@webpresso/agent-kit 3.1.30 → 3.3.0

package/dist/esm/review/events.d.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+export declare const MAINTAINER_OVERRIDE_REVIEWER = "maintainer-override";
 export declare const reviewEventSchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<2>;
     id: z.ZodString;
@@ -16,12 +17,12 @@ export declare const reviewEventSchema: z.ZodObject<{
     gateId: z.ZodString;
     promptHash: z.ZodString;
     reviewer: z.ZodString;
-    provider: z.ZodEnum<{
+    provider: z.ZodOptional<z.ZodEnum<{
         claude: "claude";
         codex: "codex";
         grok: "grok";
         opencode: "opencode";
-    }>;
+    }>>;
     model: z.ZodOptional<z.ZodString>;
     effort: z.ZodOptional<z.ZodEnum<{
         high: "high";

package/dist/esm/review/events.js

@@ -9,6 +9,14 @@ const SHA256_PATTERN = /^[a-f0-9]{64}$/u;
 const COMMIT_PATTERN = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/u;
 const BLUEPRINT_SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*(?:\/[a-z0-9]+(?:-[a-z0-9]+)*)*$/u;
 const ARTIFACT_PATH_PATTERN = /^review-artifacts\/[a-zA-Z0-9._-]+\.md$/u;
+// The honest, auditable escape hatch reviewer id. A maintainer override is a
+// HUMAN adjudication (not a machine backend), recorded only by `wp review
+// override` after a real strong-reviewer rejection of the same subject. It
+// satisfies the promotion gate DISTINCTLY (never folded into a strong or
+// OpenCode-Go approval). Defined here — the lowest review-core module — so both
+// the ledger read-time policy below and the lifecycle approval gate share one
+// source of truth without an import cycle.
+export const MAINTAINER_OVERRIDE_REVIEWER = "maintainer-override";
 export const reviewEventSchema = z
     .object({
     schemaVersion: z.literal(2),
@@ -21,7 +29,10 @@ export const reviewEventSchema = z
     gateId: z.string().min(1).max(120),
     promptHash: z.string().regex(SHA256_PATTERN),
     reviewer: z.string().min(1).max(120),
-    provider: z.enum(["claude", "codex", "opencode", "grok"]),
+    // Optional: present for machine-backend reviews (always set by `wp review
+    // gate`/`log`); absent for a human maintainer-override, which has no AI
+    // backend. Descriptive metadata only — no policy keys off `provider`.
+    provider: z.enum(["claude", "codex", "opencode", "grok"]).optional(),
     model: z.string().min(1).max(240).optional(),
     effort: z.enum(["medium", "high"]).optional(),
     stage: z.string().min(1).max(120),
@@ -81,7 +92,7 @@ function orderedEvent(event) {
         gateId: event.gateId,
         promptHash: event.promptHash,
         reviewer: event.reviewer,
-        provider: event.provider,
+        ...(event.provider ? { provider: event.provider } : {}),
         ...(event.model ? { model: event.model } : {}),
         ...(event.effort ? { effort: event.effort } : {}),
         stage: event.stage,
@@ -164,10 +175,19 @@ function isManualMarker(value) {
     // dodge the policy while real gate ids (content hashes) can never collide.
     return value.trim().toLowerCase() === "manual";
 }
+// Reviewers whose manual-stage approvals are legitimate governance decisions,
+// not disguised machine approvals: a plain `human` review and a
+// `maintainer-override` (a maintainer's hand-recorded adjudication). Both are
+// human authority by construction, so a manual marker on their events is
+// expected rather than a policy dodge.
+const HUMAN_LIKE_REVIEWERS = new Set(["human", MAINTAINER_OVERRIDE_REVIEWER]);
+function isHumanLikeReviewer(reviewer) {
+    return HUMAN_LIKE_REVIEWERS.has(canonicalReviewer(reviewer));
+}
 function isManualMachineApproval(event) {
     return (isPolicyApprovalVerdict(event.verdict) &&
         (isManualMarker(event.gateId) || isManualMarker(event.stage)) &&
-        canonicalReviewer(event.reviewer) !== "human");
+        !isHumanLikeReviewer(event.reviewer));
 }
 // `compromisedIds` marks events whose artifact evidence failed integrity
 // verification. They still PARTICIPATE in reviewer supersession — a later

package/dist/esm/review/execution/adapters.d.ts

@@ -1,4 +1,14 @@
-import type { ReviewRunInput, ReviewStreamAdapter } from "./types.js";
+import type { ReviewAdapterEvent, ReviewRunInput, ReviewStreamAdapter } from "./types.js";
+/**
+ * Classify an OpenCode Go usage-limit message and derive its real reset window.
+ *
+ * Exported because the `wp opencode` launch-time health probe
+ * (`#cli/commands/opencode-probe.js`) runs the same provider text through the
+ * same classifier. A second copy of this wording/duration math would drift the
+ * moment the provider changes a phrase, and the two consumers would then
+ * disagree about whether an account is capped.
+ */
+export declare function opencodeUsageLimit(message: string): ReviewAdapterEvent | null;
 export declare const claudeReviewAdapter: ReviewStreamAdapter;
 export declare const codexReviewAdapter: ReviewStreamAdapter;
 export declare const opencodeReviewAdapter: ReviewStreamAdapter;

package/dist/esm/review/execution/adapters.js

@@ -3,7 +3,7 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { CLAUDE_DEFAULT_REVIEW_MODEL, CODEX_DEFAULT_REVIEW_MODEL, GROK_DEFAULT_REVIEW_MODEL, } from "./types.js";
-import { canonicalizeProviderFailureCode } from "./output-policy.js";
+import { canonicalizeProviderFailureCode, sanitizeProviderErrorDetail } from "./output-policy.js";
 function objectValue(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value)
         ? value
@@ -61,6 +61,18 @@ function providerErrorMessage(value) {
     ];
     return candidates.find((candidate) => typeof candidate === "string") ?? null;
 }
+// Builds a "failure" event, attaching the provider's raw diagnostic text
+// (sanitized and length-bounded) alongside the canonical short `code` when
+// one is available. `code` stays the only field the retry/classification
+// control flow reads; `message` exists purely to be surfaced to a caller who
+// is stuck debugging a generic failure code.
+function providerFailureEvent(value, code, message = providerErrorMessage(value)) {
+    return {
+        kind: "failure",
+        code,
+        ...(message ? { message: sanitizeProviderErrorDetail(message) } : {}),
+    };
+}
 function parseResetDurationMs(message) {
     const reset = message.match(/\bresets?\s+in\s+([^.'"]+)/iu)?.[1];
     if (!reset)
@@ -80,7 +92,16 @@ function parseResetDurationMs(message) {
     }
     return duration > 0 ? duration : undefined;
 }
-function opencodeUsageLimit(message) {
+/**
+ * Classify an OpenCode Go usage-limit message and derive its real reset window.
+ *
+ * Exported because the `wp opencode` launch-time health probe
+ * (`#cli/commands/opencode-probe.js`) runs the same provider text through the
+ * same classifier. A second copy of this wording/duration math would drift the
+ * moment the provider changes a phrase, and the two consumers would then
+ * disagree about whether an account is capped.
+ */
+export function opencodeUsageLimit(message) {
     if (!/\busage limit reached\b/iu.test(message))
         return null;
     const limitWindow = /\bweekly usage limit reached\b/iu.test(message)
@@ -94,6 +115,7 @@ function opencodeUsageLimit(message) {
     return {
         kind: "failure",
         code: "opencode-go-usage-limit",
+        message: sanitizeProviderErrorDetail(message),
         limitWindow,
         ...(retryAfterMs === undefined ? {} : { retryAfterMs }),
     };
@@ -104,7 +126,7 @@ function claudeEvent(value) {
         return { kind: "unsupported" };
     if (record.type === "result") {
         if (record.is_error === true || record.subtype === "error") {
-            return { kind: "failure", code: failureCode(record) };
+            return providerFailureEvent(record, failureCode(record));
         }
         return {
             kind: "terminal",
@@ -112,7 +134,7 @@ function claudeEvent(value) {
         };
     }
     if (record.type === "error")
-        return { kind: "failure", code: failureCode(record) };
+        return providerFailureEvent(record, failureCode(record));
     if (record.type === "rate_limit_event") {
         const rateLimit = objectValue(record.rate_limit_info);
         return rateLimit?.status === "rejected"
@@ -127,7 +149,7 @@ function claudeEvent(value) {
     }
     if (record.type === "assistant") {
         return typeof record.error === "string"
-            ? { kind: "failure", code: failureCode(record) }
+            ? providerFailureEvent(record, failureCode(record), record.error)
             : { kind: "progress", frontier: claudeEnvelopeFrontier(record) };
     }
     if (record.type !== "stream_event")
@@ -151,7 +173,7 @@ function claudeEvent(value) {
         return { kind: "progress", frontier: stableFrontier(event) };
     }
     if (event.type === "error")
-        return { kind: "failure", code: failureCode(event) };
+        return providerFailureEvent(event, failureCode(event));
     return { kind: "unsupported" };
 }
 function opencodeText(record) {
@@ -216,7 +238,7 @@ function opencodeEvent(value) {
     if (record.type === "error") {
         const message = providerErrorMessage(record);
         const usageLimit = message === null ? null : opencodeUsageLimit(message);
-        return usageLimit ?? { kind: "failure", code: failureCode(record) };
+        return usageLimit ?? providerFailureEvent(record, failureCode(record), message);
     }
     // OpenCode's non-interactive JSON protocol closes a completed run with
     // session.idle or step_finish(reason: "stop"); recorded Kimi and DeepSeek
@@ -293,10 +315,10 @@ function codexEvent(value) {
                     : message && /rate.?limit|quota/iu.test(message)
                         ? "rate-limit-rejected"
                         : "provider-error");
-        return { kind: "failure", code };
+        return providerFailureEvent(record, code, message);
     }
     if (type.includes("rate_limit") && /reject|limit|quota/iu.test(message ?? "")) {
-        return { kind: "failure", code: "rate-limit-rejected" };
+        return providerFailureEvent(record, "rate-limit-rejected", message);
     }
     if (type === "result" ||
         type === "final" ||
@@ -399,6 +421,10 @@ export const opencodeReviewAdapter = {
                 OPENCODE_CONFIG_CONTENT: OPENCODE_REVIEW_CONFIG,
                 OPENCODE_DISABLE_AUTOUPDATE: "true",
                 OPENCODE_DISABLE_PRUNE: "true",
+                // Isolate the credential store per account: the spawn reads
+                // `<authDataDir>/opencode/auth.json` instead of the user's global file,
+                // so mid-flight account failover never races a live interactive TUI.
+                ...(input.authDataDir ? { XDG_DATA_HOME: input.authDataDir } : {}),
             },
             cleanup: attachment.cleanup,
         };
@@ -506,7 +532,7 @@ export const grokReviewAdapter = {
             return {
                 kind: "failure",
                 code: "provider-failed",
-                message,
+                message: sanitizeProviderErrorDetail(message),
             };
         }
         return { kind: "progress", frontier: type || "event" };

package/dist/esm/review/execution/artifacts.d.ts

@@ -14,4 +14,4 @@ export interface ReviewArtifactWriter {
 export declare function reviewRunStatePath(root: string, runId: string): string;
 export type ReviewRunStateCleanupResult = "missing" | "not-running" | "removed" | "refused";
 export declare function removeOwnedRunningReviewState(root: string, runId: string, reservationToken: string): ReviewRunStateCleanupResult;
-export declare function createReviewArtifactWriter(root: string, runId: string, startedAt: string, reservationToken?: `${string}-${string}-${string}-${string}-${string}`): ReviewArtifactWriter;
+export declare function createReviewArtifactWriter(root: string, runId: string, startedAt: string, reservationToken?: string): ReviewArtifactWriter;

package/dist/esm/review/execution/output-policy.d.ts

@@ -11,4 +11,6 @@ export type ReviewOutputPolicyResult = {
 };
 export declare function sanitizeReviewOutput(value: string): string;
 export declare function applyReviewOutputPolicy(value: string, consumedBytes?: number): ReviewOutputPolicyResult;
+export declare const REVIEW_ERROR_DETAIL_MAX_CHARS = 400;
+export declare function sanitizeProviderErrorDetail(value: string): string;
 export declare function canonicalizeProviderFailureCode(value: unknown): string;

package/dist/esm/review/execution/output-policy.js

@@ -23,6 +23,18 @@ export function applyReviewOutputPolicy(value, consumedBytes = 0) {
     }
     return { ok: true, value: sanitized, bytes, totalBytes: consumedBytes + bytes };
 }
+export const REVIEW_ERROR_DETAIL_MAX_CHARS = 400;
+// Bounds and redacts a provider's raw diagnostic text (a JSON envelope's
+// error.message field, or a raw stderr line) before it is retained anywhere.
+// This feeds only the ephemeral gate state file and CLI stdout -- never the
+// durable, git-committed review ledger -- but the same secret redaction that
+// already applies to terminal/progress "result" text applies here too.
+export function sanitizeProviderErrorDetail(value) {
+    const sanitized = sanitizeReviewOutput(value).replace(/\s+/gu, " ").trim();
+    return sanitized.length > REVIEW_ERROR_DETAIL_MAX_CHARS
+        ? `${sanitized.slice(0, REVIEW_ERROR_DETAIL_MAX_CHARS)}…`
+        : sanitized;
+}
 export function canonicalizeProviderFailureCode(value) {
     if (typeof value !== "string")
         return "provider-error";

package/dist/esm/review/execution/review-checkout.js

@@ -1,8 +1,8 @@
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { lstatSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, rmSync, unlinkSync, writeFileSync, } from "node:fs";
+import { lstatSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, rmSync, symlinkSync, unlinkSync, writeFileSync, } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { basename, join } from "node:path";
 function git(cwd, args, input) {
     return execFileSync("git", [...args], {
         cwd,
@@ -23,24 +23,34 @@ function frame(hash, label, value) {
     hash.update(`${label}\0${bytes.byteLength}\0`, "utf8");
     hash.update(bytes);
 }
-function worktreeFingerprint(cwd) {
+// Fingerprint over the filtered line set `status()` produces below, minus
+// pure gitignored (`!!`) entries, so the two contamination checks
+// (`changes()`'s status() diff and the caller worktree fingerprint) cannot
+// drift apart on what counts as "source" content while still tolerating
+// expected runtime bookkeeping.
+//
+// Before the status()-alignment fix, the fingerprint hashed the raw
+// unfiltered `git status` output (without `--ignored`), so anything status()
+// already tolerates (the self-hosting bootstrap's idempotent `package.json`
+// trailing-whitespace normalization, and non-source ignored paths under
+// dist/.tshy/node_modules) could still flip the fingerprint and false-flag a
+// clean caller worktree as contaminated.
+//
+// Reusing status() alone re-introduces a different false positive: the
+// supervisor writes process records under gitignored `.webpresso/` (and similar
+// runtime roots) during the run. Those appear as `!!` lines only when
+// `--ignored` is on. Dropping `!!` here restores the prior fingerprint
+// contract for ignored paths while keeping the package.json / non-`!!` filters
+// shared with status(). Checkout-side status() still reports non-derived
+// gitignored writes (e.g. a stray `.env`) on the disposable review tree.
+function worktreeFingerprint(cwd, ignoredPaths = new Set()) {
     const hash = createHash("sha256");
-    const porcelain = git(cwd, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]);
-    frame(hash, "porcelain", porcelain);
+    const lines = status(cwd, ignoredPaths).filter((line) => !line.startsWith("!!"));
+    frame(hash, "status-lines", lines.join("\n"));
     frame(hash, "staged", gitBytes(cwd, ["diff", "--cached", "--binary", "--no-ext-diff", "HEAD", "--"]));
-    const records = porcelain.split("\0").filter(Boolean);
     const dirtyPaths = new Set();
-    for (let index = 0; index < records.length; index += 1) {
-        const record = records[index] ?? "";
-        dirtyPaths.add(record.slice(3));
-        if (record.slice(0, 2).match(/[RC]/u)) {
-            const pairedPath = records[index + 1];
-            if (pairedPath) {
-                dirtyPaths.add(pairedPath);
-                index += 1;
-            }
-        }
-    }
+    for (const line of lines)
+        dirtyPaths.add(statusEntryPath(line));
     for (const relativePath of [...dirtyPaths].filter(Boolean).toSorted()) {
         const absolutePath = join(cwd, relativePath);
         frame(hash, "dirty-path", relativePath);
@@ -60,12 +70,78 @@ function worktreeFingerprint(cwd) {
     }
     return hash.digest("hex");
 }
-function status(cwd) {
+// Path segments that mark gitignored content as NON-source: derived build
+// outputs a Promotion Gate command (`./bin/wp typecheck`/`test`/etc.)
+// regenerates while self-hosting this repo (`dist/`, `.tshy/`) and the
+// reconstructed dependency tree (`node_modules`, already separately allowlisted
+// via `ignoredPaths` when symlinked — kept here too for depth-safety, e.g. a
+// nested per-workspace-package `node_modules`). A gitignored (`!!`) path whose
+// ANY segment is one of these — at any workspace depth (e.g. `packages/x/dist`,
+// `.tshy/build.log`) — is exempt from the contamination check. Confirmed
+// empirically that the gate commands emit gitignored output exclusively under
+// these roots.
+//
+// SCOPE (deliberate, documented): this verifier enforces the review TARGET's
+// *source* integrity, not its build artifacts. It does not flag writes under a
+// derived/dependency root, because such output can reach neither the caller
+// nor the reviewed source (the checkout is a disposable tmpdir). Everything
+// else stays strict: a tracked mutation (` M `/` D `), a new untracked source
+// file (`?? `), and any NON-derived gitignored write (e.g. a stray `.env`) all
+// still surface.
+const NON_SOURCE_IGNORED_SEGMENTS = new Set(["dist", ".tshy", "node_modules"]);
+function isNonSourceIgnoredPath(relativePath) {
+    return relativePath.split("/").some((segment) => NON_SOURCE_IGNORED_SEGMENTS.has(segment));
+}
+// This repo self-hosts: a Promotion Gate command's first `./bin/wp` invocation
+// triggers wp's own bootstrap build, which runs tshy and then
+// `./bin/wp format --file package.json` — an IDEMPOTENT normalization (e.g.
+// adding a missing trailing newline). Re-running it a second time produces
+// byte-identical output modulo trailing whitespace, so it is not a source
+// mutation. Exempt ONLY that exact shape: a plain, unstaged content
+// modification (` M `) of a file literally named `package.json` whose
+// tracked-vs-working-tree bytes differ solely in trailing whitespace. Any
+// other package.json change (dependency/script/field edits, staged changes,
+// adds, deletes) still fails closed — this check never inspects JSON
+// semantics, only trailing-whitespace-normalized byte equality.
+function isNormalizedPackageJsonModification(cwd, line) {
+    if (!line.startsWith(" M "))
+        return false;
+    const relativePath = line.slice(3);
+    if (basename(relativePath) !== "package.json")
+        return false;
+    try {
+        const working = readFileSync(join(cwd, relativePath), "utf8");
+        const tracked = git(cwd, ["show", `HEAD:${relativePath}`]);
+        return working.replace(/\s+$/u, "") === tracked.replace(/\s+$/u, "");
+    }
+    catch {
+        return false;
+    }
+}
+// Single source of truth for turning a `git status --porcelain=v1` line into
+// its relative path, shared by status()'s filter predicate and
+// worktreeFingerprint()'s dirty-path hashing so both stay aligned by
+// construction. Does not special-case the rename arrow (`old -> new`); a
+// rename line's raw tail is used as-is, matching this function's prior
+// (pre-refactor) inline behavior.
+function statusEntryPath(line) {
+    return line.slice(3).replace(/\/$/u, "");
+}
+function status(cwd, ignoredPaths = new Set()) {
     const output = git(cwd, ["status", "--porcelain=v1", "--untracked-files=all", "--ignored"]);
     return output
         .split(/\r?\n/u)
-        .map((line) => line.trimEnd())
-        .filter((line) => line.length > 0);
+        .filter((line) => line.length > 0)
+        .filter((line) => {
+        const relativePath = statusEntryPath(line);
+        if (ignoredPaths.has(relativePath))
+            return false;
+        if (line.startsWith("!!") && isNonSourceIgnoredPath(relativePath))
+            return false;
+        if (isNormalizedPackageJsonModification(cwd, line))
+            return false;
+        return true;
+    });
 }
 function neutralizeSymlinks(directory) {
     for (const entry of readdirSync(directory, { withFileTypes: true })) {
@@ -111,6 +187,7 @@ export function createReviewTargetCheckout(repositoryRoot, targetSha) {
         git(cwd, ["update-ref", "HEAD", baselineHead]);
         if (status(cwd).length > 0)
             throw new Error("review target checkout was not clean at start");
+        const injectedPaths = projectCallerDependencies(repositoryRoot, cwd);
         let cleaned = false;
         return {
             cwd,
@@ -119,7 +196,7 @@ export function createReviewTargetCheckout(repositoryRoot, targetSha) {
             },
             changes: () => {
                 try {
-                    const changes = [...status(cwd)];
+                    const changes = [...status(cwd, injectedPaths)];
                     if (git(cwd, ["rev-parse", "HEAD"]).trim() !== baselineHead) {
                         changes.push("review checkout HEAD changed");
                     }
@@ -145,3 +222,26 @@ export function createReviewTargetCheckout(repositoryRoot, targetSha) {
         throw error;
     }
 }
+function projectCallerDependencies(repositoryRoot, checkoutRoot) {
+    const projected = new Set();
+    const dependencyPath = "node_modules";
+    const callerPath = join(repositoryRoot, dependencyPath);
+    const targetPath = join(checkoutRoot, dependencyPath);
+    try {
+        lstatSync(callerPath);
+    }
+    catch {
+        return projected;
+    }
+    try {
+        lstatSync(targetPath);
+        return projected;
+    }
+    catch {
+        // Missing in the target archive means the caller dependency cache may be
+        // projected for local tooling without overwriting target-owned files.
+    }
+    symlinkSync(callerPath, targetPath, "dir");
+    projected.add(dependencyPath);
+    return projected;
+}

package/dist/esm/review/execution/supervisor.js

@@ -107,6 +107,7 @@ export async function superviseReviewExecution(input, adapter, deps = {}) {
     });
     let status = null;
     let failureCode;
+    let providerErrorDetail;
     let limitWindow;
     let retryAfterMs;
     let result;
@@ -122,6 +123,10 @@ export async function superviseReviewExecution(input, adapter, deps = {}) {
     let fallbackSelectionTimer;
     let pendingFallback;
     const seenFrontiers = new Set();
+    const droppedEventWarnings = [];
+    const recordDroppedProviderEvent = (reason) => {
+        droppedEventWarnings.push(reason);
+    };
     const decoder = new StringDecoder("utf8");
     const diagnosticDecoder = new StringDecoder("utf8");
     let buffered = "";
@@ -191,6 +196,7 @@ export async function superviseReviewExecution(input, adapter, deps = {}) {
         failureCode = code;
         limitWindow = metadata.limitWindow;
         retryAfterMs = metadata.retryAfterMs;
+        providerErrorDetail = metadata.providerErrorDetail;
         requestTermination();
         finalize();
     };
@@ -228,19 +234,41 @@ export async function superviseReviewExecution(input, adapter, deps = {}) {
     const processLine = (line) => {
         if (line.trim().length === 0 || status !== null)
             return;
-        if (Buffer.byteLength(line, "utf8") > MAX_PROVIDER_EVENT_BYTES) {
-            fail("protocol-unsupported", "provider-event-too-large");
-            return;
-        }
+        const oversized = Buffer.byteLength(line, "utf8") > MAX_PROVIDER_EVENT_BYTES;
         let value;
         try {
             value = JSON.parse(line);
         }
         catch {
+            // An oversized frame that also fails to parse carries no recoverable
+            // signal (a genuinely truncated/malformed line looks the same either
+            // way) -- drop it with a warning instead of failing a run that may
+            // still receive a complete, well-formed terminal verdict later. A
+            // normal-sized malformed line is still a protocol violation.
+            if (oversized) {
+                recordDroppedProviderEvent("provider-event-too-large-unparseable");
+                return;
+            }
             fail("protocol-unsupported", "invalid-json-event");
             return;
         }
         const event = adapter.parseEvent(value);
+        if (oversized && (event.kind === "terminal" || event.kind === "failure")) {
+            // Terminal/verdict and failure frames are load-bearing: an oversized
+            // one is treated as a protocol violation, same as before this fix.
+            fail("protocol-unsupported", "provider-event-too-large");
+            return;
+        }
+        if (oversized) {
+            // Non-terminal (progress/neutral/unsupported) oversized frames are
+            // dropped rather than failing the whole run -- a provider that echoes
+            // e.g. a large lockfile read in a progress frame must not discard an
+            // otherwise-complete review verdict. See catalog/agent/rules
+            // /no-timeout-as-fix.md: the byte bound stays in place, we just stop
+            // treating "one big frame" as fatal to the whole run.
+            recordDroppedProviderEvent(`provider-event-too-large-${event.kind}`);
+            return;
+        }
         if (event.kind === "unsupported") {
             fail("protocol-unsupported", "unknown-provider-event");
             return;
@@ -249,6 +277,7 @@ export async function superviseReviewExecution(input, adapter, deps = {}) {
             fail("provider-failure", canonicalizeProviderFailureCode(event.code), {
                 ...(event.limitWindow === undefined ? {} : { limitWindow: event.limitWindow }),
                 ...(event.retryAfterMs === undefined ? {} : { retryAfterMs: event.retryAfterMs }),
+                ...(event.message === undefined ? {} : { providerErrorDetail: event.message }),
             });
             return;
         }
@@ -324,6 +353,7 @@ export async function superviseReviewExecution(input, adapter, deps = {}) {
             fail("provider-failure", canonicalizeProviderFailureCode(event.code), {
                 ...(event.limitWindow === undefined ? {} : { limitWindow: event.limitWindow }),
                 ...(event.retryAfterMs === undefined ? {} : { retryAfterMs: event.retryAfterMs }),
+                ...(event.message === undefined ? {} : { providerErrorDetail: event.message }),
             });
         }
     };
@@ -425,9 +455,11 @@ export async function superviseReviewExecution(input, adapter, deps = {}) {
             markerMatched,
             ...(result === undefined ? {} : { result }),
             ...(terminalFailureCode === undefined ? {} : { failureCode: terminalFailureCode }),
+            ...(providerErrorDetail === undefined ? {} : { providerErrorDetail }),
             ...(limitWindow === undefined ? {} : { limitWindow }),
             ...(retryAfterMs === undefined ? {} : { retryAfterMs }),
             summaryPath: artifacts.summaryPath,
+            ...(droppedEventWarnings.length > 0 ? { warnings: [...droppedEventWarnings] } : {}),
         };
     }
     function recordReviewProcessStart(reviewChild, processGroupId) {

package/dist/esm/review/execution/types.d.ts

@@ -19,6 +19,12 @@ export interface ReviewRunInput {
     readonly cwd?: string;
     readonly registryRoot?: string;
     readonly signal?: AbortSignal;
+    /**
+     * Isolated opencode auth store directory for this spawn. When set, the
+     * opencode adapter injects it as `XDG_DATA_HOME` so the child reads a
+     * per-account `auth.json` instead of the user's global credential store.
+     */
+    readonly authDataDir?: string;
 }
 export interface ReviewInvocation {
     readonly command: string;
@@ -41,6 +47,7 @@ export type ReviewAdapterEvent = {
 } | {
     readonly kind: "failure";
     readonly code: string;
+    readonly message?: string;
     readonly limitWindow?: ReviewLimitWindow;
     readonly retryAfterMs?: number;
 } | {
@@ -70,7 +77,9 @@ export interface ReviewRunSummary {
     readonly markerMatched: boolean | null;
     readonly result?: string;
     readonly failureCode?: string;
+    readonly providerErrorDetail?: string;
     readonly limitWindow?: ReviewLimitWindow;
     readonly retryAfterMs?: number;
     readonly summaryPath: string;
+    readonly warnings?: readonly string[];
 }

package/dist/esm/review/opencode-account.d.ts

@@ -0,0 +1,24 @@
+import { type OpencodeAccountAvailabilityState } from "./availability.js";
+export interface OpencodeAccount {
+    readonly id: string;
+    readonly secretName: string;
+    readonly key: string;
+}
+export interface OpencodeAccountSelection {
+    readonly account: OpencodeAccount;
+    readonly cooled: boolean;
+    readonly waitMs?: number;
+}
+/**
+ * Discover opencode-go accounts from Doppler-sourced secrets shaped
+ * `OPENCODE_GO_KEY_<ID>`. Sorted by id ascending, de-duplicated by id.
+ */
+export declare function resolveOpencodeAccounts(secrets: Readonly<Record<string, string>>): readonly OpencodeAccount[];
+export declare function opencodeAccountCanonicalId(id: string): string;
+export declare function opencodeAccountDataDir(id: string, stateRoot?: string): string;
+/**
+ * Select the account to use for the next opencode-go invocation. Callers must
+ * prune expired suppressions in `state` before calling this (via
+ * `pruneExpiredOpencodeAccountSuppressions`).
+ */
+export declare function selectActiveOpencodeAccount(accounts: readonly OpencodeAccount[], state: OpencodeAccountAvailabilityState, nowMs?: number): OpencodeAccountSelection | undefined;