pullfrog 0.1.57 → 0.1.60

package/dist/index.js

@@ -3682,7 +3682,7 @@ var require_util2 = __commonJS({
     "use strict";
     var { redirectStatusSet, referrerPolicySet: referrerPolicyTokens, badPortsSet } = require_constants2();
     var { getGlobalOrigin } = require_global();
-    var { performance: performance9 } = __require("perf_hooks");
+    var { performance: performance10 } = __require("perf_hooks");
     var { isBlobLike, toUSVString, ReadableStreamFrom } = require_util();
     var assert3 = __require("assert");
     var { isUint8Array } = __require("util/types");
@@ -3845,7 +3845,7 @@ var require_util2 = __commonJS({
       }
     }
     function coarsenedSharedCurrentTime(crossOriginIsolatedCapability) {
-      return performance9.now();
+      return performance10.now();
     }
     function createOpaqueTimingInfo(timingInfo) {
       return {
@@ -19826,14 +19826,14 @@ Support boolean input list: \`true | True | TRUE | false | False | FALSE\``);
       });
     }
     exports.group = group2;
-    function saveState2(name, value2) {
+    function saveState3(name, value2) {
       const filePath = process.env["GITHUB_STATE"] || "";
       if (filePath) {
         return (0, file_command_1.issueFileCommand)("STATE", (0, file_command_1.prepareKeyValueMessage)(name, value2));
       }
       (0, command_1.issueCommand)("save-state", { name }, (0, utils_1.toCommandValue)(value2));
     }
-    exports.saveState = saveState2;
+    exports.saveState = saveState3;
     function getState(name) {
       return process.env[`STATE_${name}`] || "";
     }
@@ -27621,11 +27621,11 @@ var require_mode = __commonJS({
 var require_isexe = __commonJS({
   "node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js"(exports, module) {
     var fs5 = __require("fs");
-    var core10;
+    var core11;
     if (process.platform === "win32" || global.TESTING_WINDOWS) {
-      core10 = require_windows();
+      core11 = require_windows();
     } else {
-      core10 = require_mode();
+      core11 = require_mode();
     }
     module.exports = isexe;
     isexe.sync = sync;
@@ -27648,7 +27648,7 @@ var require_isexe = __commonJS({
           });
         });
       }
-      core10(path4, options || {}, function(er, is) {
+      core11(path4, options || {}, function(er, is) {
         if (er) {
           if (er.code === "EACCES" || options && options.ignoreErrors) {
             er = null;
@@ -27660,7 +27660,7 @@ var require_isexe = __commonJS({
     }
     function sync(path4, options) {
       try {
-        return core10.sync(path4, options || {});
+        return core11.sync(path4, options || {});
       } catch (er) {
         if (options && options.ignoreErrors || er.code === "EACCES") {
           return false;
@@ -33026,7 +33026,7 @@ var require_util9 = __commonJS({
     var { redirectStatusSet, referrerPolicyTokens, badPortsSet } = require_constants9();
     var { getGlobalOrigin } = require_global3();
     var { collectAnHTTPQuotedString, parseMIMEType } = require_data_url();
-    var { performance: performance9 } = __require("node:perf_hooks");
+    var { performance: performance10 } = __require("node:perf_hooks");
     var { ReadableStreamFrom, isValidHTTPToken, normalizedMethodRecordsBase } = require_util8();
     var assert3 = __require("node:assert");
     var { isUint8Array } = __require("node:util/types");
@@ -33181,7 +33181,7 @@ var require_util9 = __commonJS({
       };
     }
     function coarsenedSharedCurrentTime(crossOriginIsolatedCapability) {
-      return coarsenTime(performance9.now(), crossOriginIsolatedCapability);
+      return coarsenTime(performance10.now(), crossOriginIsolatedCapability);
     }
     function createOpaqueTimingInfo(timingInfo) {
       return {
@@ -76453,7 +76453,7 @@ var require_core3 = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     var id_1 = require_id();
     var ref_1 = require_ref();
-    var core10 = [
+    var core11 = [
       "$schema",
       "$id",
       "$defs",
@@ -76463,7 +76463,7 @@ var require_core3 = __commonJS({
       id_1.default,
       ref_1.default
     ];
-    exports.default = core10;
+    exports.default = core11;
   }
 });
 
@@ -98334,14 +98334,14 @@ var require_turndown_cjs = __commonJS({
         } else if (node2.nodeType === 1) {
           replacement = replacementForNode.call(self2, node2);
         }
-        return join27(output, replacement);
+        return join28(output, replacement);
       }, "");
     }
     function postProcess(output) {
       var self2 = this;
       this.rules.forEach(function(rule) {
         if (typeof rule.append === "function") {
-          output = join27(output, rule.append(self2.options));
+          output = join28(output, rule.append(self2.options));
         }
       });
       return output.replace(/^[\t\r\n]+/, "").replace(/[\t\r\n\s]+$/, "");
@@ -98353,7 +98353,7 @@ var require_turndown_cjs = __commonJS({
       if (whitespace.leading || whitespace.trailing) content = content.trim();
       return whitespace.leading + rule.replacement(content, node2, this.options) + whitespace.trailing;
     }
-    function join27(output, replacement) {
+    function join28(output, replacement) {
       var s1 = trimTrailingNewlines(output);
       var s2 = trimLeadingNewlines(replacement);
       var nls = Math.max(output.length - s1.length, replacement.length - s2.length);
@@ -103144,9 +103144,9 @@ var init_file_type = __esm({
 });
 
 // main.ts
-import { existsSync as existsSync8, readdirSync as readdirSync2 } from "node:fs";
+import { existsSync as existsSync9, readdirSync as readdirSync2 } from "node:fs";
 import { readFile as readFile5 } from "node:fs/promises";
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 
 // node_modules/.pnpm/package-manager-detector@1.8.0/node_modules/package-manager-detector/dist/commands.mjs
 function splitRunArgs(args2, valueFlags = []) {
@@ -104019,6 +104019,22 @@ var providers = {
       }
     }
   }),
+  azure: provider({
+    displayName: "Azure OpenAI",
+    // the resource name is half the endpoint URL and the deployment is the model
+    // id, so both are as load-bearing as the key. only the key is sensitive.
+    envVars: ["AZURE_API_KEY", "AZURE_RESOURCE_NAME", "AZURE_DEPLOYMENT"],
+    models: {
+      // single routing entry — the real model is the customer's deployment name,
+      // read from AZURE_DEPLOYMENT at run time. see ModelRouting docs for why
+      // Azure can't be cataloged even though models.dev lists it.
+      byok: {
+        displayName: "Azure OpenAI",
+        resolve: "azure",
+        routing: "azure"
+      }
+    }
+  }),
   "openai-compatible": provider({
     // "Custom" is the picker group, "OpenAI-compatible" the entry under it, so the
     // menu reads `Custom › OpenAI-compatible` and a second custom backend (a
@@ -104244,6 +104260,11 @@ function getModelEnvVars(slug2) {
   }
   return providerConfig.envVars.slice();
 }
+function getModelManagedCredentials(slug2) {
+  const parsed2 = parseModel(slug2);
+  const providerConfig = providers[parsed2.provider];
+  return providerConfig?.managedCredentials?.slice() ?? [];
+}
 var modelAliases = Object.entries(providers).flatMap(
   ([providerKey, config3]) => Object.entries(config3.models).map(([modelId, def]) => ({
     slug: `${providerKey}/${modelId}`,
@@ -104341,6 +104362,13 @@ function isOssAllowedModel(slug2) {
 }
 var BEDROCK_MODEL_ID_ENV = "BEDROCK_MODEL_ID";
 var VERTEX_MODEL_ID_ENV = "VERTEX_MODEL_ID";
+var AZURE_PROVIDER = "azure";
+var AZURE_RESOURCE_NAME_ENV = "AZURE_RESOURCE_NAME";
+var AZURE_API_KEY_ENV = "AZURE_API_KEY";
+var AZURE_DEPLOYMENT_ENV = "AZURE_DEPLOYMENT";
+var AZURE_CONTEXT_ENV = "AZURE_CONTEXT";
+var AZURE_MAX_OUTPUT_ENV = "AZURE_MAX_OUTPUT";
+var AZURE_USE_CHAT_COMPLETIONS_ENV = "AZURE_USE_CHAT_COMPLETIONS";
 var OPENAI_COMPATIBLE_PROVIDER = "openai-compatible";
 var OPENAI_COMPATIBLE_BASE_URL_ENV = "OPENAI_COMPATIBLE_BASE_URL";
 var OPENAI_COMPATIBLE_API_KEY_ENV = "OPENAI_COMPATIBLE_API_KEY";
@@ -104360,6 +104388,8 @@ function formatMcpToolRef(agentId, toolName) {
   switch (agentId) {
     case "claude":
       return `mcp__${pullfrogMcpName}__${toolName}`;
+    case "codex":
+      return `${pullfrogMcpName}__${toolName}`;
     case "opencode":
       return `${pullfrogMcpName}_${toolName}`;
     default:
@@ -104390,6 +104420,11 @@ var DEFAULT_ACTIVITY_TIMEOUT_MS = 3e5;
 var AGENT_ACTIVITY_TIMEOUT_MS = 9e5;
 var AGENT_FIRST_EVENT_TIMEOUT_MS = 12e4;
 var DEFAULT_ACTIVITY_CHECK_INTERVAL_MS = 5e3;
+function watchdogBudgetMs(compiled, envVar) {
+  const raw2 = Number(process.env[envVar]);
+  if (!Number.isFinite(raw2) || raw2 <= 0) return compiled;
+  return Math.min(compiled, raw2);
+}
 var DEBUG_TS_PREFIX = /^(?:\[\d{4}-\d{2}-\d{2}T[^\]]+\]\s+)?/.source;
 var ACTIVITY_NOISE_PATTERNS = [
   new RegExp(`${DEBUG_TS_PREFIX}\\[mcp-proxy\\]`),
@@ -104861,7 +104896,8 @@ import { pipeline } from "node:stream/promises";
 async function installFromNpmTarball(params) {
   const tempDir = process.env.PULLFROG_TEMP_DIR;
   if (!tempDir) throw new Error("PULLFROG_TEMP_DIR is not set");
-  const extractedDir = join(tempDir, "package");
+  const packageRoot = join(tempDir, `npm-${params.packageName.replace(/[^a-z0-9]+/gi, "-")}`);
+  const extractedDir = join(packageRoot, "package");
   const cliPath = join(extractedDir, params.executablePath);
   if (existsSync2(cliPath)) {
     log.debug(`\xBB using cached binary at ${cliPath}`);
@@ -104887,7 +104923,8 @@ async function installFromNpmTarball(params) {
     }
   }
   log.debug(`\xBB installing ${params.packageName}@${resolvedVersion}...`);
-  const tarballPath = join(tempDir, "package.tgz");
+  mkdirSync(packageRoot, { recursive: true });
+  const tarballPath = join(packageRoot, "package.tgz");
   const npmRegistry = process.env.NPM_REGISTRY || "https://registry.npmjs.org";
   let tarballUrl;
   if (params.packageName.startsWith("@")) {
@@ -104907,7 +104944,7 @@ async function installFromNpmTarball(params) {
   await pipeline(response.body, fileStream);
   log.debug(`\xBB downloaded tarball to ${tarballPath}`);
   log.debug(`\xBB extracting tarball...`);
-  const extractResult = spawnSync("tar", ["-xzf", tarballPath, "-C", tempDir], {
+  const extractResult = spawnSync("tar", ["-xzf", tarballPath, "-C", packageRoot], {
     stdio: "pipe",
     encoding: "utf-8"
   });
@@ -104916,9 +104953,6 @@ async function installFromNpmTarball(params) {
       `Failed to extract tarball: ${extractResult.stderr || extractResult.stdout || "Unknown error"}`
     );
   }
-  if (!existsSync2(cliPath)) {
-    throw new Error(`Executable not found in extracted package at ${cliPath}`);
-  }
   if (params.installDependencies) {
     log.debug(`\xBB installing dependencies for ${params.packageName}...`);
     const installResult = spawnSync("npm", ["install", "--production"], {
@@ -104939,6 +104973,9 @@ async function installFromNpmTarball(params) {
     }
     log.debug(`\xBB dependencies installed`);
   }
+  if (!existsSync2(cliPath)) {
+    throw new Error(`Executable not found in extracted package at ${cliPath}`);
+  }
   chmodSync(cliPath, 493);
   log.debug(`\xBB ${params.packageName} installed at ${cliPath}`);
   return cliPath;
@@ -105112,6 +105149,7 @@ function resolveRunAlias(ctx) {
   }
   const model = ctx.resolvedModel;
   if (!model) return void 0;
+  if (model.startsWith(`${AZURE_PROVIDER}/`)) return void 0;
   return modelAliases.find((a) => !a.fallback && a.resolve === model) ?? matchHostedAnthropicAlias(model);
 }
 function ossEffortFloor(ctx) {
@@ -105150,7 +105188,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.57",
+  version: "0.1.60",
   type: "module",
   bin: {
     pullfrog: "dist/cli.mjs",
@@ -105182,6 +105220,8 @@ var package_default = {
     "@clack/prompts": "^1.2.0",
     "@modelcontextprotocol/sdk": "^1.26.0",
     "@opencode-ai/sdk": "1.18.5",
+    "@openai/codex": "0.147.0",
+    "@openai/codex-sdk": "0.147.0",
     "@octokit/plugin-throttling": "^11.0.3",
     "@octokit/rest": "^22.0.0",
     "@octokit/webhooks-types": "^7.6.1",
@@ -107257,7 +107297,7 @@ var claude = agent({
       if ((isBedrockRoute || isVertexRoute2) && specifier && effort.alias?.effort) {
         applyHostedEffortCapabilities({ env: env2, modelId: specifier, levels: effort.alias.effort });
       }
-      if (env2.CLAUDE_CODE_OAUTH_TOKEN && !isBedrockRoute && env2.ANTHROPIC_API_KEY) {
+      if (env2.CLAUDE_CODE_OAUTH_TOKEN && !isBedrockRoute && !isVertexRoute2 && !env2.ANTHROPIC_BASE_URL && !env2.ANTHROPIC_AUTH_TOKEN && env2.ANTHROPIC_API_KEY) {
         const preflight = await preflightClaudeSubscription({
           token: env2.CLAUDE_CODE_OAUTH_TOKEN,
           model
@@ -107303,13 +107343,782 @@ var claude = agent({
   }
 });
 
-// agents/opencode.ts
+// agents/codex.ts
 var core2 = __toESM(require_core(), 1);
-import { spawn as nodeSpawn2 } from "node:child_process";
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync6, readFileSync as readFileSync2, writeFileSync as writeFileSync5 } from "node:fs";
 import { join as join6 } from "node:path";
 import { performance as performance6 } from "node:perf_hooks";
 
+// utils/codexHome.ts
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync4 } from "node:fs";
+import { homedir as homedir2, userInfo } from "node:os";
+import { join as join5 } from "node:path";
+
+// utils/codexOAuth.ts
+function decodeJwtExpMs(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  let payload;
+  try {
+    payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+  if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp)) return null;
+  return payload.exp * 1e3;
+}
+function parseCodexAuthBody(raw2) {
+  let parsed2;
+  try {
+    parsed2 = JSON.parse(raw2);
+  } catch {
+    return null;
+  }
+  if (!parsed2 || typeof parsed2 !== "object") return null;
+  const v = parsed2;
+  if (v.auth_mode !== "chatgpt") return null;
+  const tokens = v.tokens;
+  if (!tokens || typeof tokens !== "object") return null;
+  const t = tokens;
+  if (typeof t.access_token !== "string" || t.access_token.length === 0) return null;
+  if (typeof t.refresh_token !== "string" || t.refresh_token.length === 0) return null;
+  return {
+    auth_mode: "chatgpt",
+    ...typeof v.refresh_rejected_at === "string" ? { refresh_rejected_at: v.refresh_rejected_at } : {},
+    tokens: {
+      access_token: t.access_token,
+      refresh_token: t.refresh_token,
+      ...typeof t.id_token === "string" ? { id_token: t.id_token } : {},
+      ...typeof t.account_id === "string" ? { account_id: t.account_id } : {}
+    },
+    ...typeof v.last_refresh === "string" ? { last_refresh: v.last_refresh } : {}
+  };
+}
+function stringifyCodexAuthBody(body) {
+  return `${JSON.stringify(body, null, 2)}
+`;
+}
+
+// utils/codexHome.ts
+var CODEX_AUTH_ENV = "CODEX_AUTH_JSON";
+var PULLFROG_DATA_DIR = "/var/lib/pullfrog";
+function isRejectedChain(body) {
+  if (!body.refresh_rejected_at) return false;
+  log.warning(
+    `\xBB ${CODEX_AUTH_ENV} was rejected by OpenAI at ${body.refresh_rejected_at} and cannot be refreshed \u2014 re-run \`npx pullfrog auth codex\`. skipping it for this run.`
+  );
+  return true;
+}
+function installCodexAuth() {
+  const raw2 = process.env[CODEX_AUTH_ENV];
+  if (!raw2) return null;
+  const body = parseCodexAuthBody(raw2);
+  if (!body) {
+    log.warning(`\xBB ${CODEX_AUTH_ENV} present but malformed; ignoring`);
+    return null;
+  }
+  if (isRejectedChain(body)) return null;
+  const expiresMs = decodeJwtExpMs(body.tokens.access_token) ?? 0;
+  const xdgDataHome = resolveDataHome();
+  const opencodeDir = join5(xdgDataHome, "opencode");
+  const authPath = join5(opencodeDir, "auth.json");
+  const opencodeAuth = {
+    openai: {
+      type: "oauth",
+      refresh: body.tokens.refresh_token,
+      access: body.tokens.access_token,
+      expires: expiresMs,
+      ...body.tokens.account_id ? { accountId: body.tokens.account_id } : {}
+    }
+  };
+  mkdirSync5(opencodeDir, { recursive: true });
+  writeFileSync4(authPath, `${JSON.stringify(opencodeAuth, null, 2)}
+`, { mode: 384 });
+  process.env.XDG_DATA_HOME = xdgDataHome;
+  log.info(`\xBB installed Codex auth at ${authPath}`);
+  return {
+    authPath,
+    xdgDataHome,
+    originalRefresh: body.tokens.refresh_token,
+    originalIdToken: body.tokens.id_token
+  };
+}
+function installCodexHome() {
+  const raw2 = process.env[CODEX_AUTH_ENV];
+  if (!raw2) return null;
+  const body = parseCodexAuthBody(raw2);
+  if (!body) {
+    log.warning(`\xBB ${CODEX_AUTH_ENV} present but malformed; ignoring`);
+    return null;
+  }
+  if (isRejectedChain(body)) return null;
+  if (!body.tokens.id_token) {
+    log.warning(
+      `\xBB ${CODEX_AUTH_ENV} carries no id_token \u2014 the codex CLI cannot load it. re-run \`npx pullfrog auth codex\` to mint a complete credential.`
+    );
+    return null;
+  }
+  const codexHome = join5(resolveDataHome(), "codex");
+  const authPath = join5(codexHome, "auth.json");
+  mkdirSync5(codexHome, { recursive: true });
+  writeFileSync4(authPath, stringifyCodexAuthBody(body), { mode: 384 });
+  log.info(`\xBB installed Codex auth at ${authPath}`);
+  return { codexHome, authPath, originalRefresh: body.tokens.refresh_token };
+}
+function resolveDataHome() {
+  if (process.env.CI !== "true") return join5(homedir2(), ".local", "share");
+  bootstrapPullfrogDataDir();
+  return PULLFROG_DATA_DIR;
+}
+function bootstrapPullfrogDataDir() {
+  const user = userInfo().username;
+  let primaryGroup;
+  try {
+    primaryGroup = execFileSync3("id", ["-gn", user], { stdio: "pipe", encoding: "utf-8" }).trim();
+  } catch {
+    primaryGroup = user;
+  }
+  try {
+    execFileSync3("sudo", ["-n", "mkdir", "-p", PULLFROG_DATA_DIR], { stdio: "pipe" });
+    execFileSync3("sudo", ["-n", "chown", `${user}:${primaryGroup}`, PULLFROG_DATA_DIR], {
+      stdio: "pipe"
+    });
+    execFileSync3("sudo", ["-n", "chmod", "700", PULLFROG_DATA_DIR], { stdio: "pipe" });
+  } catch (err) {
+    throw new Error(
+      `failed to bootstrap ${PULLFROG_DATA_DIR} (required for codex auth in CI): ${err instanceof Error ? err.message : String(err)}. the MCP shell's mount-namespace sandbox cannot protect the auth file when it lives under $HOME, and silently falling back would contradict the "three independent layers" claim in wiki/codex-auth.md. passwordless sudo is required for codex auth on this runner \u2014 either configure it, or remove CODEX_AUTH_JSON from the run.`
+    );
+  }
+}
+
+// utils/secrets.ts
+var SENSITIVE_PATTERNS = [
+  /_KEY$/i,
+  /_SECRET$/i,
+  /_TOKEN$/i,
+  /_PASSWORD$/i,
+  /_CREDENTIAL$/i
+];
+function isSensitiveEnvName(key) {
+  return SENSITIVE_PATTERNS.some((p) => p.test(key));
+}
+var SAFE_ENV_PREFIXES = ["GITHUB_", "RUNNER_", "JAVA_HOME_", "GOROOT_"];
+var SAFE_ENV_NAMES = /* @__PURE__ */ new Set([
+  // system
+  "CI",
+  "HOME",
+  "LANG",
+  "LOGNAME",
+  "PATH",
+  "SHELL",
+  "SHLVL",
+  "TERM",
+  "TMPDIR",
+  "TZ",
+  "USER",
+  "XDG_CONFIG_HOME",
+  "XDG_RUNTIME_DIR",
+  "DEBIAN_FRONTEND",
+  // runner image toolchain
+  "ACCEPT_EULA",
+  "AGENT_TOOLSDIRECTORY",
+  "ANDROID_HOME",
+  "ANDROID_NDK",
+  "ANDROID_NDK_HOME",
+  "ANDROID_NDK_LATEST_HOME",
+  "ANDROID_NDK_ROOT",
+  "ANDROID_SDK_ROOT",
+  "ANT_HOME",
+  "AZURE_EXTENSION_DIR",
+  "BOOTSTRAP_HASKELL_NONINTERACTIVE",
+  "CHROME_BIN",
+  "CHROMEWEBDRIVER",
+  "CONDA",
+  "DOTNET_MULTILEVEL_LOOKUP",
+  "DOTNET_NOLOGO",
+  "DOTNET_SKIP_FIRST_TIME_EXPERIENCE",
+  "EDGEWEBDRIVER",
+  "GECKOWEBDRIVER",
+  "GHCUP_INSTALL_BASE_PREFIX",
+  "GRADLE_HOME",
+  "JAVA_HOME",
+  "HOMEBREW_CLEANUP_PERIODIC_FULL_DAYS",
+  "HOMEBREW_NO_AUTO_UPDATE",
+  "ImageOS",
+  "ImageVersion",
+  "NVM_DIR",
+  "PIPX_BIN_DIR",
+  "PIPX_HOME",
+  "PSModulePath",
+  "SELENIUM_JAR_PATH",
+  "SGX_AESM_ADDR",
+  "SWIFT_PATH",
+  "VCPKG_INSTALLATION_ROOT"
+]);
+var _userAllowlist = null;
+function setEnvAllowlist(raw2) {
+  const names = raw2.split("\n").map((line) => line.trim()).filter(Boolean);
+  _userAllowlist = new Set(names);
+}
+function isSafeEnvVar(key) {
+  if (SAFE_ENV_NAMES.has(key)) return true;
+  return SAFE_ENV_PREFIXES.some((p) => key.startsWith(p));
+}
+var WORKFLOW_COMMAND_ENV_NAMES = [
+  "GITHUB_ENV",
+  "GITHUB_PATH",
+  "GITHUB_OUTPUT",
+  "GITHUB_STATE",
+  "GITHUB_STEP_SUMMARY",
+  // dropping the five paths above but keeping RUNNER_TEMP would be theatre:
+  // the file-command files live in `$RUNNER_TEMP/_runner_file_commands/`, so the
+  // directory is one `ls` away. nothing in the install path reads it (only our
+  // own leak-surface wipe in `setup.ts`, which runs in the parent), and package
+  // managers use TMPDIR.
+  "RUNNER_TEMP"
+];
+function filterEnvForUntrustedCode() {
+  const env2 = filterEnv();
+  for (const name of WORKFLOW_COMMAND_ENV_NAMES) delete env2[name];
+  return env2;
+}
+function filterEnv() {
+  const filtered = {};
+  for (const [key, value2] of Object.entries(process.env)) {
+    if (value2 === void 0) continue;
+    const userAllowed = _userAllowlist?.has(key) ?? false;
+    if (isSensitiveEnvName(key) && !userAllowed) continue;
+    if (isSafeEnvVar(key) || userAllowed) {
+      filtered[key] = value2;
+    }
+  }
+  return filtered;
+}
+function resolveEnv(mode) {
+  if (mode === "inherit") {
+    return process.env;
+  }
+  if (mode === "restricted" || mode === void 0) {
+    return filterEnv();
+  }
+  return { ...filterEnv(), ...mode };
+}
+
+// agents/codex.ts
+var CODEX_TARGETS = {
+  "linux-x64": "x86_64-unknown-linux-musl",
+  "linux-arm64": "aarch64-unknown-linux-musl",
+  "darwin-x64": "x86_64-apple-darwin",
+  "darwin-arm64": "aarch64-apple-darwin",
+  "win32-x64": "x86_64-pc-windows-msvc",
+  "win32-arm64": "aarch64-pc-windows-msvc"
+};
+async function installCodexCli() {
+  const target = CODEX_TARGETS[`${process.platform}-${process.arch}`];
+  if (!target) {
+    throw new Error(`the codex CLI ships no binary for ${process.platform}-${process.arch}`);
+  }
+  const binary = process.platform === "win32" ? "codex.exe" : "codex";
+  return await installFromNpmTarball({
+    packageName: "@openai/codex",
+    version: getDevDependencyVersion("@openai/codex"),
+    executablePath: `node_modules/@openai/codex-${process.platform}-${process.arch}/vendor/${target}/bin/${binary}`,
+    installDependencies: true
+  });
+}
+var CODEX_DISABLED_FEATURES = [
+  // browser / desktop control — network reach and arbitrary JS
+  "browser_use",
+  "browser_use_external",
+  "browser_use_full_cdp_access",
+  "computer_use",
+  "in_app_browser",
+  // third-party code loaded into the agent process
+  "plugins",
+  "remote_plugin",
+  "plugin_sharing",
+  "skill_mcp_dependency_install",
+  // lifecycle hooks run commands sourced from repo config, which a PR can edit
+  "hooks",
+  // connectors
+  "apps",
+  // ungated subagent fan-out (see the file header)
+  "multi_agent",
+  "multi_agent_v2"
+];
+var CODEX_SHELL_FEATURES = ["shell_tool", "unified_exec"];
+function tomlBool(entries, value2) {
+  return entries.map((name) => `${name} = ${value2}`).join("\n");
+}
+function securityOverrideFlags(params) {
+  const shellEnabled = params.ctx.payload.shell === "enabled";
+  const features = [
+    ...CODEX_DISABLED_FEATURES.map((name) => `${name}=false`),
+    ...CODEX_SHELL_FEATURES.map((name) => `${name}=${shellEnabled}`)
+  ];
+  return [
+    "-c",
+    `approval_policy=${JSON.stringify("never")}`,
+    "-c",
+    `sandbox_mode=${JSON.stringify(params.sandboxMode)}`,
+    // the sandbox's EXTENT has to be locked too, not just its mode: a repo
+    // setting `writable_roots = ["/"]` walked straight out of the checkout with
+    // `sandbox_mode` already flag-locked (measured — apply_patch wrote a file
+    // under $HOME).
+    "-c",
+    `sandbox_workspace_write.writable_roots=[${JSON.stringify(params.repoDir)}]`,
+    "-c",
+    "sandbox_workspace_write.network_access=true",
+    // our own MCP server, for a third time in the same class: a repo pointing
+    // `mcp_servers.pullfrog.url` at its own endpoint (measured — `codex mcp get`
+    // reported the repo's URL) turns every pullfrog tool call into an
+    // exfiltration channel, carrying diffs, file contents and cross-repo
+    // learnings to whoever it names.
+    "-c",
+    `mcp_servers.${pullfrogMcpName}.url=${JSON.stringify(params.mcpServerUrl)}`,
+    "-c",
+    `mcp_servers.${pullfrogMcpName}.${APPROVAL_MODE_KEY}=${JSON.stringify("approve")}`,
+    "-c",
+    `mcp_servers.${pullfrogMcpName}.required=true`,
+    "-c",
+    `mcp_servers.${pullfrogMcpName}.tool_timeout_sec=660`,
+    // `enabled` closes the silent-DoS variant: a repo setting it false would
+    // otherwise strip every GitHub tool and leave the agent narrating failure.
+    "-c",
+    `mcp_servers.${pullfrogMcpName}.enabled=true`,
+    // not a boundary, but the same override: a repo silently re-pointing the
+    // model spends the account's money on a pick it never made, and makes the
+    // "Using `…`" run footer a lie about what actually ran.
+    ...params.model ? ["-c", `model=${JSON.stringify(params.model)}`] : [],
+    ...params.effortRung ? ["-c", `model_reasoning_effort=${JSON.stringify(params.effortRung)}`] : [],
+    ...features.flatMap((entry) => ["-c", `features.${entry}`])
+  ];
+}
+var CODEX_EFFORTS = ["minimal", "low", "medium", "high", "xhigh"];
+function resolveCodexModel(ctx) {
+  const specifier = ctx.payload.proxyModel ?? ctx.resolvedModel;
+  if (!specifier) return void 0;
+  try {
+    if (getModelProvider(specifier) === "openai") return stripProviderPrefix(specifier);
+  } catch {
+  }
+  log.warning(`\xBB ${specifier} isn't an OpenAI model \u2014 running codex on its own default instead`);
+  return void 0;
+}
+var APPROVAL_MODE_KEY = "default_tools_approval_mode";
+var APPROVE_TOOLS = `${APPROVAL_MODE_KEY} = "approve"`;
+function repoMcpApprovals(repoDir) {
+  const path4 = join6(repoDir, ".codex", "config.toml");
+  if (!existsSync4(path4)) return [];
+  const out = [];
+  let section = [];
+  let isServerTable = false;
+  function flush() {
+    if (section.length === 0) return;
+    const declared = section.some((line) => line.trimStart().startsWith(APPROVAL_MODE_KEY));
+    if (isServerTable && !declared) section.splice(1, 0, APPROVE_TOOLS);
+    out.push(...section, "");
+    section = [];
+  }
+  for (const line of readFileSync2(path4, "utf8").split("\n")) {
+    const header = line.trim().match(/^\[(?<key>[^\]]+)\]$/);
+    if (!header?.groups) {
+      if (section.length > 0) section.push(line);
+      continue;
+    }
+    flush();
+    const key = header.groups.key.trim();
+    if (!key.startsWith("mcp_servers.")) continue;
+    const name = key.slice("mcp_servers.".length).replace(/^"([^"]*)"/, "$1");
+    if (name === pullfrogMcpName || name.startsWith(`${pullfrogMcpName}.`)) continue;
+    isServerTable = !name.includes(".");
+    section = [line.trim()];
+  }
+  flush();
+  return out;
+}
+function warnIfNativeEditsUnavailable(ctx) {
+  if (process.platform !== "linux" || ctx.payload.shell !== "disabled") return;
+  log.warning(
+    "\xBB this run cannot change files: codex's native write tool depends on bubblewrap, which Ubuntu 24.04 blocks (https://github.com/openai/codex/issues/29908), and the MCP shell is disabled for this repo. read-only work is unaffected \u2014 set `shell: restricted` if the agent needs to edit anything."
+  );
+}
+function writeCodexConfig(params) {
+  const shellEnabled = params.ctx.payload.shell === "enabled";
+  const sandboxMode = params.ctx.payload.push === "disabled" ? "read-only" : "workspace-write";
+  const repoDir = process.cwd();
+  const config3 = [
+    "# written by pullfrog",
+    // "never" keeps the run non-interactive WITHOUT
+    // --dangerously-bypass-approvals-and-sandbox, which would also switch the
+    // sandbox off and let the native apply_patch tool write anywhere.
+    'approval_policy = "never"',
+    `sandbox_mode = ${JSON.stringify(sandboxMode)}`,
+    // matches opencode's `webfetch: "allow"` — research is part of the job and
+    // neither harness gates it on a permission.
+    'web_search = "live"',
+    ...params.model ? [`model = ${JSON.stringify(params.model)}`] : [],
+    ...params.effortRung ? [`model_reasoning_effort = ${JSON.stringify(params.effortRung)}`] : [],
+    "",
+    "[features]",
+    tomlBool(CODEX_DISABLED_FEATURES, false),
+    tomlBool(CODEX_SHELL_FEATURES, shellEnabled),
+    "",
+    "[sandbox_workspace_write]",
+    "network_access = true",
+    // the checkout, named explicitly rather than left to `workspace-write` to
+    // imply. does NOT fix the Linux native-write failure — nothing here does;
+    // see wiki/codex-agent.md "The Linux native-write blocker".
+    `writable_roots = [${JSON.stringify(repoDir)}]`,
+    "",
+    `[mcp_servers.${pullfrogMcpName}]`,
+    `url = ${JSON.stringify(params.ctx.mcpServerUrl)}`,
+    // codex's default MCP approval mode PROMPTS for anything it can't read as
+    // read-only, and a `codex exec` run has nobody to answer — the call comes
+    // back "user cancelled MCP tool call" and the agent silently accomplishes
+    // nothing. our own server is the trusted one; the boundary is what we
+    // register, not a second confirmation.
+    APPROVE_TOOLS,
+    // a run whose GitHub tools never registered can't do its job, so fail loudly
+    // rather than let the agent improvise without them.
+    "required = true",
+    // mirrors the opencode harness's 660s: `checkout_pr` runs a multi-minute
+    // fetch on large repos and enforces its own 600s deadline, so a shorter
+    // client abort turns a working checkout into a spurious tool error.
+    "tool_timeout_sec = 660",
+    "",
+    ...repoMcpApprovals(repoDir),
+    // UNTRUSTED, deliberately, and this one line is the whole config-precedence
+    // boundary. Codex loads `<repo>/.codex/config.toml` as a layer that
+    // OUTRANKS ours (project 25 vs user 20), and its denylist strips none of
+    // `sandbox_mode`, `approval_policy`, `features` or `mcp_servers` — so a
+    // fork PR could ship a config re-enabling the native shell. Marking the
+    // checkout untrusted makes that layer load `disabled`, closing the class
+    // outright rather than key by key: `RawMcpServerConfig` alone has ~26
+    // fields and enumeration can never finish.
+    //
+    // It costs nothing. `codex exec`'s only startup gate is a GIT-REPO check
+    // (`exec/src/lib.rs:796` — `get_git_repo_root(...).is_none()`, whose error
+    // text unhelpfully says "Not inside a trusted directory"), so an untrusted
+    // checkout still runs. And the repo's own MCP servers survive, because
+    // `repoMcpApprovals` above copies them into OUR layer — which is why that
+    // copying exists at all.
+    //
+    // Measured both ways at 0.147.0: `trusted` → the repo's `model` won;
+    // `untrusted` → it did not, and the run proceeded normally.
+    `[projects.${JSON.stringify(repoDir)}]`,
+    'trust_level = "untrusted"',
+    ""
+  ].join("\n");
+  writeFileSync5(join6(params.codexHome, "config.toml"), config3, { mode: 384 });
+  log.info(`\xBB codex config: sandbox=${sandboxMode}, nativeShell=${shellEnabled}`);
+}
+function toTodoWriteInput(item) {
+  return {
+    todos: item.items.map((todo, index) => ({
+      id: String(index),
+      content: todo.text,
+      status: todo.completed ? "completed" : "pending"
+    }))
+  };
+}
+async function runCodex(params) {
+  const startTime = performance6.now();
+  const thinkingTimer = new ThinkingTimer();
+  const output = new TailBuffer(DEFAULT_MAX_RETAINED_BYTES);
+  const recentStderr = [];
+  let eventCount = 0;
+  let finalOutput = "";
+  let threadId;
+  let turnError = null;
+  let lastProviderError = null;
+  let stdoutBuffer = "";
+  const tokens = { input: 0, cacheRead: 0, output: 0 };
+  function buildUsage2() {
+    if (tokens.input === 0 && tokens.output === 0) return void 0;
+    return {
+      agent: "codex",
+      inputTokens: tokens.input,
+      outputTokens: tokens.output,
+      cacheReadTokens: tokens.cacheRead || void 0
+    };
+  }
+  function onItem(item, phase) {
+    switch (item.type) {
+      case "agent_message":
+        if (phase === "completed" && item.text.trim()) {
+          finalOutput = item.text.trim();
+          log.box(finalOutput, { title: "Pullfrog" });
+        }
+        return;
+      case "reasoning":
+        if (phase === "completed" && item.text.trim()) {
+          log.box(item.text.trim(), { title: "Pullfrog" });
+        }
+        return;
+      case "command_execution":
+        if (phase === "started") {
+          thinkingTimer.markToolCall();
+          log.toolCall({ toolName: "shell", input: { command: item.command } });
+          return;
+        }
+        thinkingTimer.markToolResult();
+        log.startGroup("shell output");
+        log.info(item.aggregated_output || "");
+        log.endGroup();
+        return;
+      case "mcp_tool_call":
+        if (phase === "started") {
+          thinkingTimer.markToolCall();
+          params.onToolUse?.({ toolName: item.tool, input: item.arguments });
+          log.toolCall({ toolName: `${item.server}__${item.tool}`, input: item.arguments });
+          if (item.tool.includes("report_progress")) params.todoTracker?.cancel();
+          return;
+        }
+        thinkingTimer.markToolResult();
+        if (item.error) log.info(`\xBB tool error: ${item.error.message}`);
+        return;
+      case "file_change":
+        if (phase === "completed") {
+          const paths = item.changes.map((c) => `${c.kind} ${c.path}`).join(", ");
+          log.info(`\xBB apply_patch (${item.status}): ${paths}`);
+        }
+        return;
+      case "web_search":
+        if (phase === "started") log.toolCall({ toolName: "web_search", input: item.query });
+        return;
+      case "todo_list":
+        if (params.todoTracker?.enabled) params.todoTracker.update(toTodoWriteInput(item));
+        return;
+      case "error":
+        log.info(`\xBB ${item.message}`);
+        return;
+      default:
+        item;
+    }
+  }
+  function onEvent(event) {
+    switch (event.type) {
+      case "thread.started":
+        threadId = event.thread_id;
+        return;
+      case "turn.completed":
+        tokens.input += event.usage.input_tokens ?? 0;
+        tokens.cacheRead += event.usage.cached_input_tokens ?? 0;
+        tokens.output += event.usage.output_tokens ?? 0;
+        return;
+      case "turn.failed":
+        turnError = event.error.message;
+        log.info(`\xBB turn failed: ${turnError}`);
+        return;
+      case "error":
+        turnError = event.message;
+        log.info(`\xBB codex error: ${event.message}`);
+        return;
+      case "item.started":
+        onItem(event.item, "started");
+        return;
+      case "item.completed":
+        onItem(event.item, "completed");
+        return;
+      case "item.updated":
+        if (event.item.type === "todo_list") onItem(event.item, "started");
+        return;
+      case "turn.started":
+        return;
+      default:
+        event;
+    }
+  }
+  try {
+    const result = await spawn({
+      cmd: params.cliPath,
+      args: params.args,
+      cwd: params.cwd,
+      env: params.env,
+      activityTimeout: AGENT_ACTIVITY_TIMEOUT_MS,
+      onActivityTimeout: params.onActivityTimeout,
+      // stdin MUST be `ignore`: codex reads a piped stdin as an extra `<stdin>`
+      // prompt block and blocks on EOF, so an inherited pipe hangs the run
+      // before the first model call.
+      stdio: ["ignore", "pipe", "pipe"],
+      killGroup: true,
+      retain: "none",
+      onStdout: (chunk) => {
+        output.append(chunk);
+        markActivity();
+        stdoutBuffer += chunk;
+        const lines = stdoutBuffer.split("\n");
+        stdoutBuffer = lines.pop() || "";
+        for (const line of lines) {
+          const trimmed = line.trim();
+          if (!trimmed) continue;
+          let event;
+          try {
+            event = JSON.parse(trimmed);
+          } catch {
+            log.debug(`\xBB non-JSON stdout line: ${trimmed.substring(0, 200)}`);
+            continue;
+          }
+          eventCount++;
+          log.debug(JSON.stringify(event, null, 2));
+          const idleMs = getIdleMs();
+          if (idleMs > 1e4) {
+            log.info(
+              `\xBB no activity for ${(idleMs / 1e3).toFixed(1)}s (${eventCount} events processed so far)`
+            );
+          }
+          markActivity();
+          onEvent(event);
+        }
+      },
+      onStderr: (chunk) => {
+        const trimmed = chunk.trim();
+        if (!trimmed) return;
+        recentStderr.push(trimmed);
+        if (recentStderr.length > MAX_STDERR_LINES) recentStderr.shift();
+        const match3 = findProviderErrorMatch(trimmed);
+        if (match3) {
+          lastProviderError = match3.label;
+          log.info(`\xBB provider error detected (${match3.label}): ${match3.excerpt}`);
+        } else {
+          log.debug(trimmed);
+        }
+      }
+    });
+    const duration4 = performance6.now() - startTime;
+    log.info(`\xBB codex completed in ${Math.round(duration4)}ms with exit code ${result.exitCode}`);
+    const usage = buildUsage2();
+    if (usage) {
+      logTokenTable({
+        input: tokens.input - tokens.cacheRead,
+        cacheRead: tokens.cacheRead,
+        cacheWrite: 0,
+        output: tokens.output
+      });
+    }
+    if (result.exitCode !== 0 || turnError) {
+      const stderrSnapshot = recentStderr.join("\n");
+      const error52 = turnError || stderrSnapshot || lastProviderError && `provider error: ${lastProviderError}` || `unknown error - no output from Codex CLI (exit ${result.exitCode})`;
+      log.error(`codex exited with code ${result.exitCode}: ${error52}`);
+      return { success: false, output: finalOutput || output.toString(), error: error52, usage, threadId };
+    }
+    return { success: true, output: finalOutput || output.toString(), usage, threadId };
+  } catch (error52) {
+    const duration4 = performance6.now() - startTime;
+    const message = error52 instanceof Error ? error52.message : String(error52);
+    const isActivityTimeout = error52 instanceof SpawnTimeoutError && error52.code === SPAWN_ACTIVITY_TIMEOUT_CODE;
+    const diagnosis = lastProviderError ? `likely cause: ${lastProviderError}` : eventCount === 0 ? "codex produced 0 stdout events - check if the API is reachable" : `${eventCount} events were processed before the hang`;
+    log.info(
+      `\xBB codex ${isActivityTimeout ? "hung" : "failed"} after ${(duration4 / 1e3).toFixed(1)}s: ${message}`
+    );
+    log.info(`\xBB diagnosis: ${diagnosis}`);
+    if (recentStderr.length > 0) log.info(`\xBB recent stderr:
+${recentStderr.join("\n")}`);
+    return {
+      success: false,
+      output: finalOutput || output.toString(),
+      error: `${message} [${diagnosis}]`,
+      usage: buildUsage2(),
+      threadId
+    };
+  }
+}
+var codex = agent({
+  name: "codex",
+  install: installCodexCli,
+  run: async (ctx) => {
+    const cliPath = await installCodexCli();
+    warnIfNativeEditsUnavailable(ctx);
+    const codexHomeAuth = installCodexHome();
+    const codexHome = codexHomeAuth?.codexHome ?? join6(ctx.tmpdir, ".codex");
+    mkdirSync6(codexHome, { recursive: true });
+    const effort = resolveRunEffort(ctx);
+    if (effort.rung && !CODEX_EFFORTS.includes(effort.rung)) {
+      log.warning(`\xBB effort ${effort.rung} not sent \u2014 codex doesn't accept that level`);
+    }
+    writeCodexConfig({
+      ctx,
+      codexHome,
+      model: resolveCodexModel(ctx),
+      effortRung: effort.rung && CODEX_EFFORTS.includes(effort.rung) ? effort.rung : void 0
+    });
+    if (codexHomeAuth) {
+      core2.saveState(
+        "codex_writeback",
+        JSON.stringify({
+          apiToken: ctx.apiToken,
+          authPath: codexHomeAuth.authPath,
+          originalRefresh: codexHomeAuth.originalRefresh
+        })
+      );
+    }
+    const baseEnv = ctx.payload.shell === "enabled" ? process.env : filterEnv();
+    const env2 = {
+      ...baseEnv,
+      CODEX_HOME: codexHome,
+      PWD: process.cwd()
+    };
+    delete env2.CODEX_API_KEY;
+    if (codexHomeAuth) {
+      delete env2.OPENAI_API_KEY;
+    } else if (process.env.OPENAI_API_KEY) {
+      env2.CODEX_API_KEY = process.env.OPENAI_API_KEY;
+    }
+    const securityFlags = securityOverrideFlags({
+      ctx,
+      sandboxMode: ctx.payload.push === "disabled" ? "read-only" : "workspace-write",
+      repoDir: process.cwd(),
+      mcpServerUrl: ctx.mcpServerUrl,
+      model: resolveCodexModel(ctx),
+      effortRung: effort.rung && CODEX_EFFORTS.includes(effort.rung) ? effort.rung : void 0
+    });
+    const runnerArgs = { cliPath, cwd: process.cwd(), env: env2, todoTracker: ctx.todoTracker };
+    const initial = await runCodex({
+      ...runnerArgs,
+      args: [...securityFlags, "exec", "--json", ctx.instructions.full],
+      onActivityTimeout: ctx.onActivityTimeout,
+      onToolUse: ctx.onToolUse
+    });
+    const result = await runPostRunRetryLoop({
+      ctx,
+      initialResult: initial,
+      initialUsage: initial.usage,
+      reflectionPrompt: buildReflectionPrompt(ctx.toolState),
+      // a resume needs the thread codex recorded. without one there is nothing
+      // to continue, and `resume --last` would be worse than not resuming: it
+      // picks the newest recorded session in this cwd, which on a self-hosted
+      // runner with a shared CODEX_HOME is somebody else's run.
+      canResume: (r) => r.threadId !== void 0,
+      resume: async (c) => runCodex({
+        ...runnerArgs,
+        args: [
+          ...securityFlags,
+          "exec",
+          "resume",
+          "--json",
+          c.previousResult.threadId ?? "",
+          c.prompt
+        ]
+      })
+    });
+    if (result.success) {
+      await ctx.todoTracker?.flush();
+    } else {
+      ctx.todoTracker?.cancel();
+    }
+    return result;
+  }
+});
+
+// agents/opencode.ts
+var core3 = __toESM(require_core(), 1);
+import { spawn as nodeSpawn2 } from "node:child_process";
+import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join7 } from "node:path";
+import { performance as performance7 } from "node:perf_hooks";
+
 // node_modules/.pnpm/@opencode-ai+sdk@1.18.5/node_modules/@opencode-ai/sdk/dist/v2/gen/core/serverSentEvents.gen.js
 var createSseClient = ({ onRequest, onSseError, onSseEvent, responseTransformer, responseValidator, sseDefaultRetryDelay, sseMaxRetryAttempts, sseMaxRetryDelay, sseSleepFn, url: url4, ...options }) => {
   let lastEventId;
@@ -112716,114 +113525,6 @@ var import_cross_spawn = __toESM(require_cross_spawn(), 1);
 // agents/opencode.ts
 var import_undici = __toESM(require_undici2(), 1);
 
-// utils/codexHome.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync4 } from "node:fs";
-import { homedir as homedir2, userInfo } from "node:os";
-import { join as join5 } from "node:path";
-
-// utils/codexOAuth.ts
-function decodeJwtExpMs(token) {
-  const parts = token.split(".");
-  if (parts.length !== 3) return null;
-  let payload;
-  try {
-    payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
-  } catch {
-    return null;
-  }
-  if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp)) return null;
-  return payload.exp * 1e3;
-}
-function parseCodexAuthBody(raw2) {
-  let parsed2;
-  try {
-    parsed2 = JSON.parse(raw2);
-  } catch {
-    return null;
-  }
-  if (!parsed2 || typeof parsed2 !== "object") return null;
-  const v = parsed2;
-  if (v.auth_mode !== "chatgpt") return null;
-  const tokens = v.tokens;
-  if (!tokens || typeof tokens !== "object") return null;
-  const t = tokens;
-  if (typeof t.access_token !== "string" || t.access_token.length === 0) return null;
-  if (typeof t.refresh_token !== "string" || t.refresh_token.length === 0) return null;
-  return {
-    auth_mode: "chatgpt",
-    ...typeof v.refresh_rejected_at === "string" ? { refresh_rejected_at: v.refresh_rejected_at } : {},
-    tokens: {
-      access_token: t.access_token,
-      refresh_token: t.refresh_token,
-      ...typeof t.id_token === "string" ? { id_token: t.id_token } : {},
-      ...typeof t.account_id === "string" ? { account_id: t.account_id } : {}
-    },
-    ...typeof v.last_refresh === "string" ? { last_refresh: v.last_refresh } : {}
-  };
-}
-
-// utils/codexHome.ts
-var CODEX_AUTH_ENV = "CODEX_AUTH_JSON";
-var PULLFROG_DATA_DIR = "/var/lib/pullfrog";
-function installCodexAuth() {
-  const raw2 = process.env[CODEX_AUTH_ENV];
-  if (!raw2) return null;
-  const body = parseCodexAuthBody(raw2);
-  if (!body) {
-    log.warning(`\xBB ${CODEX_AUTH_ENV} present but malformed; ignoring`);
-    return null;
-  }
-  const expiresMs = decodeJwtExpMs(body.tokens.access_token) ?? 0;
-  const xdgDataHome = resolveDataHome();
-  const opencodeDir = join5(xdgDataHome, "opencode");
-  const authPath = join5(opencodeDir, "auth.json");
-  const opencodeAuth = {
-    openai: {
-      type: "oauth",
-      refresh: body.tokens.refresh_token,
-      access: body.tokens.access_token,
-      expires: expiresMs,
-      ...body.tokens.account_id ? { accountId: body.tokens.account_id } : {}
-    }
-  };
-  mkdirSync5(opencodeDir, { recursive: true });
-  writeFileSync4(authPath, `${JSON.stringify(opencodeAuth, null, 2)}
-`, { mode: 384 });
-  process.env.XDG_DATA_HOME = xdgDataHome;
-  log.info(`\xBB installed Codex auth at ${authPath}`);
-  return {
-    authPath,
-    xdgDataHome,
-    originalRefresh: body.tokens.refresh_token
-  };
-}
-function resolveDataHome() {
-  if (process.env.CI !== "true") return join5(homedir2(), ".local", "share");
-  bootstrapPullfrogDataDir();
-  return PULLFROG_DATA_DIR;
-}
-function bootstrapPullfrogDataDir() {
-  const user = userInfo().username;
-  let primaryGroup;
-  try {
-    primaryGroup = execFileSync3("id", ["-gn", user], { stdio: "pipe", encoding: "utf-8" }).trim();
-  } catch {
-    primaryGroup = user;
-  }
-  try {
-    execFileSync3("sudo", ["-n", "mkdir", "-p", PULLFROG_DATA_DIR], { stdio: "pipe" });
-    execFileSync3("sudo", ["-n", "chown", `${user}:${primaryGroup}`, PULLFROG_DATA_DIR], {
-      stdio: "pipe"
-    });
-    execFileSync3("sudo", ["-n", "chmod", "700", PULLFROG_DATA_DIR], { stdio: "pipe" });
-  } catch (err) {
-    throw new Error(
-      `failed to bootstrap ${PULLFROG_DATA_DIR} (required for codex auth in CI): ${err instanceof Error ? err.message : String(err)}. the MCP shell's mount-namespace sandbox cannot protect the auth file when it lives under $HOME, and silently falling back would contradict the "three independent layers" claim in wiki/codex-auth.md. passwordless sudo is required for codex auth on this runner \u2014 either configure it, or remove CODEX_AUTH_JSON from the run.`
-    );
-  }
-}
-
 // utils/worktree.ts
 async function dirtyTrackedPaths(params = {}) {
   const result = await spawn({
@@ -113091,6 +113792,30 @@ function openAICompatibleProvider(model) {
     }
   };
 }
+function azureProvider(model) {
+  const prefix = `${AZURE_PROVIDER}/`;
+  if (!model?.startsWith(prefix)) return {};
+  const deployment = model.slice(prefix.length);
+  return {
+    [AZURE_PROVIDER]: {
+      // always sent: opencode reads it as `Boolean(options?.useCompletionUrls)`,
+      // so `false` and absent are the same, and the deep merge keeps the native
+      // loader's `resourceName` either way.
+      options: {
+        useCompletionUrls: process.env[AZURE_USE_CHAT_COMPLETIONS_ENV]?.trim() === "true"
+      },
+      models: {
+        [deployment]: {
+          name: deployment,
+          limit: {
+            context: Number(process.env[AZURE_CONTEXT_ENV]),
+            output: Number(process.env[AZURE_MAX_OUTPUT_ENV])
+          }
+        }
+      }
+    }
+  };
+}
 var KIMI_ENFORCERLESS_PROVIDERS = ["siliconflow", "together"];
 function kimiOpenRouterProviderOverrides() {
   return Object.fromEntries(
@@ -113182,7 +113907,8 @@ function buildSecurityConfig(ctx, model) {
     // see opencodeShared.ts.
     provider: {
       openrouter: { models: kimiOpenRouterProviderOverrides() },
-      ...openAICompatibleProvider(model)
+      ...openAICompatibleProvider(model),
+      ...azureProvider(model)
     }
   };
   if (model) {
@@ -113350,7 +114076,7 @@ function isModelOutput(ctx, part) {
 }
 async function dispatchEvent(ctx, event) {
   if (event.type === "message.part.updated") {
-    ctx.lastEventAt = performance6.now();
+    ctx.lastEventAt = performance7.now();
     if (isModelOutput(ctx, event.properties.part)) ctx.sawModelOutput = true;
     await onPartUpdated(ctx, event.properties.part);
     return;
@@ -113417,7 +114143,7 @@ async function onToolPart(ctx, part, label, isOrchestrator) {
   if (toolName === "task" && status === "running" && isOrchestrator && !ctx.taskDispatchByCallID.has(toolId)) {
     const input = part.state.input ?? {};
     const dispatched = ctx.labeler.recordTaskDispatch(input);
-    ctx.taskDispatchByCallID.set(toolId, { label: dispatched, startedAt: performance6.now() });
+    ctx.taskDispatchByCallID.set(toolId, { label: dispatched, startedAt: performance7.now() });
     log.info(
       `\xBB dispatching subagent: ${dispatched}` + (input.subagent_type ? ` (subagent_type=${input.subagent_type})` : "")
     );
@@ -113436,6 +114162,7 @@ function processTerminalToolPart(ctx, part, label, isOrchestrator) {
   const callLine = inputFormatted !== "{}" ? `\xBB ${toolName}(${inputFormatted})` : `\xBB ${toolName}()`;
   log.info(withLabel(label, callLine));
   if (isOrchestrator) ctx.loggedToolCallIDs.add(toolId);
+  if (isOrchestrator && toolName.startsWith("pullfrog_")) ctx.mcpToolCalls++;
   if (state.status === "completed") {
     log.debug(withLabel(label, `  output: ${state.output}`));
   } else {
@@ -113447,7 +114174,7 @@ function processTerminalToolPart(ctx, part, label, isOrchestrator) {
   if (toolName === "task") {
     const dispatch = ctx.taskDispatchByCallID.get(toolId);
     if (dispatch) {
-      const dur = ((performance6.now() - dispatch.startedAt) / 1e3).toFixed(1);
+      const dur = ((performance7.now() - dispatch.startedAt) / 1e3).toFixed(1);
       const outputStr = state.status === "completed" ? state.output : "";
       const preview = typeof outputStr === "string" && outputStr.length > 120 ? `${outputStr.slice(0, 120)}\u2026` : outputStr;
       log.info(
@@ -113490,7 +114217,7 @@ function withLabel(label, message) {
   return label === ORCHESTRATOR_LABEL ? message : formatWithLabel(label, message);
 }
 async function runPromptTurn(ctx, params) {
-  const start = performance6.now();
+  const start = performance7.now();
   const turnStartMs = Date.now();
   ctx.currentTurn = newTurn();
   const turn = ctx.currentTurn;
@@ -113524,7 +114251,7 @@ async function runPromptTurn(ctx, params) {
   } catch (err) {
     networkError = err instanceof Error ? err.message : String(err);
   }
-  const durationMs = performance6.now() - start;
+  const durationMs = performance7.now() - start;
   const aggregatedUsage = await aggregateTurnUsage(ctx, turnStartMs);
   const usage = aggregatedUsage ?? buildUsage(turn, assistant);
   const finalText = turn.finalText || extractTextFromParts(returnedParts) || "";
@@ -113674,21 +114401,28 @@ function formatConfigError(name, data) {
   ).join("");
   return `${name}${detail}${bullets}`;
 }
+var WATCHDOG_SALVAGE_PROMPT = "Your previous turn was cut off mid-response by a provider stall. Nothing you had not already submitted through a tool was saved. Continue from where you stopped and submit your work now \u2014 do not restart your analysis.";
 function startInnerActivityWatchdog(params) {
   let fired = false;
+  let everFired = false;
   const id = setInterval(() => {
     if (fired) return;
-    const idleMs = performance6.now() - params.ctx.lastEventAt;
-    const budgetMs = params.ctx.sawModelOutput ? params.timeoutMs : AGENT_FIRST_EVENT_TIMEOUT_MS;
+    const idleMs = performance7.now() - params.ctx.lastEventAt;
+    const compiledMs = params.ctx.sawModelOutput ? params.timeoutMs : AGENT_FIRST_EVENT_TIMEOUT_MS;
+    const budgetMs = everFired ? compiledMs : watchdogBudgetMs(
+      compiledMs,
+      params.ctx.sawModelOutput ? "PULLFROG_E2E_ACTIVITY_TIMEOUT_MS" : "PULLFROG_E2E_FIRST_EVENT_TIMEOUT_MS"
+    );
     if (idleMs <= budgetMs) return;
     fired = true;
+    everFired = true;
     const idleSec = Math.round(idleMs / 1e3);
     params.ctx.diagnostic.idleSec = idleSec;
     params.ctx.diagnostic.sawModelOutput = params.ctx.sawModelOutput;
     log.info(
       params.ctx.sawModelOutput ? `\xBB no opencode events for ${idleSec}s \u2014 aborting in-flight prompt and notifying harness` : `\xBB no opencode events for ${idleSec}s \u2014 the provider never returned a first token; aborting in-flight prompt and notifying harness`
     );
-    params.abortController.abort();
+    params.abortTurn();
     try {
       params.ctx.onActivityTimeout?.();
     } catch (err) {
@@ -113698,7 +114432,22 @@ function startInnerActivityWatchdog(params) {
     }
   }, 5e3);
   id.unref?.();
-  return { stop: () => clearInterval(id) };
+  return {
+    stop: () => clearInterval(id),
+    /**
+     * Start a turn's idle budget from now. The clock must be reset with the
+     * latch: `lastEventAt` only advances on model output, so a turn following a
+     * stall would inherit the full stalled interval and be aborted on the very
+     * next 5s tick — killing the salvage before the provider could answer. It
+     * is the right semantics for an ordinary resume too, whose budget should
+     * not be pre-spent by the post-run gate checks that ran between turns.
+     */
+    armForTurn: () => {
+      fired = false;
+      params.ctx.lastEventAt = performance7.now();
+    },
+    firedThisTurn: () => fired
+  };
 }
 var opencode = agent({
   name: "opencode",
@@ -113717,12 +114466,12 @@ var opencode = agent({
     const model = vertexModel ?? (isBedrockRoute ? `amazon-bedrock/${rawModel}` : rawModel);
     const homeEnv = {
       HOME: ctx.tmpdir,
-      XDG_CONFIG_HOME: join6(ctx.tmpdir, ".config")
+      XDG_CONFIG_HOME: join7(ctx.tmpdir, ".config")
     };
-    const opencodePluginDir = join6(homeEnv.XDG_CONFIG_HOME, "opencode", "plugin");
-    mkdirSync6(opencodePluginDir, { recursive: true });
-    writeFileSync5(
-      join6(opencodePluginDir, PULLFROG_OPENCODE_GATE_PLUGIN_FILENAME),
+    const opencodePluginDir = join7(homeEnv.XDG_CONFIG_HOME, "opencode", "plugin");
+    mkdirSync7(opencodePluginDir, { recursive: true });
+    writeFileSync6(
+      join7(opencodePluginDir, PULLFROG_OPENCODE_GATE_PLUGIN_FILENAME),
       buildOpencodeSubagentGateSource(ctx.subagentDeniedTools)
     );
     const agentBrowserVersion = getDevDependencyVersion("agent-browser");
@@ -113753,12 +114502,13 @@ var opencode = agent({
     if (codexAuth) {
       env2.XDG_DATA_HOME = codexAuth.xdgDataHome;
       delete env2.OPENAI_API_KEY;
-      core2.saveState(
+      core3.saveState(
         "codex_writeback",
         JSON.stringify({
           apiToken: ctx.apiToken,
           authPath: codexAuth.authPath,
-          originalRefresh: codexAuth.originalRefresh
+          originalRefresh: codexAuth.originalRefresh,
+          originalIdToken: codexAuth.originalIdToken
         })
       );
     }
@@ -113809,14 +114559,16 @@ var opencode = agent({
         variant: effort.rung,
         todoTracker: ctx.todoTracker,
         onActivityTimeout: ctx.onActivityTimeout,
+        onTurnRecovered: ctx.onTurnRecovered,
         onToolUse: ctx.onToolUse,
         currentTurn: null,
         eventCount: 0,
-        lastEventAt: performance6.now(),
+        lastEventAt: performance7.now(),
         sawModelOutput: false,
         promptMessageID: void 0,
         taskDispatchByCallID: /* @__PURE__ */ new Map(),
         loggedToolCallIDs: /* @__PURE__ */ new Set(),
+        mcpToolCalls: 0,
         recentStderr: server.recentStderr,
         diagnostic: {
           label: "Pullfrog",
@@ -113840,9 +114592,14 @@ var opencode = agent({
           }
         }
       });
-      const abortController = new AbortController();
-      const eventLoopPromise = consumeEvents(runnerCtx, abortController.signal).catch((err) => {
-        if (!abortController.signal.aborted) {
+      const runController = new AbortController();
+      let turnController = new AbortController();
+      const nextTurnSignal = () => {
+        turnController = new AbortController();
+        return AbortSignal.any([runController.signal, turnController.signal]);
+      };
+      const eventLoopPromise = consumeEvents(runnerCtx, runController.signal).catch((err) => {
+        if (!runController.signal.aborted) {
           log.warning(
             `\xBB opencode event subscription ended: ${err instanceof Error ? err.message : String(err)}`
           );
@@ -113858,31 +114615,48 @@ var opencode = agent({
         // a long synchronous tool call (no part.updated while it runs) can't
         // false-positive it.
         timeoutMs: AGENT_ACTIVITY_TIMEOUT_MS,
-        abortController
+        abortTurn: () => turnController.abort()
       });
       const sdkModel = parseModel2(model);
+      let salvagesLeft = 1;
+      const runTurn = async (text) => {
+        const attempt = (prompt) => {
+          watchdog.armForTurn();
+          return runTurnGuarded(
+            runnerCtx,
+            () => runPromptTurn(runnerCtx, { text: prompt, model: sdkModel, signal: nextTurnSignal() })
+          );
+        };
+        const standDownIfRecovered = (turn) => {
+          if (watchdog.firedThisTurn() && turn.success) ctx.onTurnRecovered?.();
+          return turn;
+        };
+        const result = await attempt(text);
+        if (!watchdog.firedThisTurn()) return result;
+        if (result.success) return standDownIfRecovered(result);
+        if (salvagesLeft <= 0) return result;
+        salvagesLeft--;
+        ctx.onTurnRecovered?.();
+        log.info("\xBB activity watchdog cut the turn off \u2014 re-prompting once on the same session");
+        const mcpCallsBefore = runnerCtx.mcpToolCalls;
+        const salvaged = await attempt(WATCHDOG_SALVAGE_PROMPT);
+        const usage = mergeAgentUsage(result.usage, salvaged.usage);
+        if (runnerCtx.mcpToolCalls === mcpCallsBefore) {
+          log.info(
+            "\xBB salvage turn reached no Pullfrog tool \u2014 keeping the activity-timeout failure"
+          );
+          return { ...result, usage };
+        }
+        return standDownIfRecovered({ ...salvaged, usage });
+      };
       try {
-        const initial = await runTurnGuarded(
-          runnerCtx,
-          () => runPromptTurn(runnerCtx, {
-            text: ctx.instructions.full,
-            model: sdkModel,
-            signal: abortController.signal
-          })
-        );
+        const initial = await runTurn(ctx.instructions.full);
         const result = await runPostRunRetryLoop({
           ctx,
           initialResult: initial,
           initialUsage: initial.usage,
           reflectionPrompt: buildReflectionPrompt(ctx.toolState),
-          resume: async (c) => runTurnGuarded(
-            runnerCtx,
-            () => runPromptTurn(runnerCtx, {
-              text: c.prompt,
-              model: sdkModel,
-              signal: abortController.signal
-            })
-          )
+          resume: async (c) => runTurn(c.prompt)
         });
         if (result.success) {
           await ctx.todoTracker?.flush();
@@ -113892,7 +114666,7 @@ var opencode = agent({
         return result;
       } finally {
         watchdog.stop();
-        abortController.abort();
+        runController.abort();
         await eventLoopPromise.catch(() => {
         });
       }
@@ -113922,7 +114696,7 @@ async function runTurnGuarded(ctx, fn2) {
 }
 
 // agents/index.ts
-var agents = { claude, opencode };
+var agents = { claude, codex, opencode };
 
 // node_modules/.pnpm/@ark+util@0.56.0/node_modules/@ark/util/out/arrays.js
 var liftArray = (data) => Array.isArray(data) ? data : [data];
@@ -134254,7 +135028,7 @@ var require_core$2 = /* @__PURE__ */ __commonJSMin(((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   const id_1 = require_id2();
   const ref_1 = require_ref2();
-  const core10 = [
+  const core11 = [
     "$schema",
     "$id",
     "$defs",
@@ -134264,7 +135038,7 @@ var require_core$2 = /* @__PURE__ */ __commonJSMin(((exports) => {
     id_1.default,
     ref_1.default
   ];
-  exports.default = core10;
+  exports.default = core11;
 }));
 var require_limitNumber2 = /* @__PURE__ */ __commonJSMin(((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
@@ -136402,7 +137176,7 @@ var require_json_schema_2019_09 = /* @__PURE__ */ __commonJSMin(((exports) => {
   const metaSchema = require_schema$1();
   const applicator = require_applicator$1();
   const content = require_content$1();
-  const core10 = require_core$1();
+  const core11 = require_core$1();
   const format2 = require_format3();
   const metadata = require_meta_data$1();
   const validation = require_validation$1();
@@ -136412,7 +137186,7 @@ var require_json_schema_2019_09 = /* @__PURE__ */ __commonJSMin(((exports) => {
       metaSchema,
       applicator,
       content,
-      core10,
+      core11,
       with$data(this, format2),
       metadata,
       with$data(this, validation)
@@ -136852,7 +137626,7 @@ var require_json_schema_2020_12 = /* @__PURE__ */ __commonJSMin(((exports) => {
   const applicator = require_applicator2();
   const unevaluated = require_unevaluated();
   const content = require_content();
-  const core10 = require_core4();
+  const core11 = require_core4();
   const format2 = require_format_annotation();
   const metadata = require_meta_data();
   const validation = require_validation2();
@@ -136863,7 +137637,7 @@ var require_json_schema_2020_12 = /* @__PURE__ */ __commonJSMin(((exports) => {
       applicator,
       unevaluated,
       content,
-      core10,
+      core11,
       with$data(this, format2),
       metadata,
       with$data(this, validation)
@@ -148305,7 +149079,7 @@ var require_core$22 = /* @__PURE__ */ __commonJSMin2(((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   const id_1 = require_id3();
   const ref_1 = require_ref3();
-  const core10 = [
+  const core11 = [
     "$schema",
     "$id",
     "$defs",
@@ -148315,7 +149089,7 @@ var require_core$22 = /* @__PURE__ */ __commonJSMin2(((exports) => {
     id_1.default,
     ref_1.default
   ];
-  exports.default = core10;
+  exports.default = core11;
 }));
 var require_limitNumber3 = /* @__PURE__ */ __commonJSMin2(((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
@@ -150453,7 +151227,7 @@ var require_json_schema_2019_092 = /* @__PURE__ */ __commonJSMin2(((exports) =>
   const metaSchema = require_schema$12();
   const applicator = require_applicator$12();
   const content = require_content$12();
-  const core10 = require_core$12();
+  const core11 = require_core$12();
   const format2 = require_format4();
   const metadata = require_meta_data$12();
   const validation = require_validation$12();
@@ -150463,7 +151237,7 @@ var require_json_schema_2019_092 = /* @__PURE__ */ __commonJSMin2(((exports) =>
       metaSchema,
       applicator,
       content,
-      core10,
+      core11,
       with$data(this, format2),
       metadata,
       with$data(this, validation)
@@ -150903,7 +151677,7 @@ var require_json_schema_2020_122 = /* @__PURE__ */ __commonJSMin2(((exports) =>
   const applicator = require_applicator3();
   const unevaluated = require_unevaluated2();
   const content = require_content2();
-  const core10 = require_core5();
+  const core11 = require_core5();
   const format2 = require_format_annotation2();
   const metadata = require_meta_data2();
   const validation = require_validation3();
@@ -150914,7 +151688,7 @@ var require_json_schema_2020_122 = /* @__PURE__ */ __commonJSMin2(((exports) =>
       applicator,
       unevaluated,
       content,
-      core10,
+      core11,
       with$data(this, format2),
       metadata,
       with$data(this, validation)
@@ -170875,123 +171649,8 @@ var pbkdf2Async = promisify(pbkdf2);
 
 // utils/browser.ts
 import { execFileSync as execFileSync4, spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync4 } from "node:fs";
+import { existsSync as existsSync5 } from "node:fs";
 import { dirname as dirname2 } from "node:path";
-
-// utils/secrets.ts
-var SENSITIVE_PATTERNS = [
-  /_KEY$/i,
-  /_SECRET$/i,
-  /_TOKEN$/i,
-  /_PASSWORD$/i,
-  /_CREDENTIAL$/i
-];
-function isSensitiveEnvName(key) {
-  return SENSITIVE_PATTERNS.some((p) => p.test(key));
-}
-var SAFE_ENV_PREFIXES = ["GITHUB_", "RUNNER_", "JAVA_HOME_", "GOROOT_"];
-var SAFE_ENV_NAMES = /* @__PURE__ */ new Set([
-  // system
-  "CI",
-  "HOME",
-  "LANG",
-  "LOGNAME",
-  "PATH",
-  "SHELL",
-  "SHLVL",
-  "TERM",
-  "TMPDIR",
-  "TZ",
-  "USER",
-  "XDG_CONFIG_HOME",
-  "XDG_RUNTIME_DIR",
-  "DEBIAN_FRONTEND",
-  // runner image toolchain
-  "ACCEPT_EULA",
-  "AGENT_TOOLSDIRECTORY",
-  "ANDROID_HOME",
-  "ANDROID_NDK",
-  "ANDROID_NDK_HOME",
-  "ANDROID_NDK_LATEST_HOME",
-  "ANDROID_NDK_ROOT",
-  "ANDROID_SDK_ROOT",
-  "ANT_HOME",
-  "AZURE_EXTENSION_DIR",
-  "BOOTSTRAP_HASKELL_NONINTERACTIVE",
-  "CHROME_BIN",
-  "CHROMEWEBDRIVER",
-  "CONDA",
-  "DOTNET_MULTILEVEL_LOOKUP",
-  "DOTNET_NOLOGO",
-  "DOTNET_SKIP_FIRST_TIME_EXPERIENCE",
-  "EDGEWEBDRIVER",
-  "GECKOWEBDRIVER",
-  "GHCUP_INSTALL_BASE_PREFIX",
-  "GRADLE_HOME",
-  "JAVA_HOME",
-  "HOMEBREW_CLEANUP_PERIODIC_FULL_DAYS",
-  "HOMEBREW_NO_AUTO_UPDATE",
-  "ImageOS",
-  "ImageVersion",
-  "NVM_DIR",
-  "PIPX_BIN_DIR",
-  "PIPX_HOME",
-  "PSModulePath",
-  "SELENIUM_JAR_PATH",
-  "SGX_AESM_ADDR",
-  "SWIFT_PATH",
-  "VCPKG_INSTALLATION_ROOT"
-]);
-var _userAllowlist = null;
-function setEnvAllowlist(raw2) {
-  const names = raw2.split("\n").map((line) => line.trim()).filter(Boolean);
-  _userAllowlist = new Set(names);
-}
-function isSafeEnvVar(key) {
-  if (SAFE_ENV_NAMES.has(key)) return true;
-  return SAFE_ENV_PREFIXES.some((p) => key.startsWith(p));
-}
-var WORKFLOW_COMMAND_ENV_NAMES = [
-  "GITHUB_ENV",
-  "GITHUB_PATH",
-  "GITHUB_OUTPUT",
-  "GITHUB_STATE",
-  "GITHUB_STEP_SUMMARY",
-  // dropping the five paths above but keeping RUNNER_TEMP would be theatre:
-  // the file-command files live in `$RUNNER_TEMP/_runner_file_commands/`, so the
-  // directory is one `ls` away. nothing in the install path reads it (only our
-  // own leak-surface wipe in `setup.ts`, which runs in the parent), and package
-  // managers use TMPDIR.
-  "RUNNER_TEMP"
-];
-function filterEnvForUntrustedCode() {
-  const env2 = filterEnv();
-  for (const name of WORKFLOW_COMMAND_ENV_NAMES) delete env2[name];
-  return env2;
-}
-function filterEnv() {
-  const filtered = {};
-  for (const [key, value2] of Object.entries(process.env)) {
-    if (value2 === void 0) continue;
-    const userAllowed = _userAllowlist?.has(key) ?? false;
-    if (isSensitiveEnvName(key) && !userAllowed) continue;
-    if (isSafeEnvVar(key) || userAllowed) {
-      filtered[key] = value2;
-    }
-  }
-  return filtered;
-}
-function resolveEnv(mode) {
-  if (mode === "inherit") {
-    return process.env;
-  }
-  if (mode === "restricted" || mode === void 0) {
-    return filterEnv();
-  }
-  return { ...filterEnv(), ...mode };
-}
-
-// utils/browser.ts
 var CHROME_PATHS = ["/usr/bin/google-chrome-stable"];
 var systemChromePath;
 function findSystemChromePath() {
@@ -170999,7 +171658,7 @@ function findSystemChromePath() {
     return systemChromePath || void 0;
   }
   for (const p of CHROME_PATHS) {
-    if (existsSync4(p)) {
+    if (existsSync5(p)) {
       systemChromePath = p;
       log.info(`found system chrome: ${p}`);
       return p;
@@ -171083,8 +171742,8 @@ function closeBrowserDaemon(toolState) {
 
 // mcp/checkout.ts
 import { createHash as createHash2 } from "node:crypto";
-import { statSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync8 } from "node:fs";
-import { join as join13 } from "node:path";
+import { statSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join14 } from "node:path";
 
 // node_modules/.pnpm/@ark+schema@0.56.0/node_modules/@ark/schema/out/shared/errors.js
 var ArkError = class _ArkError extends CastableBase {
@@ -178556,8 +179215,8 @@ function ensureRepoState(toolState, init) {
 
 // utils/changeImpact.ts
 import { spawn as spawn2 } from "node:child_process";
-import { writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join7 } from "node:path";
+import { writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join8 } from "node:path";
 var MAX_CANDIDATES = 24;
 var MAX_ATOM_LENGTH = 128;
 var MAX_ATOMS = 12;
@@ -178904,8 +179563,8 @@ async function createChangeImpactArtifact(ctx, params) {
     headSha: params.headSha,
     lookupError: lookup2.error
   });
-  const path4 = join7(ctx.tmpdir, `pr-${params.pullNumber}-${params.headSha.slice(0, 7)}-impact.md`);
-  writeFileSync6(path4, artifact.content);
+  const path4 = join8(ctx.tmpdir, `pr-${params.pullNumber}-${params.headSha.slice(0, 7)}-impact.md`);
+  writeFileSync7(path4, artifact.content);
   return {
     path: path4,
     candidateCount: candidates.selected.length,
@@ -179157,8 +179816,8 @@ function readNumber(params) {
 // utils/gitAuth.ts
 import { execSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { readFileSync as readFileSync2, realpathSync, unlinkSync } from "node:fs";
-import { join as join8 } from "node:path";
+import { readFileSync as readFileSync3, realpathSync, unlinkSync } from "node:fs";
+import { join as join9 } from "node:path";
 
 // utils/shell.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
@@ -179219,7 +179878,7 @@ var TRANSIENT_AUTH_PATTERNS = [
 ];
 var gitBinary;
 function hashFile(path4) {
-  return createHash("sha256").update(readFileSync2(path4)).digest("hex");
+  return createHash("sha256").update(readFileSync3(path4)).digest("hex");
 }
 function resolveGit() {
   const whichPath = execSync("which git", { encoding: "utf-8" }).trim();
@@ -179248,7 +179907,7 @@ function resolveHooksDir(cwd, gitPath) {
     cwd,
     log: false
   }).trim();
-  const hooksDir = join8(commonDir, "hooks");
+  const hooksDir = join9(commonDir, "hooks");
   hooksDirCache.set(cwd, hooksDir);
   return hooksDir;
 }
@@ -179555,7 +180214,7 @@ function postProcessRangeDiff(raw2, contextLines = 3) {
 }
 
 // yes/index.ts
-import { performance as performance7 } from "node:perf_hooks";
+import { performance as performance8 } from "node:perf_hooks";
 import { setTimeout as sleep2 } from "node:timers/promises";
 
 // node_modules/.pnpm/lru-cache@11.5.2/node_modules/lru-cache/dist/esm/node/index.min.js
@@ -180270,14 +180929,14 @@ function _op(fn2, options) {
         `failed to create cache key${namePrefix ? ` for ${options.name}` : ""}: ${errorMessage}`
       );
     }
-    const startTime = performance7.now();
+    const startTime = performance8.now();
     const timestamp = (/* @__PURE__ */ new Date()).toISOString();
     log2.debug(`${namePrefix}[${timestamp}] cache lookup started`, { key });
     if (shouldCache && lruCache) {
       const cached4 = lruCache.get(key);
       if (cached4 !== void 0) {
         if (keyMap?.get(key) === void 0) keyMap?.set(key, input);
-        const runtime = performance7.now() - startTime;
+        const runtime = performance8.now() - startTime;
         log2.debug(`${namePrefix}[${timestamp}] cache hit (from lru)`, {
           key,
           runtime: `${Math.round(runtime)}ms`
@@ -180296,12 +180955,12 @@ function _op(fn2, options) {
     defaultCacheMiss(key);
     const retries = options.retries ?? [];
     let lastError;
-    const execStartTime = performance7.now();
+    const execStartTime = performance8.now();
     const promise2 = (async () => {
       for (let attempt = 0; attempt <= retries.length; attempt++) {
         try {
           const result = acceptsCtx ? await fn2(input, ctx) : await fn2(input);
-          const execRuntime2 = performance7.now() - execStartTime;
+          const execRuntime2 = performance8.now() - execStartTime;
           const skip = options.skipCache ? options.skipCache(result) : false;
           if (shouldCache && lruCache && result !== null && result !== void 0 && !skip) {
             lruCache.set(key, result);
@@ -180354,7 +181013,7 @@ function _op(fn2, options) {
           }
         }
       }
-      const execRuntime = performance7.now() - execStartTime;
+      const execRuntime = performance8.now() - execStartTime;
       log2.debug(`${namePrefix}[${timestamp}] function failed after all retries`, {
         key,
         runtime: `${Math.round(execRuntime)}ms`,
@@ -180419,13 +181078,13 @@ function _op(fn2, options) {
 
 // mcp/git.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join11 } from "node:path";
+import { writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join12 } from "node:path";
 
 // utils/apiCommit.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { lstat, readlink } from "node:fs/promises";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 var GITHUB_API = "https://api.github.com";
 var MAX_BLOB_BYTES = 30 * 1024 * 1024;
 var BLOB_UPLOAD_CONCURRENCY = 8;
@@ -180490,7 +181149,7 @@ async function assertApiCommittable(files) {
   const root = getRepoRoot();
   const attrs = $(
     "git",
-    ["check-attr", "filter", "-z", "--", ...present.map((p) => join9(root, p))],
+    ["check-attr", "filter", "-z", "--", ...present.map((p) => join10(root, p))],
     { log: false }
   );
   const parts = attrs.split("\0");
@@ -180502,7 +181161,7 @@ async function assertApiCommittable(files) {
     }
   }
   for (const path4 of present) {
-    const stat = await lstat(join9(root, path4));
+    const stat = await lstat(join10(root, path4));
     if (stat.isDirectory()) {
       throw new Error(
         `'${path4}' is a directory (nested repository or submodule?) \u2014 signed commits only support files and symlinks.`
@@ -180511,7 +181170,7 @@ async function assertApiCommittable(files) {
   }
 }
 async function createBlobEntry(params) {
-  const absPath = join9(params.repoRoot, params.path);
+  const absPath = join10(params.repoRoot, params.path);
   const stat = await lstat(absPath);
   if (stat.size > MAX_BLOB_BYTES) {
     throw new Error(
@@ -180688,10 +181347,10 @@ this usually means your local branch has commits that were never pushed \u2014 s
 }
 
 // utils/github.ts
-var core3 = __toESM(require_core(), 1);
+var core4 = __toESM(require_core(), 1);
 import { createSign } from "node:crypto";
 import { rename, writeFile } from "node:fs/promises";
-import { dirname as dirname3, join as join10 } from "node:path";
+import { dirname as dirname3, join as join11 } from "node:path";
 
 // node_modules/.pnpm/@octokit+plugin-throttling@11.0.5_@octokit+core@7.0.7/node_modules/@octokit/plugin-throttling/dist-bundle/index.js
 var import_light = __toESM(require_light(), 1);
@@ -184889,7 +185548,7 @@ async function fetchIdTokenFromStash(creds) {
     throw new Error("ID token response has no value field");
   }
   if (isGitHubActions) {
-    core3.setSecret(body.value);
+    core4.setSecret(body.value);
   }
   return body.value;
 }
@@ -184902,7 +185561,7 @@ function translateIdTokenError(error52) {
 var mintIdToken = op(
   async () => {
     try {
-      return await core3.getIDToken(OIDC_AUDIENCE);
+      return await core4.getIDToken(OIDC_AUDIENCE);
     } catch (error52) {
       throw translateIdTokenError(error52);
     }
@@ -185111,7 +185770,7 @@ function getGitHubUsageSummary() {
 }
 async function writeGitHubUsageSummaryToFile(path4) {
   const summary2 = getGitHubUsageSummary();
-  const tmpPath = join10(dirname3(path4), `.usage-summary-${process.pid}.tmp`);
+  const tmpPath = join11(dirname3(path4), `.usage-summary-${process.pid}.tmp`);
   await writeFile(tmpPath, JSON.stringify(summary2));
   await rename(tmpPath, path4);
 }
@@ -186263,8 +186922,8 @@ function countAhead(head, base, cwd) {
 function spillGitOutput(params) {
   const tempDir = process.env.PULLFROG_TEMP_DIR;
   if (!tempDir) throw new Error("PULLFROG_TEMP_DIR not set");
-  const outputPath = join11(tempDir, `git-${params.command}-${randomUUID3().slice(0, 8)}.txt`);
-  writeFileSync7(outputPath, params.output);
+  const outputPath = join12(tempDir, `git-${params.command}-${randomUUID3().slice(0, 8)}.txt`);
+  writeFileSync8(outputPath, params.output);
   const previewByLines = params.output.split("\n").slice(0, OVERFLOW_PREVIEW_LINES).join("\n");
   const preview = previewByLines.length <= OVERFLOW_PREVIEW_MAX_CHARS ? previewByLines : `${previewByLines.slice(0, OVERFLOW_PREVIEW_MAX_CHARS)}\u2026`;
   log.info(
@@ -187778,9 +188437,9 @@ async function reportReviewNodeId(ctx, params) {
 import { execFileSync as execFileSync6, execSync as execSync2 } from "node:child_process";
 import { mkdtempSync, readdirSync, realpathSync as realpathSync2, unlinkSync as unlinkSync2 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 function createTempDirectory() {
-  const sharedTempDir = mkdtempSync(join12(tmpdir2(), "pullfrog-"));
+  const sharedTempDir = mkdtempSync(join13(tmpdir2(), "pullfrog-"));
   process.env.PULLFROG_TEMP_DIR = sharedTempDir;
   log.info(`\xBB created temp dir at ${sharedTempDir}`);
   return sharedTempDir;
@@ -187825,13 +188484,13 @@ function wipeRunnerLeakSurface() {
       return [];
     }
   };
-  const fileCommandsDir = join12(runnerTemp, "_runner_file_commands");
+  const fileCommandsDir = join13(runnerTemp, "_runner_file_commands");
   for (const entry of listDir(fileCommandsDir)) {
-    tryUnlink(join12(fileCommandsDir, entry));
+    tryUnlink(join13(fileCommandsDir, entry));
   }
   for (const entry of listDir(runnerTemp)) {
     if (entry.endsWith(".sh") || /^git-credentials-.*\.config$/.test(entry)) {
-      tryUnlink(join12(runnerTemp, entry));
+      tryUnlink(join13(runnerTemp, entry));
     }
   }
   if (wiped.length > 0) {
@@ -188381,11 +189040,11 @@ function CheckoutPrTool(ctx) {
         headSha: checkoutSha
       });
       if (incremental.status === "ok") {
-        incrementalDiffPath = join13(
+        incrementalDiffPath = join14(
           tempDir,
           `pr-${pull_number}-${beforeShort}-${headShort}-incremental.diff`
         );
-        writeFileSync8(incrementalDiffPath, incremental.diff);
+        writeFileSync9(incrementalDiffPath, incremental.diff);
         log.info(
           `\xBB incremental diff computed (${incremental.diff.length} bytes) \u2192 ${incrementalDiffPath}`
         );
@@ -188398,8 +189057,8 @@ function CheckoutPrTool(ctx) {
     const diffPreview = formatResult.content.split("\n").slice(0, 100).join("\n");
     log.debug(`formatted diff preview (first 100 lines):
 ${diffPreview}`);
-    const diffPath = join13(tempDir, `pr-${pull_number}-${headShort}.diff`);
-    writeFileSync8(diffPath, formatResult.content);
+    const diffPath = join14(tempDir, `pr-${pull_number}-${headShort}.diff`);
+    writeFileSync9(diffPath, formatResult.content);
     log.debug(`wrote diff to ${diffPath} (${formatResult.content.length} bytes)`);
     primary.diffCoverage = createDiffCoverageState({
       diffPath,
@@ -188556,8 +189215,8 @@ ${dirty}`
 }
 
 // mcp/checkSuite.ts
-import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join14 } from "node:path";
+import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join15 } from "node:path";
 var GetCheckSuiteLogs = type({
   check_suite_id: type.number.describe("the id from check_suite.id")
 });
@@ -188653,8 +189312,8 @@ function GetCheckSuiteLogsTool(ctx) {
       if (!tempDir) {
         throw new Error("PULLFROG_TEMP_DIR not set");
       }
-      const logsDir = join14(tempDir, "ci-logs");
-      mkdirSync7(logsDir, { recursive: true });
+      const logsDir = join15(tempDir, "ci-logs");
+      mkdirSync8(logsDir, { recursive: true });
       const jobResults = [];
       for (const run of failedRuns) {
         const jobs = await ctx.octokit.paginate(ctx.octokit.rest.actions.listJobsForWorkflowRun, {
@@ -188680,8 +189339,8 @@ function GetCheckSuiteLogsTool(ctx) {
               );
             }
             const logsText = await logsResult.text();
-            const logPath = join14(logsDir, `job-${job.id}.log`);
-            writeFileSync9(logPath, logsText);
+            const logPath = join15(logsDir, `job-${job.id}.log`);
+            writeFileSync10(logPath, logsText);
             const analysis = analyzeLog(logsText, 80);
             const failedSteps = job.steps?.filter((s) => s.conclusion === "failure").map((s) => `Step ${s.number}: ${s.name}`) ?? [];
             jobResults.push({
@@ -188729,8 +189388,8 @@ function GetCheckSuiteLogsTool(ctx) {
 }
 
 // mcp/commitInfo.ts
-import { writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join15 } from "node:path";
+import { writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join16 } from "node:path";
 var CommitInfo = type({
   sha: type.string.describe("the commit SHA (full or abbreviated) to fetch")
 });
@@ -188754,8 +189413,8 @@ function CommitInfoTool(ctx) {
           "PULLFROG_TEMP_DIR not set - get_commit_info must run in pullfrog action context"
         );
       }
-      const diffFile = join15(tempDir, `commit-${sha.slice(0, 7)}.diff`);
-      writeFileSync10(diffFile, formatResult.content);
+      const diffFile = join16(tempDir, `commit-${sha.slice(0, 7)}.diff`);
+      writeFileSync11(diffFile, formatResult.content);
       log.debug(`wrote commit diff to ${diffFile} (${formatResult.content.length} bytes)`);
       return {
         sha: data.sha,
@@ -188888,17 +189547,17 @@ function ReopenCurrentTool(ctx) {
 }
 
 // prep/index.ts
-import { performance as performance8 } from "node:perf_hooks";
+import { performance as performance9 } from "node:perf_hooks";
 
 // prep/installNodeDependencies.ts
-import { existsSync as existsSync6 } from "node:fs";
-import { join as join17 } from "node:path";
+import { existsSync as existsSync7 } from "node:fs";
+import { join as join18 } from "node:path";
 
 // utils/packageManager.ts
 var import_semver2 = __toESM(require_semver2(), 1);
-import { existsSync as existsSync5 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 import { mkdir, readFile as readFile2 } from "node:fs/promises";
-import { delimiter, join as join16 } from "node:path";
+import { delimiter, join as join17 } from "node:path";
 var SUPPORTED_NAMES = ["npm", "pnpm", "yarn", "bun"];
 var COREPACK_MANAGED = ["pnpm", "yarn"];
 function isSupported(name) {
@@ -188936,8 +189595,8 @@ function parseDevEnginesField(field) {
   };
 }
 async function resolvePackageManagerSpec(cwd) {
-  const pkgPath = join16(cwd, "package.json");
-  if (!existsSync5(pkgPath)) return null;
+  const pkgPath = join17(cwd, "package.json");
+  if (!existsSync6(pkgPath)) return null;
   let pkg;
   try {
     pkg = JSON.parse(await readFile2(pkgPath, "utf-8"));
@@ -188995,7 +189654,7 @@ async function currentVersion(name) {
   return result.stdout.trim();
 }
 function packageManagerBinDir(tmpdir3) {
-  return join16(tmpdir3, "pm-bin");
+  return join17(tmpdir3, "pm-bin");
 }
 async function ensurePackageManager(params) {
   const spec = params.spec;
@@ -189058,7 +189717,7 @@ async function installFallback(name, installSpec) {
   });
   if (result.exitCode !== 0) return result.stderr || `failed to install ${name}`;
   if (name === "deno") {
-    const denoPath = join16(process.env.HOME || "", ".deno", "bin");
+    const denoPath = join17(process.env.HOME || "", ".deno", "bin");
     process.env.PATH = `${denoPath}:${process.env.PATH}`;
   }
   log.info(`\xBB installed ${name}`);
@@ -189091,8 +189750,8 @@ async function isCommandAvailable2(command) {
 var installNodeDependencies = {
   name: "installNodeDependencies",
   shouldRun: () => {
-    const packageJsonPath = join17(process.cwd(), "package.json");
-    return existsSync6(packageJsonPath);
+    const packageJsonPath = join18(process.cwd(), "package.json");
+    return existsSync7(packageJsonPath);
   },
   run: async (options) => {
     const declared = await resolvePackageManagerSpec(process.cwd());
@@ -189186,14 +189845,14 @@ ${errorMessage}`]
 };
 
 // prep/installPythonDependencies.ts
-import { existsSync as existsSync7, readFileSync as readFileSync3 } from "node:fs";
-import { join as join18 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync4 } from "node:fs";
+import { join as join19 } from "node:path";
 function declaresBuildSystem(path4) {
-  return /^\s*\[\s*build-system\s*\]/m.test(readFileSync3(path4, "utf8"));
+  return /^\s*\[\s*build-system\s*\]/m.test(readFileSync4(path4, "utf8"));
 }
 function configApplies(config3, cwd) {
-  const path4 = join18(cwd, config3.file);
-  return existsSync7(path4) && (config3.applies?.(path4) ?? true);
+  const path4 = join19(cwd, config3.file);
+  return existsSync8(path4) && (config3.applies?.(path4) ?? true);
 }
 var PYTHON_CONFIGS = [
   {
@@ -189347,7 +190006,7 @@ var installPythonDependencies = {
 var prepSteps = [installNodeDependencies, installPythonDependencies];
 async function runPrepPhase(options) {
   log.debug("\xBB starting prep phase...");
-  const startTime = performance8.now();
+  const startTime = performance9.now();
   const results = [];
   const preDirty = await dirtyTrackedPaths();
   try {
@@ -189369,7 +190028,7 @@ async function runPrepPhase(options) {
   } finally {
     await restoreDirtiedSince({ before: preDirty, actor: "prep" });
   }
-  const totalDurationMs = performance8.now() - startTime;
+  const totalDurationMs = performance9.now() - startTime;
   log.debug(`\xBB prep phase completed (${Math.round(totalDurationMs)}ms)`);
   return results;
 }
@@ -189514,15 +190173,15 @@ function AwaitDependencyInstallationTool(ctx) {
 }
 
 // mcp/gh.ts
-import { mkdirSync as mkdirSync8 } from "node:fs";
-import { join as join20 } from "node:path";
+import { mkdirSync as mkdirSync9 } from "node:fs";
+import { join as join21 } from "node:path";
 
 // mcp/shell.ts
 import { spawn as spawn3, spawnSync as spawnSync6 } from "node:child_process";
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { closeSync, openSync, writeFileSync as writeFileSync11 } from "node:fs";
+import { closeSync, openSync, writeFileSync as writeFileSync12 } from "node:fs";
 import { userInfo as userInfo2 } from "node:os";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 import { setTimeout as sleep3 } from "node:timers/promises";
 var ShellParams = type({
   command: "string",
@@ -189785,8 +190444,8 @@ ${spawnError}` : spawnError;
 }
 function capOutput(output) {
   if (output.length <= MAX_OUTPUT_CHARS) return output;
-  const fullPath = join19(getTempDir(), `shell-${randomUUID4().slice(0, 8)}.log`);
-  writeFileSync11(fullPath, output);
+  const fullPath = join20(getTempDir(), `shell-${randomUUID4().slice(0, 8)}.log`);
+  writeFileSync12(fullPath, output);
   const elided = output.length - MAX_OUTPUT_CHARS;
   return `... [${elided} chars truncated; full output saved to ${fullPath}] ...
 ${output.slice(-MAX_OUTPUT_CHARS)}`;
@@ -189840,8 +190499,8 @@ Do NOT use this tool for git commands \u2014 use the dedicated git tools instead
       if (params.background) {
         const tempDir = getTempDir();
         const handle = `bg-${randomUUID4().slice(0, 8)}`;
-        const outputPath = join19(tempDir, `${handle}.log`);
-        const pidPath = join19(tempDir, `${handle}.pid`);
+        const outputPath = join20(tempDir, `${handle}.log`);
+        const pidPath = join20(tempDir, `${handle}.pid`);
         const logFd = openSync(outputPath, "a");
         let proc;
         try {
@@ -189858,7 +190517,7 @@ Do NOT use this tool for git commands \u2014 use the dedicated git tools instead
           throw new Error("failed to start background process");
         }
         proc.unref();
-        writeFileSync11(pidPath, `${proc.pid}
+        writeFileSync12(pidPath, `${proc.pid}
 `);
         ctx.toolState.backgroundProcesses.set(handle, { pid: proc.pid, outputPath, pidPath });
         return {
@@ -189938,8 +190597,8 @@ function GhTool(ctx) {
     description: `Run the GitHub CLI against ${ctx.repo.owner}/${ctx.repo.name}. Pass argv as an array \u2014 there is no shell, so pipes, redirects and \`&&\` do not work; use gh's own \`--json\`/\`--jq\` flags instead. \`gh api graphql\` is available. Authenticated with ${permissions ? formatPermissions(permissions) : "no permissions"} on this repo only; anything else 403s. Pushing, merging and ref writes are not available \u2014 use the git tools.`,
     parameters: GhParams,
     execute: execute(async (params) => {
-      const configDir = join20(ctx.tmpdir, "gh-config");
-      mkdirSync8(configDir, { recursive: true });
+      const configDir = join21(ctx.tmpdir, "gh-config");
+      mkdirSync9(configDir, { recursive: true });
       const command = ["gh", ...params.args.map(shellQuote)].join(" ");
       const result = await runSandboxed({
         command,
@@ -190662,8 +191321,8 @@ function PullRequestInfoTool(ctx) {
 }
 
 // mcp/reviewComments.ts
-import { writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join21 } from "node:path";
+import { writeFileSync as writeFileSync13 } from "node:fs";
+import { join as join22 } from "node:path";
 var COMMENTS_PER_THREAD = 50;
 var REVIEW_THREADS_QUERY = `
 query ($owner: String!, $name: String!, $prNumber: Int!, $cursor: String) {
@@ -191136,8 +191795,8 @@ function GetReviewCommentsTool(ctx) {
         throw new Error("PULLFROG_TEMP_DIR not set");
       }
       const filename = `review-${params.review_id}-threads.md`;
-      const commentsPath = join21(tempDir, filename);
-      writeFileSync12(commentsPath, formatted.content);
+      const commentsPath = join22(tempDir, filename);
+      writeFileSync13(commentsPath, formatted.content);
       log.debug(`wrote ${threadBlocks.length} threads to ${commentsPath}`);
       return {
         review_id: params.review_id,
@@ -191470,8 +192129,8 @@ function UploadFileTool(ctx) {
 }
 
 // mcp/xrepo.ts
-import { mkdirSync as mkdirSync9, rmSync as rmSync2 } from "node:fs";
-import { join as join22 } from "node:path";
+import { mkdirSync as mkdirSync10, rmSync as rmSync2 } from "node:fs";
+import { join as join23 } from "node:path";
 function assertValidRepoName(name) {
   if (!/^[A-Za-z0-9._-]+$/.test(name) || name.startsWith("-") || name.includes("..")) {
     throw new Error(
@@ -191551,8 +192210,8 @@ function CheckoutRepoTool(ctx) {
         return { path: existing.dir, access: existing.access, note: "already checked out." };
       }
       const access = accessFor(ctx, repo);
-      const dir = join22(ctx.tmpdir, "xrepo", repo);
-      mkdirSync9(dir, { recursive: true });
+      const dir = join23(ctx.tmpdir, "xrepo", repo);
+      mkdirSync10(dir, { recursive: true });
       const state = ensureRepoState(ctx.toolState, { owner, name: repo, dir, access });
       const rc = resolveRepoCtx(ctx, repo);
       try {
@@ -191798,7 +192457,10 @@ function hasEnvVar2(name) {
   return typeof val === "string" && val.length > 0;
 }
 function hasClaudeCodeAuth() {
-  return hasEnvVar2("CLAUDE_CODE_OAUTH_TOKEN") || hasEnvVar2("ANTHROPIC_API_KEY");
+  return hasEnvVar2("CLAUDE_CODE_OAUTH_TOKEN") || hasEnvVar2("ANTHROPIC_API_KEY") || hasEnvVar2("ANTHROPIC_AUTH_TOKEN");
+}
+function hasCodexAuth() {
+  return hasEnvVar2("CODEX_AUTH_JSON") || hasEnvVar2("OPENAI_API_KEY");
 }
 function hasBedrockAuth() {
   return hasEnvVar2("AWS_BEARER_TOKEN_BEDROCK") || hasEnvVar2("AWS_ACCESS_KEY_ID") && hasEnvVar2("AWS_SECRET_ACCESS_KEY");
@@ -191826,6 +192488,15 @@ function resolveSlug(slug2) {
     }
     return vertexId;
   }
+  if (alias?.routing === "azure") {
+    const deployment = process.env[AZURE_DEPLOYMENT_ENV]?.trim();
+    if (!deployment) {
+      throw new Error(
+        `${AZURE_DEPLOYMENT_ENV} env var is required when the model is set to "${slug2}". set it to the name of your Azure OpenAI deployment (not the model it serves \u2014 Azure routes on the deployment name). see https://docs.pullfrog.com/azure for setup.`
+      );
+    }
+    return `${AZURE_PROVIDER}/${deployment}`;
+  }
   if (alias?.routing === "openai-compatible") {
     const modelId = process.env[OPENAI_COMPATIBLE_MODEL_ENV]?.trim();
     if (!modelId) {
@@ -191864,6 +192535,7 @@ function resolveAgent(ctx) {
     }
     log.warning(`\xBB unknown PULLFROG_AGENT="${envAgent}" \u2014 falling through to auto-select`);
   }
+  if (ctx.proxyModel) return agents.opencode;
   if (ctx.model && hasBedrockAuth() && process.env[BEDROCK_MODEL_ID_ENV]?.trim() === ctx.model) {
     return isBedrockAnthropicId(ctx.model) ? agents.claude : agents.opencode;
   }
@@ -191873,12 +192545,17 @@ function resolveAgent(ctx) {
   if (ctx.model) {
     try {
       const provider2 = getModelProvider(ctx.model);
-      if (provider2 === "anthropic" && hasClaudeCodeAuth()) {
-        return agents.claude;
-      }
+      if (provider2 === "anthropic" && hasClaudeCodeAuth()) return agents.claude;
+      if (provider2 === "openai" && ctx.codexAgent && hasCodexAuth()) return agents.codex;
     } catch {
     }
   }
+  if (!ctx.model) {
+    if (hasEnvVar2("ANTHROPIC_AUTH_TOKEN") && !hasEnvVar2("ANTHROPIC_API_KEY") && !hasEnvVar2("CLAUDE_CODE_OAUTH_TOKEN")) {
+      return agents.claude;
+    }
+    if (ctx.codexAgent && hasCodexAuth() && !hasClaudeCodeAuth()) return agents.codex;
+  }
   return agents.opencode;
 }
 
@@ -191976,10 +192653,37 @@ auto-compaction is disabled, so long runs grow until your endpoint refuses them.
 
 for full setup instructions, see https://docs.pullfrog.com/openai-compatible`;
 }
+function buildAzureSetupError(params) {
+  const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
+  return `Azure OpenAI selected but required configuration is missing: ${params.missing.join(", ")}.
+
+only the API key is sensitive \u2014 add it as a secret at ${githubSecretsUrl}. the rest is plain workflow \`env:\`:
+
+  ${AZURE_RESOURCE_NAME_ENV}: <name>
+  ${AZURE_API_KEY_ENV}: \${{ secrets.${AZURE_API_KEY_ENV} }}
+  ${AZURE_DEPLOYMENT_ENV}: <deployment-name>
+  ${AZURE_CONTEXT_ENV}: "400000"
+  ${AZURE_MAX_OUTPUT_ENV}: "128000"
+
+${AZURE_RESOURCE_NAME_ENV} is the \`<name>\` in your endpoint https://<name>.openai.azure.com.
+${AZURE_DEPLOYMENT_ENV} is the name of the deployment, which is not necessarily the name of
+the model it serves \u2014 Azure routes on the deployment name.
+
+set the last two to the real limits of whichever model your deployment serves. Pullfrog can't
+discover them \u2014 a deployment name carries no catalog metadata \u2014 and without them completions
+are capped at 32000 tokens (rejected outright by models with a smaller cap) and auto-compaction
+is disabled, so long runs grow until Azure refuses them.
+
+for full setup instructions, see https://docs.pullfrog.com/azure`;
+}
 function hasEnvVar3(name) {
   const value2 = process.env[name];
   return typeof value2 === "string" && value2.length > 0;
 }
+function modelHasRuntimeAuth(model) {
+  const authVars = [...getModelEnvVars(model), ...getModelManagedCredentials(model)];
+  return authVars.length === 0 || authVars.some(hasEnvVar3);
+}
 function hasPositiveNumberEnvVar(name) {
   return Number(process.env[name]) > 0;
 }
@@ -191998,6 +192702,17 @@ function validateOpenAICompatibleSetup(params) {
     );
   }
 }
+function validateAzureSetup(params) {
+  const missing = [];
+  if (!hasEnvVar3(AZURE_API_KEY_ENV)) missing.push(AZURE_API_KEY_ENV);
+  if (!hasEnvVar3(AZURE_RESOURCE_NAME_ENV)) missing.push(AZURE_RESOURCE_NAME_ENV);
+  if (!hasEnvVar3(AZURE_DEPLOYMENT_ENV)) missing.push(AZURE_DEPLOYMENT_ENV);
+  if (!hasPositiveNumberEnvVar(AZURE_CONTEXT_ENV)) missing.push(AZURE_CONTEXT_ENV);
+  if (!hasPositiveNumberEnvVar(AZURE_MAX_OUTPUT_ENV)) missing.push(AZURE_MAX_OUTPUT_ENV);
+  if (missing.length > 0) {
+    throw new Error(buildAzureSetupError({ owner: params.owner, name: params.name, missing }));
+  }
+}
 function validateBedrockSetup(params) {
   const hasAuth = hasEnvVar3("AWS_BEARER_TOKEN_BEDROCK") || hasEnvVar3("AWS_ACCESS_KEY_ID") && hasEnvVar3("AWS_SECRET_ACCESS_KEY");
   const missing = [];
@@ -192021,6 +192736,12 @@ function validateVertexSetup(params) {
     throw new Error(buildVertexSetupError({ owner: params.owner, name: params.name, missing }));
   }
 }
+function hasSingleProviderAuth(agentName) {
+  if (agentName === "codex") {
+    return hasEnvVar3("OPENAI_API_KEY") || hasEnvVar3("CODEX_AUTH_JSON");
+  }
+  return hasEnvVar3("ANTHROPIC_API_KEY") || hasEnvVar3("ANTHROPIC_AUTH_TOKEN") || hasEnvVar3("CLAUDE_CODE_OAUTH_TOKEN");
+}
 function validateAgentApiKey(params) {
   if (params.model) {
     const alias = resolveDisplayAlias(params.model);
@@ -192036,6 +192757,10 @@ function validateAgentApiKey(params) {
       validateOpenAICompatibleSetup({ owner: params.owner, name: params.name });
       return;
     }
+    if (params.model.startsWith(`${AZURE_PROVIDER}/`)) {
+      validateAzureSetup({ owner: params.owner, name: params.name });
+      return;
+    }
     if (!params.model.includes("/")) {
       if (process.env[VERTEX_MODEL_ID_ENV]?.trim() === params.model) {
         validateVertexSetup({ owner: params.owner, name: params.name });
@@ -192059,7 +192784,7 @@ function validateAgentApiKey(params) {
         })
       );
     }
-    if (hasEnvVar3("ANTHROPIC_API_KEY") || hasEnvVar3("CLAUDE_CODE_OAUTH_TOKEN")) return;
+    if (hasSingleProviderAuth(params.agent.name)) return;
     throw new Error(
       buildKeyError({
         owner: params.owner,
@@ -192071,7 +192796,7 @@ function validateAgentApiKey(params) {
     );
   }
   if (params.agent.name === "opencode") {
-    if (params.authorized.size > 0) return;
+    if ([...params.authorized].some(modelHasRuntimeAuth)) return;
     const reason = getModelsFailure();
     if (reason) throw new Error(reason);
     throw new Error(
@@ -192083,7 +192808,7 @@ function validateAgentApiKey(params) {
       })
     );
   }
-  if (hasEnvVar3("ANTHROPIC_API_KEY") || hasEnvVar3("CLAUDE_CODE_OAUTH_TOKEN")) return;
+  if (hasSingleProviderAuth(params.agent.name)) return;
   throw new Error(
     buildKeyError({
       owner: params.owner,
@@ -192347,7 +193072,8 @@ var PROBES = {
     request: (value2) => ({
       url: "https://api.anthropic.com/v1/models",
       headers: { "x-api-key": value2, "anthropic-version": "2023-06-01" }
-    })
+    }),
+    hostConfigurable: true
   },
   OPENROUTER_API_KEY: {
     request: (value2) => ({
@@ -192396,12 +193122,18 @@ function hasEnvVar4(name) {
   const value2 = process.env[name];
   return typeof value2 === "string" && value2.length > 0;
 }
+var HOST_OVERRIDES = {
+  ANTHROPIC_API_KEY: "ANTHROPIC_BASE_URL",
+  CLAUDE_CODE_OAUTH_TOKEN: "ANTHROPIC_BASE_URL"
+};
 function envVarsFor(model) {
   return model.includes("/") ? getModelEnvVars(model) : [];
 }
 async function checkOne(params) {
   const value2 = process.env[params.envVar];
   if (!value2) return null;
+  const hostOverride = HOST_OVERRIDES[params.envVar];
+  if (hostOverride && hasEnvVar4(hostOverride)) return null;
   if (params.envVar === "CLAUDE_CODE_OAUTH_TOKEN") {
     const preflight = await preflightClaudeSubscription({
       token: value2,
@@ -192456,9 +193188,9 @@ async function checkConfiguredCredentials(params) {
 
 // utils/gitAuthServer.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { writeFileSync as writeFileSync13 } from "node:fs";
+import { writeFileSync as writeFileSync14 } from "node:fs";
 import { createServer as createServer3 } from "node:http";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 var REVOKED_TRAP_MS = 6e4;
 function revokeGitHubToken(token) {
   fetch("https://api.github.com/installation/token", {
@@ -192527,7 +193259,7 @@ async function startGitAuthServer(tmpdir3) {
   function writeAskpassScript(code) {
     const scriptId = randomUUID5();
     const scriptName = `askpass-${scriptId}.js`;
-    const scriptPath = join23(tmpdir3, scriptName);
+    const scriptPath = join24(tmpdir3, scriptName);
     const content = [
       `#!/usr/bin/env node`,
       `var a=process.argv[2]||"";`,
@@ -192540,7 +193272,7 @@ async function startGitAuthServer(tmpdir3) {
       `r.on("end",function(){process.stdout.write(d+"\\n")})`,
       `}).on("error",function(){process.exit(1)})}`
     ].join("\n");
-    writeFileSync13(scriptPath, content, { mode: 448 });
+    writeFileSync14(scriptPath, content, { mode: 448 });
     return scriptPath;
   }
   async function close() {
@@ -192979,7 +193711,7 @@ function resolveInstructions(ctx) {
 
 // utils/learnings.ts
 import { mkdir as mkdir2, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname4, join as join24 } from "node:path";
+import { dirname as dirname4, join as join25 } from "node:path";
 
 // utils/learningsTruncate.ts
 var MAX_LEARNINGS_LENGTH = 1e5;
@@ -192997,10 +193729,10 @@ function truncateAtLineBoundary(body, cap) {
 var LEARNINGS_FILE_NAME = "pullfrog-learnings.md";
 var XREPO_LEARNINGS_FILE_NAME = "pullfrog-xrepo-learnings.md";
 function learningsFilePath(tmpdir3) {
-  return join24(tmpdir3, LEARNINGS_FILE_NAME);
+  return join25(tmpdir3, LEARNINGS_FILE_NAME);
 }
 function xrepoLearningsFilePath(tmpdir3) {
-  return join24(tmpdir3, XREPO_LEARNINGS_FILE_NAME);
+  return join25(tmpdir3, XREPO_LEARNINGS_FILE_NAME);
 }
 async function seedLearningsFile(params) {
   const path4 = learningsFilePath(params.tmpdir);
@@ -193116,7 +193848,7 @@ async function persistXrepoLearnings(ctx) {
 // utils/modelAccess.ts
 function decideModelAccess(input) {
   if (!input.modelExplicit || !input.model) return { kind: "ok" };
-  const byokAuthorized = !!input.resolvedModel && (input.authorized.has(input.resolvedModel) || !input.resolvedModel.includes("/") || input.resolvedModel.startsWith(`${OPENAI_COMPATIBLE_PROVIDER}/`));
+  const byokAuthorized = !!input.resolvedModel && (input.authorized.has(input.resolvedModel) || !input.resolvedModel.includes("/") || input.resolvedModel.startsWith(`${OPENAI_COMPATIBLE_PROVIDER}/`) || input.resolvedModel.startsWith(`${AZURE_PROVIDER}/`));
   if (input.proxyActive) {
     const target = resolveOpenRouterModel(input.model);
     if (input.oss) {
@@ -193161,7 +193893,7 @@ function buildModelAccessError(input) {
 }
 
 // utils/normalizeEnv.ts
-var core4 = __toESM(require_core(), 1);
+var core5 = __toESM(require_core(), 1);
 function hasControlCharacter(value2) {
   return [...value2].some((ch) => {
     const code = ch.charCodeAt(0);
@@ -193187,7 +193919,7 @@ function sanitizeSecret(key, value2) {
       `\xBB stripped whitespace from ${key} (whitespace in secret values breaks GitHub Actions log masking)`
     );
   }
-  core4.setSecret(trimmed);
+  core5.setSecret(trimmed);
   return trimmed;
 }
 function normalizeEnv() {
@@ -193231,7 +193963,7 @@ function normalizeEnv() {
 }
 
 // utils/overrides.ts
-var core5 = __toESM(require_core(), 1);
+var core6 = __toESM(require_core(), 1);
 var DENIED_OVERRIDE_NAMES = /* @__PURE__ */ new Set([
   "GITHUB_TOKEN",
   "GH_TOKEN",
@@ -193277,7 +194009,7 @@ function applyOverrides(params) {
       denied.push(key);
       continue;
     }
-    if (value2.length > 0) core5.setSecret(value2);
+    if (value2.length > 0) core6.setSecret(value2);
     params.env[key] = value2;
     applied.push(key);
   }
@@ -193286,8 +194018,8 @@ function applyOverrides(params) {
 }
 
 // utils/payload.ts
-var core6 = __toESM(require_core(), 1);
-import { readFileSync as readFileSync5 } from "node:fs";
+var core7 = __toESM(require_core(), 1);
+import { readFileSync as readFileSync6 } from "node:fs";
 import { isAbsolute as isAbsolute2, resolve as resolve2 } from "node:path";
 
 // utils/versioning.ts
@@ -193374,8 +194106,8 @@ function resolveCwd(cwd) {
   return workspace ? resolve2(workspace, cwd) : cwd;
 }
 function resolvePromptInput() {
-  const promptInput = core6.getInput("prompt");
-  const promptFile = core6.getInput("prompt_file");
+  const promptInput = core7.getInput("prompt");
+  const promptFile = core7.getInput("prompt_file");
   if (promptInput && promptFile) {
     throw new Error("set exactly one of 'prompt' or 'prompt_file' inputs, not both.");
   }
@@ -193401,7 +194133,7 @@ function resolvePromptInput() {
 function resolvePromptFile(input) {
   const workspace = process.env.GITHUB_WORKSPACE;
   const path4 = isAbsolute2(input) ? input : workspace ? resolve2(workspace, input) : resolve2(input);
-  const content = readFileSync5(path4, "utf-8");
+  const content = readFileSync6(path4, "utf-8");
   if (!content.trim()) {
     throw new Error(`prompt_file ${JSON.stringify(input)} is empty.`);
   }
@@ -193409,7 +194141,7 @@ function resolvePromptFile(input) {
 }
 function warnIfDeprecatedStatusChecks(value2) {
   if (value2 !== void 0) {
-    core6.warning(
+    core7.warning(
       "`status_checks` is deprecated. Both checks are now repository settings \u2014 open the Pullfrog console for this repo (Automations \u2192 Review PRs) and set them there, then remove `status_checks` from your workflow. It keeps working until you do."
     );
   }
@@ -193417,15 +194149,15 @@ function warnIfDeprecatedStatusChecks(value2) {
 }
 function resolveNonPromptInputs() {
   return Inputs.omit("prompt", "prompt_file").assert({
-    model: core6.getInput("model") || void 0,
-    effort: core6.getInput("effort") || void 0,
-    debug: core6.getInput("debug") || void 0,
-    timeout: core6.getInput("timeout") || void 0,
-    cwd: core6.getInput("cwd") || void 0,
-    push: core6.getInput("push") || void 0,
-    shell: core6.getInput("shell") || void 0,
-    status_checks: warnIfDeprecatedStatusChecks(core6.getInput("status_checks") || void 0),
-    progress_comments: core6.getInput("progress_comments") || void 0
+    model: core7.getInput("model") || void 0,
+    effort: core7.getInput("effort") || void 0,
+    debug: core7.getInput("debug") || void 0,
+    timeout: core7.getInput("timeout") || void 0,
+    cwd: core7.getInput("cwd") || void 0,
+    push: core7.getInput("push") || void 0,
+    shell: core7.getInput("shell") || void 0,
+    status_checks: warnIfDeprecatedStatusChecks(core7.getInput("status_checks") || void 0),
+    progress_comments: core7.getInput("progress_comments") || void 0
   });
 }
 function resolvePayload(resolvedPromptInput, repoSettings) {
@@ -193493,7 +194225,7 @@ function resolvePayload(resolvedPromptInput, repoSettings) {
   };
 }
 function resolveOutputSchema() {
-  const raw2 = core6.getInput("output_schema");
+  const raw2 = core7.getInput("output_schema");
   if (!raw2) return void 0;
   let parsed2;
   try {
@@ -193509,10 +194241,10 @@ function resolveOutputSchema() {
 }
 
 // utils/proxy.ts
-var core8 = __toESM(require_core(), 1);
+var core9 = __toESM(require_core(), 1);
 
 // utils/token.ts
-var core7 = __toESM(require_core(), 1);
+var core8 = __toESM(require_core(), 1);
 import assert2 from "node:assert/strict";
 var mcpTokenValue;
 var refreshMcpTokenFn;
@@ -193520,7 +194252,7 @@ function getMcpTokenRefresh() {
   return refreshMcpTokenFn;
 }
 function getJobToken() {
-  const inputToken = core7.getInput("token");
+  const inputToken = core8.getInput("token");
   if (inputToken) {
     return inputToken;
   }
@@ -193536,7 +194268,7 @@ async function resolveTokens(params) {
   if (externalToken) {
     mcpTokenValue = externalToken;
     if (isGitHubActions) {
-      core7.setSecret(externalToken);
+      core8.setSecret(externalToken);
     }
     log.info("\xBB using external GH_TOKEN for both git and MCP");
     return {
@@ -193556,7 +194288,7 @@ async function resolveTokens(params) {
   const gitPermissions = params.push === "disabled" ? { contents: "read" } : { contents: "write", workflows: "write" };
   const gitToken = await acquireNewToken({ repos: writeRepos, permissions: gitPermissions });
   if (isGitHubActions) {
-    core7.setSecret(gitToken);
+    core8.setSecret(gitToken);
   }
   log.info(
     `\xBB acquired git token (${Object.entries(gitPermissions).map((e) => e.join(":")).join(", ")})`
@@ -193573,7 +194305,7 @@ async function resolveTokens(params) {
   };
   const mcpToken = await acquireNewToken({ repos: writeRepos, permissions: mcpPermissions });
   if (isGitHubActions) {
-    core7.setSecret(mcpToken);
+    core8.setSecret(mcpToken);
   }
   log.info(
     `\xBB acquired scoped MCP token (${Object.entries(mcpPermissions).map((e) => e.join(":")).join(", ")})`
@@ -193582,7 +194314,7 @@ async function resolveTokens(params) {
   let ghToken;
   if (ghPermissions) {
     ghToken = await acquireNewToken({ permissions: ghPermissions });
-    if (isGitHubActions) core7.setSecret(ghToken);
+    if (isGitHubActions) core8.setSecret(ghToken);
     log.info(
       `\xBB acquired gh token mirroring ${params.authorPermission} (${formatPermissions(ghPermissions)})`
     );
@@ -193593,7 +194325,7 @@ async function resolveTokens(params) {
       repos: params.xrepo.read,
       permissions: { contents: "read" }
     });
-    if (isGitHubActions) core7.setSecret(readToken);
+    if (isGitHubActions) core8.setSecret(readToken);
     log.info(`\xBB acquired cross-repo read token (contents:read, ${params.xrepo.read.length} repos)`);
   }
   mcpTokenValue = mcpToken;
@@ -193612,7 +194344,7 @@ async function resolveTokens(params) {
       oidc: params.oidc ?? void 0
     }).then((fresh) => {
       if (isGitHubActions) {
-        core7.setSecret(fresh);
+        core8.setSecret(fresh);
       }
       mcpTokenValue = fresh;
       currentMcpToken = fresh;
@@ -193633,7 +194365,7 @@ async function resolveTokens(params) {
         permissions: gitPermissions,
         oidc: params.oidc ?? void 0
       }).then((fresh) => {
-        if (isGitHubActions) core7.setSecret(fresh);
+        if (isGitHubActions) core8.setSecret(fresh);
         void revokeGitHubInstallationToken(currentGitToken);
         currentGitToken = fresh;
         log.warning("\xBB GitHub rejected the git token; re-acquired a fresh git token");
@@ -193650,7 +194382,7 @@ async function resolveTokens(params) {
         permissions: { contents: "read" },
         oidc: params.oidc ?? void 0
       }).then((fresh) => {
-        if (isGitHubActions) core7.setSecret(fresh);
+        if (isGitHubActions) core8.setSecret(fresh);
         void revokeGitHubInstallationToken(read2);
         currentReadToken = fresh;
         log.warning("\xBB GitHub rejected the read token; re-acquired a fresh read token");
@@ -193864,7 +194596,7 @@ async function resolveProxyModel(ctx) {
   });
   if (!key) return;
   process.env.OPENROUTER_API_KEY = key;
-  core8.setSecret(key);
+  core9.setSecret(key);
   ctx.payload.proxyModel = ctx.proxyModel;
   ctx.toolState.model = ctx.proxyModel;
   const label = ctx.oss ? "oss" : "router";
@@ -193935,7 +194667,7 @@ async function runProxyResolution(ctx) {
 
 // utils/prSummary.ts
 import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname5, join as join25 } from "node:path";
+import { dirname as dirname5, join as join26 } from "node:path";
 var SUMMARY_FILE_NAME = "pullfrog-summary.md";
 var SUMMARY_SCAFFOLD = `# PR summary
 
@@ -193945,7 +194677,7 @@ var SUMMARY_SCAFFOLD = `# PR summary
 var MIN_SNAPSHOT_LENGTH = 60;
 var MAX_SNAPSHOT_LENGTH = 32768;
 function summaryFilePath(tmpdir3) {
-  return join25(tmpdir3, SUMMARY_FILE_NAME);
+  return join26(tmpdir3, SUMMARY_FILE_NAME);
 }
 async function seedSummaryFile(params) {
   const path4 = summaryFilePath(params.tmpdir);
@@ -194074,6 +194806,7 @@ var defaultSettings = {
   shell: "restricted",
   prApproveEnabled: false,
   autoMergeEnabled: false,
+  codexAgent: false,
   signedCommits: false,
   repoIntelligence: false,
   progressComments: true,
@@ -194562,7 +195295,7 @@ ${genericBody}`,
 }
 
 // utils/runLifecycle.ts
-var core9 = __toESM(require_core(), 1);
+var core10 = __toESM(require_core(), 1);
 
 // utils/autoMerge.ts
 function hasBlockingHumanReview(reviews) {
@@ -194948,7 +195681,7 @@ async function finalizeSuccessRun(input) {
   }
   if (input.toolState.output) {
     log.info(`::pullfrog-output::${Buffer.from(input.toolState.output).toString("base64")}`);
-    core9.setOutput("result", input.toolState.output);
+    core10.setOutput("result", input.toolState.output);
   }
   if (input.result.success) {
     await approveAfterFix(input.toolContext).catch((error52) => {
@@ -195412,7 +196145,11 @@ async function main() {
         }
         const resolvedModel = credentials.kind === "fellBack" ? credentials.replacement : configuredModel;
         vertexCredentials = materializeVertexCredentials({ model: resolvedModel });
-        const agent2 = resolveAgent({ model: resolvedModel });
+        const agent2 = resolveAgent({
+          model: resolvedModel,
+          proxyModel: payload.proxyModel,
+          codexAgent: runContext.repoSettings.codexAgent
+        });
         const effectiveModel = payload.proxyModel ?? resolvedModel ?? payload.model;
         toolState.model = effectiveModel;
         if (!payload.proxyModel) {
@@ -195596,8 +196333,8 @@ ${instructions.user}` : null,
           log.info(instructions.full);
         });
         if (agentId === "opencode") {
-          const pluginDir = join26(process.cwd(), ".opencode", "plugin");
-          const hasPlugins = existsSync8(pluginDir) && readdirSync2(pluginDir).some((f) => /\.[jt]sx?$/.test(f));
+          const pluginDir = join27(process.cwd(), ".opencode", "plugin");
+          const hasPlugins = existsSync9(pluginDir) && readdirSync2(pluginDir).some((f) => /\.[jt]sx?$/.test(f));
           if (hasPlugins && toolState.dependencyInstallation?.promise) {
             log.info(
               "\xBB .opencode/plugin/ detected \u2014 awaiting dependency installation before agent start"
@@ -195629,16 +196366,14 @@ ${instructions.user}` : null,
         const onInnerActivityTimeout = () => {
           if (innerTimeoutFired) return;
           innerTimeoutFired = true;
-          log.info(
-            "\xBB inner activity timeout fired \u2014 stopping MCP server and starting 5min safety-net timer"
-          );
-          mcpHttpServer[Symbol.asyncDispose]().catch((err) => {
-            log.debug(
-              `mcp server stop after inner kill failed: ${err instanceof Error ? err.message : String(err)}`
-            );
-          });
+          log.info("\xBB inner activity timeout fired \u2014 starting 5min safety-net timer");
           safetyNetTimer = setTimeout(
             () => {
+              mcpHttpServer[Symbol.asyncDispose]().catch((err) => {
+                log.debug(
+                  `mcp server stop after inner kill failed: ${err instanceof Error ? err.message : String(err)}`
+                );
+              });
               activityTimeout?.forceReject(
                 "agent still pending 5min after inner activity kill \u2014 forcing exit"
               );
@@ -195647,6 +196382,13 @@ ${instructions.user}` : null,
           );
           safetyNetTimer.unref?.();
         };
+        const onTurnRecovered = () => {
+          if (!innerTimeoutFired) return;
+          innerTimeoutFired = false;
+          if (safetyNetTimer) clearTimeout(safetyNetTimer);
+          safetyNetTimer = void 0;
+          log.info("\xBB inner activity safety net stood down \u2014 turn recovered");
+        };
         const agentPromise = agent2.run({
           payload,
           resolvedModel,
@@ -195667,6 +196409,7 @@ ${instructions.user}` : null,
           toolState,
           apiToken: runContext.apiToken,
           onActivityTimeout: onInnerActivityTimeout,
+          onTurnRecovered,
           onToolUse: (event) => {
             const wasTracked = recordDiffReadFromToolUse({
               state: primaryRepoState(toolState).diffCoverage,