prizmkit 1.1.91 → 1.1.92

package/bundled/dev-pipeline/run-refactor.sh

@@ -8,13 +8,14 @@ set -euo pipefail
 # execute refactors from a .prizmkit/plans/refactor-list.json specification.
 #
 # Usage:
-#   ./run-refactor.sh run [.prizmkit/plans/refactor-list.json]          Run all refactors
+#   ./run-refactor.sh run [.prizmkit/plans/refactor-list.json] [options] Run all refactors
 #   ./run-refactor.sh run <refactor-id> [options]       Run a single refactor
 #   ./run-refactor.sh status [.prizmkit/plans/refactor-list.json]       Show pipeline status
 #   ./run-refactor.sh reset                             Clear all state
 #
 # Environment Variables:
-#   MAX_RETRIES           Max retries per refactor (default: 3)
+#   MAX_RETRIES           Max code retries per refactor (default: 3)
+#   MAX_INFRA_RETRIES     Max infrastructure/provider retries per refactor (default: 3)
 #   SESSION_TIMEOUT       Session timeout in seconds (default: 0 = no limit)
 #   AI_CLI                AI CLI command name (auto-detected: cbc, claude, or codex)
 #   CODEBUDDY_CLI         Legacy alias for AI_CLI (deprecated, use AI_CLI instead)
@@ -43,6 +44,7 @@ SCRIPTS_DIR="$SCRIPT_DIR/scripts"
 
 # Configuration
 MAX_RETRIES=${MAX_RETRIES:-3}
+MAX_INFRA_RETRIES=${MAX_INFRA_RETRIES:-3}
 SESSION_TIMEOUT=${SESSION_TIMEOUT:-0}
 HEARTBEAT_STALE_THRESHOLD=${HEARTBEAT_STALE_THRESHOLD:-600}
 HEARTBEAT_INTERVAL=${HEARTBEAT_INTERVAL:-30}
@@ -92,8 +94,9 @@ spawn_and_wait_session() {
     local bootstrap_prompt="$4"
     local session_dir="$5"
     local max_retries="$6"
-    local item_model="${7:-}"
-    local base_branch="${8:-main}"
+    local max_infra_retries="$7"
+    local item_model="${8:-}"
+    local base_branch="${9:-main}"
 
     local session_log="$session_dir/logs/session.log"
     local progress_json="$session_dir/logs/progress.json"
@@ -149,9 +152,23 @@ spawn_and_wait_session() {
     # Check for stale-kill marker (heartbeat killed the process due to no progress)
     local stale_kill_marker="$session_dir/logs/stale-kill.json"
     local was_stale_killed=false
+    local stale_kill_reason=""
     if [[ -f "$stale_kill_marker" ]]; then
         was_stale_killed=true
-        log_warn "Session was stale-killed by heartbeat monitor (no progress for too long)"
+        stale_kill_reason=$(python3 - "$stale_kill_marker" <<'PY' 2>/dev/null || true
+import json, sys
+try:
+    with open(sys.argv[1], encoding="utf-8") as fh:
+        print(json.load(fh).get("reason") or "")
+except Exception:
+    pass
+PY
+)
+        if [[ "$stale_kill_reason" == "error_loop" ]]; then
+            log_warn "Session was killed by heartbeat monitor due to repeated read-offset/wasted-call errors"
+        else
+            log_warn "Session was stale-killed by heartbeat monitor (no progress for too long)"
+        fi
     fi
 
     local was_infra_error=false
@@ -185,7 +202,11 @@ spawn_and_wait_session() {
         log_warn "Infrastructure errors are retried without consuming code retry budget"
         session_status="infra_error"
     elif [[ "$was_stale_killed" == true ]]; then
-        log_warn "Session stale-killed (no progress for ${STALE_KILL_THRESHOLD}s)"
+        if [[ "$stale_kill_reason" == "error_loop" ]]; then
+            log_warn "Session killed due to repeated read-offset/wasted-call error loop"
+        else
+            log_warn "Session stale-killed (no progress for ${STALE_KILL_THRESHOLD}s)"
+        fi
         log_warn "Stale-killed sessions are treated as failed; dev branch is preserved for inspection"
         session_status="crashed"
     elif [[ $exit_code -ne 0 ]]; then
@@ -202,10 +223,10 @@ spawn_and_wait_session() {
             session_status="success"
         else
             local uncommitted=""
-            uncommitted=$(git -C "$project_root" status --porcelain 2>/dev/null | head -1 || true)
+            uncommitted=$(prizm_git_status_safe "$project_root" | head -1 || true)
             if [[ -n "$uncommitted" ]]; then
                 log_warn "Session exited cleanly but produced no commits (uncommitted changes found) — auto-committing..."
-                git -C "$project_root" add -A 2>/dev/null || true
+                prizm_git_add_all_safe "$project_root" || true
                 if git -C "$project_root" commit --no-verify -m "chore($refactor_id): auto-commit session work" 2>/dev/null; then
                     log_info "Auto-commit succeeded"
                     session_status="success"
@@ -224,10 +245,10 @@ spawn_and_wait_session() {
     if [[ "$session_status" == "success" ]]; then
         if git -C "$project_root" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
             local dirty_files=""
-            dirty_files=$(git -C "$project_root" status --porcelain 2>/dev/null || true)
+            dirty_files=$(prizm_git_status_safe "$project_root" || true)
             if [[ -n "$dirty_files" ]]; then
                 log_info "Auto-committing remaining session artifacts..."
-                git -C "$project_root" add -A 2>/dev/null || true
+                prizm_git_add_all_safe "$project_root" || true
                 git -C "$project_root" commit --no-verify --amend --no-edit 2>/dev/null \
                     || git -C "$project_root" commit --no-verify -m "chore($refactor_id): include remaining session artifacts" 2>/dev/null \
                     || true
@@ -305,7 +326,20 @@ sys.exit(0)
         fi
     fi
 
-    # Update refactor status (do NOT commit on dev branch — commit happens after merge)
+    # Final status updates happen after the caller returns to the original branch.
+    _SPAWN_RESULT="$session_status"
+}
+
+finalize_refactor_status_after_branch_return() {
+    local refactor_id="$1"
+    local refactor_list="$2"
+    local session_id="$3"
+    local session_status="$4"
+    local max_retries="$5"
+    local max_infra_retries="$6"
+
+    # Update refactor status on the original branch. The caller commits the
+    # resulting refactor-list diff immediately after this helper returns.
     local update_output
     update_output=$(python3 "$SCRIPTS_DIR/update-refactor-status.py" \
         --refactor-list "$refactor_list" \
@@ -314,14 +348,13 @@ sys.exit(0)
         --session-status "$session_status" \
         --session-id "$session_id" \
         --max-retries "$max_retries" \
+        --max-infra-retries "$max_infra_retries" \
         --action update 2>&1) || {
         log_error "Failed to update refactor status: $update_output"
         update_output=""
     }
 
     _SPAWN_ITEM_STATUS="$(printf '%s' "$update_output" | prizm_extract_update_new_status)"
-
-    _SPAWN_RESULT="$session_status"
 }
 
 # ============================================================
@@ -361,6 +394,8 @@ for item in data.get('refactors', []):
                 --state-dir "$STATE_DIR" \
                 --refactor-id "$_interrupted_id" \
                 --session-status "failed" \
+                --max-retries "$MAX_RETRIES" \
+                --max-infra-retries "$MAX_INFRA_RETRIES" \
                 --action update 2>/dev/null || true
             log_info "Refactor $_interrupted_id marked as failed due to interrupt"
         fi
@@ -433,6 +468,16 @@ run_one() {
             --clean) do_clean=true; shift ;;
             --no-reset) no_reset=true; shift ;;
             --timeout) shift; SESSION_TIMEOUT="${1:-0}"; shift ;;
+            --max-infra-retries)
+                shift
+                if [[ $# -eq 0 ]]; then
+                    log_error "--max-infra-retries requires a value"
+                    exit 1
+                fi
+                prizm_require_positive_int "--max-infra-retries" "$1"
+                MAX_INFRA_RETRIES="$1"
+                shift
+                ;;
             --mode)
                 shift
                 if [[ $# -eq 0 ]]; then
@@ -725,6 +770,8 @@ else:
                 --state-dir "$STATE_DIR" \
                 --refactor-id "$refactor_id" \
                 --session-status "failed" \
+                --max-retries "$MAX_RETRIES" \
+                --max-infra-retries "$MAX_INFRA_RETRIES" \
                 --action update 2>/dev/null || true
             log_info "Refactor $refactor_id marked as failed due to interrupt"
         fi
@@ -758,12 +805,13 @@ else:
     if branch_create "$_proj_root" "$_branch_name" "$_source_branch"; then
         _DEV_BRANCH_NAME="$_branch_name"
     else
-        log_warn "Failed to create branch; running session on current branch"
+        log_error "Failed to create branch: $_branch_name from $_source_branch — aborting to avoid running on $_source_branch"
+        return 1
     fi
 
     spawn_and_wait_session \
         "$refactor_id" "$refactor_list" "$session_id" \
-        "$bootstrap_prompt" "$session_dir" 999 "$refactor_model" "$_ORIGINAL_BRANCH"
+        "$bootstrap_prompt" "$session_dir" "$MAX_RETRIES" "$MAX_INFRA_RETRIES" "$refactor_model" "$_ORIGINAL_BRANCH"
     local session_status="$_SPAWN_RESULT"
 
     # Merge dev branch back to original on success
@@ -773,7 +821,7 @@ else:
         else
             log_warn "Auto-merge failed — dev branch preserved: $_DEV_BRANCH_NAME"
             log_warn "Merge manually: git checkout $_ORIGINAL_BRANCH && git rebase $_DEV_BRANCH_NAME"
-            _DEV_BRANCH_NAME=""
+            session_status="merge_conflict"
         fi
     elif [[ -n "$_DEV_BRANCH_NAME" ]]; then
         # Session failed — preserve dev branch for inspection
@@ -784,10 +832,12 @@ else:
     # GUARANTEED: always return to original branch regardless of success/failure/merge outcome
     branch_ensure_return "$_proj_root" "$_ORIGINAL_BRANCH"
 
+    finalize_refactor_status_after_branch_return \
+        "$refactor_id" "$refactor_list" "$session_id" "$session_status" "$MAX_RETRIES" "$MAX_INFRA_RETRIES"
+
     # Commit refactor status update on the original branch (after guaranteed return)
     if ! git -C "$_proj_root" diff --quiet "$refactor_list" 2>/dev/null; then
-        git -C "$_proj_root" add "$refactor_list"
-        git -C "$_proj_root" commit --no-verify -m "chore($refactor_id): update refactor status" 2>/dev/null || true
+        prizm_git_commit_paths "$_proj_root" "chore($refactor_id): update refactor status" "$refactor_list"
     fi
 
     echo ""
@@ -808,7 +858,41 @@ else:
 # ============================================================
 
 main() {
-    local refactor_list="${1:-$PRIZMKIT_DIR/plans/refactor-list.json}"
+    local refactor_list="$PRIZMKIT_DIR/plans/refactor-list.json"
+
+    while [[ $# -gt 0 ]]; do
+        case "$1" in
+            --max-infra-retries)
+                shift
+                if [[ $# -eq 0 ]]; then
+                    log_error "--max-infra-retries requires a value"
+                    exit 1
+                fi
+                prizm_require_positive_int "--max-infra-retries" "$1"
+                MAX_INFRA_RETRIES="$1"
+                shift
+                ;;
+            --)
+                shift
+                break
+                ;;
+            -*)
+                log_error "Unknown option: $1"
+                show_help
+                exit 1
+                ;;
+            *)
+                refactor_list="$1"
+                shift
+                ;;
+        esac
+    done
+
+    if [[ $# -gt 0 ]]; then
+        log_error "Unexpected arguments: $*"
+        show_help
+        exit 1
+    fi
 
     if [[ ! "$refactor_list" = /* ]]; then
         refactor_list="$(pwd)/$refactor_list"
@@ -870,7 +954,8 @@ main() {
     echo -e "${BOLD}        Refactor Pipeline Runner Started${NC}"
     echo -e "${BOLD}════════════════════════════════════════════════════${NC}"
     log_info "Refactor list: $refactor_list"
-    log_info "Max retries per refactor: $MAX_RETRIES"
+    log_info "Max code retries per refactor: $MAX_RETRIES"
+    log_info "Max infrastructure retries per refactor: $MAX_INFRA_RETRIES"
     if [[ $SESSION_TIMEOUT -gt 0 ]]; then
         log_info "Session timeout: ${SESSION_TIMEOUT}s"
     else
@@ -920,6 +1005,7 @@ main() {
             --refactor-list "$refactor_list" \
             --state-dir "$STATE_DIR" \
             --max-retries "$MAX_RETRIES" \
+            --max-infra-retries "$MAX_INFRA_RETRIES" \
             --action get_next 2>/dev/null); then
             log_error "Failed to get next refactor"
             break
@@ -1007,27 +1093,43 @@ DEPLOY_PROMPT_EOF
         fi
 
         # Parse refactor info
-        local refactor_id refactor_title refactor_complexity retry_count resume_phase
+        local refactor_id refactor_title refactor_complexity retry_count infra_error_count resume_phase
         refactor_id=$(echo "$next_refactor" | jq -r '.refactor_id')
         refactor_title=$(echo "$next_refactor" | jq -r '.title')
         refactor_complexity=$(echo "$next_refactor" | jq -r '.complexity')
         retry_count=$(echo "$next_refactor" | jq -r '.retry_count // 0')
+        infra_error_count=$(echo "$next_refactor" | jq -r '.infra_error_count // 0')
         resume_phase=$(echo "$next_refactor" | jq -r '.resume_from_phase // "null"')
 
         echo ""
         echo -e "${BOLD}────────────────────────────────────────────────────${NC}"
         log_info "Refactor: ${BOLD}$refactor_id${NC} — $refactor_title"
-        log_info "Complexity: $refactor_complexity | Retry: $retry_count / $MAX_RETRIES"
+        log_info "Complexity: $refactor_complexity"
+        log_info "Code retry: $retry_count / $MAX_RETRIES"
+        log_info "Infrastructure retry: $infra_error_count / $MAX_INFRA_RETRIES"
         if [[ "$resume_phase" != "null" ]]; then
             log_info "Resuming from Phase $resume_phase"
         fi
         echo -e "${BOLD}────────────────────────────────────────────────────${NC}"
 
-        # Pre-commit any dirty tree from previous iteration
-        if ! git -C "$_proj_root" diff --quiet HEAD 2>/dev/null || [ -n "$(git -C "$_proj_root" ls-files --others --exclude-standard 2>/dev/null)" ]; then
-            log_info "Dirty working tree detected — committing before $refactor_id..."
-            git -C "$_proj_root" add -A 2>/dev/null || true
-            git -C "$_proj_root" commit --no-verify -m "chore: capture artifacts before $refactor_id session" 2>/dev/null || true
+        # Do not auto-commit an arbitrary dirty baseline on the original branch.
+        # Only pipeline bookkeeping is committed explicitly; user/source WIP,
+        # submodule dirt, specs, and root-level hidden tool temporary worktrees
+        # must never be swept into main by a broad git add.
+        local _dirty_files=""
+        _dirty_files=$(prizm_git_status_non_bookkeeping "$_proj_root" "$STATE_DIR" "$refactor_list" || true)
+        if [[ -n "$_dirty_files" ]]; then
+            log_error "Dirty working tree detected before $refactor_id; refusing to commit it on $_ORIGINAL_BRANCH."
+            log_error "Commit/stash your changes or start from a clean branch, then rerun the pipeline."
+            printf '%s\n' "$_dirty_files" | sed 's/^/  /'
+            break
+        fi
+
+        local _bookkeeping_dirty=""
+        _bookkeeping_dirty=$(prizm_git_status_bookkeeping "$_proj_root" "$STATE_DIR" "$refactor_list" || true)
+        if [[ -n "$_bookkeeping_dirty" ]]; then
+            log_info "Committing pending pipeline bookkeeping before $refactor_id..."
+            prizm_git_commit_paths "$_proj_root" "chore($refactor_id): include pipeline bookkeeping" "$refactor_list" "$STATE_DIR"
         fi
 
         # Mark refactor as in-progress BEFORE creating dev branch
@@ -1040,8 +1142,7 @@ DEPLOY_PROMPT_EOF
             --action start >/dev/null 2>&1 || true
         # Commit the in_progress status on the original branch
         if ! git -C "$_proj_root" diff --quiet "$refactor_list" 2>/dev/null; then
-            git -C "$_proj_root" add "$refactor_list" 2>/dev/null || true
-            git -C "$_proj_root" commit --no-verify -m "chore($refactor_id): mark in_progress" 2>/dev/null || true
+            prizm_git_commit_paths "$_proj_root" "chore($refactor_id): mark in_progress" "$refactor_list"
         fi
 
         # Create per-refactor dev branch (from the now-updated original branch)
@@ -1050,8 +1151,9 @@ DEPLOY_PROMPT_EOF
             _DEV_BRANCH_NAME="$_refactor_branch"
             log_info "Dev branch: $_refactor_branch"
         else
-            log_warn "Failed to create dev branch; running on current branch: $_ORIGINAL_BRANCH"
+            log_error "Failed to create dev branch: $_refactor_branch from $_ORIGINAL_BRANCH — aborting to avoid running on $_ORIGINAL_BRANCH"
             _DEV_BRANCH_NAME=""
+            break
         fi
 
         # Generate session
@@ -1122,7 +1224,7 @@ DEPLOY_PROMPT_EOF
 
         spawn_and_wait_session \
             "$refactor_id" "$refactor_list" "$session_id" \
-            "$bootstrap_prompt" "$session_dir" "$MAX_RETRIES" "$refactor_model" "$_ORIGINAL_BRANCH"
+            "$bootstrap_prompt" "$session_dir" "$MAX_RETRIES" "$MAX_INFRA_RETRIES" "$refactor_model" "$_ORIGINAL_BRANCH"
 
         # Validate key artifacts after successful session
         if [[ "$_SPAWN_RESULT" == "success" ]]; then
@@ -1135,7 +1237,6 @@ DEPLOY_PROMPT_EOF
         fi
 
         local session_status="$_SPAWN_RESULT"
-        local item_status_after_session="${_SPAWN_ITEM_STATUS:-}"
 
         # Merge per-refactor dev branch back to original on success
         if [[ "$session_status" == "success" && -n "$_DEV_BRANCH_NAME" ]]; then
@@ -1144,7 +1245,7 @@ DEPLOY_PROMPT_EOF
             else
                 log_warn "Auto-merge failed — dev branch preserved: $_DEV_BRANCH_NAME"
                 log_warn "Merge manually: git checkout $_ORIGINAL_BRANCH && git rebase $_DEV_BRANCH_NAME"
-                _DEV_BRANCH_NAME=""
+                session_status="merge_conflict"
             fi
         elif [[ -n "$_DEV_BRANCH_NAME" ]]; then
             # Session failed — preserve dev branch for inspection
@@ -1155,10 +1256,13 @@ DEPLOY_PROMPT_EOF
         # GUARANTEED: always return to original branch regardless of success/failure/merge outcome
         branch_ensure_return "$_proj_root" "$_ORIGINAL_BRANCH"
 
+        finalize_refactor_status_after_branch_return \
+            "$refactor_id" "$refactor_list" "$session_id" "$session_status" "$MAX_RETRIES" "$MAX_INFRA_RETRIES"
+        local item_status_after_session="${_SPAWN_ITEM_STATUS:-}"
+
         # Commit refactor status update on the original branch (after guaranteed return)
         if ! git -C "$_proj_root" diff --quiet "$refactor_list" 2>/dev/null; then
-            git -C "$_proj_root" add "$refactor_list"
-            git -C "$_proj_root" commit --no-verify -m "chore($refactor_id): update refactor status" 2>/dev/null || true
+            prizm_git_commit_paths "$_proj_root" "chore($refactor_id): update refactor status" "$refactor_list"
         fi
 
         # Stuck detection
@@ -1185,7 +1289,7 @@ DEPLOY_PROMPT_EOF
             log_error "════════════════════════════════════════════════════"
             break
         elif [[ "$session_status" != "success" && "$STOP_ON_FAILURE" == "1" ]]; then
-            log_info "STOP_ON_FAILURE: $refactor_id is ${item_status_after_session:-unknown}; retry budget not exhausted, continuing."
+            log_info "STOP_ON_FAILURE: $refactor_id is ${item_status_after_session:-unknown}; code/infra retry budget not exhausted, continuing."
         fi
 
         log_info "Pausing 5s before next refactor..."
@@ -1201,7 +1305,7 @@ show_help() {
     echo "Usage: $0 <command> [options]"
     echo ""
     echo "Commands:"
-    echo "  run [.prizmkit/plans/refactor-list.json]                Run all refactors in dependency-topological order"
+    echo "  run [.prizmkit/plans/refactor-list.json] [options]       Run all refactors in dependency-topological order"
     echo "  run <refactor-id> [options]              Run a single refactor"
     echo "  status [.prizmkit/plans/refactor-list.json]              Show refactor pipeline status"
     echo "  reset                                    Clear all refactor state"
@@ -1212,12 +1316,17 @@ show_help() {
     echo "  --clean                     Delete artifacts and reset before running"
     echo "  --no-reset                  Skip status reset (preserve retry count)"
     echo "  --timeout N                 Session timeout in seconds (default: 0 = no limit)"
+    echo "  --max-infra-retries N       Max infrastructure/provider retries (default: 3)"
     echo "  --mode <lite|standard|full> Override pipeline mode"
     echo "  --critic                    Enable adversarial critic review"
     echo "  --no-critic                 Disable adversarial critic review"
     echo ""
+    echo "Pipeline Options (run all):"
+    echo "  --max-infra-retries N       Max infrastructure/provider retries (default: 3)"
+    echo ""
     echo "Environment Variables:"
-    echo "  MAX_RETRIES              Max retries per refactor (default: 3)"
+    echo "  MAX_RETRIES              Max code retries per refactor (default: 3)"
+    echo "  MAX_INFRA_RETRIES     Max infrastructure/provider retries per refactor (default: 3)"
     echo "  SESSION_TIMEOUT          Session timeout in seconds (default: 0 = no limit)"
     echo "  MODEL                    Default AI model (overridden by per-refactor model in refactor list)"
     echo "  PRIZMKIT_EFFORT          AI reasoning effort (low|medium|high|xhigh|max; max is Claude Code only)"
@@ -1249,7 +1358,7 @@ case "${1:-run}" in
         if [[ "${1:-}" =~ ^[Rr]-[0-9]+ ]]; then
             run_one "$@"
         else
-            main "${1:-$PRIZMKIT_DIR/plans/refactor-list.json}"
+            main "$@"
         fi
         ;;
     status)
@@ -1261,6 +1370,8 @@ case "${1:-run}" in
         python3 "$SCRIPTS_DIR/update-refactor-status.py" \
             --refactor-list "${2:-$PRIZMKIT_DIR/plans/refactor-list.json}" \
             --state-dir "$STATE_DIR" \
+            --max-retries "$MAX_RETRIES" \
+            --max-infra-retries "$MAX_INFRA_RETRIES" \
             --action status
         ;;
     reset)

package/bundled/dev-pipeline/scripts/update-bug-status.py

@@ -16,7 +16,7 @@ Usage:
         --bug-list <path> --state-dir <path> \
         --action <get_next|start|update|status|pause|reset|clean|unskip> \
         [--bug-id <id>] [--session-status <status>] \
-        [--session-id <id>] [--max-retries <n>]
+        [--session-id <id>] [--max-retries <n>] [--max-infra-retries <n>]
 """
 
 import argparse
@@ -75,7 +75,8 @@ def parse_args():
         help="Session outcome status (required for 'update' action)",
     )
     parser.add_argument("--session-id", default=None, help="Session ID (optional, for 'update' action)")
-    parser.add_argument("--max-retries", type=int, default=3, help="Maximum retry count (default: 3)")
+    parser.add_argument("--max-retries", type=int, default=3, help="Maximum code retry count (default: 3)")
+    parser.add_argument("--max-infra-retries", type=int, default=3, help="Maximum infrastructure retry count (default: 3)")
     parser.add_argument("--project-root", default=None, help="Project root directory. Required for 'clean' action.")
     return parser.parse_args()
 
@@ -98,6 +99,9 @@ def load_bug_status(state_dir, bug_id):
             "bug_id": bug_id,
             "retry_count": 0,
             "max_retries": 3,
+            "max_infra_retries": 3,
+            "infra_error_count": 0,
+            "last_infra_error_session_id": None,
             "sessions": [],
             "last_session_id": None,
             "resume_from_phase": None,
@@ -111,6 +115,9 @@ def load_bug_status(state_dir, bug_id):
             "bug_id": bug_id,
             "retry_count": 0,
             "max_retries": 3,
+            "max_infra_retries": 3,
+            "infra_error_count": 0,
+            "last_infra_error_session_id": None,
             "sessions": [],
             "last_session_id": None,
             "resume_from_phase": None,
@@ -234,6 +241,7 @@ def action_get_next(bug_list_data, state_dir):
         "title": chosen.get("title", ""),
         "severity": chosen.get("severity", "medium"),
         "retry_count": chosen_status_data.get("retry_count", 0),
+        "infra_error_count": chosen_status_data.get("infra_error_count", 0),
         "resume_from_phase": chosen_status_data.get("resume_from_phase", None),
     }
     print(json.dumps(result, indent=2, ensure_ascii=False))
@@ -248,6 +256,7 @@ def action_update(args, bug_list_path, state_dir):
     session_status = args.session_status
     session_id = args.session_id
     max_retries = args.max_retries
+    max_infra_retries = args.max_infra_retries
 
     if not bug_id:
         error_out("--bug-id is required for 'update' action")
@@ -262,6 +271,8 @@ def action_update(args, bug_list_path, state_dir):
     new_status = get_bug_status_from_list(bug_list_path, bug_id)
 
     if session_status == "success":
+        bs["infra_error_count"] = 0
+        bs["last_infra_error_session_id"] = None
         new_status = "completed"
         bs["resume_from_phase"] = None
         err = update_bug_in_list(bug_list_path, bug_id, "completed")
@@ -286,11 +297,25 @@ def action_update(args, bug_list_path, state_dir):
             error_out("Failed to update .prizmkit/plans/bug-fix-list.json: {}".format(err))
             return
     elif session_status == "infra_error":
-        new_status = "pending"
-        bs["infra_error_count"] = bs.get("infra_error_count", 0) + 1
+        # AI CLI/provider outage, auth failure, gateway error, etc.
+        # Infra failures do not consume the code retry budget, but they still
+        # need their own bounded budget so a flaky provider cannot loop forever.
+        infra_error_count = bs.get("infra_error_count", 0) + 1
+        bs["infra_error_count"] = infra_error_count
         bs["last_infra_error_session_id"] = session_id
+        bs["max_infra_retries"] = max_infra_retries
+        bs["degraded_reason"] = "infra_error"
+        if session_id:
+            bs["last_session_id"] = session_id
         bs["resume_from_phase"] = None
 
+        if infra_error_count >= max_infra_retries:
+            new_status = "failed"
+            if session_id:
+                bs["last_failed_session_id"] = session_id
+        else:
+            new_status = "pending"
+
         err = update_bug_in_list(bug_list_path, bug_id, new_status)
         if err:
             error_out("Failed to update .prizmkit/plans/bug-fix-list.json: {}".format(err))
@@ -338,6 +363,8 @@ def action_update(args, bug_list_path, state_dir):
         "session_status": session_status,
         "new_status": new_status,
         "retry_count": bs["retry_count"],
+        "infra_error_count": bs.get("infra_error_count", 0),
+        "max_infra_retries": max_infra_retries,
         "resume_from_phase": bs.get("resume_from_phase"),
         "updated_at": bs["updated_at"],
     }
@@ -577,6 +604,8 @@ def action_reset(args, bug_list_path, state_dir):
     old_retry = bs.get("retry_count", 0)
 
     bs["retry_count"] = 0
+    bs["infra_error_count"] = 0
+    bs["last_infra_error_session_id"] = None
     bs["sessions"] = []
     bs["last_session_id"] = None
     bs["resume_from_phase"] = None
@@ -652,6 +681,8 @@ def action_clean(args, bug_list_path, state_dir):
     old_retry = bs.get("retry_count", 0)
 
     bs["retry_count"] = 0
+    bs["infra_error_count"] = 0
+    bs["last_infra_error_session_id"] = None
     bs["sessions"] = []
     bs["last_session_id"] = None
     bs["resume_from_phase"] = None
@@ -740,6 +771,8 @@ def action_start(args, bug_list_path, state_dir):
         "bug_id": bug_id,
         "old_status": old_status,
         "new_status": "in_progress",
+        "retry_count": bs.get("retry_count", 0),
+        "infra_error_count": bs.get("infra_error_count", 0),
         "updated_at": bs["updated_at"],
     }
     print(json.dumps(result, indent=2, ensure_ascii=False))
@@ -816,6 +849,8 @@ def action_unskip(args, bug_list_path, state_dir):
     for bid in to_reset:
         bs = load_bug_status(state_dir, bid)
         bs["retry_count"] = 0
+        bs["infra_error_count"] = 0
+        bs["last_infra_error_session_id"] = None
         bs["sessions"] = []
         bs["last_session_id"] = None
         bs["resume_from_phase"] = None