claude-dev-env 1.81.0 → 1.83.0

package/skills/autoconverge/workflow/converge.mjs

@@ -29,13 +29,19 @@ const CONFIG = {
   bugteamRubric: '$HOME/.claude/skills/bugteam/reference/audit-contract.md',
 }
 
+const REVIEWER_GATE_SENTINEL = 'CLAUDE_REVIEWER_GATE=autoconverge '
+
 const HEADLESS_SAFETY_PREAMBLE =
   'HEADLESS RUN — you run unattended: no human can answer a permission or confirmation prompt, and any such prompt stalls the entire convergence run. The destructive_command_blocker hook matches dangerous patterns (rm -rf, git reset --hard, dd, mkfs, chmod -R, fork bombs) as raw text anywhere in a Bash command, with no quote-awareness — so a destructive string stalls you even when it is only data you never execute. Therefore:\n' +
   '- Never place a destructive-command literal inside a Bash command — not in echo, not in a heredoc, and not as an argument to python -c, node -e, or awk. To exercise or verify destructive_command_blocker (or any hook) behavior, run the committed test suite, e.g. python -m pytest <test_file>, which passes the command strings as in-language data rather than as a shell command.\n' +
   '- When a commit message, or a PR / issue / review-comment body, must describe destructive-command behavior, write that text to a file and pass it by path (git commit -F <file>, gh ... --body-file <file>); never inline it with git commit -m or gh ... -b, where the literal lands in the Bash command and stalls you.\n' +
   '- Keep scratch files and cleanup inside the OS temp dir; never target a repository or worktree path.\n' +
   '- rm shape rules — the hook grants several rm auto-allow paths. The simplest one accepts a standalone Bash call whose target resolves inside the ephemeral namespace (/tmp, /temp, the OS temp root, or the run worktree); a compound path accepts an rm joined with benign reporting segments when every rm target is an absolute ephemeral path. Both of those paths fail closed on $(...) command substitution and on backtick subshells. The compound path additionally fails closed on any $ in the target — including $CLAUDE_JOB_DIR. The standalone path declines a $-bearing target only when the literal path is not already under an ephemeral root, so it does not by itself stop a $VAR that expands inside an ephemeral root. A third, broad path matches only when the command itself declares an ephemeral working directory (it cds into one, or runs under one): that cwd-scoped path resolves the target against the declared cwd, fails closed on $(...) , backticks, and unknown variables, and resolves the known temporary variables TEMP, TMP, TMPDIR, and CLAUDE_JOB_DIR to the OS temp root, so under that declared ephemeral cwd a bare $CLAUDE_JOB_DIR/tmp/<name> target and a relative target after a cd are auto-allowed. Even so, prefer a Python helper for any cleanup whose path is variable-built or whose setup/teardown spans multiple steps: author the helper file and run it as python <file>.py, which keeps every destructive literal out of a Bash command string entirely and never depends on which auto-allow path matches.\n' +
-  '- If a step appears to require a real destructive command, use a non-destructive equivalent or report it as a blocker instead of running it.\n\n'
+  '- If a step appears to require a real destructive command, use a non-destructive equivalent or report it as a blocker instead of running it.\n\n' +
+  'WAITS AND POLLS — foreground sleep is blocked in this headless harness: a bare Bash "sleep N" or a PowerShell "Start-Sleep" is denied, and a wait you move to a background process — then end your turn to await it — never resumes, because a schema-bearing agent runs for a single turn. Therefore:\n' +
+  '- Perform every required delay or poll-interval wait inside this same turn by pairing the Monitor tool with a bounded until-loop: the Monitor tool streams its events to you while you keep working, and the until-loop re-runs the step condition on the interval the step names, up to the attempt budget the step names, exiting the moment the condition holds or the budget is spent — consume the Monitor notifications as they arrive rather than ending your turn to await them. Never end your turn to wait for something to finish.\n' +
+  '- Size the Monitor to the whole wait: its timeout_ms defaults to 300000 (300 seconds) and the Monitor is killed the moment that elapses, so a poll whose interval or whose interval-times-attempts span runs longer registers a false time-out. Before you arm a Monitor, set timeout_ms to at least the poll interval times the attempt count the step names — up to the 3600000ms ceiling — or pass persistent: true so the Monitor is never timed out. A 360-second interval, or a many-minute total, exceeds the 300000 default, so arming the Monitor with the default truncates the wait; set timeout_ms to the step span instead.\n' +
+  '- When your run was given a result schema, your final action is always the StructuredOutput call. If the poll budget is spent before the awaited signal arrives, call StructuredOutput with the whole time-out result the step documents — for the Copilot gate, the full down result {sha, clean:false, down:true, findings:[]}, never a bare down flag — rather than ending the turn without a result.\n\n'
 
 let activeRepoPath = null
 
@@ -102,7 +108,7 @@ function runGitTask(task, head) {
     `Report whether ${prCoordinates} (HEAD ${head}) has merge conflicts with its base branch. Do not edit, commit, push, or rebase — read only.\n\n` +
       `GitHub computes mergeability asynchronously, so .mergeable is null right after a push until it finishes. Poll until it resolves: run\n` +
       `   gh api repos/${input.owner}/${input.repo}/pulls/${input.prNumber} --jq '{mergeable: .mergeable, state: .mergeable_state}'\n` +
-      `up to 5 times, 5 seconds apart (delay each retry with "sleep 5", or the PowerShell alternative "Start-Sleep -Seconds 5"), stopping as soon as mergeable is true or false.\n\n` +
+      `up to 5 times, 5 seconds apart (wait each 5-second interval inside this turn with the Monitor tool, per the WAITS AND POLLS rule above), stopping as soon as mergeable is true or false.\n\n` +
       `Return conflicting:true when mergeable is false or state is "dirty" (the branch conflicts with the base). Return conflicting:false when mergeable is true, or when mergeable stays null after the full poll budget — mergeability is unknown, so let the bug checks proceed rather than rebase on a guess.`,
     { label: 'git-utility', phase: 'Converge', schema: MERGE_CONFLICT_SCHEMA, agentType: 'Explore' },
   )
@@ -205,7 +211,7 @@ async function fixerWithRecovery(head, findings, sourceLabel) {
  * Each task carries its own edit instructions.
  * @param {string} task the short task name
  * @param {object} context task-specific context
- * @returns {Promise<object|string>} the structured output, or the transcript string when a schema-less task ('hardening-commit', 'standards-resolve-threads') runs
+ * @returns {Promise<object|string>} the structured output, or the transcript string when a schema-less task ('standards-resolve-threads') runs
  */
 function runCodeEditorTask(task, context) {
   const label = `code-editor:${task}`
@@ -312,9 +318,10 @@ function runCodeEditorTask(task, context) {
       `You are the COMMIT step opening the environment-hardening PR (${context.sourceLabel}) for the change staged in ${context.hardeningRepoPath} on branch ${context.hardeningBranch}. The edit step left the hooks/rules edits in the working tree and the verify step passed, so a verifier verdict already binds to this exact working tree. Do NOT touch the PR's own branch.\n\n` +
         `Rules:\n` +
         `- Make NO further file edits of any kind. Any edit changes the surface and invalidates the verdict that unlocks the commit gate, so the push would be blocked. Only commit and push what is already there.\n` +
-        `- In ${context.hardeningRepoPath}: make ONE commit of the staged hooks/rules change on branch ${context.hardeningBranch}, push it, then open a DRAFT PR. The PR body references the follow-up issue ${context.issueUrl || '(none)'} and states the PR hardens the environment so the deferred violation classes are blocked at Write/Edit time. Honor the gh-body-file rule: write a BOM-free temp file and pass --body-file.\n\n` +
-        `Return a one-line summary naming the hardening PR URL.`,
-      { label, phase: 'Converge', agentType: 'clean-coder' },
+        `- In ${context.hardeningRepoPath}: make ONE commit of the staged hooks/rules change on branch ${context.hardeningBranch}, push it, then open a DRAFT PR. The PR body references the follow-up issue ${context.issueUrl || '(none)'} and states the PR hardens the environment so the deferred violation classes are blocked at Write/Edit time. Honor the gh-body-file rule: write a BOM-free temp file and pass --body-file.\n` +
+        `- Title the PR as a Conventional Commit — a type prefix (feat, fix, chore, docs, refactor, perf, ci, style, test, build, revert), an optional scope in parentheses, then a colon and a short summary, e.g. "feat(hooks): block the deferred violation class". The target repo's CI validates the PR title as a semantic commit and rejects a non-conforming title.\n\n` +
+        `Return the full https URL of the DRAFT hardening PR in hardeningPrUrl (empty string when no PR was opened) and a one-line summary.`,
+      { label, phase: 'Converge', schema: HARDENING_COMMIT_SCHEMA, agentType: 'clean-coder' },
     )
   }
   if (task === 'commit-recover') {
@@ -459,6 +466,27 @@ function runConvergenceCheck(context) {
   )
 }
 
+/**
+ * Spawn a single reviewer-availability Explore agent once per CONVERGE round,
+ * before either reviewer's own agent is spawned. It runs the shared
+ * reviewer_availability.py CLI for both Copilot and Bugbot and reports each
+ * one's down state and reason, so resolveReviewerDown can decide whether to
+ * spawn the Bugbot lens and the Copilot gate without depending on an
+ * externally pre-set input flag.
+ * @returns {Promise<object>} REVIEWER_AVAILABILITY_SCHEMA result
+ */
+function runReviewerAvailabilityCheck() {
+  return convergeAgent(
+    `Check whether GitHub Copilot and Cursor Bugbot are available to review ${prCoordinates} this round, before either reviewer's agent is spawned. Do not edit code, commit, or push.\n\n` +
+      `Run exactly:\n` +
+      `python "${CONFIG.prLoopScripts}/reviewer_availability.py" --reviewer copilot\n` +
+      `python "${CONFIG.prLoopScripts}/reviewer_availability.py" --reviewer bugbot\n` +
+      `Each run exits 0 when that reviewer is available and non-zero when it is down, and prints one line naming the reason (stdout when available, stderr when down) — capture that line.\n\n` +
+      `Return strictly the schema: copilot.down and bugbot.down report whether that reviewer's run exited non-zero, and copilot.reason / bugbot.reason carry its printed line.`,
+    { label: 'reviewer-availability', phase: 'Converge', schema: REVIEWER_AVAILABILITY_SCHEMA, agentType: 'Explore' },
+  )
+}
+
 const PRE_COMMIT_GATE_STEP =
   `\n\nFINAL STEP — pre-commit gate check (do NOT commit): before your turn ends, prove your working-tree changes CAN be committed by dry-running the CODE_RULES commit gate that gates git commit (precommit_code_rules_gate). From inside the checkout that holds your changes, resolve its root with git rev-parse --show-toplevel, stage your changes with git add -A, then run exactly:\n` +
   `   python "${CONFIG.prLoopScripts}/code_rules_gate.py" --repo-root "<that root>" --staged\n` +
@@ -504,6 +532,32 @@ const COPILOT_SCHEMA = {
   required: ['sha', 'clean', 'down', 'findings'],
 }
 
+const REVIEWER_AVAILABILITY_SCHEMA = {
+  type: 'object',
+  additionalProperties: false,
+  properties: {
+    copilot: {
+      type: 'object',
+      additionalProperties: false,
+      properties: {
+        down: { type: 'boolean', description: 'true when reviewer_availability.py --reviewer copilot exited non-zero (opted out or out of premium-request quota)' },
+        reason: { type: 'string', description: 'the one-line reason reviewer_availability.py printed for Copilot' },
+      },
+      required: ['down', 'reason'],
+    },
+    bugbot: {
+      type: 'object',
+      additionalProperties: false,
+      properties: {
+        down: { type: 'boolean', description: 'true when reviewer_availability.py --reviewer bugbot exited non-zero (opted out via CLAUDE_REVIEWS_DISABLED)' },
+        reason: { type: 'string', description: 'the one-line reason reviewer_availability.py printed for Bugbot' },
+      },
+      required: ['down', 'reason'],
+    },
+  },
+  required: ['copilot', 'bugbot'],
+}
+
 const HEAD_SCHEMA = {
   type: 'object',
   additionalProperties: false,
@@ -583,6 +637,16 @@ const STANDARDS_EDIT_SCHEMA = {
   required: ['issueUrl', 'hardeningRepoPath', 'hardeningBranch', 'hardeningEdited', 'summary'],
 }
 
+const HARDENING_COMMIT_SCHEMA = {
+  type: 'object',
+  additionalProperties: false,
+  properties: {
+    hardeningPrUrl: { type: 'string', description: 'the full https URL of the DRAFT environment-hardening PR the commit step opened, or an empty string when no PR was opened' },
+    summary: { type: 'string' },
+  },
+  required: ['hardeningPrUrl', 'summary'],
+}
+
 /**
  * Build the verdict-fence step instructions for a verify agent, binding the
  * surface hash by branch name rather than by a self-resolved cwd. Resolving
@@ -734,19 +798,27 @@ function isMoreSevere(candidateSeverity, currentSeverity) {
 }
 
 /**
- * Decide whether the convergence check should bypass the Bugbot gate this round,
- * recomputed from the current Bugbot lens result rather than latched across the
- * run, so a recovered Bugbot re-arms the gate. A dead lens agent (null/undefined
- * result) produces no Bugbot verdict on this HEAD, so it is treated as down to
- * keep the convergence gate from demanding a verdict that cannot exist.
- * @param {object|null|undefined} bugbotLens the current round's Bugbot lens result
- * @param {boolean} bugbotDisabled true when Bugbot is opted out for the whole run
- * @returns {boolean} true when the Bugbot gate is bypassed for the current HEAD
+ * Decide whether a reviewer is skipped this round — the one shared gate both
+ * Bugbot and Copilot consult before either reviewer's agent is spawned. The
+ * run's own disable flag always wins, so a deferred PR seeded with
+ * copilotDisabled or bugbotDisabled skips the reviewer without a probe.
+ * Otherwise the decision comes from the carried entry's down field, read from
+ * the round-start availability probe for a pre-spawn decision. A missing entry
+ * (a dead probe agent, or no result yet) reads as available rather than down,
+ * so an outage in the probe itself never wedges convergence — the reviewer's
+ * own runtime detection still runs and can report down on its own. This
+ * fail-open null handling suits a pre-spawn decision; a caller computing a
+ * post-round verdict from a reviewer's own lens/gate result — where a dead
+ * agent has no verdict to report, not an available one — guards that null
+ * case itself before calling this function.
+ * @param {{down: boolean}|null|undefined} reviewerAvailabilityEntry the probe's per-reviewer entry, or a reviewer's own result, carrying a down field
+ * @param {boolean} isReviewerDisabledByInput true when the run input opts this reviewer out for the whole run
+ * @returns {boolean} true when the reviewer is treated as down this round
  */
-function resolveBugbotDown(bugbotLens, bugbotDisabled) {
-  if (bugbotDisabled) return true
-  if (bugbotLens == null) return true
-  return bugbotLens.down === true
+function resolveReviewerDown(reviewerAvailabilityEntry, isReviewerDisabledByInput) {
+  if (isReviewerDisabledByInput) return true
+  if (reviewerAvailabilityEntry == null) return false
+  return reviewerAvailabilityEntry.down === true
 }
 
 /**
@@ -1000,9 +1072,10 @@ function classifyCopilotOutcome(copilot) {
 
 /**
  * Decide whether the Copilot review gate is bypassed for this COPILOT pass from
- * the gate outcome, mirroring resolveBugbotDown so the flag is recomputed every
- * pass rather than left sticky. Only a 'down' outcome (Copilot out of quota or
- * unreachable after the poll cap) bypasses the convergence Copilot gate; an
+ * the gate outcome, mirroring resolveReviewerDown's post-round bugbotDown
+ * recompute so the flag is recomputed every pass rather than left sticky. Only
+ * a 'down' outcome (Copilot out of quota or unreachable after the poll cap)
+ * bypasses the convergence Copilot gate; an
  * 'approved', 'fix', or 'retry' outcome means Copilot answered this pass, so the
  * gate must be evaluated against its review and is never bypassed. Recomputing
  * from the current outcome is what lets a recovered Copilot — one that returns
@@ -1090,9 +1163,6 @@ const prCoordinates = `owner=${input.owner} repo=${input.repo} PR #${input.prNum
  * @returns {Promise<object>} LENS_SCHEMA result
  */
 function runBugbotLens(head) {
-  if (input.bugbotDisabled) {
-    return Promise.resolve({ sha: head, clean: true, down: true, findings: [] })
-  }
   return convergeAgent(
     `You are the Cursor Bugbot lens for ${prCoordinates}, HEAD ${head}. Cursor Bugbot participates this run.\n\n` +
       `Goal: return Bugbot's verdict on HEAD ${head}. Do not edit code, commit, or push. You may post the literal trigger comment described below.\n\n` +
@@ -1105,7 +1175,7 @@ function runBugbotLens(head) {
       `   Only count entries whose commit_id starts with ${head}.\n` +
       `   - If findings exist on HEAD -> return them (each with its inline comment id in replyToCommentId when present, else null).\n` +
       `   - If a clean review exists on HEAD -> return clean.\n` +
-      `4. No review yet on HEAD: check_bugbot_ci.py --check-active. If active (exit 0), poll: repeat check_bugbot_ci.py --check-clean / --check-active every 60 seconds (delay each iteration with "sleep 60", or the PowerShell alternative "Start-Sleep -Seconds 60") for up to 25 iterations, then re-fetch the review. If not active (exit 1), post the literal comment "bugbot run" (no @mention, no other text) via python "${CONFIG.sharedScripts}/post_fix_reply.py" --owner ${input.owner} --repo ${input.repo} --pr-number ${input.prNumber} --body "bugbot run", delay 8 seconds with "sleep 8" (PowerShell alternative "Start-Sleep -Seconds 8"), then poll as above.\n` +
+      `4. No review yet on HEAD: check_bugbot_ci.py --check-active. If active (exit 0), poll: repeat check_bugbot_ci.py --check-clean / --check-active every 60 seconds (wait each 60-second interval inside this turn with the Monitor tool, per the WAITS AND POLLS rule above) for up to 25 iterations, then re-fetch the review. If not active (exit 1), post the literal comment "bugbot run" (no @mention, no other text) via ${REVIEWER_GATE_SENTINEL}python "${CONFIG.sharedScripts}/post_fix_reply.py" --owner ${input.owner} --repo ${input.repo} --pr-number ${input.prNumber} --body "bugbot run", wait 8 seconds inside this turn with the Monitor tool (per the WAITS AND POLLS rule above), then poll as above.\n` +
       `5. If after the full poll budget Bugbot has neither a check run nor a review on HEAD -> return {sha:${'`'}${head}${'`'}, clean:true, down:true, findings:[]} (treat as down).\n\n` +
       `Scope is the whole PR; you are only reading Bugbot's own output here. For each finding set category: 'code-standard' when it is a pure CODE_RULES/style violation (naming, comments, type hints, magic values, structure) with no behavioral impact; 'bug' otherwise. Return strictly the schema.`,
     { label: 'lens:bugbot', phase: 'Converge', schema: LENS_SCHEMA },
@@ -1299,8 +1369,8 @@ function runCopilotGate(head) {
     `You are the Copilot gate for ${prCoordinates}, HEAD ${head}. Do not edit code, commit, or push.\n\n` +
       `Copilot can run out of usage. When the newest Copilot review on HEAD carries an out-of-usage notice — a body stating Copilot was unable to review because the user who requested the review has reached their quota limit, or any equivalent quota / premium-request / usage-limit exhaustion message rather than an actual code review — Copilot is down for this run: return {sha:${'`'}${head}${'`'}, clean:true, down:true, findings:[]} and stop. Do NOT re-request a review, do NOT keep polling, and do NOT treat the notice as a finding.\n\n` +
       `1. Read any existing Copilot review on HEAD first: python "${CONFIG.sharedScripts}/fetch_copilot_reviews.py" --owner ${input.owner} --repo ${input.repo} --pr-number ${input.prNumber}. This lists every Copilot review across all commits newest-first; only count entries whose commit_id starts with ${head}. If the newest such HEAD-scoped Copilot review is the out-of-usage notice above -> return the down result and stop. A notice on any earlier commit is NOT down: ignore it and continue. With no Copilot review on HEAD, skip a duplicate request: python "${CONFIG.sharedScripts}/check_pending_reviews.py" --owner ${input.owner} --repo ${input.repo} --pr-number ${input.prNumber} --user copilot. Exit 0 means a request is already pending; otherwise request one:\n` +
-      `   gh api --method POST repos/${input.owner}/${input.repo}/pulls/${input.prNumber}/requested_reviewers -f 'reviewers[]=copilot-pull-request-reviewer[bot]'\n` +
-      `2. Poll for Copilot's review on HEAD ${head}: up to ${CONFIG.copilotMaxPolls} attempts, 360 seconds apart (delay each attempt with "sleep 360", or the PowerShell alternative "Start-Sleep -Seconds 360"). Each attempt: python "${CONFIG.sharedScripts}/fetch_copilot_reviews.py" --owner ${input.owner} --repo ${input.repo} --pr-number ${input.prNumber} for the top-level review state, plus gh api "repos/${input.owner}/${input.repo}/pulls/${input.prNumber}/comments" --paginate --slurp for inline comment ids (Copilot's login contains "copilot", case-insensitive). Only count entries whose commit_id starts with ${head}.\n` +
+      `   ${REVIEWER_GATE_SENTINEL}gh api --method POST repos/${input.owner}/${input.repo}/pulls/${input.prNumber}/requested_reviewers -f 'reviewers[]=copilot-pull-request-reviewer[bot]'\n` +
+      `2. Poll for Copilot's review on HEAD ${head}: up to ${CONFIG.copilotMaxPolls} attempts, 360 seconds apart (wait each 360-second interval inside this turn with the Monitor tool, per the WAITS AND POLLS rule above; if the attempt budget is spent with no review on HEAD, return down: true). Each attempt: python "${CONFIG.sharedScripts}/fetch_copilot_reviews.py" --owner ${input.owner} --repo ${input.repo} --pr-number ${input.prNumber} for the top-level review state, plus gh api "repos/${input.owner}/${input.repo}/pulls/${input.prNumber}/comments" --paginate --slurp for inline comment ids (Copilot's login contains "copilot", case-insensitive). Only count entries whose commit_id starts with ${head}.\n` +
       `   - Out-of-usage notice on HEAD -> return the down result above (clean:true, down:true) and stop.\n` +
       `   - Copilot review present on HEAD whose state is APPROVED, or COMMENTED with no inline findings -> a clean pass: return {sha:${'`'}${head}${'`'}, clean:true, down:false, findings:[]}.\n` +
       `   - Copilot findings on HEAD -> return them (each with its inline comment id in replyToCommentId; category 'code-standard' for pure CODE_RULES/style violations with no behavioral impact, 'bug' otherwise), clean:false, down:false.\n` +
@@ -1436,6 +1506,25 @@ function standardsDeferralNote(findingsCount, wasHardeningPrOpened) {
     : `${base} — verify it lands (no environment-hardening PR was opened for this run)`
 }
 
+/**
+ * Parse a GitHub pull-request URL into the owner, repo, and number a recursive
+ * converge run needs to address it.
+ *
+ * A hardening PR the commit step opens returns its URL as
+ * `https://github.com/<owner>/<repo>/pull/<number>`; this reads those three
+ * coordinates back out so the self-closing orchestrator can converge the
+ * deferred PR in turn. A blank or non-matching string yields null, so a commit
+ * step that opened no PR contributes no deferred coordinate.
+ * @param {string} prUrl the hardening PR's https URL, or an empty string
+ * @returns {{owner: string, repo: string, prNumber: number}|null} the parsed coordinates, or null when the URL does not match
+ */
+function parseDeferredPr(prUrl) {
+  if (typeof prUrl !== 'string') return null
+  const match = prUrl.match(/^https:\/\/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)\/?(?:[?#].*)?$/)
+  if (!match) return null
+  return { owner: match[1], repo: match[2], prNumber: Number(match[3]) }
+}
+
 /**
  * Defer a standards-only round: edit (clean-coder files the follow-up fix issue,
  * stages an environment-hardening hooks/rules change in the config repo's
@@ -1451,28 +1540,35 @@ function standardsDeferralNote(findingsCount, wasHardeningPrOpened) {
  * @param {Array<object>} findings deduped code-standard-only findings
  * @param {string} sourceLabel short description of where the findings came from
  * @param {boolean} hasHardeningPrAlreadyOpened true when an earlier round already opened the environment-hardening PR for this run, so the verify and commit steps are skipped and no second PR opens while the edit retries the issue filing
- * @returns {Promise<object>} `{ followUpIssueFiled, issueUrl, hardeningPrOpened }` — followUpIssueFiled true when the standards-edit step returned a non-empty issue URL, issueUrl that filed URL (empty string when the filing failed) so a later reuse-path round can reference it when resolving its own threads, hardeningPrOpened true only when the hardening PR was opened on this call
+ * @param {{copilotDisabled: boolean, bugbotDisabled: boolean}} deferredReviewerFlags this run's latest resolved reviewer-down state, carried onto the deferred PR so a later generation converging it seeds the known-unavailable state instead of re-learning it
+ * @returns {Promise<object>} `{ followUpIssueFiled, issueUrl, hardeningPrOpened, deferredPr }` — followUpIssueFiled true when the standards-edit step returned a non-empty issue URL, issueUrl that filed URL (empty string when the filing failed) so a later reuse-path round can reference it when resolving its own threads, hardeningPrOpened true when the hardening-commit step returned a non-empty hardeningPrUrl (a PR opened) so the run-once latch holds even when that URL does not parse into coordinates, and false when the commit step returned an empty URL (no PR opened) so a later round retries the open, and deferredPr the opened PR's `{owner, repo, prNumber, copilotDisabled, bugbotDisabled}` (null when no PR was opened or the committed URL does not parse) so the self-closing orchestrator can converge it in turn
  */
-async function spawnStandardsFollowUp(head, findings, sourceLabel, hasHardeningPrAlreadyOpened) {
+async function spawnStandardsFollowUp(head, findings, sourceLabel, hasHardeningPrAlreadyOpened, deferredReviewerFlags) {
   const editResult = await runCodeEditorTask('standards-edit', { head, findings, sourceLabel })
   const followUpIssueFiled = typeof editResult?.issueUrl === 'string' && editResult.issueUrl.length > 0
   const followUpIssueUrl = followUpIssueFiled ? editResult.issueUrl : ''
   if (hasHardeningPrAlreadyOpened === true) {
-    return { followUpIssueFiled, issueUrl: followUpIssueUrl, hardeningPrOpened: false }
+    return { followUpIssueFiled, issueUrl: followUpIssueUrl, hardeningPrOpened: false, deferredPr: null }
   }
   if (editResult?.hardeningEdited !== true || !editResult?.hardeningRepoPath) {
-    return { followUpIssueFiled, issueUrl: followUpIssueUrl, hardeningPrOpened: false }
+    return { followUpIssueFiled, issueUrl: followUpIssueUrl, hardeningPrOpened: false, deferredPr: null }
   }
   const verifyTranscript = await runVerifierTask('hardening-verify', {
     head, sourceLabel, hardeningRepoPath: editResult.hardeningRepoPath, hardeningBranch: editResult.hardeningBranch,
   })
   if (!verdictPassed(verifyTranscript)) {
-    return { followUpIssueFiled, issueUrl: followUpIssueUrl, hardeningPrOpened: false }
+    return { followUpIssueFiled, issueUrl: followUpIssueUrl, hardeningPrOpened: false, deferredPr: null }
   }
-  await runCodeEditorTask('hardening-commit', {
+  const commitResult = await runCodeEditorTask('hardening-commit', {
     head, sourceLabel, hardeningRepoPath: editResult.hardeningRepoPath, hardeningBranch: editResult.hardeningBranch, issueUrl: editResult.issueUrl,
   })
-  return { followUpIssueFiled, issueUrl: followUpIssueUrl, hardeningPrOpened: true }
+  const parsedDeferredPr = parseDeferredPr(commitResult?.hardeningPrUrl)
+  const deferredPr =
+    parsedDeferredPr === null
+      ? null
+      : { ...parsedDeferredPr, copilotDisabled: deferredReviewerFlags.copilotDisabled, bugbotDisabled: deferredReviewerFlags.bugbotDisabled }
+  const hardeningPrOpened = typeof commitResult?.hardeningPrUrl === 'string' && commitResult.hardeningPrUrl.length > 0
+  return { followUpIssueFiled, issueUrl: followUpIssueUrl, hardeningPrOpened, deferredPr }
 }
 
 /**
@@ -1525,21 +1621,22 @@ async function resolveStandardsThreadsForBatch(head, findings, sourceLabel) {
  * @param {string} head PR HEAD SHA the findings were raised against
  * @param {Array<object>} findings deduped code-standard-only findings
  * @param {string} sourceLabel short description of where the findings came from
- * @returns {Promise<boolean>} true when a hardening PR was opened for this run
+ * @param {{copilotDisabled: boolean, bugbotDisabled: boolean}} deferredReviewerFlags this run's latest resolved reviewer-down state, carried onto the deferred PR so a later generation converging it seeds the known-unavailable state instead of re-learning it
+ * @returns {Promise<object>} `{ hardeningPrOpened, deferredPr }` — hardeningPrOpened true when a hardening PR was opened for this run, and deferredPr the opened PR's `{owner, repo, prNumber, copilotDisabled, bugbotDisabled}` when this call opened it (null otherwise) so the self-closing orchestrator can converge it in turn
  */
-async function openStandardsFollowUpOnce(head, findings, sourceLabel) {
+async function openStandardsFollowUpOnce(head, findings, sourceLabel, deferredReviewerFlags) {
   if (!shouldOpenStandardsFollowUp(hasStandardsFollowUpFiled)) {
     log(`Standards deferral (${sourceLabel}): reusing the follow-up fix issue already filed for this run rather than filing a duplicate; environment-hardening PR ${wasStandardsHardeningPrOpened ? 'was opened for this run' : 'was not opened for this run'}`)
     await resolveStandardsThreadsForBatch(head, findings, sourceLabel)
-    return wasStandardsHardeningPrOpened
+    return { hardeningPrOpened: wasStandardsHardeningPrOpened, deferredPr: null }
   }
-  const standardsOutcome = await spawnStandardsFollowUp(head, findings, sourceLabel, wasStandardsHardeningPrOpened)
+  const standardsOutcome = await spawnStandardsFollowUp(head, findings, sourceLabel, wasStandardsHardeningPrOpened, deferredReviewerFlags)
   hasStandardsFollowUpFiled = standardsOutcome?.followUpIssueFiled === true
   if (hasStandardsFollowUpFiled) {
     standardsFollowUpIssueUrl = standardsOutcome.issueUrl
   }
   wasStandardsHardeningPrOpened = wasStandardsHardeningPrOpened || standardsOutcome?.hardeningPrOpened === true
-  return wasStandardsHardeningPrOpened
+  return { hardeningPrOpened: wasStandardsHardeningPrOpened, deferredPr: standardsOutcome?.deferredPr ?? null }
 }
 
 let phase = 'CONVERGE'
@@ -1555,6 +1652,8 @@ let hasStandardsFollowUpFiled = false
 let wasStandardsHardeningPrOpened = false
 let standardsFollowUpIssueUrl = ''
 let reuseNote = null
+let reviewerAvailability = null
+const deferredPrs = []
 
 const preflightHead = await runGitTask('resolve-head')
 if (isResolvedHeadUsable(preflightHead?.sha)) {
@@ -1592,13 +1691,15 @@ while (iterations < CONFIG.maxIterations) {
       continue
     }
     await runGitTask('prefetch-main')
+    reviewerAvailability = await runReviewerAvailabilityCheck()
+    const isBugbotDownPreSpawn = resolveReviewerDown(reviewerAvailability?.bugbot, input.bugbotDisabled || false)
     log(`Round ${rounds}: parallel Bugbot + code-review + bug-audit on ${head?.slice(0, 7)}`)
     const lenses = await parallel([
-      () => runBugbotLens(head),
+      () => (isBugbotDownPreSpawn ? Promise.resolve({ sha: head, clean: true, down: true, findings: [] }) : runBugbotLens(head)),
       () => runCodeReviewLens(head),
       () => runAuditLens(head),
     ])
-    bugbotDown = resolveBugbotDown(lenses[0], input.bugbotDisabled || false)
+    bugbotDown = lenses[0] == null ? true : resolveReviewerDown(lenses[0], input.bugbotDisabled || false)
     const roundOutcome = resolveRoundOutcome(lenses)
     if (roundOutcome.allLensesDead) {
       log(`Round ${rounds}: every lens agent died — retrying without posting a clean artifact`)
@@ -1607,8 +1708,9 @@ while (iterations < CONFIG.maxIterations) {
     const findings = roundOutcome.findings
     if (isStandardsOnlyRound(findings)) {
       log(`Round ${rounds}: ${findings.length} code-standard-only finding(s) — deferring to follow-up PRs and treating the round as passed`)
-      const wasHardeningPrOpened = await openStandardsFollowUpOnce(head, findings, 'converge-round')
-      standardsNote = standardsDeferralNote(findings.length, wasHardeningPrOpened)
+      const standardsOutcome = await openStandardsFollowUpOnce(head, findings, 'converge-round', { copilotDisabled: copilotDown, bugbotDisabled: bugbotDown })
+      standardsNote = standardsDeferralNote(findings.length, standardsOutcome.hardeningPrOpened)
+      if (standardsOutcome?.deferredPr) deferredPrs.push(standardsOutcome.deferredPr)
       const auditResult = await runGeneralUtilityTask('post-clean-audit', { head })
       if (!auditResult?.posted) {
         blocker = cleanAuditBlocker(head, auditResult)
@@ -1645,10 +1747,10 @@ while (iterations < CONFIG.maxIterations) {
   }
 
   if (phase === 'COPILOT') {
-    if (input.copilotDisabled) {
+    if (resolveReviewerDown(reviewerAvailability?.copilot, input.copilotDisabled || false)) {
       copilotDown = true
-      copilotNote = 'Copilot was skipped by the quota pre-check (out of premium-request quota, unreachable, or unconfigured) — the Copilot gate was bypassed and the PR was marked ready without a Copilot review'
-      log('Copilot gate: the quota pre-check reported Copilot unavailable — skipping the Copilot gate with no agent spawned and proceeding to mark-ready with the gate bypassed.')
+      copilotNote = 'Copilot was unavailable or out of premium-request quota this round — the Copilot gate was bypassed with no agent spawned and the PR was marked ready without a Copilot review'
+      log('Copilot gate: the shared reviewer-availability probe (or the run input) reported Copilot unavailable — skipping the Copilot gate with no agent spawned and proceeding to mark-ready with the gate bypassed.')
       phase = 'FINALIZE'
       continue
     }
@@ -1670,8 +1772,9 @@ while (iterations < CONFIG.maxIterations) {
     if (copilotOutcome.kind === 'fix') {
       if (isStandardsOnlyRound(copilotOutcome.findings)) {
         log(`Copilot raised ${copilotOutcome.findings.length} code-standard-only finding(s) — deferring to follow-up PRs and treating the gate as passed`)
-        const wasHardeningPrOpened = await openStandardsFollowUpOnce(head, copilotOutcome.findings, 'copilot')
-        standardsNote = standardsDeferralNote(copilotOutcome.findings.length, wasHardeningPrOpened)
+        const standardsOutcome = await openStandardsFollowUpOnce(head, copilotOutcome.findings, 'copilot', { copilotDisabled: copilotDown, bugbotDisabled: bugbotDown })
+        standardsNote = standardsDeferralNote(copilotOutcome.findings.length, standardsOutcome.hardeningPrOpened)
+        if (standardsOutcome?.deferredPr) deferredPrs.push(standardsOutcome.deferredPr)
         copilotDown = false
         copilotNote = null
         phase = 'FINALIZE'
@@ -1707,7 +1810,7 @@ while (iterations < CONFIG.maxIterations) {
       const readyResult = await runGeneralUtilityTask('mark-ready', { head, copilotDown })
       const readyOutcome = classifyReadyOutcome(readyResult)
       if (readyOutcome.converged) {
-        return { converged: true, rounds, finalSha: head, blocker: null, standardsNote, copilotNote, reuseNote }
+        return { converged: true, rounds, finalSha: head, blocker: null, standardsNote, copilotNote, reuseNote, deferredPrs }
       }
       blocker = readyOutcome.blocker
       break
@@ -1727,4 +1830,5 @@ return {
   standardsNote,
   copilotNote,
   reuseNote,
+  deferredPrs,
 }

package/skills/autoconverge/workflow/converge_multi.mjs

@@ -126,7 +126,7 @@ function childRunInput(prEntry) {
 
 const multiInput = classifyMultiInput(args)
 if (multiInput.blocker) {
-  return { converged: false, prCount: 0, convergedCount: 0, results: [], blocker: multiInput.blocker }
+  return { converged: false, prCount: 0, convergedCount: 0, results: [], allDeferredPrs: [], blocker: multiInput.blocker }
 }
 const input = multiInput.input
 
@@ -147,6 +147,7 @@ const childResults = await parallel(
       rounds: childOutcome && childOutcome.rounds !== undefined ? childOutcome.rounds : null,
       finalSha: childOutcome && childOutcome.finalSha !== undefined ? childOutcome.finalSha : null,
       blocker: childOutcome && childOutcome.blocker !== undefined ? childOutcome.blocker : null,
+      deferredPrs: childOutcome && Array.isArray(childOutcome.deferredPrs) ? childOutcome.deferredPrs : [],
     }
   }),
 )
@@ -161,17 +162,20 @@ const results = childResults.map((eachResult, eachIndex) =>
         rounds: null,
         finalSha: null,
         blocker: 'child run threw or was skipped before returning an outcome',
+        deferredPrs: [],
       }
     : eachResult,
 )
 
 const convergedCount = results.filter((eachResult) => eachResult.converged).length
-log(`autoconverge multi-PR done: ${convergedCount}/${results.length} PR(s) converged`)
+const allDeferredPrs = results.flatMap((eachResult) => eachResult.deferredPrs)
+log(`autoconverge multi-PR done: ${convergedCount}/${results.length} PR(s) converged, ${allDeferredPrs.length} deferred hardening PR(s) opened`)
 
 return {
   converged: convergedCount === results.length,
   prCount: results.length,
   convergedCount,
   results,
+  allDeferredPrs,
   blocker: null,
 }

package/skills/autoconverge/workflow/converge_multi.run-input.test.mjs

@@ -21,6 +21,19 @@ const productionModule = new Function(
 )();
 const { normalizeMultiInput, classifyMultiInput, childRunInput } = productionModule;
 
+const AsyncFunction = async function () {}.constructor;
+const workflowBodySource = multiSource.slice(multiSource.indexOf('function normalizeMultiInput('));
+const runMultiWorkflowBody = new AsyncFunction(
+  'args',
+  'phase',
+  'log',
+  'parallel',
+  'workflow',
+  workflowBodySource,
+);
+
+function ignoreCall() {}
+
 const SCRIPT_PATH = '/abs/skills/autoconverge/workflow/converge.mjs';
 
 function validEntry(prNumber) {
@@ -124,3 +137,16 @@ test('childRunInput forwards bugbotDisabled true when the entry opts out', () =>
 test('childRunInput defaults bugbotDisabled to false when the entry omits it', () => {
   assert.equal(childRunInput(validEntry(398)).bugbotDisabled, false);
 });
+
+test('the malformed-input blocker return carries an empty allDeferredPrs list', async () => {
+  const blockerOutcome = await runMultiWorkflowBody(
+    'not json at all',
+    ignoreCall,
+    ignoreCall,
+    ignoreCall,
+    ignoreCall,
+  );
+  assert.notEqual(blockerOutcome.blocker, null);
+  assert.equal(blockerOutcome.prCount, 0);
+  assert.deepEqual(blockerOutcome.allDeferredPrs, []);
+});

package/skills/everything-search/SKILL.md

@@ -11,6 +11,11 @@ Search files instantly on Windows using the Everything command-line interface (e
 
 **Announce at start:** "I'm using the everything-search skill to find files."
 
+## Hard limits
+
+- **Scope every search.** Pass a project path, an `ext:`/`dm:`/`size:` filter, or a name pattern. A bare whole-drive scan or a network-share sweep is out of bounds.
+- **Fall back on failure.** When `es.exe` fails or returns nothing, try to start it. if that doesn't work, prompt the user to decide next steps: grep, debug further, etc.
+
 ## Instructions
 
 ### Command Syntax