pullfrog 0.1.55 → 0.1.56

package/dist/index.js

@@ -98334,14 +98334,14 @@ var require_turndown_cjs = __commonJS({
         } else if (node2.nodeType === 1) {
           replacement = replacementForNode.call(self2, node2);
         }
-        return join26(output, replacement);
+        return join27(output, replacement);
       }, "");
     }
     function postProcess(output) {
       var self2 = this;
       this.rules.forEach(function(rule) {
         if (typeof rule.append === "function") {
-          output = join26(output, rule.append(self2.options));
+          output = join27(output, rule.append(self2.options));
         }
       });
       return output.replace(/^[\t\r\n]+/, "").replace(/[\t\r\n\s]+$/, "");
@@ -98353,7 +98353,7 @@ var require_turndown_cjs = __commonJS({
       if (whitespace.leading || whitespace.trailing) content = content.trim();
       return whitespace.leading + rule.replacement(content, node2, this.options) + whitespace.trailing;
     }
-    function join26(output, replacement) {
+    function join27(output, replacement) {
       var s1 = trimTrailingNewlines(output);
       var s2 = trimLeadingNewlines(replacement);
       var nls = Math.max(output.length - s1.length, replacement.length - s2.length);
@@ -103146,7 +103146,7 @@ var init_file_type = __esm({
 // main.ts
 import { existsSync as existsSync8, readdirSync as readdirSync2 } from "node:fs";
 import { readFile as readFile5 } from "node:fs/promises";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 
 // node_modules/.pnpm/package-manager-detector@1.8.0/node_modules/package-manager-detector/dist/commands.mjs
 function splitRunArgs(args2, valueFlags = []) {
@@ -103735,12 +103735,22 @@ var providers = {
     displayName: "DeepSeek",
     envVars: ["DEEPSEEK_API_KEY"],
     models: {
+      // same fork trap as `deepseek-flash` below, and Pro fell into it on
+      // 2026-08-12: OpenRouter forked the 0813 release into its own id and left
+      // the April preview live under the unversioned one at 2.7x the input and
+      // 27x the CACHE-READ rate ($1.168/$2.336/$0.09855 vs
+      // $0.435/$0.87/$0.003625). the direct route upgraded in place, so only the
+      // OpenRouter side was stale — and that side is what OSS and Router runs
+      // use. measured: $0.1719/run authoritative against the funded default's
+      // $0.0405. there is no `~deepseek/*-pro-latest` pointer to track, so this
+      // one has to be a dated pin; the `models-catalog` drift test is what
+      // catches the next release.
       "deepseek-pro": {
         displayName: "DeepSeek Pro",
         resolve: "deepseek/deepseek-v4-pro",
         effort: ["high", "max"],
-        openRouterEffort: ["high", "xhigh"],
-        openRouterResolve: "openrouter/deepseek/deepseek-v4-pro",
+        openRouterEffort: ["low", "high", "max"],
+        openRouterResolve: "openrouter/deepseek/deepseek-v4-pro-0813",
         preferred: true
       },
       // DeepSeek upgrades the `deepseek-v4-flash` API model in place, so the
@@ -103748,14 +103758,19 @@ var providers = {
       // release into its own id and left the April preview live under the
       // unversioned one at a HIGHER price ($0.14/$0.28 vs $0.09/$0.18) — so the
       // OpenRouter route can never use the bare id. it tracks the rolling
-      // `~deepseek/*-latest` pointer (rule 4), which resolves to 0731 at the
-      // same price today and follows the next in-place upgrade on its own,
-      // rather than pinning a dated snapshot that goes stale every release.
-      // 0731 gained a `low` rung and renamed the top to `max`, unlike Pro
-      // (`high, max` direct / `high, xhigh` via OpenRouter). that ladder now
-      // reads the same on BOTH routes — the in-place direct upgrade caught up
-      // to the fork — so `low`, not `high`, is position 0 either way, which is
-      // why the OSS effort floor in `main.ts` pins the `high` rung by name.
+      // `~deepseek/*-latest` pointer (rule 4), which follows the next in-place
+      // upgrade on its own rather than pinning a dated snapshot that goes stale
+      // every release. that pointer is NOT priced like 0731 — its listed rates
+      // run +40% on output and +57.5% on cache read, and it costs 12% more per
+      // run on authoritative spend ($0.0405 vs $0.0361). kept anyway: ~$45/yr
+      // buys auto-following the upgrade, and the listed gap overstates the real
+      // one because a rolling alias prices at its routing ceiling.
+      // 0731 gained a `low` rung and renamed the top to `max`, and that ladder
+      // now reads the same on BOTH routes — the in-place direct upgrade caught
+      // up to the fork. so `low`, not `high`, is position 0 either way, which is
+      // why the OSS effort floor in `main.ts` pins the `high` rung by name. Pro
+      // is the same shape via OpenRouter since 0813; only its direct route still
+      // starts at `high`.
       "deepseek-flash": {
         displayName: "DeepSeek Flash",
         resolve: "deepseek/deepseek-v4-flash",
@@ -104154,11 +104169,13 @@ var providers = {
         effort: ["low", "medium", "high"],
         openRouterResolve: "openrouter/x-ai/grok-4.5"
       },
+      // dated pin, not the bare id — see `deepseek/deepseek-pro` for why
+      // OpenRouter's unversioned `deepseek-v4-pro` is the stale April preview.
       "deepseek-pro": {
         displayName: "DeepSeek Pro",
-        resolve: "openrouter/deepseek/deepseek-v4-pro",
-        effort: ["high", "xhigh"],
-        openRouterResolve: "openrouter/deepseek/deepseek-v4-pro"
+        resolve: "openrouter/deepseek/deepseek-v4-pro-0813",
+        effort: ["low", "high", "max"],
+        openRouterResolve: "openrouter/deepseek/deepseek-v4-pro-0813"
       },
       // rolling pointer, not the bare id — see `deepseek/deepseek-flash` for why
       // OpenRouter's unversioned `deepseek-v4-flash` is the stale April preview.
@@ -104349,6 +104366,19 @@ function formatMcpToolRef(agentId, toolName) {
       return agentId;
   }
 }
+function extractMcpToolRefs(agentId, text) {
+  const prefix = formatMcpToolRef(agentId, "");
+  const escaped = prefix.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return [...text.matchAll(new RegExp(`${escaped}([a-z0-9_]+)`, "g"))].map((match3) => match3[1]);
+}
+function assertPromptToolRefs(params) {
+  const registered = new Set(params.toolNames);
+  const dangling = [...new Set(extractMcpToolRefs(params.agentId, params.prompt))].filter((name) => !registered.has(name)).sort();
+  if (dangling.length === 0) return;
+  throw new Error(
+    `prompt advertises ${dangling.length} tool(s) the MCP server did not register: ${dangling.join(", ")}. registered: ${[...registered].sort().join(", ")}`
+  );
+}
 function hasSimilarIssues(params) {
   return params.repoIntelligence && !!params.event.issue_number && !params.event.is_pr;
 }
@@ -105122,7 +105152,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.55",
+  version: "0.1.56",
   type: "module",
   bin: {
     pullfrog: "dist/cli.mjs",
@@ -112797,11 +112827,12 @@ function bootstrapPullfrogDataDir() {
 }
 
 // utils/worktree.ts
-async function dirtyTrackedPaths() {
+async function dirtyTrackedPaths(params = {}) {
   const result = await spawn({
     cmd: "git",
     args: ["diff", "--name-only", "HEAD"],
     env: process.env,
+    cwd: params.cwd ?? process.cwd(),
     activityTimeout: 0
   });
   if (result.exitCode !== 0) {
@@ -112812,12 +112843,15 @@ async function dirtyTrackedPaths() {
   return new Set(result.stdout.split("\n").filter(Boolean));
 }
 async function restoreDirtiedSince(params) {
-  const dirtied = [...await dirtyTrackedPaths()].filter((path4) => !params.before.has(path4));
+  const dirtied = [...await dirtyTrackedPaths({ cwd: params.cwd ?? process.cwd() })].filter(
+    (path4) => !params.before.has(path4)
+  );
   if (dirtied.length === 0) return;
   const result = await spawn({
     cmd: "git",
     args: ["restore", "--staged", "--worktree", "--", ...dirtied],
     env: process.env,
+    cwd: params.cwd ?? process.cwd(),
     activityTimeout: 0
   });
   if (result.exitCode !== 0) {
@@ -188745,6 +188779,116 @@ function CommitInfoTool(ctx) {
   });
 }
 
+// utils/roleMirror.ts
+function mirrorRolePermissions(role) {
+  switch (role) {
+    case "admin":
+    case "maintain":
+    case "write":
+    case "triage":
+      return { contents: "read", issues: "write", pull_requests: "write" };
+    case "read":
+    case "none":
+    case void 0:
+      return null;
+    default:
+      return role;
+  }
+}
+function formatPermissions(permissions) {
+  return Object.entries(permissions).map((entry) => entry.join(":")).join(", ");
+}
+
+// mcp/currentObject.ts
+async function resolveCurrentObject(ctx) {
+  const issueNumber = ctx.payload.event.issue_number;
+  if (!issueNumber) {
+    throw new Error("this run was not triggered on an issue or pull request");
+  }
+  if (mirrorRolePermissions(ctx.payload.event.authorPermission)) {
+    return { issueNumber, isPr: ctx.payload.event.is_pr === true };
+  }
+  const issue3 = await ctx.octokit.rest.issues.get({
+    owner: ctx.repo.owner,
+    repo: ctx.repo.name,
+    issue_number: issueNumber
+  });
+  const author = issue3.data.user?.login;
+  const triggerer = ctx.payload.triggerer;
+  if (!author || !triggerer || author.toLowerCase() !== triggerer.toLowerCase()) {
+    throw new Error(
+      `${triggerer ?? "the triggering user"} did not open #${issueNumber} and has no write access to ${ctx.repo.owner}/${ctx.repo.name}, so this run cannot change its state.`
+    );
+  }
+  return { issueNumber, isPr: issue3.data.pull_request !== void 0 };
+}
+var CloseCurrent = type({
+  state_reason: type.enumerated("completed", "not_planned", "duplicate").describe(
+    "why it is being closed: 'completed' (resolved), 'not_planned' (won't fix, out of scope), or 'duplicate' (already tracked elsewhere). ignored for pull requests."
+  )
+});
+function CloseCurrentTool(ctx) {
+  return tool({
+    name: "close_current",
+    mutates: true,
+    description: 'Close the issue or pull request this run was triggered on. Example: `close_current({ state_reason: "duplicate" })`. Comment first to explain the decision \u2014 closing alone is opaque to the author.',
+    parameters: CloseCurrent,
+    execute: execute(async (params) => {
+      const target = await resolveCurrentObject(ctx);
+      const result = target.isPr ? await ctx.octokit.rest.pulls.update({
+        owner: ctx.repo.owner,
+        repo: ctx.repo.name,
+        pull_number: target.issueNumber,
+        state: "closed"
+      }) : await ctx.octokit.rest.issues.update({
+        owner: ctx.repo.owner,
+        repo: ctx.repo.name,
+        issue_number: target.issueNumber,
+        state: "closed",
+        state_reason: params.state_reason
+      });
+      ctx.toolState.wasUpdated = true;
+      log.info(`\xBB closed #${target.issueNumber} (${params.state_reason})`);
+      return {
+        success: true,
+        number: result.data.number,
+        url: result.data.html_url,
+        state: result.data.state
+      };
+    }, "close_current")
+  });
+}
+function ReopenCurrentTool(ctx) {
+  return tool({
+    name: "reopen_current",
+    mutates: true,
+    description: "Reopen the issue or pull request this run was triggered on.",
+    parameters: type({}),
+    execute: execute(async () => {
+      const target = await resolveCurrentObject(ctx);
+      const result = target.isPr ? await ctx.octokit.rest.pulls.update({
+        owner: ctx.repo.owner,
+        repo: ctx.repo.name,
+        pull_number: target.issueNumber,
+        state: "open"
+      }) : await ctx.octokit.rest.issues.update({
+        owner: ctx.repo.owner,
+        repo: ctx.repo.name,
+        issue_number: target.issueNumber,
+        state: "open"
+      });
+      ctx.toolState.wasUpdated = true;
+      log.info(`\xBB reopened #${target.issueNumber}`);
+      return {
+        success: true,
+        number: result.data.number,
+        url: result.data.html_url,
+        state: result.data.state
+      };
+    }, "reopen_current")
+  });
+}
+
 // prep/index.ts
 import { performance as performance8 } from "node:perf_hooks";
 
@@ -189371,6 +189515,456 @@ function AwaitDependencyInstallationTool(ctx) {
   });
 }
 
+// mcp/gh.ts
+import { mkdirSync as mkdirSync8 } from "node:fs";
+import { join as join20 } from "node:path";
+
+// mcp/shell.ts
+import { spawn as spawn3, spawnSync as spawnSync6 } from "node:child_process";
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { closeSync, openSync, writeFileSync as writeFileSync11 } from "node:fs";
+import { userInfo as userInfo2 } from "node:os";
+import { join as join19 } from "node:path";
+import { setTimeout as sleep3 } from "node:timers/promises";
+var ShellParams = type({
+  command: "string",
+  // advisory and unread — no code path consumes it. kept in the schema only
+  // because it nudges the model to state intent before running a command;
+  // REQUIRING it cost a full rejected turn every time one was omitted. #1140.
+  "description?": "string",
+  "timeout?": type.number.describe(
+    "Timeout in MILLISECONDS (not seconds). Default 30000 (30s), max 120000 (2m). e.g. timeout: 180000 for 3 minutes; timeout: 180 means 180ms and will kill the process almost immediately."
+  ),
+  "working_directory?": "string",
+  "background?": "boolean"
+});
+var detectedSandboxMethod;
+var usernsProbeError;
+function getSandboxMethod() {
+  return detectSandboxMethod();
+}
+function detectSandboxMethod() {
+  if (detectedSandboxMethod !== void 0) {
+    return detectedSandboxMethod;
+  }
+  if (process.env.CI !== "true") {
+    detectedSandboxMethod = "none";
+    log.debug("sandbox disabled (CI !== true)");
+    return "none";
+  }
+  try {
+    const result = spawnSync6("unshare", ["--pid", "--fork", "--mount-proc", "true"], {
+      timeout: 5e3,
+      stdio: "ignore"
+    });
+    if (result.status === 0) {
+      detectedSandboxMethod = "unshare";
+      log.debug("PID namespace isolation enabled (unprivileged unshare)");
+      return "unshare";
+    }
+  } catch {
+  }
+  try {
+    const result = spawnSync6("sudo", ["unshare", "--pid", "--fork", "--mount-proc", "true"], {
+      timeout: 5e3,
+      stdio: "ignore"
+    });
+    if (result.status === 0) {
+      detectedSandboxMethod = "sudo-unshare";
+      log.debug("PID namespace isolation enabled (sudo unshare)");
+      return "sudo-unshare";
+    }
+  } catch {
+  }
+  try {
+    const result = spawnSync6(
+      "unshare",
+      [
+        "--user",
+        "--map-root-user",
+        "--pid",
+        "--fork",
+        "--mount",
+        "setpriv",
+        "--no-new-privs",
+        "--bounding-set",
+        "-all",
+        "--inh-caps",
+        "-all",
+        "--ambient-caps",
+        "-all",
+        "true"
+      ],
+      { timeout: 5e3, stdio: ["ignore", "ignore", "pipe"] }
+    );
+    if (result.status === 0) {
+      detectedSandboxMethod = "userns-unshare";
+      log.debug("PID namespace isolation enabled (unprivileged userns unshare)");
+      return "userns-unshare";
+    }
+    usernsProbeError = result.stderr?.toString().trim() || result.error?.message;
+  } catch {
+  }
+  detectedSandboxMethod = "none";
+  log.info("PID namespace isolation not available");
+  return "none";
+}
+var PROC_CLEANUP = "umount /proc 2>/dev/null; umount /proc 2>/dev/null; mount -t proc proc /proc 2>/dev/null;";
+var SOCKET_CLEANUP = [
+  "/var/run/docker.sock",
+  "/run/docker.sock",
+  "/var/run/podman/podman.sock",
+  "/run/podman/podman.sock",
+  "/run/containerd/containerd.sock",
+  "/var/run/crio/crio.sock"
+].map((path4) => `mount --bind /dev/null ${path4} 2>/dev/null;`).join(" ");
+function buildFsMounts(repoDir) {
+  const escaped = repoDir.replace(/'/g, "'\\''");
+  return [
+    `mkdir -p /var/lib/pullfrog 2>/dev/null;`,
+    `mount -t tmpfs tmpfs /var/lib/pullfrog 2>/dev/null;`,
+    `[ -n "$RUNNER_TEMP" ] && [ -d "$RUNNER_TEMP/_runner_file_commands" ] && mount -t tmpfs tmpfs "$RUNNER_TEMP/_runner_file_commands" 2>/dev/null;`,
+    `[ -e '${escaped}/.git' ] && mount --bind '${escaped}/.git' '${escaped}/.git' 2>/dev/null && mount -o remount,bind,ro '${escaped}/.git' 2>/dev/null;`
+  ].join(" ");
+}
+var _repoRoot;
+function resolveRepoRoot() {
+  if (_repoRoot) return _repoRoot;
+  const fromEnv = process.env.GITHUB_WORKSPACE;
+  if (fromEnv) {
+    _repoRoot = fromEnv;
+    return _repoRoot;
+  }
+  try {
+    _repoRoot = spawnSync6("git", ["rev-parse", "--show-toplevel"], {
+      cwd: process.cwd(),
+      stdio: ["ignore", "pipe", "ignore"],
+      encoding: "utf-8"
+    }).stdout?.trim();
+  } catch {
+  }
+  if (!_repoRoot) _repoRoot = process.cwd();
+  return _repoRoot;
+}
+function spawnShell(params) {
+  const spawnOpts = { env: params.env, cwd: params.cwd, stdio: params.stdio, detached: true };
+  const sandboxMethod = detectSandboxMethod();
+  const ci = process.env.CI === "true";
+  if (ci && sandboxMethod === "none") {
+    throw new Error(
+      "PID-namespace isolation is required in CI but unavailable: unprivileged unshare, sudo unshare, and userns-nested unshare all failed. " + (usernsProbeError ? `userns probe said: ${usernsProbeError}. ` : "") + "on a containerized / Kubernetes self-hosted runner the cause is usually one of: the pod's seccomp profile blocks user-namespace creation (Pod Security Standards baseline/restricted); the pod runs as root without CAP_SETFCAP, which the kernel requires to map uid 0; or the node kernel disallows unprivileged user namespaces (Ubuntu >= 23.10, Bottlerocket, Talos). elsewhere, check that `unshare` and `setpriv` (util-linux >= 2.31, which is what added --ambient-caps) are on PATH. see https://docs.pullfrog.com/security#self-hosted-runners"
+    );
+  }
+  const repoRoot = resolveRepoRoot();
+  const fsMounts = buildFsMounts(repoRoot);
+  if (sandboxMethod === "unshare") {
+    return spawn3(
+      "unshare",
+      [
+        "--pid",
+        "--fork",
+        "--mount-proc",
+        "bash",
+        "-c",
+        `${PROC_CLEANUP} ${SOCKET_CLEANUP} ${fsMounts} ${params.command}`
+      ],
+      spawnOpts
+    );
+  }
+  if (sandboxMethod === "userns-unshare") {
+    const escaped = params.command.replace(/'/g, "'\\''");
+    return spawn3(
+      "unshare",
+      [
+        "--user",
+        "--map-root-user",
+        "--pid",
+        "--fork",
+        "--mount",
+        "bash",
+        "-c",
+        `${PROC_CLEANUP} ${SOCKET_CLEANUP} ${fsMounts} exec setpriv --no-new-privs --bounding-set -all --inh-caps -all --ambient-caps -all bash -c '${escaped}'`
+      ],
+      spawnOpts
+    );
+  }
+  if (sandboxMethod === "sudo-unshare") {
+    const envArgs = [];
+    for (const [k2, v] of Object.entries(params.env)) {
+      if (v !== void 0) {
+        envArgs.push(`${k2}=${v}`);
+      }
+    }
+    const username = userInfo2().username;
+    const pathRestore = 'export PATH="${SANDBOX_PATH:-$PATH}"; ';
+    const escaped = (pathRestore + params.command).replace(/'/g, "'\\''");
+    envArgs.push(`SANDBOX_PATH=${params.env.PATH ?? ""}`);
+    return spawn3(
+      "sudo",
+      [
+        "env",
+        ...envArgs,
+        "unshare",
+        "--pid",
+        "--fork",
+        "--mount-proc",
+        "bash",
+        "-c",
+        `${PROC_CLEANUP} ${SOCKET_CLEANUP} ${fsMounts} exec su -p -s /bin/bash ${username} -c '${escaped}'`
+      ],
+      { ...spawnOpts, env: {} }
+    );
+  }
+  return spawn3("bash", ["-c", params.command], spawnOpts);
+}
+async function killProcessGroup(proc) {
+  if (!proc.pid) return;
+  try {
+    process.kill(-proc.pid, "SIGTERM");
+    await new Promise((r) => setTimeout(r, 200));
+    process.kill(-proc.pid, "SIGKILL");
+  } catch {
+    try {
+      proc.kill("SIGKILL");
+    } catch {
+    }
+  }
+}
+function getTempDir() {
+  const tempDir = process.env.PULLFROG_TEMP_DIR;
+  if (!tempDir) {
+    throw new Error("PULLFROG_TEMP_DIR not set");
+  }
+  return tempDir;
+}
+var MAX_OUTPUT_CHARS = 5e3;
+async function runSandboxed(params) {
+  const proc = spawnShell({
+    command: params.command,
+    env: params.env,
+    cwd: params.cwd,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  let stdout = "", stderr = "", timedOut = false, exited = false, spawnError = "";
+  proc.stdout?.on("data", (chunk) => {
+    stdout += chunk.toString();
+  });
+  proc.stderr?.on("data", (chunk) => {
+    stderr += chunk.toString();
+  });
+  const timeoutId = setTimeout(async () => {
+    if (!exited) {
+      timedOut = true;
+      await killProcessGroup(proc);
+    }
+  }, params.timeout);
+  const exitCode = await new Promise((resolve3) => {
+    const done = (code) => {
+      exited = true;
+      clearTimeout(timeoutId);
+      resolve3(code);
+    };
+    proc.on("exit", done);
+    proc.on("error", (err) => {
+      spawnError = err.message;
+      done(null);
+    });
+  });
+  proc.stdout?.destroy();
+  proc.stderr?.destroy();
+  let output = stderr ? stdout ? `${stdout}
+${stderr}` : stderr : stdout;
+  if (spawnError) output = output ? `${output}
+${spawnError}` : spawnError;
+  if (timedOut)
+    output = output ? `${output}
+[timed out after ${params.timeout}ms]` : `[timed out after ${params.timeout}ms]`;
+  return {
+    output: output.trim(),
+    exitCode: exitCode ?? (timedOut ? 124 : -1),
+    timedOut
+  };
+}
+function capOutput(output) {
+  if (output.length <= MAX_OUTPUT_CHARS) return output;
+  const fullPath = join19(getTempDir(), `shell-${randomUUID4().slice(0, 8)}.log`);
+  writeFileSync11(fullPath, output);
+  const elided = output.length - MAX_OUTPUT_CHARS;
+  return `... [${elided} chars truncated; full output saved to ${fullPath}] ...
+${output.slice(-MAX_OUTPUT_CHARS)}`;
+}
+function isGitCommand(command) {
+  const trimmed = command.trim();
+  if (trimmed === "git" || trimmed.startsWith("git ")) return true;
+  if (trimmed.startsWith("sudo git")) return true;
+  return /[;&|]\s*(?:sudo\s+)?git(?:\s|$)/.test(trimmed);
+}
+function ShellTool(ctx) {
+  return tool({
+    name: "shell",
+    timeoutMs: 12e4,
+    description: `Execute shell commands securely. Environment is filtered to remove API keys and secrets.
+
+Example: \`shell({ command: "pnpm test", description: "run the test suite" })\`.
+
+Use this tool to:
+- Run shell commands (ls, cat, grep, find, etc.)
+- Execute build tools (npm, pnpm, cargo, make, etc.)
+- Run tests and linters
+
+Output is capped at ${MAX_OUTPUT_CHARS} chars: if exceeded, only the tail is returned and the full body is saved to a tempfile (path included in the response). Re-read the tempfile with cat/tail/grep when you need more.
+
+Do NOT use this tool for git commands \u2014 use the dedicated git tools instead.`,
+    parameters: ShellParams,
+    execute: execute(async (params) => {
+      if (isGitCommand(params.command)) {
+        throw new Error(
+          'git commands are not allowed in the shell tool. use the dedicated git tools instead:\n- git: local operations, e.g. git({ command: "log", args: ["--oneline"] }) \u2014 `command` is the subcommand ONLY\n- push_branch: push to remote (handles authentication)\n- git_fetch: fetch from remote (handles authentication)\n- checkout_pr: check out PR branches'
+        );
+      }
+      const timeout = Math.min(params.timeout ?? 3e4, 12e4);
+      const cwd = params.working_directory ?? process.cwd();
+      const env2 = resolveEnv(ctx.payload.shell === "enabled" ? "inherit" : "restricted");
+      if (params.command.includes("agent-browser")) {
+        const daemonError = ensureBrowserDaemon(ctx.toolState);
+        if (daemonError) {
+          return {
+            output: `browser daemon unavailable: ${daemonError}`,
+            exit_code: 1,
+            timed_out: false
+          };
+        }
+        const binDir = ctx.toolState.browserDaemon?.binDir;
+        if (binDir) {
+          env2.PATH = `${binDir}:${env2.PATH ?? ""}`;
+        }
+      }
+      if (params.background) {
+        const tempDir = getTempDir();
+        const handle = `bg-${randomUUID4().slice(0, 8)}`;
+        const outputPath = join19(tempDir, `${handle}.log`);
+        const pidPath = join19(tempDir, `${handle}.pid`);
+        const logFd = openSync(outputPath, "a");
+        let proc;
+        try {
+          proc = spawnShell({
+            command: params.command,
+            env: env2,
+            cwd,
+            stdio: ["ignore", logFd, logFd]
+          });
+        } finally {
+          closeSync(logFd);
+        }
+        if (!proc.pid) {
+          throw new Error("failed to start background process");
+        }
+        proc.unref();
+        writeFileSync11(pidPath, `${proc.pid}
+`);
+        ctx.toolState.backgroundProcesses.set(handle, { pid: proc.pid, outputPath, pidPath });
+        return {
+          handle,
+          outputPath,
+          pidPath,
+          message: `started background process ${handle} (pid ${proc.pid})`
+        };
+      }
+      const result = await runSandboxed({ command: params.command, env: env2, cwd, timeout });
+      if (result.exitCode !== 0) {
+        log.info(`shell command failed with exit code ${result.exitCode}: ${params.command}`);
+        if (result.output) log.info(`output: ${result.output}`);
+      }
+      return {
+        output: capOutput(result.output),
+        exit_code: result.exitCode,
+        timed_out: result.timedOut
+      };
+    })
+  });
+}
+var KillBackgroundParams = type({
+  handle: type.string.describe("The handle of the background process to kill (e.g., bg-a1b2c3d4)")
+});
+function KillBackgroundTool(ctx) {
+  return tool({
+    name: "kill_background",
+    mutates: true,
+    description: `Kill a background process by its handle. Use this to stop dev servers or other long-running processes started with shell({ background: true }).`,
+    parameters: KillBackgroundParams,
+    execute: execute(async (params) => {
+      const proc = ctx.toolState.backgroundProcesses.get(params.handle);
+      if (!proc) {
+        return {
+          success: false,
+          message: `no background process with handle ${params.handle}`
+        };
+      }
+      try {
+        process.kill(-proc.pid, "SIGTERM");
+      } catch {
+      }
+      await sleep3(200);
+      try {
+        process.kill(-proc.pid, "SIGKILL");
+      } catch {
+      }
+      ctx.toolState.backgroundProcesses.delete(params.handle);
+      return {
+        success: true,
+        message: `killed background process ${params.handle} (pid ${proc.pid})`
+      };
+    })
+  });
+}
+
+// mcp/gh.ts
+var GH_TIMEOUT_MS = 12e4;
+var GhParams = type({
+  args: type.string.array().describe(
+    'gh arguments as an argv array, e.g. ["pr", "list", "--json", "number,title"] or ["api", "graphql", "-f", "query=..."]'
+  )
+});
+function shellQuote(arg) {
+  return `'${arg.replace(/'/g, "'\\''")}'`;
+}
+function GhTool(ctx) {
+  const permissions = mirrorRolePermissions(ctx.payload.event.authorPermission);
+  return tool({
+    name: "gh",
+    // denied to subagents. `shell` is deliberately unmarked because git is
+    // blocked inside it, but `gh` reaches PR and issue state changes — the
+    // shape of the 2026-05-18 cross-branch clobber the gate exists for.
+    mutates: true,
+    timeoutMs: GH_TIMEOUT_MS,
+    description: `Run the GitHub CLI against ${ctx.repo.owner}/${ctx.repo.name}. Pass argv as an array \u2014 there is no shell, so pipes, redirects and \`&&\` do not work; use gh's own \`--json\`/\`--jq\` flags instead. \`gh api graphql\` is available. Authenticated with ${permissions ? formatPermissions(permissions) : "no permissions"} on this repo only; anything else 403s. Pushing, merging and ref writes are not available \u2014 use the git tools.`,
+    parameters: GhParams,
+    execute: execute(async (params) => {
+      const configDir = join20(ctx.tmpdir, "gh-config");
+      mkdirSync8(configDir, { recursive: true });
+      const command = ["gh", ...params.args.map(shellQuote)].join(" ");
+      const result = await runSandboxed({
+        command,
+        cwd: process.cwd(),
+        timeout: GH_TIMEOUT_MS,
+        env: {
+          ...filterEnvForUntrustedCode(),
+          GH_TOKEN: ctx.ghToken,
+          GH_CONFIG_DIR: configDir,
+          GH_PROMPT_DISABLED: "1",
+          GH_NO_UPDATE_NOTIFIER: "1"
+        }
+      });
+      log.info(`\xBB gh ${params.args.join(" ")} (exit ${result.exitCode})`);
+      return {
+        output: capOutput(result.output),
+        exit_code: result.exitCode,
+        timed_out: result.timedOut
+      };
+    }, "gh")
+  });
+}
+
 // mcp/issue.ts
 var Issue = type({
   title: type.string.describe("the title of the issue"),
@@ -189415,65 +190009,6 @@ function IssueTool(ctx) {
     })
   });
 }
-var CloseIssue = type({
-  issue_number: type.number.describe("the issue number to close"),
-  state_reason: type.enumerated("completed", "not_planned", "duplicate").describe(
-    "why the issue is being closed: 'completed' (resolved/done), 'not_planned' (won't fix, out of scope), or 'duplicate' (already tracked elsewhere)."
-  )
-});
-function CloseIssueTool(ctx) {
-  return tool({
-    name: "close_issue",
-    mutates: true,
-    description: 'Close a GitHub issue with a reason. Example: `close_issue({ issue_number: 1234, state_reason: "not_planned" })`. Comment first to explain the decision \u2014 closing alone is opaque to the author.',
-    parameters: CloseIssue,
-    execute: execute(async (params) => {
-      const result = await ctx.octokit.rest.issues.update({
-        owner: ctx.repo.owner,
-        repo: ctx.repo.name,
-        issue_number: params.issue_number,
-        state: "closed",
-        state_reason: params.state_reason
-      });
-      ctx.toolState.wasUpdated = true;
-      log.info(`\xBB closed issue #${params.issue_number} (${params.state_reason})`);
-      return {
-        success: true,
-        number: result.data.number,
-        url: result.data.html_url,
-        state: result.data.state,
-        stateReason: result.data.state_reason
-      };
-    })
-  });
-}
-var ReopenIssue = type({
-  issue_number: type.number.describe("the issue number to reopen")
-});
-function ReopenIssueTool(ctx) {
-  return tool({
-    name: "reopen_issue",
-    mutates: true,
-    description: "Reopen a previously closed GitHub issue. Example: `reopen_issue({ issue_number: 1234 })`.",
-    parameters: ReopenIssue,
-    execute: execute(async (params) => {
-      const result = await ctx.octokit.rest.issues.update({
-        owner: ctx.repo.owner,
-        repo: ctx.repo.name,
-        issue_number: params.issue_number,
-        state: "open"
-      });
-      ctx.toolState.wasUpdated = true;
-      log.info(`\xBB reopened issue #${params.issue_number}`);
-      return {
-        success: true,
-        number: result.data.number,
-        url: result.data.html_url,
-        state: result.data.state
-      };
-    })
-  });
-}
 
 // utils/body.ts
 var import_turndown = __toESM(require_turndown_cjs(), 1);
@@ -189970,33 +190505,6 @@ function buildPrBodyWithFooter(ctx, body) {
   const bodyWithoutFooter = stripExistingFooter(fixDoubleEscapedString(body));
   return `${bodyWithoutFooter}${footer}`;
 }
-var ClosePullRequest = type({
-  pull_number: type.number.describe("the pull request number to close")
-});
-function ClosePullRequestTool(ctx) {
-  return tool({
-    name: "close_pull_request",
-    mutates: true,
-    description: "Close an open pull request WITHOUT merging it. Example: `close_pull_request({ pull_number: 1234 })`. Comment first to explain why \u2014 closing alone is opaque to the author. Merging is a human action and is never done here.",
-    parameters: ClosePullRequest,
-    execute: execute(async (params) => {
-      const result = await ctx.octokit.rest.pulls.update({
-        owner: ctx.repo.owner,
-        repo: ctx.repo.name,
-        pull_number: params.pull_number,
-        state: "closed"
-      });
-      ctx.toolState.wasUpdated = true;
-      log.info(`\xBB closed pull request #${params.pull_number}`);
-      return {
-        success: true,
-        number: result.data.number,
-        url: result.data.html_url,
-        state: result.data.state
-      };
-    })
-  });
-}
 var UpdatePullRequestBody = type({
   pull_number: type.number.describe("the pull request number to update"),
   body: type.string.describe("the new body content for the pull request")
@@ -190156,8 +190664,8 @@ function PullRequestInfoTool(ctx) {
 }
 
 // mcp/reviewComments.ts
-import { writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join19 } from "node:path";
+import { writeFileSync as writeFileSync12 } from "node:fs";
+import { join as join21 } from "node:path";
 var COMMENTS_PER_THREAD = 50;
 var REVIEW_THREADS_QUERY = `
 query ($owner: String!, $name: String!, $prNumber: Int!, $cursor: String) {
@@ -190630,8 +191138,8 @@ function GetReviewCommentsTool(ctx) {
         throw new Error("PULLFROG_TEMP_DIR not set");
       }
       const filename = `review-${params.review_id}-threads.md`;
-      const commentsPath = join19(tempDir, filename);
-      writeFileSync11(commentsPath, formatted.content);
+      const commentsPath = join21(tempDir, filename);
+      writeFileSync12(commentsPath, formatted.content);
       log.debug(`wrote ${threadBlocks.length} threads to ${commentsPath}`);
       return {
         review_id: params.review_id,
@@ -190877,394 +191385,6 @@ ${addendum}`,
   });
 }
 
-// mcp/shell.ts
-import { spawn as spawn3, spawnSync as spawnSync6 } from "node:child_process";
-import { randomUUID as randomUUID4 } from "node:crypto";
-import { closeSync, openSync, writeFileSync as writeFileSync12 } from "node:fs";
-import { userInfo as userInfo2 } from "node:os";
-import { join as join20 } from "node:path";
-import { setTimeout as sleep3 } from "node:timers/promises";
-var ShellParams = type({
-  command: "string",
-  // advisory and unread — no code path consumes it. kept in the schema only
-  // because it nudges the model to state intent before running a command;
-  // REQUIRING it cost a full rejected turn every time one was omitted. #1140.
-  "description?": "string",
-  "timeout?": type.number.describe(
-    "Timeout in MILLISECONDS (not seconds). Default 30000 (30s), max 120000 (2m). e.g. timeout: 180000 for 3 minutes; timeout: 180 means 180ms and will kill the process almost immediately."
-  ),
-  "working_directory?": "string",
-  "background?": "boolean"
-});
-var detectedSandboxMethod;
-var usernsProbeError;
-function getSandboxMethod() {
-  return detectSandboxMethod();
-}
-function detectSandboxMethod() {
-  if (detectedSandboxMethod !== void 0) {
-    return detectedSandboxMethod;
-  }
-  if (process.env.CI !== "true") {
-    detectedSandboxMethod = "none";
-    log.debug("sandbox disabled (CI !== true)");
-    return "none";
-  }
-  try {
-    const result = spawnSync6("unshare", ["--pid", "--fork", "--mount-proc", "true"], {
-      timeout: 5e3,
-      stdio: "ignore"
-    });
-    if (result.status === 0) {
-      detectedSandboxMethod = "unshare";
-      log.debug("PID namespace isolation enabled (unprivileged unshare)");
-      return "unshare";
-    }
-  } catch {
-  }
-  try {
-    const result = spawnSync6("sudo", ["unshare", "--pid", "--fork", "--mount-proc", "true"], {
-      timeout: 5e3,
-      stdio: "ignore"
-    });
-    if (result.status === 0) {
-      detectedSandboxMethod = "sudo-unshare";
-      log.debug("PID namespace isolation enabled (sudo unshare)");
-      return "sudo-unshare";
-    }
-  } catch {
-  }
-  try {
-    const result = spawnSync6(
-      "unshare",
-      [
-        "--user",
-        "--map-root-user",
-        "--pid",
-        "--fork",
-        "--mount",
-        "setpriv",
-        "--no-new-privs",
-        "--bounding-set",
-        "-all",
-        "--inh-caps",
-        "-all",
-        "--ambient-caps",
-        "-all",
-        "true"
-      ],
-      { timeout: 5e3, stdio: ["ignore", "ignore", "pipe"] }
-    );
-    if (result.status === 0) {
-      detectedSandboxMethod = "userns-unshare";
-      log.debug("PID namespace isolation enabled (unprivileged userns unshare)");
-      return "userns-unshare";
-    }
-    usernsProbeError = result.stderr?.toString().trim() || result.error?.message;
-  } catch {
-  }
-  detectedSandboxMethod = "none";
-  log.info("PID namespace isolation not available");
-  return "none";
-}
-var PROC_CLEANUP = "umount /proc 2>/dev/null; umount /proc 2>/dev/null; mount -t proc proc /proc 2>/dev/null;";
-var SOCKET_CLEANUP = [
-  "/var/run/docker.sock",
-  "/run/docker.sock",
-  "/var/run/podman/podman.sock",
-  "/run/podman/podman.sock",
-  "/run/containerd/containerd.sock",
-  "/var/run/crio/crio.sock"
-].map((path4) => `mount --bind /dev/null ${path4} 2>/dev/null;`).join(" ");
-function buildFsMounts(repoDir) {
-  const escaped = repoDir.replace(/'/g, "'\\''");
-  return [
-    `mkdir -p /var/lib/pullfrog 2>/dev/null;`,
-    `mount -t tmpfs tmpfs /var/lib/pullfrog 2>/dev/null;`,
-    `[ -n "$RUNNER_TEMP" ] && [ -d "$RUNNER_TEMP/_runner_file_commands" ] && mount -t tmpfs tmpfs "$RUNNER_TEMP/_runner_file_commands" 2>/dev/null;`,
-    `[ -e '${escaped}/.git' ] && mount --bind '${escaped}/.git' '${escaped}/.git' 2>/dev/null && mount -o remount,bind,ro '${escaped}/.git' 2>/dev/null;`
-  ].join(" ");
-}
-var _repoRoot;
-function resolveRepoRoot() {
-  if (_repoRoot) return _repoRoot;
-  const fromEnv = process.env.GITHUB_WORKSPACE;
-  if (fromEnv) {
-    _repoRoot = fromEnv;
-    return _repoRoot;
-  }
-  try {
-    _repoRoot = spawnSync6("git", ["rev-parse", "--show-toplevel"], {
-      cwd: process.cwd(),
-      stdio: ["ignore", "pipe", "ignore"],
-      encoding: "utf-8"
-    }).stdout?.trim();
-  } catch {
-  }
-  if (!_repoRoot) _repoRoot = process.cwd();
-  return _repoRoot;
-}
-function spawnShell(params) {
-  const spawnOpts = { env: params.env, cwd: params.cwd, stdio: params.stdio, detached: true };
-  const sandboxMethod = detectSandboxMethod();
-  const ci = process.env.CI === "true";
-  if (ci && sandboxMethod === "none") {
-    throw new Error(
-      "PID-namespace isolation is required in CI but unavailable: unprivileged unshare, sudo unshare, and userns-nested unshare all failed. " + (usernsProbeError ? `userns probe said: ${usernsProbeError}. ` : "") + "on a containerized / Kubernetes self-hosted runner the cause is usually one of: the pod's seccomp profile blocks user-namespace creation (Pod Security Standards baseline/restricted); the pod runs as root without CAP_SETFCAP, which the kernel requires to map uid 0; or the node kernel disallows unprivileged user namespaces (Ubuntu >= 23.10, Bottlerocket, Talos). elsewhere, check that `unshare` and `setpriv` (util-linux >= 2.31, which is what added --ambient-caps) are on PATH. see https://docs.pullfrog.com/security#self-hosted-runners"
-    );
-  }
-  const repoRoot = resolveRepoRoot();
-  const fsMounts = buildFsMounts(repoRoot);
-  if (sandboxMethod === "unshare") {
-    return spawn3(
-      "unshare",
-      [
-        "--pid",
-        "--fork",
-        "--mount-proc",
-        "bash",
-        "-c",
-        `${PROC_CLEANUP} ${SOCKET_CLEANUP} ${fsMounts} ${params.command}`
-      ],
-      spawnOpts
-    );
-  }
-  if (sandboxMethod === "userns-unshare") {
-    const escaped = params.command.replace(/'/g, "'\\''");
-    return spawn3(
-      "unshare",
-      [
-        "--user",
-        "--map-root-user",
-        "--pid",
-        "--fork",
-        "--mount",
-        "bash",
-        "-c",
-        `${PROC_CLEANUP} ${SOCKET_CLEANUP} ${fsMounts} exec setpriv --no-new-privs --bounding-set -all --inh-caps -all --ambient-caps -all bash -c '${escaped}'`
-      ],
-      spawnOpts
-    );
-  }
-  if (sandboxMethod === "sudo-unshare") {
-    const envArgs = [];
-    for (const [k2, v] of Object.entries(params.env)) {
-      if (v !== void 0) {
-        envArgs.push(`${k2}=${v}`);
-      }
-    }
-    const username = userInfo2().username;
-    const pathRestore = 'export PATH="${SANDBOX_PATH:-$PATH}"; ';
-    const escaped = (pathRestore + params.command).replace(/'/g, "'\\''");
-    envArgs.push(`SANDBOX_PATH=${params.env.PATH ?? ""}`);
-    return spawn3(
-      "sudo",
-      [
-        "env",
-        ...envArgs,
-        "unshare",
-        "--pid",
-        "--fork",
-        "--mount-proc",
-        "bash",
-        "-c",
-        `${PROC_CLEANUP} ${SOCKET_CLEANUP} ${fsMounts} exec su -p -s /bin/bash ${username} -c '${escaped}'`
-      ],
-      { ...spawnOpts, env: {} }
-    );
-  }
-  return spawn3("bash", ["-c", params.command], spawnOpts);
-}
-async function killProcessGroup(proc) {
-  if (!proc.pid) return;
-  try {
-    process.kill(-proc.pid, "SIGTERM");
-    await new Promise((r) => setTimeout(r, 200));
-    process.kill(-proc.pid, "SIGKILL");
-  } catch {
-    try {
-      proc.kill("SIGKILL");
-    } catch {
-    }
-  }
-}
-function getTempDir() {
-  const tempDir = process.env.PULLFROG_TEMP_DIR;
-  if (!tempDir) {
-    throw new Error("PULLFROG_TEMP_DIR not set");
-  }
-  return tempDir;
-}
-var MAX_OUTPUT_CHARS = 5e3;
-function capOutput(output) {
-  if (output.length <= MAX_OUTPUT_CHARS) return output;
-  const fullPath = join20(getTempDir(), `shell-${randomUUID4().slice(0, 8)}.log`);
-  writeFileSync12(fullPath, output);
-  const elided = output.length - MAX_OUTPUT_CHARS;
-  return `... [${elided} chars truncated; full output saved to ${fullPath}] ...
-${output.slice(-MAX_OUTPUT_CHARS)}`;
-}
-function isGitCommand(command) {
-  const trimmed = command.trim();
-  if (trimmed === "git" || trimmed.startsWith("git ")) return true;
-  if (trimmed.startsWith("sudo git")) return true;
-  return /[;&|]\s*(?:sudo\s+)?git(?:\s|$)/.test(trimmed);
-}
-function ShellTool(ctx) {
-  return tool({
-    name: "shell",
-    timeoutMs: 12e4,
-    description: `Execute shell commands securely. Environment is filtered to remove API keys and secrets.
-
-Example: \`shell({ command: "pnpm test", description: "run the test suite" })\`.
-
-Use this tool to:
-- Run shell commands (ls, cat, grep, find, etc.)
-- Execute build tools (npm, pnpm, cargo, make, etc.)
-- Run tests and linters
-
-Output is capped at ${MAX_OUTPUT_CHARS} chars: if exceeded, only the tail is returned and the full body is saved to a tempfile (path included in the response). Re-read the tempfile with cat/tail/grep when you need more.
-
-Do NOT use this tool for git commands \u2014 use the dedicated git tools instead.`,
-    parameters: ShellParams,
-    execute: execute(async (params) => {
-      if (isGitCommand(params.command)) {
-        throw new Error(
-          'git commands are not allowed in the shell tool. use the dedicated git tools instead:\n- git: local operations, e.g. git({ command: "log", args: ["--oneline"] }) \u2014 `command` is the subcommand ONLY\n- push_branch: push to remote (handles authentication)\n- git_fetch: fetch from remote (handles authentication)\n- checkout_pr: check out PR branches'
-        );
-      }
-      const timeout = Math.min(params.timeout ?? 3e4, 12e4);
-      const cwd = params.working_directory ?? process.cwd();
-      const env2 = resolveEnv(ctx.payload.shell === "enabled" ? "inherit" : "restricted");
-      if (params.command.includes("agent-browser")) {
-        const daemonError = ensureBrowserDaemon(ctx.toolState);
-        if (daemonError) {
-          return {
-            output: `browser daemon unavailable: ${daemonError}`,
-            exit_code: 1,
-            timed_out: false
-          };
-        }
-        const binDir = ctx.toolState.browserDaemon?.binDir;
-        if (binDir) {
-          env2.PATH = `${binDir}:${env2.PATH ?? ""}`;
-        }
-      }
-      if (params.background) {
-        const tempDir = getTempDir();
-        const handle = `bg-${randomUUID4().slice(0, 8)}`;
-        const outputPath = join20(tempDir, `${handle}.log`);
-        const pidPath = join20(tempDir, `${handle}.pid`);
-        const logFd = openSync(outputPath, "a");
-        let proc2;
-        try {
-          proc2 = spawnShell({
-            command: params.command,
-            env: env2,
-            cwd,
-            stdio: ["ignore", logFd, logFd]
-          });
-        } finally {
-          closeSync(logFd);
-        }
-        if (!proc2.pid) {
-          throw new Error("failed to start background process");
-        }
-        proc2.unref();
-        writeFileSync12(pidPath, `${proc2.pid}
-`);
-        ctx.toolState.backgroundProcesses.set(handle, { pid: proc2.pid, outputPath, pidPath });
-        return {
-          handle,
-          outputPath,
-          pidPath,
-          message: `started background process ${handle} (pid ${proc2.pid})`
-        };
-      }
-      const proc = spawnShell({
-        command: params.command,
-        env: env2,
-        cwd,
-        stdio: ["ignore", "pipe", "pipe"]
-      });
-      let stdout = "", stderr = "", timedOut = false, exited = false;
-      proc.stdout?.on("data", (chunk) => {
-        stdout += chunk.toString();
-      });
-      proc.stderr?.on("data", (chunk) => {
-        stderr += chunk.toString();
-      });
-      const timeoutId = setTimeout(async () => {
-        if (!exited) {
-          timedOut = true;
-          await killProcessGroup(proc);
-        }
-      }, timeout);
-      const exitCode = await new Promise((resolve3) => {
-        const done = (code) => {
-          exited = true;
-          clearTimeout(timeoutId);
-          resolve3(code);
-        };
-        proc.on("exit", done);
-        proc.on("error", () => done(null));
-      });
-      proc.stdout?.destroy();
-      proc.stderr?.destroy();
-      let output = stderr ? stdout ? `${stdout}
-${stderr}` : stderr : stdout;
-      if (timedOut)
-        output = output ? `${output}
-[timed out after ${timeout}ms]` : `[timed out after ${timeout}ms]`;
-      const finalExitCode = exitCode ?? (timedOut ? 124 : -1);
-      const trimmed = output.trim();
-      if (finalExitCode !== 0) {
-        log.info(`shell command failed with exit code ${finalExitCode}: ${params.command}`);
-        if (trimmed) log.info(`output: ${trimmed}`);
-      }
-      return {
-        output: capOutput(trimmed),
-        exit_code: finalExitCode,
-        timed_out: timedOut
-      };
-    })
-  });
-}
-var KillBackgroundParams = type({
-  handle: type.string.describe("The handle of the background process to kill (e.g., bg-a1b2c3d4)")
-});
-function KillBackgroundTool(ctx) {
-  return tool({
-    name: "kill_background",
-    mutates: true,
-    description: `Kill a background process by its handle. Use this to stop dev servers or other long-running processes started with shell({ background: true }).`,
-    parameters: KillBackgroundParams,
-    execute: execute(async (params) => {
-      const proc = ctx.toolState.backgroundProcesses.get(params.handle);
-      if (!proc) {
-        return {
-          success: false,
-          message: `no background process with handle ${params.handle}`
-        };
-      }
-      try {
-        process.kill(-proc.pid, "SIGTERM");
-      } catch {
-      }
-      await sleep3(200);
-      try {
-        process.kill(-proc.pid, "SIGKILL");
-      } catch {
-      }
-      ctx.toolState.backgroundProcesses.delete(params.handle);
-      return {
-        success: true,
-        message: `killed background process ${params.handle} (pid ${proc.pid})`
-      };
-    })
-  });
-}
-
 // mcp/similarIssues.ts
 var SimilarIssues = type({
   issue_number: type.number.describe("The issue number to find older duplicate candidates for")
@@ -191352,8 +191472,8 @@ function UploadFileTool(ctx) {
 }
 
 // mcp/xrepo.ts
-import { mkdirSync as mkdirSync8, rmSync as rmSync2 } from "node:fs";
-import { join as join21 } from "node:path";
+import { mkdirSync as mkdirSync9, rmSync as rmSync2 } from "node:fs";
+import { join as join22 } from "node:path";
 function assertValidRepoName(name) {
   if (!/^[A-Za-z0-9._-]+$/.test(name) || name.startsWith("-") || name.includes("..")) {
     throw new Error(
@@ -191433,8 +191553,8 @@ function CheckoutRepoTool(ctx) {
         return { path: existing.dir, access: existing.access, note: "already checked out." };
       }
       const access = accessFor(ctx, repo);
-      const dir = join21(ctx.tmpdir, "xrepo", repo);
-      mkdirSync8(dir, { recursive: true });
+      const dir = join22(ctx.tmpdir, "xrepo", repo);
+      mkdirSync9(dir, { recursive: true });
       const state = ensureRepoState(ctx.toolState, { owner, name: repo, dir, access });
       const rc = resolveRepoCtx(ctx, repo);
       try {
@@ -191512,8 +191632,8 @@ function buildCommonTools(ctx, outputSchema) {
     EditCommentTool(ctx),
     ReplyToReviewCommentTool(ctx),
     IssueTool(ctx),
-    CloseIssueTool(ctx),
-    ReopenIssueTool(ctx),
+    CloseCurrentTool(ctx),
+    ReopenCurrentTool(ctx),
     IssueInfoTool(ctx),
     GetIssueCommentsTool(ctx),
     GetIssueEventsTool(ctx),
@@ -191545,6 +191665,9 @@ function buildCommonTools(ctx, outputSchema) {
     tools.push(ShellTool(ctx));
     tools.push(KillBackgroundTool(ctx));
   }
+  if (ctx.ghToken) {
+    tools.push(GhTool(ctx));
+  }
   return tools;
 }
 function buildOrchestratorTools(ctx, outputSchema) {
@@ -191556,8 +191679,7 @@ function buildOrchestratorTools(ctx, outputSchema) {
     PushTagsTool(ctx),
     DeleteBranchTool(ctx),
     CreatePullRequestTool(ctx),
-    UpdatePullRequestBodyTool(ctx),
-    ClosePullRequestTool(ctx)
+    UpdatePullRequestBodyTool(ctx)
   ];
   if (ctx.signedCommits) {
     tools.push(CommitChangesTool(ctx));
@@ -191647,6 +191769,10 @@ async function startMcpHttpServer(ctx, options) {
   let disposed = false;
   return {
     url: startResult.url,
+    // the names actually registered, handed back so the prompt can be checked
+    // against them rather than against a second derivation. see
+    // assertPromptToolRefs.
+    toolNames: tools.map((registered) => registered.name),
     [Symbol.asyncDispose]: async () => {
       if (disposed) return;
       disposed = true;
@@ -192334,7 +192460,7 @@ async function checkConfiguredCredentials(params) {
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { writeFileSync as writeFileSync13 } from "node:fs";
 import { createServer as createServer3 } from "node:http";
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 var REVOKED_TRAP_MS = 6e4;
 function revokeGitHubToken(token) {
   fetch("https://api.github.com/installation/token", {
@@ -192403,7 +192529,7 @@ async function startGitAuthServer(tmpdir3) {
   function writeAskpassScript(code) {
     const scriptId = randomUUID5();
     const scriptName = `askpass-${scriptId}.js`;
-    const scriptPath = join22(tmpdir3, scriptName);
+    const scriptPath = join23(tmpdir3, scriptName);
     const content = [
       `#!/usr/bin/env node`,
       `var a=process.argv[2]||"";`,
@@ -192855,7 +192981,7 @@ function resolveInstructions(ctx) {
 
 // utils/learnings.ts
 import { mkdir as mkdir2, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname4, join as join23 } from "node:path";
+import { dirname as dirname4, join as join24 } from "node:path";
 
 // utils/learningsTruncate.ts
 var MAX_LEARNINGS_LENGTH = 1e5;
@@ -192873,10 +192999,10 @@ function truncateAtLineBoundary(body, cap) {
 var LEARNINGS_FILE_NAME = "pullfrog-learnings.md";
 var XREPO_LEARNINGS_FILE_NAME = "pullfrog-xrepo-learnings.md";
 function learningsFilePath(tmpdir3) {
-  return join23(tmpdir3, LEARNINGS_FILE_NAME);
+  return join24(tmpdir3, LEARNINGS_FILE_NAME);
 }
 function xrepoLearningsFilePath(tmpdir3) {
-  return join23(tmpdir3, XREPO_LEARNINGS_FILE_NAME);
+  return join24(tmpdir3, XREPO_LEARNINGS_FILE_NAME);
 }
 async function seedLearningsFile(params) {
   const path4 = learningsFilePath(params.tmpdir);
@@ -193420,6 +193546,9 @@ async function resolveTokens(params) {
       mcpToken: externalToken,
       // external token is whatever scope the user granted — reuse for reads too.
       readToken: params.xrepo ? externalToken : void 0,
+      // the scope is the user's to choose here, but the role threshold still
+      // decides whether the agent gets a CLI credential at all.
+      ghToken: mirrorRolePermissions(params.authorPermission) ? externalToken : void 0,
       async [Symbol.asyncDispose]() {
         mcpTokenValue = void 0;
       }
@@ -193451,6 +193580,15 @@ async function resolveTokens(params) {
   log.info(
     `\xBB acquired scoped MCP token (${Object.entries(mcpPermissions).map((e) => e.join(":")).join(", ")})`
   );
+  const ghPermissions = mirrorRolePermissions(params.authorPermission);
+  let ghToken;
+  if (ghPermissions) {
+    ghToken = await acquireNewToken({ permissions: ghPermissions });
+    if (isGitHubActions) core7.setSecret(ghToken);
+    log.info(
+      `\xBB acquired gh token mirroring ${params.authorPermission} (${formatPermissions(ghPermissions)})`
+    );
+  }
   let readToken;
   if (params.xrepo) {
     readToken = await acquireNewToken({
@@ -193540,7 +193678,9 @@ async function resolveTokens(params) {
       await Promise.all([
         revokeGitHubInstallationToken(currentGitToken),
         revokeGitHubInstallationToken(currentMcpToken),
-        ...currentReadToken ? [revokeGitHubInstallationToken(currentReadToken)] : []
+        ...currentReadToken ? [revokeGitHubInstallationToken(currentReadToken)] : [],
+        // revoking this one is what bounds a `gh` leak to the run's lifetime
+        ...ghToken ? [revokeGitHubInstallationToken(ghToken)] : []
       ]);
     } finally {
       removeSignalHandler();
@@ -193555,6 +193695,7 @@ async function resolveTokens(params) {
     },
     mcpToken,
     readToken,
+    ghToken,
     refreshGitToken,
     [Symbol.asyncDispose]: dispose
   };
@@ -193796,7 +193937,7 @@ async function runProxyResolution(ctx) {
 
 // utils/prSummary.ts
 import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname5, join as join24 } from "node:path";
+import { dirname as dirname5, join as join25 } from "node:path";
 var SUMMARY_FILE_NAME = "pullfrog-summary.md";
 var SUMMARY_SCAFFOLD = `# PR summary
 
@@ -193806,7 +193947,7 @@ var SUMMARY_SCAFFOLD = `# PR summary
 var MIN_SNAPSHOT_LENGTH = 60;
 var MAX_SNAPSHOT_LENGTH = 32768;
 function summaryFilePath(tmpdir3) {
-  return join24(tmpdir3, SUMMARY_FILE_NAME);
+  return join25(tmpdir3, SUMMARY_FILE_NAME);
 }
 async function seedSummaryFile(params) {
   const path4 = summaryFilePath(params.tmpdir);
@@ -194028,7 +194169,10 @@ function warnIfPinnedToSha() {
   }
 }
 async function resolveRunContextData(params) {
-  log.info(`\xBB running Pullfrog v${package_default.version}...`);
+  const actionRef = process.env.GITHUB_ACTION_REF;
+  log.info(
+    `\xBB running Pullfrog v${package_default.version}${actionRef ? ` (ref: ${actionRef})` : ""}...`
+  );
   warnIfPinnedToSha();
   const repoContext = parseRepoContext();
   let oidcToken;
@@ -195118,6 +195262,7 @@ async function main() {
       try {
         const _commentTokenRef = __using(_stack, await resolveTokens({
           push: "disabled",
+          authorPermission: void 0,
           oidc: oidcCredentials
         }), true);
         const errorMessage = runContext.commercialRefused === "subscription_unpaid" ? "Pro renewal failed for this organization" : "Pro plan required for this organization";
@@ -195136,6 +195281,8 @@ async function main() {
       }
     }
     const tmpdir3 = createTempDirectory();
+    const repoDir = payload.cwd;
+    const preIntrospectionDirty = repoDir ? await dirtyTrackedPaths({ cwd: repoDir }) : null;
     const opencodeCliPath = await agents.opencode.install();
     captureBaselineModels(opencodeCliPath);
     if (runContext.dbSecrets) {
@@ -195150,6 +195297,13 @@ async function main() {
     }
     installCodexAuth();
     captureAuthorizedModels(opencodeCliPath);
+    if (preIntrospectionDirty && repoDir) {
+      await restoreDirtiedSince({
+        before: preIntrospectionDirty,
+        actor: "model introspection",
+        cwd: repoDir
+      });
+    }
     if (runContext.repoSettings.envAllowlist) {
       setEnvAllowlist(runContext.repoSettings.envAllowlist);
     }
@@ -195161,6 +195315,7 @@ async function main() {
     }
     const tokenRef = __using(_stack3, await resolveTokens({
       push: payload.push,
+      authorPermission: payload.event.authorPermission,
       xrepo: payload.xrepo,
       oidc: oidcCredentials
     }), true);
@@ -195327,6 +195482,7 @@ async function main() {
           },
           refreshGitToken: tokenRef.refreshGitToken,
           readToken: tokenRef.readToken,
+          ghToken: tokenRef.ghToken,
           xrepo: payload.xrepo,
           apiToken: runContext.apiToken,
           modes: modes2,
@@ -195418,6 +195574,11 @@ async function main() {
           xrepoLearningsFilePath: toolState.xrepoLearningsFilePath ?? null,
           xrepoLearningsHeadings: runContext.repoSettings.xrepoLearningsHeadings
         });
+        assertPromptToolRefs({
+          agentId,
+          prompt: instructions.full,
+          toolNames: mcpHttpServer.toolNames
+        });
         const logParts = [
           instructions.eventInstructions ? `EVENT-LEVEL INSTRUCTIONS:
 ${instructions.eventInstructions}` : null,
@@ -195432,7 +195593,7 @@ ${instructions.user}` : null,
           log.info(instructions.full);
         });
         if (agentId === "opencode") {
-          const pluginDir = join25(process.cwd(), ".opencode", "plugin");
+          const pluginDir = join26(process.cwd(), ".opencode", "plugin");
           const hasPlugins = existsSync8(pluginDir) && readdirSync2(pluginDir).some((f) => /\.[jt]sx?$/.test(f));
           if (hasPlugins && toolState.dependencyInstallation?.promise) {
             log.info(