pullfrog 0.1.73 → 0.1.75

package/dist/index.js

@@ -28027,7 +28027,7 @@ var require_cross_spawn = __commonJS({
       enoent.hookChildProcess(spawned, parsed2);
       return spawned;
     }
-    function spawnSync7(command, args2, options) {
+    function spawnSync8(command, args2, options) {
       const parsed2 = parse6(command, args2, options);
       const result = cp.spawnSync(parsed2.command, parsed2.args, parsed2.options);
       result.error = result.error || enoent.verifyENOENTSync(result.status, parsed2);
@@ -28035,7 +28035,7 @@ var require_cross_spawn = __commonJS({
     }
     module.exports = spawn4;
     module.exports.spawn = spawn4;
-    module.exports.sync = spawnSync7;
+    module.exports.sync = spawnSync8;
     module.exports._parse = parse6;
     module.exports._enoent = enoent;
   }
@@ -109795,7 +109795,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.73",
+  version: "0.1.75",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -176983,8 +176983,8 @@ function closeBrowserDaemon(toolState) {
 
 // mcp/checkout.ts
 import { createHash as createHash2 } from "node:crypto";
-import { statSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join14 } from "node:path";
+import { statSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join15 } from "node:path";
 
 // node_modules/.pnpm/@ark+schema@0.56.0/node_modules/@ark/schema/out/shared/errors.js
 var ArkError = class _ArkError extends CastableBase {
@@ -185256,6 +185256,960 @@ async function $gitFetchWithDeepen(args2, options, label) {
   }
 }
 
+// utils/lifecycle.ts
+import { spawnSync as spawnSync7 } from "node:child_process";
+
+// mcp/shell.ts
+import { spawn as spawn3, spawnSync as spawnSync6 } from "node:child_process";
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { closeSync, openSync, writeFileSync as writeFileSync8 } from "node:fs";
+import { userInfo as userInfo2 } from "node:os";
+import { join as join10 } from "node:path";
+import { setTimeout as sleep2 } from "node:timers/promises";
+
+// node_modules/.pnpm/@toon-format+toon@1.4.0/node_modules/@toon-format/toon/dist/index.mjs
+var LIST_ITEM_MARKER = "-";
+var LIST_ITEM_PREFIX = "- ";
+var COMMA = ",";
+var PIPE = "|";
+var DOT = ".";
+var NULL_LITERAL = "null";
+var TRUE_LITERAL = "true";
+var FALSE_LITERAL = "false";
+var BACKSLASH = "\\";
+var DOUBLE_QUOTE = '"';
+var TAB = "	";
+var DELIMITERS = {
+  comma: COMMA,
+  tab: TAB,
+  pipe: PIPE
+};
+var DEFAULT_DELIMITER = DELIMITERS.comma;
+function escapeString(value2) {
+  return value2.replace(/\\/g, `${BACKSLASH}${BACKSLASH}`).replace(/"/g, `${BACKSLASH}${DOUBLE_QUOTE}`).replace(/\n/g, `${BACKSLASH}n`).replace(/\r/g, `${BACKSLASH}r`).replace(/\t/g, `${BACKSLASH}t`);
+}
+function isBooleanOrNullLiteral(token) {
+  return token === TRUE_LITERAL || token === FALSE_LITERAL || token === NULL_LITERAL;
+}
+function normalizeValue(value2) {
+  if (value2 === null) return null;
+  if (typeof value2 === "string" || typeof value2 === "boolean") return value2;
+  if (typeof value2 === "number") {
+    if (Object.is(value2, -0)) return 0;
+    if (!Number.isFinite(value2)) return null;
+    return value2;
+  }
+  if (typeof value2 === "bigint") {
+    if (value2 >= Number.MIN_SAFE_INTEGER && value2 <= Number.MAX_SAFE_INTEGER) return Number(value2);
+    return value2.toString();
+  }
+  if (value2 instanceof Date) return value2.toISOString();
+  if (Array.isArray(value2)) return value2.map(normalizeValue);
+  if (value2 instanceof Set) return Array.from(value2).map(normalizeValue);
+  if (value2 instanceof Map) return Object.fromEntries(Array.from(value2, ([k2, v]) => [String(k2), normalizeValue(v)]));
+  if (isPlainObject6(value2)) {
+    const normalized = {};
+    for (const key in value2) if (Object.prototype.hasOwnProperty.call(value2, key)) normalized[key] = normalizeValue(value2[key]);
+    return normalized;
+  }
+  return null;
+}
+function isJsonPrimitive(value2) {
+  return value2 === null || typeof value2 === "string" || typeof value2 === "number" || typeof value2 === "boolean";
+}
+function isJsonArray(value2) {
+  return Array.isArray(value2);
+}
+function isJsonObject4(value2) {
+  return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
+}
+function isEmptyObject2(value2) {
+  return Object.keys(value2).length === 0;
+}
+function isPlainObject6(value2) {
+  if (value2 === null || typeof value2 !== "object") return false;
+  const prototype = Object.getPrototypeOf(value2);
+  return prototype === null || prototype === Object.prototype;
+}
+function isArrayOfPrimitives(value2) {
+  return value2.length === 0 || value2.every((item) => isJsonPrimitive(item));
+}
+function isArrayOfArrays(value2) {
+  return value2.length === 0 || value2.every((item) => isJsonArray(item));
+}
+function isArrayOfObjects(value2) {
+  return value2.length === 0 || value2.every((item) => isJsonObject4(item));
+}
+function isValidUnquotedKey(key) {
+  return /^[A-Z_][\w.]*$/i.test(key);
+}
+function isIdentifierSegment(key) {
+  return /^[A-Z_]\w*$/i.test(key);
+}
+function isSafeUnquoted(value2, delimiter2 = DEFAULT_DELIMITER) {
+  if (!value2) return false;
+  if (value2 !== value2.trim()) return false;
+  if (isBooleanOrNullLiteral(value2) || isNumericLike(value2)) return false;
+  if (value2.includes(":")) return false;
+  if (value2.includes('"') || value2.includes("\\")) return false;
+  if (/[[\]{}]/.test(value2)) return false;
+  if (/[\n\r\t]/.test(value2)) return false;
+  if (value2.includes(delimiter2)) return false;
+  if (value2.startsWith(LIST_ITEM_MARKER)) return false;
+  return true;
+}
+function isNumericLike(value2) {
+  return /^-?\d+(?:\.\d+)?(?:e[+-]?\d+)?$/i.test(value2) || /^0\d+$/.test(value2);
+}
+var QUOTED_KEY_MARKER = Symbol("quotedKey");
+function tryFoldKeyChain(key, value2, siblings, options, rootLiteralKeys, pathPrefix, flattenDepth) {
+  if (options.keyFolding !== "safe") return;
+  if (!isJsonObject4(value2)) return;
+  const { segments, tail, leafValue } = collectSingleKeyChain(key, value2, flattenDepth ?? options.flattenDepth);
+  if (segments.length < 2) return;
+  if (!segments.every((seg) => isIdentifierSegment(seg))) return;
+  const foldedKey = buildFoldedKey(segments);
+  const absolutePath = pathPrefix ? `${pathPrefix}${DOT}${foldedKey}` : foldedKey;
+  if (siblings.includes(foldedKey)) return;
+  if (rootLiteralKeys && rootLiteralKeys.has(absolutePath)) return;
+  return {
+    foldedKey,
+    remainder: tail,
+    leafValue,
+    segmentCount: segments.length
+  };
+}
+function collectSingleKeyChain(startKey, startValue, maxDepth) {
+  const segments = [startKey];
+  let currentValue = startValue;
+  while (segments.length < maxDepth) {
+    if (!isJsonObject4(currentValue)) break;
+    const keys = Object.keys(currentValue);
+    if (keys.length !== 1) break;
+    const nextKey = keys[0];
+    const nextValue = currentValue[nextKey];
+    segments.push(nextKey);
+    currentValue = nextValue;
+  }
+  if (!isJsonObject4(currentValue) || isEmptyObject2(currentValue)) return {
+    segments,
+    tail: void 0,
+    leafValue: currentValue
+  };
+  return {
+    segments,
+    tail: currentValue,
+    leafValue: currentValue
+  };
+}
+function buildFoldedKey(segments) {
+  return segments.join(DOT);
+}
+function encodePrimitive(value2, delimiter2) {
+  if (value2 === null) return NULL_LITERAL;
+  if (typeof value2 === "boolean") return String(value2);
+  if (typeof value2 === "number") return String(value2);
+  return encodeStringLiteral(value2, delimiter2);
+}
+function encodeStringLiteral(value2, delimiter2 = DEFAULT_DELIMITER) {
+  if (isSafeUnquoted(value2, delimiter2)) return value2;
+  return `${DOUBLE_QUOTE}${escapeString(value2)}${DOUBLE_QUOTE}`;
+}
+function encodeKey(key) {
+  if (isValidUnquotedKey(key)) return key;
+  return `${DOUBLE_QUOTE}${escapeString(key)}${DOUBLE_QUOTE}`;
+}
+function encodeAndJoinPrimitives(values, delimiter2 = DEFAULT_DELIMITER) {
+  return values.map((v) => encodePrimitive(v, delimiter2)).join(delimiter2);
+}
+function formatHeader(length, options) {
+  const key = options?.key;
+  const fields = options?.fields;
+  const delimiter2 = options?.delimiter ?? COMMA;
+  let header = "";
+  if (key) header += encodeKey(key);
+  header += `[${length}${delimiter2 !== DEFAULT_DELIMITER ? delimiter2 : ""}]`;
+  if (fields) {
+    const quotedFields = fields.map((f) => encodeKey(f));
+    header += `{${quotedFields.join(delimiter2)}}`;
+  }
+  header += ":";
+  return header;
+}
+function* encodeJsonValue(value2, options, depth) {
+  if (isJsonPrimitive(value2)) {
+    const encodedPrimitive = encodePrimitive(value2, options.delimiter);
+    if (encodedPrimitive !== "") yield encodedPrimitive;
+    return;
+  }
+  if (isJsonArray(value2)) yield* encodeArrayLines(void 0, value2, depth, options);
+  else if (isJsonObject4(value2)) yield* encodeObjectLines(value2, depth, options);
+}
+function* encodeObjectLines(value2, depth, options, rootLiteralKeys, pathPrefix, remainingDepth) {
+  const keys = Object.keys(value2);
+  if (depth === 0 && !rootLiteralKeys) rootLiteralKeys = new Set(keys.filter((k2) => k2.includes(".")));
+  const effectiveFlattenDepth = remainingDepth ?? options.flattenDepth;
+  for (const [key, val] of Object.entries(value2)) yield* encodeKeyValuePairLines(key, val, depth, options, keys, rootLiteralKeys, pathPrefix, effectiveFlattenDepth);
+}
+function* encodeKeyValuePairLines(key, value2, depth, options, siblings, rootLiteralKeys, pathPrefix, flattenDepth) {
+  const currentPath = pathPrefix ? `${pathPrefix}${DOT}${key}` : key;
+  const effectiveFlattenDepth = flattenDepth ?? options.flattenDepth;
+  if (options.keyFolding === "safe" && siblings) {
+    const foldResult = tryFoldKeyChain(key, value2, siblings, options, rootLiteralKeys, pathPrefix, effectiveFlattenDepth);
+    if (foldResult) {
+      const { foldedKey, remainder, leafValue, segmentCount } = foldResult;
+      const encodedFoldedKey = encodeKey(foldedKey);
+      if (remainder === void 0) {
+        if (isJsonPrimitive(leafValue)) {
+          yield indentedLine(depth, `${encodedFoldedKey}: ${encodePrimitive(leafValue, options.delimiter)}`, options.indent);
+          return;
+        } else if (isJsonArray(leafValue)) {
+          yield* encodeArrayLines(foldedKey, leafValue, depth, options);
+          return;
+        } else if (isJsonObject4(leafValue) && isEmptyObject2(leafValue)) {
+          yield indentedLine(depth, `${encodedFoldedKey}:`, options.indent);
+          return;
+        }
+      }
+      if (isJsonObject4(remainder)) {
+        yield indentedLine(depth, `${encodedFoldedKey}:`, options.indent);
+        const remainingDepth = effectiveFlattenDepth - segmentCount;
+        const foldedPath = pathPrefix ? `${pathPrefix}${DOT}${foldedKey}` : foldedKey;
+        yield* encodeObjectLines(remainder, depth + 1, options, rootLiteralKeys, foldedPath, remainingDepth);
+        return;
+      }
+    }
+  }
+  const encodedKey = encodeKey(key);
+  if (isJsonPrimitive(value2)) yield indentedLine(depth, `${encodedKey}: ${encodePrimitive(value2, options.delimiter)}`, options.indent);
+  else if (isJsonArray(value2)) yield* encodeArrayLines(key, value2, depth, options);
+  else if (isJsonObject4(value2)) {
+    yield indentedLine(depth, `${encodedKey}:`, options.indent);
+    if (!isEmptyObject2(value2)) yield* encodeObjectLines(value2, depth + 1, options, rootLiteralKeys, currentPath, effectiveFlattenDepth);
+  }
+}
+function* encodeArrayLines(key, value2, depth, options) {
+  if (value2.length === 0) {
+    yield indentedLine(depth, formatHeader(0, {
+      key,
+      delimiter: options.delimiter
+    }), options.indent);
+    return;
+  }
+  if (isArrayOfPrimitives(value2)) {
+    yield indentedLine(depth, encodeInlineArrayLine(value2, options.delimiter, key), options.indent);
+    return;
+  }
+  if (isArrayOfArrays(value2)) {
+    if (value2.every((arr) => isArrayOfPrimitives(arr))) {
+      yield* encodeArrayOfArraysAsListItemsLines(key, value2, depth, options);
+      return;
+    }
+  }
+  if (isArrayOfObjects(value2)) {
+    const header = extractTabularHeader(value2);
+    if (header) yield* encodeArrayOfObjectsAsTabularLines(key, value2, header, depth, options);
+    else yield* encodeMixedArrayAsListItemsLines(key, value2, depth, options);
+    return;
+  }
+  yield* encodeMixedArrayAsListItemsLines(key, value2, depth, options);
+}
+function* encodeArrayOfArraysAsListItemsLines(prefix, values, depth, options) {
+  yield indentedLine(depth, formatHeader(values.length, {
+    key: prefix,
+    delimiter: options.delimiter
+  }), options.indent);
+  for (const arr of values) if (isArrayOfPrimitives(arr)) {
+    const arrayLine = encodeInlineArrayLine(arr, options.delimiter);
+    yield indentedListItem(depth + 1, arrayLine, options.indent);
+  }
+}
+function encodeInlineArrayLine(values, delimiter2, prefix) {
+  const header = formatHeader(values.length, {
+    key: prefix,
+    delimiter: delimiter2
+  });
+  const joinedValue = encodeAndJoinPrimitives(values, delimiter2);
+  if (values.length === 0) return header;
+  return `${header} ${joinedValue}`;
+}
+function* encodeArrayOfObjectsAsTabularLines(prefix, rows, header, depth, options) {
+  yield indentedLine(depth, formatHeader(rows.length, {
+    key: prefix,
+    fields: header,
+    delimiter: options.delimiter
+  }), options.indent);
+  yield* writeTabularRowsLines(rows, header, depth + 1, options);
+}
+function extractTabularHeader(rows) {
+  if (rows.length === 0) return;
+  const firstRow = rows[0];
+  const firstKeys = Object.keys(firstRow);
+  if (firstKeys.length === 0) return;
+  if (isTabularArray(rows, firstKeys)) return firstKeys;
+}
+function isTabularArray(rows, header) {
+  for (const row of rows) {
+    if (Object.keys(row).length !== header.length) return false;
+    for (const key of header) {
+      if (!(key in row)) return false;
+      if (!isJsonPrimitive(row[key])) return false;
+    }
+  }
+  return true;
+}
+function* writeTabularRowsLines(rows, header, depth, options) {
+  for (const row of rows) yield indentedLine(depth, encodeAndJoinPrimitives(header.map((key) => row[key]), options.delimiter), options.indent);
+}
+function* encodeMixedArrayAsListItemsLines(prefix, items, depth, options) {
+  yield indentedLine(depth, formatHeader(items.length, {
+    key: prefix,
+    delimiter: options.delimiter
+  }), options.indent);
+  for (const item of items) yield* encodeListItemValueLines(item, depth + 1, options);
+}
+function* encodeObjectAsListItemLines(obj, depth, options) {
+  if (isEmptyObject2(obj)) {
+    yield indentedLine(depth, LIST_ITEM_MARKER, options.indent);
+    return;
+  }
+  const entries = Object.entries(obj);
+  if (entries.length === 1) {
+    const [key, value2] = entries[0];
+    if (isJsonArray(value2) && isArrayOfObjects(value2)) {
+      const header = extractTabularHeader(value2);
+      if (header) {
+        yield indentedListItem(depth, formatHeader(value2.length, {
+          key,
+          fields: header,
+          delimiter: options.delimiter
+        }), options.indent);
+        yield* writeTabularRowsLines(value2, header, depth + 1, options);
+        return;
+      }
+    }
+  }
+  yield indentedLine(depth, LIST_ITEM_MARKER, options.indent);
+  yield* encodeObjectLines(obj, depth + 1, options);
+}
+function* encodeListItemValueLines(value2, depth, options) {
+  if (isJsonPrimitive(value2)) yield indentedListItem(depth, encodePrimitive(value2, options.delimiter), options.indent);
+  else if (isJsonArray(value2)) if (isArrayOfPrimitives(value2)) yield indentedListItem(depth, encodeInlineArrayLine(value2, options.delimiter), options.indent);
+  else {
+    yield indentedListItem(depth, formatHeader(value2.length, { delimiter: options.delimiter }), options.indent);
+    for (const item of value2) yield* encodeListItemValueLines(item, depth + 1, options);
+  }
+  else if (isJsonObject4(value2)) yield* encodeObjectAsListItemLines(value2, depth, options);
+}
+function indentedLine(depth, content, indentSize) {
+  return " ".repeat(indentSize * depth) + content;
+}
+function indentedListItem(depth, content, indentSize) {
+  return indentedLine(depth, LIST_ITEM_PREFIX + content, indentSize);
+}
+function encode4(input2, options) {
+  return Array.from(encodeLines(input2, options)).join("\n");
+}
+function encodeLines(input2, options) {
+  return encodeJsonValue(normalizeValue(input2), resolveOptions(options), 0);
+}
+function resolveOptions(options) {
+  return {
+    indent: options?.indent ?? 2,
+    delimiter: options?.delimiter ?? DEFAULT_DELIMITER,
+    keyFolding: options?.keyFolding ?? "off",
+    flattenDepth: options?.flattenDepth ?? Number.POSITIVE_INFINITY
+  };
+}
+
+// mcp/geminiSanitizer.ts
+function parseStringEnumBranch(item) {
+  if (!item || typeof item !== "object") return null;
+  const record3 = item;
+  if (Array.isArray(record3.enum)) {
+    const strings = record3.enum.filter((v) => typeof v === "string");
+    return strings.length === record3.enum.length && strings.length > 0 ? { values: strings } : null;
+  }
+  if (typeof record3.const === "string") {
+    return { values: [record3.const] };
+  }
+  return null;
+}
+function collapseStringUnion(branches) {
+  const values = [];
+  for (const item of branches) {
+    const parsed2 = parseStringEnumBranch(item);
+    if (!parsed2) return null;
+    values.push(...parsed2.values);
+  }
+  if (values.length === 0) return null;
+  return { type: "string", enum: [...new Set(values)] };
+}
+function sanitizeForGemini(schema2) {
+  if (!schema2 || typeof schema2 !== "object") return schema2;
+  if (Array.isArray(schema2)) return schema2.map(sanitizeForGemini);
+  const source = schema2;
+  if (Array.isArray(source.enum) && typeof source.type !== "string") {
+    const allStrings = source.enum.every((v) => typeof v === "string");
+    if (allStrings) {
+      const result = { type: "string", enum: source.enum };
+      if (typeof source.description === "string") result.description = source.description;
+      return result;
+    }
+  }
+  for (const unionKey of ["anyOf", "oneOf"]) {
+    const branches = source[unionKey];
+    if (Array.isArray(branches) && branches.length > 0) {
+      const collapsed = collapseStringUnion(branches);
+      if (collapsed) {
+        const result = { ...collapsed };
+        if (typeof source.description === "string") result.description = source.description;
+        return result;
+      }
+    }
+  }
+  if (Array.isArray(source.anyOf) || Array.isArray(source.oneOf)) {
+    const result = {};
+    if (Array.isArray(source.anyOf)) result.anyOf = source.anyOf.map(sanitizeForGemini);
+    if (Array.isArray(source.oneOf)) result.oneOf = source.oneOf.map(sanitizeForGemini);
+    return result;
+  }
+  const sanitized = {};
+  for (const [key, value2] of Object.entries(source)) {
+    if (key === "$schema") continue;
+    if (key === "$defs") {
+      sanitized.definitions = sanitizeForGemini(value2);
+      continue;
+    }
+    sanitized[key] = sanitizeForGemini(value2);
+  }
+  return sanitized;
+}
+function wrapJsonSchemaProducer(producer) {
+  return new Proxy(producer, {
+    get(target, prop, receiver) {
+      const value2 = Reflect.get(target, prop, receiver);
+      if ((prop === "input" || prop === "output") && typeof value2 === "function") {
+        const fn2 = value2;
+        return (...args2) => sanitizeForGemini(fn2.apply(target, args2));
+      }
+      return value2;
+    }
+  });
+}
+function wrapStandard(standard) {
+  return new Proxy(standard, {
+    get(target, prop, receiver) {
+      if (prop === "jsonSchema") {
+        const value2 = Reflect.get(target, prop, receiver);
+        if (value2 && typeof value2 === "object") {
+          return wrapJsonSchemaProducer(value2);
+        }
+        return value2;
+      }
+      return Reflect.get(target, prop, receiver);
+    }
+  });
+}
+function wrapSchemaForGemini(schema2) {
+  return new Proxy(schema2, {
+    get(target, prop, receiver) {
+      if (prop === "~standard") {
+        const value2 = Reflect.get(target, prop, receiver);
+        if (value2 && typeof value2 === "object") {
+          return wrapStandard(value2);
+        }
+        return value2;
+      }
+      if (prop === "toJsonSchema") {
+        const method = Reflect.get(target, prop, receiver);
+        if (typeof method === "function") {
+          return () => sanitizeForGemini(method.call(target));
+        }
+        return method;
+      }
+      return Reflect.get(target, prop, receiver);
+    }
+  });
+}
+function sanitizeToolForGemini(tool2) {
+  if (!tool2.parameters) return tool2;
+  return { ...tool2, parameters: wrapSchemaForGemini(tool2.parameters) };
+}
+function isGeminiRouted(ctx) {
+  const effective = ctx.payload.proxyModel ?? ctx.resolvedModel ?? ctx.payload.model;
+  if (!effective) return true;
+  const normalized = effective.toLowerCase();
+  if (normalized.includes("gemini")) return true;
+  if (!normalized.includes("/")) return true;
+  return false;
+}
+
+// mcp/shared.ts
+function getHttpStatus(err) {
+  if (typeof err !== "object" || err === null || !("status" in err)) return void 0;
+  return typeof err.status === "number" ? err.status : void 0;
+}
+var tool = (toolDef) => toolDef;
+var handleToolSuccess = (data) => {
+  const text = typeof data === "string" ? data : encode4(data);
+  return {
+    content: [{ type: "text", text }]
+  };
+};
+var handleToolError = (error62) => {
+  const errorMessage = error62 instanceof Error ? error62.message : String(error62);
+  return {
+    content: [
+      {
+        type: "text",
+        text: `Error: ${errorMessage}`
+      }
+    ],
+    isError: true
+  };
+};
+var execute = (fn2, toolName) => {
+  const _fn = async (params) => {
+    try {
+      const result = await fn2(params);
+      return handleToolSuccess(result);
+    } catch (error62) {
+      const errorMessage = error62 instanceof Error ? error62.message : String(error62);
+      const prefix = toolName ? `[${toolName}]` : "tool";
+      log.info(`${prefix} error: ${errorMessage}`);
+      log.debug(`${prefix} params: ${formatJsonValue(params)}`);
+      return handleToolError(error62);
+    }
+  };
+  return _fn;
+};
+var addTools = (ctx, server, tools) => {
+  const shouldSanitize = isGeminiRouted(ctx);
+  for (const tool2 of tools) {
+    server.addTool(shouldSanitize ? sanitizeToolForGemini(tool2) : tool2);
+  }
+  return server;
+};
+
+// mcp/shell.ts
+var ShellParams = type({
+  command: "string",
+  // advisory and unread — no code path consumes it. kept in the schema only
+  // because it nudges the model to state intent before running a command;
+  // REQUIRING it cost a full rejected turn every time one was omitted. #1140.
+  "description?": "string",
+  "timeout?": type.number.describe(
+    "Timeout in MILLISECONDS (not seconds). Default 30000 (30s), max 120000 (2m). e.g. timeout: 180000 for 3 minutes; timeout: 180 means 180ms and will kill the process almost immediately."
+  ),
+  "working_directory?": "string",
+  "background?": "boolean"
+});
+var detectedSandboxMethod;
+var usernsProbeError;
+function getSandboxMethod() {
+  return detectSandboxMethod();
+}
+function detectSandboxMethod() {
+  if (detectedSandboxMethod !== void 0) {
+    return detectedSandboxMethod;
+  }
+  if (process.env.CI !== "true") {
+    detectedSandboxMethod = "none";
+    log.debug("sandbox disabled (CI !== true)");
+    return "none";
+  }
+  try {
+    const result = spawnSync6("unshare", ["--pid", "--fork", "--mount-proc", "true"], {
+      timeout: 5e3,
+      stdio: "ignore"
+    });
+    if (result.status === 0) {
+      detectedSandboxMethod = "unshare";
+      log.debug("PID namespace isolation enabled (unprivileged unshare)");
+      return "unshare";
+    }
+  } catch {
+  }
+  try {
+    const result = spawnSync6("sudo", ["unshare", "--pid", "--fork", "--mount-proc", "true"], {
+      timeout: 5e3,
+      stdio: "ignore"
+    });
+    if (result.status === 0) {
+      detectedSandboxMethod = "sudo-unshare";
+      log.debug("PID namespace isolation enabled (sudo unshare)");
+      return "sudo-unshare";
+    }
+  } catch {
+  }
+  try {
+    const result = spawnSync6(
+      "unshare",
+      [
+        "--user",
+        "--map-root-user",
+        "--pid",
+        "--fork",
+        "--mount",
+        "setpriv",
+        "--no-new-privs",
+        "--bounding-set",
+        "-all",
+        "--inh-caps",
+        "-all",
+        "--ambient-caps",
+        "-all",
+        "true"
+      ],
+      { timeout: 5e3, stdio: ["ignore", "ignore", "pipe"] }
+    );
+    if (result.status === 0) {
+      detectedSandboxMethod = "userns-unshare";
+      log.debug("PID namespace isolation enabled (unprivileged userns unshare)");
+      return "userns-unshare";
+    }
+    usernsProbeError = result.stderr?.toString().trim() || result.error?.message;
+  } catch {
+  }
+  detectedSandboxMethod = "none";
+  log.info("PID namespace isolation not available");
+  return "none";
+}
+var PROC_CLEANUP = "umount /proc 2>/dev/null; umount /proc 2>/dev/null; mount -t proc proc /proc 2>/dev/null;";
+var SOCKET_CLEANUP = [
+  "/var/run/docker.sock",
+  "/run/docker.sock",
+  "/var/run/podman/podman.sock",
+  "/run/podman/podman.sock",
+  "/run/containerd/containerd.sock",
+  "/var/run/crio/crio.sock"
+].map((path4) => `mount --bind /dev/null ${path4} 2>/dev/null;`).join(" ");
+function buildFsMounts(repoDir) {
+  const escaped = repoDir.replace(/'/g, "'\\''");
+  return [
+    `mkdir -p /var/lib/pullfrog 2>/dev/null;`,
+    `mount -t tmpfs tmpfs /var/lib/pullfrog 2>/dev/null;`,
+    `[ -n "$RUNNER_TEMP" ] && [ -d "$RUNNER_TEMP/_runner_file_commands" ] && mount -t tmpfs tmpfs "$RUNNER_TEMP/_runner_file_commands" 2>/dev/null;`,
+    `[ -e '${escaped}/.git' ] && mount --bind '${escaped}/.git' '${escaped}/.git' 2>/dev/null && mount -o remount,bind,ro '${escaped}/.git' 2>/dev/null;`,
+    // the corepack shim dir sits FIRST on PATH (utils/packageManager.ts) and
+    // PATH survives filterEnv, so a writable pm-bin lets sandboxed code plant
+    // a `git`/`pnpm` that a later UNSANDBOXED spawn resolves with the parent
+    // env. read-only closes that for every sandboxed command at once.
+    //
+    // the path is interpolated HERE rather than read as `$PULLFROG_TEMP_DIR`
+    // inside the sandbox: that name is not on the `filterEnv` safe list, so in
+    // restricted mode it expands to empty and the mount silently no-ops in the
+    // one tier it exists to protect. `$RUNNER_TEMP` above is safe only because
+    // `RUNNER_` is an allowed prefix.
+    shimMount()
+  ].filter(Boolean).join(" ");
+}
+function shimMount() {
+  const tempDir = process.env.PULLFROG_TEMP_DIR;
+  if (!tempDir) return "";
+  const dir = join10(tempDir, "pm-bin").replace(/'/g, "'\\''");
+  return `[ -d '${dir}' ] && mount --bind '${dir}' '${dir}' 2>/dev/null && mount -o remount,bind,ro '${dir}' 2>/dev/null;`;
+}
+var _repoRoot;
+function resolveRepoRoot() {
+  if (_repoRoot) return _repoRoot;
+  const fromEnv = process.env.GITHUB_WORKSPACE;
+  if (fromEnv) {
+    _repoRoot = fromEnv;
+    return _repoRoot;
+  }
+  try {
+    _repoRoot = spawnSync6("git", ["rev-parse", "--show-toplevel"], {
+      cwd: process.cwd(),
+      stdio: ["ignore", "pipe", "ignore"],
+      encoding: "utf-8"
+    }).stdout?.trim();
+  } catch {
+  }
+  if (!_repoRoot) _repoRoot = process.cwd();
+  return _repoRoot;
+}
+function spawnShell(params) {
+  const spawnOpts = { env: params.env, cwd: params.cwd, stdio: params.stdio, detached: true };
+  const sandboxMethod = detectSandboxMethod();
+  const ci = process.env.CI === "true";
+  if (ci && sandboxMethod === "none") {
+    throw new Error(
+      "PID-namespace isolation is required in CI but unavailable: unprivileged unshare, sudo unshare, and userns-nested unshare all failed. " + (usernsProbeError ? `userns probe said: ${usernsProbeError}. ` : "") + "on a containerized / Kubernetes self-hosted runner the cause is usually one of: the pod's seccomp profile blocks user-namespace creation (Pod Security Standards baseline/restricted); the pod runs as root without CAP_SETFCAP, which the kernel requires to map uid 0; or the node kernel disallows unprivileged user namespaces (Ubuntu >= 23.10, Bottlerocket, Talos). elsewhere, check that `unshare` and `setpriv` (util-linux >= 2.31, which is what added --ambient-caps) are on PATH. see https://docs.pullfrog.com/security#self-hosted-runners"
+    );
+  }
+  const repoRoot = resolveRepoRoot();
+  const fsMounts = buildFsMounts(repoRoot);
+  if (sandboxMethod === "unshare") {
+    return spawn3(
+      "unshare",
+      [
+        "--pid",
+        "--fork",
+        "--mount-proc",
+        "bash",
+        "-c",
+        `${PROC_CLEANUP} ${SOCKET_CLEANUP} ${fsMounts} ${params.command}`
+      ],
+      spawnOpts
+    );
+  }
+  if (sandboxMethod === "userns-unshare") {
+    const escaped = params.command.replace(/'/g, "'\\''");
+    return spawn3(
+      "unshare",
+      [
+        "--user",
+        "--map-root-user",
+        "--pid",
+        "--fork",
+        "--mount",
+        "bash",
+        "-c",
+        `${PROC_CLEANUP} ${SOCKET_CLEANUP} ${fsMounts} exec setpriv --no-new-privs --bounding-set -all --inh-caps -all --ambient-caps -all bash -c '${escaped}'`
+      ],
+      spawnOpts
+    );
+  }
+  if (sandboxMethod === "sudo-unshare") {
+    const envArgs = [];
+    for (const [k2, v] of Object.entries(params.env)) {
+      if (v !== void 0) {
+        envArgs.push(`${k2}=${v}`);
+      }
+    }
+    const username = userInfo2().username;
+    const pathRestore = 'export PATH="${SANDBOX_PATH:-$PATH}"; ';
+    const escaped = (pathRestore + params.command).replace(/'/g, "'\\''");
+    envArgs.push(`SANDBOX_PATH=${params.env.PATH ?? ""}`);
+    return spawn3(
+      "sudo",
+      [
+        "env",
+        ...envArgs,
+        "unshare",
+        "--pid",
+        "--fork",
+        "--mount-proc",
+        "bash",
+        "-c",
+        `${PROC_CLEANUP} ${SOCKET_CLEANUP} ${fsMounts} exec su -p -s /bin/bash ${username} -c '${escaped}'`
+      ],
+      { ...spawnOpts, env: {} }
+    );
+  }
+  return spawn3("bash", ["-c", params.command], spawnOpts);
+}
+async function killProcessGroup(proc) {
+  if (!proc.pid) return;
+  try {
+    process.kill(-proc.pid, "SIGTERM");
+    await new Promise((r) => setTimeout(r, 200));
+    process.kill(-proc.pid, "SIGKILL");
+  } catch {
+    try {
+      proc.kill("SIGKILL");
+    } catch {
+    }
+  }
+}
+function getTempDir() {
+  const tempDir = process.env.PULLFROG_TEMP_DIR;
+  if (!tempDir) {
+    throw new Error("PULLFROG_TEMP_DIR not set");
+  }
+  return tempDir;
+}
+var MAX_OUTPUT_CHARS = 5e3;
+async function runSandboxed(params) {
+  const proc = spawnShell({
+    command: params.command,
+    env: params.env,
+    cwd: params.cwd,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const stdout = new TailBuffer(DEFAULT_MAX_RETAINED_BYTES);
+  const stderr = new TailBuffer(DEFAULT_MAX_RETAINED_BYTES);
+  let timedOut = false, exited = false, spawnError = "";
+  proc.stdout?.on("data", (chunk) => {
+    const text = chunk.toString();
+    stdout.append(text);
+    params.onStdout?.(text);
+  });
+  proc.stderr?.on("data", (chunk) => {
+    const text = chunk.toString();
+    stderr.append(text);
+    params.onStderr?.(text);
+  });
+  const timeoutId = setTimeout(async () => {
+    if (!exited) {
+      timedOut = true;
+      await killProcessGroup(proc);
+    }
+  }, params.timeout);
+  const exitCode = await new Promise((resolve3) => {
+    const done = (code) => {
+      exited = true;
+      clearTimeout(timeoutId);
+      resolve3(code);
+    };
+    proc.on("exit", done);
+    proc.on("error", (err) => {
+      spawnError = err.message;
+      done(null);
+    });
+  });
+  proc.stdout?.destroy();
+  proc.stderr?.destroy();
+  const outText = stdout.toString();
+  const errText = stderr.toString();
+  let output2 = errText ? outText ? `${outText}
+${errText}` : errText : outText;
+  if (spawnError) output2 = output2 ? `${output2}
+${spawnError}` : spawnError;
+  if (timedOut)
+    output2 = output2 ? `${output2}
+[timed out after ${params.timeout}ms]` : `[timed out after ${params.timeout}ms]`;
+  return {
+    output: output2.trim(),
+    exitCode: exitCode ?? (timedOut ? 124 : -1),
+    timedOut
+  };
+}
+function capOutput(output2) {
+  if (output2.length <= MAX_OUTPUT_CHARS) return output2;
+  const fullPath = join10(getTempDir(), `shell-${randomUUID3().slice(0, 8)}.log`);
+  writeFileSync8(fullPath, output2);
+  const elided = output2.length - MAX_OUTPUT_CHARS;
+  return `... [${elided} chars truncated; output saved to ${fullPath}] ...
+${output2.slice(-MAX_OUTPUT_CHARS)}`;
+}
+function isGitCommand(command) {
+  const trimmed = command.trim();
+  if (trimmed === "git" || trimmed.startsWith("git ")) return true;
+  if (trimmed.startsWith("sudo git")) return true;
+  return /[;&|]\s*(?:sudo\s+)?git(?:\s|$)/.test(trimmed);
+}
+function ShellTool(ctx) {
+  return tool({
+    name: "shell",
+    timeoutMs: 12e4,
+    description: `Execute shell commands securely. Environment is filtered to remove API keys and secrets.
+
+Example: \`shell({ command: "pnpm test", description: "run the test suite" })\`.
+
+Use this tool to:
+- Run shell commands (ls, cat, grep, find, etc.)
+- Execute build tools (npm, pnpm, cargo, make, etc.)
+- Run tests and linters
+
+Output is capped at ${MAX_OUTPUT_CHARS} chars: if exceeded, only the tail is returned and the captured output is saved to a tempfile (path included in the response). Re-read the tempfile with cat/tail/grep when you need more.
+
+Do NOT use this tool for git commands \u2014 use the dedicated git tools instead.`,
+    parameters: ShellParams,
+    execute: execute(async (params) => {
+      if (isGitCommand(params.command)) {
+        throw new Error(
+          'git commands are not allowed in the shell tool. use the dedicated git tools instead:\n- git: local operations, e.g. git({ command: "log", args: ["--oneline"] }) \u2014 `command` is the subcommand ONLY\n- push_branch: push to remote (handles authentication)\n- git_fetch: fetch from remote (handles authentication)\n- checkout_pr: check out PR branches'
+        );
+      }
+      const timeout = Math.min(params.timeout ?? 3e4, 12e4);
+      const cwd = params.working_directory ?? process.cwd();
+      const env2 = resolveEnv(ctx.payload.shell === "enabled" ? "inherit" : "restricted");
+      if (params.command.includes("agent-browser")) {
+        const daemonError = ensureBrowserDaemon(ctx.toolState);
+        if (daemonError) {
+          return {
+            output: `browser daemon unavailable: ${daemonError}`,
+            exit_code: 1,
+            timed_out: false
+          };
+        }
+        const binDir = ctx.toolState.browserDaemon?.binDir;
+        if (binDir) {
+          env2.PATH = `${binDir}:${env2.PATH ?? ""}`;
+        }
+      }
+      if (params.background) {
+        const tempDir = getTempDir();
+        const handle = `bg-${randomUUID3().slice(0, 8)}`;
+        const outputPath = join10(tempDir, `${handle}.log`);
+        const pidPath = join10(tempDir, `${handle}.pid`);
+        const logFd = openSync(outputPath, "a");
+        let proc;
+        try {
+          proc = spawnShell({
+            command: params.command,
+            env: env2,
+            cwd,
+            stdio: ["ignore", logFd, logFd]
+          });
+        } finally {
+          closeSync(logFd);
+        }
+        if (!proc.pid) {
+          throw new Error("failed to start background process");
+        }
+        proc.unref();
+        writeFileSync8(pidPath, `${proc.pid}
+`);
+        ctx.toolState.backgroundProcesses.set(handle, { pid: proc.pid, outputPath, pidPath });
+        return {
+          handle,
+          outputPath,
+          pidPath,
+          message: `started background process ${handle} (pid ${proc.pid})`
+        };
+      }
+      const result = await runSandboxed({ command: params.command, env: env2, cwd, timeout });
+      if (result.exitCode !== 0) {
+        log.info(`shell command failed with exit code ${result.exitCode}: ${params.command}`);
+        if (result.output) log.info(`output: ${result.output}`);
+      }
+      return {
+        output: capOutput(result.output),
+        exit_code: result.exitCode,
+        timed_out: result.timedOut
+      };
+    })
+  });
+}
+var KillBackgroundParams = type({
+  handle: type.string.describe("The handle of the background process to kill (e.g., bg-a1b2c3d4)")
+});
+function KillBackgroundTool(ctx) {
+  return tool({
+    name: "kill_background",
+    mutates: true,
+    description: `Kill a background process by its handle. Use this to stop dev servers or other long-running processes started with shell({ background: true }).`,
+    parameters: KillBackgroundParams,
+    execute: execute(async (params) => {
+      const proc = ctx.toolState.backgroundProcesses.get(params.handle);
+      if (!proc) {
+        return {
+          success: false,
+          message: `no background process with handle ${params.handle}`
+        };
+      }
+      try {
+        process.kill(-proc.pid, "SIGTERM");
+      } catch {
+      }
+      await sleep2(200);
+      try {
+        process.kill(-proc.pid, "SIGKILL");
+      } catch {
+      }
+      ctx.toolState.backgroundProcesses.delete(params.handle);
+      return {
+        success: true,
+        message: `killed background process ${params.handle} (pid ${proc.pid})`
+      };
+    })
+  });
+}
+
 // utils/lifecycle.ts
 function describeSetupFailure(failure2) {
   if (!failure2) return "";
@@ -185277,44 +186231,47 @@ ${failure2.output || "(empty)"}`;
 async function executeLifecycleHook(params) {
   if (!params.script) return {};
   log.info(`\xBB executing ${params.event} lifecycle hook...`);
+  resolveTrustedGit();
   const preHookTrackedCount = params.normalizeWorkingTreeAfter ? (await runGitLines(["diff", "--name-only", "HEAD"])).length : 0;
   let result;
   try {
+    let sandboxed;
     try {
-      const spawnResult = await spawn({
-        cmd: "bash",
-        args: ["-c", params.script],
-        env: process.env,
+      sandboxed = await runSandboxed({
+        command: params.script,
+        env: resolveEnv(params.shell === "enabled" ? "inherit" : "restricted"),
+        cwd: process.cwd(),
         timeout: LIFECYCLE_HOOK_TIMEOUT_MS,
-        activityTimeout: 0,
         onStdout: (chunk) => process.stdout.write(chunk),
         onStderr: (chunk) => process.stderr.write(chunk)
       });
-      if (spawnResult.exitCode !== 0) {
-        const output2 = (spawnResult.stderr || spawnResult.stdout).trim();
-        result = {
-          failure: { kind: "exit", output: output2, exitCode: spawnResult.exitCode },
-          warning: `lifecycle hook '${params.event}' failed with exit code ${spawnResult.exitCode}. output: ${output2 || "(empty)"}. retry the operation if the failure looks flaky (network blips, transient rate limits). do NOT retry if the script is broken (missing commands, syntax errors) or the error is persistent.`
-        };
-      } else {
-        log.info(`\xBB ${params.event} lifecycle hook completed successfully`);
-        result = {};
-      }
     } catch (err) {
-      const isTimeout = err instanceof SpawnTimeoutError && (err.code === SPAWN_TIMEOUT_CODE || err.code === SPAWN_ACTIVITY_TIMEOUT_CODE);
-      if (isTimeout) {
-        const minutes = Math.round(LIFECYCLE_HOOK_TIMEOUT_MS / 6e4);
-        result = {
-          failure: { kind: "timeout" },
-          warning: `lifecycle hook '${params.event}' timed out after ${minutes}min. do NOT retry \u2014 the script is likely hung or doing too much work. ask the repo owner to simplify the hook (e.g. move long-running work out of the hook, add caching, or split it).`
-        };
-      } else {
-        const msg = err instanceof Error ? err.message : String(err);
-        result = {
-          failure: { kind: "spawn", spawnError: msg },
-          warning: `lifecycle hook '${params.event}' failed to spawn: ${msg}. this is likely a transient failure \u2014 retry the operation.`
-        };
-      }
+      const msg = err instanceof Error ? err.message : String(err);
+      return {
+        failure: { kind: "spawn", spawnError: msg },
+        warning: `lifecycle hook '${params.event}' could not be sandboxed, so it did not run: ${msg}`
+      };
+    }
+    if (sandboxed.timedOut) {
+      const minutes = Math.round(LIFECYCLE_HOOK_TIMEOUT_MS / 6e4);
+      result = {
+        failure: { kind: "timeout" },
+        warning: `lifecycle hook '${params.event}' timed out after ${minutes}min. do NOT retry \u2014 the script is likely hung or doing too much work. ask the repo owner to simplify the hook (e.g. move long-running work out of the hook, add caching, or split it).`
+      };
+    } else if (sandboxed.exitCode === -1) {
+      result = {
+        failure: { kind: "spawn", spawnError: sandboxed.output },
+        warning: `lifecycle hook '${params.event}' failed to spawn: ${sandboxed.output}. this is likely a transient failure \u2014 retry the operation.`
+      };
+    } else if (sandboxed.exitCode !== 0) {
+      const output2 = capOutput(sandboxed.output);
+      result = {
+        failure: { kind: "exit", output: output2, exitCode: sandboxed.exitCode },
+        warning: `lifecycle hook '${params.event}' failed with exit code ${sandboxed.exitCode}. output: ${output2 || "(empty)"}. retry the operation if the failure looks flaky (network blips, transient rate limits). do NOT retry if the script is broken (missing commands, syntax errors) or the error is persistent. if it failed on a missing environment variable, the repo's env allowlist has to name it \u2014 hooks run with the same filtered env as the shell tool.`
+      };
+    } else {
+      log.info(`\xBB ${params.event} lifecycle hook completed successfully`);
+      result = {};
     }
   } finally {
     if (params.normalizeWorkingTreeAfter) {
@@ -185335,8 +186292,20 @@ async function normalizeWorkingTreeAfterHook(params) {
   await runGit(["restore", "--staged", "--worktree", "."]);
   log.info(`\xBB discarded ${trackedCount} tracked changes from ${params.event} hook`);
 }
+var trustedGit;
+function resolveTrustedGit() {
+  if (trustedGit) return trustedGit;
+  const resolved = spawnSync7("sh", ["-c", "command -v git"], { encoding: "utf-8" });
+  trustedGit = resolved.stdout?.trim() || "git";
+  return trustedGit;
+}
 async function runGit(args2) {
-  const result = await spawn({ cmd: "git", args: args2, env: process.env, activityTimeout: 0 });
+  const result = await spawn({
+    cmd: resolveTrustedGit(),
+    args: args2,
+    env: filterEnvForUntrustedCode(),
+    activityTimeout: 0
+  });
   if (result.exitCode !== 0) {
     throw new Error(
       `git ${args2.join(" ")} failed (exit ${result.exitCode}): ${result.stderr.trim() || "(no stderr)"}`
@@ -185456,7 +186425,7 @@ function postProcessRangeDiff(raw2, contextLines = 3) {
 
 // yes/index.ts
 import { performance as performance8 } from "node:perf_hooks";
-import { setTimeout as sleep2 } from "node:timers/promises";
+import { setTimeout as sleep3 } from "node:timers/promises";
 
 // node_modules/.pnpm/lru-cache@11.5.2/node_modules/lru-cache/dist/esm/node/index.min.js
 import { tracingChannel as G, channel as P } from "node:diagnostics_channel";
@@ -186250,7 +187219,7 @@ function _op(fn2, options) {
               );
               log2.info({ key, error: error62, attempt });
             }
-            await sleep2(delay2);
+            await sleep3(delay2);
           }
         }
       }
@@ -186318,14 +187287,14 @@ function _op(fn2, options) {
 }
 
 // mcp/git.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
-import { writeFileSync as writeFileSync8 } from "node:fs";
-import { join as join12 } from "node:path";
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join13 } from "node:path";
 
 // utils/apiCommit.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { lstat, readlink } from "node:fs/promises";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 var GITHUB_API = "https://api.github.com";
 var MAX_BLOB_BYTES = 30 * 1024 * 1024;
 var BLOB_UPLOAD_CONCURRENCY = 8;
@@ -186390,7 +187359,7 @@ async function assertApiCommittable(files) {
   const root = getRepoRoot();
   const attrs = $(
     "git",
-    ["check-attr", "filter", "-z", "--", ...present.map((p) => join10(root, p))],
+    ["check-attr", "filter", "-z", "--", ...present.map((p) => join11(root, p))],
     { log: false }
   );
   const parts = attrs.split("\0");
@@ -186402,7 +187371,7 @@ async function assertApiCommittable(files) {
     }
   }
   for (const path4 of present) {
-    const stat = await lstat(join10(root, path4));
+    const stat = await lstat(join11(root, path4));
     if (stat.isDirectory()) {
       throw new Error(
         `'${path4}' is a directory (nested repository or submodule?) \u2014 signed commits only support files and symlinks.`
@@ -186411,7 +187380,7 @@ async function assertApiCommittable(files) {
   }
 }
 async function createBlobEntry(params) {
-  const absPath = join10(params.repoRoot, params.path);
+  const absPath = join11(params.repoRoot, params.path);
   const stat = await lstat(absPath);
   if (stat.size > MAX_BLOB_BYTES) {
     throw new Error(
@@ -186591,7 +187560,7 @@ this usually means your local branch has commits that were never pushed \u2014 s
 var core5 = __toESM(require_core(), 1);
 import { createSign } from "node:crypto";
 import { rename, writeFile } from "node:fs/promises";
-import { dirname as dirname3, join as join11 } from "node:path";
+import { dirname as dirname3, join as join12 } from "node:path";
 
 // node_modules/.pnpm/@octokit+plugin-throttling@11.0.5_@octokit+core@7.0.8/node_modules/@octokit/plugin-throttling/dist-bundle/index.js
 var import_light = __toESM(require_light(), 1);
@@ -186963,7 +187932,7 @@ function lowercaseKeys(object5) {
     return newObj;
   }, {});
 }
-function isPlainObject6(value2) {
+function isPlainObject7(value2) {
   if (typeof value2 !== "object" || value2 === null) return false;
   if (Object.prototype.toString.call(value2) !== "[object Object]") return false;
   const proto = Object.getPrototypeOf(value2);
@@ -186974,7 +187943,7 @@ function isPlainObject6(value2) {
 function mergeDeep(defaults, options) {
   const result = Object.assign({}, defaults);
   Object.keys(options).forEach((key) => {
-    if (isPlainObject6(options[key])) {
+    if (isPlainObject7(options[key])) {
       if (!(key in defaults)) Object.assign(result, { [key]: options[key] });
       else result[key] = mergeDeep(defaults[key], options[key]);
     } else {
@@ -187261,7 +188230,7 @@ var NullObject = /* @__PURE__ */ (() => {
   return C;
 })();
 function parse5(header, options) {
-  const stopChar = options?.comma === true ? COMMA : 65536;
+  const stopChar = options?.comma === true ? COMMA2 : 65536;
   const len = header.length;
   let index = skipOWS(header, options?.start ?? 0, len);
   const valueStart = index;
@@ -187279,7 +188248,7 @@ var SEMI = 59;
 var EQ = 61;
 var DQUOTE = 34;
 var BSLASH = 92;
-var COMMA = 44;
+var COMMA2 = 44;
 function parseParameters(header, type2, index, len, stopChar) {
   const parameters = new NullObject();
   parameter: while (index < len) {
@@ -187738,7 +188707,7 @@ var defaults_default = {
     "user-agent": `octokit-request.js/${VERSION3} ${getUserAgent2()}`
   }
 };
-function isPlainObject7(value2) {
+function isPlainObject8(value2) {
   if (typeof value2 !== "object" || value2 === null) return false;
   if (Object.prototype.toString.call(value2) !== "[object Object]") return false;
   const proto = Object.getPrototypeOf(value2);
@@ -187756,7 +188725,7 @@ async function fetchWrapper(requestOptions) {
   }
   const log3 = requestOptions.request?.log || console;
   const parseSuccessResponseBody = requestOptions.request?.parseSuccessResponseBody !== false;
-  const body = isPlainObject7(requestOptions.body) || Array.isArray(requestOptions.body) ? JSONStringify(requestOptions.body) : requestOptions.body;
+  const body = isPlainObject8(requestOptions.body) || Array.isArray(requestOptions.body) ? JSONStringify(requestOptions.body) : requestOptions.body;
   const requestHeaders = Object.fromEntries(
     Object.entries(requestOptions.headers).map(([name, value2]) => [
       name,
@@ -191061,7 +192030,7 @@ function getGitHubUsageSummary() {
 }
 async function writeGitHubUsageSummaryToFile(path4) {
   const summary2 = getGitHubUsageSummary();
-  const tmpPath = join11(dirname3(path4), `.usage-summary-${process.pid}.tmp`);
+  const tmpPath = join12(dirname3(path4), `.usage-summary-${process.pid}.tmp`);
   await writeFile(tmpPath, JSON.stringify(summary2));
   await rename(tmpPath, path4);
 }
@@ -191168,531 +192137,6 @@ function resolveRepoCtx(ctx, repo) {
   };
 }
 
-// node_modules/.pnpm/@toon-format+toon@1.4.0/node_modules/@toon-format/toon/dist/index.mjs
-var LIST_ITEM_MARKER = "-";
-var LIST_ITEM_PREFIX = "- ";
-var COMMA2 = ",";
-var PIPE = "|";
-var DOT = ".";
-var NULL_LITERAL = "null";
-var TRUE_LITERAL = "true";
-var FALSE_LITERAL = "false";
-var BACKSLASH = "\\";
-var DOUBLE_QUOTE = '"';
-var TAB = "	";
-var DELIMITERS = {
-  comma: COMMA2,
-  tab: TAB,
-  pipe: PIPE
-};
-var DEFAULT_DELIMITER = DELIMITERS.comma;
-function escapeString(value2) {
-  return value2.replace(/\\/g, `${BACKSLASH}${BACKSLASH}`).replace(/"/g, `${BACKSLASH}${DOUBLE_QUOTE}`).replace(/\n/g, `${BACKSLASH}n`).replace(/\r/g, `${BACKSLASH}r`).replace(/\t/g, `${BACKSLASH}t`);
-}
-function isBooleanOrNullLiteral(token) {
-  return token === TRUE_LITERAL || token === FALSE_LITERAL || token === NULL_LITERAL;
-}
-function normalizeValue(value2) {
-  if (value2 === null) return null;
-  if (typeof value2 === "string" || typeof value2 === "boolean") return value2;
-  if (typeof value2 === "number") {
-    if (Object.is(value2, -0)) return 0;
-    if (!Number.isFinite(value2)) return null;
-    return value2;
-  }
-  if (typeof value2 === "bigint") {
-    if (value2 >= Number.MIN_SAFE_INTEGER && value2 <= Number.MAX_SAFE_INTEGER) return Number(value2);
-    return value2.toString();
-  }
-  if (value2 instanceof Date) return value2.toISOString();
-  if (Array.isArray(value2)) return value2.map(normalizeValue);
-  if (value2 instanceof Set) return Array.from(value2).map(normalizeValue);
-  if (value2 instanceof Map) return Object.fromEntries(Array.from(value2, ([k2, v]) => [String(k2), normalizeValue(v)]));
-  if (isPlainObject8(value2)) {
-    const normalized = {};
-    for (const key in value2) if (Object.prototype.hasOwnProperty.call(value2, key)) normalized[key] = normalizeValue(value2[key]);
-    return normalized;
-  }
-  return null;
-}
-function isJsonPrimitive(value2) {
-  return value2 === null || typeof value2 === "string" || typeof value2 === "number" || typeof value2 === "boolean";
-}
-function isJsonArray(value2) {
-  return Array.isArray(value2);
-}
-function isJsonObject4(value2) {
-  return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
-}
-function isEmptyObject2(value2) {
-  return Object.keys(value2).length === 0;
-}
-function isPlainObject8(value2) {
-  if (value2 === null || typeof value2 !== "object") return false;
-  const prototype = Object.getPrototypeOf(value2);
-  return prototype === null || prototype === Object.prototype;
-}
-function isArrayOfPrimitives(value2) {
-  return value2.length === 0 || value2.every((item) => isJsonPrimitive(item));
-}
-function isArrayOfArrays(value2) {
-  return value2.length === 0 || value2.every((item) => isJsonArray(item));
-}
-function isArrayOfObjects(value2) {
-  return value2.length === 0 || value2.every((item) => isJsonObject4(item));
-}
-function isValidUnquotedKey(key) {
-  return /^[A-Z_][\w.]*$/i.test(key);
-}
-function isIdentifierSegment(key) {
-  return /^[A-Z_]\w*$/i.test(key);
-}
-function isSafeUnquoted(value2, delimiter2 = DEFAULT_DELIMITER) {
-  if (!value2) return false;
-  if (value2 !== value2.trim()) return false;
-  if (isBooleanOrNullLiteral(value2) || isNumericLike(value2)) return false;
-  if (value2.includes(":")) return false;
-  if (value2.includes('"') || value2.includes("\\")) return false;
-  if (/[[\]{}]/.test(value2)) return false;
-  if (/[\n\r\t]/.test(value2)) return false;
-  if (value2.includes(delimiter2)) return false;
-  if (value2.startsWith(LIST_ITEM_MARKER)) return false;
-  return true;
-}
-function isNumericLike(value2) {
-  return /^-?\d+(?:\.\d+)?(?:e[+-]?\d+)?$/i.test(value2) || /^0\d+$/.test(value2);
-}
-var QUOTED_KEY_MARKER = Symbol("quotedKey");
-function tryFoldKeyChain(key, value2, siblings, options, rootLiteralKeys, pathPrefix, flattenDepth) {
-  if (options.keyFolding !== "safe") return;
-  if (!isJsonObject4(value2)) return;
-  const { segments, tail, leafValue } = collectSingleKeyChain(key, value2, flattenDepth ?? options.flattenDepth);
-  if (segments.length < 2) return;
-  if (!segments.every((seg) => isIdentifierSegment(seg))) return;
-  const foldedKey = buildFoldedKey(segments);
-  const absolutePath = pathPrefix ? `${pathPrefix}${DOT}${foldedKey}` : foldedKey;
-  if (siblings.includes(foldedKey)) return;
-  if (rootLiteralKeys && rootLiteralKeys.has(absolutePath)) return;
-  return {
-    foldedKey,
-    remainder: tail,
-    leafValue,
-    segmentCount: segments.length
-  };
-}
-function collectSingleKeyChain(startKey, startValue, maxDepth) {
-  const segments = [startKey];
-  let currentValue = startValue;
-  while (segments.length < maxDepth) {
-    if (!isJsonObject4(currentValue)) break;
-    const keys = Object.keys(currentValue);
-    if (keys.length !== 1) break;
-    const nextKey = keys[0];
-    const nextValue = currentValue[nextKey];
-    segments.push(nextKey);
-    currentValue = nextValue;
-  }
-  if (!isJsonObject4(currentValue) || isEmptyObject2(currentValue)) return {
-    segments,
-    tail: void 0,
-    leafValue: currentValue
-  };
-  return {
-    segments,
-    tail: currentValue,
-    leafValue: currentValue
-  };
-}
-function buildFoldedKey(segments) {
-  return segments.join(DOT);
-}
-function encodePrimitive(value2, delimiter2) {
-  if (value2 === null) return NULL_LITERAL;
-  if (typeof value2 === "boolean") return String(value2);
-  if (typeof value2 === "number") return String(value2);
-  return encodeStringLiteral(value2, delimiter2);
-}
-function encodeStringLiteral(value2, delimiter2 = DEFAULT_DELIMITER) {
-  if (isSafeUnquoted(value2, delimiter2)) return value2;
-  return `${DOUBLE_QUOTE}${escapeString(value2)}${DOUBLE_QUOTE}`;
-}
-function encodeKey(key) {
-  if (isValidUnquotedKey(key)) return key;
-  return `${DOUBLE_QUOTE}${escapeString(key)}${DOUBLE_QUOTE}`;
-}
-function encodeAndJoinPrimitives(values, delimiter2 = DEFAULT_DELIMITER) {
-  return values.map((v) => encodePrimitive(v, delimiter2)).join(delimiter2);
-}
-function formatHeader(length, options) {
-  const key = options?.key;
-  const fields = options?.fields;
-  const delimiter2 = options?.delimiter ?? COMMA2;
-  let header = "";
-  if (key) header += encodeKey(key);
-  header += `[${length}${delimiter2 !== DEFAULT_DELIMITER ? delimiter2 : ""}]`;
-  if (fields) {
-    const quotedFields = fields.map((f) => encodeKey(f));
-    header += `{${quotedFields.join(delimiter2)}}`;
-  }
-  header += ":";
-  return header;
-}
-function* encodeJsonValue(value2, options, depth) {
-  if (isJsonPrimitive(value2)) {
-    const encodedPrimitive = encodePrimitive(value2, options.delimiter);
-    if (encodedPrimitive !== "") yield encodedPrimitive;
-    return;
-  }
-  if (isJsonArray(value2)) yield* encodeArrayLines(void 0, value2, depth, options);
-  else if (isJsonObject4(value2)) yield* encodeObjectLines(value2, depth, options);
-}
-function* encodeObjectLines(value2, depth, options, rootLiteralKeys, pathPrefix, remainingDepth) {
-  const keys = Object.keys(value2);
-  if (depth === 0 && !rootLiteralKeys) rootLiteralKeys = new Set(keys.filter((k2) => k2.includes(".")));
-  const effectiveFlattenDepth = remainingDepth ?? options.flattenDepth;
-  for (const [key, val] of Object.entries(value2)) yield* encodeKeyValuePairLines(key, val, depth, options, keys, rootLiteralKeys, pathPrefix, effectiveFlattenDepth);
-}
-function* encodeKeyValuePairLines(key, value2, depth, options, siblings, rootLiteralKeys, pathPrefix, flattenDepth) {
-  const currentPath = pathPrefix ? `${pathPrefix}${DOT}${key}` : key;
-  const effectiveFlattenDepth = flattenDepth ?? options.flattenDepth;
-  if (options.keyFolding === "safe" && siblings) {
-    const foldResult = tryFoldKeyChain(key, value2, siblings, options, rootLiteralKeys, pathPrefix, effectiveFlattenDepth);
-    if (foldResult) {
-      const { foldedKey, remainder, leafValue, segmentCount } = foldResult;
-      const encodedFoldedKey = encodeKey(foldedKey);
-      if (remainder === void 0) {
-        if (isJsonPrimitive(leafValue)) {
-          yield indentedLine(depth, `${encodedFoldedKey}: ${encodePrimitive(leafValue, options.delimiter)}`, options.indent);
-          return;
-        } else if (isJsonArray(leafValue)) {
-          yield* encodeArrayLines(foldedKey, leafValue, depth, options);
-          return;
-        } else if (isJsonObject4(leafValue) && isEmptyObject2(leafValue)) {
-          yield indentedLine(depth, `${encodedFoldedKey}:`, options.indent);
-          return;
-        }
-      }
-      if (isJsonObject4(remainder)) {
-        yield indentedLine(depth, `${encodedFoldedKey}:`, options.indent);
-        const remainingDepth = effectiveFlattenDepth - segmentCount;
-        const foldedPath = pathPrefix ? `${pathPrefix}${DOT}${foldedKey}` : foldedKey;
-        yield* encodeObjectLines(remainder, depth + 1, options, rootLiteralKeys, foldedPath, remainingDepth);
-        return;
-      }
-    }
-  }
-  const encodedKey = encodeKey(key);
-  if (isJsonPrimitive(value2)) yield indentedLine(depth, `${encodedKey}: ${encodePrimitive(value2, options.delimiter)}`, options.indent);
-  else if (isJsonArray(value2)) yield* encodeArrayLines(key, value2, depth, options);
-  else if (isJsonObject4(value2)) {
-    yield indentedLine(depth, `${encodedKey}:`, options.indent);
-    if (!isEmptyObject2(value2)) yield* encodeObjectLines(value2, depth + 1, options, rootLiteralKeys, currentPath, effectiveFlattenDepth);
-  }
-}
-function* encodeArrayLines(key, value2, depth, options) {
-  if (value2.length === 0) {
-    yield indentedLine(depth, formatHeader(0, {
-      key,
-      delimiter: options.delimiter
-    }), options.indent);
-    return;
-  }
-  if (isArrayOfPrimitives(value2)) {
-    yield indentedLine(depth, encodeInlineArrayLine(value2, options.delimiter, key), options.indent);
-    return;
-  }
-  if (isArrayOfArrays(value2)) {
-    if (value2.every((arr) => isArrayOfPrimitives(arr))) {
-      yield* encodeArrayOfArraysAsListItemsLines(key, value2, depth, options);
-      return;
-    }
-  }
-  if (isArrayOfObjects(value2)) {
-    const header = extractTabularHeader(value2);
-    if (header) yield* encodeArrayOfObjectsAsTabularLines(key, value2, header, depth, options);
-    else yield* encodeMixedArrayAsListItemsLines(key, value2, depth, options);
-    return;
-  }
-  yield* encodeMixedArrayAsListItemsLines(key, value2, depth, options);
-}
-function* encodeArrayOfArraysAsListItemsLines(prefix, values, depth, options) {
-  yield indentedLine(depth, formatHeader(values.length, {
-    key: prefix,
-    delimiter: options.delimiter
-  }), options.indent);
-  for (const arr of values) if (isArrayOfPrimitives(arr)) {
-    const arrayLine = encodeInlineArrayLine(arr, options.delimiter);
-    yield indentedListItem(depth + 1, arrayLine, options.indent);
-  }
-}
-function encodeInlineArrayLine(values, delimiter2, prefix) {
-  const header = formatHeader(values.length, {
-    key: prefix,
-    delimiter: delimiter2
-  });
-  const joinedValue = encodeAndJoinPrimitives(values, delimiter2);
-  if (values.length === 0) return header;
-  return `${header} ${joinedValue}`;
-}
-function* encodeArrayOfObjectsAsTabularLines(prefix, rows, header, depth, options) {
-  yield indentedLine(depth, formatHeader(rows.length, {
-    key: prefix,
-    fields: header,
-    delimiter: options.delimiter
-  }), options.indent);
-  yield* writeTabularRowsLines(rows, header, depth + 1, options);
-}
-function extractTabularHeader(rows) {
-  if (rows.length === 0) return;
-  const firstRow = rows[0];
-  const firstKeys = Object.keys(firstRow);
-  if (firstKeys.length === 0) return;
-  if (isTabularArray(rows, firstKeys)) return firstKeys;
-}
-function isTabularArray(rows, header) {
-  for (const row of rows) {
-    if (Object.keys(row).length !== header.length) return false;
-    for (const key of header) {
-      if (!(key in row)) return false;
-      if (!isJsonPrimitive(row[key])) return false;
-    }
-  }
-  return true;
-}
-function* writeTabularRowsLines(rows, header, depth, options) {
-  for (const row of rows) yield indentedLine(depth, encodeAndJoinPrimitives(header.map((key) => row[key]), options.delimiter), options.indent);
-}
-function* encodeMixedArrayAsListItemsLines(prefix, items, depth, options) {
-  yield indentedLine(depth, formatHeader(items.length, {
-    key: prefix,
-    delimiter: options.delimiter
-  }), options.indent);
-  for (const item of items) yield* encodeListItemValueLines(item, depth + 1, options);
-}
-function* encodeObjectAsListItemLines(obj, depth, options) {
-  if (isEmptyObject2(obj)) {
-    yield indentedLine(depth, LIST_ITEM_MARKER, options.indent);
-    return;
-  }
-  const entries = Object.entries(obj);
-  if (entries.length === 1) {
-    const [key, value2] = entries[0];
-    if (isJsonArray(value2) && isArrayOfObjects(value2)) {
-      const header = extractTabularHeader(value2);
-      if (header) {
-        yield indentedListItem(depth, formatHeader(value2.length, {
-          key,
-          fields: header,
-          delimiter: options.delimiter
-        }), options.indent);
-        yield* writeTabularRowsLines(value2, header, depth + 1, options);
-        return;
-      }
-    }
-  }
-  yield indentedLine(depth, LIST_ITEM_MARKER, options.indent);
-  yield* encodeObjectLines(obj, depth + 1, options);
-}
-function* encodeListItemValueLines(value2, depth, options) {
-  if (isJsonPrimitive(value2)) yield indentedListItem(depth, encodePrimitive(value2, options.delimiter), options.indent);
-  else if (isJsonArray(value2)) if (isArrayOfPrimitives(value2)) yield indentedListItem(depth, encodeInlineArrayLine(value2, options.delimiter), options.indent);
-  else {
-    yield indentedListItem(depth, formatHeader(value2.length, { delimiter: options.delimiter }), options.indent);
-    for (const item of value2) yield* encodeListItemValueLines(item, depth + 1, options);
-  }
-  else if (isJsonObject4(value2)) yield* encodeObjectAsListItemLines(value2, depth, options);
-}
-function indentedLine(depth, content, indentSize) {
-  return " ".repeat(indentSize * depth) + content;
-}
-function indentedListItem(depth, content, indentSize) {
-  return indentedLine(depth, LIST_ITEM_PREFIX + content, indentSize);
-}
-function encode4(input2, options) {
-  return Array.from(encodeLines(input2, options)).join("\n");
-}
-function encodeLines(input2, options) {
-  return encodeJsonValue(normalizeValue(input2), resolveOptions(options), 0);
-}
-function resolveOptions(options) {
-  return {
-    indent: options?.indent ?? 2,
-    delimiter: options?.delimiter ?? DEFAULT_DELIMITER,
-    keyFolding: options?.keyFolding ?? "off",
-    flattenDepth: options?.flattenDepth ?? Number.POSITIVE_INFINITY
-  };
-}
-
-// mcp/geminiSanitizer.ts
-function parseStringEnumBranch(item) {
-  if (!item || typeof item !== "object") return null;
-  const record3 = item;
-  if (Array.isArray(record3.enum)) {
-    const strings = record3.enum.filter((v) => typeof v === "string");
-    return strings.length === record3.enum.length && strings.length > 0 ? { values: strings } : null;
-  }
-  if (typeof record3.const === "string") {
-    return { values: [record3.const] };
-  }
-  return null;
-}
-function collapseStringUnion(branches) {
-  const values = [];
-  for (const item of branches) {
-    const parsed2 = parseStringEnumBranch(item);
-    if (!parsed2) return null;
-    values.push(...parsed2.values);
-  }
-  if (values.length === 0) return null;
-  return { type: "string", enum: [...new Set(values)] };
-}
-function sanitizeForGemini(schema2) {
-  if (!schema2 || typeof schema2 !== "object") return schema2;
-  if (Array.isArray(schema2)) return schema2.map(sanitizeForGemini);
-  const source = schema2;
-  if (Array.isArray(source.enum) && typeof source.type !== "string") {
-    const allStrings = source.enum.every((v) => typeof v === "string");
-    if (allStrings) {
-      const result = { type: "string", enum: source.enum };
-      if (typeof source.description === "string") result.description = source.description;
-      return result;
-    }
-  }
-  for (const unionKey of ["anyOf", "oneOf"]) {
-    const branches = source[unionKey];
-    if (Array.isArray(branches) && branches.length > 0) {
-      const collapsed = collapseStringUnion(branches);
-      if (collapsed) {
-        const result = { ...collapsed };
-        if (typeof source.description === "string") result.description = source.description;
-        return result;
-      }
-    }
-  }
-  if (Array.isArray(source.anyOf) || Array.isArray(source.oneOf)) {
-    const result = {};
-    if (Array.isArray(source.anyOf)) result.anyOf = source.anyOf.map(sanitizeForGemini);
-    if (Array.isArray(source.oneOf)) result.oneOf = source.oneOf.map(sanitizeForGemini);
-    return result;
-  }
-  const sanitized = {};
-  for (const [key, value2] of Object.entries(source)) {
-    if (key === "$schema") continue;
-    if (key === "$defs") {
-      sanitized.definitions = sanitizeForGemini(value2);
-      continue;
-    }
-    sanitized[key] = sanitizeForGemini(value2);
-  }
-  return sanitized;
-}
-function wrapJsonSchemaProducer(producer) {
-  return new Proxy(producer, {
-    get(target, prop, receiver) {
-      const value2 = Reflect.get(target, prop, receiver);
-      if ((prop === "input" || prop === "output") && typeof value2 === "function") {
-        const fn2 = value2;
-        return (...args2) => sanitizeForGemini(fn2.apply(target, args2));
-      }
-      return value2;
-    }
-  });
-}
-function wrapStandard(standard) {
-  return new Proxy(standard, {
-    get(target, prop, receiver) {
-      if (prop === "jsonSchema") {
-        const value2 = Reflect.get(target, prop, receiver);
-        if (value2 && typeof value2 === "object") {
-          return wrapJsonSchemaProducer(value2);
-        }
-        return value2;
-      }
-      return Reflect.get(target, prop, receiver);
-    }
-  });
-}
-function wrapSchemaForGemini(schema2) {
-  return new Proxy(schema2, {
-    get(target, prop, receiver) {
-      if (prop === "~standard") {
-        const value2 = Reflect.get(target, prop, receiver);
-        if (value2 && typeof value2 === "object") {
-          return wrapStandard(value2);
-        }
-        return value2;
-      }
-      if (prop === "toJsonSchema") {
-        const method = Reflect.get(target, prop, receiver);
-        if (typeof method === "function") {
-          return () => sanitizeForGemini(method.call(target));
-        }
-        return method;
-      }
-      return Reflect.get(target, prop, receiver);
-    }
-  });
-}
-function sanitizeToolForGemini(tool2) {
-  if (!tool2.parameters) return tool2;
-  return { ...tool2, parameters: wrapSchemaForGemini(tool2.parameters) };
-}
-function isGeminiRouted(ctx) {
-  const effective = ctx.payload.proxyModel ?? ctx.resolvedModel ?? ctx.payload.model;
-  if (!effective) return true;
-  const normalized = effective.toLowerCase();
-  if (normalized.includes("gemini")) return true;
-  if (!normalized.includes("/")) return true;
-  return false;
-}
-
-// mcp/shared.ts
-function getHttpStatus(err) {
-  if (typeof err !== "object" || err === null || !("status" in err)) return void 0;
-  return typeof err.status === "number" ? err.status : void 0;
-}
-var tool = (toolDef) => toolDef;
-var handleToolSuccess = (data) => {
-  const text = typeof data === "string" ? data : encode4(data);
-  return {
-    content: [{ type: "text", text }]
-  };
-};
-var handleToolError = (error62) => {
-  const errorMessage = error62 instanceof Error ? error62.message : String(error62);
-  return {
-    content: [
-      {
-        type: "text",
-        text: `Error: ${errorMessage}`
-      }
-    ],
-    isError: true
-  };
-};
-var execute = (fn2, toolName) => {
-  const _fn = async (params) => {
-    try {
-      const result = await fn2(params);
-      return handleToolSuccess(result);
-    } catch (error62) {
-      const errorMessage = error62 instanceof Error ? error62.message : String(error62);
-      const prefix = toolName ? `[${toolName}]` : "tool";
-      log.info(`${prefix} error: ${errorMessage}`);
-      log.debug(`${prefix} params: ${formatJsonValue(params)}`);
-      return handleToolError(error62);
-    }
-  };
-  return _fn;
-};
-var addTools = (ctx, server, tools) => {
-  const shouldSanitize = isGeminiRouted(ctx);
-  for (const tool2 of tools) {
-    server.addTool(shouldSanitize ? sanitizeToolForGemini(tool2) : tool2);
-  }
-  return server;
-};
-
 // mcp/git.ts
 function getPushDestination(branch, storedDest, cwd) {
   if (storedDest && storedDest.localBranch === branch) {
@@ -191818,7 +192262,8 @@ async function runPrepushHook(ctx, retryTool) {
   if (!ctx.prepushScript) return false;
   const prepushHook = await executeLifecycleHook({
     event: "prepush",
-    script: ctx.prepushScript
+    script: ctx.prepushScript,
+    shell: ctx.payload.shell
   });
   if (prepushHook.failure) {
     ctx.toolState.prepushFailureCount += 1;
@@ -192213,8 +192658,8 @@ function countAhead(head, base, cwd) {
 function spillGitOutput(params) {
   const tempDir = process.env.PULLFROG_TEMP_DIR;
   if (!tempDir) throw new Error("PULLFROG_TEMP_DIR not set");
-  const outputPath = join12(tempDir, `git-${params.command}-${randomUUID3().slice(0, 8)}.txt`);
-  writeFileSync8(outputPath, params.output);
+  const outputPath = join13(tempDir, `git-${params.command}-${randomUUID4().slice(0, 8)}.txt`);
+  writeFileSync9(outputPath, params.output);
   const previewByLines = params.output.split("\n").slice(0, OVERFLOW_PREVIEW_LINES).join("\n");
   const preview = previewByLines.length <= OVERFLOW_PREVIEW_MAX_CHARS ? previewByLines : `${previewByLines.slice(0, OVERFLOW_PREVIEW_MAX_CHARS)}\u2026`;
   log.info(
@@ -193740,9 +194185,9 @@ async function reportReviewNodeId(ctx, params) {
 import { execFileSync as execFileSync6, execSync as execSync2 } from "node:child_process";
 import { mkdtempSync, readdirSync, realpathSync as realpathSync2, unlinkSync as unlinkSync2 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 function createTempDirectory() {
-  const sharedTempDir = mkdtempSync(join13(tmpdir2(), "pullfrog-"));
+  const sharedTempDir = mkdtempSync(join14(tmpdir2(), "pullfrog-"));
   process.env.PULLFROG_TEMP_DIR = sharedTempDir;
   log.info(`\xBB created temp dir at ${sharedTempDir}`);
   return sharedTempDir;
@@ -193787,13 +194232,13 @@ function wipeRunnerLeakSurface() {
       return [];
     }
   };
-  const fileCommandsDir = join13(runnerTemp, "_runner_file_commands");
+  const fileCommandsDir = join14(runnerTemp, "_runner_file_commands");
   for (const entry of listDir(fileCommandsDir)) {
-    tryUnlink(join13(fileCommandsDir, entry));
+    tryUnlink(join14(fileCommandsDir, entry));
   }
   for (const entry of listDir(runnerTemp)) {
     if (entry.endsWith(".sh") || /^git-credentials-.*\.config$/.test(entry)) {
-      tryUnlink(join13(runnerTemp, entry));
+      tryUnlink(join14(runnerTemp, entry));
     }
   }
   if (wiped.length > 0) {
@@ -194268,6 +194713,7 @@ async function checkoutPrBranch(pr, params) {
   const postCheckoutHook = await executeLifecycleHook({
     event: "post-checkout",
     script: params.postCheckoutScript,
+    shell: params.shell,
     normalizeWorkingTreeAfter: true
   });
   return { hookWarning: postCheckoutHook.warning };
@@ -194349,11 +194795,11 @@ function CheckoutPrTool(ctx) {
         headSha: checkoutSha
       });
       if (incremental.status === "ok") {
-        incrementalDiffPath = join14(
+        incrementalDiffPath = join15(
           tempDir,
           `pr-${pull_number}-${beforeShort}-${headShort}-incremental.diff`
         );
-        writeFileSync9(incrementalDiffPath, incremental.diff);
+        writeFileSync10(incrementalDiffPath, incremental.diff);
         log.info(
           `\xBB incremental diff computed (${incremental.diff.length} bytes) \u2192 ${incrementalDiffPath}`
         );
@@ -194366,8 +194812,8 @@ function CheckoutPrTool(ctx) {
     const diffPreview = formatResult.content.split("\n").slice(0, 100).join("\n");
     log.debug(`formatted diff preview (first 100 lines):
 ${diffPreview}`);
-    const diffPath = join14(tempDir, `pr-${pull_number}-${headShort}.diff`);
-    writeFileSync9(diffPath, formatResult.content);
+    const diffPath = join15(tempDir, `pr-${pull_number}-${headShort}.diff`);
+    writeFileSync10(diffPath, formatResult.content);
     log.debug(`wrote diff to ${diffPath} (${formatResult.content.length} bytes)`);
     primary.diffCoverage = createDiffCoverageState({
       diffPath,
@@ -194524,8 +194970,8 @@ ${dirty}`
 }
 
 // mcp/checkSuite.ts
-import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join15 } from "node:path";
+import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join16 } from "node:path";
 var GetCheckSuiteLogs = type({
   check_suite_id: type.number.describe("the id from check_suite.id")
 });
@@ -194621,7 +195067,7 @@ function GetCheckSuiteLogsTool(ctx) {
       if (!tempDir) {
         throw new Error("PULLFROG_TEMP_DIR not set");
       }
-      const logsDir = join15(tempDir, "ci-logs");
+      const logsDir = join16(tempDir, "ci-logs");
       mkdirSync8(logsDir, { recursive: true });
       const jobResults = [];
       for (const run of failedRuns) {
@@ -194648,8 +195094,8 @@ function GetCheckSuiteLogsTool(ctx) {
               );
             }
             const logsText = await logsResult.text();
-            const logPath = join15(logsDir, `job-${job.id}.log`);
-            writeFileSync10(logPath, logsText);
+            const logPath = join16(logsDir, `job-${job.id}.log`);
+            writeFileSync11(logPath, logsText);
             const analysis = analyzeLog(logsText, 80);
             const failedSteps = job.steps?.filter((s) => s.conclusion === "failure").map((s) => `Step ${s.number}: ${s.name}`) ?? [];
             jobResults.push({
@@ -194697,8 +195143,8 @@ function GetCheckSuiteLogsTool(ctx) {
 }
 
 // mcp/commitInfo.ts
-import { writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join16 } from "node:path";
+import { writeFileSync as writeFileSync12 } from "node:fs";
+import { join as join17 } from "node:path";
 var CommitInfo = type({
   sha: type.string.describe("the commit SHA (full or abbreviated) to fetch")
 });
@@ -194722,8 +195168,8 @@ function CommitInfoTool(ctx) {
           "PULLFROG_TEMP_DIR not set - get_commit_info must run in pullfrog action context"
         );
       }
-      const diffFile = join16(tempDir, `commit-${sha.slice(0, 7)}.diff`);
-      writeFileSync11(diffFile, formatResult.content);
+      const diffFile = join17(tempDir, `commit-${sha.slice(0, 7)}.diff`);
+      writeFileSync12(diffFile, formatResult.content);
       log.debug(`wrote commit diff to ${diffFile} (${formatResult.content.length} bytes)`);
       return {
         sha: data.sha,
@@ -194860,13 +195306,13 @@ import { performance as performance9 } from "node:perf_hooks";
 
 // prep/installNodeDependencies.ts
 import { existsSync as existsSync8 } from "node:fs";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 
 // utils/packageManager.ts
 var import_semver2 = __toESM(require_semver2(), 1);
 import { existsSync as existsSync7 } from "node:fs";
 import { mkdir, readFile as readFile2 } from "node:fs/promises";
-import { delimiter, join as join17 } from "node:path";
+import { delimiter, join as join18 } from "node:path";
 var SUPPORTED_NAMES = ["npm", "pnpm", "yarn", "bun"];
 var COREPACK_MANAGED = ["pnpm", "yarn"];
 function isSupported(name) {
@@ -194904,7 +195350,7 @@ function parseDevEnginesField(field) {
   };
 }
 async function resolvePackageManagerSpec(cwd) {
-  const pkgPath = join17(cwd, "package.json");
+  const pkgPath = join18(cwd, "package.json");
   if (!existsSync7(pkgPath)) return null;
   let pkg;
   try {
@@ -194963,7 +195409,7 @@ async function currentVersion(name) {
   return result.stdout.trim();
 }
 function packageManagerBinDir(tmpdir3) {
-  return join17(tmpdir3, "pm-bin");
+  return join18(tmpdir3, "pm-bin");
 }
 async function ensurePackageManager(params) {
   const spec = params.spec;
@@ -195026,7 +195472,7 @@ async function installFallback(name, installSpec) {
   });
   if (result.exitCode !== 0) return result.stderr || `failed to install ${name}`;
   if (name === "deno") {
-    const denoPath = join17(process.env.HOME || "", ".deno", "bin");
+    const denoPath = join18(process.env.HOME || "", ".deno", "bin");
     process.env.PATH = `${denoPath}:${process.env.PATH}`;
   }
   log.info(`\xBB installed ${name}`);
@@ -195059,7 +195505,7 @@ async function isCommandAvailable2(command) {
 var installNodeDependencies = {
   name: "installNodeDependencies",
   shouldRun: () => {
-    const packageJsonPath = join18(process.cwd(), "package.json");
+    const packageJsonPath = join19(process.cwd(), "package.json");
     return existsSync8(packageJsonPath);
   },
   run: async (options) => {
@@ -195155,12 +195601,12 @@ ${errorMessage}`]
 
 // prep/installPythonDependencies.ts
 import { existsSync as existsSync9, readFileSync as readFileSync5 } from "node:fs";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 function declaresBuildSystem(path4) {
   return /^\s*\[\s*build-system\s*\]/m.test(readFileSync5(path4, "utf8"));
 }
 function configApplies(config3, cwd) {
-  const path4 = join19(cwd, config3.file);
+  const path4 = join20(cwd, config3.file);
   return existsSync9(path4) && (config3.applies?.(path4) ?? true);
 }
 var PYTHON_CONFIGS = [
@@ -195484,407 +195930,6 @@ function AwaitDependencyInstallationTool(ctx) {
 // mcp/gh.ts
 import { mkdirSync as mkdirSync9 } from "node:fs";
 import { join as join21 } from "node:path";
-
-// mcp/shell.ts
-import { spawn as spawn3, spawnSync as spawnSync6 } from "node:child_process";
-import { randomUUID as randomUUID4 } from "node:crypto";
-import { closeSync, openSync, writeFileSync as writeFileSync12 } from "node:fs";
-import { userInfo as userInfo2 } from "node:os";
-import { join as join20 } from "node:path";
-import { setTimeout as sleep3 } from "node:timers/promises";
-var ShellParams = type({
-  command: "string",
-  // advisory and unread — no code path consumes it. kept in the schema only
-  // because it nudges the model to state intent before running a command;
-  // REQUIRING it cost a full rejected turn every time one was omitted. #1140.
-  "description?": "string",
-  "timeout?": type.number.describe(
-    "Timeout in MILLISECONDS (not seconds). Default 30000 (30s), max 120000 (2m). e.g. timeout: 180000 for 3 minutes; timeout: 180 means 180ms and will kill the process almost immediately."
-  ),
-  "working_directory?": "string",
-  "background?": "boolean"
-});
-var detectedSandboxMethod;
-var usernsProbeError;
-function getSandboxMethod() {
-  return detectSandboxMethod();
-}
-function detectSandboxMethod() {
-  if (detectedSandboxMethod !== void 0) {
-    return detectedSandboxMethod;
-  }
-  if (process.env.CI !== "true") {
-    detectedSandboxMethod = "none";
-    log.debug("sandbox disabled (CI !== true)");
-    return "none";
-  }
-  try {
-    const result = spawnSync6("unshare", ["--pid", "--fork", "--mount-proc", "true"], {
-      timeout: 5e3,
-      stdio: "ignore"
-    });
-    if (result.status === 0) {
-      detectedSandboxMethod = "unshare";
-      log.debug("PID namespace isolation enabled (unprivileged unshare)");
-      return "unshare";
-    }
-  } catch {
-  }
-  try {
-    const result = spawnSync6("sudo", ["unshare", "--pid", "--fork", "--mount-proc", "true"], {
-      timeout: 5e3,
-      stdio: "ignore"
-    });
-    if (result.status === 0) {
-      detectedSandboxMethod = "sudo-unshare";
-      log.debug("PID namespace isolation enabled (sudo unshare)");
-      return "sudo-unshare";
-    }
-  } catch {
-  }
-  try {
-    const result = spawnSync6(
-      "unshare",
-      [
-        "--user",
-        "--map-root-user",
-        "--pid",
-        "--fork",
-        "--mount",
-        "setpriv",
-        "--no-new-privs",
-        "--bounding-set",
-        "-all",
-        "--inh-caps",
-        "-all",
-        "--ambient-caps",
-        "-all",
-        "true"
-      ],
-      { timeout: 5e3, stdio: ["ignore", "ignore", "pipe"] }
-    );
-    if (result.status === 0) {
-      detectedSandboxMethod = "userns-unshare";
-      log.debug("PID namespace isolation enabled (unprivileged userns unshare)");
-      return "userns-unshare";
-    }
-    usernsProbeError = result.stderr?.toString().trim() || result.error?.message;
-  } catch {
-  }
-  detectedSandboxMethod = "none";
-  log.info("PID namespace isolation not available");
-  return "none";
-}
-var PROC_CLEANUP = "umount /proc 2>/dev/null; umount /proc 2>/dev/null; mount -t proc proc /proc 2>/dev/null;";
-var SOCKET_CLEANUP = [
-  "/var/run/docker.sock",
-  "/run/docker.sock",
-  "/var/run/podman/podman.sock",
-  "/run/podman/podman.sock",
-  "/run/containerd/containerd.sock",
-  "/var/run/crio/crio.sock"
-].map((path4) => `mount --bind /dev/null ${path4} 2>/dev/null;`).join(" ");
-function buildFsMounts(repoDir) {
-  const escaped = repoDir.replace(/'/g, "'\\''");
-  return [
-    `mkdir -p /var/lib/pullfrog 2>/dev/null;`,
-    `mount -t tmpfs tmpfs /var/lib/pullfrog 2>/dev/null;`,
-    `[ -n "$RUNNER_TEMP" ] && [ -d "$RUNNER_TEMP/_runner_file_commands" ] && mount -t tmpfs tmpfs "$RUNNER_TEMP/_runner_file_commands" 2>/dev/null;`,
-    `[ -e '${escaped}/.git' ] && mount --bind '${escaped}/.git' '${escaped}/.git' 2>/dev/null && mount -o remount,bind,ro '${escaped}/.git' 2>/dev/null;`
-  ].join(" ");
-}
-var _repoRoot;
-function resolveRepoRoot() {
-  if (_repoRoot) return _repoRoot;
-  const fromEnv = process.env.GITHUB_WORKSPACE;
-  if (fromEnv) {
-    _repoRoot = fromEnv;
-    return _repoRoot;
-  }
-  try {
-    _repoRoot = spawnSync6("git", ["rev-parse", "--show-toplevel"], {
-      cwd: process.cwd(),
-      stdio: ["ignore", "pipe", "ignore"],
-      encoding: "utf-8"
-    }).stdout?.trim();
-  } catch {
-  }
-  if (!_repoRoot) _repoRoot = process.cwd();
-  return _repoRoot;
-}
-function spawnShell(params) {
-  const spawnOpts = { env: params.env, cwd: params.cwd, stdio: params.stdio, detached: true };
-  const sandboxMethod = detectSandboxMethod();
-  const ci = process.env.CI === "true";
-  if (ci && sandboxMethod === "none") {
-    throw new Error(
-      "PID-namespace isolation is required in CI but unavailable: unprivileged unshare, sudo unshare, and userns-nested unshare all failed. " + (usernsProbeError ? `userns probe said: ${usernsProbeError}. ` : "") + "on a containerized / Kubernetes self-hosted runner the cause is usually one of: the pod's seccomp profile blocks user-namespace creation (Pod Security Standards baseline/restricted); the pod runs as root without CAP_SETFCAP, which the kernel requires to map uid 0; or the node kernel disallows unprivileged user namespaces (Ubuntu >= 23.10, Bottlerocket, Talos). elsewhere, check that `unshare` and `setpriv` (util-linux >= 2.31, which is what added --ambient-caps) are on PATH. see https://docs.pullfrog.com/security#self-hosted-runners"
-    );
-  }
-  const repoRoot = resolveRepoRoot();
-  const fsMounts = buildFsMounts(repoRoot);
-  if (sandboxMethod === "unshare") {
-    return spawn3(
-      "unshare",
-      [
-        "--pid",
-        "--fork",
-        "--mount-proc",
-        "bash",
-        "-c",
-        `${PROC_CLEANUP} ${SOCKET_CLEANUP} ${fsMounts} ${params.command}`
-      ],
-      spawnOpts
-    );
-  }
-  if (sandboxMethod === "userns-unshare") {
-    const escaped = params.command.replace(/'/g, "'\\''");
-    return spawn3(
-      "unshare",
-      [
-        "--user",
-        "--map-root-user",
-        "--pid",
-        "--fork",
-        "--mount",
-        "bash",
-        "-c",
-        `${PROC_CLEANUP} ${SOCKET_CLEANUP} ${fsMounts} exec setpriv --no-new-privs --bounding-set -all --inh-caps -all --ambient-caps -all bash -c '${escaped}'`
-      ],
-      spawnOpts
-    );
-  }
-  if (sandboxMethod === "sudo-unshare") {
-    const envArgs = [];
-    for (const [k2, v] of Object.entries(params.env)) {
-      if (v !== void 0) {
-        envArgs.push(`${k2}=${v}`);
-      }
-    }
-    const username = userInfo2().username;
-    const pathRestore = 'export PATH="${SANDBOX_PATH:-$PATH}"; ';
-    const escaped = (pathRestore + params.command).replace(/'/g, "'\\''");
-    envArgs.push(`SANDBOX_PATH=${params.env.PATH ?? ""}`);
-    return spawn3(
-      "sudo",
-      [
-        "env",
-        ...envArgs,
-        "unshare",
-        "--pid",
-        "--fork",
-        "--mount-proc",
-        "bash",
-        "-c",
-        `${PROC_CLEANUP} ${SOCKET_CLEANUP} ${fsMounts} exec su -p -s /bin/bash ${username} -c '${escaped}'`
-      ],
-      { ...spawnOpts, env: {} }
-    );
-  }
-  return spawn3("bash", ["-c", params.command], spawnOpts);
-}
-async function killProcessGroup(proc) {
-  if (!proc.pid) return;
-  try {
-    process.kill(-proc.pid, "SIGTERM");
-    await new Promise((r) => setTimeout(r, 200));
-    process.kill(-proc.pid, "SIGKILL");
-  } catch {
-    try {
-      proc.kill("SIGKILL");
-    } catch {
-    }
-  }
-}
-function getTempDir() {
-  const tempDir = process.env.PULLFROG_TEMP_DIR;
-  if (!tempDir) {
-    throw new Error("PULLFROG_TEMP_DIR not set");
-  }
-  return tempDir;
-}
-var MAX_OUTPUT_CHARS = 5e3;
-async function runSandboxed(params) {
-  const proc = spawnShell({
-    command: params.command,
-    env: params.env,
-    cwd: params.cwd,
-    stdio: ["ignore", "pipe", "pipe"]
-  });
-  let stdout = "", stderr = "", timedOut = false, exited = false, spawnError = "";
-  proc.stdout?.on("data", (chunk) => {
-    stdout += chunk.toString();
-  });
-  proc.stderr?.on("data", (chunk) => {
-    stderr += chunk.toString();
-  });
-  const timeoutId = setTimeout(async () => {
-    if (!exited) {
-      timedOut = true;
-      await killProcessGroup(proc);
-    }
-  }, params.timeout);
-  const exitCode = await new Promise((resolve3) => {
-    const done = (code) => {
-      exited = true;
-      clearTimeout(timeoutId);
-      resolve3(code);
-    };
-    proc.on("exit", done);
-    proc.on("error", (err) => {
-      spawnError = err.message;
-      done(null);
-    });
-  });
-  proc.stdout?.destroy();
-  proc.stderr?.destroy();
-  let output2 = stderr ? stdout ? `${stdout}
-${stderr}` : stderr : stdout;
-  if (spawnError) output2 = output2 ? `${output2}
-${spawnError}` : spawnError;
-  if (timedOut)
-    output2 = output2 ? `${output2}
-[timed out after ${params.timeout}ms]` : `[timed out after ${params.timeout}ms]`;
-  return {
-    output: output2.trim(),
-    exitCode: exitCode ?? (timedOut ? 124 : -1),
-    timedOut
-  };
-}
-function capOutput(output2) {
-  if (output2.length <= MAX_OUTPUT_CHARS) return output2;
-  const fullPath = join20(getTempDir(), `shell-${randomUUID4().slice(0, 8)}.log`);
-  writeFileSync12(fullPath, output2);
-  const elided = output2.length - MAX_OUTPUT_CHARS;
-  return `... [${elided} chars truncated; full output saved to ${fullPath}] ...
-${output2.slice(-MAX_OUTPUT_CHARS)}`;
-}
-function isGitCommand(command) {
-  const trimmed = command.trim();
-  if (trimmed === "git" || trimmed.startsWith("git ")) return true;
-  if (trimmed.startsWith("sudo git")) return true;
-  return /[;&|]\s*(?:sudo\s+)?git(?:\s|$)/.test(trimmed);
-}
-function ShellTool(ctx) {
-  return tool({
-    name: "shell",
-    timeoutMs: 12e4,
-    description: `Execute shell commands securely. Environment is filtered to remove API keys and secrets.
-
-Example: \`shell({ command: "pnpm test", description: "run the test suite" })\`.
-
-Use this tool to:
-- Run shell commands (ls, cat, grep, find, etc.)
-- Execute build tools (npm, pnpm, cargo, make, etc.)
-- Run tests and linters
-
-Output is capped at ${MAX_OUTPUT_CHARS} chars: if exceeded, only the tail is returned and the full body is saved to a tempfile (path included in the response). Re-read the tempfile with cat/tail/grep when you need more.
-
-Do NOT use this tool for git commands \u2014 use the dedicated git tools instead.`,
-    parameters: ShellParams,
-    execute: execute(async (params) => {
-      if (isGitCommand(params.command)) {
-        throw new Error(
-          'git commands are not allowed in the shell tool. use the dedicated git tools instead:\n- git: local operations, e.g. git({ command: "log", args: ["--oneline"] }) \u2014 `command` is the subcommand ONLY\n- push_branch: push to remote (handles authentication)\n- git_fetch: fetch from remote (handles authentication)\n- checkout_pr: check out PR branches'
-        );
-      }
-      const timeout = Math.min(params.timeout ?? 3e4, 12e4);
-      const cwd = params.working_directory ?? process.cwd();
-      const env2 = resolveEnv(ctx.payload.shell === "enabled" ? "inherit" : "restricted");
-      if (params.command.includes("agent-browser")) {
-        const daemonError = ensureBrowserDaemon(ctx.toolState);
-        if (daemonError) {
-          return {
-            output: `browser daemon unavailable: ${daemonError}`,
-            exit_code: 1,
-            timed_out: false
-          };
-        }
-        const binDir = ctx.toolState.browserDaemon?.binDir;
-        if (binDir) {
-          env2.PATH = `${binDir}:${env2.PATH ?? ""}`;
-        }
-      }
-      if (params.background) {
-        const tempDir = getTempDir();
-        const handle = `bg-${randomUUID4().slice(0, 8)}`;
-        const outputPath = join20(tempDir, `${handle}.log`);
-        const pidPath = join20(tempDir, `${handle}.pid`);
-        const logFd = openSync(outputPath, "a");
-        let proc;
-        try {
-          proc = spawnShell({
-            command: params.command,
-            env: env2,
-            cwd,
-            stdio: ["ignore", logFd, logFd]
-          });
-        } finally {
-          closeSync(logFd);
-        }
-        if (!proc.pid) {
-          throw new Error("failed to start background process");
-        }
-        proc.unref();
-        writeFileSync12(pidPath, `${proc.pid}
-`);
-        ctx.toolState.backgroundProcesses.set(handle, { pid: proc.pid, outputPath, pidPath });
-        return {
-          handle,
-          outputPath,
-          pidPath,
-          message: `started background process ${handle} (pid ${proc.pid})`
-        };
-      }
-      const result = await runSandboxed({ command: params.command, env: env2, cwd, timeout });
-      if (result.exitCode !== 0) {
-        log.info(`shell command failed with exit code ${result.exitCode}: ${params.command}`);
-        if (result.output) log.info(`output: ${result.output}`);
-      }
-      return {
-        output: capOutput(result.output),
-        exit_code: result.exitCode,
-        timed_out: result.timedOut
-      };
-    })
-  });
-}
-var KillBackgroundParams = type({
-  handle: type.string.describe("The handle of the background process to kill (e.g., bg-a1b2c3d4)")
-});
-function KillBackgroundTool(ctx) {
-  return tool({
-    name: "kill_background",
-    mutates: true,
-    description: `Kill a background process by its handle. Use this to stop dev servers or other long-running processes started with shell({ background: true }).`,
-    parameters: KillBackgroundParams,
-    execute: execute(async (params) => {
-      const proc = ctx.toolState.backgroundProcesses.get(params.handle);
-      if (!proc) {
-        return {
-          success: false,
-          message: `no background process with handle ${params.handle}`
-        };
-      }
-      try {
-        process.kill(-proc.pid, "SIGTERM");
-      } catch {
-      }
-      await sleep3(200);
-      try {
-        process.kill(-proc.pid, "SIGKILL");
-      } catch {
-      }
-      ctx.toolState.backgroundProcesses.delete(params.handle);
-      return {
-        success: true,
-        message: `killed background process ${params.handle} (pid ${proc.pid})`
-      };
-    })
-  });
-}
-
-// mcp/gh.ts
 var GH_TIMEOUT_MS = 12e4;
 var GhParams = type({
   args: type.string.array().describe(
@@ -201683,6 +201728,7 @@ async function main() {
         const setupHook = await executeLifecycleHook({
           event: "setup",
           script: runContext.repoSettings.setupScript,
+          shell: payload.shell,
           normalizeWorkingTreeAfter: true
         });
         if (setupHook.warning) {