happy-stacks 0.6.12 → 0.6.13

package/scripts/stack_daemon_cmd.test.mjs

@@ -18,6 +18,14 @@ function runNode(args, { cwd, env }) {
   });
 }
 
+async function writeDummyAuth({ cliHomeDir }) {
+  // For these tests, we don't care about the auth format—only that credentials exist.
+  // Happy Stacks will short-circuit daemon start when access.key is missing.
+  await mkdir(cliHomeDir, { recursive: true });
+  await writeFile(join(cliHomeDir, 'access.key'), 'dummy\n', 'utf-8');
+  await writeFile(join(cliHomeDir, 'settings.json'), JSON.stringify({ machineId: 'test-machine' }) + '\n', 'utf-8');
+}
+
 async function writeStubHappyCli({ cliDir }) {
   await mkdir(join(cliDir, 'bin'), { recursive: true });
   await mkdir(join(cliDir, 'dist'), { recursive: true });
@@ -107,6 +115,7 @@ test('happys stack daemon <name> restart restarts only the daemon', async () =>
   const cliDir = await writeStubHappyCli({ cliDir: join(tmp, 'stub-happy-cli') });
   const stackCliHome = join(storageDir, stackName, 'cli');
   await mkdir(stackCliHome, { recursive: true });
+  await writeDummyAuth({ cliHomeDir: stackCliHome });
 
   const envPath = join(storageDir, stackName, 'env');
   await mkdir(dirname(envPath), { recursive: true });
@@ -162,3 +171,190 @@ test('happys stack daemon <name> restart restarts only the daemon', async () =>
   await rm(tmp, { recursive: true, force: true });
 });
 
+test('happys stack <name> daemon start works (stack name first)', async () => {
+  const scriptsDir = dirname(fileURLToPath(import.meta.url));
+  const rootDir = dirname(scriptsDir);
+  const tmp = await mkdtemp(join(tmpdir(), 'happy-stacks-stack-daemon-name-first-'));
+
+  const storageDir = join(tmp, 'storage');
+  const homeDir = join(tmp, 'home');
+  const stackName = 'exp-test';
+
+  const cliDir = await writeStubHappyCli({ cliDir: join(tmp, 'stub-happy-cli') });
+  const stackCliHome = join(storageDir, stackName, 'cli');
+  await mkdir(stackCliHome, { recursive: true });
+  await writeDummyAuth({ cliHomeDir: stackCliHome });
+
+  const envPath = join(storageDir, stackName, 'env');
+  await mkdir(dirname(envPath), { recursive: true });
+  await writeFile(
+    envPath,
+    [
+      `HAPPY_STACKS_COMPONENT_DIR_HAPPY_CLI=${cliDir}`,
+      `HAPPY_STACKS_CLI_HOME_DIR=${stackCliHome}`,
+      `HAPPY_STACKS_SERVER_PORT=4101`,
+      '',
+    ].join('\n'),
+    'utf-8'
+  );
+
+  const baseEnv = {
+    ...process.env,
+    HAPPY_STACKS_HOME_DIR: homeDir,
+    HAPPY_STACKS_STORAGE_DIR: storageDir,
+    HAPPY_STACKS_CLI_ROOT_DISABLE: '1',
+  };
+
+  const startRes = await runNode([join(rootDir, 'bin', 'happys.mjs'), 'stack', stackName, 'daemon', 'start', '--json'], {
+    cwd: rootDir,
+    env: baseEnv,
+  });
+  assert.equal(
+    startRes.code,
+    0,
+    `expected start exit 0, got ${startRes.code}\nstdout:\n${startRes.stdout}\nstderr:\n${startRes.stderr}`
+  );
+  assert.ok(!startRes.stdout.includes('[stack] unknown command'), `unexpected unknown command output\n${startRes.stdout}`);
+
+  const logPath = join(stackCliHome, 'stub-daemon.log');
+  const logText = await (await import('node:fs/promises')).readFile(logPath, 'utf-8').then(String);
+  assert.ok(logText.includes('start'), `expected stub daemon start to be called\n${logText}`);
+
+  await runNode([join(rootDir, 'bin', 'happys.mjs'), 'stack', stackName, 'daemon', 'stop', '--json'], { cwd: rootDir, env: baseEnv });
+  await rm(tmp, { recursive: true, force: true });
+});
+
+test('happys stack daemon <name> start/stop with --identity uses an isolated cli home dir', async () => {
+  const scriptsDir = dirname(fileURLToPath(import.meta.url));
+  const rootDir = dirname(scriptsDir);
+  const tmp = await mkdtemp(join(tmpdir(), 'happy-stacks-stack-daemon-identity-'));
+
+  const storageDir = join(tmp, 'storage');
+  const homeDir = join(tmp, 'home');
+  const stackName = 'exp-test';
+  const identity = 'account-b';
+
+  const cliDir = await writeStubHappyCli({ cliDir: join(tmp, 'stub-happy-cli') });
+  const stackCliHome = join(storageDir, stackName, 'cli');
+  await mkdir(stackCliHome, { recursive: true });
+  const identityHome = join(storageDir, stackName, 'cli-identities', identity);
+  await writeDummyAuth({ cliHomeDir: identityHome });
+
+  const envPath = join(storageDir, stackName, 'env');
+  await mkdir(dirname(envPath), { recursive: true });
+  await writeFile(
+    envPath,
+    [
+      `HAPPY_STACKS_COMPONENT_DIR_HAPPY_CLI=${cliDir}`,
+      `HAPPY_STACKS_CLI_HOME_DIR=${stackCliHome}`,
+      `HAPPY_STACKS_SERVER_PORT=4101`,
+      '',
+    ].join('\n'),
+    'utf-8'
+  );
+
+  const baseEnv = {
+    ...process.env,
+    HAPPY_STACKS_HOME_DIR: homeDir,
+    HAPPY_STACKS_STORAGE_DIR: storageDir,
+    HAPPY_STACKS_CLI_ROOT_DISABLE: '1',
+  };
+
+  const startRes = await runNode(
+    [join(rootDir, 'bin', 'happys.mjs'), 'stack', 'daemon', stackName, 'start', `--identity=${identity}`, '--json'],
+    { cwd: rootDir, env: baseEnv }
+  );
+  assert.equal(
+    startRes.code,
+    0,
+    `expected start exit 0, got ${startRes.code}\nstdout:\n${startRes.stdout}\nstderr:\n${startRes.stderr}`
+  );
+
+  const logPath = join(identityHome, 'stub-daemon.log');
+  const logText = await (await import('node:fs/promises')).readFile(logPath, 'utf-8').then(String);
+  assert.ok(logText.includes('start'), `expected stub daemon start to be called in identity home\n${logText}`);
+
+  const stopRes = await runNode(
+    [join(rootDir, 'bin', 'happys.mjs'), 'stack', 'daemon', stackName, 'stop', `--identity=${identity}`, '--json'],
+    { cwd: rootDir, env: baseEnv }
+  );
+  assert.equal(
+    stopRes.code,
+    0,
+    `expected stop exit 0, got ${stopRes.code}\nstdout:\n${stopRes.stdout}\nstderr:\n${stopRes.stderr}`
+  );
+
+  const logTextAfter = await (await import('node:fs/promises')).readFile(logPath, 'utf-8').then(String);
+  assert.ok(logTextAfter.includes('stop'), `expected stub daemon stop to be called for identity\n${logTextAfter}`);
+
+  await rm(tmp, { recursive: true, force: true });
+});
+
+test('happys stack auth <name> login --identity=<name> --print prints identity-scoped HAPPY_HOME_DIR', async () => {
+  const scriptsDir = dirname(fileURLToPath(import.meta.url));
+  const rootDir = dirname(scriptsDir);
+  const tmp = await mkdtemp(join(tmpdir(), 'happy-stacks-stack-auth-identity-'));
+
+  const storageDir = join(tmp, 'storage');
+  const homeDir = join(tmp, 'home');
+  const stackName = 'exp-test';
+  const identity = 'account-b';
+
+  const cliDir = await writeStubHappyCli({ cliDir: join(tmp, 'stub-happy-cli') });
+  const stackCliHome = join(storageDir, stackName, 'cli');
+  await mkdir(stackCliHome, { recursive: true });
+  await writeDummyAuth({ cliHomeDir: stackCliHome });
+
+  const envPath = join(storageDir, stackName, 'env');
+  await mkdir(dirname(envPath), { recursive: true });
+  await writeFile(
+    envPath,
+    [
+      `HAPPY_STACKS_COMPONENT_DIR_HAPPY_CLI=${cliDir}`,
+      `HAPPY_STACKS_CLI_HOME_DIR=${stackCliHome}`,
+      `HAPPY_STACKS_SERVER_PORT=4101`,
+      '',
+    ].join('\n'),
+    'utf-8'
+  );
+
+  const baseEnv = {
+    ...process.env,
+    HAPPY_STACKS_HOME_DIR: homeDir,
+    HAPPY_STACKS_STORAGE_DIR: storageDir,
+    HAPPY_STACKS_CLI_ROOT_DISABLE: '1',
+  };
+
+  const res = await runNode(
+    [
+      join(rootDir, 'bin', 'happys.mjs'),
+      'stack',
+      'auth',
+      stackName,
+      'login',
+      `--identity=${identity}`,
+      '--no-open',
+      '--print',
+      '--json',
+    ],
+    { cwd: rootDir, env: baseEnv }
+  );
+  assert.equal(
+    res.code,
+    0,
+    `expected auth login --print exit 0, got ${res.code}\nstdout:\n${res.stdout}\nstderr:\n${res.stderr}`
+  );
+
+  const parsed = JSON.parse(res.stdout.trim());
+  assert.equal(parsed?.cliIdentity, identity);
+  assert.ok(
+    parsed?.cmd?.includes(`HAPPY_HOME_DIR="${join(storageDir, stackName, 'cli-identities', identity)}"`),
+    `expected printed cmd to include identity home dir\n${parsed?.cmd}`
+  );
+  assert.ok(
+    parsed?.cmd?.includes('--no-open'),
+    `expected printed cmd to include --no-open\n${parsed?.cmd}`
+  );
+
+  await rm(tmp, { recursive: true, force: true });
+});

package/scripts/stack_happy_cmd.test.mjs

@@ -38,6 +38,21 @@ async function writeStubHappyCli({ root, message }) {
   return cliDir;
 }
 
+async function writeFailingStubHappyCli({ root, errorMessage }) {
+  const cliDir = join(root, 'happy-cli');
+  await mkdir(join(cliDir, 'dist'), { recursive: true });
+  await writeFile(
+    join(cliDir, 'dist', 'index.mjs'),
+    [
+      `console.error(${JSON.stringify(errorMessage)});`,
+      `process.exit(1);`,
+      '',
+    ].join('\n'),
+    'utf-8'
+  );
+  return cliDir;
+}
+
 test('happys stack happy <name> runs happy-cli under that stack env', async () => {
   const scriptsDir = dirname(fileURLToPath(import.meta.url));
   const rootDir = dirname(scriptsDir);
@@ -82,6 +97,53 @@ test('happys stack happy <name> runs happy-cli under that stack env', async () =
   assert.equal(out.serverUrl, 'http://127.0.0.1:3999');
 });
 
+test('happys stack happy <name> --identity=<name> uses identity-scoped HAPPY_HOME_DIR', async () => {
+  const scriptsDir = dirname(fileURLToPath(import.meta.url));
+  const rootDir = dirname(scriptsDir);
+  const tmp = await mkdtemp(join(tmpdir(), 'happy-stacks-stack-happy-identity-'));
+
+  const storageDir = join(tmp, 'storage');
+  const homeDir = join(tmp, 'home');
+  const stackName = 'exp-test';
+  const identity = 'account-a';
+
+  const stubRoot = join(tmp, 'stub-components');
+  const cliDir = await writeStubHappyCli({ root: stubRoot, message: 'identity' });
+
+  const stackCliHome = join(storageDir, stackName, 'cli');
+  const envPath = join(storageDir, stackName, 'env');
+  await mkdir(dirname(envPath), { recursive: true });
+  await writeFile(
+    envPath,
+    [
+      `HAPPY_STACKS_COMPONENT_DIR_HAPPY_CLI=${cliDir}`,
+      `HAPPY_STACKS_CLI_HOME_DIR=${stackCliHome}`,
+      `HAPPY_STACKS_SERVER_PORT=3999`,
+      '',
+    ].join('\n'),
+    'utf-8'
+  );
+
+  const baseEnv = {
+    ...process.env,
+    HAPPY_STACKS_HOME_DIR: homeDir,
+    HAPPY_STACKS_STORAGE_DIR: storageDir,
+    HAPPY_STACKS_CLI_ROOT_DISABLE: '1',
+  };
+
+  const res = await runNode(
+    [join(rootDir, 'bin', 'happys.mjs'), 'stack', 'happy', stackName, `--identity=${identity}`],
+    { cwd: rootDir, env: baseEnv }
+  );
+  assert.equal(res.code, 0, `expected exit 0, got ${res.code}\nstdout:\n${res.stdout}\nstderr:\n${res.stderr}`);
+
+  const out = JSON.parse(res.stdout.trim());
+  assert.equal(out.message, 'identity');
+  assert.equal(out.stack, stackName);
+  assert.equal(out.homeDir, join(storageDir, stackName, 'cli-identities', identity));
+  assert.equal(out.serverUrl, 'http://127.0.0.1:3999');
+});
+
 test('happys <stack> happy ... shorthand runs happy-cli under that stack env', async () => {
   const scriptsDir = dirname(fileURLToPath(import.meta.url));
   const rootDir = dirname(scriptsDir);
@@ -124,3 +186,44 @@ test('happys <stack> happy ... shorthand runs happy-cli under that stack env', a
   assert.equal(out.serverUrl, 'http://127.0.0.1:4101');
 });
 
+test('happys stack happy <name> does not print wrapper stack traces on happy-cli failure', async () => {
+  const scriptsDir = dirname(fileURLToPath(import.meta.url));
+  const rootDir = dirname(scriptsDir);
+  const tmp = await mkdtemp(join(tmpdir(), 'happy-stacks-stack-happy-fail-'));
+
+  const storageDir = join(tmp, 'storage');
+  const homeDir = join(tmp, 'home');
+  const stackName = 'exp-test';
+
+  const stubRoot = join(tmp, 'stub-components');
+  const cliDir = await writeFailingStubHappyCli({ root: stubRoot, errorMessage: 'stub failure' });
+
+  const stackCliHome = join(storageDir, stackName, 'cli');
+  const envPath = join(storageDir, stackName, 'env');
+  await mkdir(dirname(envPath), { recursive: true });
+  await writeFile(
+    envPath,
+    [
+      `HAPPY_STACKS_COMPONENT_DIR_HAPPY_CLI=${cliDir}`,
+      `HAPPY_STACKS_CLI_HOME_DIR=${stackCliHome}`,
+      `HAPPY_STACKS_SERVER_PORT=3999`,
+      '',
+    ].join('\n'),
+    'utf-8'
+  );
+
+  const baseEnv = {
+    ...process.env,
+    HAPPY_STACKS_HOME_DIR: homeDir,
+    HAPPY_STACKS_STORAGE_DIR: storageDir,
+    HAPPY_STACKS_CLI_ROOT_DISABLE: '1',
+  };  const res = await runNode([join(rootDir, 'bin', 'happys.mjs'), 'stack', 'happy', stackName, 'attach', 'abc'], {
+    cwd: rootDir,
+    env: baseEnv,
+  });
+  assert.equal(res.code, 1, `expected exit 1, got ${res.code}\nstdout:\n${res.stdout}\nstderr:\n${res.stderr}`);
+  assert.ok(res.stderr.includes('stub failure'), `expected stderr to include stub failure, got:\n${res.stderr}`);
+  assert.ok(!res.stderr.includes('[happy] failed:'), `expected no [happy] failed stack trace, got:\n${res.stderr}`);
+  assert.ok(!res.stderr.includes('[stack] failed:'), `expected no [stack] failed stack trace, got:\n${res.stderr}`);
+  assert.ok(!res.stderr.includes('node:internal'), `expected no node:internal stack trace, got:\n${res.stderr}`);
+});

package/scripts/utils/cli/prereqs.mjs

@@ -4,7 +4,7 @@ function formatMissingTool({ name, why, install }) {
   return [`- ${name}: ${why}`, ...(install?.length ? install.map((l) => `  ${l}`) : [])].join('\n');
 }
 
-export async function assertCliPrereqs({ git = false, pnpm = false, codex = false, coderabbit = false } = {}) {
+export async function assertCliPrereqs({ git = false, pnpm = false, codex = false, coderabbit = false, augment = false } = {}) {
   const missing = [];
 
   if (git) {
@@ -65,6 +65,17 @@ export async function assertCliPrereqs({ git = false, pnpm = false, codex = fals
     }
   }
 
+  if (augment) {
+    const hasAuggie = await commandExists('auggie');
+    if (!hasAuggie) {
+      missing.push({
+        name: 'auggie',
+        why: 'required to run Augment (Auggie) review',
+        install: ['Install Auggie CLI: `npm install -g @augmentcode/auggie`', 'Then authenticate: `auggie login`'],
+      });
+    }
+  }
+
   if (!missing.length) return;
 
   throw new Error(

package/scripts/utils/dev/daemon.mjs

@@ -47,7 +47,9 @@ export async function prepareDaemonAuthSeed({
     serverComponentName,
     serverDir,
     env: serverEnv,
-    bestEffort: serverComponentName === 'happy-server',
+    // This probe is used only for auth seeding heuristics (and should never block stack startup).
+    // For unified server-light, running migrations here can race the running server and lock SQLite.
+    bestEffort: true,
   });
   return await prepareDaemonAuthSeedIfNeeded({
     rootDir,

package/scripts/utils/proc/pm.mjs

@@ -105,7 +105,7 @@ function resolveStackCacheBaseDirFromEnv(env) {
   }
 }
 
-async function applyStackCacheEnv(baseEnv) {
+export async function applyStackCacheEnv(baseEnv) {
   const env = { ...(baseEnv && typeof baseEnv === 'object' ? baseEnv : process.env) };
   const envFile = (env.HAPPY_STACKS_ENV_FILE ?? env.HAPPY_LOCAL_ENV_FILE ?? '').toString().trim();
   const stackCacheBase = resolveStackCacheBaseDirFromEnv(env);

package/scripts/utils/review/detached_worktree.mjs

@@ -0,0 +1,61 @@
+import { join } from 'node:path';
+import { existsSync } from 'node:fs';
+import { ensureDir } from '../fs/ops.mjs';
+import { runCapture } from '../proc/proc.mjs';
+
+function sanitizeLabel(raw) {
+  return String(raw ?? 'worktree')
+    .toLowerCase()
+    .replace(/[^a-z0-9._-]+/g, '-')
+    .replace(/^-+|-+$/g, '');
+}
+
+function defaultNonce() {
+  const rand = Math.random().toString(16).slice(2, 10);
+  return `${process.pid}-${Date.now()}-${rand}`;
+}
+
+export function computeDetachedWorktreeDir({ repoRootDir, label, headCommit, nonce } = {}) {
+  const root = String(repoRootDir ?? '').trim();
+  if (!root) throw new Error('[review] computeDetachedWorktreeDir: missing repoRootDir');
+
+  const safeLabel = sanitizeLabel(label);
+  const short = String(headCommit ?? '').slice(0, 12);
+  const n = String(nonce ?? defaultNonce()).trim();
+  return join(root, '.project', 'review-worktrees', `${safeLabel}-${short}-${n}`);
+}
+
+/**
+ * Create a detached git worktree for `headCommit`, run `fn(worktreeDir)`, then clean up.
+ *
+ * Notes:
+ * - The worktree directory name includes a nonce to avoid collisions when a prior run crashed
+ *   and left behind a directory, or when multiple review runs happen in parallel.
+ * - We do best-effort cleanup even if `fn` throws.
+ */
+export async function withDetachedWorktree({ repoDir, headCommit, label, env, nonce }, fn) {
+  const root = (await runCapture('git', ['rev-parse', '--show-toplevel'], { cwd: repoDir, env })).toString().trim();
+  if (!root) throw new Error('[review] failed to resolve git toplevel');
+
+  const worktreesRoot = join(root, '.project', 'review-worktrees');
+  await ensureDir(worktreesRoot);
+  const dir = computeDetachedWorktreeDir({ repoRootDir: root, label, headCommit, nonce });
+
+  // Extremely defensive: should not happen with nonced dirs, but avoid surprising errors.
+  if (existsSync(dir)) {
+    throw new Error(`[review] detached worktree dir already exists: ${dir}`);
+  }
+
+  try {
+    await runCapture('git', ['worktree', 'add', '--detach', dir, headCommit], { cwd: repoDir, env });
+    return await fn(dir);
+  } finally {
+    try {
+      await runCapture('git', ['worktree', 'remove', '--force', dir], { cwd: repoDir, env });
+      await runCapture('git', ['worktree', 'prune'], { cwd: repoDir, env });
+    } catch {
+      // best-effort cleanup; leave an orphaned worktree if needed
+    }
+  }
+}
+

package/scripts/utils/review/detached_worktree.test.mjs

@@ -0,0 +1,62 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { run, runCapture } from '../proc/proc.mjs';
+import { computeDetachedWorktreeDir, withDetachedWorktree } from './detached_worktree.mjs';
+
+function gitEnv() {
+  const clean = {};
+  for (const [k, v] of Object.entries(process.env)) {
+    if (k.startsWith('HAPPY_STACKS_') || k.startsWith('HAPPY_LOCAL_')) continue;
+    clean[k] = v;
+  }
+  return {
+    ...clean,
+    GIT_AUTHOR_NAME: 'Test',
+    GIT_AUTHOR_EMAIL: 'test@example.com',
+    GIT_COMMITTER_NAME: 'Test',
+    GIT_COMMITTER_EMAIL: 'test@example.com',
+  };
+}
+
+test('computeDetachedWorktreeDir includes nonce to avoid collisions', () => {
+  const dir1 = computeDetachedWorktreeDir({ repoRootDir: '/repo', label: 'coderabbit-1-of-21', headCommit: 'abcdef0123456789', nonce: 'n1' });
+  const dir2 = computeDetachedWorktreeDir({ repoRootDir: '/repo', label: 'coderabbit-1-of-21', headCommit: 'abcdef0123456789', nonce: 'n2' });
+  assert.notEqual(dir1, dir2);
+  assert.ok(dir1.includes('coderabbit-1-of-21-abcdef012345-n1'));
+  assert.ok(dir2.includes('coderabbit-1-of-21-abcdef012345-n2'));
+});
+
+test('withDetachedWorktree can be called repeatedly without directory collisions', async () => {
+  const repo = await mkdtemp(join(tmpdir(), 'happy-review-wt-'));
+  const env = gitEnv();
+
+  try {
+    await run('git', ['init', '-q'], { cwd: repo, env });
+    await run('git', ['checkout', '-q', '-b', 'main'], { cwd: repo, env });
+    await mkdir(join(repo, 'x'), { recursive: true });
+    await writeFile(join(repo, 'x', 'a.txt'), 'a\n', 'utf-8');
+    await run('git', ['add', '.'], { cwd: repo, env });
+    await run('git', ['commit', '-q', '-m', 'base'], { cwd: repo, env });
+
+    const head = (await runCapture('git', ['rev-parse', 'HEAD'], { cwd: repo, env })).trim();
+
+    const seen = [];
+    await withDetachedWorktree({ repoDir: repo, headCommit: head, label: 'test', env, nonce: 'one' }, async (dir) => {
+      seen.push(dir);
+      assert.equal((await runCapture('git', ['rev-parse', '--is-inside-work-tree'], { cwd: dir, env })).trim(), 'true');
+    });
+    await withDetachedWorktree({ repoDir: repo, headCommit: head, label: 'test', env, nonce: 'two' }, async (dir) => {
+      seen.push(dir);
+      assert.equal((await runCapture('git', ['rev-parse', '--is-inside-work-tree'], { cwd: dir, env })).trim(), 'true');
+    });
+
+    assert.equal(seen.length, 2);
+    assert.notEqual(seen[0], seen[1]);
+  } finally {
+    await rm(repo, { recursive: true, force: true });
+  }
+});
+

package/scripts/utils/review/findings.mjs

@@ -45,7 +45,9 @@ export function parseCodeRabbitPlainOutput(text) {
 
   for (let i = 0; i < lines.length; i += 1) {
     const line = lines[i];
-    const trimmed = line.trimEnd();
+    // The raw log files written by the review runner prefix each line with "[label] ".
+    // Strip that prefix so we can parse both prefixed logs and unprefixed stdout.
+    const trimmed = line.trimEnd().replace(/^\[[^\]]+\]\s*/g, '');
 
     if (trimmed.startsWith('============================================================================')) {
       flush();
@@ -95,27 +97,129 @@ export function parseCodexReviewText(reviewText) {
   const s = String(reviewText ?? '');
   const marker = '===FINDINGS_JSON===';
   const idx = s.indexOf(marker);
-  if (idx < 0) return [];
-  const jsonText = s.slice(idx + marker.length).trim();
-  if (!jsonText) return [];
-
-  let parsed;
-  try {
-    parsed = JSON.parse(jsonText);
-  } catch {
-    return [];
+  if (idx >= 0) {
+    let jsonText = s.slice(idx + marker.length).trim();
+    if (!jsonText) return [];
+
+    // The raw log files written by the review runner prefix each line with "[label] ".
+    // Strip that prefix so we can parse both prefixed logs and unprefixed stdout.
+    jsonText = jsonText
+      .split('\n')
+      .map((line) => String(line ?? '').replace(/^\[[^\]]+\]\s*/g, ''))
+      .join('\n')
+      .trim();
+
+    // Some reviewers wrap the JSON in a fenced code block:
+    // ===FINDINGS_JSON===
+    // ```json
+    // [...]
+    // ```
+    //
+    // Strip the outer fence so JSON.parse can succeed.
+    const fence = jsonText.match(/^```[a-z0-9_-]*\s*\n([\s\S]*?)\n```/i);
+    if (fence?.[1]) jsonText = fence[1].trim();
+
+    let parsed;
+    try {
+      parsed = JSON.parse(jsonText);
+    } catch {
+      parsed = null;
+    }
+
+    // Some tools append non-JSON metadata after the array (e.g. "Request ID: ...").
+    // As a last resort, try to parse the first top-level JSON array substring.
+    if (!Array.isArray(parsed)) {
+      const firstBracket = jsonText.indexOf('[');
+      const lastBracket = jsonText.lastIndexOf(']');
+      if (firstBracket >= 0 && lastBracket > firstBracket) {
+        try {
+          parsed = JSON.parse(jsonText.slice(firstBracket, lastBracket + 1));
+        } catch {
+          // ignore
+        }
+      }
+    }
+    if (Array.isArray(parsed)) {
+      return parsed
+        .map((x) => ({
+          reviewer: 'codex',
+          severity: x?.severity ?? null,
+          file: x?.file ?? null,
+          lines: x?.lines ?? null,
+          title: x?.title ?? null,
+          recommendation: x?.recommendation ?? null,
+          needsDiscussion: Boolean(x?.needsDiscussion),
+        }))
+        .filter((x) => x.file && x.title);
+    }
+  }
+
+  // Fallback: Codex sometimes returns a human-readable list like:
+  // - [P2] Thing — /abs/path/.project/review-worktrees/codex-.../cli/src/foo.ts:10-12
+  //
+  // Parse these into structured findings so they appear in triage even when the
+  // JSON trailer is missing.
+  const priorityToSeverity = { 1: 'blocker', 2: 'major', 3: 'minor', 4: 'nit' };
+  const lines = s.split('\n');
+  const findings = [];
+  const seen = new Set();
+
+  function stripPrefix(line) {
+    return String(line ?? '').replace(/^\[[^\]]+\]\s*/g, '').trim();
+  }
+
+  function normalizePath(rawPath) {
+    const p = String(rawPath ?? '').trim();
+    const marker2 = '/.project/review-worktrees/';
+    const i = p.indexOf(marker2);
+    if (i < 0) return p;
+    const rest = p.slice(i + marker2.length);
+    const slash = rest.indexOf('/');
+    if (slash < 0) return p;
+    return rest.slice(slash + 1);
   }
-  if (!Array.isArray(parsed)) return [];
-  return parsed
-    .map((x) => ({
+
+  for (const rawLine of lines) {
+    const line = stripPrefix(rawLine);
+    const m = line.match(/^- \[P([1-4])\]\s+(.+?)\s+—\s+(.+)$/);
+    if (!m) continue;
+
+    const priority = Number(m[1]);
+    const title = String(m[2]).trim();
+    const pathPart = String(m[3]).trim();
+
+    let file = pathPart;
+    let range = null;
+
+    const lastColon = pathPart.lastIndexOf(':');
+    if (lastColon > 0) {
+      const suffix = pathPart.slice(lastColon + 1).trim();
+      const rm = suffix.match(/^(\d+)(?:-(\d+))?$/);
+      if (rm) {
+        const start = Number(rm[1]);
+        const end = Number(rm[2] ?? rm[1]);
+        range = { start, end };
+        file = pathPart.slice(0, lastColon);
+      }
+    }
+
+    const normalizedFile = normalizePath(file);
+    const severity = priorityToSeverity[priority] ?? null;
+    const key = `${normalizedFile}:${range?.start ?? ''}-${range?.end ?? ''}:${title}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    findings.push({
       reviewer: 'codex',
-      severity: x?.severity ?? null,
-      file: x?.file ?? null,
-      title: x?.title ?? null,
-      recommendation: x?.recommendation ?? null,
-      needsDiscussion: Boolean(x?.needsDiscussion),
-    }))
-    .filter((x) => x.file && x.title);
+      severity,
+      file: normalizedFile,
+      lines: range,
+      title,
+      recommendation: null,
+      needsDiscussion: false,
+    });
+  }
+
+  return findings.filter((x) => x.file && x.title);
 }
 
 export function formatTriageMarkdown({ runLabel, baseRef, findings }) {
@@ -126,6 +230,15 @@ export function formatTriageMarkdown({ runLabel, baseRef, findings }) {
     `- Base ref: ${baseRef ?? ''}`,
     `- Findings: ${items.length}`,
     '',
+    '## Trust checklist (READ THIS FIRST)',
+    '',
+    'Before you act on reviewer output:',
+    '1) Load this file into your context (human/LLM) so you follow the workflow end-to-end.',
+    '2) Treat every suggestion as a suggestion: verify against best practices + project invariants.',
+    '3) If you are unsure, do not apply; mark **Needs discussion** and capture rationale.',
+    '4) Do not skip nits by default: apply them when they improve long-term maintainability without risk.',
+    '5) Use web search sparingly when needed to validate best practices, but prefer primary sources/docs.',
+    '',
     '## Mandatory workflow',
     '',
     'For each finding below:',