maxPreviewLines) }
+			}))
+		}))
+	});
+}
+function cloneDiffManifest(manifest) {
+	return parseDiffManifest(structuredClone(manifest));
+}
+function prepareDiffManifestPrompt(manifest, config) {
+	const limits = resolveDiffManifestPromptLimits(config);
+	const full = measureDiffManifestPrompt(manifest);
+	if (fitsLimit(full, limits.fullMaxBytes, limits.fullMaxEstimatedTokens)) return {
+		mode: "full",
+		manifest,
+		metrics: {
+			full,
+			selected: full
+		},
+		limits
+	};
+	const condensedManifest = condenseDiffManifest(manifest);
+	const condensed = measureDiffManifestPrompt(condensedManifest);
+	if (!fitsLimit(condensed, limits.condensedMaxBytes, limits.condensedMaxEstimatedTokens)) throw new Error([
+		"Diff Manifest payload exceeds condensed limit before Pi execution",
+		`selected=${condensed.bytes} bytes/${condensed.estimatedTokens} estimated tokens`,
+		`limit=${limits.condensedMaxBytes} bytes/${limits.condensedMaxEstimatedTokens} estimated tokens`
+	].join("; "));
+	return {
+		mode: "condensed",
+		manifest: condensedManifest,
+		metrics: {
+			full,
+			selected: condensed
+		},
+		limits
+	};
+}
+function condenseDiffManifest(manifest) {
+	return {
+		baseSha: manifest.baseSha,
+		headSha: manifest.headSha,
+		mergeBaseSha: manifest.mergeBaseSha,
+		files: manifest.files.map(condenseDiffManifestFile)
+	};
+}
+function measureDiffManifestPrompt(manifest) {
+	const json = JSON.stringify(manifest, null, 2);
+	const bytes = Buffer.byteLength(json, "utf8");
+	return {
+		bytes,
+		estimatedTokens: Math.ceil(bytes / 4)
+	};
+}
+function resolveDiffManifestPromptLimits(config) {
+	return {
+		...defaultDiffManifestPromptLimits,
+		...Object.fromEntries(Object.entries(config ?? {}).filter((entry) => entry[1] !== void 0))
+	};
+}
+function manifestOptionsHaveEffect(options) {
+	return Boolean(options?.compressed || options?.includePreviews === false || options?.maxPreviewLines !== void 0 || options?.paths);
+}
+function withoutCompressedFileFields(file, compressed) {
+	if (!compressed) return file;
+	const { signals: _signals, changedSymbols: _changedSymbols, ...rest } = file;
+	return rest;
+}
+function withoutCompressedRangeFields(range, compressed) {
+	if (!compressed) return range;
+	const { summary: _summary, ...rest } = range;
+	return rest;
+}
+function rangeFieldsForOptions(range, options) {
+	const fields = withoutCompressedRangeFields(range, options.compressed === true);
+	if (options.includePreviews === false) {
+		const { preview: _preview, ...rest } = fields;
+		return rest;
+	}
+	return fields;
+}
+function truncatePreview(preview, maxLines) {
+	if (preview === void 0 || maxLines === void 0) return preview;
+	return preview.split("\n").slice(0, maxLines).join("\n");
+}
+function condenseDiffManifestFile(file) {
+	return {
+		path: file.path,
+		previousPath: file.previousPath,
+		status: file.status,
+		language: file.language,
+		additions: file.additions,
+		deletions: file.deletions,
+		hunks: file.hunks.map((hunk) => ({
+			hunkIndex: hunk.hunkIndex,
+			header: hunk.header,
+			oldStart: hunk.oldStart,
+			oldLines: hunk.oldLines,
+			newStart: hunk.newStart,
+			newLines: hunk.newLines,
+			contentHash: hunk.contentHash
+		})),
+		commentableRanges: file.commentableRanges.map((range) => ({
+			id: range.id,
+			path: range.path,
+			side: range.side,
+			startLine: range.startLine,
+			endLine: range.endLine,
+			kind: range.kind,
+			hunkIndex: range.hunkIndex,
+			hunkHeader: range.hunkHeader,
+			hunkContentHash: range.hunkContentHash
+		})),
+		excludedReason: file.excludedReason
+	};
+}
+function fitsLimit(metrics, maxBytes, maxEstimatedTokens) {
+	return metrics.bytes <= maxBytes && metrics.estimatedTokens <= maxEstimatedTokens;
+}
+//#endregion
+//#region src/commands/grammar.ts
+const piprCommandPrefix = "@pipr";
+function firstNonEmptyLine(value) {
+	return value.split(/\r?\n/).map((line) => line.trim()).find((line) => line.length > 0);
+}
+function isPiprCommandLine(line) {
+	return line === piprCommandPrefix || line.startsWith(`${piprCommandPrefix} `);
+}
+function parseCommandPattern(pattern, line) {
+	const patternParts = commandPatternParts(pattern);
+	const validationError = unsupportedCommandRestCaptureError(pattern);
+	if (validationError) return {
+		ok: false,
+		error: validationError
+	};
+	const lineTokens = tokenizeCommandPattern(line);
+	const captures = {};
+	let index = 0;
+	for (const part of patternParts) {
+		if (isOptionalCommandPatternPart(part)) {
+			const nextIndex = parseOptionalPatternPart(part.slice(1, -1), lineTokens, index, captures);
+			if (nextIndex !== void 0) index = nextIndex;
+			continue;
+		}
+		if (isCommandRestCaptureToken(part)) {
+			const value = lineTokens.slice(index).join(" ");
 			if (!value) return {
 				ok: false,
 				error: `Expected '${part}'`
@@ -4202,7 +5269,7 @@ function parsePatternToken(patternToken, lineTokens, index, captures) {
 	return lineTokens[index] === patternToken ? index + 1 : void 0;
 }
 //#endregion
-//#region src/action/entry-dispatch.ts
+//#region src/host-run/entry-dispatch.ts
 const permissionOrder = [
 	"read",
 	"triage",
@@ -4337,229 +5404,44 @@ function renderPlanCommandHelp(plan, reason) {
 	return lines.join("\n");
 }
 //#endregion
-//#region src/diff/path-filter.ts
-const matcherOptions = {
-	dot: true,
-	nonegate: true,
-	windows: false
-};
-const compiledFilters = /* @__PURE__ */ new WeakMap();
-function filterDiffManifestByPaths(manifest, filter) {
-	if (!filter) return manifest;
+//#region src/pi/runtime-tools.ts
+const piRuntimeReadToolNames = ["pipr_read_diff", "pipr_read_at_ref"];
+async function preparePiRuntimeReadTools(options) {
+	const toolRoot = path.join(options.root, "runtime-tools");
+	const baseRoot = path.join(toolRoot, "base");
+	await mkdir(baseRoot, { recursive: true });
+	const baseRanges = await materializeBaseRangeSnapshots({
+		baseRoot,
+		manifest: options.request.manifest,
+		sourceWorkspace: options.sourceWorkspace,
+		maxBytes: options.request.toolResponseMaxBytes
+	});
+	const data = {
+		manifest: options.request.manifest,
+		toolResponseMaxBytes: options.request.toolResponseMaxBytes,
+		baseRanges
+	};
+	const dataPath = path.join(toolRoot, "data.json");
+	await Bun.write(dataPath, JSON.stringify(data));
 	return {
-		...manifest,
-		files: manifest.files.filter((file) => diffFileMatchesPathFilter(file, filter))
+		extensionPath: await piRuntimeToolsExtensionPath(),
+		dataPath,
+		toolNames: piRuntimeReadToolNames
 	};
 }
-function diffFileMatchesPathFilter(file, filter) {
-	if (!filter) return true;
-	const paths = [...new Set([file.path, file.previousPath].filter((item) => item !== void 0))].map((item) => item.replaceAll("\\", "/").replace(/^\.\/+/, ""));
-	const compiled = readCompiledFilter(filter);
-	const include = compiled.include;
-	const exclude = compiled.exclude;
-	const included = include ? paths.some((filePath) => include.some((pattern) => pattern.matches(pattern.matchBasename ? path.posix.basename(filePath) : filePath))) : true;
-	const excluded = exclude ? paths.some((filePath) => exclude.some((pattern) => pattern.matches(pattern.matchBasename ? path.posix.basename(filePath) : filePath))) : false;
-	return included && !excluded;
+async function piRuntimeToolsExtensionPath() {
+	const moduleDir = path.dirname(fileURLToPath(import.meta.url));
+	const candidates = [
+		path.join(moduleDir, "pi", "runtime-tools-extension.mjs"),
+		path.join(moduleDir, "runtime-tools-extension.mjs"),
+		path.join(moduleDir, "..", "..", "dist", "pi", "runtime-tools-extension.mjs"),
+		path.join(moduleDir, "runtime-tools-extension.ts")
+	];
+	for (const candidate of candidates) if (await pathExists(candidate)) return candidate;
+	throw new Error("Unable to locate pipr runtime tools extension");
 }
-function pathMatchesFilter(filePath, filter) {
-	if (!filter) return true;
-	const normalizedPath = filePath.replaceAll("\\", "/").replace(/^\.\/+/, "");
-	const compiled = readCompiledFilter(filter);
-	if (!(compiled.include ? compiled.include.some((pattern) => pattern.matches(pattern.matchBasename ? path.posix.basename(normalizedPath) : normalizedPath)) : true)) return false;
-	return compiled.exclude ? !compiled.exclude.some((pattern) => pattern.matches(pattern.matchBasename ? path.posix.basename(normalizedPath) : normalizedPath)) : true;
-}
-function readCompiledFilter(filter) {
-	const existing = compiledFilters.get(filter);
-	if (existing) return existing;
-	const compiled = {
-		include: filter.include?.map(compilePattern),
-		exclude: filter.exclude?.map(compilePattern)
-	};
-	compiledFilters.set(filter, compiled);
-	return compiled;
-}
-function compilePattern(pattern) {
-	return {
-		matches: picomatch(pattern, matcherOptions),
-		matchBasename: !pattern.includes("/")
-	};
-}
-//#endregion
-//#region src/diff/manifest-projection.ts
-const defaultDiffManifestPromptLimits = {
-	fullMaxBytes: 128 * 1024,
-	fullMaxEstimatedTokens: 32e3,
-	condensedMaxBytes: 256 * 1024,
-	condensedMaxEstimatedTokens: 64e3,
-	toolResponseMaxBytes: 64 * 1024
-};
-function projectDiffManifest(manifest, options) {
-	if (!manifestOptionsHaveEffect(options)) return manifest;
-	const manifestOptions = options ?? {};
-	const scopedManifest = filterDiffManifestByPaths(manifest, manifestOptions.paths);
-	return parseDiffManifest({
-		...scopedManifest,
-		files: scopedManifest.files.map((file) => ({
-			...withoutCompressedFileFields(file, manifestOptions.compressed === true),
-			commentableRanges: file.commentableRanges.map((range) => ({
-				...rangeFieldsForOptions(range, manifestOptions),
-				...manifestOptions.includePreviews === false ? {} : { preview: truncatePreview(range.preview, manifestOptions.maxPreviewLines) }
-			}))
-		}))
-	});
-}
-function cloneDiffManifest(manifest) {
-	return parseDiffManifest(structuredClone(manifest));
-}
-function prepareDiffManifestPrompt(manifest, config) {
-	const limits = resolveDiffManifestPromptLimits(config);
-	const full = measureDiffManifestPrompt(manifest);
-	if (fitsLimit(full, limits.fullMaxBytes, limits.fullMaxEstimatedTokens)) return {
-		mode: "full",
-		manifest,
-		metrics: {
-			full,
-			selected: full
-		},
-		limits
-	};
-	const condensedManifest = condenseDiffManifest(manifest);
-	const condensed = measureDiffManifestPrompt(condensedManifest);
-	if (!fitsLimit(condensed, limits.condensedMaxBytes, limits.condensedMaxEstimatedTokens)) throw new Error([
-		"Diff Manifest payload exceeds condensed limit before Pi execution",
-		`selected=${condensed.bytes} bytes/${condensed.estimatedTokens} estimated tokens`,
-		`limit=${limits.condensedMaxBytes} bytes/${limits.condensedMaxEstimatedTokens} estimated tokens`
-	].join("; "));
-	return {
-		mode: "condensed",
-		manifest: condensedManifest,
-		metrics: {
-			full,
-			selected: condensed
-		},
-		limits
-	};
-}
-function condenseDiffManifest(manifest) {
-	return {
-		baseSha: manifest.baseSha,
-		headSha: manifest.headSha,
-		mergeBaseSha: manifest.mergeBaseSha,
-		files: manifest.files.map(condenseDiffManifestFile)
-	};
-}
-function measureDiffManifestPrompt(manifest) {
-	const json = JSON.stringify(manifest, null, 2);
-	const bytes = Buffer.byteLength(json, "utf8");
-	return {
-		bytes,
-		estimatedTokens: Math.ceil(bytes / 4)
-	};
-}
-function resolveDiffManifestPromptLimits(config) {
-	return {
-		...defaultDiffManifestPromptLimits,
-		...Object.fromEntries(Object.entries(config ?? {}).filter((entry) => entry[1] !== void 0))
-	};
-}
-function manifestOptionsHaveEffect(options) {
-	return Boolean(options?.compressed || options?.includePreviews === false || options?.maxPreviewLines !== void 0 || options?.paths);
-}
-function withoutCompressedFileFields(file, compressed) {
-	if (!compressed) return file;
-	const { signals: _signals, changedSymbols: _changedSymbols, ...rest } = file;
-	return rest;
-}
-function withoutCompressedRangeFields(range, compressed) {
-	if (!compressed) return range;
-	const { summary: _summary, ...rest } = range;
-	return rest;
-}
-function rangeFieldsForOptions(range, options) {
-	const fields = withoutCompressedRangeFields(range, options.compressed === true);
-	if (options.includePreviews === false) {
-		const { preview: _preview, ...rest } = fields;
-		return rest;
-	}
-	return fields;
-}
-function truncatePreview(preview, maxLines) {
-	if (preview === void 0 || maxLines === void 0) return preview;
-	return preview.split("\n").slice(0, maxLines).join("\n");
-}
-function condenseDiffManifestFile(file) {
-	return {
-		path: file.path,
-		previousPath: file.previousPath,
-		status: file.status,
-		language: file.language,
-		additions: file.additions,
-		deletions: file.deletions,
-		hunks: file.hunks.map((hunk) => ({
-			hunkIndex: hunk.hunkIndex,
-			header: hunk.header,
-			oldStart: hunk.oldStart,
-			oldLines: hunk.oldLines,
-			newStart: hunk.newStart,
-			newLines: hunk.newLines,
-			contentHash: hunk.contentHash
-		})),
-		commentableRanges: file.commentableRanges.map((range) => ({
-			id: range.id,
-			path: range.path,
-			side: range.side,
-			startLine: range.startLine,
-			endLine: range.endLine,
-			kind: range.kind,
-			hunkIndex: range.hunkIndex,
-			hunkHeader: range.hunkHeader,
-			hunkContentHash: range.hunkContentHash
-		})),
-		excludedReason: file.excludedReason
-	};
-}
-function fitsLimit(metrics, maxBytes, maxEstimatedTokens) {
-	return metrics.bytes <= maxBytes && metrics.estimatedTokens <= maxEstimatedTokens;
-}
-//#endregion
-//#region src/pi/runtime-tools.ts
-const piRuntimeReadToolNames = ["pipr_read_diff", "pipr_read_at_ref"];
-async function preparePiRuntimeReadTools(options) {
-	const toolRoot = path.join(options.root, "runtime-tools");
-	const baseRoot = path.join(toolRoot, "base");
-	await mkdir(baseRoot, { recursive: true });
-	const baseRanges = await materializeBaseRangeSnapshots({
-		baseRoot,
-		manifest: options.request.manifest,
-		sourceWorkspace: options.sourceWorkspace,
-		maxBytes: options.request.toolResponseMaxBytes
-	});
-	const data = {
-		manifest: options.request.manifest,
-		toolResponseMaxBytes: options.request.toolResponseMaxBytes,
-		baseRanges
-	};
-	const dataPath = path.join(toolRoot, "data.json");
-	await Bun.write(dataPath, JSON.stringify(data));
-	return {
-		extensionPath: await piRuntimeToolsExtensionPath(),
-		dataPath,
-		toolNames: piRuntimeReadToolNames
-	};
-}
-async function piRuntimeToolsExtensionPath() {
-	const moduleDir = path.dirname(fileURLToPath(import.meta.url));
-	const candidates = [
-		path.join(moduleDir, "pi", "runtime-tools-extension.mjs"),
-		path.join(moduleDir, "runtime-tools-extension.mjs"),
-		path.join(moduleDir, "..", "..", "dist", "pi", "runtime-tools-extension.mjs"),
-		path.join(moduleDir, "runtime-tools-extension.ts")
-	];
-	for (const candidate of candidates) if (await pathExists(candidate)) return candidate;
-	throw new Error("Unable to locate pipr runtime tools extension");
-}
-async function pathExists(filePath) {
-	return await Bun.file(filePath).exists();
+async function pathExists(filePath) {
+	return await Bun.file(filePath).exists();
 }
 async function materializeBaseRangeSnapshots(options) {
 	const ranges = {};
@@ -4752,7 +5634,27 @@ const ignoredWorkspacePaths = /* @__PURE__ */ new Set([
 	".fallow",
 	"coverage"
 ]);
-const eventRecordSchema = z.record(z.string(), z.unknown());
+const typedEventSchema = z.looseObject({ type: z.string() });
+const piJsonEventTypes = /* @__PURE__ */ new Set([
+	"agent_start",
+	"agent_end",
+	"auto_retry_start",
+	"auto_retry_end",
+	"compaction_start",
+	"compaction_end",
+	"message_start",
+	"message_update",
+	"message_end",
+	"queue_update",
+	"session",
+	"session_info_changed",
+	"thinking_level_changed",
+	"tool_execution_start",
+	"tool_execution_update",
+	"tool_execution_end",
+	"turn_start",
+	"turn_end"
+]);
 const tokenCountSchema = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
 const assistantMessageEventSchema = z.looseObject({
 	type: z.literal("message_end"),
@@ -4770,6 +5672,14 @@ const assistantUsageMessageSchema = z.looseObject({
 		cost: z.looseObject({ total: z.number().nonnegative() })
 	})
 });
+const defaultPiStreamLimits = {
+	maxJsonEventBytes: 16 * 1024 * 1024,
+	maxRawStdoutBytes: 16 * 1024 * 1024,
+	maxStderrBytes: 16 * 1024 * 1024
+};
+const maxRetainedModelCount = 64;
+const maxRetainedModelBytes = 64 * 1024;
+const processTerminationGraceMs = 250;
 async function runPi(options) {
 	const started = Date.now();
 	const sandbox = await createPiRunSandbox(options.workspace);
@@ -4786,19 +5696,13 @@ async function runPi(options) {
 		const promptPath = path.join(sandbox.root, "prompt.md");
 		await Bun.write(promptPath, options.prompt);
 		const args = buildPiArgs(options.provider, `@${promptPath}`, sandbox.sessionDir, preparedTools, options.builtinTools);
-		const result = await runProcess(options.piExecutable ?? "pi", args, {
+		return await runProcess(options.piExecutable ?? "pi", args, {
 			cwd: sandbox.workspace,
 			env: buildPiEnv(options.provider, sandbox, options.env, preparedTools),
 			started,
-			timeoutSeconds: options.timeoutSeconds
+			timeoutSeconds: options.timeoutSeconds,
+			streamLimits: options.streamLimits ?? defaultPiStreamLimits
 		});
-		const events = parsePiJsonEvents(result.stdout);
-		return {
-			...result,
-			...events?.models.length ? { models: events.models } : {},
-			...events?.usage ? { usage: events.usage } : {},
-			stdout: result.exitCode === 0 ? events?.assistantText ?? result.stdout : result.stdout
-		};
 	} finally {
 		await preparedTools?.custom?.close();
 		await chmodRecursive(sandbox.root, 493);
@@ -4920,69 +5824,195 @@ async function chmodRecursive(target, mode) {
 	const entries = await readdir(target, { withFileTypes: true });
 	for (const entry of entries) await chmodRecursive(path.join(target, entry.name), mode);
 }
-function parsePiJsonEvents(stdout) {
-	const events = [];
-	for (const line of stdout.split(/\r?\n/).map((item) => item.trim()).filter(Boolean)) try {
-		const value = JSON.parse(line);
-		const parsed = eventRecordSchema.safeParse(value);
-		if (!parsed.success) return;
-		events.push(parsed.data);
-	} catch {
-		return;
+var PiOutputCollector = class {
+	limits;
+	mode = "undetermined";
+	pending = "";
+	pendingBytes = 0;
+	rawOutput = "";
+	rawOutputBytes = 0;
+	failureReason;
+	assistantText;
+	models = [];
+	modelSet = /* @__PURE__ */ new Set();
+	modelBytes = 0;
+	assistantMessageCount = 0;
+	usageMessageCount = 0;
+	inputTokens = 0;
+	outputTokens = 0;
+	costUsd = 0;
+	usagePartial = false;
+	stream = {
+		rawStdoutBytes: 0,
+		jsonEventCount: 0,
+		largestEventBytes: 0,
+		peakBufferedBytes: 0
+	};
+	constructor(limits) {
+		this.limits = limits;
 	}
-	if (!events.some((event) => typeof event.type === "string")) return;
-	let assistantText;
-	for (const event of events) assistantText = assistantTextFromEvent(event) ?? assistantText;
-	const assistantMessages = assistantMessagesFromEvents(events);
-	const models = assistantModels(assistantMessages);
-	const usage = assistantUsage(assistantMessages);
-	return {
-		...assistantText !== void 0 ? { assistantText } : {},
-		models,
-		...usage ? { usage } : {}
-	};
-}
-function assistantMessagesFromEvents(events) {
-	return events.flatMap((event) => {
+	push(chunk) {
+		this.stream.rawStdoutBytes += Buffer$1.byteLength(chunk, "utf8");
+		if (this.failureReason) return this.failureReason;
+		let offset = 0;
+		while (offset < chunk.length && !this.failureReason) {
+			if (this.mode === "raw") {
+				this.appendRaw(chunk.slice(offset));
+				break;
+			}
+			const newline = chunk.indexOf("\n", offset);
+			const end = newline < 0 ? chunk.length : newline;
+			this.appendPending(chunk.slice(offset, end));
+			if (newline < 0 || this.failureReason) break;
+			this.consumePending(true);
+			offset = newline + 1;
+		}
+		return this.failureReason;
+	}
+	finish() {
+		if (!this.failureReason && this.pending.length > 0) this.consumePending(false);
+		if (this.failureReason) return {
+			stdout: "",
+			stream: this.stream
+		};
+		if (this.mode !== "json") return {
+			stdout: this.rawOutput,
+			stream: this.stream
+		};
+		return {
+			stdout: this.assistantText ?? "",
+			...this.models.length > 0 ? { models: this.models } : {},
+			...this.usageMessageCount > 0 ? { usage: this.usage() } : {},
+			stream: this.stream
+		};
+	}
+	failure() {
+		return this.failureReason;
+	}
+	appendPending(fragment) {
+		const fragmentBytes = Buffer$1.byteLength(fragment, "utf8");
+		const nextBytes = this.pendingBytes + fragmentBytes;
+		if (nextBytes > (this.mode === "json" ? this.limits.maxJsonEventBytes : Math.max(this.limits.maxJsonEventBytes, this.limits.maxRawStdoutBytes))) {
+			this.fail(this.mode === "json" ? "Pi JSON event exceeded the output limit" : "Pi stdout exceeded the output limit");
+			return;
+		}
+		this.pending += fragment;
+		this.pendingBytes = nextBytes;
+		this.recordPeak(this.pendingBytes);
+	}
+	consumePending(terminated) {
+		const source = `${this.pending}${terminated ? "\n" : ""}`;
+		const line = this.pending.trim();
+		const eventBytes = Buffer$1.byteLength(line, "utf8");
+		this.pending = "";
+		this.pendingBytes = 0;
+		if (!line) {
+			if (this.mode === "undetermined") this.appendRaw(source);
+			return;
+		}
+		const event = parsePiEvent(line);
+		if (this.mode === "undetermined") {
+			if (!event || !piJsonEventTypes.has(event.type)) {
+				this.mode = "raw";
+				this.appendRaw(source);
+				return;
+			}
+			this.mode = "json";
+			this.rawOutput = "";
+			this.rawOutputBytes = 0;
+		}
+		if (!event) {
+			this.fail("Pi JSON output was malformed");
+			return;
+		}
+		if (eventBytes > this.limits.maxJsonEventBytes) {
+			this.fail("Pi JSON event exceeded the output limit");
+			return;
+		}
+		this.stream.jsonEventCount += 1;
+		this.stream.largestEventBytes = Math.max(this.stream.largestEventBytes, eventBytes);
+		this.consumeEvent(event);
+	}
+	appendRaw(value) {
+		const valueBytes = Buffer$1.byteLength(value, "utf8");
+		const nextBytes = this.rawOutputBytes + valueBytes;
+		if (nextBytes > this.limits.maxRawStdoutBytes) {
+			this.fail("Pi raw stdout exceeded the output limit");
+			return;
+		}
+		this.rawOutput += value;
+		this.rawOutputBytes = nextBytes;
+		this.recordPeak(this.rawOutputBytes);
+	}
+	fail(reason) {
+		this.failureReason = reason;
+		this.pending = "";
+		this.pendingBytes = 0;
+		this.rawOutput = "";
+		this.rawOutputBytes = 0;
+		this.assistantText = void 0;
+		this.models.length = 0;
+		this.modelSet.clear();
+		this.modelBytes = 0;
+	}
+	consumeEvent(event) {
+		this.assistantText = assistantTextFromEvent(event) ?? this.assistantText;
 		const parsed = assistantMessageEventSchema.safeParse(event);
-		return parsed.success ? [parsed.data.message] : [];
-	});
-}
-function assistantModels(messages) {
-	const models = [];
-	for (const message of messages) {
+		if (!parsed.success) return;
+		const message = parsed.data.message;
+		this.assistantMessageCount += 1;
 		const model = message.responseModel ?? message.model;
-		if (model && !models.includes(model)) models.push(model);
+		if (model) {
+			this.addModel(model);
+			if (this.failureReason) return;
+		}
+		const usage = assistantUsageMessageSchema.safeParse(message);
+		if (!usage.success) return;
+		this.usageMessageCount += 1;
+		this.addUsage(usage.data);
 	}
-	return models;
-}
-function assistantUsage(messages) {
-	const usageMessages = messages.flatMap((message) => {
-		const parsed = assistantUsageMessageSchema.safeParse(message);
-		return parsed.success ? [parsed.data] : [];
-	});
-	if (usageMessages.length === 0) return;
-	let inputTokens = 0;
-	let outputTokens = 0;
-	let costUsd = 0;
-	let partial = usageMessages.length !== messages.length;
-	for (const message of usageMessages) {
-		const nextInputTokens = inputTokens + message.usage.input;
-		if (Number.isSafeInteger(nextInputTokens)) inputTokens = nextInputTokens;
-		else partial = true;
-		const nextOutputTokens = outputTokens + message.usage.output;
-		if (Number.isSafeInteger(nextOutputTokens)) outputTokens = nextOutputTokens;
-		else partial = true;
-		const nextCostUsd = costUsd + message.usage.cost.total;
-		if (Number.isFinite(nextCostUsd)) costUsd = nextCostUsd;
-		else partial = true;
+	addModel(model) {
+		if (this.modelSet.has(model)) return;
+		const modelBytes = Buffer$1.byteLength(model, "utf8");
+		if (this.modelSet.size >= maxRetainedModelCount || this.modelBytes + modelBytes > maxRetainedModelBytes) {
+			this.fail("Pi model metadata exceeded the output limit");
+			return;
+		}
+		this.modelSet.add(model);
+		this.models.push(model);
+		this.modelBytes += modelBytes;
+	}
+	addUsage(message) {
+		const nextInputTokens = this.inputTokens + message.usage.input;
+		if (Number.isSafeInteger(nextInputTokens)) this.inputTokens = nextInputTokens;
+		else this.usagePartial = true;
+		const nextOutputTokens = this.outputTokens + message.usage.output;
+		if (Number.isSafeInteger(nextOutputTokens)) this.outputTokens = nextOutputTokens;
+		else this.usagePartial = true;
+		const nextCostUsd = this.costUsd + message.usage.cost.total;
+		if (Number.isFinite(nextCostUsd)) this.costUsd = nextCostUsd;
+		else this.usagePartial = true;
+	}
+	usage() {
+		return {
+			status: this.usagePartial || this.usageMessageCount !== this.assistantMessageCount ? "partial" : "complete",
+			inputTokens: this.inputTokens,
+			outputTokens: this.outputTokens,
+			costUsd: this.costUsd
+		};
+	}
+	recordPeak(bytes) {
+		this.stream.peakBufferedBytes = Math.max(this.stream.peakBufferedBytes, bytes);
+	}
+};
+function parsePiEvent(line) {
+	try {
+		const parsed = typedEventSchema.safeParse(JSON.parse(line));
+		if (!parsed.success) return;
+		return parsed.data;
+	} catch {
+		return;
 	}
-	return {
-		status: partial ? "partial" : "complete",
-		inputTokens,
-		outputTokens,
-		costUsd
-	};
 }
 function assistantTextFromEvent(event) {
 	if (event.type === "message_end" || event.type === "turn_end") return assistantMessageText(event.message);
@@ -5012,7 +6042,9 @@ function textContent(content) {
 function runProcess(command, args, options) {
 	return new Promise((resolve, reject) => {
 		let timedOut = false;
+		let streamFailure;
 		let timeout;
+		let terminationTimeout;
 		const detached = process.platform !== "win32";
 		const child = spawn(command, args, {
 			cwd: options.cwd,
@@ -5024,34 +6056,85 @@ function runProcess(command, args, options) {
 				"pipe"
 			]
 		});
-		let stdout = "";
+		const stdout = new PiOutputCollector(options.streamLimits);
 		let stderr = "";
+		let stderrBytes = 0;
 		child.stdout.setEncoding("utf8");
 		child.stderr.setEncoding("utf8");
 		child.stdout.on("data", (chunk) => {
-			stdout += chunk;
+			const failure = stdout.push(chunk);
+			if (failure) failStream(failure);
 		});
 		child.stderr.on("data", (chunk) => {
+			if (streamFailure || timedOut) return;
+			const nextBytes = stderrBytes + Buffer$1.byteLength(chunk, "utf8");
+			if (nextBytes > options.streamLimits.maxStderrBytes) {
+				failStream("Pi stderr exceeded the output limit");
+				return;
+			}
 			stderr += chunk;
+			stderrBytes = nextBytes;
 		});
+		const failStream = (reason) => {
+			if (streamFailure || timedOut) return;
+			streamFailure = reason;
+			stderr = "";
+			stderrBytes = 0;
+			if (timeout) {
+				clearTimeout(timeout);
+				timeout = void 0;
+			}
+			terminateProcessGroup();
+		};
+		const terminateProcessGroup = () => {
+			killProcessGroup(child, "SIGTERM");
+			terminationTimeout ??= setTimeout(() => {
+				killProcessGroup(child, "SIGKILL");
+			}, processTerminationGraceMs);
+		};
 		if (options.timeoutSeconds !== void 0) timeout = setTimeout(() => {
 			timedOut = true;
-			killProcessGroup(child, "SIGTERM");
+			terminateProcessGroup();
 		}, options.timeoutSeconds * 1e3);
 		child.on("error", reject);
 		child.on("close", (exitCode) => {
 			if (timeout) clearTimeout(timeout);
-			if (timedOut) stderr += `${stderr ? "\n" : ""}Pi timed out after ${options.timeoutSeconds}s`;
-			resolve({
-				stdout,
+			resolve(finalizeProcessResult({
+				collector: stdout,
 				stderr,
-				exitCode: timedOut ? 124 : exitCode ?? 1,
+				exitCode,
+				timedOut,
+				streamFailure,
+				timeoutSeconds: options.timeoutSeconds,
 				durationMs: Date.now() - options.started
-			});
+			}));
 		});
 	});
 }
-function killProcessGroup(child, signal) {
+function finalizeProcessResult(options) {
+	const collected = options.collector.finish();
+	const streamFailure = options.streamFailure ?? options.collector.failure();
+	if (options.timedOut) return {
+		...collected,
+		stderr: `${options.stderr ? `${options.stderr}\n` : ""}Pi timed out after ${options.timeoutSeconds}s`,
+		exitCode: 124,
+		durationMs: options.durationMs
+	};
+	if (streamFailure) return {
+		stdout: "",
+		stderr: streamFailure,
+		exitCode: 1,
+		durationMs: options.durationMs,
+		...collected.stream ? { stream: collected.stream } : {}
+	};
+	return {
+		...collected,
+		stderr: options.stderr,
+		exitCode: options.exitCode ?? 1,
+		durationMs: options.durationMs
+	};
+}
+function killProcessGroup(child, signal) {
 	try {
 		if (process.platform !== "win32" && child.pid) {
 			process.kill(-child.pid, signal);
@@ -5063,19 +6146,13 @@ function killProcessGroup(child, signal) {
 	}
 }
 //#endregion
-//#region src/shared/redaction.ts
-const secretLikeTokenPattern = /\b[A-Za-z0-9][A-Za-z0-9_.:/+=-]*(?:secret|token|api[_-]?key|apikey)[A-Za-z0-9_.:/+=-]{8,}\b/gi;
-function redactPotentialSecrets(value) {
-	return value.replace(secretLikeTokenPattern, "[redacted secret]");
-}
-//#endregion
 //#region src/shared/logging.ts
 const sensitiveEnvNamePattern = /(TOKEN|SECRET|PASSWORD|PASS|KEY|AUTH|CREDENTIAL|COOKIE)/i;
-function createRuntimeActionLog(options) {
+function createRuntimeLog(options) {
 	const secrets = /* @__PURE__ */ new Set();
 	for (const [key, value] of Object.entries(options.env ?? process.env)) if (sensitiveEnvNamePattern.test(key)) addSecret(secrets, value);
 	const debugEnabled = (options.env ?? process.env).ACTIONS_STEP_DEBUG === "true" || (options.env ?? process.env).PIPR_LOG_LEVEL === "debug";
-	const sink = options.logSink ?? noopActionLogSink;
+	const sink = options.logSink ?? noopRuntimeLogSink;
 	return {
 		debugEnabled,
 		writesToSink: options.logSink !== void 0,
@@ -5152,7 +6229,7 @@ function emitRecord(sink, secrets, level, event, fields, text) {
 		text
 	});
 }
-const noopActionLogSink = {
+const noopRuntimeLogSink = {
 	log() {},
 	async group(_name, run) {
 		return await run();
@@ -5677,7 +6754,8 @@ function logPiResult(options, provider, result, timeoutSeconds) {
 		durationMs: result.durationMs,
 		stdoutBytes: result.stdout.length,
 		stderrBytes: result.stderr.length,
-		timeoutSeconds
+		timeoutSeconds,
+		...result.stream ?? {}
 	});
 }
 function builtinToolsForPrompt(toolMode) {
@@ -6085,6 +7163,7 @@ const inlinePublicationItemSchema = z.strictObject({
 	finding: reviewFindingSchema,
 	range: commentableRangeSchema,
 	path: z.string().min(1),
+	previousPath: z.string().min(1).optional(),
 	side: reviewSideSchema,
 	startLine: z.number().int().positive(),
 	endLine: z.number().int().positive(),
@@ -6119,7 +7198,7 @@ const threadActionSchema = z.strictObject({
 	kind: z.enum(["resolve", "reply"]),
 	findingId: findingIdSchema,
 	findingHeadSha: z.string().min(1),
-	commentId: z.number().int().positive(),
+	commentId: z.string().min(1),
 	threadId: z.string().min(1).optional(),
 	body: z.string().min(1),
 	responseKey: z.string().min(1)
@@ -6148,6 +7227,20 @@ const publicationPlanSchema = z.strictObject({
 	reviewState: priorReviewStateSchema,
 	threadActions: threadActionsSchema
 });
+function publicationPlanForHostCapabilities(plan, capabilities) {
+	return {
+		...plan,
+		inlineItems: plan.inlineItems.filter((item) => capabilities.multilineInlineComments || item.startLine === item.endLine).map((item) => {
+			if (capabilities.suggestedChanges || !item.finding.suggestedFix) return item;
+			const finding = withoutSuggestedFix(item.finding);
+			return {
+				...item,
+				finding,
+				body: renderInlineBody(finding, item.findingId, item.reviewedHeadSha)
+			};
+		})
+	};
+}
 function buildPublicationPlan(options) {
 	const reviewState = options.reviewState ?? buildPriorReviewState({
 		findings: options.inlineItems.map((item) => item.finding),
@@ -6180,19 +7273,21 @@ function buildPublicationPlan(options) {
 function preparePublishableInlineFindings(options) {
 	const ranges = createDiffRangeIndex(options.manifest);
 	return options.validated.validFindings.flatMap((finding) => {
-		const range = ranges.rangeById(finding.rangeId);
-		if (!range) throw new Error(`Validated finding range '${finding.rangeId}' is missing from Diff Manifest`);
+		const match = ranges.findRange(finding.rangeId);
+		if (!match) throw new Error(`Validated finding range '${finding.rangeId}' is missing from Diff Manifest`);
+		const { file, range } = match;
 		const findingWithBody = findingWithPublishableBody(finding);
 		if (!findingWithBody) return [];
 		return [{
 			finding: findingWithPublishableSuggestedFix(findingWithBody, range),
-			range
+			range,
+			previousPath: file.previousPath
 		}];
 	});
 }
 function prepareInlinePublicationItemsForPublishableFindings(options) {
 	const seenFindingIds = /* @__PURE__ */ new Set();
-	return inlinePublicationItemsSchema.parse(options.publishableFindings.flatMap(({ finding: publishableFinding, range }) => {
+	return inlinePublicationItemsSchema.parse(options.publishableFindings.flatMap(({ finding: publishableFinding, range, previousPath }) => {
 		const findingId = findingIdFor(publishableFinding, options.reviewState);
 		const stateRecord = options.reviewState ? matchFindingRecord(options.reviewState, publishableFinding) : void 0;
 		if (seenFindingIds.has(findingId) || stateRecord?.lastCommentedHeadSha === options.reviewedHeadSha) return [];
@@ -6202,6 +7297,7 @@ function prepareInlinePublicationItemsForPublishableFindings(options) {
 			finding: publishableFinding,
 			range,
 			path: publishableFinding.path,
+			previousPath,
 			side: publishableFinding.side,
 			startLine: publishableFinding.startLine,
 			endLine: publishableFinding.endLine,
@@ -6604,8 +7700,12 @@ function internalVerifierAgent(provider, config) {
 				"Do not repeat user-supplied text unless needed to explain the verdict.",
 				config.publication.autoResolve.instructions
 			].filter(Boolean).join("\n"),
-			prompt: (input) => JSON.stringify(input, null, 2),
+			prompt: (input) => {
+				const { manifest: _manifest, ...verifierPromptInput } = input;
+				return JSON.stringify(verifierPromptInput, null, 2);
+			},
 			tools: [],
+			timeout: "2m",
 			retry: {
 				invalidOutput: 1,
 				transientFailure: 0
@@ -7163,106 +8263,1101 @@ function createTaskContext(options) {
 		secret(secret) {
 			return resolveTaskSecret(secret, options);
 		},
-		pi: { async run(agent, input, runOptions) {
-			const result = await runReviewAgent({
-				agent,
-				input,
-				runOptions,
-				runtime: {
-					...options,
-					taskContext,
-					runId: options.runId,
-					piRunSink: options.piRunSink
-				}
-			});
-			options.output.providerModels.push(...result.providerModels);
-			if (result.repairAttempted) options.output.repairAttempted = true;
-			trackResultFindingScope(options.output, result.value, runOptions?.paths);
-			return agentOutputForTaskContext(agent, result.value);
-		} },
-		review: { async prior() {
-			return priorReviewForTask(options.priorMainComment, options.priorReviewState);
+		pi: { async run(agent, input, runOptions) {
+			const result = await runReviewAgent({
+				agent,
+				input,
+				runOptions,
+				runtime: {
+					...options,
+					taskContext,
+					runId: options.runId,
+					piRunSink: options.piRunSink
+				}
+			});
+			options.output.providerModels.push(...result.providerModels);
+			if (result.repairAttempted) options.output.repairAttempted = true;
+			trackResultFindingScope(options.output, result.value, runOptions?.paths);
+			return agentOutputForTaskContext(agent, result.value);
+		} },
+		review: { async prior() {
+			return priorReviewForTask(options.priorMainComment, options.priorReviewState);
+		} },
+		check: createCheckHandle(options.output),
+		async comment(value) {
+			collectComment(options.output, value, options.taskName);
+		},
+		log: options.taskLog ?? console
+	};
+	return taskContext;
+}
+function agentOutputForTaskContext(_agent, value) {
+	return value;
+}
+function resolveTaskSecret(secret, options) {
+	if (secret.kind !== "pipr.secret" || typeof secret.name !== "string") throw new Error("ctx.secret(...) requires a pipr.secret reference");
+	const value = (options.env ?? process.env)[secret.name];
+	if (!value) throw new Error(`Missing secret env var: ${secret.name}`);
+	options.log?.addSecret(value);
+	return value;
+}
+function commandResponseRuntimeResult(options) {
+	return {
+		kind: "command-response",
+		provider: options.provider,
+		diffManifest: options.diffManifest,
+		taskChecks: options.taskChecks,
+		repairAttempted: options.output.repairAttempted,
+		commandResponse: {
+			commandName: options.commandInvocation.name,
+			line: options.commandInvocation.line,
+			arguments: options.commandInvocation.arguments,
+			body: options.commandResponse.value
+		}
+	};
+}
+function skippedTaskRuntimeResult(options) {
+	const reason = options.reason ?? (options.taskName ? `Task '${options.taskName}' was not registered` : "No tasks matched the change request event");
+	const review = {
+		summary: { body: reason },
+		inlineFindings: []
+	};
+	const validated = {
+		review,
+		validFindings: [],
+		droppedFindings: []
+	};
+	const publicationPlan = buildCommentPublishingPlan({
+		event: options.event,
+		main: reason,
+		validated,
+		manifest: options.diffManifest,
+		maxInlineComments: options.config.publication.maxInlineComments,
+		showHeader: options.config.publication.showHeader,
+		showFooter: options.config.publication.showFooter,
+		showStats: options.config.publication.showStats,
+		metadata: {
+			runtimeVersion,
+			configVersion: options.versionCompatibility?.configVersion,
+			trustedConfigSha: options.trustedConfigSha,
+			trustedConfigHash: options.trustedConfigHash,
+			reviewedHeadSha: options.event.change.head.sha,
+			providerModels: [options.provider.model],
+			selectedTasks: [],
+			failedTasks: [],
+			validFindings: 0,
+			droppedFindings: 0
+		}
+	}).publicationPlan;
+	return {
+		kind: "skipped",
+		skipReason: reason,
+		provider: options.provider,
+		diffManifest: options.diffManifest,
+		review,
+		validated,
+		publicationPlan,
+		mainComment: publicationPlan.mainComment,
+		inlineCommentDrafts: [],
+		taskChecks: [],
+		repairAttempted: false
+	};
+}
+//#endregion
+//#region src/hosts/env.ts
+function requiredHostEnv(env, name, host) {
+	const value = env[name];
+	if (!value) throw new Error(`${name} is required for ${host} events`);
+	return value;
+}
+function positiveIntegerHostEnv(env, name, host) {
+	const value = Number(requiredHostEnv(env, name, host));
+	if (!Number.isInteger(value) || value <= 0) throw new Error(`${name} must be a positive integer`);
+	return value;
+}
+//#endregion
+//#region src/hosts/azure-devops/event.ts
+const repositorySchema = z.looseObject({
+	id: z.string().min(1),
+	name: z.string().min(1).optional(),
+	project: z.looseObject({
+		id: z.string().min(1),
+		name: z.string().min(1)
+	})
+});
+const serviceHookSchema = z.looseObject({
+	id: z.string().min(1),
+	eventType: z.string().min(1),
+	resource: z.unknown(),
+	resourceContainers: z.looseObject({
+		account: z.looseObject({ baseUrl: z.string().url() }),
+		project: z.looseObject({
+			id: z.string().min(1),
+			baseUrl: z.string().url()
+		}).optional()
+	})
+});
+const pullRequestResourceSchema = z.looseObject({
+	pullRequestId: z.number().int().positive(),
+	isDraft: z.boolean().optional(),
+	repository: repositorySchema
+});
+const commentResourceSchema = z.looseObject({
+	comment: z.looseObject({
+		id: z.union([z.number(), z.string()]).transform(String),
+		parentCommentId: z.number().int().nonnegative().default(0),
+		content: z.string(),
+		author: z.looseObject({ uniqueName: z.string().min(1) })
+	}),
+	pullRequest: pullRequestResourceSchema
+});
+async function parseAzureDevOpsEvent(options) {
+	return options.eventPath ? await serviceHookEvent(options) : await pipelineEvent$2(options);
+}
+async function pipelineEvent$2(options) {
+	const organization = organizationFromCollectionUri(requiredHostEnv(options.env, "SYSTEM_COLLECTIONURI", "Azure DevOps pipeline"));
+	const loaded = await loadChange$1(options, {
+		organization,
+		project: requiredHostEnv(options.env, "SYSTEM_TEAMPROJECT", "Azure DevOps pipeline"),
+		repositoryId: requiredHostEnv(options.env, "BUILD_REPOSITORY_ID", "Azure DevOps pipeline"),
+		changeNumber: positiveIntegerHostEnv(options.env, "SYSTEM_PULLREQUEST_PULLREQUESTID", "Azure DevOps pipeline")
+	});
+	if (loaded.change.isDraft) return draftEvent$1();
+	return changeRequestEvent(loaded, {
+		eventName: "azure_pipeline",
+		action: options.env.PIPR_CHANGE_ACTION ?? "updated",
+		rawAction: options.env.PIPR_CHANGE_ACTION,
+		host: `https://dev.azure.com/${organization}`,
+		workspace: options.workspace
+	});
+}
+async function serviceHookEvent(options) {
+	const payload = await Bun.file(options.eventPath ?? "").json();
+	const hook = serviceHookSchema.parse(payload);
+	const organization = organizationFromCollectionUri(hook.resourceContainers.account.baseUrl);
+	if (hook.eventType === "ms.vss-code.git-pullrequest-comment-event") {
+		const resource = commentResourceSchema.parse(hook.resource);
+		const repository = resource.pullRequest.repository;
+		const common = {
+			eventName: hook.eventType,
+			action: "created",
+			rawAction: hook.eventType,
+			repository: {
+				slug: `${organization}/${repository.project.name}/${repository.name ?? repository.id}`,
+				url: azureRepositoryUrl(organization, repository.project.name, repository.name ?? repository.id)
+			},
+			changeNumber: resource.pullRequest.pullRequestId,
+			commentId: resource.comment.id,
+			body: resource.comment.content,
+			actor: resource.comment.author.uniqueName,
+			workspace: options.workspace
+		};
+		return resource.comment.parentCommentId > 0 ? {
+			kind: "review-comment-reply",
+			reply: {
+				...common,
+				parentCommentId: String(resource.comment.parentCommentId)
+			}
+		} : {
+			kind: "command-comment",
+			comment: {
+				...common,
+				isChangeRequest: true
+			}
+		};
+	}
+	if (hook.eventType === "git.pullrequest.created" || hook.eventType === "git.pullrequest.updated") {
+		const resource = pullRequestResourceSchema.parse(hook.resource);
+		return pullRequestHookEvent(options, organization, hook.eventType, resource);
+	}
+	throw new Error(`Unsupported Azure DevOps event '${hook.eventType}'`);
+}
+async function pullRequestHookEvent(options, organization, eventType, resource) {
+	if (resource.isDraft) return draftEvent$1();
+	return changeRequestEvent(await loadChange$1(options, {
+		organization,
+		project: resource.repository.project.name,
+		repositoryId: resource.repository.id,
+		changeNumber: resource.pullRequestId
+	}), {
+		eventName: eventType,
+		action: eventType === "git.pullrequest.created" ? "opened" : "updated",
+		rawAction: eventType,
+		host: `https://dev.azure.com/${organization}`,
+		workspace: options.workspace
+	});
+}
+function draftEvent$1() {
+	return {
+		kind: "ignored",
+		reason: "pull request is a draft"
+	};
+}
+function changeRequestEvent(loaded, native) {
+	return {
+		kind: "change-request",
+		change: parseChangeRequestEventContext({
+			eventName: native.eventName,
+			action: native.action,
+			rawAction: native.rawAction,
+			platform: {
+				id: "azure-devops",
+				host: native.host
+			},
+			repository: loaded.repository,
+			coordinates: loaded.coordinates,
+			change: loaded.change,
+			workspace: native.workspace
+		})
+	};
+}
+async function loadChange$1(options, ref) {
+	if (!options.loadChangeRequest) throw new Error("Azure DevOps pull request events require an API-backed change loader");
+	return await options.loadChangeRequest(ref);
+}
+function organizationFromCollectionUri(value) {
+	const organization = azureOrganizationFromUrl(value);
+	if (!organization) throw new Error("Azure DevOps collection URI did not contain an organization");
+	return organization;
+}
+function azureRepositoryUrl(organization, project, repository) {
+	return `https://dev.azure.com/${encodeURIComponent(organization)}/${encodeURIComponent(project)}/_git/${encodeURIComponent(repository)}`;
+}
+//#endregion
+//#region src/review/publication-result.ts
+/** Error thrown when publication fails after producing partial result metadata. */
+var PublicationError = class extends Error {
+	result;
+	constructor(message, result) {
+		super(message);
+		this.result = result;
+	}
+};
+//#endregion
+//#region src/hosts/publication.ts
+async function publishUnseenInlineItems(options) {
+	const existing = new Set(extractInlineFindingMarkerRecords(options.existingBodies).map((record) => `${record.id}:${record.head}`));
+	const errors = [];
+	let posted = 0;
+	let skipped = 0;
+	for (const item of options.items) {
+		if (existing.has(`${item.findingId}:${item.reviewedHeadSha}`)) {
+			skipped += 1;
+			continue;
+		}
+		try {
+			await options.publish(item);
+			posted += 1;
+		} catch (error) {
+			errors.push(error instanceof Error ? error.message : String(error));
+		}
+	}
+	return {
+		posted,
+		skipped,
+		errors
+	};
+}
+function commandResponseBody(options) {
+	const marker = `<!-- pipr:command-response change=${options.changeNumber} source=${options.sourceCommentId} command=${options.commandName} -->`;
+	return {
+		marker,
+		body: [
+			marker,
+			"",
+			options.body,
+			""
+		].join("\n")
+	};
+}
+function completeHostPublication(options) {
+	const partial = {
+		inlineComments: {
+			posted: options.inline.posted,
+			skipped: options.inline.skipped,
+			failed: options.inline.errors.length
+		},
+		metadata: {
+			...options.metadata,
+			inlinePublicationErrors: options.inline.errors,
+			inlineResolutionErrors: options.resolutionErrors
+		}
+	};
+	if (options.inline.errors.length > 0) throw new PublicationError(`${options.provider} inline comment publication failed`, partial);
+	return {
+		mainComment: {
+			action: options.mainAction,
+			id: options.mainId
+		},
+		...partial
+	};
+}
+//#endregion
+//#region src/hosts/azure-devops/publication.ts
+async function publishAzureDevOpsPlan(options) {
+	const coordinates = azureCoordinates$1(options.change);
+	const native = await currentNativeChange(options.client, options.change);
+	const owner = await options.client.currentUser();
+	const threads = await options.client.listThreads(coordinates.repositoryId, options.change.change.number);
+	const existingMain = ownedRootThread(threads, owner.uniqueName, mainMarker$2(options.change.change.number));
+	const main = existingMain ? await options.client.updateComment(coordinates.repositoryId, options.change.change.number, existingMain.id, existingMain.comments[0]?.id ?? "", options.plan.mainComment) : (await options.client.createThread(coordinates.repositoryId, options.change.change.number, unpositionedThread(options.plan.mainComment))).comments[0];
+	if (!main) throw new Error("Azure DevOps did not return the Main Review Comment");
+	const markerBodies = ownedThreadComments(threads, owner.uniqueName).map((comment) => comment.content);
+	const changes = await options.client.listIterationChanges(coordinates.repositoryId, options.change.change.number, native.iterationId);
+	const inline = await publishUnseenInlineItems({
+		items: options.plan.inlineItems,
+		existingBodies: markerBodies,
+		publish: async (item) => {
+			await options.client.createThread(coordinates.repositoryId, options.change.change.number, await inlineThread(options.change, item, changes, native.iterationId));
+		}
+	});
+	const resolution = await publishAzureDevOpsThreadActions({
+		client: options.client,
+		change: options.change,
+		actions: options.plan.threadActions,
+		reviewedHeadSha: options.plan.metadata.reviewedHeadSha,
+		threads
+	});
+	return completeHostPublication({
+		provider: "Azure DevOps",
+		mainAction: existingMain ? "updated" : "created",
+		mainId: main.id,
+		inline,
+		resolutionErrors: resolution.errors,
+		metadata: options.plan.metadata
+	});
+}
+async function publishAzureDevOpsCommandResponse(options) {
+	const coordinates = azureCoordinates$1(options.change);
+	const response = commandResponseBody({
+		changeNumber: options.change.change.number,
+		sourceCommentId: options.sourceCommentId,
+		commandName: options.commandName,
+		body: options.body
+	});
+	await currentPullRequest(options.client, options.change);
+	const owner = await options.client.currentUser();
+	const existing = ownedRootThread(await options.client.listThreads(coordinates.repositoryId, options.change.change.number), owner.uniqueName, response.marker);
+	const comment = existing ? await options.client.updateComment(coordinates.repositoryId, options.change.change.number, existing.id, existing.comments[0]?.id ?? "", response.body) : (await options.client.createThread(coordinates.repositoryId, options.change.change.number, unpositionedThread(response.body))).comments[0];
+	if (!comment) throw new Error("Azure DevOps did not return the command response comment");
+	return {
+		action: existing ? "updated" : "created",
+		id: comment.id
+	};
+}
+async function loadAzureDevOpsPriorReviewState(options) {
+	const state = extractPriorReviewState(await loadAzureDevOpsPriorMainComment(options), options.change.change.number);
+	if (!state) return void 0;
+	const owner = await options.client.currentUser();
+	const bodies = ownedThreadComments(await options.client.listThreads(azureCoordinates$1(options.change).repositoryId, options.change.change.number), owner.uniqueName).map((comment) => comment.content);
+	return applyResolvedFindingMarkers(applyInlineFindingMarkers(state, bodies), bodies);
+}
+async function loadAzureDevOpsPriorMainComment(options) {
+	const owner = await options.client.currentUser();
+	return ownedRootThread(await options.client.listThreads(azureCoordinates$1(options.change).repositoryId, options.change.change.number), owner.uniqueName, mainMarker$2(options.change.change.number))?.comments[0]?.content;
+}
+async function loadAzureDevOpsInlineThreadContexts(options) {
+	const owner = await options.client.currentUser();
+	return (await options.client.listThreads(azureCoordinates$1(options.change).repositoryId, options.change.change.number)).flatMap((thread) => {
+		const root = thread.comments[0];
+		const marker = root ? extractInlineFindingMarkerRecords([root.content])[0] : void 0;
+		if (!root || !marker || root.author?.uniqueName !== owner.uniqueName) return [];
+		return [{
+			findingId: marker.id,
+			findingHeadSha: marker.head,
+			parentCommentId: root.id,
+			parentBody: root.content,
+			threadId: thread.id,
+			threadResolved: isResolved(thread),
+			comments: thread.comments.map((comment) => ({
+				id: comment.id,
+				body: comment.content,
+				authorLogin: comment.author?.uniqueName
+			}))
+		}];
+	});
+}
+async function publishAzureDevOpsThreadActions(options) {
+	if (options.actions.length === 0) return { errors: [] };
+	const coordinates = azureCoordinates$1(options.change);
+	await currentNativeChange(options.client, options.change, options.reviewedHeadSha);
+	const threads = options.threads ?? await options.client.listThreads(coordinates.repositoryId, options.change.change.number);
+	const byComment = new Map(threads.flatMap((thread) => thread.comments.map((comment) => [comment.id, thread])));
+	const errors = [];
+	for (const action of options.actions) {
+		const thread = action.threadId ? threads.find((candidate) => candidate.id === action.threadId) : byComment.get(action.commentId);
+		const error = await publishAzureDevOpsThreadAction({
+			client: options.client,
+			repositoryId: coordinates.repositoryId,
+			changeNumber: options.change.change.number,
+			action,
+			thread
+		});
+		if (error) errors.push(error);
+	}
+	return { errors };
+}
+async function publishAzureDevOpsThreadAction(options) {
+	if (!options.thread) return `Azure DevOps thread not found for comment ${options.action.commentId}`;
+	try {
+		if (!options.thread.comments.some((comment) => comment.content.includes(options.action.responseKey))) await options.client.createThreadComment(options.repositoryId, options.changeNumber, options.thread.id, {
+			parentCommentId: Number(options.thread.comments[0]?.id ?? 0),
+			content: options.action.body,
+			commentType: 1
+		});
+		if (options.action.kind === "resolve" && !isResolved(options.thread)) await options.client.updateThreadStatus(options.repositoryId, options.changeNumber, options.thread.id, "fixed");
+	} catch (error) {
+		return error instanceof Error ? error.message : String(error);
+	}
+}
+async function inlineThread(change, item, changes, iterationId) {
+	const selectedPath = item.side === "LEFT" ? item.previousPath ?? item.path : item.path;
+	const nativeChange = changes.find((candidate) => {
+		if (!(candidate.path === selectedPath || candidate.originalPath === selectedPath)) return false;
+		const changeType = candidate.changeType.toLowerCase();
+		return item.side === "LEFT" ? changeType !== "add" : changeType !== "delete";
+	});
+	if (!nativeChange) throw new Error(`Azure DevOps changeTrackingId not found for ${selectedPath}`);
+	const start = {
+		line: item.startLine,
+		offset: 1
+	};
+	const end = {
+		line: item.endLine,
+		offset: await lineEndOffset(change, selectedPath, item.endLine, item.side)
+	};
+	return {
+		comments: [{
+			parentCommentId: 0,
+			content: item.body,
+			commentType: 1
+		}],
+		status: "active",
+		threadContext: {
+			filePath: `/${selectedPath.replace(/^\/+/, "")}`,
+			...item.side === "RIGHT" ? {
+				rightFileStart: start,
+				rightFileEnd: end
+			} : {
+				leftFileStart: start,
+				leftFileEnd: end
+			}
+		},
+		pullRequestThreadContext: {
+			changeTrackingId: nativeChange.changeTrackingId,
+			iterationContext: {
+				firstComparingIteration: 1,
+				secondComparingIteration: iterationId
+			}
+		}
+	};
+}
+async function lineEndOffset(change, filePath, line, side) {
+	const root = path.resolve(change.workspace);
+	const sha = side === "RIGHT" ? change.change.head.sha : change.change.base.sha;
+	try {
+		const result = Bun.spawnSync([
+			"git",
+			"show",
+			`${sha}:${filePath}`
+		], { cwd: root });
+		if (result.exitCode !== 0) return 1;
+		const content = result.stdout.toString().split(/\r?\n/)[line - 1];
+		return content === void 0 ? 1 : content.length + 1;
+	} catch {
+		return 1;
+	}
+}
+async function currentNativeChange(client, change, reviewedHeadSha = change.change.head.sha) {
+	const pullRequest = await currentPullRequest(client, change, reviewedHeadSha);
+	const coordinates = azureCoordinates$1(change);
+	const iteration = (await client.listIterations(coordinates.repositoryId, change.change.number)).findLast((candidate) => candidate.headSha === reviewedHeadSha);
+	if (!iteration) throw new Error(`Azure DevOps has no pull request iteration for head ${reviewedHeadSha}`);
+	return {
+		pullRequest,
+		iterationId: iteration.id
+	};
+}
+async function currentPullRequest(client, change, reviewedHeadSha = change.change.head.sha) {
+	const coordinates = azureCoordinates$1(change);
+	const pullRequest = await client.getPullRequest(coordinates.repositoryId, change.change.number);
+	if (pullRequest.lastMergeSourceCommit.commitId !== reviewedHeadSha) throw new Error(`Azure DevOps pull request head changed from ${reviewedHeadSha} to ${pullRequest.lastMergeSourceCommit.commitId}`);
+	if (pullRequest.lastMergeTargetCommit.commitId !== change.change.base.sha) throw new Error(`Azure DevOps pull request base changed from ${change.change.base.sha} to ${pullRequest.lastMergeTargetCommit.commitId}`);
+	return pullRequest;
+}
+function azureCoordinates$1(change) {
+	if (change.coordinates?.provider !== "azure-devops") throw new Error("Azure DevOps adapter requires Azure DevOps coordinates");
+	return change.coordinates;
+}
+function ownedRootThread(threads, uniqueName, marker) {
+	return threads.find((thread) => {
+		const root = thread.comments[0];
+		return !thread.threadContext?.filePath && root?.author?.uniqueName === uniqueName && root.content.trimStart().startsWith(marker);
+	});
+}
+function ownedThreadComments(threads, uniqueName) {
+	return threads.flatMap((thread) => thread.comments.filter((comment) => comment.author?.uniqueName === uniqueName));
+}
+function unpositionedThread(content) {
+	return {
+		comments: [{
+			parentCommentId: 0,
+			content,
+			commentType: 1
+		}],
+		status: "active"
+	};
+}
+function isResolved(thread) {
+	return thread.status === "fixed" || thread.status === "closed" || thread.status === "wontFix" || thread.status === "byDesign";
+}
+function mainMarker$2(changeNumber) {
+	return `<!-- pipr:main-comment change=${changeNumber} `;
+}
+//#endregion
+//#region src/hosts/git.ts
+async function ensureCodeHostHeadCheckout(options) {
+	if (!await hasGitCommit(options.rootDir, options.headSha)) {
+		const remote = options.fetchRemote ?? "origin";
+		try {
+			await fetchGit(options.rootDir, remote, options.headSha, options.fetchEnv);
+		} catch {
+			await fetchGit(options.rootDir, remote, options.fetchRef, options.fetchEnv);
+		}
+		if (!await hasGitCommit(options.rootDir, options.headSha)) throw new Error(`Code host did not provide reviewed commit ${options.headSha} from ${options.fetchRef}`);
+	}
+	if ((await runGit(options.rootDir, ["rev-parse", "HEAD"])).trim() !== options.headSha) await runGit(options.rootDir, [
+		"checkout",
+		"--detach",
+		options.headSha
+	]);
+}
+async function fetchGit(rootDir, remote, ref, env) {
+	await runGit(rootDir, [
+		"fetch",
+		"--no-tags",
+		"--depth=1",
+		remote,
+		ref
+	], env);
+}
+async function hasGitCommit(rootDir, sha) {
+	try {
+		await runGit(rootDir, [
+			"cat-file",
+			"-e",
+			`${sha}^{commit}`
+		]);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function runGit(rootDir, args, env) {
+	const child = Bun.spawn(["git", ...args], {
+		cwd: rootDir,
+		env: {
+			...process.env,
+			...env
+		},
+		stderr: "pipe",
+		stdout: "pipe"
+	});
+	const [exitCode, stdout, stderr] = await Promise.all([
+		child.exited,
+		new Response(child.stdout).text(),
+		new Response(child.stderr).text()
+	]);
+	if (exitCode !== 0) throw new Error(stderr.trim() || `git ${args.join(" ")} failed`);
+	return stdout;
+}
+//#endregion
+//#region src/hosts/azure-devops/workspace.ts
+function ensureAzureDevOpsHeadCheckout(options) {
+	const headRef = options.change.change.head.ref;
+	if (!headRef) throw new Error("Azure DevOps pull request source ref is required for checkout");
+	return ensureCodeHostHeadCheckout({
+		rootDir: options.rootDir,
+		headSha: options.change.change.head.sha,
+		fetchRef: headRef.startsWith("refs/") ? headRef : `refs/heads/${headRef}`,
+		fetchRemote: options.change.change.isFork ? options.change.change.head.url : void 0
+	});
+}
+//#endregion
+//#region src/hosts/azure-devops/adapter.ts
+function createAzureDevOpsHostAdapter(options = {}) {
+	const client = options.client ?? createAzureDevOpsClient(options.env);
+	return {
+		id: "azure-devops",
+		capabilities: {
+			commandComments: true,
+			reviewCommentReplies: true,
+			threadResolution: true,
+			multilineInlineComments: true,
+			suggestedChanges: true,
+			statuses: true
+		},
+		events: {
+			parseEvent(parseOptions) {
+				return parseAzureDevOpsEvent({
+					...parseOptions,
+					loadChangeRequest: (ref) => client.loadChange(ref)
+				});
+			},
+			loadChangeRequest(ref) {
+				const coordinates = azureCoordinatesFromRepository(client, ref.repository.slug);
+				return client.loadChange({
+					...coordinates,
+					changeNumber: ref.changeNumber
+				}).then((loaded) => ({
+					...loaded,
+					eventName: ref.eventName,
+					action: ref.action,
+					rawAction: ref.rawAction,
+					workspace: ref.workspace
+				}));
+			}
+		},
+		workspace: { ensureHeadCheckout: ensureAzureDevOpsHeadCheckout },
+		permissions: { getRepositoryPermission({ change, actor }) {
+			const coordinates = azureCoordinates(change);
+			if (!coordinates.projectId) throw new Error("Azure DevOps projectId is required for permission checks");
+			return client.getRepositoryPermission(actor, coordinates.projectId, coordinates.repositoryId);
 		} },
-		check: createCheckHandle(options.output),
-		async comment(value) {
-			collectComment(options.output, value, options.taskName);
+		publication: {
+			publish: ({ plan, change }) => publishAzureDevOpsPlan({
+				client,
+				plan,
+				change
+			}),
+			publishCommandResponse: (args) => publishAzureDevOpsCommandResponse({
+				client,
+				...args
+			}),
+			publishThreadActions: (args) => publishAzureDevOpsThreadActions({
+				client,
+				...args
+			})
 		},
-		log: options.taskLog ?? console
+		comments: {
+			loadPriorReviewState: ({ change }) => loadAzureDevOpsPriorReviewState({
+				client,
+				change
+			}),
+			loadPriorMainComment: ({ change }) => loadAzureDevOpsPriorMainComment({
+				client,
+				change
+			}),
+			loadInlineThreadContexts: ({ change }) => loadAzureDevOpsInlineThreadContexts({
+				client,
+				change
+			})
+		},
+		statuses: {
+			isAvailable: () => true,
+			async upsert({ change, name, state, summary, status }) {
+				const coordinates = azureCoordinates(change);
+				const pullRequest = await client.getPullRequest(coordinates.repositoryId, change.change.number);
+				if (pullRequest.lastMergeSourceCommit.commitId !== change.change.head.sha || pullRequest.lastMergeTargetCommit.commitId !== change.change.base.sha) throw new Error("Azure DevOps pull request endpoints changed before status publication");
+				const iteration = (await client.listIterations(coordinates.repositoryId, change.change.number)).findLast((candidate) => candidate.headSha === change.change.head.sha);
+				if (!iteration) throw new Error(`Azure DevOps has no pull request iteration for head ${change.change.head.sha}`);
+				const id = await client.createStatus(coordinates.repositoryId, change.change.number, {
+					state: azureDevOpsStatusState(state),
+					description: summary?.slice(0, 1e3),
+					context: {
+						genre: "pipr",
+						name: `pipr/${name}`
+					},
+					iterationId: iteration.id
+				});
+				return status ?? {
+					id,
+					name
+				};
+			}
+		}
 	};
-	return taskContext;
 }
-function agentOutputForTaskContext(_agent, value) {
-	return value;
+function azureCoordinates(change) {
+	if (change.coordinates?.provider !== "azure-devops") throw new Error("Azure DevOps adapter requires Azure DevOps coordinates");
+	return change.coordinates;
 }
-function resolveTaskSecret(secret, options) {
-	if (secret.kind !== "pipr.secret" || typeof secret.name !== "string") throw new Error("ctx.secret(...) requires a pipr.secret reference");
-	const value = (options.env ?? process.env)[secret.name];
-	if (!value) throw new Error(`Missing secret env var: ${secret.name}`);
-	options.log?.addSecret(value);
-	return value;
+function azureCoordinatesFromRepository(client, slug) {
+	const repositoryId = slug.split("/").at(-1);
+	if (!repositoryId) throw new Error("Azure DevOps repository slug must identify a repository");
+	return {
+		organization: client.organization,
+		project: client.project,
+		repositoryId
+	};
 }
-function commandResponseRuntimeResult(options) {
+//#endregion
+//#region src/hosts/bitbucket/event.ts
+const webhookSchema = z.looseObject({
+	actor: z.looseObject({ nickname: z.string().min(1) }),
+	repository: bitbucketRepositorySchema,
+	pullrequest: z.looseObject({
+		id: z.number().int().positive(),
+		draft: z.boolean().optional()
+	}),
+	comment: z.looseObject({
+		id: z.union([z.number(), z.string()]).transform(String),
+		content: z.looseObject({ raw: z.string().default("") }),
+		parent: z.looseObject({ id: z.union([z.number(), z.string()]).transform(String) }).optional(),
+		inline: z.unknown().optional()
+	}).optional()
+});
+async function parseBitbucketEvent(options) {
+	return options.eventPath ? await webhookEvent(options) : await pipelineEvent$1(options);
+}
+async function pipelineEvent$1(options) {
+	const workspace = requiredHostEnv(options.env, "BITBUCKET_WORKSPACE", "Bitbucket");
+	const repository = requiredHostEnv(options.env, "BITBUCKET_REPO_SLUG", "Bitbucket");
+	const changeNumber = positiveIntegerHostEnv(options.env, "BITBUCKET_PR_ID", "Bitbucket");
+	const loaded = await options.loadChangeRequest({
+		workspace,
+		repository,
+		changeNumber
+	});
+	if (loaded.change.isDraft) return draftEvent();
 	return {
-		kind: "command-response",
-		provider: options.provider,
-		diffManifest: options.diffManifest,
-		taskChecks: options.taskChecks,
-		repairAttempted: options.output.repairAttempted,
-		commandResponse: {
-			commandName: options.commandInvocation.name,
-			line: options.commandInvocation.line,
-			arguments: options.commandInvocation.arguments,
-			body: options.commandResponse.value
+		kind: "change-request",
+		change: {
+			eventName: "bitbucket_pipeline",
+			action: options.env.PIPR_CHANGE_ACTION ?? "updated",
+			rawAction: options.env.PIPR_CHANGE_ACTION,
+			platform: {
+				id: "bitbucket",
+				host: "https://bitbucket.org"
+			},
+			repository: loaded.repository,
+			coordinates: loaded.coordinates,
+			change: loaded.change,
+			workspace: options.workspace
 		}
 	};
 }
-function skippedTaskRuntimeResult(options) {
-	const reason = options.reason ?? (options.taskName ? `Task '${options.taskName}' was not registered` : "No tasks matched the change request event");
-	const review = {
-		summary: { body: reason },
-		inlineFindings: []
+async function webhookEvent(options) {
+	const hook = webhookSchema.parse(await Bun.file(options.eventPath ?? "").json());
+	const eventKey = requiredHostEnv(options.env, "BITBUCKET_EVENT_KEY", "Bitbucket");
+	if (eventKey === "pullrequest:comment_created") {
+		if (!hook.comment) throw new Error("Bitbucket comment event payload is missing comment");
+		return commentEvent(hook, hook.comment, eventKey, options.workspace);
+	}
+	return await pullRequestEvent(options, hook, eventKey);
+}
+function commentEvent(hook, comment, eventKey, workspace) {
+	const common = {
+		eventName: eventKey,
+		action: "created",
+		rawAction: eventKey,
+		repository: {
+			slug: hook.repository.full_name,
+			url: hook.repository.links.html.href
+		},
+		changeNumber: hook.pullrequest.id,
+		commentId: comment.id,
+		body: comment.content.raw,
+		actor: hook.actor.nickname,
+		workspace
 	};
-	const validated = {
-		review,
-		validFindings: [],
-		droppedFindings: []
+	return comment.parent ? {
+		kind: "review-comment-reply",
+		reply: {
+			...common,
+			parentCommentId: comment.parent.id
+		}
+	} : {
+		kind: "command-comment",
+		comment: {
+			...common,
+			isChangeRequest: true
+		}
 	};
-	const publicationPlan = buildCommentPublishingPlan({
-		event: options.event,
-		main: reason,
-		validated,
-		manifest: options.diffManifest,
-		maxInlineComments: options.config.publication.maxInlineComments,
-		showHeader: options.config.publication.showHeader,
-		showFooter: options.config.publication.showFooter,
-		showStats: options.config.publication.showStats,
-		metadata: {
-			runtimeVersion,
-			configVersion: options.versionCompatibility?.configVersion,
-			trustedConfigSha: options.trustedConfigSha,
-			trustedConfigHash: options.trustedConfigHash,
-			reviewedHeadSha: options.event.change.head.sha,
-			providerModels: [options.provider.model],
-			selectedTasks: [],
-			failedTasks: [],
-			validFindings: 0,
-			droppedFindings: 0
+}
+async function pullRequestEvent(options, hook, eventKey) {
+	const action = pullRequestAction(eventKey);
+	if (hook.pullrequest.draft) return draftEvent();
+	const loaded = await options.loadChangeRequest({
+		workspace: hook.repository.full_name.split("/")[0] ?? "",
+		repository: hook.repository.slug,
+		changeNumber: hook.pullrequest.id
+	});
+	return {
+		kind: "change-request",
+		change: {
+			eventName: eventKey,
+			action,
+			rawAction: eventKey,
+			platform: {
+				id: "bitbucket",
+				host: "https://bitbucket.org"
+			},
+			repository: loaded.repository,
+			coordinates: loaded.coordinates,
+			change: loaded.change,
+			workspace: options.workspace
 		}
-	}).publicationPlan;
+	};
+}
+function pullRequestAction(eventKey) {
+	if (eventKey === "pullrequest:created") return "opened";
+	if (eventKey === "pullrequest:updated") return "updated";
+	if ([
+		"pullrequest:fulfilled",
+		"pullrequest:rejected",
+		"pullrequest:superseded"
+	].includes(eventKey)) return "closed";
+	throw new Error(`Unsupported Bitbucket event: ${eventKey}`);
+}
+function draftEvent() {
 	return {
-		kind: "skipped",
-		skipReason: reason,
-		provider: options.provider,
-		diffManifest: options.diffManifest,
-		review,
-		validated,
-		publicationPlan,
-		mainComment: publicationPlan.mainComment,
-		inlineCommentDrafts: [],
-		taskChecks: [],
-		repairAttempted: false
+		kind: "ignored",
+		reason: "pull request is a draft"
+	};
+}
+//#endregion
+//#region src/hosts/bitbucket/publication.ts
+async function publishBitbucketPlan(options) {
+	await assertCurrentEndpoints(options.client, options.change);
+	const owner = await options.client.currentUser();
+	const comments = await options.client.listComments(options.change.change.number);
+	const owned = comments.filter((comment) => comment.user?.uuid === owner.uuid);
+	const existingMain = owned.find((comment) => comment.content.raw.includes(mainMarker$1(options.change.change.number)));
+	const main = existingMain ? await options.client.updateComment(options.change.change.number, existingMain.id, options.plan.mainComment) : await options.client.createComment(options.change.change.number, { content: { raw: options.plan.mainComment } });
+	const inline = await publishUnseenInlineItems({
+		items: options.plan.inlineItems,
+		existingBodies: owned.map((comment) => comment.content.raw),
+		publish: (item) => options.client.createComment(options.change.change.number, {
+			content: { raw: item.body },
+			inline: bitbucketInline(item)
+		})
+	});
+	const resolution = await publishBitbucketThreadActions({
+		client: options.client,
+		change: options.change,
+		actions: options.plan.threadActions,
+		reviewedHeadSha: options.plan.metadata.reviewedHeadSha,
+		comments
+	});
+	return completeHostPublication({
+		provider: "Bitbucket",
+		mainAction: existingMain ? "updated" : "created",
+		mainId: main.id,
+		inline,
+		resolutionErrors: resolution.errors,
+		metadata: options.plan.metadata
+	});
+}
+async function publishBitbucketCommandResponse(options) {
+	const response = commandResponseBody({
+		changeNumber: options.change.change.number,
+		sourceCommentId: options.sourceCommentId,
+		commandName: options.commandName,
+		body: options.body
+	});
+	await assertCurrentEndpoints(options.client, options.change);
+	const owner = await options.client.currentUser();
+	const existing = (await options.client.listComments(options.change.change.number)).find((comment) => comment.user?.uuid === owner.uuid && comment.content.raw.includes(response.marker));
+	const comment = existing ? await options.client.updateComment(options.change.change.number, existing.id, response.body) : await options.client.createComment(options.change.change.number, { content: { raw: response.body } });
+	return {
+		action: existing ? "updated" : "created",
+		id: comment.id
+	};
+}
+async function loadBitbucketPriorReviewState(options) {
+	const comments = await loadBitbucketOwnedComments(options);
+	const body = comments.find((comment) => comment.content.raw.includes(mainMarker$1(options.change.change.number)))?.content.raw;
+	const state = extractPriorReviewState(body, options.change.change.number);
+	if (!state) return void 0;
+	const bodies = comments.map((comment) => comment.content.raw);
+	return applyResolvedFindingMarkers(applyInlineFindingMarkers(state, bodies), bodies);
+}
+async function loadBitbucketPriorMainComment(options) {
+	return (await loadBitbucketOwnedComments(options)).find((comment) => comment.content.raw.includes(mainMarker$1(options.change.change.number)))?.content.raw;
+}
+async function loadBitbucketOwnedComments(options) {
+	const owner = await options.client.currentUser();
+	return (await options.client.listComments(options.change.change.number)).filter((comment) => comment.user?.uuid === owner.uuid);
+}
+async function loadBitbucketInlineThreadContexts(options) {
+	const owner = await options.client.currentUser();
+	const comments = await options.client.listComments(options.change.change.number);
+	return comments.flatMap((root) => {
+		const marker = extractInlineFindingMarkerRecords([root.content.raw])[0];
+		if (!marker || root.user?.uuid !== owner.uuid || root.parent) return [];
+		const replies = comments.filter((comment) => comment.parent?.id === root.id);
+		return [{
+			findingId: marker.id,
+			findingHeadSha: marker.head,
+			parentCommentId: root.id,
+			parentBody: root.content.raw,
+			threadId: root.id,
+			threadResolved: root.resolution !== void 0,
+			comments: [root, ...replies].map((comment) => ({
+				id: comment.id,
+				body: comment.content.raw,
+				authorLogin: comment.user?.nickname
+			}))
+		}];
+	});
+}
+async function publishBitbucketThreadActions(options) {
+	if (options.actions.length === 0) return { errors: [] };
+	await assertCurrentEndpoints(options.client, options.change, options.reviewedHeadSha);
+	const comments = options.comments ?? await options.client.listComments(options.change.change.number);
+	const errors = [];
+	for (const action of options.actions) {
+		const root = comments.find((comment) => comment.id === (action.threadId ?? action.commentId) && !comment.parent);
+		if (!root) {
+			errors.push(`Bitbucket comment not found for ${action.commentId}`);
+			continue;
+		}
+		try {
+			if (!comments.filter((comment) => comment.parent?.id === root.id).some((comment) => comment.content.raw.includes(action.responseKey))) await options.client.replyToComment(options.change.change.number, root.id, action.body);
+			if (action.kind === "resolve" && root.resolution === void 0) await options.client.resolveComment(options.change.change.number, root.id);
+		} catch (error) {
+			errors.push(error instanceof Error ? error.message : String(error));
+		}
+	}
+	return { errors };
+}
+function bitbucketInline(item) {
+	return item.side === "RIGHT" ? {
+		path: item.path,
+		to: item.endLine,
+		...item.startLine !== item.endLine ? { start_to: item.startLine } : {}
+	} : {
+		path: item.previousPath ?? item.path,
+		from: item.endLine,
+		...item.startLine !== item.endLine ? { start_from: item.startLine } : {}
+	};
+}
+async function assertCurrentEndpoints(client, change, reviewedHeadSha = change.change.head.sha) {
+	const pullRequest = await client.getPullRequest(change.change.number);
+	if (pullRequest.source.commit.hash !== reviewedHeadSha || pullRequest.destination.commit.hash !== change.change.base.sha) throw new Error("Bitbucket pull request endpoints changed before publication");
+}
+function mainMarker$1(changeNumber) {
+	return `<!-- pipr:main-comment change=${changeNumber} `;
+}
+//#endregion
+//#region src/hosts/bitbucket/workspace.ts
+function ensureBitbucketHeadCheckout(options) {
+	const ref = options.change.change.head.ref;
+	if (!ref) throw new Error("Bitbucket pull request source ref is required for checkout");
+	const token = options.env?.BITBUCKET_API_TOKEN ?? process.env.BITBUCKET_API_TOKEN;
+	const fetchEnv = options.change.change.isFork && token ? {
+		...options.env,
+		GIT_CONFIG_COUNT: "1",
+		GIT_CONFIG_KEY_0: "http.extraHeader",
+		GIT_CONFIG_VALUE_0: `Authorization: Basic ${Buffer.from(`x-bitbucket-api-token-auth:${token}`).toString("base64")}`
+	} : options.env;
+	return ensureCodeHostHeadCheckout({
+		rootDir: options.rootDir,
+		headSha: options.change.change.head.sha,
+		fetchRef: ref.startsWith("refs/") ? ref : `refs/heads/${ref}`,
+		fetchRemote: options.change.change.isFork ? options.change.change.head.url : void 0,
+		fetchEnv
+	});
+}
+//#endregion
+//#region src/hosts/bitbucket/adapter.ts
+function createBitbucketHostAdapter(options = {}) {
+	const client = options.client ?? createBitbucketClient(options.env);
+	return {
+		id: "bitbucket",
+		capabilities: {
+			commandComments: true,
+			reviewCommentReplies: true,
+			threadResolution: true,
+			multilineInlineComments: true,
+			suggestedChanges: false,
+			statuses: true
+		},
+		events: {
+			parseEvent: (parseOptions) => parseBitbucketEvent({
+				...parseOptions,
+				loadChangeRequest: (ref) => client.loadChange(ref)
+			}),
+			loadChangeRequest(ref) {
+				const parts = ref.repository.slug.split("/");
+				return client.loadChange({
+					workspace: parts.at(-2) ?? client.workspace,
+					repository: parts.at(-1) ?? client.repository,
+					changeNumber: ref.changeNumber
+				}).then((loaded) => ({
+					...loaded,
+					eventName: ref.eventName,
+					action: ref.action,
+					rawAction: ref.rawAction,
+					workspace: ref.workspace
+				}));
+			}
+		},
+		workspace: { ensureHeadCheckout: (args) => ensureBitbucketHeadCheckout({
+			...args,
+			env: options.env
+		}) },
+		permissions: { getRepositoryPermission({ change, actor }) {
+			const coordinates = bitbucketCoordinates(change);
+			if (!coordinates.repositoryUuid) throw new Error("Bitbucket repository UUID is required for permission checks");
+			return client.getRepositoryPermission(actor, coordinates.repositoryUuid);
+		} },
+		publication: {
+			publish: ({ change, plan }) => publishBitbucketPlan({
+				client,
+				change,
+				plan
+			}),
+			publishCommandResponse: (args) => publishBitbucketCommandResponse({
+				client,
+				...args
+			}),
+			publishThreadActions: (args) => publishBitbucketThreadActions({
+				client,
+				...args
+			})
+		},
+		comments: {
+			loadPriorReviewState: ({ change }) => loadBitbucketPriorReviewState({
+				client,
+				change
+			}),
+			loadPriorMainComment: ({ change }) => loadBitbucketPriorMainComment({
+				client,
+				change
+			}),
+			loadInlineThreadContexts: ({ change }) => loadBitbucketInlineThreadContexts({
+				client,
+				change
+			})
+		},
+		statuses: {
+			isAvailable: () => true,
+			async upsert({ change, name, state, summary, status }) {
+				const pullRequest = await client.getPullRequest(change.change.number);
+				if (pullRequest.source.commit.hash !== change.change.head.sha || pullRequest.destination.commit.hash !== change.change.base.sha) throw new Error("Bitbucket pull request endpoints changed before status publication");
+				const key = `pipr-${name}`.replace(/[^a-zA-Z0-9_-]/g, "-").slice(0, 40);
+				const id = await client.setStatus(change.change.head.sha, key, {
+					state: bitbucketStatusState(state),
+					key,
+					name: `Pipr: ${name}`.slice(0, 255),
+					description: summary?.slice(0, 255),
+					refname: change.change.head.ref,
+					url: change.change.url
+				});
+				return status ?? {
+					id,
+					name
+				};
+			}
+		}
 	};
 }
+function bitbucketCoordinates(change) {
+	if (change.coordinates?.provider !== "bitbucket") throw new Error("Bitbucket adapter requires Bitbucket coordinates");
+	return change.coordinates;
+}
 //#endregion
 //#region src/shared/github.ts
 const githubApiVersion = "2026-03-10";
@@ -7277,12 +9372,21 @@ function parseRepoSlug(value) {
 		repo
 	};
 }
+function githubCoordinates(value) {
+	const { owner, repo } = parseRepoSlug(value);
+	return {
+		provider: "github",
+		owner,
+		repository: repo
+	};
+}
 //#endregion
 //#region src/hosts/github/command.ts
 const pullRequestDetailsSchema = z.looseObject({
 	title: z.string().optional(),
 	body: z.string().nullable().optional(),
 	html_url: z.string().optional(),
+	draft: z.boolean().optional(),
 	user: z.looseObject({ login: z.string().min(1).optional() }).optional(),
 	base: z.looseObject({
 		sha: z.string().min(1),
@@ -7305,7 +9409,7 @@ const pullRequestDetailsSchema = z.looseObject({
 });
 const githubRepositoryPermissionResponseSchema = z.looseObject({
 	permission: z.string().min(1),
-	role_name: z.string().min(1).optional()
+	role_name: z.string().optional()
 });
 const permissionLevels = /* @__PURE__ */ new Set([
 	"read",
@@ -7375,7 +9479,8 @@ function githubPullRequestDetails(options) {
 				author: githubActor(options.json.head.user?.login),
 				fork: options.json.head.repo?.fork
 			},
-			isFork: githubHeadIsFork(options.json, repository.slug)
+			isFork: githubHeadIsFork(options.json, repository.slug),
+			isDraft: options.json.draft
 		}
 	};
 }
@@ -7402,6 +9507,7 @@ const githubPullRequestPayloadSchema = z.looseObject({
 		title: z.string().optional(),
 		body: z.string().nullable().optional(),
 		html_url: z.string().optional(),
+		draft: z.boolean().optional(),
 		user: z.looseObject({ login: z.string().optional() }).optional(),
 		base: z.looseObject({
 			sha: z.string().optional(),
@@ -7462,7 +9568,7 @@ const githubIssueCommentEventContextSchema = z.strictObject({
 		url: z.string().min(1).optional()
 	}),
 	changeNumber: z.number({ error: "GitHub issue comment event is missing issue number" }).int().positive(),
-	commentId: z.number({ error: "GitHub issue comment event is missing comment id" }).int().positive(),
+	commentId: z.number({ error: "GitHub issue comment event is missing comment id" }).int().positive().transform(String),
 	isChangeRequest: z.boolean(),
 	body: z.string(),
 	actor: z.string({ error: "GitHub issue comment event is missing comment user" }).min(1),
@@ -7477,8 +9583,8 @@ const githubReviewCommentReplyEventSchema = z.strictObject({
 		url: z.string().min(1).optional()
 	}),
 	changeNumber: z.number({ error: "GitHub review comment event is missing pull request number" }).int().positive(),
-	commentId: z.number({ error: "GitHub review comment event is missing comment id" }).int().positive(),
-	parentCommentId: z.number().int().positive().optional(),
+	commentId: z.number({ error: "GitHub review comment event is missing comment id" }).int().positive().transform(String),
+	parentCommentId: z.number().int().positive().transform(String).optional(),
 	body: z.string(),
 	actor: z.string({ error: "GitHub review comment event is missing comment user" }).min(1),
 	workspace: z.string().min(1)
@@ -7497,18 +9603,21 @@ function githubPullRequestEventInput(payload, options) {
 			host: options.env.GITHUB_SERVER_URL
 		},
 		repository,
+		coordinates: githubCoordinates(repository.slug),
 		change: githubEventChange(payload, repository.slug),
 		workspace: options.workspace
 	};
 }
 function githubEventRepository(payload, env) {
 	const baseRepo = payload.pull_request.base?.repo;
+	const slug = [
+		payload.repository?.full_name,
+		baseRepo?.full_name,
+		env.GITHUB_REPOSITORY
+	].find((value) => value !== void 0 && value.length > 0);
+	if (!slug) throw new Error("GitHub pull request event is missing repository coordinates");
 	return {
-		slug: [
-			payload.repository?.full_name,
-			baseRepo?.full_name,
-			env.GITHUB_REPOSITORY
-		].find((value) => value !== void 0 && value.length > 0),
+		slug,
 		url: payload.repository?.html_url ?? baseRepo?.html_url
 	};
 }
@@ -7522,7 +9631,8 @@ function githubEventChange(payload, repositorySlug) {
 		author: githubActor(pullRequest.user?.login),
 		base: githubBaseEndpoint(pullRequest),
 		head: githubHeadEndpoint(pullRequest),
-		isFork: githubEventHeadIsFork(pullRequest.head?.repo?.full_name, repositorySlug)
+		isFork: githubEventHeadIsFork(pullRequest.head?.repo?.full_name, repositorySlug),
+		isDraft: pullRequest.draft
 	};
 }
 function githubBaseEndpoint(pullRequest) {
@@ -7820,16 +9930,6 @@ const githubResolveReviewThreadMutation = `
   }
 `;
 //#endregion
-//#region src/review/publication-result.ts
-/** Error thrown when publication fails after producing partial result metadata. */
-var PublicationError = class extends Error {
-	result;
-	constructor(message, result) {
-		super(message);
-		this.result = result;
-	}
-};
-//#endregion
 //#region src/hosts/github/publication-shared.ts
 async function assertCurrentHeadSha(client, change, reviewedHeadSha) {
 	const headMismatch = await currentHeadShaMismatch(client, change, reviewedHeadSha);
@@ -7886,21 +9986,25 @@ async function publishGitHubCommandResponse(options) {
 		repo: options.change.repository.slug,
 		issueNumber: options.change.change.number
 	}), marker, ownerLogin);
-	if (existing) return {
-		action: "updated",
-		id: (await options.client.updateIssueComment({
+	if (existing) {
+		const updated = await options.client.updateIssueComment({
 			repo: options.change.repository.slug,
 			commentId: existing.id,
 			body
-		})).id
-	};
+		});
+		return {
+			action: "updated",
+			id: String(updated.id)
+		};
+	}
+	const created = await options.client.createIssueComment({
+		repo: options.change.repository.slug,
+		issueNumber: options.change.change.number,
+		body
+	});
 	return {
 		action: "created",
-		id: (await options.client.createIssueComment({
-			repo: options.change.repository.slug,
-			issueNumber: options.change.change.number,
-			body
-		})).id
+		id: String(created.id)
 	};
 }
 function findCommandResponseComment(comments, marker, ownerLogin) {
@@ -7943,14 +10047,14 @@ async function loadGitHubInlineThreadContexts(options) {
 		return [{
 			findingId: marker.id,
 			findingHeadSha: marker.head,
-			parentCommentId: comment.id,
+			parentCommentId: String(comment.id),
 			parentBody: comment.body ?? "",
 			threadId: thread?.id,
 			threadResolved: thread?.isResolved ?? false,
 			comments: thread?.commentIds.flatMap((id) => {
 				const item = commentById.get(id);
 				return item ? [{
-					id: item.id,
+					id: String(item.id),
 					body: item.body ?? "",
 					authorLogin: item.authorLogin
 				}] : [];
@@ -8071,7 +10175,7 @@ async function postThreadActionReplyIfNeeded(context, action) {
 		await context.client.createReviewCommentReply({
 			repo: context.change.repository.slug,
 			pullRequestNumber: context.change.change.number,
-			commentId: action.commentId,
+			commentId: Number(action.commentId),
 			body: [
 				marker.body,
 				"",
@@ -8143,7 +10247,7 @@ async function resolveReviewThread(context, action) {
 }
 function threadForAction(context, action) {
 	if (action.kind !== "resolve") return;
-	return (action.threadId ? context.threadById.get(action.threadId) : void 0) ?? context.threadByCommentId.get(action.commentId);
+	return (action.threadId ? context.threadById.get(action.threadId) : void 0) ?? context.threadByCommentId.get(Number(action.commentId));
 }
 //#endregion
 //#region src/hosts/github/publication-review.ts
@@ -8191,21 +10295,25 @@ async function upsertMainComment(options) {
 		repo: options.change.repository.slug,
 		issueNumber: options.change.change.number
 	}), options.plan.mainMarker, options.change.change.number, options.ownerLogin);
-	if (existing) return {
-		action: "updated",
-		id: (await options.client.updateIssueComment({
+	if (existing) {
+		const updated = await options.client.updateIssueComment({
 			repo: options.change.repository.slug,
 			commentId: existing.id,
 			body: options.plan.mainComment
-		})).id
-	};
+		});
+		return {
+			action: "updated",
+			id: String(updated.id)
+		};
+	}
+	const created = await options.client.createIssueComment({
+		repo: options.change.repository.slug,
+		issueNumber: options.change.change.number,
+		body: options.plan.mainComment
+	});
 	return {
 		action: "created",
-		id: (await options.client.createIssueComment({
-			repo: options.change.repository.slug,
-			issueNumber: options.change.change.number,
-			body: options.plan.mainComment
-		})).id
+		id: String(created.id)
 	};
 }
 async function publishInlineComments(options) {
@@ -8361,48 +10469,18 @@ function gitConfigEnvCount(env) {
 	const count = Number.parseInt(env.GIT_CONFIG_COUNT ?? process.env.GIT_CONFIG_COUNT ?? Bun.env.GIT_CONFIG_COUNT ?? "0", 10);
 	return Number.isSafeInteger(count) && count >= 0 ? count : 0;
 }
-function gitGlobalConfigHome(env) {
-	if (existsSync("/home/bun")) return "/home/bun";
-	const root = env.RUNNER_TEMP ?? env.TMPDIR ?? os.tmpdir();
-	mkdirSync(root, { recursive: true });
-	return root;
-}
-function ensureGitHubHeadCheckout(options) {
-	const headSha = options.change.change.head.sha;
-	if (!hasGitCommit(options.rootDir, headSha)) runGit(options.rootDir, [
-		"fetch",
-		"--no-tags",
-		"--depth=1",
-		"origin",
-		`refs/pull/${options.change.change.number}/head`
-	]);
-	if (runGit(options.rootDir, ["rev-parse", "HEAD"]).trim() !== headSha) runGit(options.rootDir, [
-		"checkout",
-		"--detach",
-		headSha
-	]);
-}
-function hasGitCommit(rootDir, sha) {
-	try {
-		runGit(rootDir, [
-			"cat-file",
-			"-e",
-			`${sha}^{commit}`
-		]);
-		return true;
-	} catch {
-		return false;
-	}
-}
-function runGit(rootDir, args) {
-	const result = Bun.spawnSync(["git", ...args], {
-		cwd: rootDir,
-		env: process.env,
-		stderr: "pipe",
-		stdout: "pipe"
+function gitGlobalConfigHome(env) {
+	if (existsSync("/home/bun")) return "/home/bun";
+	const root = env.RUNNER_TEMP ?? env.TMPDIR ?? os.tmpdir();
+	mkdirSync(root, { recursive: true });
+	return root;
+}
+function ensureGitHubHeadCheckout(options) {
+	return ensureCodeHostHeadCheckout({
+		rootDir: options.rootDir,
+		headSha: options.change.change.head.sha,
+		fetchRef: `refs/pull/${options.change.change.number}/head`
 	});
-	if (result.exitCode !== 0) throw new Error(result.stderr.toString().trim() || `git ${args.join(" ")} failed`);
-	return result.stdout.toString();
 }
 //#endregion
 //#region src/hosts/github/adapter.ts
@@ -8412,35 +10490,63 @@ function createGitHubHostAdapter(options = {}) {
 	const publicationClient = options.publicationClient ?? createGitHubPublicationClient(env);
 	return {
 		id: "github",
+		capabilities: {
+			commandComments: true,
+			reviewCommentReplies: true,
+			threadResolution: true,
+			multilineInlineComments: true,
+			suggestedChanges: true,
+			statuses: true
+		},
 		events: {
-			parseEvent(parseOptions) {
-				return loadGitHubPullRequestEventContext(parseOptions);
+			async parseEvent(parseOptions) {
+				const eventPath = parseOptions.eventPath;
+				if (!eventPath) throw new Error("GITHUB_EVENT_PATH is required for GitHub events");
+				const eventOptions = {
+					...parseOptions,
+					eventPath
+				};
+				if (parseOptions.env.GITHUB_EVENT_NAME === "issue_comment") return {
+					kind: "command-comment",
+					comment: await loadGitHubIssueCommentEventContext(eventOptions)
+				};
+				if (parseOptions.env.GITHUB_EVENT_NAME === "pull_request_review_comment") return {
+					kind: "review-comment-reply",
+					reply: await loadGitHubReviewCommentReplyEvent(eventOptions)
+				};
+				const change = await loadGitHubPullRequestEventContext(eventOptions);
+				return change.change.isDraft ? {
+					kind: "ignored",
+					reason: "pull request is a draft"
+				} : {
+					kind: "change-request",
+					change
+				};
 			},
 			async loadChangeRequest(ref) {
+				const loaded = await commandClient.getPullRequest({
+					repository: ref.repository,
+					changeNumber: ref.changeNumber
+				});
 				return {
-					...await commandClient.getPullRequest({
-						repository: ref.repository,
-						changeNumber: ref.changeNumber
-					}),
+					...loaded,
+					coordinates: githubCoordinates(loaded.repository.slug),
 					eventName: ref.eventName,
 					action: ref.action,
 					rawAction: ref.rawAction,
 					workspace: ref.workspace
 				};
-			},
-			resolveCommandComment(parseOptions) {
-				return loadGitHubIssueCommentEventContext(parseOptions);
-			},
-			resolveReviewCommentReply(parseOptions) {
-				return loadGitHubReviewCommentReplyEvent(parseOptions);
 			}
 		},
 		workspace: {
 			ensureHeadCheckout: ensureGitHubHeadCheckout,
 			ensureWorkspaceSafeDirectory: ensureGitHubWorkspaceSafeDirectory
 		},
-		permissions: { getRepositoryPermission(options) {
-			return commandClient.getRepositoryPermission(options);
+		permissions: { getRepositoryPermission({ change, actor }) {
+			return commandClient.getRepositoryPermission({
+				repository: change.repository,
+				actor
+			});
 		} },
 		publication: {
 			publish(options) {
@@ -8454,7 +10560,7 @@ function createGitHubHostAdapter(options = {}) {
 				return publishGitHubCommandResponse({
 					client: publicationClient,
 					change: options.change,
-					sourceCommentId: options.sourceCommentId,
+					sourceCommentId: Number(options.sourceCommentId),
 					commandName: options.commandName,
 					body: options.body
 				});
@@ -8488,44 +10594,509 @@ function createGitHubHostAdapter(options = {}) {
 				});
 			}
 		},
-		checks: {
-			createCheckRun(options) {
-				return publicationClient.createCheckRun({
+		statuses: {
+			isAvailable(change) {
+				return change.eventName === "pull_request";
+			},
+			async upsert(options) {
+				if (!options.status) {
+					const checkRun = await publicationClient.createCheckRun({
+						repo: options.change.repository.slug,
+						name: options.name,
+						headSha: options.change.change.head.sha,
+						summary: options.summary
+					});
+					return {
+						id: String(checkRun.id),
+						name: checkRun.name
+					};
+				}
+				if (options.state === "pending") return options.status;
+				await publicationClient.updateCheckRun({
 					repo: options.change.repository.slug,
-					name: options.name,
-					headSha: options.change.change.head.sha,
+					checkRunId: Number(options.status.id),
+					name: options.status.name,
+					conclusion: options.state,
 					summary: options.summary
 				});
+				return options.status;
+			}
+		}
+	};
+}
+//#endregion
+//#region src/hosts/gitlab/event.ts
+const projectSchema = z.looseObject({
+	id: z.union([z.number(), z.string()]),
+	path_with_namespace: z.string().min(1),
+	web_url: z.string().url().optional()
+});
+const mergeRequestHookSchema = z.looseObject({
+	object_kind: z.literal("merge_request"),
+	project: projectSchema,
+	object_attributes: z.looseObject({
+		iid: z.number().int().positive(),
+		action: z.string().optional(),
+		draft: z.boolean().optional()
+	}),
+	changes: z.looseObject({ draft: z.looseObject({
+		previous: z.boolean(),
+		current: z.boolean()
+	}).optional() }).optional()
+});
+const noteHookSchema = z.looseObject({
+	object_kind: z.literal("note"),
+	project: projectSchema,
+	merge_request: z.looseObject({ iid: z.number().int().positive() }),
+	user: z.looseObject({ username: z.string().min(1) }),
+	object_attributes: z.looseObject({
+		id: z.union([z.number(), z.string()]),
+		note: z.string(),
+		action: z.string().optional(),
+		noteable_type: z.string(),
+		discussion_id: z.string().min(1).optional()
+	})
+});
+async function parseGitLabEvent(options) {
+	if (!options.eventPath) return await pipelineEvent(options);
+	const payload = await Bun.file(options.eventPath).json();
+	if (isObjectKind(payload, "merge_request")) return await mergeRequestEvent(payload, options);
+	if (isObjectKind(payload, "note")) return await noteEvent(payload, options);
+	throw new Error("Unsupported GitLab event payload");
+}
+async function pipelineEvent(options) {
+	const loaded = await loadChange(options, {
+		projectId: requiredHostEnv(options.env, "CI_PROJECT_ID", "GitLab pipeline"),
+		projectPath: requiredHostEnv(options.env, "CI_PROJECT_PATH", "GitLab pipeline"),
+		changeNumber: positiveIntegerHostEnv(options.env, "CI_MERGE_REQUEST_IID", "GitLab pipeline")
+	});
+	if (loaded.change.isDraft) return {
+		kind: "ignored",
+		reason: "merge request is a draft"
+	};
+	return {
+		kind: "change-request",
+		change: parseChangeRequestEventContext({
+			eventName: "gitlab_pipeline",
+			action: options.env.PIPR_CHANGE_ACTION ?? "updated",
+			rawAction: options.env.PIPR_CHANGE_ACTION,
+			platform: {
+				id: "gitlab",
+				host: options.env.CI_SERVER_URL ?? "https://gitlab.com"
 			},
-			updateCheckRun(options) {
-				return publicationClient.updateCheckRun({
-					repo: options.change.repository.slug,
-					checkRunId: Number(options.checkRun.id),
-					name: options.checkRun.name,
-					conclusion: options.conclusion,
-					summary: options.summary
+			repository: loaded.repository,
+			coordinates: loaded.coordinates,
+			change: loaded.change,
+			workspace: options.workspace
+		})
+	};
+}
+async function mergeRequestEvent(payload, options) {
+	const hook = mergeRequestHookSchema.parse(payload);
+	const becameReady = hook.changes?.draft?.previous === true && hook.changes.draft.current === false;
+	if (hook.object_attributes.draft === true && !becameReady) return {
+		kind: "ignored",
+		reason: "merge request is a draft"
+	};
+	const loaded = await loadChange(options, {
+		projectId: String(hook.project.id),
+		projectPath: hook.project.path_with_namespace,
+		changeNumber: hook.object_attributes.iid
+	});
+	return {
+		kind: "change-request",
+		change: parseChangeRequestEventContext({
+			eventName: "merge_request",
+			action: normalizeMergeRequestAction(hook.object_attributes.action, hook.changes?.draft),
+			rawAction: hook.object_attributes.action,
+			platform: {
+				id: "gitlab",
+				host: gitLabHost(hook.project.web_url)
+			},
+			repository: loaded.repository,
+			coordinates: loaded.coordinates,
+			change: loaded.change,
+			workspace: options.workspace
+		})
+	};
+}
+async function noteEvent(payload, options) {
+	const hook = noteHookSchema.parse(payload);
+	if (hook.object_attributes.noteable_type !== "MergeRequest") throw new Error("GitLab note did not target a merge request");
+	const common = {
+		eventName: "note",
+		action: hook.object_attributes.action === "create" ? "created" : hook.object_attributes.action,
+		rawAction: hook.object_attributes.action,
+		repository: {
+			slug: hook.project.path_with_namespace,
+			url: hook.project.web_url
+		},
+		changeNumber: hook.merge_request.iid,
+		commentId: String(hook.object_attributes.id),
+		body: hook.object_attributes.note,
+		actor: hook.user.username,
+		workspace: options.workspace
+	};
+	const parentCommentId = await options.resolveReplyParent?.({
+		projectId: String(hook.project.id),
+		changeNumber: hook.merge_request.iid,
+		noteId: String(hook.object_attributes.id),
+		discussionId: hook.object_attributes.discussion_id
+	});
+	return parentCommentId ? {
+		kind: "review-comment-reply",
+		reply: {
+			...common,
+			parentCommentId
+		}
+	} : {
+		kind: "command-comment",
+		comment: {
+			...common,
+			isChangeRequest: true
+		}
+	};
+}
+async function loadChange(options, ref) {
+	if (!options.loadChangeRequest) throw new Error("GitLab merge request events require an API-backed change loader");
+	return await options.loadChangeRequest(ref);
+}
+function normalizeMergeRequestAction(action, draftChange) {
+	if (action === "update" && draftChange?.previous === true && draftChange.current === false) return "ready";
+	return action ? gitLabMergeRequestActions[action] ?? action : void 0;
+}
+const gitLabMergeRequestActions = {
+	open: "opened",
+	reopen: "reopened",
+	update: "updated",
+	approved: "updated",
+	unapproved: "updated",
+	close: "closed",
+	merge: "closed"
+};
+function isObjectKind(value, kind) {
+	return typeof value === "object" && value !== null && "object_kind" in value && value.object_kind === kind;
+}
+function gitLabHost(projectUrl) {
+	return projectUrl ? new URL(projectUrl).origin : "https://gitlab.com";
+}
+//#endregion
+//#region src/hosts/gitlab/publication.ts
+async function publishGitLabPlan(options) {
+	const { projectId } = gitLabCoordinates$1(options.change);
+	const owner = await options.client.currentUser();
+	const existingMain = ownedNote(await options.client.listNotes(projectId, options.change.change.number), owner.username, mainMarker(options.change.change.number));
+	const discussions = await options.client.listDiscussions(projectId, options.change.change.number);
+	const ownedBodies = discussionNotes(discussions).filter((note) => note.author?.username === owner.username).map((note) => note.body);
+	const mergeRequest = await assertCurrentHead(options.client, projectId, options.change);
+	const main = existingMain ? await options.client.updateNote(projectId, options.change.change.number, existingMain.id, options.plan.mainComment) : await options.client.createNote(projectId, options.change.change.number, options.plan.mainComment);
+	const inline = await publishUnseenInlineItems({
+		items: options.plan.inlineItems,
+		existingBodies: ownedBodies,
+		publish: async (item) => {
+			await options.client.createDiscussion(projectId, options.change.change.number, gitLabInlineBody(item), gitLabPosition(item, mergeRequest.diff_refs));
+		}
+	});
+	const resolution = await publishGitLabThreadActions({
+		client: options.client,
+		change: options.change,
+		actions: options.plan.threadActions,
+		reviewedHeadSha: options.plan.metadata.reviewedHeadSha,
+		discussions
+	});
+	return completeHostPublication({
+		provider: "GitLab",
+		mainAction: existingMain ? "updated" : "created",
+		mainId: main.id,
+		inline,
+		resolutionErrors: resolution.errors,
+		metadata: options.plan.metadata
+	});
+}
+async function publishGitLabCommandResponse(options) {
+	const { projectId } = gitLabCoordinates$1(options.change);
+	const owner = await options.client.currentUser();
+	const response = commandResponseBody({
+		changeNumber: options.change.change.number,
+		sourceCommentId: options.sourceCommentId,
+		commandName: options.commandName,
+		body: options.body
+	});
+	const existing = ownedNote(await options.client.listNotes(projectId, options.change.change.number), owner.username, response.marker);
+	await assertCurrentHead(options.client, projectId, options.change);
+	const note = existing ? await options.client.updateNote(projectId, options.change.change.number, existing.id, response.body) : await options.client.createNote(projectId, options.change.change.number, response.body);
+	return {
+		action: existing ? "updated" : "created",
+		id: note.id
+	};
+}
+async function loadGitLabPriorReviewState(options) {
+	const state = extractPriorReviewState(await loadGitLabPriorMainComment(options), options.change.change.number);
+	if (!state) return void 0;
+	const owner = await options.client.currentUser();
+	const bodies = discussionNotes(await options.client.listDiscussions(gitLabCoordinates$1(options.change).projectId, options.change.change.number)).filter((note) => note.author?.username === owner.username).map((note) => note.body);
+	return applyResolvedFindingMarkers(applyInlineFindingMarkers(state, bodies), bodies);
+}
+async function loadGitLabPriorMainComment(options) {
+	const owner = await options.client.currentUser();
+	return ownedNote(await options.client.listNotes(gitLabCoordinates$1(options.change).projectId, options.change.change.number), owner.username, mainMarker(options.change.change.number))?.body;
+}
+async function loadGitLabInlineThreadContexts(options) {
+	const owner = await options.client.currentUser();
+	return (await options.client.listDiscussions(gitLabCoordinates$1(options.change).projectId, options.change.change.number)).flatMap((discussion) => {
+		const root = discussion.notes[0];
+		const marker = root ? extractInlineFindingMarkerRecords([root.body])[0] : void 0;
+		if (!root || !marker || root.author?.username !== owner.username) return [];
+		return [{
+			findingId: marker.id,
+			findingHeadSha: marker.head,
+			parentCommentId: root.id,
+			parentBody: root.body,
+			threadId: discussion.id,
+			threadResolved: root.resolved ?? false,
+			comments: discussion.notes.map((note) => ({
+				id: note.id,
+				body: note.body,
+				authorLogin: note.author?.username
+			}))
+		}];
+	});
+}
+async function publishGitLabThreadActions(options) {
+	if (options.actions.length === 0) return { errors: [] };
+	const { projectId } = gitLabCoordinates$1(options.change);
+	await assertCurrentHead(options.client, projectId, options.change, options.reviewedHeadSha);
+	const discussions = options.discussions ?? await options.client.listDiscussions(projectId, options.change.change.number);
+	const byNote = new Map(discussions.flatMap((discussion) => discussion.notes.map((note) => [note.id, discussion])));
+	const errors = [];
+	for (const action of options.actions) {
+		const error = await publishGitLabThreadAction({
+			client: options.client,
+			projectId,
+			changeNumber: options.change.change.number,
+			action,
+			discussion: action.threadId ? discussions.find((candidate) => candidate.id === action.threadId) : byNote.get(action.commentId)
+		});
+		if (error) errors.push(error);
+	}
+	return { errors };
+}
+async function publishGitLabThreadAction(options) {
+	if (!options.discussion) return `GitLab discussion not found for comment ${options.action.commentId}`;
+	try {
+		if (!options.discussion.notes.some((note) => note.body.includes(options.action.responseKey))) await options.client.replyDiscussion(options.projectId, options.changeNumber, options.discussion.id, options.action.body);
+		if (options.action.kind === "resolve" && !options.discussion.notes[0]?.resolved) await options.client.resolveDiscussion(options.projectId, options.changeNumber, options.discussion.id);
+	} catch (error) {
+		return error instanceof Error ? error.message : String(error);
+	}
+}
+function gitLabPosition(item, refs) {
+	const oldPath = item.previousPath ?? item.path;
+	const position = {
+		position_type: "text",
+		base_sha: refs.base_sha,
+		start_sha: refs.start_sha,
+		head_sha: refs.head_sha,
+		old_path: oldPath,
+		new_path: item.path,
+		...item.side === "RIGHT" ? { new_line: item.endLine } : { old_line: item.endLine }
+	};
+	if (item.startLine !== item.endLine) {
+		const type = item.side === "RIGHT" ? "new" : "old";
+		const linePath = type === "old" ? oldPath : item.path;
+		position.line_range = {
+			start: lineRangePoint(linePath, type, item.startLine),
+			end: lineRangePoint(linePath, type, item.endLine)
+		};
+	}
+	return position;
+}
+function lineRangePoint(path, type, line) {
+	return {
+		line_code: `${new Bun.CryptoHasher("sha1").update(path).digest("hex")}_${type === "old" ? line : 0}_${type === "new" ? line : 0}`,
+		type,
+		...type === "old" ? { old_line: line } : { new_line: line }
+	};
+}
+function gitLabInlineBody(item) {
+	const offset = item.endLine - item.startLine;
+	return item.body.replaceAll(/(`{3,})suggestion(\r?\n)/g, `$1suggestion:-${offset}+0$2`);
+}
+async function assertCurrentHead(client, projectId, change, reviewedHeadSha = change.change.head.sha) {
+	const current = await client.getMergeRequest(projectId, change.change.number);
+	if (current.diff_refs.head_sha !== reviewedHeadSha) throw new Error(`GitLab merge request head changed from ${reviewedHeadSha} to ${current.diff_refs.head_sha}`);
+	return current;
+}
+function gitLabCoordinates$1(change) {
+	if (change.coordinates?.provider !== "gitlab") throw new Error("GitLab adapter requires GitLab coordinates");
+	return change.coordinates;
+}
+function ownedNote(notes, username, marker) {
+	return notes.find((note) => note.author?.username === username && note.body.trimStart().startsWith(marker));
+}
+function discussionNotes(discussions) {
+	return discussions.flatMap((discussion) => discussion.notes);
+}
+function mainMarker(changeNumber) {
+	return `<!-- pipr:main-comment change=${changeNumber} `;
+}
+//#endregion
+//#region src/hosts/gitlab/workspace.ts
+function ensureGitLabHeadCheckout(options) {
+	return ensureCodeHostHeadCheckout({
+		rootDir: options.rootDir,
+		headSha: options.change.change.head.sha,
+		fetchRef: `refs/merge-requests/${options.change.change.number}/head`
+	});
+}
+//#endregion
+//#region src/hosts/gitlab/adapter.ts
+function createGitLabHostAdapter(options = {}) {
+	const client = options.client ?? createGitLabClient(options.env);
+	return {
+		id: "gitlab",
+		capabilities: {
+			commandComments: true,
+			reviewCommentReplies: true,
+			threadResolution: true,
+			multilineInlineComments: true,
+			suggestedChanges: true,
+			statuses: true
+		},
+		events: {
+			parseEvent(parseOptions) {
+				return parseGitLabEvent({
+					...parseOptions,
+					loadChangeRequest: (ref) => client.loadChange(ref),
+					resolveReplyParent: ({ projectId, changeNumber, noteId, discussionId }) => client.findReplyParent(projectId, changeNumber, noteId, discussionId)
 				});
+			},
+			loadChangeRequest(ref) {
+				const coordinates = gitLabCoordinates(ref.repository.slug, ref.repository.url);
+				return client.loadChange({
+					projectId: coordinates.projectId,
+					projectPath: coordinates.projectPath,
+					changeNumber: ref.changeNumber
+				}).then((loaded) => ({
+					...loaded,
+					eventName: ref.eventName,
+					action: ref.action,
+					rawAction: ref.rawAction,
+					workspace: ref.workspace
+				}));
+			}
+		},
+		workspace: { ensureHeadCheckout: ensureGitLabHeadCheckout },
+		permissions: { getRepositoryPermission({ change, actor }) {
+			return client.getRepositoryPermission(gitLabCoordinates(change.repository.slug, change.repository.url).projectId, actor);
+		} },
+		publication: {
+			publish: ({ plan, change }) => publishGitLabPlan({
+				client,
+				plan,
+				change
+			}),
+			publishCommandResponse: (args) => publishGitLabCommandResponse({
+				client,
+				...args
+			}),
+			publishThreadActions: (args) => publishGitLabThreadActions({
+				client,
+				...args
+			})
+		},
+		comments: {
+			loadPriorReviewState: ({ change }) => loadGitLabPriorReviewState({
+				client,
+				change
+			}),
+			loadPriorMainComment: ({ change }) => loadGitLabPriorMainComment({
+				client,
+				change
+			}),
+			loadInlineThreadContexts: ({ change }) => loadGitLabInlineThreadContexts({
+				client,
+				change
+			})
+		},
+		statuses: {
+			isAvailable: () => true,
+			async upsert({ change, name, state, summary, status }) {
+				const id = await client.setStatus(gitLabChangeCoordinates(change).projectId, change.change.head.sha, name, state, summary);
+				return status ?? {
+					id,
+					name
+				};
 			}
 		}
 	};
 }
+function gitLabChangeCoordinates(change) {
+	if (change.coordinates?.provider !== "gitlab") throw new Error("GitLab adapter requires GitLab coordinates");
+	return change.coordinates;
+}
+function gitLabCoordinates(slug, url) {
+	return {
+		projectId: url?.match(/\/projects\/(\d+)/)?.[1] ?? slug,
+		projectPath: slug
+	};
+}
+//#endregion
+//#region src/hosts/selection.ts
+const codeHostIds = [
+	"github",
+	"gitlab",
+	"azure-devops",
+	"bitbucket"
+];
+function resolveCodeHostId(options) {
+	const selected = options.explicitHost ?? options.env.PIPR_CODE_HOST;
+	if (selected) return parseCodeHostId(selected);
+	const detected = [];
+	if (options.env.GITHUB_ACTIONS !== void 0) detected.push("github");
+	if (options.env.GITLAB_CI !== void 0) detected.push("gitlab");
+	if (options.env.TF_BUILD !== void 0) detected.push("azure-devops");
+	if (options.env.BITBUCKET_BUILD_NUMBER !== void 0) detected.push("bitbucket");
+	if (detected.length === 1) {
+		const host = detected[0];
+		if (host) return host;
+	}
+	if (detected.length > 1) throw new Error(`Multiple code hosts detected: ${detected.join(", ")}`);
+	throw new Error("A code host must be selected");
+}
+function parseCodeHostId(value) {
+	switch (value) {
+		case "github":
+		case "gitlab":
+		case "azure-devops":
+		case "bitbucket": return value;
+		default: throw new Error(`Unsupported code host '${value}'. Supported hosts: ${codeHostIds.join(", ")}`);
+	}
+}
 //#endregion
-//#region src/action/action-host.ts
-function assertTrustedActionProviderEnv(options, trustedConfig) {
+//#region src/host-run/adapter.ts
+function assertTrustedHostRunProviderEnv(options, trustedConfig) {
 	const env = options.env ?? process.env;
 	const missing = [];
 	for (const provider of trustedConfig.providers) if (!env[provider.apiKeyEnv]) missing.push(provider.apiKeyEnv);
 	if (missing.length > 0) throw new Error(`Missing provider env vars: ${missing.join(", ")}`);
 }
-function createActionHostAdapter(options) {
-	return options.hostAdapter ?? createGitHubHostAdapter({
-		env: options.env,
-		commandClient: options.githubClient,
-		publicationClient: options.githubPublicationClient
+function createHostRunAdapter(options) {
+	if (options.hostAdapter) return options.hostAdapter;
+	const host = resolveCodeHostId({
+		explicitHost: options.host,
+		env: options.env ?? process.env
 	});
+	if (host !== "github") {
+		if (host === "azure-devops") return createAzureDevOpsHostAdapter({ env: options.env });
+		if (host === "gitlab") return createGitLabHostAdapter({ env: options.env });
+		if (host === "bitbucket") return createBitbucketHostAdapter({ env: options.env });
+		throw new Error(`Code host adapter '${host}' is not available in this build`);
+	}
+	return createGitHubHostAdapter({ env: options.env });
 }
 //#endregion
-//#region src/action/action-logging.ts
+//#region src/host-run/logging.ts
 async function logPhase(log, name, run) {
 	const started = Date.now();
 	log.info(`${name} start`);
@@ -8574,8 +11145,8 @@ function addProviderSecrets(log, config, env) {
 	for (const provider of config.providers) log.addSecret((env ?? process.env)[provider.apiKeyEnv]);
 }
 //#endregion
-//#region src/action/runtime-checks.ts
-const genericCheckFailureSummary = "pipr failed; see Action logs for details.";
+//#region src/host-run/runtime-checks.ts
+const genericCheckFailureSummary = "pipr failed; see runner logs for details.";
 async function startRuntimeChecks(options) {
 	if (!canStartRuntimeChecks(options)) return;
 	const tasks = options.selectedTasks;
@@ -8598,8 +11169,8 @@ async function startRuntimeChecks(options) {
 	try {
 		await startTaskCheckRuns(started);
 		if (aggregateName) {
-			started.aggregate = await createCheckRunOrThrow(started, aggregateName, "pipr review is running.");
-			started.log?.info("check run created", {
+			started.aggregate = await createStatusOrThrow(started, aggregateName, "pipr review is running.");
+			started.log?.info("status created", {
 				name: aggregateName,
 				kind: "aggregate"
 			});
@@ -8611,7 +11182,7 @@ async function startRuntimeChecks(options) {
 	return started;
 }
 async function finalizeRuntimeChecks(checks, options) {
-	if (!checks?.adapter.checks?.updateCheckRun) return;
+	if (!checks?.adapter.statuses) return;
 	const taskResults = checks.tasks.map((task) => taskCheckResultForFinalization(task, checks.outcomes.get(task.name), options));
 	const taskError = await updateTaskCheckRuns(checks, taskResults);
 	const aggregateError = await updateAggregateCheckRun(checks, taskResults, options);
@@ -8619,37 +11190,38 @@ async function finalizeRuntimeChecks(checks, options) {
 	if (firstError !== void 0) throw firstError instanceof Error ? firstError : new Error(String(firstError));
 }
 function canStartRuntimeChecks(options) {
-	return options.event.eventName === "pull_request" && options.taskName === void 0 && Boolean(options.adapter.checks?.createCheckRun) && Boolean(options.adapter.checks?.updateCheckRun);
+	return options.taskName === void 0 && options.adapter.capabilities.statuses && Boolean(options.adapter.statuses?.isAvailable(options.event));
 }
 async function startTaskCheckRuns(started) {
 	for (const task of started.tasks) {
 		const settings = taskCheckSettings(task);
 		if (!settings.individual) continue;
-		const run = await createCheckRunOrThrow(started, settings.name, "pipr task is running.");
+		const run = await createStatusOrThrow(started, settings.name, "pipr task is running.");
 		started.taskRuns.set(task.name, run);
-		started.log?.info("check run created", {
+		started.log?.info("status created", {
 			name: settings.name,
 			kind: "task",
 			task: task.name
 		});
 	}
 }
-async function createCheckRunOrThrow(checks, name, summary) {
+async function createStatusOrThrow(checks, name, summary) {
 	try {
-		const createCheckRun = checks.adapter.checks?.createCheckRun;
-		if (!createCheckRun) throw new Error("check run creation is not available");
-		return await createCheckRun({
+		const statuses = checks.adapter.statuses;
+		if (!statuses) throw new Error("status publication is not available");
+		return await statuses.upsert({
 			change: checks.event,
 			name,
+			state: "pending",
 			summary
 		});
 	} catch (error) {
-		throw checkRunPermissionError(error);
+		throw statusPermissionError(error);
 	}
 }
-function checkRunPermissionError(error) {
+function statusPermissionError(error) {
 	const message = error instanceof Error ? error.message : String(error);
-	return /* @__PURE__ */ new Error(`Unable to create GitHub check run. Ensure the workflow grants 'checks: write'. ${message}`);
+	return /* @__PURE__ */ new Error(`Unable to publish code host status. Check the adapter credential scopes. ${message}`);
 }
 async function updateTaskCheckRuns(checks, taskResults) {
 	let firstError;
@@ -8667,20 +11239,21 @@ async function updateAggregateCheckRun(checks, taskResults, options) {
 }
 async function updateCheckRunOrError(checks, checkRun, result) {
 	try {
-		await checks.adapter.checks?.updateCheckRun?.({
+		await checks.adapter.statuses?.upsert({
 			change: checks.event,
-			checkRun,
-			conclusion: result.conclusion,
+			name: checkRun.name,
+			status: checkRun,
+			state: result.conclusion,
 			summary: result.summary
 		});
-		checks.log?.info("check run finalized", {
+		checks.log?.info("status finalized", {
 			name: checkRun.name,
 			conclusion: result.conclusion,
 			summary: result.summary
 		});
 		return;
 	} catch (error) {
-		checks.log?.warning("check run finalize failed", {
+		checks.log?.warning("status finalize failed", {
 			name: checkRun.name,
 			error: error instanceof Error ? error.message : String(error)
 		});
@@ -8747,7 +11320,7 @@ function taskCheckSettings(task) {
 	};
 }
 //#endregion
-//#region src/action/review-publishing.ts
+//#region src/host-run/review-publishing.ts
 async function runTrustedReviewAndPublish(options) {
 	const checks = await startRuntimeChecks({
 		adapter: options.adapter,
@@ -8798,13 +11371,14 @@ async function runTrustedReviewAndPublish(options) {
 		const publish = options.adapter.publication?.publish;
 		if (!publish) throw new Error("review publication is not available for this code host");
 		const publication = await options.log.group("publish review", async () => {
+			const publicationPlan = publicationPlanForHostCapabilities(review.publicationPlan, options.adapter.capabilities);
 			options.log.info("publication plan", {
-				inlineItems: review.publicationPlan.inlineItems.length,
-				threadActions: review.publicationPlan.threadActions.length
+				inlineItems: publicationPlan.inlineItems.length,
+				threadActions: publicationPlan.threadActions.length
 			});
 			const result = await publish({
 				change: options.event,
-				plan: review.publicationPlan
+				plan: publicationPlan
 			});
 			options.log.notice("publication result", {
 				main: result.mainComment.action,
@@ -8832,7 +11406,7 @@ async function runTrustedReviewAndPublish(options) {
 	}
 }
 //#endregion
-//#region src/action/git-project.ts
+//#region src/host-run/git-project.ts
 async function loadRuntimeProjectFromGitCommit(options) {
 	const configDir = resolveContainedConfigDir(options);
 	const files = listConfigFilesAtCommit(options.rootDir, options.commitSha, configDir.gitPath);
@@ -8911,7 +11485,7 @@ function showFileAtCommit(rootDir, commitSha, filePath) {
 	return runGit$1(["show", `${commitSha}:${filePath}`], rootDir);
 }
 //#endregion
-//#region src/action/trusted-runtime.ts
+//#region src/host-run/trusted-runtime.ts
 async function loadTrustedRuntimeForEvent(options, event, log) {
 	const trustedRuntime = await logPhase(log, "load trusted config", async () => loadRuntimeProjectFromGitCommit({
 		rootDir: options.rootDir,
@@ -8924,30 +11498,78 @@ async function loadTrustedRuntimeForEvent(options, event, log) {
 }
 async function prepareTrustedHeadCheckout(options, adapter, config, event, log) {
 	addProviderSecrets(log, config, options.env);
-	assertTrustedActionProviderEnv(options, config);
+	assertTrustedHostRunProviderEnv(options, config);
 	await logPhase(log, "checkout head", async () => {
-		adapter.workspace.ensureHeadCheckout({
+		await adapter.workspace.ensureHeadCheckout({
 			rootDir: options.rootDir,
 			change: event
 		});
 	});
 }
 //#endregion
-//#region src/action/command-entry.ts
-async function runIssueCommentActionCommand(options, adapter, log) {
-	const prepared = await prepareIssueCommentCommand(options, adapter, log);
+//#region src/host-run/change-request-entry.ts
+async function runChangeRequestHostRunCommand(options, adapter, log, event) {
+	logEventContext(log, event);
+	const trustedRuntime = await loadTrustedRuntimeForEvent(options, event, log);
+	if (options.dryRun) {
+		log.notice("dry run stop before review runtime, model, or GitHub publishing calls");
+		return {
+			kind: "dry-run",
+			event,
+			configSource: trustedRuntime.settings.source
+		};
+	}
+	await prepareTrustedHeadCheckout(options, adapter, trustedRuntime.settings.config, event, log);
+	const dispatch = dispatchRuntimeEntry({
+		kind: "change-request",
+		plan: trustedRuntime.plan,
+		event
+	});
+	const selectedTasks = dispatch.kind === "change-request" ? dispatch.tasks : [];
+	log.notice("dispatch", { selectedTasks: selectedTasks.map((task) => task.name) });
+	const completed = await runTrustedReviewAndPublish({
+		options,
+		adapter,
+		trustedRuntime,
+		event,
+		selectedTasks,
+		log
+	});
+	if (completed.kind === "skipped") {
+		log.notice("event ignored", { reason: completed.reason });
+		return {
+			kind: "ignored",
+			reason: completed.reason
+		};
+	}
+	if (completed.kind === "command-response") throw new Error("command response result is only supported for issue_comment commands");
+	return {
+		kind: "review",
+		event,
+		configSource: trustedRuntime.settings.source,
+		review: completed.review,
+		publication: completed.publication
+	};
+}
+//#endregion
+//#region src/host-run/command-entry.ts
+async function runIssueCommentHostRunCommand(options, adapter, log, comment) {
+	if (!adapter.capabilities.commandComments) {
+		const ignored = {
+			kind: "ignored",
+			reason: "host adapter does not support commands"
+		};
+		log.notice("event ignored", { reason: ignored.reason });
+		return ignored;
+	}
+	const prepared = await prepareIssueCommentCommand(options, adapter, log, comment);
 	if (prepared.kind === "ignored") {
-		log.notice("action ignored", { reason: prepared.reason });
+		log.notice("event ignored", { reason: prepared.reason });
 		return prepared;
 	}
 	return await dispatchIssueCommentCommand(options, adapter, prepared, log);
 }
-async function prepareIssueCommentCommand(options, adapter, log) {
-	const comment = await logPhase(log, "parse issue comment", async () => adapter.events.resolveCommandComment({
-		eventPath: options.eventPath,
-		env: options.env ?? process.env,
-		workspace: options.rootDir
-	}));
+async function prepareIssueCommentCommand(options, adapter, log, comment) {
 	const runnable = runnableIssueCommentCommand(comment, options.dryRun);
 	if (runnable.kind === "ignored") return runnable;
 	const loaded = await logPhase(log, "load change request", async () => adapter.events.loadChangeRequest({
@@ -8964,6 +11586,7 @@ async function prepareIssueCommentCommand(options, adapter, log) {
 		rawAction: loaded.rawAction ?? comment.rawAction,
 		platform: { id: adapter.id },
 		repository: loaded.repository,
+		coordinates: loaded.coordinates,
 		change: loaded.change,
 		workspace: loaded.workspace ?? comment.workspace
 	});
@@ -9008,7 +11631,7 @@ function runnableIssueCommentCommand(comment, dryRun) {
 async function dispatchIssueCommentCommand(options, adapter, prepared, log) {
 	const requiredPermission = prepared.resolution.kind === "matched" ? prepared.resolution.invocation.requiredPermission : prepared.resolution.requiredPermission;
 	const permission = await logPhase(log, "check command permission", async () => adapter.permissions.getRepositoryPermission({
-		repository: prepared.comment.repository,
+		change: prepared.event,
 		actor: prepared.comment.actor
 	}));
 	log.notice("command dispatch", {
@@ -9078,7 +11701,7 @@ async function issueCommentCommandResult(options) {
 		kind: "ignored",
 		reason: options.completed.reason
 	};
-	if (options.completed.kind === "command-response") return await publishCommandResponseActionResult({
+	if (options.completed.kind === "command-response") return await publishCommandResponseHostRunResult({
 		adapter: options.adapter,
 		completed: options.completed,
 		event: options.event,
@@ -9094,7 +11717,7 @@ async function issueCommentCommandResult(options) {
 		publication: options.completed.publication
 	};
 }
-async function publishCommandResponseActionResult(options) {
+async function publishCommandResponseHostRunResult(options) {
 	const publishCommandResponse = options.adapter.publication?.publishCommandResponse;
 	if (!publishCommandResponse) throw new Error("command response publication is not available for this code host");
 	const publication = await publishCommandResponse({
@@ -9113,76 +11736,21 @@ async function publishCommandResponseActionResult(options) {
 	};
 }
 //#endregion
-//#region src/action/pull-request-entry.ts
-async function runPullRequestActionCommand(options, adapter, log) {
-	const event = await logPhase(log, "parse event", async () => adapter.events.parseEvent({
-		eventPath: options.eventPath,
-		env: options.env ?? process.env,
-		workspace: options.rootDir
-	}));
-	logEventContext(log, event);
-	const trustedRuntime = await loadTrustedRuntimeForEvent(options, event, log);
-	if (options.dryRun) {
-		log.notice("dry run stop before review runtime, model, or GitHub publishing calls");
-		return {
-			kind: "dry-run",
-			event,
-			configSource: trustedRuntime.settings.source
-		};
-	}
-	await prepareTrustedHeadCheckout(options, adapter, trustedRuntime.settings.config, event, log);
-	const dispatch = dispatchRuntimeEntry({
-		kind: "change-request",
-		plan: trustedRuntime.plan,
-		event
-	});
-	const selectedTasks = dispatch.kind === "change-request" ? dispatch.tasks : [];
-	log.notice("dispatch", { selectedTasks: selectedTasks.map((task) => task.name) });
-	const completed = await runTrustedReviewAndPublish({
-		options,
-		adapter,
-		trustedRuntime,
-		event,
-		selectedTasks,
-		log
-	});
-	if (completed.kind === "skipped") {
-		log.notice("action ignored", { reason: completed.reason });
-		return {
-			kind: "ignored",
-			reason: completed.reason
-		};
-	}
-	if (completed.kind === "command-response") throw new Error("command response result is only supported for issue_comment commands");
-	return {
-		kind: "review",
-		event,
-		configSource: trustedRuntime.settings.source,
-		review: completed.review,
-		publication: completed.publication
-	};
-}
-//#endregion
-//#region src/action/verifier-entry.ts
-async function runReviewCommentReplyActionCommand(options, adapter, log) {
+//#region src/host-run/verifier-entry.ts
+async function runReviewCommentReplyHostRunCommand(options, adapter, log, reply) {
 	const capabilities = reviewCommentReplyDispatchCapabilities(options, adapter);
 	if (capabilities.kind === "ignored") {
-		log.notice("action ignored", { reason: capabilities.reason });
+		log.notice("event ignored", { reason: capabilities.reason });
 		return capabilities;
 	}
-	const reply = await logPhase(log, "parse review comment reply", async () => capabilities.resolveReviewCommentReply({
-		eventPath: options.eventPath,
-		env: options.env ?? process.env,
-		workspace: options.rootDir
-	}));
 	const runnable = runnableReviewCommentReply(reply);
 	if (runnable.kind === "ignored") {
-		log.notice("action ignored", { reason: runnable.reason });
+		log.notice("event ignored", { reason: runnable.reason });
 		return runnable;
 	}
 	const prepared = await prepareReviewCommentVerifier(options, adapter, reply, log);
 	if (prepared.kind === "ignored") {
-		log.notice("action ignored", { reason: prepared.reason });
+		log.notice("event ignored", { reason: prepared.reason });
 		return prepared;
 	}
 	const result = await runReviewCommentVerifier(options, adapter, prepared, log);
@@ -9203,9 +11771,9 @@ async function runReviewCommentReplyActionCommand(options, adapter, log) {
 	};
 }
 function reviewCommentReplyDispatchCapabilities(options, adapter) {
-	if (!adapter.events.resolveReviewCommentReply) return {
+	if (!adapter.capabilities.reviewCommentReplies || !adapter.capabilities.threadResolution) return {
 		kind: "ignored",
-		reason: "host adapter does not support review comment replies"
+		reason: "host adapter does not support verifier replies"
 	};
 	if (!adapter.publication?.publishThreadActions) return {
 		kind: "ignored",
@@ -9217,7 +11785,6 @@ function reviewCommentReplyDispatchCapabilities(options, adapter) {
 	};
 	return {
 		kind: "ready",
-		resolveReviewCommentReply: adapter.events.resolveReviewCommentReply,
 		publishThreadActions: adapter.publication.publishThreadActions
 	};
 }
@@ -9240,6 +11807,7 @@ async function prepareReviewCommentVerifier(options, adapter, reply, log) {
 		rawAction: loaded.rawAction ?? reply.rawAction,
 		platform: { id: adapter.id },
 		repository: loaded.repository,
+		coordinates: loaded.coordinates,
 		change: loaded.change,
 		workspace: loaded.workspace ?? reply.workspace
 	});
@@ -9345,12 +11913,12 @@ async function verifierActorAllowed(adapter, event, reply, config) {
 	if (allowed === "any") return true;
 	if (allowed === "author-or-write" && event.change.author?.login === reply.actor) return true;
 	return hasRequiredRepositoryPermission(await adapter.permissions.getRepositoryPermission({
-		repository: event.repository,
+		change: event,
 		actor: reply.actor
 	}), "write");
 }
 //#endregion
-//#region src/action/commands.ts
+//#region src/host-run/commands.ts
 /** Initializes the official minimal `.pipr` project files. */
 async function runInitCommand(options) {
 	return await initOfficialMinimalProject({
@@ -9380,21 +11948,19 @@ async function runInspectCommand(options) {
 		warnings: runtime.settings.warnings
 	};
 }
-/** Loads the runtime config and pull request event without running review publication. */
+/** Loads the runtime config and change request event without running review publication. */
 async function runDryRunCommand(options) {
 	const runtime = await loadRuntimeProject({
 		...options,
 		requireProviderEnv: false
 	});
-	const event = await createActionHostAdapter(options).events.parseEvent({
+	const hostEvent = await createHostRunAdapter(options).events.parseEvent({
 		eventPath: options.eventPath,
-		env: {
-			...options.env,
-			GITHUB_WORKSPACE: options.rootDir,
-			GITHUB_EVENT_NAME: "pull_request"
-		},
+		env: options.env ?? process.env,
 		workspace: options.rootDir
 	});
+	if (hostEvent.kind !== "change-request") throw new Error(`dry-run requires a change-request event, received ${hostEvent.kind}`);
+	const event = hostEvent.change;
 	return {
 		configSource: runtime.settings.source,
 		event,
@@ -9403,7 +11969,7 @@ async function runDryRunCommand(options) {
 }
 /** Runs configured change-request tasks against local Git base and head revisions. */
 async function runLocalReviewCommand(options) {
-	const log = options.logSink ? createRuntimeActionLog({
+	const log = options.logSink ? createRuntimeLog({
 		logSink: options.logSink,
 		env: options.env
 	}) : void 0;
@@ -9467,36 +12033,43 @@ async function runLocalReviewCommand(options) {
 	});
 	return result;
 }
-/** Runs the GitHub Action workflow for pull request and issue-comment events. */
-async function runActionCommand(options) {
-	return await runActionCommandWithDependencies(options);
+/** Runs a normalized code host event through the selected adapter. */
+async function runHostRunCommand(options) {
+	return await runHostRunCommandWithDependencies(options);
 }
-async function runActionCommandWithDependencies(options) {
-	const log = createRuntimeActionLog({
+async function runHostRunCommandWithDependencies(options) {
+	const log = createRuntimeLog({
 		logSink: options.logSink,
 		env: options.env
 	});
-	return await log.group("pipr action", async () => {
-		const eventName = (options.env ?? process.env).GITHUB_EVENT_NAME ?? "pull_request";
-		log.notice("action start", {
-			eventName,
+	return await log.group("pipr host run", async () => {
+		log.notice("host run start", {
 			dryRun: options.dryRun,
 			root: options.rootDir,
 			configDir: options.configDir
 		});
-		const adapter = createActionHostAdapter(options);
+		const adapter = createHostRunAdapter(options);
 		await logPhase(log, "workspace", async () => {
 			adapter.workspace.ensureWorkspaceSafeDirectory?.({
 				rootDir: options.rootDir,
 				env: options.env
 			});
 		});
-		if (eventName === "issue_comment") return await runIssueCommentActionCommand(options, adapter, log);
-		if (eventName === "pull_request_review_comment") return await runReviewCommentReplyActionCommand(options, adapter, log);
-		return await runPullRequestActionCommand(options, adapter, log);
+		const event = await logPhase(log, "parse event", async () => adapter.events.parseEvent({
+			eventPath: options.eventPath,
+			env: options.env ?? process.env,
+			workspace: options.rootDir
+		}));
+		log.notice("event dispatch", { kind: event.kind });
+		switch (event.kind) {
+			case "ignored": return event;
+			case "command-comment": return await runIssueCommentHostRunCommand(options, adapter, log, event.comment);
+			case "review-comment-reply": return await runReviewCommentReplyHostRunCommand(options, adapter, log, event.reply);
+			case "change-request": return await runChangeRequestHostRunCommand(options, adapter, log, event.change);
+		}
 	});
 }
 //#endregion
-export { runInspectCommand as a, PublicationError as c, supportedOfficialInitRecipes as d, piBuiltinToolNames as f, piThinkingLevels as h, runInitCommand as i, supportedOfficialInitAdapters as l, piRequiredCliFlags as m, runActionCommandWithDependencies as n, runLocalReviewCommand as o, piReadOnlyToolNames as p, runDryRunCommand as r, runValidateCommand as s, runActionCommand as t, listOfficialInitRecipes as u };
+export { supportedOfficialInitRecipes as _, runInspectCommand as a, piRequiredCliFlags as b, createGitHubHostAdapter as c, createBitbucketClient as d, createAzureDevOpsClient as f, listOfficialInitRecipes as g, supportedOfficialInitAdapters as h, runInitCommand as i, PublicationError as l, redactPotentialSecrets as m, runHostRunCommand as n, runLocalReviewCommand as o, azureOrganizationFromUrl as p, runHostRunCommandWithDependencies as r, runValidateCommand as s, runDryRunCommand as t, createGitLabClient as u, piBuiltinToolNames as v, piThinkingLevels as x, piReadOnlyToolNames as y };
 
-//# sourceMappingURL=commands-RY37Y0rG.mjs.map
+//# sourceMappingURL=commands-ZZkXwqEn.mjs.map