opencara 0.9.0 → 0.11.0

package/dist/index.js

@@ -1,11 +1,35 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command4 } from "commander";
+import { Command as Command2 } from "commander";
 
-// src/commands/login.ts
+// src/commands/agent.ts
 import { Command } from "commander";
-import * as readline from "readline";
+import crypto from "crypto";
+import * as fs4 from "fs";
+import * as path4 from "path";
+
+// ../shared/dist/types.js
+function isRepoAllowed(repoConfig, targetOwner, targetRepo, agentOwner) {
+  if (!repoConfig)
+    return true;
+  const fullRepo = `${targetOwner}/${targetRepo}`;
+  switch (repoConfig.mode) {
+    case "all":
+      return true;
+    case "own":
+      return agentOwner === targetOwner;
+    case "whitelist":
+      return (repoConfig.list ?? []).includes(fullRepo);
+    case "blacklist":
+      return !(repoConfig.list ?? []).includes(fullRepo);
+    default:
+      return true;
+  }
+}
+
+// ../shared/dist/review-config.js
+import { parse as parseYaml } from "yaml";
 
 // src/config.ts
 import * as fs from "fs";
@@ -15,22 +39,8 @@ import { parse, stringify } from "yaml";
 var DEFAULT_PLATFORM_URL = "https://api.opencara.dev";
 var CONFIG_DIR = path.join(os.homedir(), ".opencara");
 var CONFIG_FILE = process.env.OPENCARA_CONFIG && process.env.OPENCARA_CONFIG.trim() ? path.resolve(process.env.OPENCARA_CONFIG) : path.join(CONFIG_DIR, "config.yml");
-function ensureConfigDir() {
-  const dir = path.dirname(CONFIG_FILE);
-  fs.mkdirSync(dir, { recursive: true });
-}
 var DEFAULT_MAX_DIFF_SIZE_KB = 100;
-function parseLimits(data) {
-  const raw = data.limits;
-  if (!raw || typeof raw !== "object") return null;
-  const obj = raw;
-  const limits = {};
-  if (typeof obj.tokens_per_day === "number") limits.tokens_per_day = obj.tokens_per_day;
-  if (typeof obj.tokens_per_month === "number") limits.tokens_per_month = obj.tokens_per_month;
-  if (typeof obj.reviews_per_day === "number") limits.reviews_per_day = obj.reviews_per_day;
-  if (Object.keys(limits).length === 0) return null;
-  return limits;
-}
+var DEFAULT_MAX_CONSECUTIVE_ERRORS = 10;
 var VALID_REPO_MODES = ["all", "own", "whitelist", "blacklist"];
 var REPO_PATTERN = /^[^/]+\/[^/]+$/;
 var RepoConfigError = class extends Error {
@@ -74,44 +84,6 @@ function parseRepoConfig(obj, index) {
   }
   return config;
 }
-function parseAnonymousAgents(data) {
-  const raw = data.anonymous_agents;
-  if (!Array.isArray(raw)) return [];
-  const entries = [];
-  for (let i = 0; i < raw.length; i++) {
-    const entry = raw[i];
-    if (!entry || typeof entry !== "object") {
-      console.warn(`Warning: anonymous_agents[${i}] is not an object, skipping`);
-      continue;
-    }
-    const obj = entry;
-    if (typeof obj.agent_id !== "string" || typeof obj.api_key !== "string" || typeof obj.model !== "string" || typeof obj.tool !== "string") {
-      console.warn(
-        `Warning: anonymous_agents[${i}] missing required agent_id/api_key/model/tool fields, skipping`
-      );
-      continue;
-    }
-    const anon = {
-      agentId: obj.agent_id,
-      apiKey: obj.api_key,
-      model: obj.model,
-      tool: obj.tool
-    };
-    if (typeof obj.name === "string") anon.name = obj.name;
-    if (obj.repo_config && typeof obj.repo_config === "object") {
-      const rc = obj.repo_config;
-      if (typeof rc.mode === "string" && VALID_REPO_MODES.includes(rc.mode)) {
-        const repoConfig = { mode: rc.mode };
-        if (Array.isArray(rc.list)) {
-          repoConfig.list = rc.list.filter((v) => typeof v === "string");
-        }
-        anon.repoConfig = repoConfig;
-      }
-    }
-    entries.push(anon);
-  }
-  return entries;
-}
 function parseAgents(data) {
   if (!("agents" in data)) return null;
   const raw = data.agents;
@@ -132,8 +104,9 @@ function parseAgents(data) {
     if (typeof obj.name === "string") agent.name = obj.name;
     if (typeof obj.command === "string") agent.command = obj.command;
     if (obj.router === true) agent.router = true;
-    const agentLimits = parseLimits(obj);
-    if (agentLimits) agent.limits = agentLimits;
+    if (obj.review_only === true) agent.review_only = true;
+    if (typeof obj.github_token === "string") agent.github_token = obj.github_token;
+    if (typeof obj.codebase_dir === "string") agent.codebase_dir = obj.codebase_dir;
     const repoConfig = parseRepoConfig(obj, i);
     if (repoConfig) agent.repos = repoConfig;
     agents.push(agent);
@@ -141,14 +114,15 @@ function parseAgents(data) {
   return agents;
 }
 function loadConfig() {
+  const envPlatformUrl = process.env.OPENCARA_PLATFORM_URL?.trim() || null;
   const defaults = {
-    apiKey: null,
-    platformUrl: DEFAULT_PLATFORM_URL,
+    platformUrl: envPlatformUrl || DEFAULT_PLATFORM_URL,
     maxDiffSizeKb: DEFAULT_MAX_DIFF_SIZE_KB,
-    limits: null,
+    maxConsecutiveErrors: DEFAULT_MAX_CONSECUTIVE_ERRORS,
+    githubToken: null,
+    codebaseDir: null,
     agentCommand: null,
-    agents: null,
-    anonymousAgents: []
+    agents: null
   };
   if (!fs.existsSync(CONFIG_FILE)) {
     return defaults;
@@ -159,73 +133,136 @@ function loadConfig() {
     return defaults;
   }
   return {
-    apiKey: typeof data.api_key === "string" ? data.api_key : null,
-    platformUrl: typeof data.platform_url === "string" ? data.platform_url : DEFAULT_PLATFORM_URL,
+    platformUrl: envPlatformUrl || (typeof data.platform_url === "string" ? data.platform_url : DEFAULT_PLATFORM_URL),
     maxDiffSizeKb: typeof data.max_diff_size_kb === "number" ? data.max_diff_size_kb : DEFAULT_MAX_DIFF_SIZE_KB,
-    limits: parseLimits(data),
+    maxConsecutiveErrors: typeof data.max_consecutive_errors === "number" ? data.max_consecutive_errors : DEFAULT_MAX_CONSECUTIVE_ERRORS,
+    githubToken: typeof data.github_token === "string" ? data.github_token : null,
+    codebaseDir: typeof data.codebase_dir === "string" ? data.codebase_dir : null,
     agentCommand: typeof data.agent_command === "string" ? data.agent_command : null,
-    agents: parseAgents(data),
-    anonymousAgents: parseAnonymousAgents(data)
+    agents: parseAgents(data)
   };
 }
-function saveConfig(config) {
-  ensureConfigDir();
-  const data = {
-    platform_url: config.platformUrl
-  };
-  if (config.apiKey) {
-    data.api_key = config.apiKey;
+function resolveGithubToken(agentToken, globalToken) {
+  return agentToken ? agentToken : globalToken;
+}
+function resolveCodebaseDir(agentDir, globalDir) {
+  const raw = agentDir || globalDir;
+  if (!raw) return null;
+  if (raw.startsWith("~/") || raw === "~") {
+    return path.join(os.homedir(), raw.slice(1));
   }
-  if (config.maxDiffSizeKb !== DEFAULT_MAX_DIFF_SIZE_KB) {
-    data.max_diff_size_kb = config.maxDiffSizeKb;
+  return path.resolve(raw);
+}
+
+// src/codebase.ts
+import { execFileSync } from "child_process";
+import * as fs2 from "fs";
+import * as path2 from "path";
+
+// src/sanitize.ts
+var GITHUB_TOKEN_PATTERN = /\b(ghp_[A-Za-z0-9_]{1,255}|gho_[A-Za-z0-9_]{1,255}|ghs_[A-Za-z0-9_]{1,255}|ghr_[A-Za-z0-9_]{1,255}|github_pat_[A-Za-z0-9_]{1,255})\b/g;
+var EMBEDDED_TOKEN_PATTERN = /x-access-token:[^@\s]+@/g;
+var AUTH_HEADER_PATTERN = /(Authorization:)\s*(?:token|Bearer)\s+[^\s,;'"]+/gi;
+function sanitizeTokens(input) {
+  return input.replace(GITHUB_TOKEN_PATTERN, "***").replace(EMBEDDED_TOKEN_PATTERN, "x-access-token:***@").replace(AUTH_HEADER_PATTERN, "$1 ***");
+}
+
+// src/codebase.ts
+var VALID_NAME_PATTERN = /^[a-zA-Z0-9._-]+$/;
+function cloneOrUpdate(owner, repo, prNumber, baseDir, githubToken, taskId) {
+  validatePathSegment(owner, "owner");
+  validatePathSegment(repo, "repo");
+  if (taskId) {
+    validatePathSegment(taskId, "taskId");
+  }
+  const repoDir = taskId ? path2.join(baseDir, owner, repo, taskId) : path2.join(baseDir, owner, repo);
+  const cloneUrl = buildCloneUrl(owner, repo, githubToken);
+  let cloned = false;
+  if (!fs2.existsSync(path2.join(repoDir, ".git"))) {
+    fs2.mkdirSync(repoDir, { recursive: true });
+    git(["clone", "--depth", "1", cloneUrl, repoDir]);
+    cloned = true;
+  }
+  git(["fetch", "--force", "--depth", "1", "origin", `pull/${prNumber}/head`], repoDir);
+  git(["checkout", "FETCH_HEAD"], repoDir);
+  return { localPath: repoDir, cloned };
+}
+function cleanupTaskDir(dirPath) {
+  if (!path2.isAbsolute(dirPath) || dirPath.split(path2.sep).filter(Boolean).length < 3) {
+    return;
   }
-  if (config.limits) {
-    data.limits = config.limits;
+  try {
+    fs2.rmSync(dirPath, { recursive: true, force: true });
+  } catch (err) {
+    if (err?.code !== "ENOENT") {
+      console.warn(`[cleanup] Failed to remove ${dirPath}: ${err.message}`);
+    }
   }
-  if (config.agentCommand) {
-    data.agent_command = config.agentCommand;
+}
+function validatePathSegment(segment, name) {
+  if (!VALID_NAME_PATTERN.test(segment) || segment === "." || segment === "..") {
+    throw new Error(`Invalid ${name}: '${segment}' contains disallowed characters`);
   }
-  if (config.agents !== null) {
-    data.agents = config.agents;
+}
+function buildCloneUrl(owner, repo, githubToken) {
+  if (githubToken) {
+    return `https://x-access-token:${githubToken}@github.com/${owner}/${repo}.git`;
   }
-  if (config.anonymousAgents.length > 0) {
-    data.anonymous_agents = config.anonymousAgents.map((a) => {
-      const entry = {
-        agent_id: a.agentId,
-        api_key: a.apiKey,
-        model: a.model,
-        tool: a.tool
-      };
-      if (a.name) {
-        entry.name = a.name;
-      }
-      if (a.repoConfig) {
-        entry.repo_config = a.repoConfig;
-      }
-      return entry;
+  return `https://github.com/${owner}/${repo}.git`;
+}
+function git(args, cwd) {
+  try {
+    return execFileSync("git", args, {
+      cwd,
+      encoding: "utf-8",
+      timeout: 12e4,
+      stdio: ["ignore", "pipe", "pipe"]
     });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(sanitizeTokens(message));
   }
-  fs.writeFileSync(CONFIG_FILE, stringify(data), { encoding: "utf-8", mode: 384 });
-}
-function resolveAgentLimits(agentLimits, globalLimits) {
-  if (!agentLimits && !globalLimits) return null;
-  if (!agentLimits) return globalLimits;
-  if (!globalLimits) return agentLimits;
-  const merged = { ...globalLimits, ...agentLimits };
-  return Object.keys(merged).length === 0 ? null : merged;
-}
-function findAnonymousAgent(config, agentId) {
-  return config.anonymousAgents.find((a) => a.agentId === agentId) ?? null;
 }
-function removeAnonymousAgent(config, agentId) {
-  config.anonymousAgents = config.anonymousAgents.filter((a) => a.agentId !== agentId);
+
+// src/github-auth.ts
+import { execSync } from "child_process";
+function getGhCliToken() {
+  try {
+    const result = execSync("gh auth token", {
+      timeout: 5e3,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const token = result.trim();
+    return token.length > 0 ? token : null;
+  } catch {
+    return null;
+  }
 }
-function requireApiKey(config) {
-  if (!config.apiKey) {
-    console.error("Not authenticated. Run `opencara login` first.");
-    process.exit(1);
+function resolveGithubToken2(configToken, deps = {}) {
+  const getEnv = deps.getEnv ?? ((key) => process.env[key]);
+  const getGhToken = deps.getGhToken ?? getGhCliToken;
+  const envToken = getEnv("GITHUB_TOKEN");
+  if (envToken) {
+    return { token: envToken, method: "env" };
+  }
+  const ghToken = getGhToken();
+  if (ghToken) {
+    return { token: ghToken, method: "gh-cli" };
   }
-  return config.apiKey;
+  if (configToken) {
+    return { token: configToken, method: "config" };
+  }
+  return { token: null, method: "none" };
+}
+var AUTH_LOG_MESSAGES = {
+  env: "GitHub auth: using GITHUB_TOKEN env var",
+  "gh-cli": "GitHub auth: using gh CLI token",
+  config: "GitHub auth: using config github_token",
+  none: "GitHub auth: none (public repos only)"
+};
+function logAuthMethod(method, log) {
+  log(AUTH_LOG_MESSAGES[method]);
 }
 
 // src/http.ts
@@ -237,264 +274,105 @@ var HttpError = class extends Error {
   }
 };
 var ApiClient = class {
-  constructor(baseUrl, apiKey = null) {
+  constructor(baseUrl, debug) {
     this.baseUrl = baseUrl;
-    this.apiKey = apiKey;
+    this.debug = debug ?? process.env.OPENCARA_DEBUG === "1";
+  }
+  debug;
+  log(msg) {
+    if (this.debug) console.debug(`[ApiClient] ${msg}`);
   }
   headers() {
-    const h = {
+    return {
       "Content-Type": "application/json"
     };
-    if (this.apiKey) {
-      h["Authorization"] = `Bearer ${this.apiKey}`;
-    }
-    return h;
   }
-  async get(path3) {
-    const res = await fetch(`${this.baseUrl}${path3}`, {
+  async get(path5) {
+    this.log(`GET ${path5}`);
+    const res = await fetch(`${this.baseUrl}${path5}`, {
       method: "GET",
       headers: this.headers()
     });
-    return this.handleResponse(res);
+    return this.handleResponse(res, path5);
   }
-  async post(path3, body) {
-    const res = await fetch(`${this.baseUrl}${path3}`, {
+  async post(path5, body) {
+    this.log(`POST ${path5}`);
+    const res = await fetch(`${this.baseUrl}${path5}`, {
       method: "POST",
       headers: this.headers(),
       body: body !== void 0 ? JSON.stringify(body) : void 0
     });
-    return this.handleResponse(res);
+    return this.handleResponse(res, path5);
   }
-  async handleResponse(res) {
+  async handleResponse(res, path5) {
     if (!res.ok) {
-      if (res.status === 401) {
-        throw new HttpError(401, "Not authenticated. Run `opencara login` first.");
-      }
       let message = `HTTP ${res.status}`;
       try {
         const body = await res.json();
         if (body.error) message = body.error;
       } catch {
       }
+      this.log(`${res.status} ${message} (${path5})`);
       throw new HttpError(res.status, message);
     }
+    this.log(`${res.status} OK (${path5})`);
     return await res.json();
   }
 };
 
-// src/reconnect.ts
-var DEFAULT_RECONNECT_OPTIONS = {
-  initialDelay: 1e3,
-  maxDelay: 3e4,
-  multiplier: 2,
-  jitter: true
-};
-function calculateDelay(attempt, options = DEFAULT_RECONNECT_OPTIONS) {
-  const base = Math.min(
-    options.initialDelay * Math.pow(options.multiplier, attempt),
-    options.maxDelay
-  );
-  if (options.jitter) {
-    return base + Math.random() * 500;
+// src/retry.ts
+var NonRetryableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "NonRetryableError";
   }
-  return base;
-}
-function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
-}
-
-// src/commands/login.ts
-function promptYesNo(question) {
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve2) => {
-    rl.question(question, (answer) => {
-      rl.close();
-      const normalized = answer.trim().toLowerCase();
-      resolve2(normalized === "" || normalized === "y" || normalized === "yes");
-    });
-  });
-}
-var loginCommand = new Command("login").description("Authenticate with GitHub via device flow").action(async () => {
-  const config = loadConfig();
-  const client = new ApiClient(config.platformUrl);
-  let flow;
-  try {
-    flow = await client.post("/auth/device");
-  } catch (err) {
-    console.error("Failed to start device flow:", err instanceof Error ? err.message : err);
-    process.exit(1);
-  }
-  console.log();
-  console.log("To sign in, open this URL in your browser:");
-  console.log(`  ${flow.verificationUri}`);
-  console.log();
-  console.log(`And enter this code: ${flow.userCode}`);
-  console.log();
-  console.log("Waiting for authorization...");
-  const intervalMs = flow.interval * 1e3;
-  const deadline = Date.now() + flow.expiresIn * 1e3;
-  while (Date.now() < deadline) {
-    await sleep(intervalMs);
-    let tokenRes;
+};
+var DEFAULT_RETRY = {
+  maxAttempts: 3,
+  baseDelayMs: 1e3,
+  maxDelayMs: 3e4
+};
+async function withRetry(fn, options = {}, signal) {
+  const opts = { ...DEFAULT_RETRY, ...options };
+  let lastError;
+  for (let attempt = 0; attempt < opts.maxAttempts; attempt++) {
+    if (signal?.aborted) throw new Error("Aborted");
     try {
-      tokenRes = await client.post("/auth/device/token", {
-        deviceCode: flow.deviceCode
-      });
+      return await fn();
     } catch (err) {
-      console.error("Polling error:", err instanceof Error ? err.message : err);
-      continue;
-    }
-    if (tokenRes.status === "pending") {
-      process.stdout.write(".");
-      continue;
-    }
-    if (tokenRes.status === "expired") {
-      console.error("\nDevice code expired. Please run `opencara login` again.");
-      process.exit(1);
-    }
-    if (tokenRes.status === "complete") {
-      config.apiKey = tokenRes.apiKey;
-      saveConfig(config);
-      console.log("\nLogged in successfully. API key saved to ~/.opencara/config.yml");
-      if (config.anonymousAgents.length > 0 && process.stdin.isTTY) {
-        console.log();
-        console.log(`Found ${config.anonymousAgents.length} anonymous agent(s):`);
-        for (const anon of config.anonymousAgents) {
-          console.log(`  - ${anon.agentId} (${anon.model} / ${anon.tool})`);
-        }
-        const shouldLink = await promptYesNo("Link to your GitHub account? [Y/n] ");
-        if (shouldLink) {
-          const authedClient = new ApiClient(config.platformUrl, tokenRes.apiKey);
-          let linkedCount = 0;
-          const toRemove = [];
-          for (const anon of config.anonymousAgents) {
-            try {
-              await authedClient.post("/api/account/link", {
-                anonymousApiKey: anon.apiKey
-              });
-              toRemove.push(anon.agentId);
-              linkedCount++;
-            } catch (err) {
-              console.error(
-                `Failed to link agent ${anon.agentId}:`,
-                err instanceof Error ? err.message : err
-              );
-            }
-          }
-          for (const id of toRemove) {
-            removeAnonymousAgent(config, id);
-          }
-          saveConfig(config);
-          if (linkedCount > 0) {
-            console.log(`Linked ${linkedCount} agent(s) to your account.`);
-          }
-        }
+      if (err instanceof NonRetryableError) throw err;
+      lastError = err;
+      if (attempt < opts.maxAttempts - 1) {
+        const baseDelay = Math.min(opts.baseDelayMs * Math.pow(2, attempt), opts.maxDelayMs);
+        const delay = Math.round(baseDelay * (0.7 + Math.random() * 0.6));
+        await sleep(delay, signal);
       }
-      return;
     }
   }
-  console.error("\nDevice code expired. Please run `opencara login` again.");
-  process.exit(1);
-});
-
-// src/commands/agent.ts
-import { Command as Command2 } from "commander";
-import WebSocket from "ws";
-import crypto2 from "crypto";
-
-// ../shared/dist/api.js
-var DEFAULT_REGISTRY = {
-  tools: [
-    {
-      name: "claude",
-      displayName: "Claude",
-      binary: "claude",
-      commandTemplate: "claude --model ${MODEL} --allowedTools '*' --print",
-      tokenParser: "claude"
-    },
-    {
-      name: "codex",
-      displayName: "Codex",
-      binary: "codex",
-      commandTemplate: "codex --model ${MODEL} exec",
-      tokenParser: "codex"
-    },
-    {
-      name: "gemini",
-      displayName: "Gemini",
-      binary: "gemini",
-      commandTemplate: "gemini -m ${MODEL}",
-      tokenParser: "gemini"
-    },
-    {
-      name: "qwen",
-      displayName: "Qwen",
-      binary: "qwen",
-      commandTemplate: "qwen --model ${MODEL} -y",
-      tokenParser: "qwen"
-    }
-  ],
-  models: [
-    {
-      name: "claude-opus-4-6",
-      displayName: "Claude Opus 4.6",
-      tools: ["claude"],
-      defaultReputation: 0.8
-    },
-    {
-      name: "claude-opus-4-6[1m]",
-      displayName: "Claude Opus 4.6 (1M context)",
-      tools: ["claude"],
-      defaultReputation: 0.8
-    },
-    {
-      name: "claude-sonnet-4-6",
-      displayName: "Claude Sonnet 4.6",
-      tools: ["claude"],
-      defaultReputation: 0.7
-    },
-    {
-      name: "claude-sonnet-4-6[1m]",
-      displayName: "Claude Sonnet 4.6 (1M context)",
-      tools: ["claude"],
-      defaultReputation: 0.7
-    },
-    {
-      name: "gpt-5-codex",
-      displayName: "GPT-5 Codex",
-      tools: ["codex"],
-      defaultReputation: 0.7
-    },
-    {
-      name: "gemini-2.5-pro",
-      displayName: "Gemini 2.5 Pro",
-      tools: ["gemini"],
-      defaultReputation: 0.7
-    },
-    {
-      name: "qwen3.5-plus",
-      displayName: "Qwen 3.5 Plus",
-      tools: ["qwen"],
-      defaultReputation: 0.6
-    },
-    { name: "glm-5", displayName: "GLM-5", tools: ["qwen"], defaultReputation: 0.5 },
-    { name: "kimi-k2.5", displayName: "Kimi K2.5", tools: ["qwen"], defaultReputation: 0.5 },
-    {
-      name: "minimax-m2.5",
-      displayName: "Minimax M2.5",
-      tools: ["qwen"],
-      defaultReputation: 0.5
+  throw lastError;
+}
+function sleep(ms, signal) {
+  return new Promise((resolve2) => {
+    if (signal?.aborted) {
+      resolve2();
+      return;
     }
-  ]
-};
-
-// ../shared/dist/review-config.js
-import { parse as parseYaml } from "yaml";
+    const timer = setTimeout(resolve2, ms);
+    signal?.addEventListener(
+      "abort",
+      () => {
+        clearTimeout(timer);
+        resolve2();
+      },
+      { once: true }
+    );
+  });
+}
 
 // src/tool-executor.ts
-import { spawn, execFileSync } from "child_process";
-import * as fs2 from "fs";
-import * as path2 from "path";
+import { spawn, execFileSync as execFileSync2 } from "child_process";
+import * as fs3 from "fs";
+import * as path3 from "path";
 var ToolTimeoutError = class extends Error {
   constructor(message) {
     super(message);
@@ -505,9 +383,9 @@ var MIN_PARTIAL_RESULT_LENGTH = 50;
 var MAX_STDERR_LENGTH = 1e3;
 function validateCommandBinary(commandTemplate) {
   const { command } = parseCommandTemplate(commandTemplate);
-  if (path2.isAbsolute(command)) {
+  if (path3.isAbsolute(command)) {
     try {
-      fs2.accessSync(command, fs2.constants.X_OK);
+      fs3.accessSync(command, fs3.constants.X_OK);
       return true;
     } catch {
       return false;
@@ -516,9 +394,9 @@ function validateCommandBinary(commandTemplate) {
   try {
     const isWindows = process.platform === "win32";
     if (isWindows) {
-      execFileSync("where", [command], { stdio: "pipe" });
+      execFileSync2("where", [command], { stdio: "pipe" });
     } else {
-      execFileSync("sh", ["-c", 'command -v -- "$1"', "_", command], { stdio: "pipe" });
+      execFileSync2("sh", ["-c", 'command -v -- "$1"', "_", command], { stdio: "pipe" });
     }
     return true;
   } catch {
@@ -560,14 +438,6 @@ function parseCommandTemplate(template, vars = {}) {
   }
   return { command: interpolated[0], args: interpolated.slice(1) };
 }
-function resolveCommandTemplate(agentCommand2) {
-  if (agentCommand2) {
-    return agentCommand2;
-  }
-  throw new Error(
-    "No command configured for this agent. Set command in ~/.opencara/config.yml agents section or run `opencara agent create`."
-  );
-}
 var CHARS_PER_TOKEN = 4;
 function estimateTokens(text) {
   return Math.ceil(text.length / CHARS_PER_TOKEN);
@@ -589,9 +459,12 @@ function parseTokenUsage(stdout, stderr) {
   if (qwenMatch) return { tokens: parseInt(qwenMatch[1], 10), parsed: true };
   return { tokens: estimateTokens(stdout), parsed: false };
 }
-function executeTool(commandTemplate, prompt, timeoutMs, signal, vars) {
+function executeTool(commandTemplate, prompt, timeoutMs, signal, vars, cwd) {
   const promptViaArg = commandTemplate.includes("${PROMPT}");
   const allVars = { ...vars, PROMPT: prompt };
+  if (cwd && !allVars["CODEBASE_DIR"]) {
+    allVars["CODEBASE_DIR"] = cwd;
+  }
   const { command, args } = parseCommandTemplate(commandTemplate, allVars);
   return new Promise((resolve2, reject) => {
     if (signal?.aborted) {
@@ -599,7 +472,8 @@ function executeTool(commandTemplate, prompt, timeoutMs, signal, vars) {
       return;
     }
     const child = spawn(command, args, {
-      stdio: ["pipe", "pipe", "pipe"]
+      stdio: ["pipe", "pipe", "pipe"],
+      cwd
     });
     let stdout = "";
     let stderr = "";
@@ -677,6 +551,26 @@ function executeTool(commandTemplate, prompt, timeoutMs, signal, vars) {
     });
   });
 }
+var TEST_COMMAND_PROMPT = "Respond with: OK";
+var TEST_COMMAND_TIMEOUT_MS = 1e4;
+async function testCommand(commandTemplate) {
+  const start = Date.now();
+  try {
+    await executeTool(commandTemplate, TEST_COMMAND_PROMPT, TEST_COMMAND_TIMEOUT_MS);
+    return { ok: true, elapsedMs: Date.now() - start };
+  } catch (err) {
+    const elapsed = Date.now() - start;
+    if (err instanceof ToolTimeoutError) {
+      return {
+        ok: false,
+        elapsedMs: elapsed,
+        error: `command timed out after ${TEST_COMMAND_TIMEOUT_MS / 1e3}s`
+      };
+    }
+    const msg = err instanceof Error ? err.message : String(err);
+    return { ok: false, elapsedMs: elapsed, error: msg };
+  }
+}
 
 // src/review.ts
 var TIMEOUT_SAFETY_MARGIN_MS = 3e4;
@@ -741,6 +635,7 @@ function extractVerdict(text) {
     const review = (before + after).replace(/\n{3,}/g, "\n\n").trim();
     return { verdict: verdictStr, review };
   }
+  console.warn("No verdict found in review output, defaulting to COMMENT");
   return { verdict: "comment", review: text };
 }
 async function executeReview(req, deps, runTool = executeTool) {
@@ -769,7 +664,9 @@ ${userMessage}`;
       deps.commandTemplate,
       fullPrompt,
       effectiveTimeout,
-      abortController.signal
+      abortController.signal,
+      void 0,
+      deps.codebaseDir ?? void 0
     );
     const { verdict, review } = extractVerdict(result.stdout);
     const inputTokens = result.tokensParsed ? 0 : estimateTokens(fullPrompt);
@@ -886,7 +783,9 @@ ${userMessage}`;
       deps.commandTemplate,
       fullPrompt,
       effectiveTimeout,
-      abortController.signal
+      abortController.signal,
+      void 0,
+      deps.codebaseDir ?? void 0
     );
     const inputTokens = result.tokensParsed ? 0 : estimateTokens(fullPrompt);
     return {
@@ -900,7 +799,7 @@ ${userMessage}`;
 }
 
 // src/router.ts
-import * as readline2 from "readline";
+import * as readline from "readline";
 var END_OF_RESPONSE = "<<<OPENCARA_END_RESPONSE>>>";
 var RouterRelay = class {
   pending = null;
@@ -918,7 +817,7 @@ var RouterRelay = class {
   /** Start listening for stdin input */
   start() {
     this.stopped = false;
-    this.rl = readline2.createInterface({
+    this.rl = readline.createInterface({
       input: this.stdin,
       terminal: false
     });
@@ -928,15 +827,16 @@ var RouterRelay = class {
     this.rl.on("close", () => {
       if (this.stopped) return;
       if (this.pending) {
-        const response = this.responseLines.join("\n");
+        const response = this.responseLines.join("\n").trim();
         this.responseLines = [];
         clearTimeout(this.pending.timer);
         const task = this.pending;
         this.pending = null;
-        if (response.trim()) {
+        if (response.length >= 100) {
+          console.warn("Router stdin closed \u2014 accepting partial response");
           task.resolve(response);
         } else {
-          task.reject(new Error("stdin closed with no response"));
+          task.reject(new Error("Router process died (stdin closed with insufficient response)"));
         }
       }
     });
@@ -957,7 +857,11 @@ var RouterRelay = class {
   }
   /** Write the prompt as plain text to stdout */
   writePrompt(prompt) {
-    this.stdout.write(prompt + "\n");
+    try {
+      this.stdout.write(prompt + "\n");
+    } catch (err) {
+      throw new Error(`Failed to write to router: ${err.message}`);
+    }
   }
   /** Write a status message to stderr (doesn't interfere with prompt/response on stdout/stdin) */
   writeStatus(message) {
@@ -1001,7 +905,14 @@ ${userMessage}`;
         reject(new RouterTimeoutError(`Response timeout (${timeoutSec}s)`));
       }, timeoutMs);
       this.pending = { resolve: resolve2, reject, timer };
-      this.writePrompt(prompt);
+      try {
+        this.writePrompt(prompt);
+      } catch (err) {
+        clearTimeout(timer);
+        this.pending = null;
+        this.responseLines = [];
+        reject(err);
+      }
     });
   }
   /** Parse a review response: extract verdict and review text */
@@ -1016,11 +927,15 @@ ${userMessage}`;
   handleLine(line) {
     if (!this.pending) return;
     if (line.trim() === END_OF_RESPONSE) {
-      const response = this.responseLines.join("\n");
+      const response = this.responseLines.join("\n").trim();
       this.responseLines = [];
       clearTimeout(this.pending.timer);
       const task = this.pending;
       this.pending = null;
+      if (!response || response.length < 10) {
+        task.reject(new Error("Router returned empty or trivially short response"));
+        return;
+      }
       task.resolve(response);
       return;
     }
@@ -1035,9 +950,6 @@ var RouterTimeoutError = class extends Error {
 };
 
 // src/consumption.ts
-async function checkConsumptionLimits(_agentId, _limits) {
-  return { allowed: true };
-}
 function createSessionTracker() {
   return { tokens: 0, reviews: 0 };
 }
@@ -1045,1382 +957,712 @@ function recordSessionUsage(session, tokensUsed) {
   session.tokens += tokensUsed;
   session.reviews += 1;
 }
-function formatPostReviewStats(_tokensUsed, session, _limits, _dailyStats) {
+function formatPostReviewStats(session) {
   return `  Session: ${session.tokens.toLocaleString()} tokens / ${session.reviews} reviews`;
 }
 
 // src/commands/agent.ts
-var CONNECTION_STABILITY_THRESHOLD_MS = 3e4;
-function formatTable(agents, trustLabels) {
-  if (agents.length === 0) {
-    console.log("No agents registered. Run `opencara agent create` to register one.");
-    return;
-  }
-  const header = [
-    "ID".padEnd(38),
-    "Name".padEnd(20),
-    "Model".padEnd(22),
-    "Tool".padEnd(16),
-    "Status".padEnd(10),
-    "Trust"
-  ].join("");
-  console.log(header);
-  for (const a of agents) {
-    const trust = trustLabels?.get(a.id) ?? "--";
-    const name = a.displayName ?? "--";
-    console.log(
-      [
-        a.id.padEnd(38),
-        name.padEnd(20),
-        a.model.padEnd(22),
-        a.tool.padEnd(16),
-        a.status.padEnd(10),
-        trust
-      ].join("")
-    );
-  }
+var DEFAULT_POLL_INTERVAL_MS = 1e4;
+var MAX_CONSECUTIVE_AUTH_ERRORS = 3;
+var MAX_POLL_BACKOFF_MS = 3e5;
+function createLogger(label) {
+  const prefix = label ? `[${label}] ` : "";
+  return {
+    log: (msg) => console.log(`${prefix}${sanitizeTokens(msg)}`),
+    logError: (msg) => console.error(`${prefix}${sanitizeTokens(msg)}`),
+    logWarn: (msg) => console.warn(`${prefix}${sanitizeTokens(msg)}`)
+  };
 }
-function buildWsUrl(platformUrl, agentId, apiKey) {
-  return platformUrl.replace(/^https:\/\//, "wss://").replace(/^http:\/\//, "ws://") + `/ws/agent/${agentId}?token=${encodeURIComponent(apiKey)}`;
+var NON_RETRYABLE_STATUSES = /* @__PURE__ */ new Set([401, 403, 404]);
+function toApiDiffUrl(webUrl) {
+  const match = webUrl.match(/^https?:\/\/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)(?:\.diff)?$/);
+  if (!match) return null;
+  const [, owner, repo, prNumber] = match;
+  return `https://api.github.com/repos/${owner}/${repo}/pulls/${prNumber}`;
 }
-var HEARTBEAT_TIMEOUT_MS = 9e4;
-var STABILITY_THRESHOLD_MIN_MS = 5e3;
-var STABILITY_THRESHOLD_MAX_MS = 3e5;
-var WS_PING_INTERVAL_MS = 2e4;
-function startAgent(agentId, platformUrl, apiKey, reviewDeps, consumptionDeps, options) {
-  const verbose = options?.verbose ?? false;
-  const stabilityThreshold = options?.stabilityThresholdMs ?? CONNECTION_STABILITY_THRESHOLD_MS;
-  const repoConfig = options?.repoConfig;
-  const displayName = options?.displayName;
-  const routerRelay = options?.routerRelay;
-  const prefix = options?.label ? `[${options.label}]` : "";
-  const log = (...args) => console.log(...prefix ? [prefix, ...args] : args);
-  const logError = (...args) => console.error(...prefix ? [prefix, ...args] : args);
-  let attempt = 0;
-  let intentionalClose = false;
-  let heartbeatTimer = null;
-  let wsPingTimer = null;
-  let currentWs = null;
-  let connectionOpenedAt = null;
-  let stabilityTimer = null;
-  function clearHeartbeatTimer() {
-    if (heartbeatTimer) {
-      clearTimeout(heartbeatTimer);
-      heartbeatTimer = null;
-    }
-  }
-  function clearStabilityTimer() {
-    if (stabilityTimer) {
-      clearTimeout(stabilityTimer);
-      stabilityTimer = null;
-    }
-  }
-  function clearWsPingTimer() {
-    if (wsPingTimer) {
-      clearInterval(wsPingTimer);
-      wsPingTimer = null;
-    }
-  }
-  function shutdown() {
-    intentionalClose = true;
-    clearHeartbeatTimer();
-    clearStabilityTimer();
-    clearWsPingTimer();
-    if (currentWs) currentWs.close();
-    log("Disconnected.");
-    process.exit(0);
-  }
-  process.once("SIGINT", shutdown);
-  process.once("SIGTERM", shutdown);
-  function connect() {
-    const url = buildWsUrl(platformUrl, agentId, apiKey);
-    const ws = new WebSocket(url);
-    currentWs = ws;
-    function resetHeartbeatTimer() {
-      clearHeartbeatTimer();
-      heartbeatTimer = setTimeout(() => {
-        log("No heartbeat received in 90s. Reconnecting...");
-        ws.terminate();
-      }, HEARTBEAT_TIMEOUT_MS);
-    }
-    ws.on("open", () => {
-      connectionOpenedAt = Date.now();
-      log("Connected to platform.");
-      resetHeartbeatTimer();
-      clearWsPingTimer();
-      wsPingTimer = setInterval(() => {
-        try {
-          if (ws.readyState === WebSocket.OPEN) {
-            ws.ping();
-          }
-        } catch {
+async function fetchDiff(diffUrl, githubToken, signal) {
+  return withRetry(
+    async () => {
+      const headers = {};
+      let url;
+      const apiUrl = githubToken ? toApiDiffUrl(diffUrl) : null;
+      if (apiUrl && githubToken) {
+        url = apiUrl;
+        headers["Authorization"] = `Bearer ${githubToken}`;
+        headers["Accept"] = "application/vnd.github.v3.diff";
+      } else {
+        url = diffUrl.endsWith(".diff") ? diffUrl : `${diffUrl}.diff`;
+        if (githubToken) {
+          headers["Authorization"] = `Bearer ${githubToken}`;
         }
-      }, WS_PING_INTERVAL_MS);
-      if (verbose) {
-        log(`[verbose] Connection opened at ${new Date(connectionOpenedAt).toISOString()}`);
       }
-      clearStabilityTimer();
-      stabilityTimer = setTimeout(() => {
-        if (verbose) {
-          log(
-            `[verbose] Connection stable for ${stabilityThreshold / 1e3}s \u2014 resetting reconnect counter`
-          );
+      const response = await fetch(url, { headers, signal });
+      if (!response.ok) {
+        const msg = `Failed to fetch diff: ${response.status} ${response.statusText}`;
+        if (NON_RETRYABLE_STATUSES.has(response.status)) {
+          const hint = response.status === 404 ? ". If this is a private repo, configure github_token in ~/.opencara/config.yml" : "";
+          throw new NonRetryableError(`${msg}${hint}`);
         }
-        attempt = 0;
-      }, stabilityThreshold);
-    });
-    ws.on("message", (data) => {
-      let msg;
-      try {
-        msg = JSON.parse(data.toString());
-      } catch {
-        return;
-      }
-      handleMessage(
-        ws,
-        msg,
-        resetHeartbeatTimer,
-        reviewDeps,
-        consumptionDeps,
-        verbose,
-        repoConfig,
-        displayName,
-        prefix,
-        routerRelay
-      );
-    });
-    ws.on("close", (code, reason) => {
-      if (intentionalClose) return;
-      if (ws !== currentWs) return;
-      clearHeartbeatTimer();
-      clearStabilityTimer();
-      clearWsPingTimer();
-      if (connectionOpenedAt) {
-        const lifetimeMs = Date.now() - connectionOpenedAt;
-        const lifetimeSec = (lifetimeMs / 1e3).toFixed(1);
-        log(
-          `Disconnected (code=${code}, reason=${reason.toString()}). Connection was alive for ${lifetimeSec}s.`
-        );
-      } else {
-        log(`Disconnected (code=${code}, reason=${reason.toString()}).`);
-      }
-      if (code === 4002) {
-        log("Connection replaced by server \u2014 not reconnecting.");
-        return;
-      }
-      connectionOpenedAt = null;
-      reconnect();
-    });
-    ws.on("pong", () => {
-      if (verbose) {
-        log(`[verbose] WS pong received at ${(/* @__PURE__ */ new Date()).toISOString()}`);
+        throw new Error(msg);
       }
-    });
-    ws.on("error", (err) => {
-      logError(`WebSocket error: ${err.message}`);
-    });
-  }
-  async function reconnect() {
-    const delay = calculateDelay(attempt, DEFAULT_RECONNECT_OPTIONS);
-    const delaySec = (delay / 1e3).toFixed(1);
-    attempt++;
-    log(`Reconnecting in ${delaySec}s... (attempt ${attempt})`);
-    await sleep(delay);
-    connect();
-  }
-  connect();
-}
-function trySend(ws, data) {
-  try {
-    ws.send(JSON.stringify(data));
-  } catch {
-    console.error("Failed to send message \u2014 WebSocket may be closed");
-  }
-}
-async function logPostReviewStats(type, verdict, tokensUsed, tokensEstimated, consumptionDeps, logPrefix) {
-  const pfx = logPrefix ? `${logPrefix} ` : "";
-  const estimateTag = tokensEstimated ? " ~" : " ";
-  if (!consumptionDeps) {
-    if (verdict) {
-      console.log(
-        `${pfx}${type} complete: ${verdict} (${estimateTag}${tokensUsed} tokens${tokensEstimated ? ", estimated" : ""})`
-      );
-    } else {
-      console.log(
-        `${pfx}${type} complete (${estimateTag}${tokensUsed} tokens${tokensEstimated ? ", estimated" : ""})`
-      );
-    }
-    return;
-  }
-  recordSessionUsage(consumptionDeps.session, tokensUsed);
-  if (verdict) {
-    console.log(
-      `${pfx}${type} complete: ${verdict} (${estimateTag}${tokensUsed.toLocaleString()} tokens${tokensEstimated ? ", estimated" : ""})`
-    );
-  } else {
-    console.log(
-      `${pfx}${type} complete (${estimateTag}${tokensUsed.toLocaleString()} tokens${tokensEstimated ? ", estimated" : ""})`
-    );
-  }
-  console.log(
-    `${pfx}${formatPostReviewStats(tokensUsed, consumptionDeps.session, consumptionDeps.limits)}`
+      return response.text();
+    },
+    { maxAttempts: 2 },
+    signal
   );
 }
-function handleMessage(ws, msg, resetHeartbeat, reviewDeps, consumptionDeps, verbose, repoConfig, displayName, logPrefix, routerRelay) {
-  const pfx = logPrefix ? `${logPrefix} ` : "";
-  switch (msg.type) {
-    case "connected":
-      console.log(`${pfx}Authenticated. Protocol v${msg.version ?? "unknown"}`);
-      trySend(ws, {
-        type: "agent_preferences",
-        id: crypto2.randomUUID(),
-        timestamp: Date.now(),
-        ...displayName ? { displayName } : {},
-        repoConfig: repoConfig ?? { mode: "all" }
-      });
-      if (routerRelay) {
-        routerRelay.writeStatus("Waiting for review requests...");
-      }
-      break;
-    case "heartbeat_ping":
-      ws.send(JSON.stringify({ type: "heartbeat_pong", timestamp: Date.now() }));
-      if (verbose) {
-        console.log(
-          `${pfx}[verbose] Heartbeat ping received, pong sent at ${(/* @__PURE__ */ new Date()).toISOString()}`
-        );
-      }
-      if (resetHeartbeat) resetHeartbeat();
-      break;
-    case "review_request": {
-      const request = msg;
-      console.log(
-        `${pfx}Review request: task ${request.taskId} for ${request.project.owner}/${request.project.repo}#${request.pr.number}`
+var MAX_DIFF_FETCH_ATTEMPTS = 3;
+async function pollLoop(client, agentId, reviewDeps, consumptionDeps, agentInfo, logger, options) {
+  const { pollIntervalMs, maxConsecutiveErrors, routerRelay, reviewOnly, repoConfig, signal } = options;
+  const { log, logError, logWarn } = logger;
+  log(`Agent ${agentId} polling every ${pollIntervalMs / 1e3}s...`);
+  let consecutiveAuthErrors = 0;
+  let consecutiveErrors = 0;
+  const diffFailCounts = /* @__PURE__ */ new Map();
+  while (!signal?.aborted) {
+    try {
+      const pollBody = { agent_id: agentId };
+      if (reviewOnly) pollBody.review_only = true;
+      const pollResponse = await client.post("/api/tasks/poll", pollBody);
+      consecutiveAuthErrors = 0;
+      consecutiveErrors = 0;
+      const eligibleTasks = repoConfig ? pollResponse.tasks.filter((t) => isRepoAllowed(repoConfig, t.owner, t.repo)) : pollResponse.tasks;
+      const task = eligibleTasks.find(
+        (t) => (diffFailCounts.get(t.task_id) ?? 0) < MAX_DIFF_FETCH_ATTEMPTS
       );
-      if (routerRelay) {
-        void (async () => {
-          if (consumptionDeps) {
-            const limitResult = await checkConsumptionLimits(
-              consumptionDeps.agentId,
-              consumptionDeps.limits
-            );
-            if (!limitResult.allowed) {
-              trySend(ws, {
-                type: "review_rejected",
-                id: crypto2.randomUUID(),
-                timestamp: Date.now(),
-                taskId: request.taskId,
-                reason: limitResult.reason ?? "consumption_limit_exceeded"
-              });
-              console.log(`${pfx}Review rejected: ${limitResult.reason}`);
-              return;
-            }
-          }
-          try {
-            const prompt = routerRelay.buildReviewPrompt({
-              owner: request.project.owner,
-              repo: request.project.repo,
-              reviewMode: request.reviewMode ?? "full",
-              prompt: request.project.prompt,
-              diffContent: request.diffContent
-            });
-            const response = await routerRelay.sendPrompt(
-              "review_request",
-              request.taskId,
-              prompt,
-              request.timeout
-            );
-            const { verdict, review } = routerRelay.parseReviewResponse(response);
-            const tokensUsed = estimateTokens(prompt) + estimateTokens(response);
-            trySend(ws, {
-              type: "review_complete",
-              id: crypto2.randomUUID(),
-              timestamp: Date.now(),
-              taskId: request.taskId,
-              review,
-              verdict,
-              tokensUsed
-            });
-            await logPostReviewStats(
-              "Review",
-              verdict,
-              tokensUsed,
-              true,
-              consumptionDeps,
-              logPrefix
-            );
-          } catch (err) {
-            if (err instanceof RouterTimeoutError) {
-              trySend(ws, {
-                type: "review_error",
-                id: crypto2.randomUUID(),
-                timestamp: Date.now(),
-                taskId: request.taskId,
-                error: err.message
-              });
-            } else {
-              trySend(ws, {
-                type: "review_error",
-                id: crypto2.randomUUID(),
-                timestamp: Date.now(),
-                taskId: request.taskId,
-                error: err instanceof Error ? err.message : "Unknown error"
-              });
-            }
-            console.error(`${pfx}Review failed:`, err);
-          }
-        })();
-        break;
-      }
-      if (!reviewDeps) {
-        ws.send(
-          JSON.stringify({
-            type: "review_rejected",
-            id: crypto2.randomUUID(),
-            timestamp: Date.now(),
-            taskId: request.taskId,
-            reason: "Review execution not configured"
-          })
+      if (task) {
+        const result = await handleTask(
+          client,
+          agentId,
+          task,
+          reviewDeps,
+          consumptionDeps,
+          agentInfo,
+          logger,
+          routerRelay,
+          signal
         );
-        break;
-      }
-      void (async () => {
-        if (consumptionDeps) {
-          const limitResult = await checkConsumptionLimits(
-            consumptionDeps.agentId,
-            consumptionDeps.limits
-          );
-          if (!limitResult.allowed) {
-            trySend(ws, {
-              type: "review_rejected",
-              id: crypto2.randomUUID(),
-              timestamp: Date.now(),
-              taskId: request.taskId,
-              reason: limitResult.reason ?? "consumption_limit_exceeded"
-            });
-            console.log(`${pfx}Review rejected: ${limitResult.reason}`);
-            return;
+        if (result.diffFetchFailed) {
+          const count = (diffFailCounts.get(task.task_id) ?? 0) + 1;
+          diffFailCounts.set(task.task_id, count);
+          if (count >= MAX_DIFF_FETCH_ATTEMPTS) {
+            logWarn(`  Skipping task ${task.task_id} after ${count} diff fetch failures`);
           }
         }
-        try {
-          const result = await executeReview(
-            {
-              taskId: request.taskId,
-              diffContent: request.diffContent,
-              prompt: request.project.prompt,
-              owner: request.project.owner,
-              repo: request.project.repo,
-              prNumber: request.pr.number,
-              timeout: request.timeout,
-              reviewMode: request.reviewMode ?? "full"
-            },
-            reviewDeps
-          );
-          trySend(ws, {
-            type: "review_complete",
-            id: crypto2.randomUUID(),
-            timestamp: Date.now(),
-            taskId: request.taskId,
-            review: result.review,
-            verdict: result.verdict,
-            tokensUsed: result.tokensUsed
-          });
-          await logPostReviewStats(
-            "Review",
-            result.verdict,
-            result.tokensUsed,
-            result.tokensEstimated,
-            consumptionDeps,
-            logPrefix
-          );
-        } catch (err) {
-          if (err instanceof DiffTooLargeError) {
-            trySend(ws, {
-              type: "review_rejected",
-              id: crypto2.randomUUID(),
-              timestamp: Date.now(),
-              taskId: request.taskId,
-              reason: err.message
-            });
-          } else {
-            trySend(ws, {
-              type: "review_error",
-              id: crypto2.randomUUID(),
-              timestamp: Date.now(),
-              taskId: request.taskId,
-              error: err instanceof Error ? err.message : "Unknown error"
-            });
-          }
-          console.error(`${pfx}Review failed:`, err);
+      }
+    } catch (err) {
+      if (signal?.aborted) break;
+      if (err instanceof HttpError && (err.status === 401 || err.status === 403)) {
+        consecutiveAuthErrors++;
+        consecutiveErrors++;
+        logError(
+          `Auth error (${err.status}): ${err.message} [${consecutiveAuthErrors}/${MAX_CONSECUTIVE_AUTH_ERRORS}]`
+        );
+        if (consecutiveAuthErrors >= MAX_CONSECUTIVE_AUTH_ERRORS) {
+          logError("Authentication failed repeatedly. Exiting.");
+          break;
         }
-      })();
-      break;
-    }
-    case "summary_request": {
-      const summaryRequest = msg;
-      console.log(
-        `${pfx}Summary request: task ${summaryRequest.taskId} for ${summaryRequest.project.owner}/${summaryRequest.project.repo}#${summaryRequest.pr.number} (${summaryRequest.reviews.length} reviews)`
-      );
-      if (routerRelay) {
-        void (async () => {
-          if (consumptionDeps) {
-            const limitResult = await checkConsumptionLimits(
-              consumptionDeps.agentId,
-              consumptionDeps.limits
-            );
-            if (!limitResult.allowed) {
-              trySend(ws, {
-                type: "review_rejected",
-                id: crypto2.randomUUID(),
-                timestamp: Date.now(),
-                taskId: summaryRequest.taskId,
-                reason: limitResult.reason ?? "consumption_limit_exceeded"
-              });
-              console.log(`${pfx}Summary rejected: ${limitResult.reason}`);
-              return;
-            }
-          }
-          try {
-            const prompt = routerRelay.buildSummaryPrompt({
-              owner: summaryRequest.project.owner,
-              repo: summaryRequest.project.repo,
-              prompt: summaryRequest.project.prompt,
-              reviews: summaryRequest.reviews,
-              diffContent: summaryRequest.diffContent ?? ""
-            });
-            const response = await routerRelay.sendPrompt(
-              "summary_request",
-              summaryRequest.taskId,
-              prompt,
-              summaryRequest.timeout
-            );
-            const tokensUsed = estimateTokens(prompt) + estimateTokens(response);
-            trySend(ws, {
-              type: "summary_complete",
-              id: crypto2.randomUUID(),
-              timestamp: Date.now(),
-              taskId: summaryRequest.taskId,
-              summary: response,
-              tokensUsed
-            });
-            await logPostReviewStats(
-              "Summary",
-              void 0,
-              tokensUsed,
-              true,
-              consumptionDeps,
-              logPrefix
-            );
-          } catch (err) {
-            if (err instanceof RouterTimeoutError) {
-              trySend(ws, {
-                type: "review_error",
-                id: crypto2.randomUUID(),
-                timestamp: Date.now(),
-                taskId: summaryRequest.taskId,
-                error: err.message
-              });
-            } else {
-              trySend(ws, {
-                type: "review_error",
-                id: crypto2.randomUUID(),
-                timestamp: Date.now(),
-                taskId: summaryRequest.taskId,
-                error: err instanceof Error ? err.message : "Summary failed"
-              });
-            }
-            console.error(`${pfx}Summary failed:`, err);
-          }
-        })();
-        break;
+      } else {
+        consecutiveAuthErrors = 0;
+        consecutiveErrors++;
+        logError(`Poll error: ${err.message}`);
       }
-      if (!reviewDeps) {
-        trySend(ws, {
-          type: "review_rejected",
-          id: crypto2.randomUUID(),
-          timestamp: Date.now(),
-          taskId: summaryRequest.taskId,
-          reason: "Review tool not configured"
-        });
+      if (consecutiveErrors >= maxConsecutiveErrors) {
+        logError(
+          `Too many consecutive errors (${consecutiveErrors}/${maxConsecutiveErrors}). Shutting down.`
+        );
+        process.exitCode = 1;
         break;
       }
-      void (async () => {
-        if (consumptionDeps) {
-          const limitResult = await checkConsumptionLimits(
-            consumptionDeps.agentId,
-            consumptionDeps.limits
-          );
-          if (!limitResult.allowed) {
-            trySend(ws, {
-              type: "review_rejected",
-              id: crypto2.randomUUID(),
-              timestamp: Date.now(),
-              taskId: summaryRequest.taskId,
-              reason: limitResult.reason ?? "consumption_limit_exceeded"
-            });
-            console.log(`${pfx}Summary rejected: ${limitResult.reason}`);
-            return;
-          }
-        }
-        try {
-          const result = await executeSummary(
-            {
-              taskId: summaryRequest.taskId,
-              reviews: summaryRequest.reviews,
-              prompt: summaryRequest.project.prompt,
-              owner: summaryRequest.project.owner,
-              repo: summaryRequest.project.repo,
-              prNumber: summaryRequest.pr.number,
-              timeout: summaryRequest.timeout,
-              diffContent: summaryRequest.diffContent ?? ""
-            },
-            reviewDeps
-          );
-          trySend(ws, {
-            type: "summary_complete",
-            id: crypto2.randomUUID(),
-            timestamp: Date.now(),
-            taskId: summaryRequest.taskId,
-            summary: result.summary,
-            tokensUsed: result.tokensUsed
-          });
-          await logPostReviewStats(
-            "Summary",
-            void 0,
-            result.tokensUsed,
-            result.tokensEstimated,
-            consumptionDeps,
-            logPrefix
+      if (consecutiveErrors > 0) {
+        const backoff = Math.min(
+          pollIntervalMs * Math.pow(2, consecutiveErrors - 1),
+          MAX_POLL_BACKOFF_MS
+        );
+        const extraDelay = backoff - pollIntervalMs;
+        if (extraDelay > 0) {
+          logWarn(
+            `Poll failed (${consecutiveErrors} consecutive). Next poll in ${Math.round(backoff / 1e3)}s`
           );
-        } catch (err) {
-          if (err instanceof InputTooLargeError) {
-            trySend(ws, {
-              type: "review_rejected",
-              id: crypto2.randomUUID(),
-              timestamp: Date.now(),
-              taskId: summaryRequest.taskId,
-              reason: err.message
-            });
-          } else {
-            trySend(ws, {
-              type: "review_error",
-              id: crypto2.randomUUID(),
-              timestamp: Date.now(),
-              taskId: summaryRequest.taskId,
-              error: err instanceof Error ? err.message : "Summary failed"
-            });
-          }
-          console.error(`${pfx}Summary failed:`, err);
+          await sleep2(extraDelay, signal);
         }
-      })();
-      break;
+      }
     }
-    case "error":
-      console.error(`${pfx}Platform error: ${msg.code ?? "unknown"}`);
-      if (msg.code === "auth_revoked") process.exit(1);
-      break;
-    default:
-      break;
+    await sleep2(pollIntervalMs, signal);
   }
 }
-async function syncAgentToServer(client, serverAgents, localAgent) {
-  const existing = serverAgents.find(
-    (a) => a.model === localAgent.model && a.tool === localAgent.tool
-  );
-  if (existing) {
-    return { agentId: existing.id, created: false };
+async function handleTask(client, agentId, task, reviewDeps, consumptionDeps, agentInfo, logger, routerRelay, signal) {
+  const { task_id, owner, repo, pr_number, diff_url, timeout_seconds, prompt, role } = task;
+  const { log, logError, logWarn } = logger;
+  log(`
+Task ${task_id}: PR #${pr_number} on ${owner}/${repo} (role: ${role})`);
+  log(`  https://github.com/${owner}/${repo}/pull/${pr_number}`);
+  let claimResponse;
+  try {
+    claimResponse = await withRetry(
+      () => client.post(`/api/tasks/${task_id}/claim`, {
+        agent_id: agentId,
+        role,
+        model: agentInfo.model,
+        tool: agentInfo.tool
+      }),
+      { maxAttempts: 2 },
+      signal
+    );
+  } catch (err) {
+    const status = err instanceof HttpError ? ` (${err.status})` : "";
+    logError(`  Failed to claim task ${task_id}${status}: ${err.message}`);
+    return {};
   }
-  const body = { model: localAgent.model, tool: localAgent.tool };
-  if (localAgent.name) {
-    body.displayName = localAgent.name;
+  if (!claimResponse.claimed) {
+    log(`  Claim rejected: ${claimResponse.reason}`);
+    return {};
   }
-  if (localAgent.repos) {
-    body.repoConfig = localAgent.repos;
+  log(`  Claimed as ${role}`);
+  let diffContent;
+  try {
+    diffContent = await fetchDiff(diff_url, reviewDeps.githubToken, signal);
+    log(`  Diff fetched (${Math.round(diffContent.length / 1024)}KB)`);
+  } catch (err) {
+    logError(`  Failed to fetch diff for task ${task_id}: ${err.message}`);
+    await safeReject(
+      client,
+      task_id,
+      agentId,
+      `Cannot access diff: ${err.message}`,
+      logger
+    );
+    return { diffFetchFailed: true };
   }
-  const created = await client.post("/api/agents", body);
-  return { agentId: created.id, created: true };
-}
-function resolveLocalAgentCommand(localAgent, globalAgentCommand) {
-  const effectiveCommand = localAgent.command ?? globalAgentCommand;
-  return resolveCommandTemplate(effectiveCommand);
-}
-function startAgentRouter() {
-  void agentCommand.parseAsync(
-    ["start", "--router", "--anonymous", "--model", "router", "--tool", "opencara"],
-    { from: "user" }
-  );
-}
-var agentCommand = new Command2("agent").description("Manage review agents");
-agentCommand.command("create").description("Add an agent to local config (interactive or via flags)").option("--model <model>", "AI model name (e.g., claude-opus-4-6)").option("--tool <tool>", "Review tool name (e.g., claude-code)").option("--command <cmd>", "Custom command template (bypasses registry lookup)").action(async (opts) => {
-  const config = loadConfig();
-  requireApiKey(config);
-  let model;
-  let tool;
-  let command = opts.command;
-  if (opts.model && opts.tool) {
-    model = opts.model;
-    tool = opts.tool;
-  } else if (opts.model || opts.tool) {
-    console.error("Both --model and --tool are required in non-interactive mode.");
-    process.exit(1);
-  } else {
-    const client = new ApiClient(config.platformUrl, config.apiKey);
-    let registry;
+  let taskReviewDeps = reviewDeps;
+  let taskCheckoutPath = null;
+  if (reviewDeps.codebaseDir) {
     try {
-      registry = await client.get("/api/registry");
-    } catch {
-      console.warn("Could not fetch registry from server. Using built-in defaults.");
-      registry = DEFAULT_REGISTRY;
+      const result = cloneOrUpdate(
+        owner,
+        repo,
+        pr_number,
+        reviewDeps.codebaseDir,
+        reviewDeps.githubToken,
+        task_id
+      );
+      log(`  Codebase ${result.cloned ? "cloned" : "updated"}: ${result.localPath}`);
+      taskCheckoutPath = result.localPath;
+      taskReviewDeps = { ...reviewDeps, codebaseDir: result.localPath };
+    } catch (err) {
+      logWarn(
+        `  Warning: codebase clone failed: ${err.message}. Continuing with diff-only review.`
+      );
+      taskReviewDeps = { ...reviewDeps, codebaseDir: null };
     }
-    const { search, input } = await import("@inquirer/prompts");
-    const searchTheme = {
-      style: {
-        keysHelpTip: (keys) => keys.map(([key, action]) => `${key} ${action}`).join(", ") + ", ^C exit"
-      }
-    };
-    const existingAgents = config.agents ?? [];
-    const toolChoices = registry.tools.map((t) => ({
-      name: t.displayName,
-      value: t.name
-    }));
+  } else {
     try {
-      while (true) {
-        tool = await search({
-          message: "Select a tool:",
-          theme: searchTheme,
-          source: (term) => {
-            const q = (term ?? "").toLowerCase();
-            return toolChoices.filter(
-              (c) => c.name.toLowerCase().includes(q) || c.value.toLowerCase().includes(q)
-            );
-          }
-        });
-        const compatible = registry.models.filter((m) => m.tools.includes(tool));
-        const incompatible = registry.models.filter((m) => !m.tools.includes(tool));
-        const modelChoices = [
-          ...compatible.map((m) => ({
-            name: m.displayName,
-            value: m.name
-          })),
-          ...incompatible.map((m) => ({
-            name: `\x1B[38;5;249m${m.displayName}\x1B[0m`,
-            value: m.name
-          }))
-        ];
-        model = await search({
-          message: "Select a model:",
-          theme: searchTheme,
-          source: (term) => {
-            const q = (term ?? "").toLowerCase();
-            return modelChoices.filter(
-              (c) => c.value.toLowerCase().includes(q) || c.name.toLowerCase().includes(q)
-            );
-          }
-        });
-        const isDup = existingAgents.some((a) => a.model === model && a.tool === tool);
-        if (isDup) {
-          console.warn(`"${model}" / "${tool}" already exists in config. Choose again.`);
-          continue;
-        }
-        const modelEntry = registry.models.find((m) => m.name === model);
-        if (modelEntry && !modelEntry.tools.includes(tool)) {
-          console.warn(`Warning: "${model}" is not listed as compatible with "${tool}".`);
-        }
-        break;
-      }
-      const toolEntry = registry.tools.find((t) => t.name === tool);
-      const defaultCommand = toolEntry ? toolEntry.commandTemplate.replaceAll("${MODEL}", model) : `${tool} --model ${model}`;
-      command = await input({
-        message: "Command:",
-        default: defaultCommand,
-        prefill: "editable"
-      });
+      validatePathSegment(owner, "owner");
+      validatePathSegment(repo, "repo");
+      validatePathSegment(task_id, "task_id");
+      const repoScopedDir = path4.join(CONFIG_DIR, "repos", owner, repo, task_id);
+      fs4.mkdirSync(repoScopedDir, { recursive: true });
+      taskCheckoutPath = repoScopedDir;
+      taskReviewDeps = { ...reviewDeps, codebaseDir: repoScopedDir };
+      log(`  Working directory: ${repoScopedDir}`);
     } catch (err) {
-      if (err && typeof err === "object" && "name" in err && err.name === "ExitPromptError") {
-        console.log("Cancelled.");
-        return;
-      }
-      throw err;
+      logWarn(
+        `  Warning: failed to create working directory: ${err.message}. Continuing without scoped cwd.`
+      );
     }
   }
-  if (!command) {
-    const toolEntry = DEFAULT_REGISTRY.tools.find((t) => t.name === tool);
-    if (toolEntry) {
-      command = toolEntry.commandTemplate.replaceAll("${MODEL}", model);
+  try {
+    if (role === "summary" && "reviews" in claimResponse && claimResponse.reviews) {
+      await executeSummaryTask(
+        client,
+        agentId,
+        task_id,
+        owner,
+        repo,
+        pr_number,
+        diffContent,
+        prompt,
+        timeout_seconds,
+        claimResponse.reviews,
+        taskReviewDeps,
+        consumptionDeps,
+        logger,
+        routerRelay,
+        signal
+      );
     } else {
-      console.error(`No command template for tool "${tool}". Use --command to specify one.`);
-      process.exit(1);
+      await executeReviewTask(
+        client,
+        agentId,
+        task_id,
+        owner,
+        repo,
+        pr_number,
+        diffContent,
+        prompt,
+        timeout_seconds,
+        taskReviewDeps,
+        consumptionDeps,
+        logger,
+        routerRelay,
+        signal
+      );
     }
-  }
-  if (validateCommandBinary(command)) {
-    console.log(`Verifying... binary found.`);
-  } else {
-    console.warn(
-      `Warning: binary for command "${command.split(" ")[0]}" not found on this machine.`
-    );
-  }
-  const newAgent = { model, tool, command };
-  if (config.agents === null) {
-    config.agents = [];
-  }
-  const isDuplicate = config.agents.some((a) => a.model === model && a.tool === tool);
-  if (isDuplicate) {
-    console.error(`Agent with model "${model}" and tool "${tool}" already exists in config.`);
-    process.exit(1);
-  }
-  config.agents.push(newAgent);
-  saveConfig(config);
-  console.log("Agent added to config:");
-  console.log(`  Model:   ${model}`);
-  console.log(`  Tool:    ${tool}`);
-  console.log(`  Command: ${command}`);
-});
-agentCommand.command("init").description("Import server-side agents into local config").action(async () => {
-  const config = loadConfig();
-  const apiKey = requireApiKey(config);
-  const client = new ApiClient(config.platformUrl, apiKey);
-  let res;
-  try {
-    res = await client.get("/api/agents");
   } catch (err) {
-    console.error("Failed to list agents:", err instanceof Error ? err.message : err);
-    process.exit(1);
-  }
-  if (res.agents.length === 0) {
-    console.log("No server-side agents found. Use `opencara agent create` to add one.");
-    return;
-  }
-  let registry;
-  try {
-    registry = await client.get("/api/registry");
-  } catch {
-    registry = DEFAULT_REGISTRY;
-  }
-  const toolCommands = new Map(registry.tools.map((t) => [t.name, t.commandTemplate]));
-  const existing = config.agents ?? [];
-  let imported = 0;
-  for (const agent of res.agents) {
-    const isDuplicate = existing.some((e) => e.model === agent.model && e.tool === agent.tool);
-    if (isDuplicate) continue;
-    let command = toolCommands.get(agent.tool);
-    if (command) {
-      command = command.replaceAll("${MODEL}", agent.model);
+    if (err instanceof DiffTooLargeError || err instanceof InputTooLargeError) {
+      logError(`  ${err.message}`);
+      await safeReject(client, task_id, agentId, err.message, logger);
     } else {
-      console.warn(
-        `Warning: no command template for ${agent.model}/${agent.tool} \u2014 set command manually in config`
-      );
+      logError(`  Error on task ${task_id}: ${err.message}`);
+      await safeError(client, task_id, agentId, err.message, logger);
+    }
+  } finally {
+    if (taskCheckoutPath) {
+      cleanupTaskDir(taskCheckoutPath);
     }
-    existing.push({ model: agent.model, tool: agent.tool, command });
-    imported++;
-  }
-  config.agents = existing;
-  saveConfig(config);
-  console.log(`Imported ${imported} agent(s) to local config.`);
-  if (imported > 0) {
-    console.log("Edit ~/.opencara/config.yml to adjust commands for your system.");
   }
-});
-agentCommand.command("list").description("List registered agents").action(async () => {
-  const config = loadConfig();
-  const apiKey = requireApiKey(config);
-  const client = new ApiClient(config.platformUrl, apiKey);
-  let res;
+  return {};
+}
+async function safeReject(client, taskId, agentId, reason, logger) {
   try {
-    res = await client.get("/api/agents");
+    await withRetry(
+      () => client.post(`/api/tasks/${taskId}/reject`, {
+        agent_id: agentId,
+        reason: sanitizeTokens(reason)
+      }),
+      { maxAttempts: 2 }
+    );
   } catch (err) {
-    console.error("Failed to list agents:", err instanceof Error ? err.message : err);
-    process.exit(1);
+    logger.logError(
+      `  Failed to report rejection for task ${taskId}: ${err.message} (logged locally)`
+    );
   }
-  const trustLabels = /* @__PURE__ */ new Map();
-  for (const agent of res.agents) {
-    try {
-      const stats = await client.get(`/api/stats/${agent.id}`);
-      trustLabels.set(agent.id, stats.agent.trustTier.label);
-    } catch {
-    }
+}
+async function safeError(client, taskId, agentId, error, logger) {
+  try {
+    await withRetry(
+      () => client.post(`/api/tasks/${taskId}/error`, {
+        agent_id: agentId,
+        error: sanitizeTokens(error)
+      }),
+      { maxAttempts: 2 }
+    );
+  } catch (err) {
+    logger.logError(
+      `  Failed to report error for task ${taskId}: ${err.message} (logged locally)`
+    );
   }
-  formatTable(res.agents, trustLabels);
-});
-async function resolveAnonymousAgent(config, model, tool) {
-  const existing = config.anonymousAgents.find((a) => a.model === model && a.tool === tool);
-  if (existing) {
-    console.log(`Reusing stored anonymous agent ${existing.agentId} (${model} / ${tool})`);
-    const command2 = resolveCommandTemplate(
-      DEFAULT_REGISTRY.tools.find((t) => t.name === tool)?.commandTemplate.replaceAll("${MODEL}", model) ?? null
+}
+async function executeReviewTask(client, agentId, taskId, owner, repo, prNumber, diffContent, prompt, timeoutSeconds, reviewDeps, consumptionDeps, logger, routerRelay, signal) {
+  let reviewText;
+  let verdict;
+  let tokensUsed;
+  if (routerRelay) {
+    logger.log(`  Executing review command: [router mode]`);
+    const fullPrompt = routerRelay.buildReviewPrompt({
+      owner,
+      repo,
+      reviewMode: "full",
+      prompt,
+      diffContent
+    });
+    const response = await routerRelay.sendPrompt(
+      "review_request",
+      taskId,
+      fullPrompt,
+      timeoutSeconds
     );
-    return { entry: existing, command: command2 };
-  }
-  console.log("Registering anonymous agent...");
-  const client = new ApiClient(config.platformUrl);
-  const body = { model, tool };
-  const res = await client.post("/api/agents/anonymous", body);
-  const entry = {
-    agentId: res.agentId,
-    apiKey: res.apiKey,
-    model,
-    tool
-  };
-  config.anonymousAgents.push(entry);
-  saveConfig(config);
-  console.log(`Agent registered: ${res.agentId} (${model} / ${tool})`);
-  console.log("Credentials saved to ~/.opencara/config.yml");
-  const command = resolveCommandTemplate(
-    DEFAULT_REGISTRY.tools.find((t) => t.name === tool)?.commandTemplate.replaceAll("${MODEL}", model) ?? null
+    const parsed = routerRelay.parseReviewResponse(response);
+    reviewText = parsed.review;
+    verdict = parsed.verdict;
+    tokensUsed = estimateTokens(fullPrompt) + estimateTokens(response);
+  } else {
+    logger.log(`  Executing review command: ${reviewDeps.commandTemplate}`);
+    const result = await executeReview(
+      {
+        taskId,
+        diffContent,
+        prompt,
+        owner,
+        repo,
+        prNumber,
+        timeout: timeoutSeconds,
+        reviewMode: "full"
+      },
+      reviewDeps
+    );
+    reviewText = result.review;
+    verdict = result.verdict;
+    tokensUsed = result.tokensUsed;
+  }
+  const sanitizedReview = sanitizeTokens(reviewText);
+  await withRetry(
+    () => client.post(`/api/tasks/${taskId}/result`, {
+      agent_id: agentId,
+      type: "review",
+      review_text: sanitizedReview,
+      verdict,
+      tokens_used: tokensUsed
+    }),
+    { maxAttempts: 3 },
+    signal
   );
-  return { entry, command };
+  recordSessionUsage(consumptionDeps.session, tokensUsed);
+  logger.log(`  Review submitted (${tokensUsed.toLocaleString()} tokens)`);
+  logger.log(formatPostReviewStats(consumptionDeps.session));
 }
-agentCommand.command("start [agentIdOrModel]").description("Connect agent to platform via WebSocket").option("--all", "Start all agents from local config concurrently").option("-a, --anonymous", "Start an anonymous agent (no login required)").option("--model <model>", "AI model name (used with --anonymous)").option("--tool <tool>", "Review tool name (used with --anonymous)").option("--verbose", "Enable detailed WebSocket diagnostic logging").option("--router", "Router mode: relay prompts to stdout, read responses from stdin").option(
-  "--stability-threshold <ms>",
-  `Connection stability threshold in ms (${STABILITY_THRESHOLD_MIN_MS}\u2013${STABILITY_THRESHOLD_MAX_MS}, default: ${CONNECTION_STABILITY_THRESHOLD_MS})`
-).action(
-  async (agentIdOrModel, opts) => {
-    let stabilityThresholdMs;
-    if (opts.stabilityThreshold !== void 0) {
-      const val = Number(opts.stabilityThreshold);
-      if (!Number.isInteger(val) || val < STABILITY_THRESHOLD_MIN_MS || val > STABILITY_THRESHOLD_MAX_MS) {
-        console.error(
-          `Invalid --stability-threshold: must be an integer between ${STABILITY_THRESHOLD_MIN_MS} and ${STABILITY_THRESHOLD_MAX_MS}`
-        );
-        process.exit(1);
-      }
-      stabilityThresholdMs = val;
-    }
-    const config = loadConfig();
-    if (opts.anonymous) {
-      if (!opts.model || !opts.tool) {
-        console.error("Both --model and --tool are required with --anonymous.");
-        process.exit(1);
-      }
-      let entry;
-      let reviewDeps2;
-      let relay2;
-      if (opts.router) {
-        const existing = config.anonymousAgents.find(
-          (a) => a.model === opts.model && a.tool === opts.tool
-        );
-        if (existing) {
-          console.log(
-            `Reusing stored anonymous agent ${existing.agentId} (${opts.model} / ${opts.tool})`
-          );
-          entry = existing;
-        } else {
-          console.log("Registering anonymous agent...");
-          const client2 = new ApiClient(config.platformUrl);
-          const res = await client2.post("/api/agents/anonymous", {
-            model: opts.model,
-            tool: opts.tool
-          });
-          entry = {
-            agentId: res.agentId,
-            apiKey: res.apiKey,
-            model: opts.model,
-            tool: opts.tool
-          };
-          config.anonymousAgents.push(entry);
-          saveConfig(config);
-          console.log(`Agent registered: ${res.agentId} (${opts.model} / ${opts.tool})`);
-        }
-        relay2 = new RouterRelay();
-        relay2.start();
-      } else {
-        let resolved;
-        try {
-          resolved = await resolveAnonymousAgent(config, opts.model, opts.tool);
-        } catch (err) {
-          console.error(
-            "Failed to register anonymous agent:",
-            err instanceof Error ? err.message : err
-          );
-          process.exit(1);
-        }
-        entry = resolved.entry;
-        const command = resolved.command;
-        if (validateCommandBinary(command)) {
-          reviewDeps2 = { commandTemplate: command, maxDiffSizeKb: config.maxDiffSizeKb };
-        } else {
-          console.warn(
-            `Warning: binary "${command.split(" ")[0]}" not found. Reviews will be rejected.`
-          );
-        }
-      }
-      const consumptionDeps2 = {
-        agentId: entry.agentId,
-        limits: config.limits,
-        session: createSessionTracker()
-      };
-      console.log(`Starting anonymous agent ${entry.agentId}...`);
-      startAgent(entry.agentId, config.platformUrl, entry.apiKey, reviewDeps2, consumptionDeps2, {
-        verbose: opts.verbose,
-        stabilityThresholdMs,
-        displayName: entry.name,
-        repoConfig: entry.repoConfig,
-        routerRelay: relay2
+async function executeSummaryTask(client, agentId, taskId, owner, repo, prNumber, diffContent, prompt, timeoutSeconds, reviews, reviewDeps, consumptionDeps, logger, routerRelay, signal) {
+  if (reviews.length === 0) {
+    let reviewText;
+    let verdict;
+    let tokensUsed2;
+    if (routerRelay) {
+      logger.log(`  Executing summary command: [router mode]`);
+      const fullPrompt = routerRelay.buildReviewPrompt({
+        owner,
+        repo,
+        reviewMode: "full",
+        prompt,
+        diffContent
       });
-      return;
+      const response = await routerRelay.sendPrompt(
+        "review_request",
+        taskId,
+        fullPrompt,
+        timeoutSeconds
+      );
+      const parsed = routerRelay.parseReviewResponse(response);
+      reviewText = parsed.review;
+      verdict = parsed.verdict;
+      tokensUsed2 = estimateTokens(fullPrompt) + estimateTokens(response);
+    } else {
+      logger.log(`  Executing summary command: ${reviewDeps.commandTemplate}`);
+      const result = await executeReview(
+        {
+          taskId,
+          diffContent,
+          prompt,
+          owner,
+          repo,
+          prNumber,
+          timeout: timeoutSeconds,
+          reviewMode: "full"
+        },
+        reviewDeps
+      );
+      reviewText = result.review;
+      verdict = result.verdict;
+      tokensUsed2 = result.tokensUsed;
     }
-    if (config.agents !== null) {
-      const routerAgents = [];
-      const validAgents = [];
-      for (const local of config.agents) {
-        if (opts.router || local.router) {
-          routerAgents.push(local);
-          continue;
-        }
-        let cmd;
-        try {
-          cmd = resolveLocalAgentCommand(local, config.agentCommand);
-        } catch (err) {
-          console.warn(
-            `Skipping ${local.model}/${local.tool}: ${err instanceof Error ? err.message : "no command template available"}`
-          );
-          continue;
-        }
-        if (!validateCommandBinary(cmd)) {
-          console.warn(
-            `Skipping ${local.model}/${local.tool}: binary "${cmd.split(" ")[0]}" not found`
-          );
-          continue;
-        }
-        validAgents.push({ local, command: cmd });
-      }
-      const totalValid = validAgents.length + routerAgents.length;
-      if (totalValid === 0 && config.anonymousAgents.length === 0) {
-        console.error("No valid agents in config. Check that tool binaries are installed.");
-        process.exit(1);
-      }
-      let agentsToStart;
-      let routerAgentsToStart;
-      const anonAgentsToStart = [];
-      if (opts.all) {
-        agentsToStart = validAgents;
-        routerAgentsToStart = routerAgents;
-        anonAgentsToStart.push(...config.anonymousAgents);
-      } else if (agentIdOrModel) {
-        const cmdMatch = validAgents.find((a) => a.local.model === agentIdOrModel);
-        const routerMatch = routerAgents.find((a) => a.model === agentIdOrModel);
-        if (!cmdMatch && !routerMatch) {
-          console.error(`No agent with model "${agentIdOrModel}" found in local config.`);
-          console.error("Available agents:");
-          for (const a of validAgents) {
-            console.error(`  ${a.local.model}  (${a.local.tool})`);
-          }
-          for (const a of routerAgents) {
-            console.error(`  ${a.model}  (${a.tool}) [router]`);
-          }
-          process.exit(1);
-        }
-        agentsToStart = cmdMatch ? [cmdMatch] : [];
-        routerAgentsToStart = routerMatch ? [routerMatch] : [];
-      } else if (totalValid === 1) {
-        if (validAgents.length === 1) {
-          agentsToStart = [validAgents[0]];
-          routerAgentsToStart = [];
-          console.log(`Using agent ${validAgents[0].local.model} (${validAgents[0].local.tool})`);
-        } else {
-          agentsToStart = [];
-          routerAgentsToStart = [routerAgents[0]];
-          console.log(`Using router agent ${routerAgents[0].model} (${routerAgents[0].tool})`);
-        }
-      } else if (totalValid === 0) {
-        console.error("No valid authenticated agents in config. Use --anonymous or --all.");
-        process.exit(1);
-      } else {
-        console.error("Multiple agents in config. Specify a model name or use --all:");
-        for (const a of validAgents) {
-          console.error(`  ${a.local.model}  (${a.local.tool})`);
-        }
-        for (const a of routerAgents) {
-          console.error(`  ${a.model}  (${a.tool}) [router]`);
-        }
-        process.exit(1);
-      }
-      const totalAgents = agentsToStart.length + routerAgentsToStart.length + anonAgentsToStart.length;
-      if (totalAgents > 1) {
-        process.setMaxListeners(process.getMaxListeners() + totalAgents * 2);
-      }
-      let startedCount = 0;
-      let apiKey2;
-      let client2;
-      let serverAgents;
-      if (agentsToStart.length > 0 || routerAgentsToStart.length > 0) {
-        apiKey2 = requireApiKey(config);
-        client2 = new ApiClient(config.platformUrl, apiKey2);
-        try {
-          const res = await client2.get("/api/agents");
-          serverAgents = res.agents;
-        } catch (err) {
-          console.error("Failed to fetch agents:", err instanceof Error ? err.message : err);
-          process.exit(1);
-        }
-      }
-      for (const selected of agentsToStart) {
-        let agentId2;
-        try {
-          const sync = await syncAgentToServer(client2, serverAgents, selected.local);
-          agentId2 = sync.agentId;
-          if (sync.created) {
-            console.log(`Registered new agent ${agentId2} on platform`);
-            serverAgents.push({
-              id: agentId2,
-              model: selected.local.model,
-              tool: selected.local.tool,
-              isAnonymous: false,
-              status: "offline",
-              repoConfig: null,
-              createdAt: (/* @__PURE__ */ new Date()).toISOString()
-            });
-          }
-        } catch (err) {
-          console.error(
-            `Failed to sync agent ${selected.local.model} to server:`,
-            err instanceof Error ? err.message : err
-          );
-          continue;
-        }
-        const reviewDeps2 = {
-          commandTemplate: selected.command,
-          maxDiffSizeKb: config.maxDiffSizeKb
-        };
-        const consumptionDeps2 = {
-          agentId: agentId2,
-          limits: resolveAgentLimits(selected.local.limits, config.limits),
-          session: createSessionTracker()
-        };
-        const label = selected.local.name || selected.local.model || "unnamed";
-        console.log(`Starting agent ${label} (${agentId2})...`);
-        startAgent(agentId2, config.platformUrl, apiKey2, reviewDeps2, consumptionDeps2, {
-          verbose: opts.verbose,
-          stabilityThresholdMs,
-          repoConfig: selected.local.repos,
-          label
-        });
-        startedCount++;
-      }
-      for (const local of routerAgentsToStart) {
-        let agentId2;
-        try {
-          const sync = await syncAgentToServer(client2, serverAgents, local);
-          agentId2 = sync.agentId;
-          if (sync.created) {
-            console.log(`Registered new agent ${agentId2} on platform`);
-            serverAgents.push({
-              id: agentId2,
-              model: local.model,
-              tool: local.tool,
-              isAnonymous: false,
-              status: "offline",
-              repoConfig: null,
-              createdAt: (/* @__PURE__ */ new Date()).toISOString()
-            });
-          }
-        } catch (err) {
-          console.error(
-            `Failed to sync router agent ${local.model} to server:`,
-            err instanceof Error ? err.message : err
-          );
-          continue;
-        }
-        const relay2 = new RouterRelay();
-        relay2.start();
-        const consumptionDeps2 = {
-          agentId: agentId2,
-          limits: resolveAgentLimits(local.limits, config.limits),
-          session: createSessionTracker()
-        };
-        const label = local.name || local.model || "unnamed";
-        console.log(`Starting router agent ${label} (${agentId2})...`);
-        startAgent(agentId2, config.platformUrl, apiKey2, void 0, consumptionDeps2, {
-          verbose: opts.verbose,
-          stabilityThresholdMs,
-          repoConfig: local.repos,
-          label,
-          routerRelay: relay2
-        });
-        startedCount++;
-      }
-      for (const anon of anonAgentsToStart) {
-        let command;
-        try {
-          command = resolveCommandTemplate(
-            DEFAULT_REGISTRY.tools.find((t) => t.name === anon.tool)?.commandTemplate.replaceAll("${MODEL}", anon.model) ?? null
-          );
-        } catch {
-          console.warn(
-            `Skipping anonymous agent ${anon.agentId}: no command template for tool "${anon.tool}"`
-          );
-          continue;
-        }
-        let reviewDeps2;
-        if (validateCommandBinary(command)) {
-          reviewDeps2 = { commandTemplate: command, maxDiffSizeKb: config.maxDiffSizeKb };
-        } else {
-          console.warn(
-            `Warning: binary "${command.split(" ")[0]}" not found for anonymous agent ${anon.agentId}. Reviews will be rejected.`
-          );
-        }
-        const consumptionDeps2 = {
-          agentId: anon.agentId,
-          limits: config.limits,
-          session: createSessionTracker()
-        };
-        const anonLabel = anon.name || anon.model || "anonymous";
-        console.log(`Starting anonymous agent ${anonLabel} (${anon.agentId})...`);
-        startAgent(anon.agentId, config.platformUrl, anon.apiKey, reviewDeps2, consumptionDeps2, {
-          verbose: opts.verbose,
-          stabilityThresholdMs,
-          displayName: anon.name,
-          repoConfig: anon.repoConfig,
-          label: anonLabel
-        });
-        startedCount++;
-      }
-      if (startedCount === 0) {
-        console.error("No agents could be started.");
-        process.exit(1);
-      }
+    const sanitizedReview = sanitizeTokens(reviewText);
+    await withRetry(
+      () => client.post(`/api/tasks/${taskId}/result`, {
+        agent_id: agentId,
+        type: "summary",
+        review_text: sanitizedReview,
+        verdict,
+        tokens_used: tokensUsed2
+      }),
+      { maxAttempts: 3 },
+      signal
+    );
+    recordSessionUsage(consumptionDeps.session, tokensUsed2);
+    logger.log(`  Review submitted as summary (${tokensUsed2.toLocaleString()} tokens)`);
+    logger.log(formatPostReviewStats(consumptionDeps.session));
+    return;
+  }
+  const summaryReviews = reviews.map((r) => ({
+    agentId: r.agent_id,
+    model: "unknown",
+    tool: "unknown",
+    review: r.review_text,
+    verdict: r.verdict
+  }));
+  let summaryText;
+  let tokensUsed;
+  if (routerRelay) {
+    logger.log(`  Executing summary command: [router mode]`);
+    const fullPrompt = routerRelay.buildSummaryPrompt({
+      owner,
+      repo,
+      prompt,
+      reviews: summaryReviews,
+      diffContent
+    });
+    const response = await routerRelay.sendPrompt(
+      "summary_request",
+      taskId,
+      fullPrompt,
+      timeoutSeconds
+    );
+    summaryText = response;
+    tokensUsed = estimateTokens(fullPrompt) + estimateTokens(response);
+  } else {
+    logger.log(`  Executing summary command: ${reviewDeps.commandTemplate}`);
+    const result = await executeSummary(
+      {
+        taskId,
+        reviews: summaryReviews,
+        prompt,
+        owner,
+        repo,
+        prNumber,
+        timeout: timeoutSeconds,
+        diffContent
+      },
+      reviewDeps
+    );
+    summaryText = result.summary;
+    tokensUsed = result.tokensUsed;
+  }
+  const sanitizedSummary = sanitizeTokens(summaryText);
+  await withRetry(
+    () => client.post(`/api/tasks/${taskId}/result`, {
+      agent_id: agentId,
+      type: "summary",
+      review_text: sanitizedSummary,
+      tokens_used: tokensUsed
+    }),
+    { maxAttempts: 3 },
+    signal
+  );
+  recordSessionUsage(consumptionDeps.session, tokensUsed);
+  logger.log(`  Summary submitted (${tokensUsed.toLocaleString()} tokens)`);
+  logger.log(formatPostReviewStats(consumptionDeps.session));
+}
+function sleep2(ms, signal) {
+  return new Promise((resolve2) => {
+    if (signal?.aborted) {
+      resolve2();
       return;
     }
-    const apiKey = requireApiKey(config);
-    const client = new ApiClient(config.platformUrl, apiKey);
-    console.log(
-      "Hint: No agents in local config. Run `opencara agent init` to import, or `opencara agent create` to add agents."
+    const timer = setTimeout(resolve2, ms);
+    signal?.addEventListener(
+      "abort",
+      () => {
+        clearTimeout(timer);
+        resolve2();
+      },
+      { once: true }
     );
-    let agentId = agentIdOrModel;
-    if (!agentId) {
-      let res;
-      try {
-        res = await client.get("/api/agents");
-      } catch (err) {
-        console.error("Failed to list agents:", err instanceof Error ? err.message : err);
-        process.exit(1);
-      }
-      if (res.agents.length === 0) {
-        console.error("No agents registered. Run `opencara agent create` first.");
-        process.exit(1);
-      }
-      if (res.agents.length === 1) {
-        agentId = res.agents[0].id;
-        console.log(`Using agent ${agentId}`);
-      } else {
-        console.error("Multiple agents found. Please specify an agent ID:");
-        for (const a of res.agents) {
-          console.error(`  ${a.id}  ${a.model} / ${a.tool}`);
-        }
-        process.exit(1);
-      }
-    }
-    let reviewDeps;
-    let relay;
-    if (opts.router) {
-      relay = new RouterRelay();
-      relay.start();
+  });
+}
+async function startAgent(agentId, platformUrl, agentInfo, reviewDeps, consumptionDeps, options) {
+  const client = new ApiClient(platformUrl);
+  const session = consumptionDeps?.session ?? createSessionTracker();
+  const deps = consumptionDeps ?? { agentId, session };
+  const logger = createLogger(options?.label);
+  const { log, logError, logWarn } = logger;
+  log(`Agent ${agentId} starting...`);
+  log(`Platform: ${platformUrl}`);
+  log(`Model: ${agentInfo.model} | Tool: ${agentInfo.tool}`);
+  if (!reviewDeps) {
+    logError("No review command configured. Set command in config.yml");
+    return;
+  }
+  if (reviewDeps.commandTemplate && !options?.routerRelay) {
+    log("Testing command...");
+    const result = await testCommand(reviewDeps.commandTemplate);
+    if (result.ok) {
+      log(`Testing command... ok (${(result.elapsedMs / 1e3).toFixed(1)}s)`);
     } else {
-      try {
-        const commandTemplate = resolveCommandTemplate(config.agentCommand);
-        reviewDeps = {
-          commandTemplate,
-          maxDiffSizeKb: config.maxDiffSizeKb
-        };
-      } catch (err) {
-        console.warn(
-          `Warning: ${err instanceof Error ? err.message : "Could not determine agent command."} Reviews will be rejected.`
-        );
-      }
+      logWarn(`Warning: command test failed (${result.error}). Reviews may fail.`);
     }
-    const consumptionDeps = {
-      agentId,
-      limits: config.limits,
-      session: createSessionTracker()
-    };
-    console.log(`Starting agent ${agentId}...`);
-    startAgent(agentId, config.platformUrl, apiKey, reviewDeps, consumptionDeps, {
-      verbose: opts.verbose,
-      stabilityThresholdMs,
-      label: agentId,
-      routerRelay: relay
-    });
   }
-);
-
-// src/commands/stats.ts
-import { Command as Command3 } from "commander";
-function formatTrustTier(tier) {
-  const lines = [];
-  const pctPositive = Math.round(tier.positiveRate * 100);
-  lines.push(`  Trust:    ${tier.label} (${tier.reviewCount} reviews, ${pctPositive}% positive)`);
-  if (tier.nextTier) {
-    const pctProgress = Math.round(tier.progressToNext * 100);
-    const nextLabel = tier.nextTier.charAt(0).toUpperCase() + tier.nextTier.slice(1);
-    lines.push(`            Progress to ${nextLabel}: ${pctProgress}%`);
-  }
-  return lines.join("\n");
+  const abortController = new AbortController();
+  process.on("SIGINT", () => {
+    log("\nShutting down...");
+    abortController.abort();
+  });
+  process.on("SIGTERM", () => {
+    abortController.abort();
+  });
+  await pollLoop(client, agentId, reviewDeps, deps, agentInfo, logger, {
+    pollIntervalMs: options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS,
+    maxConsecutiveErrors: options?.maxConsecutiveErrors ?? DEFAULT_MAX_CONSECUTIVE_ERRORS,
+    routerRelay: options?.routerRelay,
+    reviewOnly: options?.reviewOnly,
+    repoConfig: options?.repoConfig,
+    signal: abortController.signal
+  });
+  log("Agent stopped.");
 }
-function formatReviewQuality(stats) {
-  const lines = [];
-  lines.push(`  Reviews:  ${stats.totalReviews} completed, ${stats.totalSummaries} summaries`);
-  const totalRatings = stats.thumbsUp + stats.thumbsDown;
-  if (totalRatings > 0) {
-    const pctPositive = Math.round(stats.thumbsUp / totalRatings * 100);
-    lines.push(`  Quality:  ${stats.thumbsUp}/${totalRatings} positive ratings (${pctPositive}%)`);
+async function startAgentRouter() {
+  const config = loadConfig();
+  const agentId = crypto.randomUUID();
+  let commandTemplate;
+  let agentConfig;
+  if (config.agents && config.agents.length > 0) {
+    agentConfig = config.agents.find((a) => a.router) ?? config.agents[0];
+    commandTemplate = agentConfig.command ?? config.agentCommand ?? void 0;
   } else {
-    lines.push(`  Quality:  No ratings yet`);
-  }
-  return lines.join("\n");
+    commandTemplate = config.agentCommand ?? void 0;
+  }
+  const router = new RouterRelay();
+  router.start();
+  const configToken = resolveGithubToken(agentConfig?.github_token, config.githubToken);
+  const auth = resolveGithubToken2(configToken);
+  const logger = createLogger(agentConfig?.name ?? "agent[0]");
+  logAuthMethod(auth.method, logger.log);
+  const codebaseDir = resolveCodebaseDir(agentConfig?.codebase_dir, config.codebaseDir);
+  const reviewDeps = {
+    commandTemplate: commandTemplate ?? "",
+    maxDiffSizeKb: config.maxDiffSizeKb,
+    githubToken: auth.token,
+    codebaseDir
+  };
+  const session = createSessionTracker();
+  const model = agentConfig?.model ?? "unknown";
+  const tool = agentConfig?.tool ?? "unknown";
+  const label = agentConfig?.name ?? "agent[0]";
+  await startAgent(
+    agentId,
+    config.platformUrl,
+    { model, tool },
+    reviewDeps,
+    {
+      agentId,
+      session
+    },
+    {
+      maxConsecutiveErrors: config.maxConsecutiveErrors,
+      routerRelay: router,
+      reviewOnly: agentConfig?.review_only,
+      repoConfig: agentConfig?.repos,
+      label
+    }
+  );
+  router.stop();
 }
-function formatRepoConfig(repoConfig) {
-  if (!repoConfig) return "  Repos:    all (default)";
-  switch (repoConfig.mode) {
-    case "all":
-      return "  Repos:    all";
-    case "own":
-      return "  Repos:    own repos only";
-    case "whitelist":
-      return `  Repos:    whitelist (${repoConfig.list?.join(", ") ?? "none"})`;
-    case "blacklist":
-      return `  Repos:    blacklist (${repoConfig.list?.join(", ") ?? "none"})`;
-    default:
-      return `  Repos:    ${repoConfig.mode}`;
+function startAgentByIndex(config, agentIndex, pollIntervalMs, auth) {
+  const agentId = crypto.randomUUID();
+  let commandTemplate;
+  let agentConfig;
+  if (config.agents && config.agents.length > agentIndex) {
+    agentConfig = config.agents[agentIndex];
+    commandTemplate = agentConfig.command ?? config.agentCommand ?? void 0;
+  } else {
+    commandTemplate = config.agentCommand ?? void 0;
   }
-}
-function formatAgentStats(agent, agentStats) {
-  const lines = [];
-  lines.push(`Agent: ${agent.id} (${agent.model} / ${agent.tool})`);
-  lines.push(formatRepoConfig(agent.repoConfig));
-  if (agentStats) {
-    lines.push(formatTrustTier(agentStats.agent.trustTier));
-    lines.push(formatReviewQuality(agentStats.stats));
-  }
-  return lines.join("\n");
-}
-async function fetchAgentStats(client, agentId) {
-  try {
-    return await client.get(`/api/stats/${agentId}`);
-  } catch {
+  const label = agentConfig?.name ?? `agent[${agentIndex}]`;
+  if (!commandTemplate) {
+    console.error(`[${label}] No command configured. Skipping.`);
     return null;
   }
+  if (!validateCommandBinary(commandTemplate)) {
+    console.error(
+      `[${label}] Command binary not found: ${commandTemplate.split(" ")[0]}. Skipping.`
+    );
+    return null;
+  }
+  let githubToken;
+  if (auth.method === "env" || auth.method === "gh-cli") {
+    githubToken = auth.token;
+  } else {
+    const configToken = agentConfig ? resolveGithubToken(agentConfig.github_token, config.githubToken) : config.githubToken;
+    githubToken = configToken;
+  }
+  const codebaseDir = resolveCodebaseDir(agentConfig?.codebase_dir, config.codebaseDir);
+  const reviewDeps = {
+    commandTemplate,
+    maxDiffSizeKb: config.maxDiffSizeKb,
+    githubToken,
+    codebaseDir
+  };
+  const isRouter = agentConfig?.router === true;
+  let routerRelay;
+  if (isRouter) {
+    routerRelay = new RouterRelay();
+    routerRelay.start();
+  }
+  const session = createSessionTracker();
+  const model = agentConfig?.model ?? "unknown";
+  const tool = agentConfig?.tool ?? "unknown";
+  const agentPromise = startAgent(
+    agentId,
+    config.platformUrl,
+    { model, tool },
+    reviewDeps,
+    { agentId, session },
+    {
+      pollIntervalMs,
+      maxConsecutiveErrors: config.maxConsecutiveErrors,
+      routerRelay,
+      reviewOnly: agentConfig?.review_only,
+      repoConfig: agentConfig?.repos,
+      label
+    }
+  ).finally(() => {
+    routerRelay?.stop();
+  });
+  return agentPromise;
 }
-var statsCommand = new Command3("stats").description("Display agent dashboard: trust tier and review quality").option("--agent <agentId>", "Show stats for a specific agent").action(async (opts) => {
+var agentCommand = new Command("agent").description("Manage review agents");
+agentCommand.command("start").description("Start agents in polling mode").option("--poll-interval <seconds>", "Poll interval in seconds", "10").option("--agent <index>", "Agent index from config.yml (0-based)", "0").option("--all", "Start all configured agents concurrently").action(async (opts) => {
   const config = loadConfig();
-  if (opts.agent) {
-    const anonEntry = findAnonymousAgent(config, opts.agent);
-    if (anonEntry) {
-      const anonClient = new ApiClient(config.platformUrl, anonEntry.apiKey);
-      const agent = {
-        id: anonEntry.agentId,
-        model: anonEntry.model,
-        tool: anonEntry.tool,
-        isAnonymous: true,
-        status: "offline",
-        repoConfig: anonEntry.repoConfig ?? null,
-        createdAt: ""
-      };
-      const agentStats = await fetchAgentStats(anonClient, anonEntry.agentId);
-      console.log(formatAgentStats(agent, agentStats));
+  const pollIntervalMs = parseInt(opts.pollInterval, 10) * 1e3;
+  const configToken = resolveGithubToken(void 0, config.githubToken);
+  const auth = resolveGithubToken2(configToken);
+  logAuthMethod(auth.method, console.log.bind(console));
+  if (opts.all) {
+    if (!config.agents || config.agents.length === 0) {
+      console.error("No agents configured in ~/.opencara/config.yml");
+      process.exit(1);
       return;
     }
-  }
-  if (!config.apiKey && config.anonymousAgents.length > 0 && !opts.agent) {
-    const outputs2 = [];
-    for (const anon of config.anonymousAgents) {
-      const anonClient = new ApiClient(config.platformUrl, anon.apiKey);
-      const agent = {
-        id: anon.agentId,
-        model: anon.model,
-        tool: anon.tool,
-        isAnonymous: true,
-        status: "offline",
-        repoConfig: anon.repoConfig ?? null,
-        createdAt: ""
-      };
-      try {
-        const agentStats = await fetchAgentStats(anonClient, anon.agentId);
-        outputs2.push(formatAgentStats(agent, agentStats));
-      } catch (err) {
-        outputs2.push(
-          `Agent: ${anon.agentId} (${anon.model} / ${anon.tool})
-  Error: ${err instanceof Error ? err.message : "Failed to fetch stats"}`
-        );
+    console.log(`Starting ${config.agents.length} agent(s)...`);
+    const promises = [];
+    let startFailed = false;
+    for (let i = 0; i < config.agents.length; i++) {
+      const p = startAgentByIndex(config, i, pollIntervalMs, auth);
+      if (p) {
+        promises.push(p);
+      } else {
+        startFailed = true;
       }
     }
-    console.log(outputs2.join("\n\n"));
-    return;
-  }
-  const apiKey = requireApiKey(config);
-  const client = new ApiClient(config.platformUrl, apiKey);
-  if (opts.agent) {
-    const agent = {
-      id: opts.agent,
-      model: "unknown",
-      tool: "unknown",
-      isAnonymous: false,
-      status: "offline",
-      repoConfig: null,
-      createdAt: ""
-    };
-    try {
-      const agentsRes2 = await client.get("/api/agents");
-      const found = agentsRes2.agents.find((a) => a.id === opts.agent);
-      if (found) {
-        agent.model = found.model;
-        agent.tool = found.tool;
-      }
-    } catch {
+    if (promises.length === 0) {
+      console.error("No agents could be started. Check your config.");
+      process.exit(1);
+      return;
     }
-    const agentStats = await fetchAgentStats(client, opts.agent);
-    console.log(formatAgentStats(agent, agentStats));
-    return;
-  }
-  let agentsRes;
-  try {
-    agentsRes = await client.get("/api/agents");
-  } catch (err) {
-    console.error("Failed to list agents:", err instanceof Error ? err.message : err);
-    process.exit(1);
-  }
-  if (agentsRes.agents.length === 0 && config.anonymousAgents.length === 0) {
-    console.log("No agents registered. Run `opencara agent create` to register one.");
-    return;
-  }
-  const outputs = [];
-  for (const agent of agentsRes.agents) {
-    try {
-      const agentStats = await fetchAgentStats(client, agent.id);
-      outputs.push(formatAgentStats(agent, agentStats));
-    } catch (err) {
-      outputs.push(
-        `Agent: ${agent.id} (${agent.model} / ${agent.tool})
-  Error: ${err instanceof Error ? err.message : "Failed to fetch stats"}`
+    if (startFailed) {
+      console.error(
+        "One or more agents could not start (see warnings above). Continuing with the rest."
       );
     }
-  }
-  for (const anon of config.anonymousAgents) {
-    const anonClient = new ApiClient(config.platformUrl, anon.apiKey);
-    const agent = {
-      id: anon.agentId,
-      model: anon.model,
-      tool: anon.tool,
-      isAnonymous: true,
-      status: "offline",
-      repoConfig: anon.repoConfig ?? null,
-      createdAt: ""
-    };
-    try {
-      const agentStats = await fetchAgentStats(anonClient, anon.agentId);
-      outputs.push(formatAgentStats(agent, agentStats));
-    } catch (err) {
-      outputs.push(
-        `Agent: ${anon.agentId} (${anon.model} / ${anon.tool})
-  Error: ${err instanceof Error ? err.message : "Failed to fetch stats"}`
+    console.log(`${promises.length} agent(s) running. Press Ctrl+C to stop all.
+`);
+    const results = await Promise.allSettled(promises);
+    const failures = results.filter((r) => r.status === "rejected");
+    if (failures.length > 0) {
+      for (const f of failures) {
+        console.error(`Agent exited with error: ${f.reason}`);
+      }
+      process.exit(1);
+    }
+  } else {
+    const maxIndex = (config.agents?.length ?? 0) - 1;
+    const agentIndex = Number(opts.agent);
+    if (!Number.isInteger(agentIndex) || agentIndex < 0 || agentIndex > maxIndex) {
+      console.error(
+        maxIndex >= 0 ? `--agent must be an integer between 0 and ${maxIndex}.` : "No agents configured in ~/.opencara/config.yml"
       );
+      process.exit(1);
+      return;
+    }
+    const p = startAgentByIndex(config, agentIndex, pollIntervalMs, auth);
+    if (!p) {
+      process.exit(1);
+      return;
     }
+    await p;
   }
-  console.log(outputs.join("\n\n"));
 });
 
 // src/index.ts
-var program = new Command4().name("opencara").description("OpenCara \u2014 distributed AI code review agent").version("0.9.0");
-program.addCommand(loginCommand);
+var program = new Command2().name("opencara").description("OpenCara \u2014 distributed AI code review agent").version("0.11.0");
 program.addCommand(agentCommand);
-program.addCommand(statsCommand);
 program.action(() => {
   startAgentRouter();
 });