pullfrog 0.1.57 → 0.1.60

package/dist/cli.mjs

@@ -3955,7 +3955,7 @@ var require_util2 = __commonJS({
     "use strict";
     var { redirectStatusSet, referrerPolicySet: referrerPolicyTokens, badPortsSet } = require_constants2();
     var { getGlobalOrigin } = require_global();
-    var { performance: performance9 } = __require("perf_hooks");
+    var { performance: performance10 } = __require("perf_hooks");
     var { isBlobLike, toUSVString, ReadableStreamFrom } = require_util();
     var assert3 = __require("assert");
     var { isUint8Array } = __require("util/types");
@@ -4118,7 +4118,7 @@ var require_util2 = __commonJS({
       }
     }
     function coarsenedSharedCurrentTime(crossOriginIsolatedCapability) {
-      return performance9.now();
+      return performance10.now();
     }
     function createOpaqueTimingInfo(timingInfo) {
       return {
@@ -20099,14 +20099,14 @@ Support boolean input list: \`true | True | TRUE | false | False | FALSE\``);
       });
     }
     exports.group = group2;
-    function saveState3(name, value2) {
+    function saveState4(name, value2) {
       const filePath = process.env["GITHUB_STATE"] || "";
       if (filePath) {
         return (0, file_command_1.issueFileCommand)("STATE", (0, file_command_1.prepareKeyValueMessage)(name, value2));
       }
       (0, command_1.issueCommand)("save-state", { name }, (0, utils_1.toCommandValue)(value2));
     }
-    exports.saveState = saveState3;
+    exports.saveState = saveState4;
     function getState2(name) {
       return process.env[`STATE_${name}`] || "";
     }
@@ -27894,11 +27894,11 @@ var require_mode = __commonJS({
 var require_isexe = __commonJS({
   "node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js"(exports, module) {
     var fs5 = __require("fs");
-    var core11;
+    var core12;
     if (process.platform === "win32" || global.TESTING_WINDOWS) {
-      core11 = require_windows();
+      core12 = require_windows();
     } else {
-      core11 = require_mode();
+      core12 = require_mode();
     }
     module.exports = isexe;
     isexe.sync = sync;
@@ -27921,7 +27921,7 @@ var require_isexe = __commonJS({
           });
         });
       }
-      core11(path4, options || {}, function(er, is) {
+      core12(path4, options || {}, function(er, is) {
         if (er) {
           if (er.code === "EACCES" || options && options.ignoreErrors) {
             er = null;
@@ -27933,7 +27933,7 @@ var require_isexe = __commonJS({
     }
     function sync(path4, options) {
       try {
-        return core11.sync(path4, options || {});
+        return core12.sync(path4, options || {});
       } catch (er) {
         if (options && options.ignoreErrors || er.code === "EACCES") {
           return false;
@@ -33299,7 +33299,7 @@ var require_util9 = __commonJS({
     var { redirectStatusSet, referrerPolicyTokens, badPortsSet } = require_constants9();
     var { getGlobalOrigin } = require_global3();
     var { collectAnHTTPQuotedString, parseMIMEType } = require_data_url();
-    var { performance: performance9 } = __require("node:perf_hooks");
+    var { performance: performance10 } = __require("node:perf_hooks");
     var { ReadableStreamFrom, isValidHTTPToken, normalizedMethodRecordsBase } = require_util8();
     var assert3 = __require("node:assert");
     var { isUint8Array } = __require("node:util/types");
@@ -33454,7 +33454,7 @@ var require_util9 = __commonJS({
       };
     }
     function coarsenedSharedCurrentTime(crossOriginIsolatedCapability) {
-      return coarsenTime(performance9.now(), crossOriginIsolatedCapability);
+      return coarsenTime(performance10.now(), crossOriginIsolatedCapability);
     }
     function createOpaqueTimingInfo(timingInfo) {
       return {
@@ -76726,7 +76726,7 @@ var require_core3 = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     var id_1 = require_id();
     var ref_1 = require_ref();
-    var core11 = [
+    var core12 = [
       "$schema",
       "$id",
       "$defs",
@@ -76736,7 +76736,7 @@ var require_core3 = __commonJS({
       id_1.default,
       ref_1.default
     ];
-    exports.default = core11;
+    exports.default = core12;
   }
 });
 
@@ -98607,14 +98607,14 @@ var require_turndown_cjs = __commonJS({
         } else if (node2.nodeType === 1) {
           replacement = replacementForNode.call(self2, node2);
         }
-        return join28(output, replacement);
+        return join29(output, replacement);
       }, "");
     }
     function postProcess(output) {
       var self2 = this;
       this.rules.forEach(function(rule) {
         if (typeof rule.append === "function") {
-          output = join28(output, rule.append(self2.options));
+          output = join29(output, rule.append(self2.options));
         }
       });
       return output.replace(/^[\t\r\n]+/, "").replace(/[\t\r\n\s]+$/, "");
@@ -98626,7 +98626,7 @@ var require_turndown_cjs = __commonJS({
       if (whitespace.leading || whitespace.trailing) content = content.trim();
       return whitespace.leading + rule.replacement(content, node2, this.options) + whitespace.trailing;
     }
-    function join28(output, replacement) {
+    function join29(output, replacement) {
       var s1 = trimTrailingNewlines(output);
       var s2 = trimLeadingNewlines(replacement);
       var nls = Math.max(output.length - s1.length, replacement.length - s2.length);
@@ -105306,14 +105306,14 @@ async function runClaudeAuth() {
 }
 
 // commands/gha.ts
-var core10 = __toESM(require_core(), 1);
+var core11 = __toESM(require_core(), 1);
 var import_arg2 = __toESM(require_arg(), 1);
 import { dirname as dirname6 } from "node:path";
 
 // main.ts
-import { existsSync as existsSync8, readdirSync as readdirSync2 } from "node:fs";
+import { existsSync as existsSync9, readdirSync as readdirSync2 } from "node:fs";
 import { readFile as readFile5 } from "node:fs/promises";
-import { join as join27 } from "node:path";
+import { join as join28 } from "node:path";
 
 // node_modules/.pnpm/package-manager-detector@1.8.0/node_modules/package-manager-detector/dist/commands.mjs
 function splitRunArgs(args2, valueFlags = []) {
@@ -106186,6 +106186,22 @@ var providers = {
       }
     }
   }),
+  azure: provider({
+    displayName: "Azure OpenAI",
+    // the resource name is half the endpoint URL and the deployment is the model
+    // id, so both are as load-bearing as the key. only the key is sensitive.
+    envVars: ["AZURE_API_KEY", "AZURE_RESOURCE_NAME", "AZURE_DEPLOYMENT"],
+    models: {
+      // single routing entry — the real model is the customer's deployment name,
+      // read from AZURE_DEPLOYMENT at run time. see ModelRouting docs for why
+      // Azure can't be cataloged even though models.dev lists it.
+      byok: {
+        displayName: "Azure OpenAI",
+        resolve: "azure",
+        routing: "azure"
+      }
+    }
+  }),
   "openai-compatible": provider({
     // "Custom" is the picker group, "OpenAI-compatible" the entry under it, so the
     // menu reads `Custom › OpenAI-compatible` and a second custom backend (a
@@ -106411,6 +106427,11 @@ function getModelEnvVars(slug2) {
   }
   return providerConfig.envVars.slice();
 }
+function getModelManagedCredentials(slug2) {
+  const parsed2 = parseModel(slug2);
+  const providerConfig = providers[parsed2.provider];
+  return providerConfig?.managedCredentials?.slice() ?? [];
+}
 var modelAliases = Object.entries(providers).flatMap(
   ([providerKey, config3]) => Object.entries(config3.models).map(([modelId, def]) => ({
     slug: `${providerKey}/${modelId}`,
@@ -106508,6 +106529,13 @@ function isOssAllowedModel(slug2) {
 }
 var BEDROCK_MODEL_ID_ENV = "BEDROCK_MODEL_ID";
 var VERTEX_MODEL_ID_ENV = "VERTEX_MODEL_ID";
+var AZURE_PROVIDER = "azure";
+var AZURE_RESOURCE_NAME_ENV = "AZURE_RESOURCE_NAME";
+var AZURE_API_KEY_ENV = "AZURE_API_KEY";
+var AZURE_DEPLOYMENT_ENV = "AZURE_DEPLOYMENT";
+var AZURE_CONTEXT_ENV = "AZURE_CONTEXT";
+var AZURE_MAX_OUTPUT_ENV = "AZURE_MAX_OUTPUT";
+var AZURE_USE_CHAT_COMPLETIONS_ENV = "AZURE_USE_CHAT_COMPLETIONS";
 var OPENAI_COMPATIBLE_PROVIDER = "openai-compatible";
 var OPENAI_COMPATIBLE_BASE_URL_ENV = "OPENAI_COMPATIBLE_BASE_URL";
 var OPENAI_COMPATIBLE_API_KEY_ENV = "OPENAI_COMPATIBLE_API_KEY";
@@ -106527,6 +106555,8 @@ function formatMcpToolRef(agentId, toolName) {
   switch (agentId) {
     case "claude":
       return `mcp__${pullfrogMcpName}__${toolName}`;
+    case "codex":
+      return `${pullfrogMcpName}__${toolName}`;
     case "opencode":
       return `${pullfrogMcpName}_${toolName}`;
     default:
@@ -106557,6 +106587,11 @@ var DEFAULT_ACTIVITY_TIMEOUT_MS = 3e5;
 var AGENT_ACTIVITY_TIMEOUT_MS = 9e5;
 var AGENT_FIRST_EVENT_TIMEOUT_MS = 12e4;
 var DEFAULT_ACTIVITY_CHECK_INTERVAL_MS = 5e3;
+function watchdogBudgetMs(compiled, envVar) {
+  const raw2 = Number(process.env[envVar]);
+  if (!Number.isFinite(raw2) || raw2 <= 0) return compiled;
+  return Math.min(compiled, raw2);
+}
 var DEBUG_TS_PREFIX = /^(?:\[\d{4}-\d{2}-\d{2}T[^\]]+\]\s+)?/.source;
 var ACTIVITY_NOISE_PATTERNS = [
   new RegExp(`${DEBUG_TS_PREFIX}\\[mcp-proxy\\]`),
@@ -107028,7 +107063,8 @@ import { pipeline } from "node:stream/promises";
 async function installFromNpmTarball(params) {
   const tempDir = process.env.PULLFROG_TEMP_DIR;
   if (!tempDir) throw new Error("PULLFROG_TEMP_DIR is not set");
-  const extractedDir = join2(tempDir, "package");
+  const packageRoot = join2(tempDir, `npm-${params.packageName.replace(/[^a-z0-9]+/gi, "-")}`);
+  const extractedDir = join2(packageRoot, "package");
   const cliPath = join2(extractedDir, params.executablePath);
   if (existsSync2(cliPath)) {
     log2.debug(`\xBB using cached binary at ${cliPath}`);
@@ -107054,7 +107090,8 @@ async function installFromNpmTarball(params) {
     }
   }
   log2.debug(`\xBB installing ${params.packageName}@${resolvedVersion}...`);
-  const tarballPath = join2(tempDir, "package.tgz");
+  mkdirSync(packageRoot, { recursive: true });
+  const tarballPath = join2(packageRoot, "package.tgz");
   const npmRegistry = process.env.NPM_REGISTRY || "https://registry.npmjs.org";
   let tarballUrl;
   if (params.packageName.startsWith("@")) {
@@ -107074,7 +107111,7 @@ async function installFromNpmTarball(params) {
   await pipeline(response.body, fileStream);
   log2.debug(`\xBB downloaded tarball to ${tarballPath}`);
   log2.debug(`\xBB extracting tarball...`);
-  const extractResult = spawnSync("tar", ["-xzf", tarballPath, "-C", tempDir], {
+  const extractResult = spawnSync("tar", ["-xzf", tarballPath, "-C", packageRoot], {
     stdio: "pipe",
     encoding: "utf-8"
   });
@@ -107083,9 +107120,6 @@ async function installFromNpmTarball(params) {
       `Failed to extract tarball: ${extractResult.stderr || extractResult.stdout || "Unknown error"}`
     );
   }
-  if (!existsSync2(cliPath)) {
-    throw new Error(`Executable not found in extracted package at ${cliPath}`);
-  }
   if (params.installDependencies) {
     log2.debug(`\xBB installing dependencies for ${params.packageName}...`);
     const installResult = spawnSync("npm", ["install", "--production"], {
@@ -107106,6 +107140,9 @@ async function installFromNpmTarball(params) {
     }
     log2.debug(`\xBB dependencies installed`);
   }
+  if (!existsSync2(cliPath)) {
+    throw new Error(`Executable not found in extracted package at ${cliPath}`);
+  }
   chmodSync(cliPath, 493);
   log2.debug(`\xBB ${params.packageName} installed at ${cliPath}`);
   return cliPath;
@@ -107279,6 +107316,7 @@ function resolveRunAlias(ctx) {
   }
   const model = ctx.resolvedModel;
   if (!model) return void 0;
+  if (model.startsWith(`${AZURE_PROVIDER}/`)) return void 0;
   return modelAliases.find((a2) => !a2.fallback && a2.resolve === model) ?? matchHostedAnthropicAlias(model);
 }
 function ossEffortFloor(ctx) {
@@ -107317,7 +107355,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.57",
+  version: "0.1.60",
   type: "module",
   bin: {
     pullfrog: "dist/cli.mjs",
@@ -107349,6 +107387,8 @@ var package_default = {
     "@clack/prompts": "^1.2.0",
     "@modelcontextprotocol/sdk": "^1.26.0",
     "@opencode-ai/sdk": "1.18.5",
+    "@openai/codex": "0.147.0",
+    "@openai/codex-sdk": "0.147.0",
     "@octokit/plugin-throttling": "^11.0.3",
     "@octokit/rest": "^22.0.0",
     "@octokit/webhooks-types": "^7.6.1",
@@ -109424,7 +109464,7 @@ var claude = agent({
       if ((isBedrockRoute || isVertexRoute2) && specifier && effort.alias?.effort) {
         applyHostedEffortCapabilities({ env: env2, modelId: specifier, levels: effort.alias.effort });
       }
-      if (env2.CLAUDE_CODE_OAUTH_TOKEN && !isBedrockRoute && env2.ANTHROPIC_API_KEY) {
+      if (env2.CLAUDE_CODE_OAUTH_TOKEN && !isBedrockRoute && !isVertexRoute2 && !env2.ANTHROPIC_BASE_URL && !env2.ANTHROPIC_AUTH_TOKEN && env2.ANTHROPIC_API_KEY) {
         const preflight = await preflightClaudeSubscription({
           token: env2.CLAUDE_CODE_OAUTH_TOKEN,
           model
@@ -109470,13 +109510,735 @@ var claude = agent({
   }
 });
 
-// agents/opencode.ts
+// agents/codex.ts
 var core2 = __toESM(require_core(), 1);
-import { spawn as nodeSpawn2 } from "node:child_process";
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join7 } from "node:path";
 import { performance as performance6 } from "node:perf_hooks";
 
+// utils/codexHome.ts
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { homedir as homedir2, userInfo } from "node:os";
+import { join as join6 } from "node:path";
+var CODEX_AUTH_ENV = "CODEX_AUTH_JSON";
+var PULLFROG_DATA_DIR = "/var/lib/pullfrog";
+function isRejectedChain(body) {
+  if (!body.refresh_rejected_at) return false;
+  log2.warning(
+    `\xBB ${CODEX_AUTH_ENV} was rejected by OpenAI at ${body.refresh_rejected_at} and cannot be refreshed \u2014 re-run \`npx pullfrog auth codex\`. skipping it for this run.`
+  );
+  return true;
+}
+function installCodexAuth() {
+  const raw2 = process.env[CODEX_AUTH_ENV];
+  if (!raw2) return null;
+  const body = parseCodexAuthBody(raw2);
+  if (!body) {
+    log2.warning(`\xBB ${CODEX_AUTH_ENV} present but malformed; ignoring`);
+    return null;
+  }
+  if (isRejectedChain(body)) return null;
+  const expiresMs = decodeJwtExpMs(body.tokens.access_token) ?? 0;
+  const xdgDataHome = resolveDataHome();
+  const opencodeDir = join6(xdgDataHome, "opencode");
+  const authPath = join6(opencodeDir, "auth.json");
+  const opencodeAuth = {
+    openai: {
+      type: "oauth",
+      refresh: body.tokens.refresh_token,
+      access: body.tokens.access_token,
+      expires: expiresMs,
+      ...body.tokens.account_id ? { accountId: body.tokens.account_id } : {}
+    }
+  };
+  mkdirSync5(opencodeDir, { recursive: true });
+  writeFileSync5(authPath, `${JSON.stringify(opencodeAuth, null, 2)}
+`, { mode: 384 });
+  process.env.XDG_DATA_HOME = xdgDataHome;
+  log2.info(`\xBB installed Codex auth at ${authPath}`);
+  return {
+    authPath,
+    xdgDataHome,
+    originalRefresh: body.tokens.refresh_token,
+    originalIdToken: body.tokens.id_token
+  };
+}
+function installCodexHome() {
+  const raw2 = process.env[CODEX_AUTH_ENV];
+  if (!raw2) return null;
+  const body = parseCodexAuthBody(raw2);
+  if (!body) {
+    log2.warning(`\xBB ${CODEX_AUTH_ENV} present but malformed; ignoring`);
+    return null;
+  }
+  if (isRejectedChain(body)) return null;
+  if (!body.tokens.id_token) {
+    log2.warning(
+      `\xBB ${CODEX_AUTH_ENV} carries no id_token \u2014 the codex CLI cannot load it. re-run \`npx pullfrog auth codex\` to mint a complete credential.`
+    );
+    return null;
+  }
+  const codexHome = join6(resolveDataHome(), "codex");
+  const authPath = join6(codexHome, "auth.json");
+  mkdirSync5(codexHome, { recursive: true });
+  writeFileSync5(authPath, stringifyCodexAuthBody(body), { mode: 384 });
+  log2.info(`\xBB installed Codex auth at ${authPath}`);
+  return { codexHome, authPath, originalRefresh: body.tokens.refresh_token };
+}
+function resolveDataHome() {
+  if (process.env.CI !== "true") return join6(homedir2(), ".local", "share");
+  bootstrapPullfrogDataDir();
+  return PULLFROG_DATA_DIR;
+}
+function bootstrapPullfrogDataDir() {
+  const user = userInfo().username;
+  let primaryGroup;
+  try {
+    primaryGroup = execFileSync4("id", ["-gn", user], { stdio: "pipe", encoding: "utf-8" }).trim();
+  } catch {
+    primaryGroup = user;
+  }
+  try {
+    execFileSync4("sudo", ["-n", "mkdir", "-p", PULLFROG_DATA_DIR], { stdio: "pipe" });
+    execFileSync4("sudo", ["-n", "chown", `${user}:${primaryGroup}`, PULLFROG_DATA_DIR], {
+      stdio: "pipe"
+    });
+    execFileSync4("sudo", ["-n", "chmod", "700", PULLFROG_DATA_DIR], { stdio: "pipe" });
+  } catch (err) {
+    throw new Error(
+      `failed to bootstrap ${PULLFROG_DATA_DIR} (required for codex auth in CI): ${err instanceof Error ? err.message : String(err)}. the MCP shell's mount-namespace sandbox cannot protect the auth file when it lives under $HOME, and silently falling back would contradict the "three independent layers" claim in wiki/codex-auth.md. passwordless sudo is required for codex auth on this runner \u2014 either configure it, or remove CODEX_AUTH_JSON from the run.`
+    );
+  }
+}
+
+// utils/secrets.ts
+var SENSITIVE_PATTERNS = [
+  /_KEY$/i,
+  /_SECRET$/i,
+  /_TOKEN$/i,
+  /_PASSWORD$/i,
+  /_CREDENTIAL$/i
+];
+function isSensitiveEnvName(key) {
+  return SENSITIVE_PATTERNS.some((p) => p.test(key));
+}
+var SAFE_ENV_PREFIXES = ["GITHUB_", "RUNNER_", "JAVA_HOME_", "GOROOT_"];
+var SAFE_ENV_NAMES = /* @__PURE__ */ new Set([
+  // system
+  "CI",
+  "HOME",
+  "LANG",
+  "LOGNAME",
+  "PATH",
+  "SHELL",
+  "SHLVL",
+  "TERM",
+  "TMPDIR",
+  "TZ",
+  "USER",
+  "XDG_CONFIG_HOME",
+  "XDG_RUNTIME_DIR",
+  "DEBIAN_FRONTEND",
+  // runner image toolchain
+  "ACCEPT_EULA",
+  "AGENT_TOOLSDIRECTORY",
+  "ANDROID_HOME",
+  "ANDROID_NDK",
+  "ANDROID_NDK_HOME",
+  "ANDROID_NDK_LATEST_HOME",
+  "ANDROID_NDK_ROOT",
+  "ANDROID_SDK_ROOT",
+  "ANT_HOME",
+  "AZURE_EXTENSION_DIR",
+  "BOOTSTRAP_HASKELL_NONINTERACTIVE",
+  "CHROME_BIN",
+  "CHROMEWEBDRIVER",
+  "CONDA",
+  "DOTNET_MULTILEVEL_LOOKUP",
+  "DOTNET_NOLOGO",
+  "DOTNET_SKIP_FIRST_TIME_EXPERIENCE",
+  "EDGEWEBDRIVER",
+  "GECKOWEBDRIVER",
+  "GHCUP_INSTALL_BASE_PREFIX",
+  "GRADLE_HOME",
+  "JAVA_HOME",
+  "HOMEBREW_CLEANUP_PERIODIC_FULL_DAYS",
+  "HOMEBREW_NO_AUTO_UPDATE",
+  "ImageOS",
+  "ImageVersion",
+  "NVM_DIR",
+  "PIPX_BIN_DIR",
+  "PIPX_HOME",
+  "PSModulePath",
+  "SELENIUM_JAR_PATH",
+  "SGX_AESM_ADDR",
+  "SWIFT_PATH",
+  "VCPKG_INSTALLATION_ROOT"
+]);
+var _userAllowlist = null;
+function setEnvAllowlist(raw2) {
+  const names = raw2.split("\n").map((line) => line.trim()).filter(Boolean);
+  _userAllowlist = new Set(names);
+}
+function isSafeEnvVar(key) {
+  if (SAFE_ENV_NAMES.has(key)) return true;
+  return SAFE_ENV_PREFIXES.some((p) => key.startsWith(p));
+}
+var WORKFLOW_COMMAND_ENV_NAMES = [
+  "GITHUB_ENV",
+  "GITHUB_PATH",
+  "GITHUB_OUTPUT",
+  "GITHUB_STATE",
+  "GITHUB_STEP_SUMMARY",
+  // dropping the five paths above but keeping RUNNER_TEMP would be theatre:
+  // the file-command files live in `$RUNNER_TEMP/_runner_file_commands/`, so the
+  // directory is one `ls` away. nothing in the install path reads it (only our
+  // own leak-surface wipe in `setup.ts`, which runs in the parent), and package
+  // managers use TMPDIR.
+  "RUNNER_TEMP"
+];
+function filterEnvForUntrustedCode() {
+  const env2 = filterEnv();
+  for (const name of WORKFLOW_COMMAND_ENV_NAMES) delete env2[name];
+  return env2;
+}
+function filterEnv() {
+  const filtered = {};
+  for (const [key, value2] of Object.entries(process.env)) {
+    if (value2 === void 0) continue;
+    const userAllowed = _userAllowlist?.has(key) ?? false;
+    if (isSensitiveEnvName(key) && !userAllowed) continue;
+    if (isSafeEnvVar(key) || userAllowed) {
+      filtered[key] = value2;
+    }
+  }
+  return filtered;
+}
+function resolveEnv(mode) {
+  if (mode === "inherit") {
+    return process.env;
+  }
+  if (mode === "restricted" || mode === void 0) {
+    return filterEnv();
+  }
+  return { ...filterEnv(), ...mode };
+}
+
+// agents/codex.ts
+var CODEX_TARGETS = {
+  "linux-x64": "x86_64-unknown-linux-musl",
+  "linux-arm64": "aarch64-unknown-linux-musl",
+  "darwin-x64": "x86_64-apple-darwin",
+  "darwin-arm64": "aarch64-apple-darwin",
+  "win32-x64": "x86_64-pc-windows-msvc",
+  "win32-arm64": "aarch64-pc-windows-msvc"
+};
+async function installCodexCli() {
+  const target = CODEX_TARGETS[`${process.platform}-${process.arch}`];
+  if (!target) {
+    throw new Error(`the codex CLI ships no binary for ${process.platform}-${process.arch}`);
+  }
+  const binary = process.platform === "win32" ? "codex.exe" : "codex";
+  return await installFromNpmTarball({
+    packageName: "@openai/codex",
+    version: getDevDependencyVersion("@openai/codex"),
+    executablePath: `node_modules/@openai/codex-${process.platform}-${process.arch}/vendor/${target}/bin/${binary}`,
+    installDependencies: true
+  });
+}
+var CODEX_DISABLED_FEATURES = [
+  // browser / desktop control — network reach and arbitrary JS
+  "browser_use",
+  "browser_use_external",
+  "browser_use_full_cdp_access",
+  "computer_use",
+  "in_app_browser",
+  // third-party code loaded into the agent process
+  "plugins",
+  "remote_plugin",
+  "plugin_sharing",
+  "skill_mcp_dependency_install",
+  // lifecycle hooks run commands sourced from repo config, which a PR can edit
+  "hooks",
+  // connectors
+  "apps",
+  // ungated subagent fan-out (see the file header)
+  "multi_agent",
+  "multi_agent_v2"
+];
+var CODEX_SHELL_FEATURES = ["shell_tool", "unified_exec"];
+function tomlBool(entries, value2) {
+  return entries.map((name) => `${name} = ${value2}`).join("\n");
+}
+function securityOverrideFlags(params) {
+  const shellEnabled = params.ctx.payload.shell === "enabled";
+  const features = [
+    ...CODEX_DISABLED_FEATURES.map((name) => `${name}=false`),
+    ...CODEX_SHELL_FEATURES.map((name) => `${name}=${shellEnabled}`)
+  ];
+  return [
+    "-c",
+    `approval_policy=${JSON.stringify("never")}`,
+    "-c",
+    `sandbox_mode=${JSON.stringify(params.sandboxMode)}`,
+    // the sandbox's EXTENT has to be locked too, not just its mode: a repo
+    // setting `writable_roots = ["/"]` walked straight out of the checkout with
+    // `sandbox_mode` already flag-locked (measured — apply_patch wrote a file
+    // under $HOME).
+    "-c",
+    `sandbox_workspace_write.writable_roots=[${JSON.stringify(params.repoDir)}]`,
+    "-c",
+    "sandbox_workspace_write.network_access=true",
+    // our own MCP server, for a third time in the same class: a repo pointing
+    // `mcp_servers.pullfrog.url` at its own endpoint (measured — `codex mcp get`
+    // reported the repo's URL) turns every pullfrog tool call into an
+    // exfiltration channel, carrying diffs, file contents and cross-repo
+    // learnings to whoever it names.
+    "-c",
+    `mcp_servers.${pullfrogMcpName}.url=${JSON.stringify(params.mcpServerUrl)}`,
+    "-c",
+    `mcp_servers.${pullfrogMcpName}.${APPROVAL_MODE_KEY}=${JSON.stringify("approve")}`,
+    "-c",
+    `mcp_servers.${pullfrogMcpName}.required=true`,
+    "-c",
+    `mcp_servers.${pullfrogMcpName}.tool_timeout_sec=660`,
+    // `enabled` closes the silent-DoS variant: a repo setting it false would
+    // otherwise strip every GitHub tool and leave the agent narrating failure.
+    "-c",
+    `mcp_servers.${pullfrogMcpName}.enabled=true`,
+    // not a boundary, but the same override: a repo silently re-pointing the
+    // model spends the account's money on a pick it never made, and makes the
+    // "Using `…`" run footer a lie about what actually ran.
+    ...params.model ? ["-c", `model=${JSON.stringify(params.model)}`] : [],
+    ...params.effortRung ? ["-c", `model_reasoning_effort=${JSON.stringify(params.effortRung)}`] : [],
+    ...features.flatMap((entry) => ["-c", `features.${entry}`])
+  ];
+}
+var CODEX_EFFORTS = ["minimal", "low", "medium", "high", "xhigh"];
+function resolveCodexModel(ctx) {
+  const specifier = ctx.payload.proxyModel ?? ctx.resolvedModel;
+  if (!specifier) return void 0;
+  try {
+    if (getModelProvider(specifier) === "openai") return stripProviderPrefix(specifier);
+  } catch {
+  }
+  log2.warning(`\xBB ${specifier} isn't an OpenAI model \u2014 running codex on its own default instead`);
+  return void 0;
+}
+var APPROVAL_MODE_KEY = "default_tools_approval_mode";
+var APPROVE_TOOLS = `${APPROVAL_MODE_KEY} = "approve"`;
+function repoMcpApprovals(repoDir) {
+  const path4 = join7(repoDir, ".codex", "config.toml");
+  if (!existsSync4(path4)) return [];
+  const out = [];
+  let section = [];
+  let isServerTable = false;
+  function flush() {
+    if (section.length === 0) return;
+    const declared = section.some((line) => line.trimStart().startsWith(APPROVAL_MODE_KEY));
+    if (isServerTable && !declared) section.splice(1, 0, APPROVE_TOOLS);
+    out.push(...section, "");
+    section = [];
+  }
+  for (const line of readFileSync3(path4, "utf8").split("\n")) {
+    const header = line.trim().match(/^\[(?<key>[^\]]+)\]$/);
+    if (!header?.groups) {
+      if (section.length > 0) section.push(line);
+      continue;
+    }
+    flush();
+    const key = header.groups.key.trim();
+    if (!key.startsWith("mcp_servers.")) continue;
+    const name = key.slice("mcp_servers.".length).replace(/^"([^"]*)"/, "$1");
+    if (name === pullfrogMcpName || name.startsWith(`${pullfrogMcpName}.`)) continue;
+    isServerTable = !name.includes(".");
+    section = [line.trim()];
+  }
+  flush();
+  return out;
+}
+function warnIfNativeEditsUnavailable(ctx) {
+  if (process.platform !== "linux" || ctx.payload.shell !== "disabled") return;
+  log2.warning(
+    "\xBB this run cannot change files: codex's native write tool depends on bubblewrap, which Ubuntu 24.04 blocks (https://github.com/openai/codex/issues/29908), and the MCP shell is disabled for this repo. read-only work is unaffected \u2014 set `shell: restricted` if the agent needs to edit anything."
+  );
+}
+function writeCodexConfig(params) {
+  const shellEnabled = params.ctx.payload.shell === "enabled";
+  const sandboxMode = params.ctx.payload.push === "disabled" ? "read-only" : "workspace-write";
+  const repoDir = process.cwd();
+  const config3 = [
+    "# written by pullfrog",
+    // "never" keeps the run non-interactive WITHOUT
+    // --dangerously-bypass-approvals-and-sandbox, which would also switch the
+    // sandbox off and let the native apply_patch tool write anywhere.
+    'approval_policy = "never"',
+    `sandbox_mode = ${JSON.stringify(sandboxMode)}`,
+    // matches opencode's `webfetch: "allow"` — research is part of the job and
+    // neither harness gates it on a permission.
+    'web_search = "live"',
+    ...params.model ? [`model = ${JSON.stringify(params.model)}`] : [],
+    ...params.effortRung ? [`model_reasoning_effort = ${JSON.stringify(params.effortRung)}`] : [],
+    "",
+    "[features]",
+    tomlBool(CODEX_DISABLED_FEATURES, false),
+    tomlBool(CODEX_SHELL_FEATURES, shellEnabled),
+    "",
+    "[sandbox_workspace_write]",
+    "network_access = true",
+    // the checkout, named explicitly rather than left to `workspace-write` to
+    // imply. does NOT fix the Linux native-write failure — nothing here does;
+    // see wiki/codex-agent.md "The Linux native-write blocker".
+    `writable_roots = [${JSON.stringify(repoDir)}]`,
+    "",
+    `[mcp_servers.${pullfrogMcpName}]`,
+    `url = ${JSON.stringify(params.ctx.mcpServerUrl)}`,
+    // codex's default MCP approval mode PROMPTS for anything it can't read as
+    // read-only, and a `codex exec` run has nobody to answer — the call comes
+    // back "user cancelled MCP tool call" and the agent silently accomplishes
+    // nothing. our own server is the trusted one; the boundary is what we
+    // register, not a second confirmation.
+    APPROVE_TOOLS,
+    // a run whose GitHub tools never registered can't do its job, so fail loudly
+    // rather than let the agent improvise without them.
+    "required = true",
+    // mirrors the opencode harness's 660s: `checkout_pr` runs a multi-minute
+    // fetch on large repos and enforces its own 600s deadline, so a shorter
+    // client abort turns a working checkout into a spurious tool error.
+    "tool_timeout_sec = 660",
+    "",
+    ...repoMcpApprovals(repoDir),
+    // UNTRUSTED, deliberately, and this one line is the whole config-precedence
+    // boundary. Codex loads `<repo>/.codex/config.toml` as a layer that
+    // OUTRANKS ours (project 25 vs user 20), and its denylist strips none of
+    // `sandbox_mode`, `approval_policy`, `features` or `mcp_servers` — so a
+    // fork PR could ship a config re-enabling the native shell. Marking the
+    // checkout untrusted makes that layer load `disabled`, closing the class
+    // outright rather than key by key: `RawMcpServerConfig` alone has ~26
+    // fields and enumeration can never finish.
+    //
+    // It costs nothing. `codex exec`'s only startup gate is a GIT-REPO check
+    // (`exec/src/lib.rs:796` — `get_git_repo_root(...).is_none()`, whose error
+    // text unhelpfully says "Not inside a trusted directory"), so an untrusted
+    // checkout still runs. And the repo's own MCP servers survive, because
+    // `repoMcpApprovals` above copies them into OUR layer — which is why that
+    // copying exists at all.
+    //
+    // Measured both ways at 0.147.0: `trusted` → the repo's `model` won;
+    // `untrusted` → it did not, and the run proceeded normally.
+    `[projects.${JSON.stringify(repoDir)}]`,
+    'trust_level = "untrusted"',
+    ""
+  ].join("\n");
+  writeFileSync6(join7(params.codexHome, "config.toml"), config3, { mode: 384 });
+  log2.info(`\xBB codex config: sandbox=${sandboxMode}, nativeShell=${shellEnabled}`);
+}
+function toTodoWriteInput(item) {
+  return {
+    todos: item.items.map((todo, index) => ({
+      id: String(index),
+      content: todo.text,
+      status: todo.completed ? "completed" : "pending"
+    }))
+  };
+}
+async function runCodex2(params) {
+  const startTime = performance6.now();
+  const thinkingTimer = new ThinkingTimer();
+  const output = new TailBuffer(DEFAULT_MAX_RETAINED_BYTES);
+  const recentStderr = [];
+  let eventCount = 0;
+  let finalOutput = "";
+  let threadId;
+  let turnError = null;
+  let lastProviderError = null;
+  let stdoutBuffer = "";
+  const tokens = { input: 0, cacheRead: 0, output: 0 };
+  function buildUsage2() {
+    if (tokens.input === 0 && tokens.output === 0) return void 0;
+    return {
+      agent: "codex",
+      inputTokens: tokens.input,
+      outputTokens: tokens.output,
+      cacheReadTokens: tokens.cacheRead || void 0
+    };
+  }
+  function onItem(item, phase) {
+    switch (item.type) {
+      case "agent_message":
+        if (phase === "completed" && item.text.trim()) {
+          finalOutput = item.text.trim();
+          log2.box(finalOutput, { title: "Pullfrog" });
+        }
+        return;
+      case "reasoning":
+        if (phase === "completed" && item.text.trim()) {
+          log2.box(item.text.trim(), { title: "Pullfrog" });
+        }
+        return;
+      case "command_execution":
+        if (phase === "started") {
+          thinkingTimer.markToolCall();
+          log2.toolCall({ toolName: "shell", input: { command: item.command } });
+          return;
+        }
+        thinkingTimer.markToolResult();
+        log2.startGroup("shell output");
+        log2.info(item.aggregated_output || "");
+        log2.endGroup();
+        return;
+      case "mcp_tool_call":
+        if (phase === "started") {
+          thinkingTimer.markToolCall();
+          params.onToolUse?.({ toolName: item.tool, input: item.arguments });
+          log2.toolCall({ toolName: `${item.server}__${item.tool}`, input: item.arguments });
+          if (item.tool.includes("report_progress")) params.todoTracker?.cancel();
+          return;
+        }
+        thinkingTimer.markToolResult();
+        if (item.error) log2.info(`\xBB tool error: ${item.error.message}`);
+        return;
+      case "file_change":
+        if (phase === "completed") {
+          const paths = item.changes.map((c2) => `${c2.kind} ${c2.path}`).join(", ");
+          log2.info(`\xBB apply_patch (${item.status}): ${paths}`);
+        }
+        return;
+      case "web_search":
+        if (phase === "started") log2.toolCall({ toolName: "web_search", input: item.query });
+        return;
+      case "todo_list":
+        if (params.todoTracker?.enabled) params.todoTracker.update(toTodoWriteInput(item));
+        return;
+      case "error":
+        log2.info(`\xBB ${item.message}`);
+        return;
+      default:
+        item;
+    }
+  }
+  function onEvent(event) {
+    switch (event.type) {
+      case "thread.started":
+        threadId = event.thread_id;
+        return;
+      case "turn.completed":
+        tokens.input += event.usage.input_tokens ?? 0;
+        tokens.cacheRead += event.usage.cached_input_tokens ?? 0;
+        tokens.output += event.usage.output_tokens ?? 0;
+        return;
+      case "turn.failed":
+        turnError = event.error.message;
+        log2.info(`\xBB turn failed: ${turnError}`);
+        return;
+      case "error":
+        turnError = event.message;
+        log2.info(`\xBB codex error: ${event.message}`);
+        return;
+      case "item.started":
+        onItem(event.item, "started");
+        return;
+      case "item.completed":
+        onItem(event.item, "completed");
+        return;
+      case "item.updated":
+        if (event.item.type === "todo_list") onItem(event.item, "started");
+        return;
+      case "turn.started":
+        return;
+      default:
+        event;
+    }
+  }
+  try {
+    const result = await spawn3({
+      cmd: params.cliPath,
+      args: params.args,
+      cwd: params.cwd,
+      env: params.env,
+      activityTimeout: AGENT_ACTIVITY_TIMEOUT_MS,
+      onActivityTimeout: params.onActivityTimeout,
+      // stdin MUST be `ignore`: codex reads a piped stdin as an extra `<stdin>`
+      // prompt block and blocks on EOF, so an inherited pipe hangs the run
+      // before the first model call.
+      stdio: ["ignore", "pipe", "pipe"],
+      killGroup: true,
+      retain: "none",
+      onStdout: (chunk) => {
+        output.append(chunk);
+        markActivity();
+        stdoutBuffer += chunk;
+        const lines = stdoutBuffer.split("\n");
+        stdoutBuffer = lines.pop() || "";
+        for (const line of lines) {
+          const trimmed = line.trim();
+          if (!trimmed) continue;
+          let event;
+          try {
+            event = JSON.parse(trimmed);
+          } catch {
+            log2.debug(`\xBB non-JSON stdout line: ${trimmed.substring(0, 200)}`);
+            continue;
+          }
+          eventCount++;
+          log2.debug(JSON.stringify(event, null, 2));
+          const idleMs = getIdleMs();
+          if (idleMs > 1e4) {
+            log2.info(
+              `\xBB no activity for ${(idleMs / 1e3).toFixed(1)}s (${eventCount} events processed so far)`
+            );
+          }
+          markActivity();
+          onEvent(event);
+        }
+      },
+      onStderr: (chunk) => {
+        const trimmed = chunk.trim();
+        if (!trimmed) return;
+        recentStderr.push(trimmed);
+        if (recentStderr.length > MAX_STDERR_LINES) recentStderr.shift();
+        const match3 = findProviderErrorMatch(trimmed);
+        if (match3) {
+          lastProviderError = match3.label;
+          log2.info(`\xBB provider error detected (${match3.label}): ${match3.excerpt}`);
+        } else {
+          log2.debug(trimmed);
+        }
+      }
+    });
+    const duration4 = performance6.now() - startTime;
+    log2.info(`\xBB codex completed in ${Math.round(duration4)}ms with exit code ${result.exitCode}`);
+    const usage = buildUsage2();
+    if (usage) {
+      logTokenTable({
+        input: tokens.input - tokens.cacheRead,
+        cacheRead: tokens.cacheRead,
+        cacheWrite: 0,
+        output: tokens.output
+      });
+    }
+    if (result.exitCode !== 0 || turnError) {
+      const stderrSnapshot = recentStderr.join("\n");
+      const error52 = turnError || stderrSnapshot || lastProviderError && `provider error: ${lastProviderError}` || `unknown error - no output from Codex CLI (exit ${result.exitCode})`;
+      log2.error(`codex exited with code ${result.exitCode}: ${error52}`);
+      return { success: false, output: finalOutput || output.toString(), error: error52, usage, threadId };
+    }
+    return { success: true, output: finalOutput || output.toString(), usage, threadId };
+  } catch (error52) {
+    const duration4 = performance6.now() - startTime;
+    const message = error52 instanceof Error ? error52.message : String(error52);
+    const isActivityTimeout = error52 instanceof SpawnTimeoutError && error52.code === SPAWN_ACTIVITY_TIMEOUT_CODE;
+    const diagnosis = lastProviderError ? `likely cause: ${lastProviderError}` : eventCount === 0 ? "codex produced 0 stdout events - check if the API is reachable" : `${eventCount} events were processed before the hang`;
+    log2.info(
+      `\xBB codex ${isActivityTimeout ? "hung" : "failed"} after ${(duration4 / 1e3).toFixed(1)}s: ${message}`
+    );
+    log2.info(`\xBB diagnosis: ${diagnosis}`);
+    if (recentStderr.length > 0) log2.info(`\xBB recent stderr:
+${recentStderr.join("\n")}`);
+    return {
+      success: false,
+      output: finalOutput || output.toString(),
+      error: `${message} [${diagnosis}]`,
+      usage: buildUsage2(),
+      threadId
+    };
+  }
+}
+var codex = agent({
+  name: "codex",
+  install: installCodexCli,
+  run: async (ctx) => {
+    const cliPath = await installCodexCli();
+    warnIfNativeEditsUnavailable(ctx);
+    const codexHomeAuth = installCodexHome();
+    const codexHome = codexHomeAuth?.codexHome ?? join7(ctx.tmpdir, ".codex");
+    mkdirSync6(codexHome, { recursive: true });
+    const effort = resolveRunEffort(ctx);
+    if (effort.rung && !CODEX_EFFORTS.includes(effort.rung)) {
+      log2.warning(`\xBB effort ${effort.rung} not sent \u2014 codex doesn't accept that level`);
+    }
+    writeCodexConfig({
+      ctx,
+      codexHome,
+      model: resolveCodexModel(ctx),
+      effortRung: effort.rung && CODEX_EFFORTS.includes(effort.rung) ? effort.rung : void 0
+    });
+    if (codexHomeAuth) {
+      core2.saveState(
+        "codex_writeback",
+        JSON.stringify({
+          apiToken: ctx.apiToken,
+          authPath: codexHomeAuth.authPath,
+          originalRefresh: codexHomeAuth.originalRefresh
+        })
+      );
+    }
+    const baseEnv = ctx.payload.shell === "enabled" ? process.env : filterEnv();
+    const env2 = {
+      ...baseEnv,
+      CODEX_HOME: codexHome,
+      PWD: process.cwd()
+    };
+    delete env2.CODEX_API_KEY;
+    if (codexHomeAuth) {
+      delete env2.OPENAI_API_KEY;
+    } else if (process.env.OPENAI_API_KEY) {
+      env2.CODEX_API_KEY = process.env.OPENAI_API_KEY;
+    }
+    const securityFlags = securityOverrideFlags({
+      ctx,
+      sandboxMode: ctx.payload.push === "disabled" ? "read-only" : "workspace-write",
+      repoDir: process.cwd(),
+      mcpServerUrl: ctx.mcpServerUrl,
+      model: resolveCodexModel(ctx),
+      effortRung: effort.rung && CODEX_EFFORTS.includes(effort.rung) ? effort.rung : void 0
+    });
+    const runnerArgs = { cliPath, cwd: process.cwd(), env: env2, todoTracker: ctx.todoTracker };
+    const initial = await runCodex2({
+      ...runnerArgs,
+      args: [...securityFlags, "exec", "--json", ctx.instructions.full],
+      onActivityTimeout: ctx.onActivityTimeout,
+      onToolUse: ctx.onToolUse
+    });
+    const result = await runPostRunRetryLoop({
+      ctx,
+      initialResult: initial,
+      initialUsage: initial.usage,
+      reflectionPrompt: buildReflectionPrompt(ctx.toolState),
+      // a resume needs the thread codex recorded. without one there is nothing
+      // to continue, and `resume --last` would be worse than not resuming: it
+      // picks the newest recorded session in this cwd, which on a self-hosted
+      // runner with a shared CODEX_HOME is somebody else's run.
+      canResume: (r2) => r2.threadId !== void 0,
+      resume: async (c2) => runCodex2({
+        ...runnerArgs,
+        args: [
+          ...securityFlags,
+          "exec",
+          "resume",
+          "--json",
+          c2.previousResult.threadId ?? "",
+          c2.prompt
+        ]
+      })
+    });
+    if (result.success) {
+      await ctx.todoTracker?.flush();
+    } else {
+      ctx.todoTracker?.cancel();
+    }
+    return result;
+  }
+});
+
+// agents/opencode.ts
+var core3 = __toESM(require_core(), 1);
+import { spawn as nodeSpawn2 } from "node:child_process";
+import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join8 } from "node:path";
+import { performance as performance7 } from "node:perf_hooks";
+
 // node_modules/.pnpm/@opencode-ai+sdk@1.18.5/node_modules/@opencode-ai/sdk/dist/v2/gen/core/serverSentEvents.gen.js
 var createSseClient = ({ onRequest, onSseError, onSseEvent, responseTransformer, responseValidator, sseDefaultRetryDelay, sseMaxRetryAttempts, sseMaxRetryDelay, sseSleepFn, url: url4, ...options }) => {
   let lastEventId;
@@ -114883,71 +115645,6 @@ var import_cross_spawn = __toESM(require_cross_spawn(), 1);
 // agents/opencode.ts
 var import_undici = __toESM(require_undici2(), 1);
 
-// utils/codexHome.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
-import { homedir as homedir2, userInfo } from "node:os";
-import { join as join6 } from "node:path";
-var CODEX_AUTH_ENV = "CODEX_AUTH_JSON";
-var PULLFROG_DATA_DIR = "/var/lib/pullfrog";
-function installCodexAuth() {
-  const raw2 = process.env[CODEX_AUTH_ENV];
-  if (!raw2) return null;
-  const body = parseCodexAuthBody(raw2);
-  if (!body) {
-    log2.warning(`\xBB ${CODEX_AUTH_ENV} present but malformed; ignoring`);
-    return null;
-  }
-  const expiresMs = decodeJwtExpMs(body.tokens.access_token) ?? 0;
-  const xdgDataHome = resolveDataHome();
-  const opencodeDir = join6(xdgDataHome, "opencode");
-  const authPath = join6(opencodeDir, "auth.json");
-  const opencodeAuth = {
-    openai: {
-      type: "oauth",
-      refresh: body.tokens.refresh_token,
-      access: body.tokens.access_token,
-      expires: expiresMs,
-      ...body.tokens.account_id ? { accountId: body.tokens.account_id } : {}
-    }
-  };
-  mkdirSync5(opencodeDir, { recursive: true });
-  writeFileSync5(authPath, `${JSON.stringify(opencodeAuth, null, 2)}
-`, { mode: 384 });
-  process.env.XDG_DATA_HOME = xdgDataHome;
-  log2.info(`\xBB installed Codex auth at ${authPath}`);
-  return {
-    authPath,
-    xdgDataHome,
-    originalRefresh: body.tokens.refresh_token
-  };
-}
-function resolveDataHome() {
-  if (process.env.CI !== "true") return join6(homedir2(), ".local", "share");
-  bootstrapPullfrogDataDir();
-  return PULLFROG_DATA_DIR;
-}
-function bootstrapPullfrogDataDir() {
-  const user = userInfo().username;
-  let primaryGroup;
-  try {
-    primaryGroup = execFileSync4("id", ["-gn", user], { stdio: "pipe", encoding: "utf-8" }).trim();
-  } catch {
-    primaryGroup = user;
-  }
-  try {
-    execFileSync4("sudo", ["-n", "mkdir", "-p", PULLFROG_DATA_DIR], { stdio: "pipe" });
-    execFileSync4("sudo", ["-n", "chown", `${user}:${primaryGroup}`, PULLFROG_DATA_DIR], {
-      stdio: "pipe"
-    });
-    execFileSync4("sudo", ["-n", "chmod", "700", PULLFROG_DATA_DIR], { stdio: "pipe" });
-  } catch (err) {
-    throw new Error(
-      `failed to bootstrap ${PULLFROG_DATA_DIR} (required for codex auth in CI): ${err instanceof Error ? err.message : String(err)}. the MCP shell's mount-namespace sandbox cannot protect the auth file when it lives under $HOME, and silently falling back would contradict the "three independent layers" claim in wiki/codex-auth.md. passwordless sudo is required for codex auth on this runner \u2014 either configure it, or remove CODEX_AUTH_JSON from the run.`
-    );
-  }
-}
-
 // utils/worktree.ts
 async function dirtyTrackedPaths(params = {}) {
   const result = await spawn3({
@@ -115215,6 +115912,30 @@ function openAICompatibleProvider(model) {
     }
   };
 }
+function azureProvider(model) {
+  const prefix = `${AZURE_PROVIDER}/`;
+  if (!model?.startsWith(prefix)) return {};
+  const deployment = model.slice(prefix.length);
+  return {
+    [AZURE_PROVIDER]: {
+      // always sent: opencode reads it as `Boolean(options?.useCompletionUrls)`,
+      // so `false` and absent are the same, and the deep merge keeps the native
+      // loader's `resourceName` either way.
+      options: {
+        useCompletionUrls: process.env[AZURE_USE_CHAT_COMPLETIONS_ENV]?.trim() === "true"
+      },
+      models: {
+        [deployment]: {
+          name: deployment,
+          limit: {
+            context: Number(process.env[AZURE_CONTEXT_ENV]),
+            output: Number(process.env[AZURE_MAX_OUTPUT_ENV])
+          }
+        }
+      }
+    }
+  };
+}
 var KIMI_ENFORCERLESS_PROVIDERS = ["siliconflow", "together"];
 function kimiOpenRouterProviderOverrides() {
   return Object.fromEntries(
@@ -115306,7 +116027,8 @@ function buildSecurityConfig(ctx, model) {
     // see opencodeShared.ts.
     provider: {
       openrouter: { models: kimiOpenRouterProviderOverrides() },
-      ...openAICompatibleProvider(model)
+      ...openAICompatibleProvider(model),
+      ...azureProvider(model)
     }
   };
   if (model) {
@@ -115474,7 +116196,7 @@ function isModelOutput(ctx, part) {
 }
 async function dispatchEvent(ctx, event) {
   if (event.type === "message.part.updated") {
-    ctx.lastEventAt = performance6.now();
+    ctx.lastEventAt = performance7.now();
     if (isModelOutput(ctx, event.properties.part)) ctx.sawModelOutput = true;
     await onPartUpdated(ctx, event.properties.part);
     return;
@@ -115541,7 +116263,7 @@ async function onToolPart(ctx, part, label, isOrchestrator) {
   if (toolName === "task" && status === "running" && isOrchestrator && !ctx.taskDispatchByCallID.has(toolId)) {
     const input = part.state.input ?? {};
     const dispatched = ctx.labeler.recordTaskDispatch(input);
-    ctx.taskDispatchByCallID.set(toolId, { label: dispatched, startedAt: performance6.now() });
+    ctx.taskDispatchByCallID.set(toolId, { label: dispatched, startedAt: performance7.now() });
     log2.info(
       `\xBB dispatching subagent: ${dispatched}` + (input.subagent_type ? ` (subagent_type=${input.subagent_type})` : "")
     );
@@ -115560,6 +116282,7 @@ function processTerminalToolPart(ctx, part, label, isOrchestrator) {
   const callLine = inputFormatted !== "{}" ? `\xBB ${toolName}(${inputFormatted})` : `\xBB ${toolName}()`;
   log2.info(withLabel(label, callLine));
   if (isOrchestrator) ctx.loggedToolCallIDs.add(toolId);
+  if (isOrchestrator && toolName.startsWith("pullfrog_")) ctx.mcpToolCalls++;
   if (state.status === "completed") {
     log2.debug(withLabel(label, `  output: ${state.output}`));
   } else {
@@ -115571,7 +116294,7 @@ function processTerminalToolPart(ctx, part, label, isOrchestrator) {
   if (toolName === "task") {
     const dispatch = ctx.taskDispatchByCallID.get(toolId);
     if (dispatch) {
-      const dur = ((performance6.now() - dispatch.startedAt) / 1e3).toFixed(1);
+      const dur = ((performance7.now() - dispatch.startedAt) / 1e3).toFixed(1);
       const outputStr = state.status === "completed" ? state.output : "";
       const preview = typeof outputStr === "string" && outputStr.length > 120 ? `${outputStr.slice(0, 120)}\u2026` : outputStr;
       log2.info(
@@ -115614,7 +116337,7 @@ function withLabel(label, message) {
   return label === ORCHESTRATOR_LABEL ? message : formatWithLabel(label, message);
 }
 async function runPromptTurn(ctx, params) {
-  const start = performance6.now();
+  const start = performance7.now();
   const turnStartMs = Date.now();
   ctx.currentTurn = newTurn();
   const turn = ctx.currentTurn;
@@ -115648,7 +116371,7 @@ async function runPromptTurn(ctx, params) {
   } catch (err) {
     networkError = err instanceof Error ? err.message : String(err);
   }
-  const durationMs = performance6.now() - start;
+  const durationMs = performance7.now() - start;
   const aggregatedUsage = await aggregateTurnUsage(ctx, turnStartMs);
   const usage = aggregatedUsage ?? buildUsage(turn, assistant);
   const finalText = turn.finalText || extractTextFromParts(returnedParts) || "";
@@ -115798,21 +116521,28 @@ function formatConfigError(name, data) {
   ).join("");
   return `${name}${detail}${bullets}`;
 }
+var WATCHDOG_SALVAGE_PROMPT = "Your previous turn was cut off mid-response by a provider stall. Nothing you had not already submitted through a tool was saved. Continue from where you stopped and submit your work now \u2014 do not restart your analysis.";
 function startInnerActivityWatchdog(params) {
   let fired = false;
+  let everFired = false;
   const id = setInterval(() => {
     if (fired) return;
-    const idleMs = performance6.now() - params.ctx.lastEventAt;
-    const budgetMs = params.ctx.sawModelOutput ? params.timeoutMs : AGENT_FIRST_EVENT_TIMEOUT_MS;
+    const idleMs = performance7.now() - params.ctx.lastEventAt;
+    const compiledMs = params.ctx.sawModelOutput ? params.timeoutMs : AGENT_FIRST_EVENT_TIMEOUT_MS;
+    const budgetMs = everFired ? compiledMs : watchdogBudgetMs(
+      compiledMs,
+      params.ctx.sawModelOutput ? "PULLFROG_E2E_ACTIVITY_TIMEOUT_MS" : "PULLFROG_E2E_FIRST_EVENT_TIMEOUT_MS"
+    );
     if (idleMs <= budgetMs) return;
     fired = true;
+    everFired = true;
     const idleSec = Math.round(idleMs / 1e3);
     params.ctx.diagnostic.idleSec = idleSec;
     params.ctx.diagnostic.sawModelOutput = params.ctx.sawModelOutput;
     log2.info(
       params.ctx.sawModelOutput ? `\xBB no opencode events for ${idleSec}s \u2014 aborting in-flight prompt and notifying harness` : `\xBB no opencode events for ${idleSec}s \u2014 the provider never returned a first token; aborting in-flight prompt and notifying harness`
     );
-    params.abortController.abort();
+    params.abortTurn();
     try {
       params.ctx.onActivityTimeout?.();
     } catch (err) {
@@ -115822,7 +116552,22 @@ function startInnerActivityWatchdog(params) {
     }
   }, 5e3);
   id.unref?.();
-  return { stop: () => clearInterval(id) };
+  return {
+    stop: () => clearInterval(id),
+    /**
+     * Start a turn's idle budget from now. The clock must be reset with the
+     * latch: `lastEventAt` only advances on model output, so a turn following a
+     * stall would inherit the full stalled interval and be aborted on the very
+     * next 5s tick — killing the salvage before the provider could answer. It
+     * is the right semantics for an ordinary resume too, whose budget should
+     * not be pre-spent by the post-run gate checks that ran between turns.
+     */
+    armForTurn: () => {
+      fired = false;
+      params.ctx.lastEventAt = performance7.now();
+    },
+    firedThisTurn: () => fired
+  };
 }
 var opencode = agent({
   name: "opencode",
@@ -115841,12 +116586,12 @@ var opencode = agent({
     const model = vertexModel ?? (isBedrockRoute ? `amazon-bedrock/${rawModel}` : rawModel);
     const homeEnv = {
       HOME: ctx.tmpdir,
-      XDG_CONFIG_HOME: join7(ctx.tmpdir, ".config")
+      XDG_CONFIG_HOME: join8(ctx.tmpdir, ".config")
     };
-    const opencodePluginDir = join7(homeEnv.XDG_CONFIG_HOME, "opencode", "plugin");
-    mkdirSync6(opencodePluginDir, { recursive: true });
-    writeFileSync6(
-      join7(opencodePluginDir, PULLFROG_OPENCODE_GATE_PLUGIN_FILENAME),
+    const opencodePluginDir = join8(homeEnv.XDG_CONFIG_HOME, "opencode", "plugin");
+    mkdirSync7(opencodePluginDir, { recursive: true });
+    writeFileSync7(
+      join8(opencodePluginDir, PULLFROG_OPENCODE_GATE_PLUGIN_FILENAME),
       buildOpencodeSubagentGateSource(ctx.subagentDeniedTools)
     );
     const agentBrowserVersion = getDevDependencyVersion("agent-browser");
@@ -115877,12 +116622,13 @@ var opencode = agent({
     if (codexAuth) {
       env2.XDG_DATA_HOME = codexAuth.xdgDataHome;
       delete env2.OPENAI_API_KEY;
-      core2.saveState(
+      core3.saveState(
         "codex_writeback",
         JSON.stringify({
           apiToken: ctx.apiToken,
           authPath: codexAuth.authPath,
-          originalRefresh: codexAuth.originalRefresh
+          originalRefresh: codexAuth.originalRefresh,
+          originalIdToken: codexAuth.originalIdToken
         })
       );
     }
@@ -115933,14 +116679,16 @@ var opencode = agent({
         variant: effort.rung,
         todoTracker: ctx.todoTracker,
         onActivityTimeout: ctx.onActivityTimeout,
+        onTurnRecovered: ctx.onTurnRecovered,
         onToolUse: ctx.onToolUse,
         currentTurn: null,
         eventCount: 0,
-        lastEventAt: performance6.now(),
+        lastEventAt: performance7.now(),
         sawModelOutput: false,
         promptMessageID: void 0,
         taskDispatchByCallID: /* @__PURE__ */ new Map(),
         loggedToolCallIDs: /* @__PURE__ */ new Set(),
+        mcpToolCalls: 0,
         recentStderr: server.recentStderr,
         diagnostic: {
           label: "Pullfrog",
@@ -115964,9 +116712,14 @@ var opencode = agent({
           }
         }
       });
-      const abortController = new AbortController();
-      const eventLoopPromise = consumeEvents(runnerCtx, abortController.signal).catch((err) => {
-        if (!abortController.signal.aborted) {
+      const runController = new AbortController();
+      let turnController = new AbortController();
+      const nextTurnSignal = () => {
+        turnController = new AbortController();
+        return AbortSignal.any([runController.signal, turnController.signal]);
+      };
+      const eventLoopPromise = consumeEvents(runnerCtx, runController.signal).catch((err) => {
+        if (!runController.signal.aborted) {
           log2.warning(
             `\xBB opencode event subscription ended: ${err instanceof Error ? err.message : String(err)}`
           );
@@ -115982,31 +116735,48 @@ var opencode = agent({
         // a long synchronous tool call (no part.updated while it runs) can't
         // false-positive it.
         timeoutMs: AGENT_ACTIVITY_TIMEOUT_MS,
-        abortController
+        abortTurn: () => turnController.abort()
       });
       const sdkModel = parseModel2(model);
+      let salvagesLeft = 1;
+      const runTurn = async (text) => {
+        const attempt = (prompt) => {
+          watchdog.armForTurn();
+          return runTurnGuarded(
+            runnerCtx,
+            () => runPromptTurn(runnerCtx, { text: prompt, model: sdkModel, signal: nextTurnSignal() })
+          );
+        };
+        const standDownIfRecovered = (turn) => {
+          if (watchdog.firedThisTurn() && turn.success) ctx.onTurnRecovered?.();
+          return turn;
+        };
+        const result = await attempt(text);
+        if (!watchdog.firedThisTurn()) return result;
+        if (result.success) return standDownIfRecovered(result);
+        if (salvagesLeft <= 0) return result;
+        salvagesLeft--;
+        ctx.onTurnRecovered?.();
+        log2.info("\xBB activity watchdog cut the turn off \u2014 re-prompting once on the same session");
+        const mcpCallsBefore = runnerCtx.mcpToolCalls;
+        const salvaged = await attempt(WATCHDOG_SALVAGE_PROMPT);
+        const usage = mergeAgentUsage(result.usage, salvaged.usage);
+        if (runnerCtx.mcpToolCalls === mcpCallsBefore) {
+          log2.info(
+            "\xBB salvage turn reached no Pullfrog tool \u2014 keeping the activity-timeout failure"
+          );
+          return { ...result, usage };
+        }
+        return standDownIfRecovered({ ...salvaged, usage });
+      };
       try {
-        const initial = await runTurnGuarded(
-          runnerCtx,
-          () => runPromptTurn(runnerCtx, {
-            text: ctx.instructions.full,
-            model: sdkModel,
-            signal: abortController.signal
-          })
-        );
+        const initial = await runTurn(ctx.instructions.full);
         const result = await runPostRunRetryLoop({
           ctx,
           initialResult: initial,
           initialUsage: initial.usage,
           reflectionPrompt: buildReflectionPrompt(ctx.toolState),
-          resume: async (c2) => runTurnGuarded(
-            runnerCtx,
-            () => runPromptTurn(runnerCtx, {
-              text: c2.prompt,
-              model: sdkModel,
-              signal: abortController.signal
-            })
-          )
+          resume: async (c2) => runTurn(c2.prompt)
         });
         if (result.success) {
           await ctx.todoTracker?.flush();
@@ -116016,7 +116786,7 @@ var opencode = agent({
         return result;
       } finally {
         watchdog.stop();
-        abortController.abort();
+        runController.abort();
         await eventLoopPromise.catch(() => {
         });
       }
@@ -116046,7 +116816,7 @@ async function runTurnGuarded(ctx, fn2) {
 }
 
 // agents/index.ts
-var agents = { claude, opencode };
+var agents = { claude, codex, opencode };
 
 // node_modules/.pnpm/@ark+util@0.56.0/node_modules/@ark/util/out/arrays.js
 var liftArray = (data) => Array.isArray(data) ? data : [data];
@@ -136378,7 +137148,7 @@ var require_core$2 = /* @__PURE__ */ __commonJSMin(((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   const id_1 = require_id2();
   const ref_1 = require_ref2();
-  const core11 = [
+  const core12 = [
     "$schema",
     "$id",
     "$defs",
@@ -136388,7 +137158,7 @@ var require_core$2 = /* @__PURE__ */ __commonJSMin(((exports) => {
     id_1.default,
     ref_1.default
   ];
-  exports.default = core11;
+  exports.default = core12;
 }));
 var require_limitNumber2 = /* @__PURE__ */ __commonJSMin(((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
@@ -138526,7 +139296,7 @@ var require_json_schema_2019_09 = /* @__PURE__ */ __commonJSMin(((exports) => {
   const metaSchema = require_schema$1();
   const applicator = require_applicator$1();
   const content = require_content$1();
-  const core11 = require_core$1();
+  const core12 = require_core$1();
   const format2 = require_format3();
   const metadata = require_meta_data$1();
   const validation = require_validation$1();
@@ -138536,7 +139306,7 @@ var require_json_schema_2019_09 = /* @__PURE__ */ __commonJSMin(((exports) => {
       metaSchema,
       applicator,
       content,
-      core11,
+      core12,
       with$data(this, format2),
       metadata,
       with$data(this, validation)
@@ -138976,7 +139746,7 @@ var require_json_schema_2020_12 = /* @__PURE__ */ __commonJSMin(((exports) => {
   const applicator = require_applicator2();
   const unevaluated = require_unevaluated();
   const content = require_content();
-  const core11 = require_core4();
+  const core12 = require_core4();
   const format2 = require_format_annotation();
   const metadata = require_meta_data();
   const validation = require_validation2();
@@ -138987,7 +139757,7 @@ var require_json_schema_2020_12 = /* @__PURE__ */ __commonJSMin(((exports) => {
       applicator,
       unevaluated,
       content,
-      core11,
+      core12,
       with$data(this, format2),
       metadata,
       with$data(this, validation)
@@ -150429,7 +151199,7 @@ var require_core$22 = /* @__PURE__ */ __commonJSMin2(((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   const id_1 = require_id3();
   const ref_1 = require_ref3();
-  const core11 = [
+  const core12 = [
     "$schema",
     "$id",
     "$defs",
@@ -150439,7 +151209,7 @@ var require_core$22 = /* @__PURE__ */ __commonJSMin2(((exports) => {
     id_1.default,
     ref_1.default
   ];
-  exports.default = core11;
+  exports.default = core12;
 }));
 var require_limitNumber3 = /* @__PURE__ */ __commonJSMin2(((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
@@ -152577,7 +153347,7 @@ var require_json_schema_2019_092 = /* @__PURE__ */ __commonJSMin2(((exports) =>
   const metaSchema = require_schema$12();
   const applicator = require_applicator$12();
   const content = require_content$12();
-  const core11 = require_core$12();
+  const core12 = require_core$12();
   const format2 = require_format4();
   const metadata = require_meta_data$12();
   const validation = require_validation$12();
@@ -152587,7 +153357,7 @@ var require_json_schema_2019_092 = /* @__PURE__ */ __commonJSMin2(((exports) =>
       metaSchema,
       applicator,
       content,
-      core11,
+      core12,
       with$data(this, format2),
       metadata,
       with$data(this, validation)
@@ -153027,7 +153797,7 @@ var require_json_schema_2020_122 = /* @__PURE__ */ __commonJSMin2(((exports) =>
   const applicator = require_applicator3();
   const unevaluated = require_unevaluated2();
   const content = require_content2();
-  const core11 = require_core5();
+  const core12 = require_core5();
   const format2 = require_format_annotation2();
   const metadata = require_meta_data2();
   const validation = require_validation3();
@@ -153038,7 +153808,7 @@ var require_json_schema_2020_122 = /* @__PURE__ */ __commonJSMin2(((exports) =>
       applicator,
       unevaluated,
       content,
-      core11,
+      core12,
       with$data(this, format2),
       metadata,
       with$data(this, validation)
@@ -172999,123 +173769,8 @@ var pbkdf2Async = promisify(pbkdf2);
 
 // utils/browser.ts
 import { execFileSync as execFileSync5, spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync4 } from "node:fs";
+import { existsSync as existsSync5 } from "node:fs";
 import { dirname as dirname2 } from "node:path";
-
-// utils/secrets.ts
-var SENSITIVE_PATTERNS = [
-  /_KEY$/i,
-  /_SECRET$/i,
-  /_TOKEN$/i,
-  /_PASSWORD$/i,
-  /_CREDENTIAL$/i
-];
-function isSensitiveEnvName(key) {
-  return SENSITIVE_PATTERNS.some((p) => p.test(key));
-}
-var SAFE_ENV_PREFIXES = ["GITHUB_", "RUNNER_", "JAVA_HOME_", "GOROOT_"];
-var SAFE_ENV_NAMES = /* @__PURE__ */ new Set([
-  // system
-  "CI",
-  "HOME",
-  "LANG",
-  "LOGNAME",
-  "PATH",
-  "SHELL",
-  "SHLVL",
-  "TERM",
-  "TMPDIR",
-  "TZ",
-  "USER",
-  "XDG_CONFIG_HOME",
-  "XDG_RUNTIME_DIR",
-  "DEBIAN_FRONTEND",
-  // runner image toolchain
-  "ACCEPT_EULA",
-  "AGENT_TOOLSDIRECTORY",
-  "ANDROID_HOME",
-  "ANDROID_NDK",
-  "ANDROID_NDK_HOME",
-  "ANDROID_NDK_LATEST_HOME",
-  "ANDROID_NDK_ROOT",
-  "ANDROID_SDK_ROOT",
-  "ANT_HOME",
-  "AZURE_EXTENSION_DIR",
-  "BOOTSTRAP_HASKELL_NONINTERACTIVE",
-  "CHROME_BIN",
-  "CHROMEWEBDRIVER",
-  "CONDA",
-  "DOTNET_MULTILEVEL_LOOKUP",
-  "DOTNET_NOLOGO",
-  "DOTNET_SKIP_FIRST_TIME_EXPERIENCE",
-  "EDGEWEBDRIVER",
-  "GECKOWEBDRIVER",
-  "GHCUP_INSTALL_BASE_PREFIX",
-  "GRADLE_HOME",
-  "JAVA_HOME",
-  "HOMEBREW_CLEANUP_PERIODIC_FULL_DAYS",
-  "HOMEBREW_NO_AUTO_UPDATE",
-  "ImageOS",
-  "ImageVersion",
-  "NVM_DIR",
-  "PIPX_BIN_DIR",
-  "PIPX_HOME",
-  "PSModulePath",
-  "SELENIUM_JAR_PATH",
-  "SGX_AESM_ADDR",
-  "SWIFT_PATH",
-  "VCPKG_INSTALLATION_ROOT"
-]);
-var _userAllowlist = null;
-function setEnvAllowlist(raw2) {
-  const names = raw2.split("\n").map((line) => line.trim()).filter(Boolean);
-  _userAllowlist = new Set(names);
-}
-function isSafeEnvVar(key) {
-  if (SAFE_ENV_NAMES.has(key)) return true;
-  return SAFE_ENV_PREFIXES.some((p) => key.startsWith(p));
-}
-var WORKFLOW_COMMAND_ENV_NAMES = [
-  "GITHUB_ENV",
-  "GITHUB_PATH",
-  "GITHUB_OUTPUT",
-  "GITHUB_STATE",
-  "GITHUB_STEP_SUMMARY",
-  // dropping the five paths above but keeping RUNNER_TEMP would be theatre:
-  // the file-command files live in `$RUNNER_TEMP/_runner_file_commands/`, so the
-  // directory is one `ls` away. nothing in the install path reads it (only our
-  // own leak-surface wipe in `setup.ts`, which runs in the parent), and package
-  // managers use TMPDIR.
-  "RUNNER_TEMP"
-];
-function filterEnvForUntrustedCode() {
-  const env2 = filterEnv();
-  for (const name of WORKFLOW_COMMAND_ENV_NAMES) delete env2[name];
-  return env2;
-}
-function filterEnv() {
-  const filtered = {};
-  for (const [key, value2] of Object.entries(process.env)) {
-    if (value2 === void 0) continue;
-    const userAllowed = _userAllowlist?.has(key) ?? false;
-    if (isSensitiveEnvName(key) && !userAllowed) continue;
-    if (isSafeEnvVar(key) || userAllowed) {
-      filtered[key] = value2;
-    }
-  }
-  return filtered;
-}
-function resolveEnv(mode) {
-  if (mode === "inherit") {
-    return process.env;
-  }
-  if (mode === "restricted" || mode === void 0) {
-    return filterEnv();
-  }
-  return { ...filterEnv(), ...mode };
-}
-
-// utils/browser.ts
 var CHROME_PATHS = ["/usr/bin/google-chrome-stable"];
 var systemChromePath;
 function findSystemChromePath() {
@@ -173123,7 +173778,7 @@ function findSystemChromePath() {
     return systemChromePath || void 0;
   }
   for (const p of CHROME_PATHS) {
-    if (existsSync4(p)) {
+    if (existsSync5(p)) {
       systemChromePath = p;
       log2.info(`found system chrome: ${p}`);
       return p;
@@ -173207,8 +173862,8 @@ function closeBrowserDaemon(toolState) {
 
 // mcp/checkout.ts
 import { createHash as createHash2 } from "node:crypto";
-import { statSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join14 } from "node:path";
+import { statSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join15 } from "node:path";
 
 // node_modules/.pnpm/@ark+schema@0.56.0/node_modules/@ark/schema/out/shared/errors.js
 var ArkError = class _ArkError extends CastableBase {
@@ -180680,8 +181335,8 @@ function ensureRepoState(toolState, init) {
 
 // utils/changeImpact.ts
 import { spawn as spawn4 } from "node:child_process";
-import { writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join8 } from "node:path";
+import { writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join9 } from "node:path";
 var MAX_CANDIDATES = 24;
 var MAX_ATOM_LENGTH = 128;
 var MAX_ATOMS = 12;
@@ -181028,8 +181683,8 @@ async function createChangeImpactArtifact(ctx, params) {
     headSha: params.headSha,
     lookupError: lookup2.error
   });
-  const path4 = join8(ctx.tmpdir, `pr-${params.pullNumber}-${params.headSha.slice(0, 7)}-impact.md`);
-  writeFileSync7(path4, artifact.content);
+  const path4 = join9(ctx.tmpdir, `pr-${params.pullNumber}-${params.headSha.slice(0, 7)}-impact.md`);
+  writeFileSync8(path4, artifact.content);
   return {
     path: path4,
     candidateCount: candidates.selected.length,
@@ -181281,8 +181936,8 @@ function readNumber(params) {
 // utils/gitAuth.ts
 import { execSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { readFileSync as readFileSync3, realpathSync, unlinkSync } from "node:fs";
-import { join as join9 } from "node:path";
+import { readFileSync as readFileSync4, realpathSync, unlinkSync } from "node:fs";
+import { join as join10 } from "node:path";
 
 // utils/shell.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
@@ -181343,7 +181998,7 @@ var TRANSIENT_AUTH_PATTERNS = [
 ];
 var gitBinary;
 function hashFile(path4) {
-  return createHash("sha256").update(readFileSync3(path4)).digest("hex");
+  return createHash("sha256").update(readFileSync4(path4)).digest("hex");
 }
 function resolveGit() {
   const whichPath = execSync("which git", { encoding: "utf-8" }).trim();
@@ -181372,7 +182027,7 @@ function resolveHooksDir(cwd, gitPath) {
     cwd,
     log: false
   }).trim();
-  const hooksDir = join9(commonDir, "hooks");
+  const hooksDir = join10(commonDir, "hooks");
   hooksDirCache.set(cwd, hooksDir);
   return hooksDir;
 }
@@ -181679,7 +182334,7 @@ function postProcessRangeDiff(raw2, contextLines = 3) {
 }
 
 // yes/index.ts
-import { performance as performance7 } from "node:perf_hooks";
+import { performance as performance8 } from "node:perf_hooks";
 import { setTimeout as sleep2 } from "node:timers/promises";
 
 // node_modules/.pnpm/lru-cache@11.5.2/node_modules/lru-cache/dist/esm/node/index.min.js
@@ -182394,14 +183049,14 @@ function _op(fn2, options) {
         `failed to create cache key${namePrefix ? ` for ${options.name}` : ""}: ${errorMessage}`
       );
     }
-    const startTime = performance7.now();
+    const startTime = performance8.now();
     const timestamp = (/* @__PURE__ */ new Date()).toISOString();
     log3.debug(`${namePrefix}[${timestamp}] cache lookup started`, { key });
     if (shouldCache && lruCache) {
       const cached4 = lruCache.get(key);
       if (cached4 !== void 0) {
         if (keyMap?.get(key) === void 0) keyMap?.set(key, input);
-        const runtime = performance7.now() - startTime;
+        const runtime = performance8.now() - startTime;
         log3.debug(`${namePrefix}[${timestamp}] cache hit (from lru)`, {
           key,
           runtime: `${Math.round(runtime)}ms`
@@ -182420,12 +183075,12 @@ function _op(fn2, options) {
     defaultCacheMiss(key);
     const retries = options.retries ?? [];
     let lastError;
-    const execStartTime = performance7.now();
+    const execStartTime = performance8.now();
     const promise2 = (async () => {
       for (let attempt = 0; attempt <= retries.length; attempt++) {
         try {
           const result = acceptsCtx ? await fn2(input, ctx) : await fn2(input);
-          const execRuntime2 = performance7.now() - execStartTime;
+          const execRuntime2 = performance8.now() - execStartTime;
           const skip = options.skipCache ? options.skipCache(result) : false;
           if (shouldCache && lruCache && result !== null && result !== void 0 && !skip) {
             lruCache.set(key, result);
@@ -182478,7 +183133,7 @@ function _op(fn2, options) {
           }
         }
       }
-      const execRuntime = performance7.now() - execStartTime;
+      const execRuntime = performance8.now() - execStartTime;
       log3.debug(`${namePrefix}[${timestamp}] function failed after all retries`, {
         key,
         runtime: `${Math.round(execRuntime)}ms`,
@@ -182543,13 +183198,13 @@ function _op(fn2, options) {
 
 // mcp/git.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { writeFileSync as writeFileSync8 } from "node:fs";
-import { join as join12 } from "node:path";
+import { writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join13 } from "node:path";
 
 // utils/apiCommit.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { lstat, readlink } from "node:fs/promises";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 var GITHUB_API = "https://api.github.com";
 var MAX_BLOB_BYTES = 30 * 1024 * 1024;
 var BLOB_UPLOAD_CONCURRENCY = 8;
@@ -182614,7 +183269,7 @@ async function assertApiCommittable(files) {
   const root = getRepoRoot();
   const attrs = $(
     "git",
-    ["check-attr", "filter", "-z", "--", ...present.map((p) => join10(root, p))],
+    ["check-attr", "filter", "-z", "--", ...present.map((p) => join11(root, p))],
     { log: false }
   );
   const parts = attrs.split("\0");
@@ -182626,7 +183281,7 @@ async function assertApiCommittable(files) {
     }
   }
   for (const path4 of present) {
-    const stat = await lstat(join10(root, path4));
+    const stat = await lstat(join11(root, path4));
     if (stat.isDirectory()) {
       throw new Error(
         `'${path4}' is a directory (nested repository or submodule?) \u2014 signed commits only support files and symlinks.`
@@ -182635,7 +183290,7 @@ async function assertApiCommittable(files) {
   }
 }
 async function createBlobEntry(params) {
-  const absPath = join10(params.repoRoot, params.path);
+  const absPath = join11(params.repoRoot, params.path);
   const stat = await lstat(absPath);
   if (stat.size > MAX_BLOB_BYTES) {
     throw new Error(
@@ -182812,10 +183467,10 @@ this usually means your local branch has commits that were never pushed \u2014 s
 }
 
 // utils/github.ts
-var core3 = __toESM(require_core(), 1);
+var core4 = __toESM(require_core(), 1);
 import { createSign } from "node:crypto";
 import { rename, writeFile } from "node:fs/promises";
-import { dirname as dirname3, join as join11 } from "node:path";
+import { dirname as dirname3, join as join12 } from "node:path";
 
 // node_modules/.pnpm/@octokit+plugin-throttling@11.0.5_@octokit+core@7.0.7/node_modules/@octokit/plugin-throttling/dist-bundle/index.js
 var import_light = __toESM(require_light(), 1);
@@ -187013,7 +187668,7 @@ async function fetchIdTokenFromStash(creds) {
     throw new Error("ID token response has no value field");
   }
   if (isGitHubActions) {
-    core3.setSecret(body.value);
+    core4.setSecret(body.value);
   }
   return body.value;
 }
@@ -187026,7 +187681,7 @@ function translateIdTokenError(error52) {
 var mintIdToken = op(
   async () => {
     try {
-      return await core3.getIDToken(OIDC_AUDIENCE);
+      return await core4.getIDToken(OIDC_AUDIENCE);
     } catch (error52) {
       throw translateIdTokenError(error52);
     }
@@ -187235,7 +187890,7 @@ function getGitHubUsageSummary() {
 }
 async function writeGitHubUsageSummaryToFile(path4) {
   const summary2 = getGitHubUsageSummary();
-  const tmpPath = join11(dirname3(path4), `.usage-summary-${process.pid}.tmp`);
+  const tmpPath = join12(dirname3(path4), `.usage-summary-${process.pid}.tmp`);
   await writeFile(tmpPath, JSON.stringify(summary2));
   await rename(tmpPath, path4);
 }
@@ -188387,8 +189042,8 @@ function countAhead(head, base, cwd) {
 function spillGitOutput(params) {
   const tempDir = process.env.PULLFROG_TEMP_DIR;
   if (!tempDir) throw new Error("PULLFROG_TEMP_DIR not set");
-  const outputPath = join12(tempDir, `git-${params.command}-${randomUUID3().slice(0, 8)}.txt`);
-  writeFileSync8(outputPath, params.output);
+  const outputPath = join13(tempDir, `git-${params.command}-${randomUUID3().slice(0, 8)}.txt`);
+  writeFileSync9(outputPath, params.output);
   const previewByLines = params.output.split("\n").slice(0, OVERFLOW_PREVIEW_LINES).join("\n");
   const preview = previewByLines.length <= OVERFLOW_PREVIEW_MAX_CHARS ? previewByLines : `${previewByLines.slice(0, OVERFLOW_PREVIEW_MAX_CHARS)}\u2026`;
   log2.info(
@@ -189902,9 +190557,9 @@ async function reportReviewNodeId(ctx, params) {
 import { execFileSync as execFileSync7, execSync as execSync2 } from "node:child_process";
 import { mkdtempSync as mkdtempSync2, readdirSync, realpathSync as realpathSync2, unlinkSync as unlinkSync2 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 function createTempDirectory() {
-  const sharedTempDir = mkdtempSync2(join13(tmpdir3(), "pullfrog-"));
+  const sharedTempDir = mkdtempSync2(join14(tmpdir3(), "pullfrog-"));
   process.env.PULLFROG_TEMP_DIR = sharedTempDir;
   log2.info(`\xBB created temp dir at ${sharedTempDir}`);
   return sharedTempDir;
@@ -189949,13 +190604,13 @@ function wipeRunnerLeakSurface() {
       return [];
     }
   };
-  const fileCommandsDir = join13(runnerTemp, "_runner_file_commands");
+  const fileCommandsDir = join14(runnerTemp, "_runner_file_commands");
   for (const entry of listDir(fileCommandsDir)) {
-    tryUnlink(join13(fileCommandsDir, entry));
+    tryUnlink(join14(fileCommandsDir, entry));
   }
   for (const entry of listDir(runnerTemp)) {
     if (entry.endsWith(".sh") || /^git-credentials-.*\.config$/.test(entry)) {
-      tryUnlink(join13(runnerTemp, entry));
+      tryUnlink(join14(runnerTemp, entry));
     }
   }
   if (wiped.length > 0) {
@@ -190505,11 +191160,11 @@ function CheckoutPrTool(ctx) {
         headSha: checkoutSha
       });
       if (incremental.status === "ok") {
-        incrementalDiffPath = join14(
+        incrementalDiffPath = join15(
           tempDir,
           `pr-${pull_number}-${beforeShort}-${headShort}-incremental.diff`
         );
-        writeFileSync9(incrementalDiffPath, incremental.diff);
+        writeFileSync10(incrementalDiffPath, incremental.diff);
         log2.info(
           `\xBB incremental diff computed (${incremental.diff.length} bytes) \u2192 ${incrementalDiffPath}`
         );
@@ -190522,8 +191177,8 @@ function CheckoutPrTool(ctx) {
     const diffPreview = formatResult.content.split("\n").slice(0, 100).join("\n");
     log2.debug(`formatted diff preview (first 100 lines):
 ${diffPreview}`);
-    const diffPath = join14(tempDir, `pr-${pull_number}-${headShort}.diff`);
-    writeFileSync9(diffPath, formatResult.content);
+    const diffPath = join15(tempDir, `pr-${pull_number}-${headShort}.diff`);
+    writeFileSync10(diffPath, formatResult.content);
     log2.debug(`wrote diff to ${diffPath} (${formatResult.content.length} bytes)`);
     primary.diffCoverage = createDiffCoverageState({
       diffPath,
@@ -190680,8 +191335,8 @@ ${dirty}`
 }
 
 // mcp/checkSuite.ts
-import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join15 } from "node:path";
+import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join16 } from "node:path";
 var GetCheckSuiteLogs = type({
   check_suite_id: type.number.describe("the id from check_suite.id")
 });
@@ -190777,8 +191432,8 @@ function GetCheckSuiteLogsTool(ctx) {
       if (!tempDir) {
         throw new Error("PULLFROG_TEMP_DIR not set");
       }
-      const logsDir = join15(tempDir, "ci-logs");
-      mkdirSync7(logsDir, { recursive: true });
+      const logsDir = join16(tempDir, "ci-logs");
+      mkdirSync8(logsDir, { recursive: true });
       const jobResults = [];
       for (const run4 of failedRuns) {
         const jobs = await ctx.octokit.paginate(ctx.octokit.rest.actions.listJobsForWorkflowRun, {
@@ -190804,8 +191459,8 @@ function GetCheckSuiteLogsTool(ctx) {
               );
             }
             const logsText = await logsResult.text();
-            const logPath = join15(logsDir, `job-${job.id}.log`);
-            writeFileSync10(logPath, logsText);
+            const logPath = join16(logsDir, `job-${job.id}.log`);
+            writeFileSync11(logPath, logsText);
             const analysis = analyzeLog(logsText, 80);
             const failedSteps = job.steps?.filter((s) => s.conclusion === "failure").map((s) => `Step ${s.number}: ${s.name}`) ?? [];
             jobResults.push({
@@ -190853,8 +191508,8 @@ function GetCheckSuiteLogsTool(ctx) {
 }
 
 // mcp/commitInfo.ts
-import { writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join16 } from "node:path";
+import { writeFileSync as writeFileSync12 } from "node:fs";
+import { join as join17 } from "node:path";
 var CommitInfo = type({
   sha: type.string.describe("the commit SHA (full or abbreviated) to fetch")
 });
@@ -190878,8 +191533,8 @@ function CommitInfoTool(ctx) {
           "PULLFROG_TEMP_DIR not set - get_commit_info must run in pullfrog action context"
         );
       }
-      const diffFile = join16(tempDir, `commit-${sha.slice(0, 7)}.diff`);
-      writeFileSync11(diffFile, formatResult.content);
+      const diffFile = join17(tempDir, `commit-${sha.slice(0, 7)}.diff`);
+      writeFileSync12(diffFile, formatResult.content);
       log2.debug(`wrote commit diff to ${diffFile} (${formatResult.content.length} bytes)`);
       return {
         sha: data.sha,
@@ -191012,17 +191667,17 @@ function ReopenCurrentTool(ctx) {
 }
 
 // prep/index.ts
-import { performance as performance8 } from "node:perf_hooks";
+import { performance as performance9 } from "node:perf_hooks";
 
 // prep/installNodeDependencies.ts
-import { existsSync as existsSync6 } from "node:fs";
-import { join as join18 } from "node:path";
+import { existsSync as existsSync7 } from "node:fs";
+import { join as join19 } from "node:path";
 
 // utils/packageManager.ts
 var import_semver2 = __toESM(require_semver2(), 1);
-import { existsSync as existsSync5 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 import { mkdir, readFile as readFile2 } from "node:fs/promises";
-import { delimiter, join as join17 } from "node:path";
+import { delimiter, join as join18 } from "node:path";
 var SUPPORTED_NAMES = ["npm", "pnpm", "yarn", "bun"];
 var COREPACK_MANAGED = ["pnpm", "yarn"];
 function isSupported(name) {
@@ -191060,8 +191715,8 @@ function parseDevEnginesField(field) {
   };
 }
 async function resolvePackageManagerSpec(cwd) {
-  const pkgPath = join17(cwd, "package.json");
-  if (!existsSync5(pkgPath)) return null;
+  const pkgPath = join18(cwd, "package.json");
+  if (!existsSync6(pkgPath)) return null;
   let pkg;
   try {
     pkg = JSON.parse(await readFile2(pkgPath, "utf-8"));
@@ -191119,7 +191774,7 @@ async function currentVersion(name) {
   return result.stdout.trim();
 }
 function packageManagerBinDir(tmpdir4) {
-  return join17(tmpdir4, "pm-bin");
+  return join18(tmpdir4, "pm-bin");
 }
 async function ensurePackageManager(params) {
   const spec = params.spec;
@@ -191182,7 +191837,7 @@ async function installFallback(name, installSpec) {
   });
   if (result.exitCode !== 0) return result.stderr || `failed to install ${name}`;
   if (name === "deno") {
-    const denoPath = join17(process.env.HOME || "", ".deno", "bin");
+    const denoPath = join18(process.env.HOME || "", ".deno", "bin");
     process.env.PATH = `${denoPath}:${process.env.PATH}`;
   }
   log2.info(`\xBB installed ${name}`);
@@ -191215,8 +191870,8 @@ async function isCommandAvailable2(command) {
 var installNodeDependencies = {
   name: "installNodeDependencies",
   shouldRun: () => {
-    const packageJsonPath = join18(process.cwd(), "package.json");
-    return existsSync6(packageJsonPath);
+    const packageJsonPath = join19(process.cwd(), "package.json");
+    return existsSync7(packageJsonPath);
   },
   run: async (options) => {
     const declared = await resolvePackageManagerSpec(process.cwd());
@@ -191310,14 +191965,14 @@ ${errorMessage}`]
 };
 
 // prep/installPythonDependencies.ts
-import { existsSync as existsSync7, readFileSync as readFileSync4 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync5 } from "node:fs";
+import { join as join20 } from "node:path";
 function declaresBuildSystem(path4) {
-  return /^\s*\[\s*build-system\s*\]/m.test(readFileSync4(path4, "utf8"));
+  return /^\s*\[\s*build-system\s*\]/m.test(readFileSync5(path4, "utf8"));
 }
 function configApplies(config3, cwd) {
-  const path4 = join19(cwd, config3.file);
-  return existsSync7(path4) && (config3.applies?.(path4) ?? true);
+  const path4 = join20(cwd, config3.file);
+  return existsSync8(path4) && (config3.applies?.(path4) ?? true);
 }
 var PYTHON_CONFIGS = [
   {
@@ -191471,7 +192126,7 @@ var installPythonDependencies = {
 var prepSteps = [installNodeDependencies, installPythonDependencies];
 async function runPrepPhase(options) {
   log2.debug("\xBB starting prep phase...");
-  const startTime = performance8.now();
+  const startTime = performance9.now();
   const results = [];
   const preDirty = await dirtyTrackedPaths();
   try {
@@ -191493,7 +192148,7 @@ async function runPrepPhase(options) {
   } finally {
     await restoreDirtiedSince({ before: preDirty, actor: "prep" });
   }
-  const totalDurationMs = performance8.now() - startTime;
+  const totalDurationMs = performance9.now() - startTime;
   log2.debug(`\xBB prep phase completed (${Math.round(totalDurationMs)}ms)`);
   return results;
 }
@@ -191638,15 +192293,15 @@ function AwaitDependencyInstallationTool(ctx) {
 }
 
 // mcp/gh.ts
-import { mkdirSync as mkdirSync8 } from "node:fs";
-import { join as join21 } from "node:path";
+import { mkdirSync as mkdirSync9 } from "node:fs";
+import { join as join22 } from "node:path";
 
 // mcp/shell.ts
 import { spawn as spawn5, spawnSync as spawnSync6 } from "node:child_process";
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { closeSync, openSync, writeFileSync as writeFileSync12 } from "node:fs";
+import { closeSync, openSync, writeFileSync as writeFileSync13 } from "node:fs";
 import { userInfo as userInfo2 } from "node:os";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 import { setTimeout as sleep3 } from "node:timers/promises";
 var ShellParams = type({
   command: "string",
@@ -191909,8 +192564,8 @@ ${spawnError}` : spawnError;
 }
 function capOutput(output) {
   if (output.length <= MAX_OUTPUT_CHARS) return output;
-  const fullPath = join20(getTempDir(), `shell-${randomUUID4().slice(0, 8)}.log`);
-  writeFileSync12(fullPath, output);
+  const fullPath = join21(getTempDir(), `shell-${randomUUID4().slice(0, 8)}.log`);
+  writeFileSync13(fullPath, output);
   const elided = output.length - MAX_OUTPUT_CHARS;
   return `... [${elided} chars truncated; full output saved to ${fullPath}] ...
 ${output.slice(-MAX_OUTPUT_CHARS)}`;
@@ -191964,8 +192619,8 @@ Do NOT use this tool for git commands \u2014 use the dedicated git tools instead
       if (params.background) {
         const tempDir = getTempDir();
         const handle = `bg-${randomUUID4().slice(0, 8)}`;
-        const outputPath = join20(tempDir, `${handle}.log`);
-        const pidPath = join20(tempDir, `${handle}.pid`);
+        const outputPath = join21(tempDir, `${handle}.log`);
+        const pidPath = join21(tempDir, `${handle}.pid`);
         const logFd = openSync(outputPath, "a");
         let proc;
         try {
@@ -191982,7 +192637,7 @@ Do NOT use this tool for git commands \u2014 use the dedicated git tools instead
           throw new Error("failed to start background process");
         }
         proc.unref();
-        writeFileSync12(pidPath, `${proc.pid}
+        writeFileSync13(pidPath, `${proc.pid}
 `);
         ctx.toolState.backgroundProcesses.set(handle, { pid: proc.pid, outputPath, pidPath });
         return {
@@ -192062,8 +192717,8 @@ function GhTool(ctx) {
     description: `Run the GitHub CLI against ${ctx.repo.owner}/${ctx.repo.name}. Pass argv as an array \u2014 there is no shell, so pipes, redirects and \`&&\` do not work; use gh's own \`--json\`/\`--jq\` flags instead. \`gh api graphql\` is available. Authenticated with ${permissions ? formatPermissions(permissions) : "no permissions"} on this repo only; anything else 403s. Pushing, merging and ref writes are not available \u2014 use the git tools.`,
     parameters: GhParams,
     execute: execute(async (params) => {
-      const configDir = join21(ctx.tmpdir, "gh-config");
-      mkdirSync8(configDir, { recursive: true });
+      const configDir = join22(ctx.tmpdir, "gh-config");
+      mkdirSync9(configDir, { recursive: true });
       const command = ["gh", ...params.args.map(shellQuote)].join(" ");
       const result = await runSandboxed({
         command,
@@ -192786,8 +193441,8 @@ function PullRequestInfoTool(ctx) {
 }
 
 // mcp/reviewComments.ts
-import { writeFileSync as writeFileSync13 } from "node:fs";
-import { join as join22 } from "node:path";
+import { writeFileSync as writeFileSync14 } from "node:fs";
+import { join as join23 } from "node:path";
 var COMMENTS_PER_THREAD = 50;
 var REVIEW_THREADS_QUERY = `
 query ($owner: String!, $name: String!, $prNumber: Int!, $cursor: String) {
@@ -193260,8 +193915,8 @@ function GetReviewCommentsTool(ctx) {
         throw new Error("PULLFROG_TEMP_DIR not set");
       }
       const filename = `review-${params.review_id}-threads.md`;
-      const commentsPath = join22(tempDir, filename);
-      writeFileSync13(commentsPath, formatted.content);
+      const commentsPath = join23(tempDir, filename);
+      writeFileSync14(commentsPath, formatted.content);
       log2.debug(`wrote ${threadBlocks.length} threads to ${commentsPath}`);
       return {
         review_id: params.review_id,
@@ -193594,8 +194249,8 @@ function UploadFileTool(ctx) {
 }
 
 // mcp/xrepo.ts
-import { mkdirSync as mkdirSync9, rmSync as rmSync3 } from "node:fs";
-import { join as join23 } from "node:path";
+import { mkdirSync as mkdirSync10, rmSync as rmSync3 } from "node:fs";
+import { join as join24 } from "node:path";
 function assertValidRepoName(name) {
   if (!/^[A-Za-z0-9._-]+$/.test(name) || name.startsWith("-") || name.includes("..")) {
     throw new Error(
@@ -193675,8 +194330,8 @@ function CheckoutRepoTool(ctx) {
         return { path: existing.dir, access: existing.access, note: "already checked out." };
       }
       const access = accessFor(ctx, repo);
-      const dir = join23(ctx.tmpdir, "xrepo", repo);
-      mkdirSync9(dir, { recursive: true });
+      const dir = join24(ctx.tmpdir, "xrepo", repo);
+      mkdirSync10(dir, { recursive: true });
       const state = ensureRepoState(ctx.toolState, { owner, name: repo, dir, access });
       const rc = resolveRepoCtx(ctx, repo);
       try {
@@ -193922,7 +194577,10 @@ function hasEnvVar2(name) {
   return typeof val === "string" && val.length > 0;
 }
 function hasClaudeCodeAuth() {
-  return hasEnvVar2("CLAUDE_CODE_OAUTH_TOKEN") || hasEnvVar2("ANTHROPIC_API_KEY");
+  return hasEnvVar2("CLAUDE_CODE_OAUTH_TOKEN") || hasEnvVar2("ANTHROPIC_API_KEY") || hasEnvVar2("ANTHROPIC_AUTH_TOKEN");
+}
+function hasCodexAuth() {
+  return hasEnvVar2("CODEX_AUTH_JSON") || hasEnvVar2("OPENAI_API_KEY");
 }
 function hasBedrockAuth() {
   return hasEnvVar2("AWS_BEARER_TOKEN_BEDROCK") || hasEnvVar2("AWS_ACCESS_KEY_ID") && hasEnvVar2("AWS_SECRET_ACCESS_KEY");
@@ -193950,6 +194608,15 @@ function resolveSlug(slug2) {
     }
     return vertexId;
   }
+  if (alias?.routing === "azure") {
+    const deployment = process.env[AZURE_DEPLOYMENT_ENV]?.trim();
+    if (!deployment) {
+      throw new Error(
+        `${AZURE_DEPLOYMENT_ENV} env var is required when the model is set to "${slug2}". set it to the name of your Azure OpenAI deployment (not the model it serves \u2014 Azure routes on the deployment name). see https://docs.pullfrog.com/azure for setup.`
+      );
+    }
+    return `${AZURE_PROVIDER}/${deployment}`;
+  }
   if (alias?.routing === "openai-compatible") {
     const modelId = process.env[OPENAI_COMPATIBLE_MODEL_ENV]?.trim();
     if (!modelId) {
@@ -193988,6 +194655,7 @@ function resolveAgent(ctx) {
     }
     log2.warning(`\xBB unknown PULLFROG_AGENT="${envAgent}" \u2014 falling through to auto-select`);
   }
+  if (ctx.proxyModel) return agents.opencode;
   if (ctx.model && hasBedrockAuth() && process.env[BEDROCK_MODEL_ID_ENV]?.trim() === ctx.model) {
     return isBedrockAnthropicId(ctx.model) ? agents.claude : agents.opencode;
   }
@@ -193997,12 +194665,17 @@ function resolveAgent(ctx) {
   if (ctx.model) {
     try {
       const provider2 = getModelProvider(ctx.model);
-      if (provider2 === "anthropic" && hasClaudeCodeAuth()) {
-        return agents.claude;
-      }
+      if (provider2 === "anthropic" && hasClaudeCodeAuth()) return agents.claude;
+      if (provider2 === "openai" && ctx.codexAgent && hasCodexAuth()) return agents.codex;
     } catch {
     }
   }
+  if (!ctx.model) {
+    if (hasEnvVar2("ANTHROPIC_AUTH_TOKEN") && !hasEnvVar2("ANTHROPIC_API_KEY") && !hasEnvVar2("CLAUDE_CODE_OAUTH_TOKEN")) {
+      return agents.claude;
+    }
+    if (ctx.codexAgent && hasCodexAuth() && !hasClaudeCodeAuth()) return agents.codex;
+  }
   return agents.opencode;
 }
 
@@ -194100,10 +194773,37 @@ auto-compaction is disabled, so long runs grow until your endpoint refuses them.
 
 for full setup instructions, see https://docs.pullfrog.com/openai-compatible`;
 }
+function buildAzureSetupError(params) {
+  const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
+  return `Azure OpenAI selected but required configuration is missing: ${params.missing.join(", ")}.
+
+only the API key is sensitive \u2014 add it as a secret at ${githubSecretsUrl}. the rest is plain workflow \`env:\`:
+
+  ${AZURE_RESOURCE_NAME_ENV}: <name>
+  ${AZURE_API_KEY_ENV}: \${{ secrets.${AZURE_API_KEY_ENV} }}
+  ${AZURE_DEPLOYMENT_ENV}: <deployment-name>
+  ${AZURE_CONTEXT_ENV}: "400000"
+  ${AZURE_MAX_OUTPUT_ENV}: "128000"
+
+${AZURE_RESOURCE_NAME_ENV} is the \`<name>\` in your endpoint https://<name>.openai.azure.com.
+${AZURE_DEPLOYMENT_ENV} is the name of the deployment, which is not necessarily the name of
+the model it serves \u2014 Azure routes on the deployment name.
+
+set the last two to the real limits of whichever model your deployment serves. Pullfrog can't
+discover them \u2014 a deployment name carries no catalog metadata \u2014 and without them completions
+are capped at 32000 tokens (rejected outright by models with a smaller cap) and auto-compaction
+is disabled, so long runs grow until Azure refuses them.
+
+for full setup instructions, see https://docs.pullfrog.com/azure`;
+}
 function hasEnvVar3(name) {
   const value2 = process.env[name];
   return typeof value2 === "string" && value2.length > 0;
 }
+function modelHasRuntimeAuth(model) {
+  const authVars = [...getModelEnvVars(model), ...getModelManagedCredentials(model)];
+  return authVars.length === 0 || authVars.some(hasEnvVar3);
+}
 function hasPositiveNumberEnvVar(name) {
   return Number(process.env[name]) > 0;
 }
@@ -194122,6 +194822,17 @@ function validateOpenAICompatibleSetup(params) {
     );
   }
 }
+function validateAzureSetup(params) {
+  const missing = [];
+  if (!hasEnvVar3(AZURE_API_KEY_ENV)) missing.push(AZURE_API_KEY_ENV);
+  if (!hasEnvVar3(AZURE_RESOURCE_NAME_ENV)) missing.push(AZURE_RESOURCE_NAME_ENV);
+  if (!hasEnvVar3(AZURE_DEPLOYMENT_ENV)) missing.push(AZURE_DEPLOYMENT_ENV);
+  if (!hasPositiveNumberEnvVar(AZURE_CONTEXT_ENV)) missing.push(AZURE_CONTEXT_ENV);
+  if (!hasPositiveNumberEnvVar(AZURE_MAX_OUTPUT_ENV)) missing.push(AZURE_MAX_OUTPUT_ENV);
+  if (missing.length > 0) {
+    throw new Error(buildAzureSetupError({ owner: params.owner, name: params.name, missing }));
+  }
+}
 function validateBedrockSetup(params) {
   const hasAuth = hasEnvVar3("AWS_BEARER_TOKEN_BEDROCK") || hasEnvVar3("AWS_ACCESS_KEY_ID") && hasEnvVar3("AWS_SECRET_ACCESS_KEY");
   const missing = [];
@@ -194145,6 +194856,12 @@ function validateVertexSetup(params) {
     throw new Error(buildVertexSetupError({ owner: params.owner, name: params.name, missing }));
   }
 }
+function hasSingleProviderAuth(agentName) {
+  if (agentName === "codex") {
+    return hasEnvVar3("OPENAI_API_KEY") || hasEnvVar3("CODEX_AUTH_JSON");
+  }
+  return hasEnvVar3("ANTHROPIC_API_KEY") || hasEnvVar3("ANTHROPIC_AUTH_TOKEN") || hasEnvVar3("CLAUDE_CODE_OAUTH_TOKEN");
+}
 function validateAgentApiKey(params) {
   if (params.model) {
     const alias = resolveDisplayAlias(params.model);
@@ -194160,6 +194877,10 @@ function validateAgentApiKey(params) {
       validateOpenAICompatibleSetup({ owner: params.owner, name: params.name });
       return;
     }
+    if (params.model.startsWith(`${AZURE_PROVIDER}/`)) {
+      validateAzureSetup({ owner: params.owner, name: params.name });
+      return;
+    }
     if (!params.model.includes("/")) {
       if (process.env[VERTEX_MODEL_ID_ENV]?.trim() === params.model) {
         validateVertexSetup({ owner: params.owner, name: params.name });
@@ -194183,7 +194904,7 @@ function validateAgentApiKey(params) {
         })
       );
     }
-    if (hasEnvVar3("ANTHROPIC_API_KEY") || hasEnvVar3("CLAUDE_CODE_OAUTH_TOKEN")) return;
+    if (hasSingleProviderAuth(params.agent.name)) return;
     throw new Error(
       buildKeyError({
         owner: params.owner,
@@ -194195,7 +194916,7 @@ function validateAgentApiKey(params) {
     );
   }
   if (params.agent.name === "opencode") {
-    if (params.authorized.size > 0) return;
+    if ([...params.authorized].some(modelHasRuntimeAuth)) return;
     const reason = getModelsFailure();
     if (reason) throw new Error(reason);
     throw new Error(
@@ -194207,7 +194928,7 @@ function validateAgentApiKey(params) {
       })
     );
   }
-  if (hasEnvVar3("ANTHROPIC_API_KEY") || hasEnvVar3("CLAUDE_CODE_OAUTH_TOKEN")) return;
+  if (hasSingleProviderAuth(params.agent.name)) return;
   throw new Error(
     buildKeyError({
       owner: params.owner,
@@ -194471,7 +195192,8 @@ var PROBES = {
     request: (value2) => ({
       url: "https://api.anthropic.com/v1/models",
       headers: { "x-api-key": value2, "anthropic-version": "2023-06-01" }
-    })
+    }),
+    hostConfigurable: true
   },
   OPENROUTER_API_KEY: {
     request: (value2) => ({
@@ -194520,12 +195242,18 @@ function hasEnvVar4(name) {
   const value2 = process.env[name];
   return typeof value2 === "string" && value2.length > 0;
 }
+var HOST_OVERRIDES = {
+  ANTHROPIC_API_KEY: "ANTHROPIC_BASE_URL",
+  CLAUDE_CODE_OAUTH_TOKEN: "ANTHROPIC_BASE_URL"
+};
 function envVarsFor(model) {
   return model.includes("/") ? getModelEnvVars(model) : [];
 }
 async function checkOne(params) {
   const value2 = process.env[params.envVar];
   if (!value2) return null;
+  const hostOverride = HOST_OVERRIDES[params.envVar];
+  if (hostOverride && hasEnvVar4(hostOverride)) return null;
   if (params.envVar === "CLAUDE_CODE_OAUTH_TOKEN") {
     const preflight = await preflightClaudeSubscription({
       token: value2,
@@ -194580,9 +195308,9 @@ async function checkConfiguredCredentials(params) {
 
 // utils/gitAuthServer.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { writeFileSync as writeFileSync14 } from "node:fs";
+import { writeFileSync as writeFileSync15 } from "node:fs";
 import { createServer as createServer3 } from "node:http";
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 var REVOKED_TRAP_MS = 6e4;
 function revokeGitHubToken(token) {
   fetch("https://api.github.com/installation/token", {
@@ -194651,7 +195379,7 @@ async function startGitAuthServer(tmpdir4) {
   function writeAskpassScript(code) {
     const scriptId = randomUUID5();
     const scriptName = `askpass-${scriptId}.js`;
-    const scriptPath = join24(tmpdir4, scriptName);
+    const scriptPath = join25(tmpdir4, scriptName);
     const content = [
       `#!/usr/bin/env node`,
       `var a=process.argv[2]||"";`,
@@ -194664,7 +195392,7 @@ async function startGitAuthServer(tmpdir4) {
       `r.on("end",function(){process.stdout.write(d+"\\n")})`,
       `}).on("error",function(){process.exit(1)})}`
     ].join("\n");
-    writeFileSync14(scriptPath, content, { mode: 448 });
+    writeFileSync15(scriptPath, content, { mode: 448 });
     return scriptPath;
   }
   async function close() {
@@ -195103,7 +195831,7 @@ function resolveInstructions(ctx) {
 
 // utils/learnings.ts
 import { mkdir as mkdir2, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname4, join as join25 } from "node:path";
+import { dirname as dirname4, join as join26 } from "node:path";
 
 // utils/learningsTruncate.ts
 var MAX_LEARNINGS_LENGTH = 1e5;
@@ -195121,10 +195849,10 @@ function truncateAtLineBoundary(body, cap) {
 var LEARNINGS_FILE_NAME = "pullfrog-learnings.md";
 var XREPO_LEARNINGS_FILE_NAME = "pullfrog-xrepo-learnings.md";
 function learningsFilePath(tmpdir4) {
-  return join25(tmpdir4, LEARNINGS_FILE_NAME);
+  return join26(tmpdir4, LEARNINGS_FILE_NAME);
 }
 function xrepoLearningsFilePath(tmpdir4) {
-  return join25(tmpdir4, XREPO_LEARNINGS_FILE_NAME);
+  return join26(tmpdir4, XREPO_LEARNINGS_FILE_NAME);
 }
 async function seedLearningsFile(params) {
   const path4 = learningsFilePath(params.tmpdir);
@@ -195240,7 +195968,7 @@ async function persistXrepoLearnings(ctx) {
 // utils/modelAccess.ts
 function decideModelAccess(input) {
   if (!input.modelExplicit || !input.model) return { kind: "ok" };
-  const byokAuthorized = !!input.resolvedModel && (input.authorized.has(input.resolvedModel) || !input.resolvedModel.includes("/") || input.resolvedModel.startsWith(`${OPENAI_COMPATIBLE_PROVIDER}/`));
+  const byokAuthorized = !!input.resolvedModel && (input.authorized.has(input.resolvedModel) || !input.resolvedModel.includes("/") || input.resolvedModel.startsWith(`${OPENAI_COMPATIBLE_PROVIDER}/`) || input.resolvedModel.startsWith(`${AZURE_PROVIDER}/`));
   if (input.proxyActive) {
     const target = resolveOpenRouterModel(input.model);
     if (input.oss) {
@@ -195285,7 +196013,7 @@ function buildModelAccessError(input) {
 }
 
 // utils/normalizeEnv.ts
-var core4 = __toESM(require_core(), 1);
+var core5 = __toESM(require_core(), 1);
 function hasControlCharacter(value2) {
   return [...value2].some((ch) => {
     const code = ch.charCodeAt(0);
@@ -195311,7 +196039,7 @@ function sanitizeSecret(key, value2) {
       `\xBB stripped whitespace from ${key} (whitespace in secret values breaks GitHub Actions log masking)`
     );
   }
-  core4.setSecret(trimmed);
+  core5.setSecret(trimmed);
   return trimmed;
 }
 function normalizeEnv() {
@@ -195355,7 +196083,7 @@ function normalizeEnv() {
 }
 
 // utils/overrides.ts
-var core5 = __toESM(require_core(), 1);
+var core6 = __toESM(require_core(), 1);
 var DENIED_OVERRIDE_NAMES = /* @__PURE__ */ new Set([
   "GITHUB_TOKEN",
   "GH_TOKEN",
@@ -195401,7 +196129,7 @@ function applyOverrides(params) {
       denied.push(key);
       continue;
     }
-    if (value2.length > 0) core5.setSecret(value2);
+    if (value2.length > 0) core6.setSecret(value2);
     params.env[key] = value2;
     applied.push(key);
   }
@@ -195410,8 +196138,8 @@ function applyOverrides(params) {
 }
 
 // utils/payload.ts
-var core6 = __toESM(require_core(), 1);
-import { readFileSync as readFileSync6 } from "node:fs";
+var core7 = __toESM(require_core(), 1);
+import { readFileSync as readFileSync7 } from "node:fs";
 import { isAbsolute as isAbsolute2, resolve as resolve2 } from "node:path";
 
 // utils/versioning.ts
@@ -195498,8 +196226,8 @@ function resolveCwd(cwd) {
   return workspace ? resolve2(workspace, cwd) : cwd;
 }
 function resolvePromptInput() {
-  const promptInput = core6.getInput("prompt");
-  const promptFile = core6.getInput("prompt_file");
+  const promptInput = core7.getInput("prompt");
+  const promptFile = core7.getInput("prompt_file");
   if (promptInput && promptFile) {
     throw new Error("set exactly one of 'prompt' or 'prompt_file' inputs, not both.");
   }
@@ -195525,7 +196253,7 @@ function resolvePromptInput() {
 function resolvePromptFile(input) {
   const workspace = process.env.GITHUB_WORKSPACE;
   const path4 = isAbsolute2(input) ? input : workspace ? resolve2(workspace, input) : resolve2(input);
-  const content = readFileSync6(path4, "utf-8");
+  const content = readFileSync7(path4, "utf-8");
   if (!content.trim()) {
     throw new Error(`prompt_file ${JSON.stringify(input)} is empty.`);
   }
@@ -195533,7 +196261,7 @@ function resolvePromptFile(input) {
 }
 function warnIfDeprecatedStatusChecks(value2) {
   if (value2 !== void 0) {
-    core6.warning(
+    core7.warning(
       "`status_checks` is deprecated. Both checks are now repository settings \u2014 open the Pullfrog console for this repo (Automations \u2192 Review PRs) and set them there, then remove `status_checks` from your workflow. It keeps working until you do."
     );
   }
@@ -195541,15 +196269,15 @@ function warnIfDeprecatedStatusChecks(value2) {
 }
 function resolveNonPromptInputs() {
   return Inputs.omit("prompt", "prompt_file").assert({
-    model: core6.getInput("model") || void 0,
-    effort: core6.getInput("effort") || void 0,
-    debug: core6.getInput("debug") || void 0,
-    timeout: core6.getInput("timeout") || void 0,
-    cwd: core6.getInput("cwd") || void 0,
-    push: core6.getInput("push") || void 0,
-    shell: core6.getInput("shell") || void 0,
-    status_checks: warnIfDeprecatedStatusChecks(core6.getInput("status_checks") || void 0),
-    progress_comments: core6.getInput("progress_comments") || void 0
+    model: core7.getInput("model") || void 0,
+    effort: core7.getInput("effort") || void 0,
+    debug: core7.getInput("debug") || void 0,
+    timeout: core7.getInput("timeout") || void 0,
+    cwd: core7.getInput("cwd") || void 0,
+    push: core7.getInput("push") || void 0,
+    shell: core7.getInput("shell") || void 0,
+    status_checks: warnIfDeprecatedStatusChecks(core7.getInput("status_checks") || void 0),
+    progress_comments: core7.getInput("progress_comments") || void 0
   });
 }
 function resolvePayload(resolvedPromptInput, repoSettings) {
@@ -195617,7 +196345,7 @@ function resolvePayload(resolvedPromptInput, repoSettings) {
   };
 }
 function resolveOutputSchema() {
-  const raw2 = core6.getInput("output_schema");
+  const raw2 = core7.getInput("output_schema");
   if (!raw2) return void 0;
   let parsed2;
   try {
@@ -195633,10 +196361,10 @@ function resolveOutputSchema() {
 }
 
 // utils/proxy.ts
-var core8 = __toESM(require_core(), 1);
+var core9 = __toESM(require_core(), 1);
 
 // utils/token.ts
-var core7 = __toESM(require_core(), 1);
+var core8 = __toESM(require_core(), 1);
 import assert2 from "node:assert/strict";
 var mcpTokenValue;
 var refreshMcpTokenFn;
@@ -195644,7 +196372,7 @@ function getMcpTokenRefresh() {
   return refreshMcpTokenFn;
 }
 function getJobToken() {
-  const inputToken = core7.getInput("token");
+  const inputToken = core8.getInput("token");
   if (inputToken) {
     return inputToken;
   }
@@ -195660,7 +196388,7 @@ async function resolveTokens(params) {
   if (externalToken) {
     mcpTokenValue = externalToken;
     if (isGitHubActions) {
-      core7.setSecret(externalToken);
+      core8.setSecret(externalToken);
     }
     log2.info("\xBB using external GH_TOKEN for both git and MCP");
     return {
@@ -195680,7 +196408,7 @@ async function resolveTokens(params) {
   const gitPermissions = params.push === "disabled" ? { contents: "read" } : { contents: "write", workflows: "write" };
   const gitToken = await acquireNewToken({ repos: writeRepos, permissions: gitPermissions });
   if (isGitHubActions) {
-    core7.setSecret(gitToken);
+    core8.setSecret(gitToken);
   }
   log2.info(
     `\xBB acquired git token (${Object.entries(gitPermissions).map((e) => e.join(":")).join(", ")})`
@@ -195697,7 +196425,7 @@ async function resolveTokens(params) {
   };
   const mcpToken = await acquireNewToken({ repos: writeRepos, permissions: mcpPermissions });
   if (isGitHubActions) {
-    core7.setSecret(mcpToken);
+    core8.setSecret(mcpToken);
   }
   log2.info(
     `\xBB acquired scoped MCP token (${Object.entries(mcpPermissions).map((e) => e.join(":")).join(", ")})`
@@ -195706,7 +196434,7 @@ async function resolveTokens(params) {
   let ghToken;
   if (ghPermissions) {
     ghToken = await acquireNewToken({ permissions: ghPermissions });
-    if (isGitHubActions) core7.setSecret(ghToken);
+    if (isGitHubActions) core8.setSecret(ghToken);
     log2.info(
       `\xBB acquired gh token mirroring ${params.authorPermission} (${formatPermissions(ghPermissions)})`
     );
@@ -195717,7 +196445,7 @@ async function resolveTokens(params) {
       repos: params.xrepo.read,
       permissions: { contents: "read" }
     });
-    if (isGitHubActions) core7.setSecret(readToken);
+    if (isGitHubActions) core8.setSecret(readToken);
     log2.info(`\xBB acquired cross-repo read token (contents:read, ${params.xrepo.read.length} repos)`);
   }
   mcpTokenValue = mcpToken;
@@ -195736,7 +196464,7 @@ async function resolveTokens(params) {
       oidc: params.oidc ?? void 0
     }).then((fresh) => {
       if (isGitHubActions) {
-        core7.setSecret(fresh);
+        core8.setSecret(fresh);
       }
       mcpTokenValue = fresh;
       currentMcpToken = fresh;
@@ -195757,7 +196485,7 @@ async function resolveTokens(params) {
         permissions: gitPermissions,
         oidc: params.oidc ?? void 0
       }).then((fresh) => {
-        if (isGitHubActions) core7.setSecret(fresh);
+        if (isGitHubActions) core8.setSecret(fresh);
         void revokeGitHubInstallationToken(currentGitToken);
         currentGitToken = fresh;
         log2.warning("\xBB GitHub rejected the git token; re-acquired a fresh git token");
@@ -195774,7 +196502,7 @@ async function resolveTokens(params) {
         permissions: { contents: "read" },
         oidc: params.oidc ?? void 0
       }).then((fresh) => {
-        if (isGitHubActions) core7.setSecret(fresh);
+        if (isGitHubActions) core8.setSecret(fresh);
         void revokeGitHubInstallationToken(read2);
         currentReadToken = fresh;
         log2.warning("\xBB GitHub rejected the read token; re-acquired a fresh read token");
@@ -195988,7 +196716,7 @@ async function resolveProxyModel(ctx) {
   });
   if (!key) return;
   process.env.OPENROUTER_API_KEY = key;
-  core8.setSecret(key);
+  core9.setSecret(key);
   ctx.payload.proxyModel = ctx.proxyModel;
   ctx.toolState.model = ctx.proxyModel;
   const label = ctx.oss ? "oss" : "router";
@@ -196059,7 +196787,7 @@ async function runProxyResolution(ctx) {
 
 // utils/prSummary.ts
 import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname5, join as join26 } from "node:path";
+import { dirname as dirname5, join as join27 } from "node:path";
 var SUMMARY_FILE_NAME = "pullfrog-summary.md";
 var SUMMARY_SCAFFOLD = `# PR summary
 
@@ -196069,7 +196797,7 @@ var SUMMARY_SCAFFOLD = `# PR summary
 var MIN_SNAPSHOT_LENGTH = 60;
 var MAX_SNAPSHOT_LENGTH = 32768;
 function summaryFilePath(tmpdir4) {
-  return join26(tmpdir4, SUMMARY_FILE_NAME);
+  return join27(tmpdir4, SUMMARY_FILE_NAME);
 }
 async function seedSummaryFile(params) {
   const path4 = summaryFilePath(params.tmpdir);
@@ -196198,6 +196926,7 @@ var defaultSettings = {
   shell: "restricted",
   prApproveEnabled: false,
   autoMergeEnabled: false,
+  codexAgent: false,
   signedCommits: false,
   repoIntelligence: false,
   progressComments: true,
@@ -196686,7 +197415,7 @@ ${genericBody}`,
 }
 
 // utils/runLifecycle.ts
-var core9 = __toESM(require_core(), 1);
+var core10 = __toESM(require_core(), 1);
 
 // utils/autoMerge.ts
 function hasBlockingHumanReview(reviews) {
@@ -197072,7 +197801,7 @@ async function finalizeSuccessRun(input) {
   }
   if (input.toolState.output) {
     log2.info(`::pullfrog-output::${Buffer.from(input.toolState.output).toString("base64")}`);
-    core9.setOutput("result", input.toolState.output);
+    core10.setOutput("result", input.toolState.output);
   }
   if (input.result.success) {
     await approveAfterFix(input.toolContext).catch((error52) => {
@@ -197536,7 +198265,11 @@ async function main() {
         }
         const resolvedModel = credentials.kind === "fellBack" ? credentials.replacement : configuredModel;
         vertexCredentials = materializeVertexCredentials({ model: resolvedModel });
-        const agent2 = resolveAgent({ model: resolvedModel });
+        const agent2 = resolveAgent({
+          model: resolvedModel,
+          proxyModel: payload.proxyModel,
+          codexAgent: runContext.repoSettings.codexAgent
+        });
         const effectiveModel = payload.proxyModel ?? resolvedModel ?? payload.model;
         toolState.model = effectiveModel;
         if (!payload.proxyModel) {
@@ -197720,8 +198453,8 @@ ${instructions.user}` : null,
           log2.info(instructions.full);
         });
         if (agentId === "opencode") {
-          const pluginDir = join27(process.cwd(), ".opencode", "plugin");
-          const hasPlugins = existsSync8(pluginDir) && readdirSync2(pluginDir).some((f) => /\.[jt]sx?$/.test(f));
+          const pluginDir = join28(process.cwd(), ".opencode", "plugin");
+          const hasPlugins = existsSync9(pluginDir) && readdirSync2(pluginDir).some((f) => /\.[jt]sx?$/.test(f));
           if (hasPlugins && toolState.dependencyInstallation?.promise) {
             log2.info(
               "\xBB .opencode/plugin/ detected \u2014 awaiting dependency installation before agent start"
@@ -197753,16 +198486,14 @@ ${instructions.user}` : null,
         const onInnerActivityTimeout = () => {
           if (innerTimeoutFired) return;
           innerTimeoutFired = true;
-          log2.info(
-            "\xBB inner activity timeout fired \u2014 stopping MCP server and starting 5min safety-net timer"
-          );
-          mcpHttpServer[Symbol.asyncDispose]().catch((err) => {
-            log2.debug(
-              `mcp server stop after inner kill failed: ${err instanceof Error ? err.message : String(err)}`
-            );
-          });
+          log2.info("\xBB inner activity timeout fired \u2014 starting 5min safety-net timer");
           safetyNetTimer = setTimeout(
             () => {
+              mcpHttpServer[Symbol.asyncDispose]().catch((err) => {
+                log2.debug(
+                  `mcp server stop after inner kill failed: ${err instanceof Error ? err.message : String(err)}`
+                );
+              });
               activityTimeout?.forceReject(
                 "agent still pending 5min after inner activity kill \u2014 forcing exit"
               );
@@ -197771,6 +198502,13 @@ ${instructions.user}` : null,
           );
           safetyNetTimer.unref?.();
         };
+        const onTurnRecovered = () => {
+          if (!innerTimeoutFired) return;
+          innerTimeoutFired = false;
+          if (safetyNetTimer) clearTimeout(safetyNetTimer);
+          safetyNetTimer = void 0;
+          log2.info("\xBB inner activity safety net stood down \u2014 turn recovered");
+        };
         const agentPromise = agent2.run({
           payload,
           resolvedModel,
@@ -197791,6 +198529,7 @@ ${instructions.user}` : null,
           toolState,
           apiToken: runContext.apiToken,
           onActivityTimeout: onInnerActivityTimeout,
+          onTurnRecovered,
           onToolUse: (event) => {
             const wasTracked = recordDiffReadFromToolUse({
               state: primaryRepoState(toolState).diffCoverage,
@@ -197913,27 +198652,27 @@ async function runMain() {
     }
   } catch (error52) {
     const errorMessage = error52 instanceof Error ? error52.message : "unknown error occurred";
-    core10.setFailed(`action failed: ${errorMessage}`);
+    core11.setFailed(`action failed: ${errorMessage}`);
   }
 }
 async function tokenMain() {
-  const reposInput = core10.getInput("repos");
+  const reposInput = core11.getInput("repos");
   const additionalRepos = reposInput ? reposInput.split(",").map((r2) => r2.trim()).filter(Boolean) : [];
   const token = await acquireNewToken({ repos: additionalRepos });
-  core10.setSecret(token);
-  core10.saveState(STATE_TOKEN, token);
-  core10.setOutput("token", token);
+  core11.setSecret(token);
+  core11.saveState(STATE_TOKEN, token);
+  core11.setOutput("token", token);
   const scope2 = additionalRepos.length ? `current repo + ${additionalRepos.join(", ")}` : "current repo only";
-  core10.info(`\xBB installation token acquired (${scope2})`);
+  core11.info(`\xBB installation token acquired (${scope2})`);
 }
 async function tokenPost() {
-  const token = core10.getState(STATE_TOKEN);
+  const token = core11.getState(STATE_TOKEN);
   if (!token) {
-    core10.debug("no token found in state, skipping revocation");
+    core11.debug("no token found in state, skipping revocation");
     return;
   }
   await revokeGitHubInstallationToken(token);
-  core10.info("\xBB installation token revoked");
+  core11.info("\xBB installation token revoked");
 }
 function printGhaUsage(params) {
   params.stream(`usage: ${params.prog} gha [subcommand]
@@ -198049,7 +198788,7 @@ async function run(args2) {
     }
   } catch (error52) {
     const message = error52 instanceof Error ? error52.message : String(error52);
-    core10.setFailed(message);
+    core11.setFailed(message);
   }
 }
 
@@ -198064,34 +198803,6 @@ var PULLFROG_API_URL2 = (process.env.PULLFROG_API_URL || "https://pullfrog.com")
 function link(text, url4) {
   return `\x1B]8;;${url4}\x07${text}\x1B]8;;\x07`;
 }
-function buildProviders() {
-  return Object.entries(providers).filter(([key]) => key !== "opencode" && key !== "openrouter").map(([key, config3]) => {
-    const aliases = modelAliases.filter(
-      (a2) => a2.provider === key && !a2.fallback && !a2.routing && !a2.hidden
-    );
-    const recommended = aliases.find((a2) => a2.preferred);
-    const sorted = [...aliases].sort((a2, b) => {
-      if (a2.preferred && !b.preferred) return -1;
-      if (!a2.preferred && b.preferred) return 1;
-      return 0;
-    });
-    return {
-      id: key,
-      name: config3.displayName,
-      envVars: config3.envVars,
-      models: sorted.map((a2) => ({
-        value: a2.slug,
-        label: a2.displayName,
-        hint: a2 === recommended ? "recommended" : void 0
-      }))
-    };
-  }).filter((p) => p.models.length > 0);
-}
-var CLI_PROVIDERS = buildProviders();
-function resolveModelProvider(slug2) {
-  const providerId = slug2.split("/")[0];
-  return CLI_PROVIDERS.find((p) => p.id === providerId) ?? null;
-}
 var activeSpin2 = null;
 function bail2(msg) {
   if (activeSpin2) {
@@ -198176,15 +198887,11 @@ function openBrowser(url4) {
   }
 }
 async function pullfrogApi2(ctx) {
-  const headers = { authorization: `Bearer ${ctx.token}` };
-  if (ctx.body) headers["content-type"] = "application/json";
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), 3e4);
   try {
     const response = await fetch(`${PULLFROG_API_URL2}${ctx.path}`, {
-      method: ctx.method || "GET",
-      headers,
-      body: ctx.body ? JSON.stringify(ctx.body) : null,
+      headers: { authorization: `Bearer ${ctx.token}` },
       signal: controller.signal
     });
     const data = await response.json().catch(() => ({}));
@@ -198212,406 +198919,27 @@ async function fetchStatus2(ctx) {
         isOrg: result.data.isOrg === true
       };
     }
-    bail2(errorMsg || `secrets check failed (${result.status})`);
+    bail2(errorMsg || `installation check failed (${result.status})`);
   }
   return {
     installed: true,
     isOrg: result.data.isOrg === true,
-    installationId: typeof result.data.installationId === "number" ? result.data.installationId : null,
-    secretsAccessible: result.data.accessible !== false,
-    repoSecrets: result.data.repoSecrets || [],
-    orgSecrets: result.data.orgSecrets || [],
-    pullfrogSecrets: result.data.pullfrogSecrets || [],
-    model: result.data.repoModel ?? null,
-    hasRuns: result.data.hasRuns === true
-  };
-}
-async function createSession(ctx) {
-  try {
-    const result = await pullfrogApi2({
-      path: "/api/cli/session",
-      token: ctx.token,
-      method: "POST",
-      body: { owner: ctx.owner.toLowerCase(), repo: ctx.repo.toLowerCase() }
-    });
-    if (!result.ok || !result.data.id) return null;
-    return result.data.id;
-  } catch {
-    return null;
-  }
-}
-async function pollSession(ctx) {
-  const result = await pullfrogApi2({
-    path: `/api/cli/session/${ctx.sessionId}`,
-    token: ctx.token
-  });
-  if (result.status === 410) return "expired";
-  if (!result.ok) return "pending";
-  return result.data.installed === true ? "installed" : "pending";
-}
-function cleanupSession(ctx) {
-  void pullfrogApi2({
-    path: `/api/cli/session/${ctx.sessionId}`,
-    token: ctx.token,
-    method: "DELETE"
-  }).catch(() => {
-  });
-}
-var SESSION_POLL_MS = 750;
-var FALLBACK_POLL_MS = 5e3;
-var HINT_AFTER_MS = 1e4;
-var TIMEOUT_MS = 3 * 60 * 1e3;
-function listenForKey(key) {
-  let triggered = false;
-  const onData = (data) => {
-    if (data.toString().toLowerCase() === key) triggered = true;
-  };
-  process.stdin.setRawMode?.(true);
-  process.stdin.resume();
-  process.stdin.on("data", onData);
-  return {
-    consume() {
-      if (!triggered) return false;
-      triggered = false;
-      return true;
-    },
-    stop() {
-      process.stdin.removeListener("data", onData);
-      process.stdin.setRawMode?.(false);
-      process.stdin.pause();
-    }
+    installationId: typeof result.data.installationId === "number" ? result.data.installationId : null
   };
 }
 function installationConfigUrl(ctx) {
   return ctx.isOrg ? `https://github.com/organizations/${ctx.owner}/settings/installations/${ctx.installationId}` : `https://github.com/settings/installations/${ctx.installationId}`;
 }
-async function ensureInstallation(ctx) {
-  activeSpin2.start("checking pullfrog app installation");
-  const initial = await fetchStatus2(ctx);
-  if (initial.installed) {
-    activeSpin2.stop(`pullfrog app is installed on ${import_picocolors3.default.cyan(`@${ctx.owner}`)}`);
-    if (initial.installationId) {
-      const configUrl = installationConfigUrl({
-        owner: ctx.owner,
-        installationId: initial.installationId,
-        isOrg: initial.isOrg
-      });
-      process.stdout.write(`${import_picocolors3.default.gray(S_BAR)}    ${link(import_picocolors3.default.dim(configUrl), configUrl)}
-`);
-    }
-    return initial;
-  }
-  const sessionId = await createSession(ctx);
-  if (initial.installationId) {
-    const repoRef = import_picocolors3.default.bold(`${ctx.owner}/${ctx.repo}`);
-    const configUrl = installationConfigUrl({
-      owner: ctx.owner,
-      installationId: initial.installationId,
-      isOrg: initial.isOrg
-    });
-    activeSpin2.stop(`pullfrog is installed on selected repos, but ${repoRef} is not included.`);
-    log.info(
-      `add it under "Repository access" on the installation config page.
-  ${import_picocolors3.default.dim(configUrl)}`
-    );
-    const openIt = await confirm({ message: "open browser?", active: "yes", inactive: "no" });
-    handleCancel2(openIt);
-    if (openIt) openBrowser(configUrl);
-  } else {
-    activeSpin2.stop("pullfrog app not installed");
-    const installUrl = `https://github.com/apps/${initial.appSlug}/installations/select_target?state=cli`;
-    log.info(`opening browser to install...
-  ${import_picocolors3.default.dim(installUrl)}`);
-    openBrowser(installUrl);
-  }
-  const isRepoAccessUpdate = !!initial.installationId;
-  const baseMsg = isRepoAccessUpdate ? "once you've added the repo, onboarding will proceed automatically" : "once you've installed the app, onboarding will proceed automatically";
-  activeSpin2.start(baseMsg);
-  let activeSessionId = sessionId;
-  let pollMs = activeSessionId ? SESSION_POLL_MS : FALLBACK_POLL_MS;
-  const listener = listenForKey("r");
-  const startedAt = Date.now();
-  let hintShown = false;
-  try {
-    while (Date.now() - startedAt < TIMEOUT_MS) {
-      await new Promise((r2) => setTimeout(r2, pollMs));
-      if (!hintShown && Date.now() - startedAt > HINT_AFTER_MS) {
-        activeSpin2.message(`${baseMsg} ${import_picocolors3.default.dim("(press r to recheck manually)")}`);
-        hintShown = true;
-      }
-      const doneMsg = isRepoAccessUpdate ? "repo access confirmed" : "pullfrog app installed";
-      if (listener.consume()) {
-        activeSpin2.message("rechecking via GitHub API");
-        try {
-          const status = await fetchStatus2(ctx);
-          if (status.installed) {
-            if (activeSessionId) cleanupSession({ token: ctx.token, sessionId: activeSessionId });
-            activeSpin2.stop(doneMsg);
-            return status;
-          }
-        } catch {
-        }
-        activeSpin2.message(`${baseMsg} ${import_picocolors3.default.dim("(press r to recheck manually)")}`);
-        continue;
-      }
-      if (activeSessionId) {
-        try {
-          const result = await pollSession({ token: ctx.token, sessionId: activeSessionId });
-          if (result === "expired") {
-            activeSessionId = null;
-            pollMs = FALLBACK_POLL_MS;
-            continue;
-          }
-          if (result === "installed") {
-            const status = await fetchStatus2(ctx);
-            if (status.installed) {
-              cleanupSession({ token: ctx.token, sessionId: activeSessionId });
-              activeSpin2.stop(doneMsg);
-              return status;
-            }
-          }
-        } catch {
-        }
-      } else {
-        try {
-          const status = await fetchStatus2(ctx);
-          if (status.installed) {
-            activeSpin2.stop(doneMsg);
-            return status;
-          }
-        } catch {
-        }
-      }
-    }
-  } finally {
-    listener.stop();
-  }
-  if (activeSessionId) cleanupSession({ token: ctx.token, sessionId: activeSessionId });
-  bail2(
-    isRepoAccessUpdate ? `timed out waiting for repo access.
-  ${import_picocolors3.default.dim("add the repo, then re-run:")} npx pullfrog init` : `timed out waiting for app installation.
-  ${import_picocolors3.default.dim("if your org requires admin approval, ask an admin to approve,")}
-  ${import_picocolors3.default.dim("then re-run:")} npx pullfrog init`
-  );
+function consoleUrl(ctx) {
+  return `${PULLFROG_API_URL2}/console/${ctx.owner}?repo=${encodeURIComponent(ctx.repo)}`;
 }
-function setGhSecret(ctx) {
-  let orgFailed = false;
-  if (ctx.org) {
-    try {
-      execFileSync8("gh", ["secret", "set", ctx.name, "--org", ctx.org, "--visibility", "all"], {
-        input: ctx.value,
-        stdio: ["pipe", "ignore", "pipe"],
-        encoding: "utf-8"
-      });
-      return { saved: true, orgFailed: false };
-    } catch {
-      orgFailed = true;
-    }
-  }
-  try {
-    execFileSync8("gh", ["secret", "set", ctx.name, "--repo", ctx.repoSlug], {
-      input: ctx.value,
-      stdio: ["pipe", "ignore", "pipe"],
-      encoding: "utf-8"
-    });
-    return { saved: true, orgFailed };
-  } catch {
-    return { saved: false, orgFailed };
-  }
+function installUrl(ctx) {
+  const state = encodeURIComponent(`cli:${ctx.owner}/${ctx.repo}`);
+  return `https://github.com/apps/${ctx.appSlug}/installations/select_target?state=${state}`;
 }
-async function setPullfrogSecret2(ctx) {
-  const result = await pullfrogApi2({
-    path: "/api/cli/secrets",
-    token: ctx.token,
-    method: "POST",
-    body: {
-      owner: ctx.owner,
-      repo: ctx.repo,
-      name: ctx.name,
-      value: ctx.value,
-      scope: ctx.scope
-    }
-  });
-  if (result.ok && result.data.success === true) {
-    return { saved: true, error: "" };
-  }
-  return { saved: false, error: result.data.error || `api returned ${result.status}` };
-}
-async function promptScope2(ctx) {
-  const scope2 = await select({
-    message: "secret scope",
-    options: [
-      { value: "account", label: `${ctx.owner} organization`, hint: "shared across repos" },
-      { value: "repo", label: `${ctx.owner}/${ctx.repo} only` }
-    ]
-  });
-  handleCancel2(scope2);
-  return scope2;
-}
-async function handleSecret(ctx) {
-  const repoSecretsUrl = `https://github.com/${ctx.owner}/${ctx.repo}/settings/secrets/actions`;
-  const matches = [];
-  for (const v of ctx.provider.envVars) {
-    if (ctx.secrets.pullfrogSecrets.includes(v)) matches.push({ name: v, source: "pullfrog" });
-    else if (ctx.secrets.secretsAccessible && ctx.secrets.orgSecrets.includes(v))
-      matches.push({ name: v, source: "org secret" });
-    else if (ctx.secrets.secretsAccessible && ctx.secrets.repoSecrets.includes(v))
-      matches.push({ name: v, source: "repo secret" });
-  }
-  if (matches.length > 0) {
-    activeSpin2.start("");
-    activeSpin2.stop("secrets already configured");
-    for (const m of matches) {
-      process.stdout.write(
-        `${import_picocolors3.default.gray(S_BAR)}    ${import_picocolors3.default.cyan(m.name)} ${import_picocolors3.default.dim(`(${m.source})`)}
-`
-      );
-    }
-    return;
-  }
-  if (!ctx.secrets.secretsAccessible) {
-    log.info(`could not verify GitHub secrets (app lacks permission)`);
-  }
-  const hasOAuthOption = ctx.provider.envVars.includes("CLAUDE_CODE_OAUTH_TOKEN");
-  let envVar = ctx.provider.envVars[0];
-  if (hasOAuthOption) {
-    const authMethod = await select({
-      message: "which credential do you want to use?",
-      options: [
-        {
-          value: "oauth",
-          label: "Claude Code OAuth token",
-          hint: `run ${import_picocolors3.default.cyan("claude setup-token")} \u2014 works with Pro/Max subscriptions`
-        },
-        {
-          value: "api",
-          label: "Anthropic API key",
-          hint: "from console.anthropic.com"
-        }
-      ]
-    });
-    handleCancel2(authMethod);
-    if (authMethod === "oauth") envVar = "CLAUDE_CODE_OAUTH_TOKEN";
-  }
-  const method = await select({
-    message: `where should ${import_picocolors3.default.cyan(envVar)} be stored?`,
-    options: [
-      {
-        value: "pullfrog",
-        label: "Pullfrog",
-        hint: "recommended \u2014 auto-injected, no workflow changes"
-      },
-      {
-        value: "github",
-        label: "GitHub Actions secret",
-        hint: "requires env block in pullfrog.yml"
-      }
-    ]
-  });
-  handleCancel2(method);
-  const pasteLabel = envVar === "CLAUDE_CODE_OAUTH_TOKEN" ? "OAuth token" : `${ctx.provider.name} API key`;
-  const apiKey = await password({
-    message: `paste your ${pasteLabel} ${import_picocolors3.default.dim("(Enter to skip)")}`,
-    mask: "*",
-    validate: () => void 0
-  });
-  handleCancel2(apiKey);
-  if (!apiKey) {
-    log.info(
-      `skipped \u2014 set it manually at:
-  ${import_picocolors3.default.dim(method === "pullfrog" ? `${PULLFROG_API_URL2}/console/${ctx.owner}` : repoSecretsUrl)}`
-    );
-    return;
-  }
-  if (method === "pullfrog") {
-    const scope2 = ctx.secrets.isOrg ? await promptScope2(ctx) : "account";
-    const target = describeSecretTarget({ owner: ctx.owner, repo: ctx.repo, scope: scope2 });
-    activeSpin2.start(`saving ${import_picocolors3.default.cyan(envVar)} to ${target}`);
-    let saveResult;
-    try {
-      saveResult = await setPullfrogSecret2({
-        token: ctx.token,
-        owner: ctx.owner,
-        repo: ctx.repo,
-        name: envVar,
-        value: apiKey,
-        scope: scope2
-      });
-    } catch (error52) {
-      activeSpin2.stop(import_picocolors3.default.red("could not save secret"));
-      log.warn(
-        `${error52 instanceof Error ? error52.message : "network error"}
-  set it manually at: ${import_picocolors3.default.dim(`${PULLFROG_API_URL2}/console/${ctx.owner}`)}`
-      );
-      return;
-    }
-    if (saveResult.saved) {
-      activeSpin2.stop(`saved ${import_picocolors3.default.cyan(envVar)} to ${target}`);
-    } else {
-      activeSpin2.stop(import_picocolors3.default.red("could not save secret"));
-      log.warn(
-        `${saveResult.error}
-  set it manually at: ${import_picocolors3.default.dim(`${PULLFROG_API_URL2}/console/${ctx.owner}`)}`
-      );
-    }
-    return;
-  }
-  let org = null;
-  if (ctx.secrets.isOrg) {
-    const scope2 = await promptScope2(ctx);
-    org = scope2 === "account" ? ctx.owner : null;
-  }
-  const secretsUrl = org ? `https://github.com/organizations/${org}/settings/secrets/actions` : repoSecretsUrl;
-  activeSpin2.start(`saving ${envVar}`);
-  const secretResult = setGhSecret({
-    name: envVar,
-    value: apiKey,
-    org,
-    repoSlug: `${ctx.owner}/${ctx.repo}`
-  });
-  if (secretResult.saved) {
-    activeSpin2.stop(
-      `saved ${import_picocolors3.default.cyan(envVar)} to ${org && !secretResult.orgFailed ? `${import_picocolors3.default.dim(ctx.owner)} org secret` : "GitHub Actions secret"}`
-    );
-    if (secretResult.orgFailed) {
-      log.warn("org secret failed (admin access required) \u2014 saved as repo secret instead");
-    }
-  } else {
-    activeSpin2.stop(import_picocolors3.default.red("could not set secret"));
-    log.warn(`set it manually at:
-  ${import_picocolors3.default.dim(secretsUrl)}`);
-  }
-}
-async function promptTestRun(ctx) {
-  const proceed = await select({
-    message: "test your installation?",
-    options: [
-      { value: true, label: "yes", hint: "dispatches a test run in your GitHub Actions" },
-      { value: false, label: "skip" }
-    ]
-  });
-  handleCancel2(proceed);
-  if (!proceed) return;
-  activeSpin2.start("dispatching test run");
-  const result = await pullfrogApi2({
-    path: "/api/cli/dispatch",
-    token: ctx.token,
-    method: "POST",
-    body: { owner: ctx.owner, repo: ctx.repo, prompt: "Tell me a joke" }
-  });
-  if (!result.ok) {
-    activeSpin2.stop(import_picocolors3.default.red("could not dispatch"));
-    log.warn(result.data.error || `dispatch failed (${result.status})`);
-    return;
-  }
-  activeSpin2.stop("dispatched test run");
-  if (result.data.url) {
-    process.stdout.write(
-      `${import_picocolors3.default.gray(S_BAR)}    ${link(import_picocolors3.default.dim(result.data.url), result.data.url)}
-`
-    );
-    openBrowser(result.data.url);
-  }
+function printLink(url4) {
+  process.stdout.write(`${import_picocolors3.default.gray(S_BAR)}    ${link(import_picocolors3.default.dim(url4), url4)}
+`);
 }
 async function main2() {
   intro(import_picocolors3.default.bgGreen(import_picocolors3.default.black(" pullfrog ")));
@@ -198633,98 +198961,58 @@ async function main2() {
   spin.start("detecting repository");
   const remote = parseGitRemote2();
   spin.stop(`detected repo ${import_picocolors3.default.cyan(`${remote.owner}/${remote.repo}`)}`);
-  const secrets = await ensureInstallation({ token, owner: remote.owner, repo: remote.repo });
-  let model;
-  let provider2;
-  if (secrets.model) {
-    model = secrets.model;
-    const resolved = resolveModelProvider(secrets.model);
-    if (!resolved) bail2(`unknown model provider: ${secrets.model}`);
-    provider2 = resolved;
-    const displayAlias = resolveDisplayAlias(secrets.model);
-    const label = displayAlias ? displayAlias.displayName : secrets.model;
+  spin.start("checking pullfrog app installation");
+  const status = await fetchStatus2({ token, owner: remote.owner, repo: remote.repo });
+  const handoff = consoleUrl({ owner: remote.owner, repo: remote.repo });
+  if (status.installed) {
+    spin.stop(`pullfrog app is installed on ${import_picocolors3.default.cyan(`@${remote.owner}`)}`);
     spin.start("");
-    spin.stop(`using model ${import_picocolors3.default.cyan(label)}`);
-  } else {
-    const providerId = await select({
-      message: "select your preferred model provider",
-      options: CLI_PROVIDERS.map((cp) => ({
-        value: cp.id,
-        label: cp.name
-      }))
-    });
-    handleCancel2(providerId);
-    const found = CLI_PROVIDERS.find((cp) => cp.id === providerId);
-    if (!found) bail2(`unknown provider: ${providerId}`);
-    provider2 = found;
-    if (provider2.models.length === 1) {
-      model = provider2.models[0].value;
-      spin.start("");
-      spin.stop(`using ${import_picocolors3.default.bold(provider2.models[0].label)}`);
-    } else {
-      const recommendedModel = provider2.models.find((m) => m.hint === "recommended");
-      const options = provider2.models.map((m) => {
-        if (m.hint) return { value: m.value, label: m.label, hint: m.hint };
-        return { value: m.value, label: m.label };
-      });
-      const selected = await select(
-        recommendedModel ? { message: "select model", initialValue: recommendedModel.value, options } : { message: "select model", options }
-      );
-      handleCancel2(selected);
-      model = selected;
-    }
-  }
-  await handleSecret({ token, owner: remote.owner, repo: remote.repo, provider: provider2, secrets });
-  spin.start("creating pullfrog.yml workflow");
-  const result = await pullfrogApi2({
-    path: "/api/cli/setup",
-    token,
-    method: "POST",
-    body: { owner: remote.owner, repo: remote.repo, model }
-  });
-  if (!result.ok) {
-    bail2(result.data.error || `api returned ${result.status}`);
-  }
-  let skipTestRun = false;
-  if (result.data.already_existed) {
-    spin.stop("pullfrog.yml already exists");
-  } else if (result.data.pull_request_url) {
-    spin.stop("opened pull request with pullfrog.yml");
-    process.stdout.write(
-      `${import_picocolors3.default.gray(S_BAR)}    ${link(import_picocolors3.default.dim(result.data.pull_request_url), result.data.pull_request_url)}
-`
+    spin.stop("opening your dashboard");
+    printLink(handoff);
+    openBrowser(handoff);
+    activeSpin2 = null;
+    outro(
+      `finish setup in your browser \u2014 ${import_picocolors3.default.cyan(`${remote.owner}/${remote.repo}`)} is ready.`
     );
-    openBrowser(result.data.pull_request_url);
-    const merged = await select({
-      message: "merge the PR to activate pullfrog, then continue",
-      options: [
-        { value: true, label: "continue", hint: "PR has been merged" },
-        { value: false, label: "skip" }
-      ]
+    return;
+  }
+  if (status.installationId) {
+    const repoRef = import_picocolors3.default.bold(`${remote.owner}/${remote.repo}`);
+    const configUrl = installationConfigUrl({
+      owner: remote.owner,
+      installationId: status.installationId,
+      isOrg: status.isOrg
     });
-    handleCancel2(merged);
-    if (!merged) skipTestRun = true;
-  } else {
-    const short = result.data.hash?.slice(0, 7);
-    spin.stop(
-      short ? `committed pullfrog.yml to repo ${import_picocolors3.default.dim(short)}` : "committed pullfrog.yml to repo"
+    spin.stop(`pullfrog is installed on selected repos, but ${repoRef} is not included.`);
+    log.info(
+      `add it under "Repository access" on the installation config page.
+  ${import_picocolors3.default.dim(configUrl)}`
     );
+    const openIt = await confirm({ message: "open browser?", active: "yes", inactive: "no" });
+    handleCancel2(openIt);
+    if (openIt) openBrowser(configUrl);
+    log.info("once the repo is added, finish setup at:");
+    printLink(handoff);
+    activeSpin2 = null;
+    outro("done.");
+    return;
   }
-  if (!skipTestRun && !secrets.hasRuns) {
-    await promptTestRun({ token, owner: remote.owner, repo: remote.repo });
-  }
-  const consoleUrl = `${PULLFROG_API_URL2}/console/${remote.owner}/${remote.repo}`;
-  spin.start("");
-  spin.stop("repo is configurable via the Pullfrog dashboard");
-  process.stdout.write(`${import_picocolors3.default.gray(S_BAR)}    ${link(import_picocolors3.default.dim(consoleUrl), consoleUrl)}
-`);
+  spin.stop("pullfrog app not installed");
+  const install = installUrl({
+    appSlug: status.appSlug,
+    owner: remote.owner,
+    repo: remote.repo
+  });
+  log.info("opening browser to install...");
+  printLink(install);
+  openBrowser(install);
   activeSpin2 = null;
-  outro("done.");
+  outro("GitHub will drop you at your dashboard to finish setup.");
 }
 function printInitUsage(params) {
   params.stream(`usage: ${params.prog} init
 `);
-  params.stream("set up pullfrog on the current repository.");
+  params.stream("install pullfrog on the current repository and open its dashboard.");
   params.stream("");
   params.stream("options:");
   params.stream("  -h, --help   show help");
@@ -198896,7 +199184,7 @@ async function runCli4(input) {
 }
 
 // cli.ts
-var VERSION10 = "0.1.57";
+var VERSION10 = "0.1.60";
 var bin = basename2(process.argv[1] || "");
 var PROG = bin === "pf" || bin === "pullfrog" ? bin : "pullfrog";
 var rawArgs = process.argv.slice(2);
@@ -198904,7 +199192,7 @@ function printMainUsage(stream) {
   stream(`usage: ${PROG} <command>
 `);
   stream("commands:");
-  stream("  init        set up pullfrog on the current repository");
+  stream("  init        install pullfrog on the current repository and open its dashboard");
   stream("  auth        manage provider credentials for the current repository");
   stream("  watch       stream a PR's activity as one JSON line per event");
   stream("");