prizmkit 1.1.91 → 1.1.92

package/bundled/VERSION.json

@@ -1,5 +1,5 @@
 {
-  "frameworkVersion": "1.1.91",
-  "bundledAt": "2026-07-01T17:51:47.362Z",
-  "bundledFrom": "5dcb047"
+  "frameworkVersion": "1.1.92",
+  "bundledAt": "2026-07-02T15:14:07.667Z",
+  "bundledFrom": "edf0ddb"
 }

package/bundled/dev-pipeline/lib/branch.sh

@@ -211,18 +211,21 @@ branch_save_wip() {
         return 0
     fi
 
-    # Check if there are any uncommitted changes (tracked or untracked, excluding gitignored)
+    # Check if there are any uncommitted changes (tracked or untracked,
+    # excluding gitignored and root-level hidden tool temporary worktrees)
     local has_changes
-    has_changes=$(git -C "$project_root" status --porcelain 2>/dev/null || true)
+    has_changes=$(prizm_git_status_safe "$project_root" || true)
     if [[ -z "$has_changes" ]]; then
         return 0
     fi
 
     log_warn "Saving uncommitted work-in-progress on branch: $dev_branch"
 
-    # Stage all changes (tracked + untracked, respects .gitignore)
-    if ! git -C "$project_root" add -A 2>/dev/null; then
-        log_warn "git add -A failed — uncommitted work may be lost on branch switch"
+    # Stage all changes (tracked + untracked, respects .gitignore), excluding
+    # root-level hidden tool temporary worktrees so nested agent repos are not
+    # recorded as accidental gitlinks in the user's project.
+    if ! prizm_git_add_all_safe "$project_root"; then
+        log_warn "git add failed — uncommitted work may be lost on branch switch"
         return 0
     fi
 

package/bundled/dev-pipeline/lib/common.sh

@@ -23,6 +23,128 @@ log_warn()    { echo -e "${YELLOW}[WARN]${NC}    $(date '+%Y-%m-%d %H:%M:%S') $*
 log_error()   { echo -e "${RED}[ERROR]${NC}   $(date '+%Y-%m-%d %H:%M:%S') $*"; }
 log_success() { echo -e "${GREEN}[SUCCESS]${NC} $(date '+%Y-%m-%d %H:%M:%S') $*"; }
 
+prizm_require_positive_int() {
+    local option_name="$1"
+    local option_value="$2"
+    if [[ ! "$option_value" =~ ^[1-9][0-9]*$ ]]; then
+        log_error "$option_name must be a positive integer: $option_value"
+        exit 1
+    fi
+}
+
+# Ignore temporary git worktrees created under root-level hidden AI tool dirs
+# matching .<tool>/worktree(s), without hiding normal source directories.
+PRIZM_GIT_HIDDEN_TOOL_WORKTREE_EXCLUDES=(
+    ':(top,exclude,glob).*/worktree'
+    ':(top,exclude,glob).*/worktree/**'
+    ':(top,exclude,glob).*/worktrees'
+    ':(top,exclude,glob).*/worktrees/**'
+)
+
+prizm_git_status_safe() {
+    local project_root="$1"
+    git -C "$project_root" status --porcelain -- . \
+        "${PRIZM_GIT_HIDDEN_TOOL_WORKTREE_EXCLUDES[@]}" 2>/dev/null
+}
+
+prizm_git_add_all_safe() {
+    local project_root="$1"
+    git -C "$project_root" add -A -- . \
+        "${PRIZM_GIT_HIDDEN_TOOL_WORKTREE_EXCLUDES[@]}" 2>/dev/null
+}
+
+prizm_git_relative_path() {
+    local project_root="$1"
+    local target_path="$2"
+    python3 - "$project_root" "$target_path" <<'PY' 2>/dev/null || true
+import os
+import sys
+root = os.path.abspath(sys.argv[1])
+target = os.path.abspath(sys.argv[2])
+print(os.path.relpath(target, root).replace(os.sep, "/"))
+PY
+}
+
+prizm_git_status_non_bookkeeping() {
+    local project_root="$1"
+    local state_dir="$2"
+    local list_path="$3"
+
+    local state_rel list_rel
+    state_rel="$(prizm_git_relative_path "$project_root" "$state_dir")"
+    list_rel="$(prizm_git_relative_path "$project_root" "$list_path")"
+
+    local line path
+    while IFS= read -r line; do
+        [[ -n "$line" ]] || continue
+        path="${line:3}"
+        if [[ "$path" == *" -> "* ]]; then
+            path="${path##* -> }"
+        fi
+        path="${path%\"}"
+        path="${path#\"}"
+        path="${path#./}"
+        if [[ -n "$list_rel" && "$path" == "$list_rel" ]]; then
+            continue
+        fi
+        if [[ -n "$state_rel" && ( "$path" == "$state_rel" || "$path" == "$state_rel/"* ) ]]; then
+            continue
+        fi
+        printf '%s\n' "$line"
+    done < <(prizm_git_status_safe "$project_root")
+}
+
+prizm_git_status_bookkeeping() {
+    local project_root="$1"
+    local state_dir="$2"
+    local list_path="$3"
+
+    local state_rel list_rel
+    state_rel="$(prizm_git_relative_path "$project_root" "$state_dir")"
+    list_rel="$(prizm_git_relative_path "$project_root" "$list_path")"
+
+    local line path
+    while IFS= read -r line; do
+        [[ -n "$line" ]] || continue
+        path="${line:3}"
+        if [[ "$path" == *" -> "* ]]; then
+            path="${path##* -> }"
+        fi
+        path="${path%\"}"
+        path="${path#\"}"
+        path="${path#./}"
+        if [[ -n "$list_rel" && "$path" == "$list_rel" ]]; then
+            printf '%s\n' "$line"
+            continue
+        fi
+        if [[ -n "$state_rel" && ( "$path" == "$state_rel" || "$path" == "$state_rel/"* ) ]]; then
+            printf '%s\n' "$line"
+        fi
+    done < <(prizm_git_status_safe "$project_root")
+}
+
+prizm_git_commit_paths() {
+    local project_root="$1"
+    local message="$2"
+    shift 2
+
+    local paths=()
+    local path rel_path
+    for path in "$@"; do
+        [[ -n "$path" && -e "$path" ]] || continue
+        rel_path="$(prizm_git_relative_path "$project_root" "$path")"
+        [[ -n "$rel_path" ]] || continue
+        paths+=("$rel_path")
+    done
+    [[ ${#paths[@]} -gt 0 ]] || return 0
+
+    git -C "$project_root" add -- "${paths[@]}" 2>/dev/null || true
+    if ! git -C "$project_root" diff --cached --quiet -- "${paths[@]}" 2>/dev/null; then
+        git -C "$project_root" commit --no-verify -m "$message" -- "${paths[@]}" 2>/dev/null || true
+    fi
+}
+
+
 # ============================================================
 # Path resolution (single source of truth)
 # ============================================================

package/bundled/dev-pipeline/lib/heartbeat.sh

@@ -46,6 +46,7 @@ start_heartbeat() {
         local prev_progress_signature=""
         local prev_error_loop_signature=""
         local stale_seconds=0
+        local stale_reason="stale_session"
         while kill -0 "$cli_pid" 2>/dev/null; do
             sleep "$heartbeat_interval"
             elapsed=$((elapsed + heartbeat_interval))
@@ -240,16 +241,20 @@ PY
             # child activity as the primary progress signals — the parent process is
             # still running and children may still be producing output.
             if [[ "$error_loop_detected" == "true" ]]; then
+                stale_reason="error_loop"
                 stale_seconds=$effective_stale_kill_threshold
             elif [[ "$log_truncated" == "true" ]]; then
+                stale_reason="stale_session"
                 if [[ $progress_advanced -gt 0 || $child_growth -gt 0 ]]; then
                     stale_seconds=0
                 else
                     stale_seconds=$((stale_seconds + heartbeat_interval))
                 fi
             elif [[ $growth -le 0 && $child_growth -eq 0 && $progress_advanced -eq 0 ]]; then
+                stale_reason="stale_session"
                 stale_seconds=$((stale_seconds + heartbeat_interval))
             else
+                stale_reason="stale_session"
                 stale_seconds=0
             fi
 
@@ -333,14 +338,19 @@ PY
             # stale window to surface stuck agents promptly.
             if [[ $effective_stale_kill_threshold -gt 0 && $stale_seconds -ge $effective_stale_kill_threshold ]]; then
                 local stale_mins=$((stale_seconds / 60))
-                echo -e "  ${RED}[HEARTBEAT]${NC} ${mins}m${secs}s | log: ${size_display} | ${RED}STALE-KILL: no progress for ${stale_mins}m (threshold: ${effective_stale_kill_threshold}s)${NC}"
-                echo -e "  ${RED}[HEARTBEAT]${NC} Killing AI CLI process $cli_pid (stale session)..."
+                if [[ "$stale_reason" == "error_loop" ]]; then
+                    echo -e "  ${RED}[HEARTBEAT]${NC} ${mins}m${secs}s | log: ${size_display} | ${RED}STALE-KILL: repeated read-offset/wasted-call error loop (threshold: ${effective_stale_kill_threshold}s)${NC}"
+                    echo -e "  ${RED}[HEARTBEAT]${NC} Killing AI CLI process $cli_pid (error loop)..."
+                else
+                    echo -e "  ${RED}[HEARTBEAT]${NC} ${mins}m${secs}s | log: ${size_display} | ${RED}STALE-KILL: no progress for ${stale_mins}m (threshold: ${effective_stale_kill_threshold}s)${NC}"
+                    echo -e "  ${RED}[HEARTBEAT]${NC} Killing AI CLI process $cli_pid (stale session)..."
+                fi
                 # Write the marker before killing. Some CLIs exit quickly, and the
                 # parent runner may stop this heartbeat process immediately after
                 # wait(1) returns.
                 local _marker_dir
                 _marker_dir="$(dirname "$session_log")"
-                echo "{\"killed_at\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\", \"reason\": \"stale_session\", \"stale_seconds\": $stale_seconds, \"threshold\": $effective_stale_kill_threshold}" > "$_marker_dir/stale-kill.json" 2>/dev/null || true
+                echo "{\"killed_at\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\", \"reason\": \"${stale_reason}\", \"stale_seconds\": $stale_seconds, \"threshold\": $effective_stale_kill_threshold}" > "$_marker_dir/stale-kill.json" 2>/dev/null || true
                 kill -TERM "$cli_pid" 2>/dev/null || true
                 # Give process 10s to exit gracefully, then force kill
                 local stale_kill_grace_seconds="${STALE_KILL_GRACE_SECONDS:-10}"

package/bundled/dev-pipeline/run-bugfix.sh

@@ -8,13 +8,14 @@ set -euo pipefail
 # fix bugs from a .prizmkit/plans/bug-fix-list.json specification.
 #
 # Usage:
-#   ./run-bugfix.sh run [.prizmkit/plans/bug-fix-list.json]          Run all bugs
+#   ./run-bugfix.sh run [.prizmkit/plans/bug-fix-list.json] [options] Run all bugs
 #   ./run-bugfix.sh run <bug-id> [options]            Run a single bug
 #   ./run-bugfix.sh status [.prizmkit/plans/bug-fix-list.json]        Show pipeline status
 #   ./run-bugfix.sh reset                             Clear all state
 #
 # Environment Variables:
-#   MAX_RETRIES           Max retries per bug (default: 3)
+#   MAX_RETRIES           Max code retries per bug (default: 3)
+#   MAX_INFRA_RETRIES     Max infrastructure/provider retries per bug (default: 3)
 #   SESSION_TIMEOUT       Session timeout in seconds (default: 0 = no limit)
 #   AI_CLI                AI CLI command name (auto-detected: cbc, claude, or codex)
 #   CODEBUDDY_CLI         Legacy alias for AI_CLI (deprecated, use AI_CLI instead)
@@ -42,6 +43,7 @@ SCRIPTS_DIR="$SCRIPT_DIR/scripts"
 
 # Configuration
 MAX_RETRIES=${MAX_RETRIES:-3}
+MAX_INFRA_RETRIES=${MAX_INFRA_RETRIES:-3}
 SESSION_TIMEOUT=${SESSION_TIMEOUT:-0}
 HEARTBEAT_STALE_THRESHOLD=${HEARTBEAT_STALE_THRESHOLD:-600}
 HEARTBEAT_INTERVAL=${HEARTBEAT_INTERVAL:-30}
@@ -90,8 +92,9 @@ spawn_and_wait_session() {
     local bootstrap_prompt="$4"
     local session_dir="$5"
     local max_retries="$6"
-    local item_model="${7:-}"
-    local base_branch="${8:-main}"
+    local max_infra_retries="$7"
+    local item_model="${8:-}"
+    local base_branch="${9:-main}"
 
     local session_log="$session_dir/logs/session.log"
     local progress_json="$session_dir/logs/progress.json"
@@ -147,9 +150,23 @@ spawn_and_wait_session() {
     # Check for stale-kill marker (heartbeat killed the process due to no progress)
     local stale_kill_marker="$session_dir/logs/stale-kill.json"
     local was_stale_killed=false
+    local stale_kill_reason=""
     if [[ -f "$stale_kill_marker" ]]; then
         was_stale_killed=true
-        log_warn "Session was stale-killed by heartbeat monitor (no progress for too long)"
+        stale_kill_reason=$(python3 - "$stale_kill_marker" <<'PY' 2>/dev/null || true
+import json, sys
+try:
+    with open(sys.argv[1], encoding="utf-8") as fh:
+        print(json.load(fh).get("reason") or "")
+except Exception:
+    pass
+PY
+)
+        if [[ "$stale_kill_reason" == "error_loop" ]]; then
+            log_warn "Session was killed by heartbeat monitor due to repeated read-offset/wasted-call errors"
+        else
+            log_warn "Session was stale-killed by heartbeat monitor (no progress for too long)"
+        fi
     fi
 
     local was_infra_error=false
@@ -183,7 +200,11 @@ spawn_and_wait_session() {
         log_warn "Infrastructure errors are retried without consuming code retry budget"
         session_status="infra_error"
     elif [[ "$was_stale_killed" == true ]]; then
-        log_warn "Session stale-killed (no progress for ${STALE_KILL_THRESHOLD}s)"
+        if [[ "$stale_kill_reason" == "error_loop" ]]; then
+            log_warn "Session killed due to repeated read-offset/wasted-call error loop"
+        else
+            log_warn "Session stale-killed (no progress for ${STALE_KILL_THRESHOLD}s)"
+        fi
         log_warn "Stale-killed sessions are treated as failed; dev branch is preserved for inspection"
         session_status="crashed"
     elif [[ $exit_code -ne 0 ]]; then
@@ -200,10 +221,10 @@ spawn_and_wait_session() {
             session_status="success"
         else
             local uncommitted=""
-            uncommitted=$(git -C "$project_root" status --porcelain 2>/dev/null | head -1 || true)
+            uncommitted=$(prizm_git_status_safe "$project_root" | head -1 || true)
             if [[ -n "$uncommitted" ]]; then
                 log_warn "Session exited cleanly but produced no commits (uncommitted changes found) — auto-committing..."
-                git -C "$project_root" add -A 2>/dev/null || true
+                prizm_git_add_all_safe "$project_root" || true
                 if git -C "$project_root" commit --no-verify -m "chore($bug_id): auto-commit session work" 2>/dev/null; then
                     log_info "Auto-commit succeeded"
                     session_status="success"
@@ -222,10 +243,10 @@ spawn_and_wait_session() {
     if [[ "$session_status" == "success" ]]; then
         if git -C "$project_root" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
             local dirty_files=""
-            dirty_files=$(git -C "$project_root" status --porcelain 2>/dev/null || true)
+            dirty_files=$(prizm_git_status_safe "$project_root" || true)
             if [[ -n "$dirty_files" ]]; then
                 log_info "Auto-committing remaining session artifacts..."
-                git -C "$project_root" add -A 2>/dev/null || true
+                prizm_git_add_all_safe "$project_root" || true
                 git -C "$project_root" commit --no-verify --amend --no-edit 2>/dev/null \
                     || git -C "$project_root" commit --no-verify -m "chore($bug_id): include remaining session artifacts" 2>/dev/null \
                     || true
@@ -278,7 +299,20 @@ sys.exit(0)
     # Subagent detection
     prizm_detect_subagents "$session_log"
 
-    # Update bug status (do NOT commit on dev branch — commit happens after merge)
+    # Final status updates happen after the caller returns to the original branch.
+    _SPAWN_RESULT="$session_status"
+}
+
+finalize_bug_status_after_branch_return() {
+    local bug_id="$1"
+    local bug_list="$2"
+    local session_id="$3"
+    local session_status="$4"
+    local max_retries="$5"
+    local max_infra_retries="$6"
+
+    # Update bug status on the original branch. The caller commits the resulting
+    # bug-list diff immediately after this helper returns.
     local update_output
     update_output=$(python3 "$SCRIPTS_DIR/update-bug-status.py" \
         --bug-list "$bug_list" \
@@ -287,14 +321,13 @@ sys.exit(0)
         --session-status "$session_status" \
         --session-id "$session_id" \
         --max-retries "$max_retries" \
+        --max-infra-retries "$max_infra_retries" \
         --action update 2>&1) || {
         log_error "Failed to update bug status: $update_output"
         update_output=""
     }
 
     _SPAWN_ITEM_STATUS="$(printf '%s' "$update_output" | prizm_extract_update_new_status)"
-
-    _SPAWN_RESULT="$session_status"
 }
 
 # ============================================================
@@ -334,6 +367,8 @@ for bug in data.get('bugs', []):
                 --state-dir "$STATE_DIR" \
                 --bug-id "$_interrupted_id" \
                 --session-status "failed" \
+                --max-retries "$MAX_RETRIES" \
+                --max-infra-retries "$MAX_INFRA_RETRIES" \
                 --action update 2>/dev/null || true
             log_info "Bug $_interrupted_id marked as failed due to interrupt"
         fi
@@ -406,6 +441,16 @@ run_one() {
             --clean) do_clean=true; shift ;;
             --no-reset) no_reset=true; shift ;;
             --timeout) shift; SESSION_TIMEOUT="${1:-0}"; shift ;;
+            --max-infra-retries)
+                shift
+                if [[ $# -eq 0 ]]; then
+                    log_error "--max-infra-retries requires a value"
+                    exit 1
+                fi
+                prizm_require_positive_int "--max-infra-retries" "$1"
+                MAX_INFRA_RETRIES="$1"
+                shift
+                ;;
             --mode)
                 shift
                 if [[ $# -eq 0 ]]; then
@@ -695,6 +740,8 @@ else:
                 --state-dir "$STATE_DIR" \
                 --bug-id "$bug_id" \
                 --session-status "failed" \
+                --max-retries "$MAX_RETRIES" \
+                --max-infra-retries "$MAX_INFRA_RETRIES" \
                 --action update 2>/dev/null || true
             log_info "Bug $bug_id marked as failed due to interrupt"
         fi
@@ -728,12 +775,13 @@ else:
     if branch_create "$_proj_root" "$_branch_name" "$_source_branch"; then
         _DEV_BRANCH_NAME="$_branch_name"
     else
-        log_warn "Failed to create branch; running session on current branch"
+        log_error "Failed to create branch: $_branch_name from $_source_branch — aborting to avoid running on $_source_branch"
+        return 1
     fi
 
     spawn_and_wait_session \
         "$bug_id" "$bug_list" "$session_id" \
-        "$bootstrap_prompt" "$session_dir" 999 "$bug_model" "$_ORIGINAL_BRANCH"
+        "$bootstrap_prompt" "$session_dir" "$MAX_RETRIES" "$MAX_INFRA_RETRIES" "$bug_model" "$_ORIGINAL_BRANCH"
     local session_status="$_SPAWN_RESULT"
 
     # Merge dev branch back to original on success
@@ -743,7 +791,7 @@ else:
         else
             log_warn "Auto-merge failed — dev branch preserved: $_DEV_BRANCH_NAME"
             log_warn "Merge manually: git checkout $_ORIGINAL_BRANCH && git rebase $_DEV_BRANCH_NAME"
-            _DEV_BRANCH_NAME=""
+            session_status="merge_conflict"
         fi
     elif [[ -n "$_DEV_BRANCH_NAME" ]]; then
         # Session failed — preserve dev branch for inspection
@@ -754,10 +802,12 @@ else:
     # GUARANTEED: always return to original branch regardless of success/failure/merge outcome
     branch_ensure_return "$_proj_root" "$_ORIGINAL_BRANCH"
 
+    finalize_bug_status_after_branch_return \
+        "$bug_id" "$bug_list" "$session_id" "$session_status" "$MAX_RETRIES" "$MAX_INFRA_RETRIES"
+
     # Commit bug status update on the original branch (after guaranteed return)
     if ! git -C "$_proj_root" diff --quiet "$bug_list" 2>/dev/null; then
-        git -C "$_proj_root" add "$bug_list"
-        git -C "$_proj_root" commit --no-verify -m "chore($bug_id): update bug status" 2>/dev/null || true
+        prizm_git_commit_paths "$_proj_root" "chore($bug_id): update bug status" "$bug_list"
     fi
 
     echo ""
@@ -778,7 +828,41 @@ else:
 # ============================================================
 
 main() {
-    local bug_list="${1:-$PRIZMKIT_DIR/plans/bug-fix-list.json}"
+    local bug_list="$PRIZMKIT_DIR/plans/bug-fix-list.json"
+
+    while [[ $# -gt 0 ]]; do
+        case "$1" in
+            --max-infra-retries)
+                shift
+                if [[ $# -eq 0 ]]; then
+                    log_error "--max-infra-retries requires a value"
+                    exit 1
+                fi
+                prizm_require_positive_int "--max-infra-retries" "$1"
+                MAX_INFRA_RETRIES="$1"
+                shift
+                ;;
+            --)
+                shift
+                break
+                ;;
+            -*)
+                log_error "Unknown option: $1"
+                show_help
+                exit 1
+                ;;
+            *)
+                bug_list="$1"
+                shift
+                ;;
+        esac
+    done
+
+    if [[ $# -gt 0 ]]; then
+        log_error "Unexpected arguments: $*"
+        show_help
+        exit 1
+    fi
 
     if [[ ! "$bug_list" = /* ]]; then
         bug_list="$(pwd)/$bug_list"
@@ -840,7 +924,8 @@ main() {
     echo -e "${BOLD}        Bug-Fix Pipeline Runner Started${NC}"
     echo -e "${BOLD}════════════════════════════════════════════════════${NC}"
     log_info "Bug fix list: $bug_list"
-    log_info "Max retries per bug: $MAX_RETRIES"
+    log_info "Max code retries per bug: $MAX_RETRIES"
+    log_info "Max infrastructure retries per bug: $MAX_INFRA_RETRIES"
     if [[ $SESSION_TIMEOUT -gt 0 ]]; then
         log_info "Session timeout: ${SESSION_TIMEOUT}s"
     else
@@ -885,6 +970,7 @@ main() {
             --bug-list "$bug_list" \
             --state-dir "$STATE_DIR" \
             --max-retries "$MAX_RETRIES" \
+            --max-infra-retries "$MAX_INFRA_RETRIES" \
             --action get_next 2>/dev/null); then
             log_error "Failed to get next bug"
             break
@@ -972,27 +1058,43 @@ DEPLOY_PROMPT_EOF
         fi
 
         # Parse bug info
-        local bug_id bug_title bug_severity retry_count resume_phase
+        local bug_id bug_title bug_severity retry_count infra_error_count resume_phase
         bug_id=$(echo "$next_bug" | jq -r '.bug_id')
         bug_title=$(echo "$next_bug" | jq -r '.title')
         bug_severity=$(echo "$next_bug" | jq -r '.severity')
         retry_count=$(echo "$next_bug" | jq -r '.retry_count // 0')
+        infra_error_count=$(echo "$next_bug" | jq -r '.infra_error_count // 0')
         resume_phase=$(echo "$next_bug" | jq -r '.resume_from_phase // "null"')
 
         echo ""
         echo -e "${BOLD}────────────────────────────────────────────────────${NC}"
         log_info "Bug: ${BOLD}$bug_id${NC} — $bug_title"
-        log_info "Severity: $bug_severity | Retry: $retry_count / $MAX_RETRIES"
+        log_info "Severity: $bug_severity"
+        log_info "Code retry: $retry_count / $MAX_RETRIES"
+        log_info "Infrastructure retry: $infra_error_count / $MAX_INFRA_RETRIES"
         if [[ "$resume_phase" != "null" ]]; then
             log_info "Resuming from Phase $resume_phase"
         fi
         echo -e "${BOLD}────────────────────────────────────────────────────${NC}"
 
-        # Pre-commit any dirty tree from previous iteration
-        if ! git -C "$_proj_root" diff --quiet HEAD 2>/dev/null || [ -n "$(git -C "$_proj_root" ls-files --others --exclude-standard 2>/dev/null)" ]; then
-            log_info "Dirty working tree detected — committing before $bug_id..."
-            git -C "$_proj_root" add -A 2>/dev/null || true
-            git -C "$_proj_root" commit --no-verify -m "chore: capture artifacts before $bug_id session" 2>/dev/null || true
+        # Do not auto-commit an arbitrary dirty baseline on the original branch.
+        # Only pipeline bookkeeping is committed explicitly; user/source WIP,
+        # submodule dirt, specs, and root-level hidden tool temporary worktrees
+        # must never be swept into main by a broad git add.
+        local _dirty_files=""
+        _dirty_files=$(prizm_git_status_non_bookkeeping "$_proj_root" "$STATE_DIR" "$bug_list" || true)
+        if [[ -n "$_dirty_files" ]]; then
+            log_error "Dirty working tree detected before $bug_id; refusing to commit it on $_ORIGINAL_BRANCH."
+            log_error "Commit/stash your changes or start from a clean branch, then rerun the pipeline."
+            printf '%s\n' "$_dirty_files" | sed 's/^/  /'
+            break
+        fi
+
+        local _bookkeeping_dirty=""
+        _bookkeeping_dirty=$(prizm_git_status_bookkeeping "$_proj_root" "$STATE_DIR" "$bug_list" || true)
+        if [[ -n "$_bookkeeping_dirty" ]]; then
+            log_info "Committing pending pipeline bookkeeping before $bug_id..."
+            prizm_git_commit_paths "$_proj_root" "chore($bug_id): include pipeline bookkeeping" "$bug_list" "$STATE_DIR"
         fi
 
         # Mark bug as in-progress BEFORE creating dev branch
@@ -1005,8 +1107,7 @@ DEPLOY_PROMPT_EOF
             --action start >/dev/null 2>&1 || true
         # Commit the in_progress status on the original branch
         if ! git -C "$_proj_root" diff --quiet "$bug_list" 2>/dev/null; then
-            git -C "$_proj_root" add "$bug_list" 2>/dev/null || true
-            git -C "$_proj_root" commit --no-verify -m "chore($bug_id): mark in_progress" 2>/dev/null || true
+            prizm_git_commit_paths "$_proj_root" "chore($bug_id): mark in_progress" "$bug_list"
         fi
 
         # Create per-bug dev branch (from the now-updated original branch)
@@ -1015,8 +1116,9 @@ DEPLOY_PROMPT_EOF
             _DEV_BRANCH_NAME="$_bug_branch"
             log_info "Dev branch: $_bug_branch"
         else
-            log_warn "Failed to create dev branch; running on current branch: $_ORIGINAL_BRANCH"
+            log_error "Failed to create dev branch: $_bug_branch from $_ORIGINAL_BRANCH — aborting to avoid running on $_ORIGINAL_BRANCH"
             _DEV_BRANCH_NAME=""
+            break
         fi
 
         # Generate session
@@ -1086,10 +1188,9 @@ DEPLOY_PROMPT_EOF
 
         spawn_and_wait_session \
             "$bug_id" "$bug_list" "$session_id" \
-            "$bootstrap_prompt" "$session_dir" "$MAX_RETRIES" "$bug_model" "$_ORIGINAL_BRANCH"
+            "$bootstrap_prompt" "$session_dir" "$MAX_RETRIES" "$MAX_INFRA_RETRIES" "$bug_model" "$_ORIGINAL_BRANCH"
 
         local session_status="$_SPAWN_RESULT"
-        local item_status_after_session="${_SPAWN_ITEM_STATUS:-}"
 
         # Merge per-bug dev branch back to original on success
         if [[ "$session_status" == "success" && -n "$_DEV_BRANCH_NAME" ]]; then
@@ -1098,7 +1199,7 @@ DEPLOY_PROMPT_EOF
             else
                 log_warn "Auto-merge failed — dev branch preserved: $_DEV_BRANCH_NAME"
                 log_warn "Merge manually: git checkout $_ORIGINAL_BRANCH && git rebase $_DEV_BRANCH_NAME"
-                _DEV_BRANCH_NAME=""
+                session_status="merge_conflict"
             fi
         elif [[ -n "$_DEV_BRANCH_NAME" ]]; then
             # Session failed — preserve dev branch for inspection
@@ -1109,10 +1210,13 @@ DEPLOY_PROMPT_EOF
         # GUARANTEED: always return to original branch regardless of success/failure/merge outcome
         branch_ensure_return "$_proj_root" "$_ORIGINAL_BRANCH"
 
+        finalize_bug_status_after_branch_return \
+            "$bug_id" "$bug_list" "$session_id" "$session_status" "$MAX_RETRIES" "$MAX_INFRA_RETRIES"
+        local item_status_after_session="${_SPAWN_ITEM_STATUS:-}"
+
         # Commit bug status update on the original branch (after guaranteed return)
         if ! git -C "$_proj_root" diff --quiet "$bug_list" 2>/dev/null; then
-            git -C "$_proj_root" add "$bug_list"
-            git -C "$_proj_root" commit --no-verify -m "chore($bug_id): update bug status" 2>/dev/null || true
+            prizm_git_commit_paths "$_proj_root" "chore($bug_id): update bug status" "$bug_list"
         fi
 
         session_count=$((session_count + 1))
@@ -1129,7 +1233,7 @@ DEPLOY_PROMPT_EOF
             log_error "════════════════════════════════════════════════════"
             break
         elif [[ "$session_status" != "success" && "$STOP_ON_FAILURE" == "1" ]]; then
-            log_info "STOP_ON_FAILURE: $bug_id is ${item_status_after_session:-unknown}; retry budget not exhausted, continuing."
+            log_info "STOP_ON_FAILURE: $bug_id is ${item_status_after_session:-unknown}; code/infra retry budget not exhausted, continuing."
         fi
 
         # Stuck detection
@@ -1166,7 +1270,7 @@ show_help() {
     echo "Usage: $0 <command> [options]"
     echo ""
     echo "Commands:"
-    echo "  run [.prizmkit/plans/bug-fix-list.json]                 Run all bugs by severity/priority order"
+    echo "  run [.prizmkit/plans/bug-fix-list.json] [options]         Run all bugs by severity/priority order"
     echo "  run <bug-id> [options]                   Run a single bug fix"
     echo "  status [.prizmkit/plans/bug-fix-list.json]               Show bug fix pipeline status"
     echo "  reset                                    Clear all bugfix state"
@@ -1177,12 +1281,17 @@ show_help() {
     echo "  --clean                     Delete artifacts and reset before running"
     echo "  --no-reset                  Skip status reset (preserve retry count)"
     echo "  --timeout N                 Session timeout in seconds (default: 0 = no limit)"
+    echo "  --max-infra-retries N       Max infrastructure/provider retries (default: 3)"
     echo "  --mode <lite|standard|full> Override pipeline mode"
     echo "  --critic                    Enable adversarial critic review"
     echo "  --no-critic                 Disable adversarial critic review"
     echo ""
+    echo "Pipeline Options (run all):"
+    echo "  --max-infra-retries N       Max infrastructure/provider retries (default: 3)"
+    echo ""
     echo "Environment Variables:"
-    echo "  MAX_RETRIES           Max retries per bug (default: 3)"
+    echo "  MAX_RETRIES           Max code retries per bug (default: 3)"
+    echo "  MAX_INFRA_RETRIES     Max infrastructure/provider retries per bug (default: 3)"
     echo "  SESSION_TIMEOUT       Session timeout in seconds (default: 0 = no limit)"
     echo "  MODEL                 Default AI model (overridden by per-bug model in bug list)"
     echo "  PRIZMKIT_EFFORT       AI reasoning effort (low|medium|high|xhigh|max; max is Claude Code only)"
@@ -1214,7 +1323,7 @@ case "${1:-run}" in
         if [[ "${1:-}" =~ ^[Bb]-[0-9]+ ]]; then
             run_one "$@"
         else
-            main "${1:-$PRIZMKIT_DIR/plans/bug-fix-list.json}"
+            main "$@"
         fi
         ;;
     status)
@@ -1226,6 +1335,8 @@ case "${1:-run}" in
         python3 "$SCRIPTS_DIR/update-bug-status.py" \
             --bug-list "${2:-$PRIZMKIT_DIR/plans/bug-fix-list.json}" \
             --state-dir "$STATE_DIR" \
+            --max-retries "$MAX_RETRIES" \
+            --max-infra-retries "$MAX_INFRA_RETRIES" \
             --action status
         ;;
     reset)