pullfrog 0.1.74 → 0.1.76

package/dist/index.js

@@ -28027,7 +28027,7 @@ var require_cross_spawn = __commonJS({
       enoent.hookChildProcess(spawned, parsed2);
       return spawned;
     }
-    function spawnSync7(command, args2, options) {
+    function spawnSync8(command, args2, options) {
       const parsed2 = parse6(command, args2, options);
       const result = cp.spawnSync(parsed2.command, parsed2.args, parsed2.options);
       result.error = result.error || enoent.verifyENOENTSync(result.status, parsed2);
@@ -28035,7 +28035,7 @@ var require_cross_spawn = __commonJS({
     }
     module.exports = spawn4;
     module.exports.spawn = spawn4;
-    module.exports.sync = spawnSync7;
+    module.exports.sync = spawnSync8;
     module.exports._parse = parse6;
     module.exports._enoent = enoent;
   }
@@ -108971,6 +108971,17 @@ var OPENAI_COMPATIBLE_API_KEY_ENV = "OPENAI_COMPATIBLE_API_KEY";
 var OPENAI_COMPATIBLE_MODEL_ENV = "OPENAI_COMPATIBLE_MODEL";
 var OPENAI_COMPATIBLE_CONTEXT_ENV = "OPENAI_COMPATIBLE_CONTEXT";
 var OPENAI_COMPATIBLE_MAX_OUTPUT_ENV = "OPENAI_COMPATIBLE_MAX_OUTPUT";
+var PROVIDER_GATEWAY_URL_ENV = {
+  anthropic: "ANTHROPIC_BASE_URL",
+  openai: "OPENAI_BASE_URL"
+};
+function getProviderGatewayUrl(specifier) {
+  const slashIndex = specifier?.indexOf("/") ?? -1;
+  if (!specifier || slashIndex <= 0) return void 0;
+  const envVar = PROVIDER_GATEWAY_URL_ENV[specifier.slice(0, slashIndex)];
+  if (!envVar) return void 0;
+  return process.env[envVar]?.trim().replace(/\/$/, "") || void 0;
+}
 function isBedrockAnthropicId(bedrockModelId) {
   return bedrockModelId.toLowerCase().split(/[./:]/).includes("anthropic");
 }
@@ -109795,7 +109806,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.74",
+  version: "0.1.76",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -110594,26 +110605,24 @@ For simple, well-defined tasks, skip the plan phase and go straight to build.`
 
 2. Checkout the PR branch via \`${t("checkout_pr")}\`.
 
-3. Fetch review comments via \`${t("get_review_comments")}\`.
+3. Fetch review comments via \`${t("get_review_comments")}\` and read the full conversation in each relevant thread.
 
-4. For each comment:
-   - understand the feedback
+4. For each thread:
+   - **check intent first**: questions, explanations, and disagreement call for a reply, not a code change. Change code only when explicitly requested. Automatic review feedback on Pullfrog-authored PRs (\`address_scope: all\`) remains actionable without a separate request; later replies can narrow or withdraw that permission.
+   - under \`address_scope: mentions\`, unmentioned threads are context only unless the user's review-body request explicitly includes them
    - **verify the finding yourself** against the actual code before deciding whether to apply \u2014 every comment (human or agent) is a hypothesis, not a directive. agent reviewers especially are fallible.
-   - you are searching for a solution that is **complete, minimal, and elegant** \u2014 you may need to think hard to find it. do not over-engineer, do not be over-defensive, **do not write AI slop**. reviewers bias toward *recommending additions*, and that bias has a recognizable slop texture: defensive checks for impossible cases, extra abstractions used once, comments restating obvious code, tests asserting tautologies, "just-in-case" guards, error handlers for cases the type system already rules out. reject those. evaluate whether applying the finding would leave the code more **sound, correct, AND elegant**; two-out-of-three is a signal to look harder for a fix that gets all three. if a request would add bloat \u2014 ceremony without commensurate correctness benefit \u2014 push back in your reply rather than mechanically applying it.
-   - if the request stands, make the code change using your native tools; otherwise reply explaining why
+   - keep requested changes **sound, minimal, and elegant**. Reject defensive checks for impossible cases, single-use abstractions, redundant comments, and tautological tests rather than mechanically applying reviewer suggestions.
+   - if intent permits a code change and the finding stands, implement it using your native tools; otherwise reply without editing
    - record what was done (or why nothing was done)
 
 5. Quality check:
-   - re-call \`${t("get_review_comments")}\` with \`fresh: true\` before committing: reviewers keep commenting while you work, and any thread it now returns that you have not addressed is in scope for this run.
-   - test changes, then review the diff before committing \u2014 verify only intended changes are present, no debug artifacts remain, no fix turned out to be bloat in context (revert any that did), and the changes are clean enough that a senior engineer would approve without hesitation
-   - ${commitStep}
+   - re-call \`${t("get_review_comments")}\` with \`fresh: true\` before finishing, even when only replying. Apply the same scope and intent checks to new comments; respect requests to stop or change direction before committing.
+   - if code changed, test and review the diff, remove unintended changes or bloat, then ${commitStep}
 
-6. Finalize. Reply + resolve are paired write actions: do BOTH or NEITHER for each thread.
-   - ${finalizeStep} (same push/prepush guidance as Build mode in *SYSTEM*)
-   - **if the push/commit fails**, call \`${t("report_progress")}\` with the exact error and STOP \u2014 do NOT reply or resolve any thread until the fix is live on the remote. Resolving a thread without the fix landing misleads the reviewer.
-   - **once the fix is live on the remote**, for each thread you acted on:
-     - reply ONCE via \`${t("reply_to_review_comment")}\`. The \`comment_id\` parameter takes the root comment's numeric \`id=\` (from the first \`comment author=...\` tag in the \`${t("get_review_comments")}\` output) \u2014 NOT the \`thread=\` value; that's a separate GraphQL ID used by resolve. The runtime dedupes identical bodies within a session.
-     - **immediately** call \`${t("resolve_review_thread")}\` with that thread's \`thread=\` value as \`thread_id\`. Resolve every thread where you (a) made the requested code change in full \u2014 partial fixes leave the thread open \u2014 OR (b) replied with a substantive answer the user explicitly asked for. Do NOT resolve threads where you pushed back on the request and the disagreement is unresolved; leave those open for the human to mediate.
+6. Finalize:
+   - **only if code changed**, ${finalizeStep} (same push/prepush guidance as Build mode in *SYSTEM*). If push/commit fails, report the exact error and STOP without claiming a fix or resolving its threads.
+   - reply ONCE per relevant thread via \`${t("reply_to_review_comment")}\`, including when no code changed. The \`comment_id\` is the root comment's numeric \`id=\`, NOT the \`thread=\` value from \`${t("get_review_comments")}\`. The runtime dedupes identical bodies within a session.
+   - resolve a thread via \`${t("resolve_review_thread")}\` (using \`thread=\` as \`thread_id\`) only after its requested fix is fully on the remote, or the user explicitly asks to resolve it. Leave discussion-only replies, partial fixes, and disagreements open.
    - call \`${t("report_progress")}\` with a brief summary. If your last \`${t("get_review_comments")}\` turned up threads you did not address, name them there \u2014 a review arriving this late is suppressed as a duplicate and nothing else will pick it up.`
     },
     // Review and IncrementalReview route the minimum reviewfrog specialists
@@ -112514,6 +112523,19 @@ function warnIfNativeEditsUnavailable(ctx) {
     "\xBB this run cannot change files: codex's native write tool depends on bubblewrap, which Ubuntu 24.04 blocks (https://github.com/openai/codex/issues/29908), and the MCP shell is disabled for this repo. read-only work is unaffected \u2014 set `shell: restricted` if the agent needs to edit anything."
   );
 }
+var CODEX_GATEWAY_PROVIDER = "pullfrog-gateway";
+function gatewayProvider(gatewayUrl) {
+  if (!gatewayUrl) return [];
+  return [
+    `[model_providers.${CODEX_GATEWAY_PROVIDER}]`,
+    'name = "OpenAI gateway"',
+    `base_url = ${JSON.stringify(gatewayUrl)}`,
+    'wire_api = "responses"',
+    // where the harness puts the run's OPENAI_API_KEY
+    'env_key = "CODEX_API_KEY"',
+    ""
+  ];
+}
 function writeCodexConfig(params) {
   const shellEnabled = params.ctx.payload.shell === "enabled";
   const sandboxMode = params.ctx.payload.push === "disabled" ? "read-only" : "workspace-write";
@@ -112530,6 +112552,7 @@ function writeCodexConfig(params) {
     'web_search = "live"',
     ...params.model ? [`model = ${JSON.stringify(params.model)}`] : [],
     ...params.effortRung ? [`model_reasoning_effort = ${JSON.stringify(params.effortRung)}`] : [],
+    ...params.gatewayUrl ? [`model_provider = ${JSON.stringify(CODEX_GATEWAY_PROVIDER)}`] : [],
     "",
     "[features]",
     tomlBool(CODEX_DISABLED_FEATURES, false),
@@ -112559,6 +112582,7 @@ function writeCodexConfig(params) {
     "tool_timeout_sec = 660",
     "",
     ...repoMcpApprovals(repoDir),
+    ...gatewayProvider(params.gatewayUrl),
     // UNTRUSTED, deliberately, and this one line is the whole config-precedence
     // boundary. Codex loads `<repo>/.codex/config.toml` as a layer that
     // OUTRANKS ours (project 25 vs user 20), and its denylist strips none of
@@ -112827,7 +112851,11 @@ var codex = agent({
       ctx,
       codexHome,
       model: resolveCodexModel(ctx),
-      effortRung: effort.rung && CODEX_EFFORTS.includes(effort.rung) ? effort.rung : void 0
+      effortRung: effort.rung && CODEX_EFFORTS.includes(effort.rung) ? effort.rung : void 0,
+      // keyed off OpenAI, not the resolved model: codex serves nothing else, an
+      // auto-selected run has no model, and a ChatGPT-subscription token is
+      // valid only at ChatGPT's own backend
+      gatewayUrl: codexHomeAuth ? void 0 : getProviderGatewayUrl("openai/")
     });
     if (codexHomeAuth) {
       core3.saveState(
@@ -118594,6 +118622,14 @@ function openAICompatibleProvider(model) {
     }
   };
 }
+var OPENCODE_GATEWAY_PATH = { anthropic: "/v1" };
+function providerGatewayOverride(model) {
+  const gatewayUrl = getProviderGatewayUrl(model);
+  if (!model || !gatewayUrl) return {};
+  const provider2 = model.slice(0, model.indexOf("/"));
+  const baseURL = `${gatewayUrl}${OPENCODE_GATEWAY_PATH[provider2] ?? ""}`;
+  return { [provider2]: { options: { baseURL } } };
+}
 function azureProvider(model) {
   const prefix = `${AZURE_PROVIDER}/`;
   if (!model?.startsWith(prefix)) return {};
@@ -118709,7 +118745,8 @@ function buildSecurityConfig(ctx, model) {
     provider: {
       openrouter: { models: kimiOpenRouterProviderOverrides() },
       ...openAICompatibleProvider(model),
-      ...azureProvider(model)
+      ...azureProvider(model),
+      ...providerGatewayOverride(model)
     }
   };
   if (model) {
@@ -176983,8 +177020,8 @@ function closeBrowserDaemon(toolState) {
 
 // mcp/checkout.ts
 import { createHash as createHash2 } from "node:crypto";
-import { statSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join14 } from "node:path";
+import { statSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join15 } from "node:path";
 
 // node_modules/.pnpm/@ark+schema@0.56.0/node_modules/@ark/schema/out/shared/errors.js
 var ArkError = class _ArkError extends CastableBase {
@@ -185256,6 +185293,960 @@ async function $gitFetchWithDeepen(args2, options, label) {
   }
 }
 
+// utils/lifecycle.ts
+import { spawnSync as spawnSync7 } from "node:child_process";
+
+// mcp/shell.ts
+import { spawn as spawn3, spawnSync as spawnSync6 } from "node:child_process";
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { closeSync, openSync, writeFileSync as writeFileSync8 } from "node:fs";
+import { userInfo as userInfo2 } from "node:os";
+import { join as join10 } from "node:path";
+import { setTimeout as sleep2 } from "node:timers/promises";
+
+// node_modules/.pnpm/@toon-format+toon@1.4.0/node_modules/@toon-format/toon/dist/index.mjs
+var LIST_ITEM_MARKER = "-";
+var LIST_ITEM_PREFIX = "- ";
+var COMMA = ",";
+var PIPE = "|";
+var DOT = ".";
+var NULL_LITERAL = "null";
+var TRUE_LITERAL = "true";
+var FALSE_LITERAL = "false";
+var BACKSLASH = "\\";
+var DOUBLE_QUOTE = '"';
+var TAB = "	";
+var DELIMITERS = {
+  comma: COMMA,
+  tab: TAB,
+  pipe: PIPE
+};
+var DEFAULT_DELIMITER = DELIMITERS.comma;
+function escapeString(value2) {
+  return value2.replace(/\\/g, `${BACKSLASH}${BACKSLASH}`).replace(/"/g, `${BACKSLASH}${DOUBLE_QUOTE}`).replace(/\n/g, `${BACKSLASH}n`).replace(/\r/g, `${BACKSLASH}r`).replace(/\t/g, `${BACKSLASH}t`);
+}
+function isBooleanOrNullLiteral(token) {
+  return token === TRUE_LITERAL || token === FALSE_LITERAL || token === NULL_LITERAL;
+}
+function normalizeValue(value2) {
+  if (value2 === null) return null;
+  if (typeof value2 === "string" || typeof value2 === "boolean") return value2;
+  if (typeof value2 === "number") {
+    if (Object.is(value2, -0)) return 0;
+    if (!Number.isFinite(value2)) return null;
+    return value2;
+  }
+  if (typeof value2 === "bigint") {
+    if (value2 >= Number.MIN_SAFE_INTEGER && value2 <= Number.MAX_SAFE_INTEGER) return Number(value2);
+    return value2.toString();
+  }
+  if (value2 instanceof Date) return value2.toISOString();
+  if (Array.isArray(value2)) return value2.map(normalizeValue);
+  if (value2 instanceof Set) return Array.from(value2).map(normalizeValue);
+  if (value2 instanceof Map) return Object.fromEntries(Array.from(value2, ([k2, v]) => [String(k2), normalizeValue(v)]));
+  if (isPlainObject6(value2)) {
+    const normalized = {};
+    for (const key in value2) if (Object.prototype.hasOwnProperty.call(value2, key)) normalized[key] = normalizeValue(value2[key]);
+    return normalized;
+  }
+  return null;
+}
+function isJsonPrimitive(value2) {
+  return value2 === null || typeof value2 === "string" || typeof value2 === "number" || typeof value2 === "boolean";
+}
+function isJsonArray(value2) {
+  return Array.isArray(value2);
+}
+function isJsonObject4(value2) {
+  return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
+}
+function isEmptyObject2(value2) {
+  return Object.keys(value2).length === 0;
+}
+function isPlainObject6(value2) {
+  if (value2 === null || typeof value2 !== "object") return false;
+  const prototype = Object.getPrototypeOf(value2);
+  return prototype === null || prototype === Object.prototype;
+}
+function isArrayOfPrimitives(value2) {
+  return value2.length === 0 || value2.every((item) => isJsonPrimitive(item));
+}
+function isArrayOfArrays(value2) {
+  return value2.length === 0 || value2.every((item) => isJsonArray(item));
+}
+function isArrayOfObjects(value2) {
+  return value2.length === 0 || value2.every((item) => isJsonObject4(item));
+}
+function isValidUnquotedKey(key) {
+  return /^[A-Z_][\w.]*$/i.test(key);
+}
+function isIdentifierSegment(key) {
+  return /^[A-Z_]\w*$/i.test(key);
+}
+function isSafeUnquoted(value2, delimiter2 = DEFAULT_DELIMITER) {
+  if (!value2) return false;
+  if (value2 !== value2.trim()) return false;
+  if (isBooleanOrNullLiteral(value2) || isNumericLike(value2)) return false;
+  if (value2.includes(":")) return false;
+  if (value2.includes('"') || value2.includes("\\")) return false;
+  if (/[[\]{}]/.test(value2)) return false;
+  if (/[\n\r\t]/.test(value2)) return false;
+  if (value2.includes(delimiter2)) return false;
+  if (value2.startsWith(LIST_ITEM_MARKER)) return false;
+  return true;
+}
+function isNumericLike(value2) {
+  return /^-?\d+(?:\.\d+)?(?:e[+-]?\d+)?$/i.test(value2) || /^0\d+$/.test(value2);
+}
+var QUOTED_KEY_MARKER = Symbol("quotedKey");
+function tryFoldKeyChain(key, value2, siblings, options, rootLiteralKeys, pathPrefix, flattenDepth) {
+  if (options.keyFolding !== "safe") return;
+  if (!isJsonObject4(value2)) return;
+  const { segments, tail, leafValue } = collectSingleKeyChain(key, value2, flattenDepth ?? options.flattenDepth);
+  if (segments.length < 2) return;
+  if (!segments.every((seg) => isIdentifierSegment(seg))) return;
+  const foldedKey = buildFoldedKey(segments);
+  const absolutePath = pathPrefix ? `${pathPrefix}${DOT}${foldedKey}` : foldedKey;
+  if (siblings.includes(foldedKey)) return;
+  if (rootLiteralKeys && rootLiteralKeys.has(absolutePath)) return;
+  return {
+    foldedKey,
+    remainder: tail,
+    leafValue,
+    segmentCount: segments.length
+  };
+}
+function collectSingleKeyChain(startKey, startValue, maxDepth) {
+  const segments = [startKey];
+  let currentValue = startValue;
+  while (segments.length < maxDepth) {
+    if (!isJsonObject4(currentValue)) break;
+    const keys = Object.keys(currentValue);
+    if (keys.length !== 1) break;
+    const nextKey = keys[0];
+    const nextValue = currentValue[nextKey];
+    segments.push(nextKey);
+    currentValue = nextValue;
+  }
+  if (!isJsonObject4(currentValue) || isEmptyObject2(currentValue)) return {
+    segments,
+    tail: void 0,
+    leafValue: currentValue
+  };
+  return {
+    segments,
+    tail: currentValue,
+    leafValue: currentValue
+  };
+}
+function buildFoldedKey(segments) {
+  return segments.join(DOT);
+}
+function encodePrimitive(value2, delimiter2) {
+  if (value2 === null) return NULL_LITERAL;
+  if (typeof value2 === "boolean") return String(value2);
+  if (typeof value2 === "number") return String(value2);
+  return encodeStringLiteral(value2, delimiter2);
+}
+function encodeStringLiteral(value2, delimiter2 = DEFAULT_DELIMITER) {
+  if (isSafeUnquoted(value2, delimiter2)) return value2;
+  return `${DOUBLE_QUOTE}${escapeString(value2)}${DOUBLE_QUOTE}`;
+}
+function encodeKey(key) {
+  if (isValidUnquotedKey(key)) return key;
+  return `${DOUBLE_QUOTE}${escapeString(key)}${DOUBLE_QUOTE}`;
+}
+function encodeAndJoinPrimitives(values, delimiter2 = DEFAULT_DELIMITER) {
+  return values.map((v) => encodePrimitive(v, delimiter2)).join(delimiter2);
+}
+function formatHeader(length, options) {
+  const key = options?.key;
+  const fields = options?.fields;
+  const delimiter2 = options?.delimiter ?? COMMA;
+  let header = "";
+  if (key) header += encodeKey(key);
+  header += `[${length}${delimiter2 !== DEFAULT_DELIMITER ? delimiter2 : ""}]`;
+  if (fields) {
+    const quotedFields = fields.map((f) => encodeKey(f));
+    header += `{${quotedFields.join(delimiter2)}}`;
+  }
+  header += ":";
+  return header;
+}
+function* encodeJsonValue(value2, options, depth) {
+  if (isJsonPrimitive(value2)) {
+    const encodedPrimitive = encodePrimitive(value2, options.delimiter);
+    if (encodedPrimitive !== "") yield encodedPrimitive;
+    return;
+  }
+  if (isJsonArray(value2)) yield* encodeArrayLines(void 0, value2, depth, options);
+  else if (isJsonObject4(value2)) yield* encodeObjectLines(value2, depth, options);
+}
+function* encodeObjectLines(value2, depth, options, rootLiteralKeys, pathPrefix, remainingDepth) {
+  const keys = Object.keys(value2);
+  if (depth === 0 && !rootLiteralKeys) rootLiteralKeys = new Set(keys.filter((k2) => k2.includes(".")));
+  const effectiveFlattenDepth = remainingDepth ?? options.flattenDepth;
+  for (const [key, val] of Object.entries(value2)) yield* encodeKeyValuePairLines(key, val, depth, options, keys, rootLiteralKeys, pathPrefix, effectiveFlattenDepth);
+}
+function* encodeKeyValuePairLines(key, value2, depth, options, siblings, rootLiteralKeys, pathPrefix, flattenDepth) {
+  const currentPath = pathPrefix ? `${pathPrefix}${DOT}${key}` : key;
+  const effectiveFlattenDepth = flattenDepth ?? options.flattenDepth;
+  if (options.keyFolding === "safe" && siblings) {
+    const foldResult = tryFoldKeyChain(key, value2, siblings, options, rootLiteralKeys, pathPrefix, effectiveFlattenDepth);
+    if (foldResult) {
+      const { foldedKey, remainder, leafValue, segmentCount } = foldResult;
+      const encodedFoldedKey = encodeKey(foldedKey);
+      if (remainder === void 0) {
+        if (isJsonPrimitive(leafValue)) {
+          yield indentedLine(depth, `${encodedFoldedKey}: ${encodePrimitive(leafValue, options.delimiter)}`, options.indent);
+          return;
+        } else if (isJsonArray(leafValue)) {
+          yield* encodeArrayLines(foldedKey, leafValue, depth, options);
+          return;
+        } else if (isJsonObject4(leafValue) && isEmptyObject2(leafValue)) {
+          yield indentedLine(depth, `${encodedFoldedKey}:`, options.indent);
+          return;
+        }
+      }
+      if (isJsonObject4(remainder)) {
+        yield indentedLine(depth, `${encodedFoldedKey}:`, options.indent);
+        const remainingDepth = effectiveFlattenDepth - segmentCount;
+        const foldedPath = pathPrefix ? `${pathPrefix}${DOT}${foldedKey}` : foldedKey;
+        yield* encodeObjectLines(remainder, depth + 1, options, rootLiteralKeys, foldedPath, remainingDepth);
+        return;
+      }
+    }
+  }
+  const encodedKey = encodeKey(key);
+  if (isJsonPrimitive(value2)) yield indentedLine(depth, `${encodedKey}: ${encodePrimitive(value2, options.delimiter)}`, options.indent);
+  else if (isJsonArray(value2)) yield* encodeArrayLines(key, value2, depth, options);
+  else if (isJsonObject4(value2)) {
+    yield indentedLine(depth, `${encodedKey}:`, options.indent);
+    if (!isEmptyObject2(value2)) yield* encodeObjectLines(value2, depth + 1, options, rootLiteralKeys, currentPath, effectiveFlattenDepth);
+  }
+}
+function* encodeArrayLines(key, value2, depth, options) {
+  if (value2.length === 0) {
+    yield indentedLine(depth, formatHeader(0, {
+      key,
+      delimiter: options.delimiter
+    }), options.indent);
+    return;
+  }
+  if (isArrayOfPrimitives(value2)) {
+    yield indentedLine(depth, encodeInlineArrayLine(value2, options.delimiter, key), options.indent);
+    return;
+  }
+  if (isArrayOfArrays(value2)) {
+    if (value2.every((arr) => isArrayOfPrimitives(arr))) {
+      yield* encodeArrayOfArraysAsListItemsLines(key, value2, depth, options);
+      return;
+    }
+  }
+  if (isArrayOfObjects(value2)) {
+    const header = extractTabularHeader(value2);
+    if (header) yield* encodeArrayOfObjectsAsTabularLines(key, value2, header, depth, options);
+    else yield* encodeMixedArrayAsListItemsLines(key, value2, depth, options);
+    return;
+  }
+  yield* encodeMixedArrayAsListItemsLines(key, value2, depth, options);
+}
+function* encodeArrayOfArraysAsListItemsLines(prefix, values, depth, options) {
+  yield indentedLine(depth, formatHeader(values.length, {
+    key: prefix,
+    delimiter: options.delimiter
+  }), options.indent);
+  for (const arr of values) if (isArrayOfPrimitives(arr)) {
+    const arrayLine = encodeInlineArrayLine(arr, options.delimiter);
+    yield indentedListItem(depth + 1, arrayLine, options.indent);
+  }
+}
+function encodeInlineArrayLine(values, delimiter2, prefix) {
+  const header = formatHeader(values.length, {
+    key: prefix,
+    delimiter: delimiter2
+  });
+  const joinedValue = encodeAndJoinPrimitives(values, delimiter2);
+  if (values.length === 0) return header;
+  return `${header} ${joinedValue}`;
+}
+function* encodeArrayOfObjectsAsTabularLines(prefix, rows, header, depth, options) {
+  yield indentedLine(depth, formatHeader(rows.length, {
+    key: prefix,
+    fields: header,
+    delimiter: options.delimiter
+  }), options.indent);
+  yield* writeTabularRowsLines(rows, header, depth + 1, options);
+}
+function extractTabularHeader(rows) {
+  if (rows.length === 0) return;
+  const firstRow = rows[0];
+  const firstKeys = Object.keys(firstRow);
+  if (firstKeys.length === 0) return;
+  if (isTabularArray(rows, firstKeys)) return firstKeys;
+}
+function isTabularArray(rows, header) {
+  for (const row of rows) {
+    if (Object.keys(row).length !== header.length) return false;
+    for (const key of header) {
+      if (!(key in row)) return false;
+      if (!isJsonPrimitive(row[key])) return false;
+    }
+  }
+  return true;
+}
+function* writeTabularRowsLines(rows, header, depth, options) {
+  for (const row of rows) yield indentedLine(depth, encodeAndJoinPrimitives(header.map((key) => row[key]), options.delimiter), options.indent);
+}
+function* encodeMixedArrayAsListItemsLines(prefix, items, depth, options) {
+  yield indentedLine(depth, formatHeader(items.length, {
+    key: prefix,
+    delimiter: options.delimiter
+  }), options.indent);
+  for (const item of items) yield* encodeListItemValueLines(item, depth + 1, options);
+}
+function* encodeObjectAsListItemLines(obj, depth, options) {
+  if (isEmptyObject2(obj)) {
+    yield indentedLine(depth, LIST_ITEM_MARKER, options.indent);
+    return;
+  }
+  const entries = Object.entries(obj);
+  if (entries.length === 1) {
+    const [key, value2] = entries[0];
+    if (isJsonArray(value2) && isArrayOfObjects(value2)) {
+      const header = extractTabularHeader(value2);
+      if (header) {
+        yield indentedListItem(depth, formatHeader(value2.length, {
+          key,
+          fields: header,
+          delimiter: options.delimiter
+        }), options.indent);
+        yield* writeTabularRowsLines(value2, header, depth + 1, options);
+        return;
+      }
+    }
+  }
+  yield indentedLine(depth, LIST_ITEM_MARKER, options.indent);
+  yield* encodeObjectLines(obj, depth + 1, options);
+}
+function* encodeListItemValueLines(value2, depth, options) {
+  if (isJsonPrimitive(value2)) yield indentedListItem(depth, encodePrimitive(value2, options.delimiter), options.indent);
+  else if (isJsonArray(value2)) if (isArrayOfPrimitives(value2)) yield indentedListItem(depth, encodeInlineArrayLine(value2, options.delimiter), options.indent);
+  else {
+    yield indentedListItem(depth, formatHeader(value2.length, { delimiter: options.delimiter }), options.indent);
+    for (const item of value2) yield* encodeListItemValueLines(item, depth + 1, options);
+  }
+  else if (isJsonObject4(value2)) yield* encodeObjectAsListItemLines(value2, depth, options);
+}
+function indentedLine(depth, content, indentSize) {
+  return " ".repeat(indentSize * depth) + content;
+}
+function indentedListItem(depth, content, indentSize) {
+  return indentedLine(depth, LIST_ITEM_PREFIX + content, indentSize);
+}
+function encode4(input2, options) {
+  return Array.from(encodeLines(input2, options)).join("\n");
+}
+function encodeLines(input2, options) {
+  return encodeJsonValue(normalizeValue(input2), resolveOptions(options), 0);
+}
+function resolveOptions(options) {
+  return {
+    indent: options?.indent ?? 2,
+    delimiter: options?.delimiter ?? DEFAULT_DELIMITER,
+    keyFolding: options?.keyFolding ?? "off",
+    flattenDepth: options?.flattenDepth ?? Number.POSITIVE_INFINITY
+  };
+}
+
+// mcp/geminiSanitizer.ts
+function parseStringEnumBranch(item) {
+  if (!item || typeof item !== "object") return null;
+  const record3 = item;
+  if (Array.isArray(record3.enum)) {
+    const strings = record3.enum.filter((v) => typeof v === "string");
+    return strings.length === record3.enum.length && strings.length > 0 ? { values: strings } : null;
+  }
+  if (typeof record3.const === "string") {
+    return { values: [record3.const] };
+  }
+  return null;
+}
+function collapseStringUnion(branches) {
+  const values = [];
+  for (const item of branches) {
+    const parsed2 = parseStringEnumBranch(item);
+    if (!parsed2) return null;
+    values.push(...parsed2.values);
+  }
+  if (values.length === 0) return null;
+  return { type: "string", enum: [...new Set(values)] };
+}
+function sanitizeForGemini(schema2) {
+  if (!schema2 || typeof schema2 !== "object") return schema2;
+  if (Array.isArray(schema2)) return schema2.map(sanitizeForGemini);
+  const source = schema2;
+  if (Array.isArray(source.enum) && typeof source.type !== "string") {
+    const allStrings = source.enum.every((v) => typeof v === "string");
+    if (allStrings) {
+      const result = { type: "string", enum: source.enum };
+      if (typeof source.description === "string") result.description = source.description;
+      return result;
+    }
+  }
+  for (const unionKey of ["anyOf", "oneOf"]) {
+    const branches = source[unionKey];
+    if (Array.isArray(branches) && branches.length > 0) {
+      const collapsed = collapseStringUnion(branches);
+      if (collapsed) {
+        const result = { ...collapsed };
+        if (typeof source.description === "string") result.description = source.description;
+        return result;
+      }
+    }
+  }
+  if (Array.isArray(source.anyOf) || Array.isArray(source.oneOf)) {
+    const result = {};
+    if (Array.isArray(source.anyOf)) result.anyOf = source.anyOf.map(sanitizeForGemini);
+    if (Array.isArray(source.oneOf)) result.oneOf = source.oneOf.map(sanitizeForGemini);
+    return result;
+  }
+  const sanitized = {};
+  for (const [key, value2] of Object.entries(source)) {
+    if (key === "$schema") continue;
+    if (key === "$defs") {
+      sanitized.definitions = sanitizeForGemini(value2);
+      continue;
+    }
+    sanitized[key] = sanitizeForGemini(value2);
+  }
+  return sanitized;
+}
+function wrapJsonSchemaProducer(producer) {
+  return new Proxy(producer, {
+    get(target, prop, receiver) {
+      const value2 = Reflect.get(target, prop, receiver);
+      if ((prop === "input" || prop === "output") && typeof value2 === "function") {
+        const fn2 = value2;
+        return (...args2) => sanitizeForGemini(fn2.apply(target, args2));
+      }
+      return value2;
+    }
+  });
+}
+function wrapStandard(standard) {
+  return new Proxy(standard, {
+    get(target, prop, receiver) {
+      if (prop === "jsonSchema") {
+        const value2 = Reflect.get(target, prop, receiver);
+        if (value2 && typeof value2 === "object") {
+          return wrapJsonSchemaProducer(value2);
+        }
+        return value2;
+      }
+      return Reflect.get(target, prop, receiver);
+    }
+  });
+}
+function wrapSchemaForGemini(schema2) {
+  return new Proxy(schema2, {
+    get(target, prop, receiver) {
+      if (prop === "~standard") {
+        const value2 = Reflect.get(target, prop, receiver);
+        if (value2 && typeof value2 === "object") {
+          return wrapStandard(value2);
+        }
+        return value2;
+      }
+      if (prop === "toJsonSchema") {
+        const method = Reflect.get(target, prop, receiver);
+        if (typeof method === "function") {
+          return () => sanitizeForGemini(method.call(target));
+        }
+        return method;
+      }
+      return Reflect.get(target, prop, receiver);
+    }
+  });
+}
+function sanitizeToolForGemini(tool2) {
+  if (!tool2.parameters) return tool2;
+  return { ...tool2, parameters: wrapSchemaForGemini(tool2.parameters) };
+}
+function isGeminiRouted(ctx) {
+  const effective = ctx.payload.proxyModel ?? ctx.resolvedModel ?? ctx.payload.model;
+  if (!effective) return true;
+  const normalized = effective.toLowerCase();
+  if (normalized.includes("gemini")) return true;
+  if (!normalized.includes("/")) return true;
+  return false;
+}
+
+// mcp/shared.ts
+function getHttpStatus(err) {
+  if (typeof err !== "object" || err === null || !("status" in err)) return void 0;
+  return typeof err.status === "number" ? err.status : void 0;
+}
+var tool = (toolDef) => toolDef;
+var handleToolSuccess = (data) => {
+  const text = typeof data === "string" ? data : encode4(data);
+  return {
+    content: [{ type: "text", text }]
+  };
+};
+var handleToolError = (error62) => {
+  const errorMessage = error62 instanceof Error ? error62.message : String(error62);
+  return {
+    content: [
+      {
+        type: "text",
+        text: `Error: ${errorMessage}`
+      }
+    ],
+    isError: true
+  };
+};
+var execute = (fn2, toolName) => {
+  const _fn = async (params) => {
+    try {
+      const result = await fn2(params);
+      return handleToolSuccess(result);
+    } catch (error62) {
+      const errorMessage = error62 instanceof Error ? error62.message : String(error62);
+      const prefix = toolName ? `[${toolName}]` : "tool";
+      log.info(`${prefix} error: ${errorMessage}`);
+      log.debug(`${prefix} params: ${formatJsonValue(params)}`);
+      return handleToolError(error62);
+    }
+  };
+  return _fn;
+};
+var addTools = (ctx, server, tools) => {
+  const shouldSanitize = isGeminiRouted(ctx);
+  for (const tool2 of tools) {
+    server.addTool(shouldSanitize ? sanitizeToolForGemini(tool2) : tool2);
+  }
+  return server;
+};
+
+// mcp/shell.ts
+var ShellParams = type({
+  command: "string",
+  // advisory and unread — no code path consumes it. kept in the schema only
+  // because it nudges the model to state intent before running a command;
+  // REQUIRING it cost a full rejected turn every time one was omitted. #1140.
+  "description?": "string",
+  "timeout?": type.number.describe(
+    "Timeout in MILLISECONDS (not seconds). Default 30000 (30s), max 120000 (2m). e.g. timeout: 180000 for 3 minutes; timeout: 180 means 180ms and will kill the process almost immediately."
+  ),
+  "working_directory?": "string",
+  "background?": "boolean"
+});
+var detectedSandboxMethod;
+var usernsProbeError;
+function getSandboxMethod() {
+  return detectSandboxMethod();
+}
+function detectSandboxMethod() {
+  if (detectedSandboxMethod !== void 0) {
+    return detectedSandboxMethod;
+  }
+  if (process.env.CI !== "true") {
+    detectedSandboxMethod = "none";
+    log.debug("sandbox disabled (CI !== true)");
+    return "none";
+  }
+  try {
+    const result = spawnSync6("unshare", ["--pid", "--fork", "--mount-proc", "true"], {
+      timeout: 5e3,
+      stdio: "ignore"
+    });
+    if (result.status === 0) {
+      detectedSandboxMethod = "unshare";
+      log.debug("PID namespace isolation enabled (unprivileged unshare)");
+      return "unshare";
+    }
+  } catch {
+  }
+  try {
+    const result = spawnSync6("sudo", ["unshare", "--pid", "--fork", "--mount-proc", "true"], {
+      timeout: 5e3,
+      stdio: "ignore"
+    });
+    if (result.status === 0) {
+      detectedSandboxMethod = "sudo-unshare";
+      log.debug("PID namespace isolation enabled (sudo unshare)");
+      return "sudo-unshare";
+    }
+  } catch {
+  }
+  try {
+    const result = spawnSync6(
+      "unshare",
+      [
+        "--user",
+        "--map-root-user",
+        "--pid",
+        "--fork",
+        "--mount",
+        "setpriv",
+        "--no-new-privs",
+        "--bounding-set",
+        "-all",
+        "--inh-caps",
+        "-all",
+        "--ambient-caps",
+        "-all",
+        "true"
+      ],
+      { timeout: 5e3, stdio: ["ignore", "ignore", "pipe"] }
+    );
+    if (result.status === 0) {
+      detectedSandboxMethod = "userns-unshare";
+      log.debug("PID namespace isolation enabled (unprivileged userns unshare)");
+      return "userns-unshare";
+    }
+    usernsProbeError = result.stderr?.toString().trim() || result.error?.message;
+  } catch {
+  }
+  detectedSandboxMethod = "none";
+  log.info("PID namespace isolation not available");
+  return "none";
+}
+var PROC_CLEANUP = "umount /proc 2>/dev/null; umount /proc 2>/dev/null; mount -t proc proc /proc 2>/dev/null;";
+var SOCKET_CLEANUP = [
+  "/var/run/docker.sock",
+  "/run/docker.sock",
+  "/var/run/podman/podman.sock",
+  "/run/podman/podman.sock",
+  "/run/containerd/containerd.sock",
+  "/var/run/crio/crio.sock"
+].map((path4) => `mount --bind /dev/null ${path4} 2>/dev/null;`).join(" ");
+function buildFsMounts(repoDir) {
+  const escaped = repoDir.replace(/'/g, "'\\''");
+  return [
+    `mkdir -p /var/lib/pullfrog 2>/dev/null;`,
+    `mount -t tmpfs tmpfs /var/lib/pullfrog 2>/dev/null;`,
+    `[ -n "$RUNNER_TEMP" ] && [ -d "$RUNNER_TEMP/_runner_file_commands" ] && mount -t tmpfs tmpfs "$RUNNER_TEMP/_runner_file_commands" 2>/dev/null;`,
+    `[ -e '${escaped}/.git' ] && mount --bind '${escaped}/.git' '${escaped}/.git' 2>/dev/null && mount -o remount,bind,ro '${escaped}/.git' 2>/dev/null;`,
+    // the corepack shim dir sits FIRST on PATH (utils/packageManager.ts) and
+    // PATH survives filterEnv, so a writable pm-bin lets sandboxed code plant
+    // a `git`/`pnpm` that a later UNSANDBOXED spawn resolves with the parent
+    // env. read-only closes that for every sandboxed command at once.
+    //
+    // the path is interpolated HERE rather than read as `$PULLFROG_TEMP_DIR`
+    // inside the sandbox: that name is not on the `filterEnv` safe list, so in
+    // restricted mode it expands to empty and the mount silently no-ops in the
+    // one tier it exists to protect. `$RUNNER_TEMP` above is safe only because
+    // `RUNNER_` is an allowed prefix.
+    shimMount()
+  ].filter(Boolean).join(" ");
+}
+function shimMount() {
+  const tempDir = process.env.PULLFROG_TEMP_DIR;
+  if (!tempDir) return "";
+  const dir = join10(tempDir, "pm-bin").replace(/'/g, "'\\''");
+  return `[ -d '${dir}' ] && mount --bind '${dir}' '${dir}' 2>/dev/null && mount -o remount,bind,ro '${dir}' 2>/dev/null;`;
+}
+var _repoRoot;
+function resolveRepoRoot() {
+  if (_repoRoot) return _repoRoot;
+  const fromEnv = process.env.GITHUB_WORKSPACE;
+  if (fromEnv) {
+    _repoRoot = fromEnv;
+    return _repoRoot;
+  }
+  try {
+    _repoRoot = spawnSync6("git", ["rev-parse", "--show-toplevel"], {
+      cwd: process.cwd(),
+      stdio: ["ignore", "pipe", "ignore"],
+      encoding: "utf-8"
+    }).stdout?.trim();
+  } catch {
+  }
+  if (!_repoRoot) _repoRoot = process.cwd();
+  return _repoRoot;
+}
+function spawnShell(params) {
+  const spawnOpts = { env: params.env, cwd: params.cwd, stdio: params.stdio, detached: true };
+  const sandboxMethod = detectSandboxMethod();
+  const ci = process.env.CI === "true";
+  if (ci && sandboxMethod === "none") {
+    throw new Error(
+      "PID-namespace isolation is required in CI but unavailable: unprivileged unshare, sudo unshare, and userns-nested unshare all failed. " + (usernsProbeError ? `userns probe said: ${usernsProbeError}. ` : "") + "on a containerized / Kubernetes self-hosted runner the cause is usually one of: the pod's seccomp profile blocks user-namespace creation (Pod Security Standards baseline/restricted); the pod runs as root without CAP_SETFCAP, which the kernel requires to map uid 0; or the node kernel disallows unprivileged user namespaces (Ubuntu >= 23.10, Bottlerocket, Talos). elsewhere, check that `unshare` and `setpriv` (util-linux >= 2.31, which is what added --ambient-caps) are on PATH. see https://docs.pullfrog.com/security#self-hosted-runners"
+    );
+  }
+  const repoRoot = resolveRepoRoot();
+  const fsMounts = buildFsMounts(repoRoot);
+  if (sandboxMethod === "unshare") {
+    return spawn3(
+      "unshare",
+      [
+        "--pid",
+        "--fork",
+        "--mount-proc",
+        "bash",
+        "-c",
+        `${PROC_CLEANUP} ${SOCKET_CLEANUP} ${fsMounts} ${params.command}`
+      ],
+      spawnOpts
+    );
+  }
+  if (sandboxMethod === "userns-unshare") {
+    const escaped = params.command.replace(/'/g, "'\\''");
+    return spawn3(
+      "unshare",
+      [
+        "--user",
+        "--map-root-user",
+        "--pid",
+        "--fork",
+        "--mount",
+        "bash",
+        "-c",
+        `${PROC_CLEANUP} ${SOCKET_CLEANUP} ${fsMounts} exec setpriv --no-new-privs --bounding-set -all --inh-caps -all --ambient-caps -all bash -c '${escaped}'`
+      ],
+      spawnOpts
+    );
+  }
+  if (sandboxMethod === "sudo-unshare") {
+    const envArgs = [];
+    for (const [k2, v] of Object.entries(params.env)) {
+      if (v !== void 0) {
+        envArgs.push(`${k2}=${v}`);
+      }
+    }
+    const username = userInfo2().username;
+    const pathRestore = 'export PATH="${SANDBOX_PATH:-$PATH}"; ';
+    const escaped = (pathRestore + params.command).replace(/'/g, "'\\''");
+    envArgs.push(`SANDBOX_PATH=${params.env.PATH ?? ""}`);
+    return spawn3(
+      "sudo",
+      [
+        "env",
+        ...envArgs,
+        "unshare",
+        "--pid",
+        "--fork",
+        "--mount-proc",
+        "bash",
+        "-c",
+        `${PROC_CLEANUP} ${SOCKET_CLEANUP} ${fsMounts} exec su -p -s /bin/bash ${username} -c '${escaped}'`
+      ],
+      { ...spawnOpts, env: {} }
+    );
+  }
+  return spawn3("bash", ["-c", params.command], spawnOpts);
+}
+async function killProcessGroup(proc) {
+  if (!proc.pid) return;
+  try {
+    process.kill(-proc.pid, "SIGTERM");
+    await new Promise((r) => setTimeout(r, 200));
+    process.kill(-proc.pid, "SIGKILL");
+  } catch {
+    try {
+      proc.kill("SIGKILL");
+    } catch {
+    }
+  }
+}
+function getTempDir() {
+  const tempDir = process.env.PULLFROG_TEMP_DIR;
+  if (!tempDir) {
+    throw new Error("PULLFROG_TEMP_DIR not set");
+  }
+  return tempDir;
+}
+var MAX_OUTPUT_CHARS = 5e3;
+async function runSandboxed(params) {
+  const proc = spawnShell({
+    command: params.command,
+    env: params.env,
+    cwd: params.cwd,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const stdout = new TailBuffer(DEFAULT_MAX_RETAINED_BYTES);
+  const stderr = new TailBuffer(DEFAULT_MAX_RETAINED_BYTES);
+  let timedOut = false, exited = false, spawnError = "";
+  proc.stdout?.on("data", (chunk) => {
+    const text = chunk.toString();
+    stdout.append(text);
+    params.onStdout?.(text);
+  });
+  proc.stderr?.on("data", (chunk) => {
+    const text = chunk.toString();
+    stderr.append(text);
+    params.onStderr?.(text);
+  });
+  const timeoutId = setTimeout(async () => {
+    if (!exited) {
+      timedOut = true;
+      await killProcessGroup(proc);
+    }
+  }, params.timeout);
+  const exitCode = await new Promise((resolve3) => {
+    const done = (code) => {
+      exited = true;
+      clearTimeout(timeoutId);
+      resolve3(code);
+    };
+    proc.on("exit", done);
+    proc.on("error", (err) => {
+      spawnError = err.message;
+      done(null);
+    });
+  });
+  proc.stdout?.destroy();
+  proc.stderr?.destroy();
+  const outText = stdout.toString();
+  const errText = stderr.toString();
+  let output2 = errText ? outText ? `${outText}
+${errText}` : errText : outText;
+  if (spawnError) output2 = output2 ? `${output2}
+${spawnError}` : spawnError;
+  if (timedOut)
+    output2 = output2 ? `${output2}
+[timed out after ${params.timeout}ms]` : `[timed out after ${params.timeout}ms]`;
+  return {
+    output: output2.trim(),
+    exitCode: exitCode ?? (timedOut ? 124 : -1),
+    timedOut
+  };
+}
+function capOutput(output2) {
+  if (output2.length <= MAX_OUTPUT_CHARS) return output2;
+  const fullPath = join10(getTempDir(), `shell-${randomUUID3().slice(0, 8)}.log`);
+  writeFileSync8(fullPath, output2);
+  const elided = output2.length - MAX_OUTPUT_CHARS;
+  return `... [${elided} chars truncated; output saved to ${fullPath}] ...
+${output2.slice(-MAX_OUTPUT_CHARS)}`;
+}
+function isGitCommand(command) {
+  const trimmed = command.trim();
+  if (trimmed === "git" || trimmed.startsWith("git ")) return true;
+  if (trimmed.startsWith("sudo git")) return true;
+  return /[;&|]\s*(?:sudo\s+)?git(?:\s|$)/.test(trimmed);
+}
+function ShellTool(ctx) {
+  return tool({
+    name: "shell",
+    timeoutMs: 12e4,
+    description: `Execute shell commands securely. Environment is filtered to remove API keys and secrets.
+
+Example: \`shell({ command: "pnpm test", description: "run the test suite" })\`.
+
+Use this tool to:
+- Run shell commands (ls, cat, grep, find, etc.)
+- Execute build tools (npm, pnpm, cargo, make, etc.)
+- Run tests and linters
+
+Output is capped at ${MAX_OUTPUT_CHARS} chars: if exceeded, only the tail is returned and the captured output is saved to a tempfile (path included in the response). Re-read the tempfile with cat/tail/grep when you need more.
+
+Do NOT use this tool for git commands \u2014 use the dedicated git tools instead.`,
+    parameters: ShellParams,
+    execute: execute(async (params) => {
+      if (isGitCommand(params.command)) {
+        throw new Error(
+          'git commands are not allowed in the shell tool. use the dedicated git tools instead:\n- git: local operations, e.g. git({ command: "log", args: ["--oneline"] }) \u2014 `command` is the subcommand ONLY\n- push_branch: push to remote (handles authentication)\n- git_fetch: fetch from remote (handles authentication)\n- checkout_pr: check out PR branches'
+        );
+      }
+      const timeout = Math.min(params.timeout ?? 3e4, 12e4);
+      const cwd = params.working_directory ?? process.cwd();
+      const env2 = resolveEnv(ctx.payload.shell === "enabled" ? "inherit" : "restricted");
+      if (params.command.includes("agent-browser")) {
+        const daemonError = ensureBrowserDaemon(ctx.toolState);
+        if (daemonError) {
+          return {
+            output: `browser daemon unavailable: ${daemonError}`,
+            exit_code: 1,
+            timed_out: false
+          };
+        }
+        const binDir = ctx.toolState.browserDaemon?.binDir;
+        if (binDir) {
+          env2.PATH = `${binDir}:${env2.PATH ?? ""}`;
+        }
+      }
+      if (params.background) {
+        const tempDir = getTempDir();
+        const handle = `bg-${randomUUID3().slice(0, 8)}`;
+        const outputPath = join10(tempDir, `${handle}.log`);
+        const pidPath = join10(tempDir, `${handle}.pid`);
+        const logFd = openSync(outputPath, "a");
+        let proc;
+        try {
+          proc = spawnShell({
+            command: params.command,
+            env: env2,
+            cwd,
+            stdio: ["ignore", logFd, logFd]
+          });
+        } finally {
+          closeSync(logFd);
+        }
+        if (!proc.pid) {
+          throw new Error("failed to start background process");
+        }
+        proc.unref();
+        writeFileSync8(pidPath, `${proc.pid}
+`);
+        ctx.toolState.backgroundProcesses.set(handle, { pid: proc.pid, outputPath, pidPath });
+        return {
+          handle,
+          outputPath,
+          pidPath,
+          message: `started background process ${handle} (pid ${proc.pid})`
+        };
+      }
+      const result = await runSandboxed({ command: params.command, env: env2, cwd, timeout });
+      if (result.exitCode !== 0) {
+        log.info(`shell command failed with exit code ${result.exitCode}: ${params.command}`);
+        if (result.output) log.info(`output: ${result.output}`);
+      }
+      return {
+        output: capOutput(result.output),
+        exit_code: result.exitCode,
+        timed_out: result.timedOut
+      };
+    })
+  });
+}
+var KillBackgroundParams = type({
+  handle: type.string.describe("The handle of the background process to kill (e.g., bg-a1b2c3d4)")
+});
+function KillBackgroundTool(ctx) {
+  return tool({
+    name: "kill_background",
+    mutates: true,
+    description: `Kill a background process by its handle. Use this to stop dev servers or other long-running processes started with shell({ background: true }).`,
+    parameters: KillBackgroundParams,
+    execute: execute(async (params) => {
+      const proc = ctx.toolState.backgroundProcesses.get(params.handle);
+      if (!proc) {
+        return {
+          success: false,
+          message: `no background process with handle ${params.handle}`
+        };
+      }
+      try {
+        process.kill(-proc.pid, "SIGTERM");
+      } catch {
+      }
+      await sleep2(200);
+      try {
+        process.kill(-proc.pid, "SIGKILL");
+      } catch {
+      }
+      ctx.toolState.backgroundProcesses.delete(params.handle);
+      return {
+        success: true,
+        message: `killed background process ${params.handle} (pid ${proc.pid})`
+      };
+    })
+  });
+}
+
 // utils/lifecycle.ts
 function describeSetupFailure(failure2) {
   if (!failure2) return "";
@@ -185277,44 +186268,47 @@ ${failure2.output || "(empty)"}`;
 async function executeLifecycleHook(params) {
   if (!params.script) return {};
   log.info(`\xBB executing ${params.event} lifecycle hook...`);
+  resolveTrustedGit();
   const preHookTrackedCount = params.normalizeWorkingTreeAfter ? (await runGitLines(["diff", "--name-only", "HEAD"])).length : 0;
   let result;
   try {
+    let sandboxed;
     try {
-      const spawnResult = await spawn({
-        cmd: "bash",
-        args: ["-c", params.script],
-        env: process.env,
+      sandboxed = await runSandboxed({
+        command: params.script,
+        env: resolveEnv(params.shell === "enabled" ? "inherit" : "restricted"),
+        cwd: process.cwd(),
         timeout: LIFECYCLE_HOOK_TIMEOUT_MS,
-        activityTimeout: 0,
         onStdout: (chunk) => process.stdout.write(chunk),
         onStderr: (chunk) => process.stderr.write(chunk)
       });
-      if (spawnResult.exitCode !== 0) {
-        const output2 = (spawnResult.stderr || spawnResult.stdout).trim();
-        result = {
-          failure: { kind: "exit", output: output2, exitCode: spawnResult.exitCode },
-          warning: `lifecycle hook '${params.event}' failed with exit code ${spawnResult.exitCode}. output: ${output2 || "(empty)"}. retry the operation if the failure looks flaky (network blips, transient rate limits). do NOT retry if the script is broken (missing commands, syntax errors) or the error is persistent.`
-        };
-      } else {
-        log.info(`\xBB ${params.event} lifecycle hook completed successfully`);
-        result = {};
-      }
     } catch (err) {
-      const isTimeout = err instanceof SpawnTimeoutError && (err.code === SPAWN_TIMEOUT_CODE || err.code === SPAWN_ACTIVITY_TIMEOUT_CODE);
-      if (isTimeout) {
-        const minutes = Math.round(LIFECYCLE_HOOK_TIMEOUT_MS / 6e4);
-        result = {
-          failure: { kind: "timeout" },
-          warning: `lifecycle hook '${params.event}' timed out after ${minutes}min. do NOT retry \u2014 the script is likely hung or doing too much work. ask the repo owner to simplify the hook (e.g. move long-running work out of the hook, add caching, or split it).`
-        };
-      } else {
-        const msg = err instanceof Error ? err.message : String(err);
-        result = {
-          failure: { kind: "spawn", spawnError: msg },
-          warning: `lifecycle hook '${params.event}' failed to spawn: ${msg}. this is likely a transient failure \u2014 retry the operation.`
-        };
-      }
+      const msg = err instanceof Error ? err.message : String(err);
+      return {
+        failure: { kind: "spawn", spawnError: msg },
+        warning: `lifecycle hook '${params.event}' could not be sandboxed, so it did not run: ${msg}`
+      };
+    }
+    if (sandboxed.timedOut) {
+      const minutes = Math.round(LIFECYCLE_HOOK_TIMEOUT_MS / 6e4);
+      result = {
+        failure: { kind: "timeout" },
+        warning: `lifecycle hook '${params.event}' timed out after ${minutes}min. do NOT retry \u2014 the script is likely hung or doing too much work. ask the repo owner to simplify the hook (e.g. move long-running work out of the hook, add caching, or split it).`
+      };
+    } else if (sandboxed.exitCode === -1) {
+      result = {
+        failure: { kind: "spawn", spawnError: sandboxed.output },
+        warning: `lifecycle hook '${params.event}' failed to spawn: ${sandboxed.output}. this is likely a transient failure \u2014 retry the operation.`
+      };
+    } else if (sandboxed.exitCode !== 0) {
+      const output2 = capOutput(sandboxed.output);
+      result = {
+        failure: { kind: "exit", output: output2, exitCode: sandboxed.exitCode },
+        warning: `lifecycle hook '${params.event}' failed with exit code ${sandboxed.exitCode}. output: ${output2 || "(empty)"}. retry the operation if the failure looks flaky (network blips, transient rate limits). do NOT retry if the script is broken (missing commands, syntax errors) or the error is persistent. if it failed on a missing environment variable, the repo's env allowlist has to name it \u2014 hooks run with the same filtered env as the shell tool.`
+      };
+    } else {
+      log.info(`\xBB ${params.event} lifecycle hook completed successfully`);
+      result = {};
     }
   } finally {
     if (params.normalizeWorkingTreeAfter) {
@@ -185335,8 +186329,20 @@ async function normalizeWorkingTreeAfterHook(params) {
   await runGit(["restore", "--staged", "--worktree", "."]);
   log.info(`\xBB discarded ${trackedCount} tracked changes from ${params.event} hook`);
 }
+var trustedGit;
+function resolveTrustedGit() {
+  if (trustedGit) return trustedGit;
+  const resolved = spawnSync7("sh", ["-c", "command -v git"], { encoding: "utf-8" });
+  trustedGit = resolved.stdout?.trim() || "git";
+  return trustedGit;
+}
 async function runGit(args2) {
-  const result = await spawn({ cmd: "git", args: args2, env: process.env, activityTimeout: 0 });
+  const result = await spawn({
+    cmd: resolveTrustedGit(),
+    args: args2,
+    env: filterEnvForUntrustedCode(),
+    activityTimeout: 0
+  });
   if (result.exitCode !== 0) {
     throw new Error(
       `git ${args2.join(" ")} failed (exit ${result.exitCode}): ${result.stderr.trim() || "(no stderr)"}`
@@ -185456,7 +186462,7 @@ function postProcessRangeDiff(raw2, contextLines = 3) {
 
 // yes/index.ts
 import { performance as performance8 } from "node:perf_hooks";
-import { setTimeout as sleep2 } from "node:timers/promises";
+import { setTimeout as sleep3 } from "node:timers/promises";
 
 // node_modules/.pnpm/lru-cache@11.5.2/node_modules/lru-cache/dist/esm/node/index.min.js
 import { tracingChannel as G, channel as P } from "node:diagnostics_channel";
@@ -186250,7 +187256,7 @@ function _op(fn2, options) {
               );
               log2.info({ key, error: error62, attempt });
             }
-            await sleep2(delay2);
+            await sleep3(delay2);
           }
         }
       }
@@ -186318,14 +187324,14 @@ function _op(fn2, options) {
 }
 
 // mcp/git.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
-import { writeFileSync as writeFileSync8 } from "node:fs";
-import { join as join12 } from "node:path";
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join13 } from "node:path";
 
 // utils/apiCommit.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { lstat, readlink } from "node:fs/promises";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 var GITHUB_API = "https://api.github.com";
 var MAX_BLOB_BYTES = 30 * 1024 * 1024;
 var BLOB_UPLOAD_CONCURRENCY = 8;
@@ -186390,7 +187396,7 @@ async function assertApiCommittable(files) {
   const root = getRepoRoot();
   const attrs = $(
     "git",
-    ["check-attr", "filter", "-z", "--", ...present.map((p) => join10(root, p))],
+    ["check-attr", "filter", "-z", "--", ...present.map((p) => join11(root, p))],
     { log: false }
   );
   const parts = attrs.split("\0");
@@ -186402,7 +187408,7 @@ async function assertApiCommittable(files) {
     }
   }
   for (const path4 of present) {
-    const stat = await lstat(join10(root, path4));
+    const stat = await lstat(join11(root, path4));
     if (stat.isDirectory()) {
       throw new Error(
         `'${path4}' is a directory (nested repository or submodule?) \u2014 signed commits only support files and symlinks.`
@@ -186411,7 +187417,7 @@ async function assertApiCommittable(files) {
   }
 }
 async function createBlobEntry(params) {
-  const absPath = join10(params.repoRoot, params.path);
+  const absPath = join11(params.repoRoot, params.path);
   const stat = await lstat(absPath);
   if (stat.size > MAX_BLOB_BYTES) {
     throw new Error(
@@ -186591,7 +187597,7 @@ this usually means your local branch has commits that were never pushed \u2014 s
 var core5 = __toESM(require_core(), 1);
 import { createSign } from "node:crypto";
 import { rename, writeFile } from "node:fs/promises";
-import { dirname as dirname3, join as join11 } from "node:path";
+import { dirname as dirname3, join as join12 } from "node:path";
 
 // node_modules/.pnpm/@octokit+plugin-throttling@11.0.5_@octokit+core@7.0.8/node_modules/@octokit/plugin-throttling/dist-bundle/index.js
 var import_light = __toESM(require_light(), 1);
@@ -186963,7 +187969,7 @@ function lowercaseKeys(object5) {
     return newObj;
   }, {});
 }
-function isPlainObject6(value2) {
+function isPlainObject7(value2) {
   if (typeof value2 !== "object" || value2 === null) return false;
   if (Object.prototype.toString.call(value2) !== "[object Object]") return false;
   const proto = Object.getPrototypeOf(value2);
@@ -186974,7 +187980,7 @@ function isPlainObject6(value2) {
 function mergeDeep(defaults, options) {
   const result = Object.assign({}, defaults);
   Object.keys(options).forEach((key) => {
-    if (isPlainObject6(options[key])) {
+    if (isPlainObject7(options[key])) {
       if (!(key in defaults)) Object.assign(result, { [key]: options[key] });
       else result[key] = mergeDeep(defaults[key], options[key]);
     } else {
@@ -187261,7 +188267,7 @@ var NullObject = /* @__PURE__ */ (() => {
   return C;
 })();
 function parse5(header, options) {
-  const stopChar = options?.comma === true ? COMMA : 65536;
+  const stopChar = options?.comma === true ? COMMA2 : 65536;
   const len = header.length;
   let index = skipOWS(header, options?.start ?? 0, len);
   const valueStart = index;
@@ -187279,7 +188285,7 @@ var SEMI = 59;
 var EQ = 61;
 var DQUOTE = 34;
 var BSLASH = 92;
-var COMMA = 44;
+var COMMA2 = 44;
 function parseParameters(header, type2, index, len, stopChar) {
   const parameters = new NullObject();
   parameter: while (index < len) {
@@ -187738,7 +188744,7 @@ var defaults_default = {
     "user-agent": `octokit-request.js/${VERSION3} ${getUserAgent2()}`
   }
 };
-function isPlainObject7(value2) {
+function isPlainObject8(value2) {
   if (typeof value2 !== "object" || value2 === null) return false;
   if (Object.prototype.toString.call(value2) !== "[object Object]") return false;
   const proto = Object.getPrototypeOf(value2);
@@ -187756,7 +188762,7 @@ async function fetchWrapper(requestOptions) {
   }
   const log3 = requestOptions.request?.log || console;
   const parseSuccessResponseBody = requestOptions.request?.parseSuccessResponseBody !== false;
-  const body = isPlainObject7(requestOptions.body) || Array.isArray(requestOptions.body) ? JSONStringify(requestOptions.body) : requestOptions.body;
+  const body = isPlainObject8(requestOptions.body) || Array.isArray(requestOptions.body) ? JSONStringify(requestOptions.body) : requestOptions.body;
   const requestHeaders = Object.fromEntries(
     Object.entries(requestOptions.headers).map(([name, value2]) => [
       name,
@@ -191061,7 +192067,7 @@ function getGitHubUsageSummary() {
 }
 async function writeGitHubUsageSummaryToFile(path4) {
   const summary2 = getGitHubUsageSummary();
-  const tmpPath = join11(dirname3(path4), `.usage-summary-${process.pid}.tmp`);
+  const tmpPath = join12(dirname3(path4), `.usage-summary-${process.pid}.tmp`);
   await writeFile(tmpPath, JSON.stringify(summary2));
   await rename(tmpPath, path4);
 }
@@ -191168,531 +192174,6 @@ function resolveRepoCtx(ctx, repo) {
   };
 }
 
-// node_modules/.pnpm/@toon-format+toon@1.4.0/node_modules/@toon-format/toon/dist/index.mjs
-var LIST_ITEM_MARKER = "-";
-var LIST_ITEM_PREFIX = "- ";
-var COMMA2 = ",";
-var PIPE = "|";
-var DOT = ".";
-var NULL_LITERAL = "null";
-var TRUE_LITERAL = "true";
-var FALSE_LITERAL = "false";
-var BACKSLASH = "\\";
-var DOUBLE_QUOTE = '"';
-var TAB = "	";
-var DELIMITERS = {
-  comma: COMMA2,
-  tab: TAB,
-  pipe: PIPE
-};
-var DEFAULT_DELIMITER = DELIMITERS.comma;
-function escapeString(value2) {
-  return value2.replace(/\\/g, `${BACKSLASH}${BACKSLASH}`).replace(/"/g, `${BACKSLASH}${DOUBLE_QUOTE}`).replace(/\n/g, `${BACKSLASH}n`).replace(/\r/g, `${BACKSLASH}r`).replace(/\t/g, `${BACKSLASH}t`);
-}
-function isBooleanOrNullLiteral(token) {
-  return token === TRUE_LITERAL || token === FALSE_LITERAL || token === NULL_LITERAL;
-}
-function normalizeValue(value2) {
-  if (value2 === null) return null;
-  if (typeof value2 === "string" || typeof value2 === "boolean") return value2;
-  if (typeof value2 === "number") {
-    if (Object.is(value2, -0)) return 0;
-    if (!Number.isFinite(value2)) return null;
-    return value2;
-  }
-  if (typeof value2 === "bigint") {
-    if (value2 >= Number.MIN_SAFE_INTEGER && value2 <= Number.MAX_SAFE_INTEGER) return Number(value2);
-    return value2.toString();
-  }
-  if (value2 instanceof Date) return value2.toISOString();
-  if (Array.isArray(value2)) return value2.map(normalizeValue);
-  if (value2 instanceof Set) return Array.from(value2).map(normalizeValue);
-  if (value2 instanceof Map) return Object.fromEntries(Array.from(value2, ([k2, v]) => [String(k2), normalizeValue(v)]));
-  if (isPlainObject8(value2)) {
-    const normalized = {};
-    for (const key in value2) if (Object.prototype.hasOwnProperty.call(value2, key)) normalized[key] = normalizeValue(value2[key]);
-    return normalized;
-  }
-  return null;
-}
-function isJsonPrimitive(value2) {
-  return value2 === null || typeof value2 === "string" || typeof value2 === "number" || typeof value2 === "boolean";
-}
-function isJsonArray(value2) {
-  return Array.isArray(value2);
-}
-function isJsonObject4(value2) {
-  return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
-}
-function isEmptyObject2(value2) {
-  return Object.keys(value2).length === 0;
-}
-function isPlainObject8(value2) {
-  if (value2 === null || typeof value2 !== "object") return false;
-  const prototype = Object.getPrototypeOf(value2);
-  return prototype === null || prototype === Object.prototype;
-}
-function isArrayOfPrimitives(value2) {
-  return value2.length === 0 || value2.every((item) => isJsonPrimitive(item));
-}
-function isArrayOfArrays(value2) {
-  return value2.length === 0 || value2.every((item) => isJsonArray(item));
-}
-function isArrayOfObjects(value2) {
-  return value2.length === 0 || value2.every((item) => isJsonObject4(item));
-}
-function isValidUnquotedKey(key) {
-  return /^[A-Z_][\w.]*$/i.test(key);
-}
-function isIdentifierSegment(key) {
-  return /^[A-Z_]\w*$/i.test(key);
-}
-function isSafeUnquoted(value2, delimiter2 = DEFAULT_DELIMITER) {
-  if (!value2) return false;
-  if (value2 !== value2.trim()) return false;
-  if (isBooleanOrNullLiteral(value2) || isNumericLike(value2)) return false;
-  if (value2.includes(":")) return false;
-  if (value2.includes('"') || value2.includes("\\")) return false;
-  if (/[[\]{}]/.test(value2)) return false;
-  if (/[\n\r\t]/.test(value2)) return false;
-  if (value2.includes(delimiter2)) return false;
-  if (value2.startsWith(LIST_ITEM_MARKER)) return false;
-  return true;
-}
-function isNumericLike(value2) {
-  return /^-?\d+(?:\.\d+)?(?:e[+-]?\d+)?$/i.test(value2) || /^0\d+$/.test(value2);
-}
-var QUOTED_KEY_MARKER = Symbol("quotedKey");
-function tryFoldKeyChain(key, value2, siblings, options, rootLiteralKeys, pathPrefix, flattenDepth) {
-  if (options.keyFolding !== "safe") return;
-  if (!isJsonObject4(value2)) return;
-  const { segments, tail, leafValue } = collectSingleKeyChain(key, value2, flattenDepth ?? options.flattenDepth);
-  if (segments.length < 2) return;
-  if (!segments.every((seg) => isIdentifierSegment(seg))) return;
-  const foldedKey = buildFoldedKey(segments);
-  const absolutePath = pathPrefix ? `${pathPrefix}${DOT}${foldedKey}` : foldedKey;
-  if (siblings.includes(foldedKey)) return;
-  if (rootLiteralKeys && rootLiteralKeys.has(absolutePath)) return;
-  return {
-    foldedKey,
-    remainder: tail,
-    leafValue,
-    segmentCount: segments.length
-  };
-}
-function collectSingleKeyChain(startKey, startValue, maxDepth) {
-  const segments = [startKey];
-  let currentValue = startValue;
-  while (segments.length < maxDepth) {
-    if (!isJsonObject4(currentValue)) break;
-    const keys = Object.keys(currentValue);
-    if (keys.length !== 1) break;
-    const nextKey = keys[0];
-    const nextValue = currentValue[nextKey];
-    segments.push(nextKey);
-    currentValue = nextValue;
-  }
-  if (!isJsonObject4(currentValue) || isEmptyObject2(currentValue)) return {
-    segments,
-    tail: void 0,
-    leafValue: currentValue
-  };
-  return {
-    segments,
-    tail: currentValue,
-    leafValue: currentValue
-  };
-}
-function buildFoldedKey(segments) {
-  return segments.join(DOT);
-}
-function encodePrimitive(value2, delimiter2) {
-  if (value2 === null) return NULL_LITERAL;
-  if (typeof value2 === "boolean") return String(value2);
-  if (typeof value2 === "number") return String(value2);
-  return encodeStringLiteral(value2, delimiter2);
-}
-function encodeStringLiteral(value2, delimiter2 = DEFAULT_DELIMITER) {
-  if (isSafeUnquoted(value2, delimiter2)) return value2;
-  return `${DOUBLE_QUOTE}${escapeString(value2)}${DOUBLE_QUOTE}`;
-}
-function encodeKey(key) {
-  if (isValidUnquotedKey(key)) return key;
-  return `${DOUBLE_QUOTE}${escapeString(key)}${DOUBLE_QUOTE}`;
-}
-function encodeAndJoinPrimitives(values, delimiter2 = DEFAULT_DELIMITER) {
-  return values.map((v) => encodePrimitive(v, delimiter2)).join(delimiter2);
-}
-function formatHeader(length, options) {
-  const key = options?.key;
-  const fields = options?.fields;
-  const delimiter2 = options?.delimiter ?? COMMA2;
-  let header = "";
-  if (key) header += encodeKey(key);
-  header += `[${length}${delimiter2 !== DEFAULT_DELIMITER ? delimiter2 : ""}]`;
-  if (fields) {
-    const quotedFields = fields.map((f) => encodeKey(f));
-    header += `{${quotedFields.join(delimiter2)}}`;
-  }
-  header += ":";
-  return header;
-}
-function* encodeJsonValue(value2, options, depth) {
-  if (isJsonPrimitive(value2)) {
-    const encodedPrimitive = encodePrimitive(value2, options.delimiter);
-    if (encodedPrimitive !== "") yield encodedPrimitive;
-    return;
-  }
-  if (isJsonArray(value2)) yield* encodeArrayLines(void 0, value2, depth, options);
-  else if (isJsonObject4(value2)) yield* encodeObjectLines(value2, depth, options);
-}
-function* encodeObjectLines(value2, depth, options, rootLiteralKeys, pathPrefix, remainingDepth) {
-  const keys = Object.keys(value2);
-  if (depth === 0 && !rootLiteralKeys) rootLiteralKeys = new Set(keys.filter((k2) => k2.includes(".")));
-  const effectiveFlattenDepth = remainingDepth ?? options.flattenDepth;
-  for (const [key, val] of Object.entries(value2)) yield* encodeKeyValuePairLines(key, val, depth, options, keys, rootLiteralKeys, pathPrefix, effectiveFlattenDepth);
-}
-function* encodeKeyValuePairLines(key, value2, depth, options, siblings, rootLiteralKeys, pathPrefix, flattenDepth) {
-  const currentPath = pathPrefix ? `${pathPrefix}${DOT}${key}` : key;
-  const effectiveFlattenDepth = flattenDepth ?? options.flattenDepth;
-  if (options.keyFolding === "safe" && siblings) {
-    const foldResult = tryFoldKeyChain(key, value2, siblings, options, rootLiteralKeys, pathPrefix, effectiveFlattenDepth);
-    if (foldResult) {
-      const { foldedKey, remainder, leafValue, segmentCount } = foldResult;
-      const encodedFoldedKey = encodeKey(foldedKey);
-      if (remainder === void 0) {
-        if (isJsonPrimitive(leafValue)) {
-          yield indentedLine(depth, `${encodedFoldedKey}: ${encodePrimitive(leafValue, options.delimiter)}`, options.indent);
-          return;
-        } else if (isJsonArray(leafValue)) {
-          yield* encodeArrayLines(foldedKey, leafValue, depth, options);
-          return;
-        } else if (isJsonObject4(leafValue) && isEmptyObject2(leafValue)) {
-          yield indentedLine(depth, `${encodedFoldedKey}:`, options.indent);
-          return;
-        }
-      }
-      if (isJsonObject4(remainder)) {
-        yield indentedLine(depth, `${encodedFoldedKey}:`, options.indent);
-        const remainingDepth = effectiveFlattenDepth - segmentCount;
-        const foldedPath = pathPrefix ? `${pathPrefix}${DOT}${foldedKey}` : foldedKey;
-        yield* encodeObjectLines(remainder, depth + 1, options, rootLiteralKeys, foldedPath, remainingDepth);
-        return;
-      }
-    }
-  }
-  const encodedKey = encodeKey(key);
-  if (isJsonPrimitive(value2)) yield indentedLine(depth, `${encodedKey}: ${encodePrimitive(value2, options.delimiter)}`, options.indent);
-  else if (isJsonArray(value2)) yield* encodeArrayLines(key, value2, depth, options);
-  else if (isJsonObject4(value2)) {
-    yield indentedLine(depth, `${encodedKey}:`, options.indent);
-    if (!isEmptyObject2(value2)) yield* encodeObjectLines(value2, depth + 1, options, rootLiteralKeys, currentPath, effectiveFlattenDepth);
-  }
-}
-function* encodeArrayLines(key, value2, depth, options) {
-  if (value2.length === 0) {
-    yield indentedLine(depth, formatHeader(0, {
-      key,
-      delimiter: options.delimiter
-    }), options.indent);
-    return;
-  }
-  if (isArrayOfPrimitives(value2)) {
-    yield indentedLine(depth, encodeInlineArrayLine(value2, options.delimiter, key), options.indent);
-    return;
-  }
-  if (isArrayOfArrays(value2)) {
-    if (value2.every((arr) => isArrayOfPrimitives(arr))) {
-      yield* encodeArrayOfArraysAsListItemsLines(key, value2, depth, options);
-      return;
-    }
-  }
-  if (isArrayOfObjects(value2)) {
-    const header = extractTabularHeader(value2);
-    if (header) yield* encodeArrayOfObjectsAsTabularLines(key, value2, header, depth, options);
-    else yield* encodeMixedArrayAsListItemsLines(key, value2, depth, options);
-    return;
-  }
-  yield* encodeMixedArrayAsListItemsLines(key, value2, depth, options);
-}
-function* encodeArrayOfArraysAsListItemsLines(prefix, values, depth, options) {
-  yield indentedLine(depth, formatHeader(values.length, {
-    key: prefix,
-    delimiter: options.delimiter
-  }), options.indent);
-  for (const arr of values) if (isArrayOfPrimitives(arr)) {
-    const arrayLine = encodeInlineArrayLine(arr, options.delimiter);
-    yield indentedListItem(depth + 1, arrayLine, options.indent);
-  }
-}
-function encodeInlineArrayLine(values, delimiter2, prefix) {
-  const header = formatHeader(values.length, {
-    key: prefix,
-    delimiter: delimiter2
-  });
-  const joinedValue = encodeAndJoinPrimitives(values, delimiter2);
-  if (values.length === 0) return header;
-  return `${header} ${joinedValue}`;
-}
-function* encodeArrayOfObjectsAsTabularLines(prefix, rows, header, depth, options) {
-  yield indentedLine(depth, formatHeader(rows.length, {
-    key: prefix,
-    fields: header,
-    delimiter: options.delimiter
-  }), options.indent);
-  yield* writeTabularRowsLines(rows, header, depth + 1, options);
-}
-function extractTabularHeader(rows) {
-  if (rows.length === 0) return;
-  const firstRow = rows[0];
-  const firstKeys = Object.keys(firstRow);
-  if (firstKeys.length === 0) return;
-  if (isTabularArray(rows, firstKeys)) return firstKeys;
-}
-function isTabularArray(rows, header) {
-  for (const row of rows) {
-    if (Object.keys(row).length !== header.length) return false;
-    for (const key of header) {
-      if (!(key in row)) return false;
-      if (!isJsonPrimitive(row[key])) return false;
-    }
-  }
-  return true;
-}
-function* writeTabularRowsLines(rows, header, depth, options) {
-  for (const row of rows) yield indentedLine(depth, encodeAndJoinPrimitives(header.map((key) => row[key]), options.delimiter), options.indent);
-}
-function* encodeMixedArrayAsListItemsLines(prefix, items, depth, options) {
-  yield indentedLine(depth, formatHeader(items.length, {
-    key: prefix,
-    delimiter: options.delimiter
-  }), options.indent);
-  for (const item of items) yield* encodeListItemValueLines(item, depth + 1, options);
-}
-function* encodeObjectAsListItemLines(obj, depth, options) {
-  if (isEmptyObject2(obj)) {
-    yield indentedLine(depth, LIST_ITEM_MARKER, options.indent);
-    return;
-  }
-  const entries = Object.entries(obj);
-  if (entries.length === 1) {
-    const [key, value2] = entries[0];
-    if (isJsonArray(value2) && isArrayOfObjects(value2)) {
-      const header = extractTabularHeader(value2);
-      if (header) {
-        yield indentedListItem(depth, formatHeader(value2.length, {
-          key,
-          fields: header,
-          delimiter: options.delimiter
-        }), options.indent);
-        yield* writeTabularRowsLines(value2, header, depth + 1, options);
-        return;
-      }
-    }
-  }
-  yield indentedLine(depth, LIST_ITEM_MARKER, options.indent);
-  yield* encodeObjectLines(obj, depth + 1, options);
-}
-function* encodeListItemValueLines(value2, depth, options) {
-  if (isJsonPrimitive(value2)) yield indentedListItem(depth, encodePrimitive(value2, options.delimiter), options.indent);
-  else if (isJsonArray(value2)) if (isArrayOfPrimitives(value2)) yield indentedListItem(depth, encodeInlineArrayLine(value2, options.delimiter), options.indent);
-  else {
-    yield indentedListItem(depth, formatHeader(value2.length, { delimiter: options.delimiter }), options.indent);
-    for (const item of value2) yield* encodeListItemValueLines(item, depth + 1, options);
-  }
-  else if (isJsonObject4(value2)) yield* encodeObjectAsListItemLines(value2, depth, options);
-}
-function indentedLine(depth, content, indentSize) {
-  return " ".repeat(indentSize * depth) + content;
-}
-function indentedListItem(depth, content, indentSize) {
-  return indentedLine(depth, LIST_ITEM_PREFIX + content, indentSize);
-}
-function encode4(input2, options) {
-  return Array.from(encodeLines(input2, options)).join("\n");
-}
-function encodeLines(input2, options) {
-  return encodeJsonValue(normalizeValue(input2), resolveOptions(options), 0);
-}
-function resolveOptions(options) {
-  return {
-    indent: options?.indent ?? 2,
-    delimiter: options?.delimiter ?? DEFAULT_DELIMITER,
-    keyFolding: options?.keyFolding ?? "off",
-    flattenDepth: options?.flattenDepth ?? Number.POSITIVE_INFINITY
-  };
-}
-
-// mcp/geminiSanitizer.ts
-function parseStringEnumBranch(item) {
-  if (!item || typeof item !== "object") return null;
-  const record3 = item;
-  if (Array.isArray(record3.enum)) {
-    const strings = record3.enum.filter((v) => typeof v === "string");
-    return strings.length === record3.enum.length && strings.length > 0 ? { values: strings } : null;
-  }
-  if (typeof record3.const === "string") {
-    return { values: [record3.const] };
-  }
-  return null;
-}
-function collapseStringUnion(branches) {
-  const values = [];
-  for (const item of branches) {
-    const parsed2 = parseStringEnumBranch(item);
-    if (!parsed2) return null;
-    values.push(...parsed2.values);
-  }
-  if (values.length === 0) return null;
-  return { type: "string", enum: [...new Set(values)] };
-}
-function sanitizeForGemini(schema2) {
-  if (!schema2 || typeof schema2 !== "object") return schema2;
-  if (Array.isArray(schema2)) return schema2.map(sanitizeForGemini);
-  const source = schema2;
-  if (Array.isArray(source.enum) && typeof source.type !== "string") {
-    const allStrings = source.enum.every((v) => typeof v === "string");
-    if (allStrings) {
-      const result = { type: "string", enum: source.enum };
-      if (typeof source.description === "string") result.description = source.description;
-      return result;
-    }
-  }
-  for (const unionKey of ["anyOf", "oneOf"]) {
-    const branches = source[unionKey];
-    if (Array.isArray(branches) && branches.length > 0) {
-      const collapsed = collapseStringUnion(branches);
-      if (collapsed) {
-        const result = { ...collapsed };
-        if (typeof source.description === "string") result.description = source.description;
-        return result;
-      }
-    }
-  }
-  if (Array.isArray(source.anyOf) || Array.isArray(source.oneOf)) {
-    const result = {};
-    if (Array.isArray(source.anyOf)) result.anyOf = source.anyOf.map(sanitizeForGemini);
-    if (Array.isArray(source.oneOf)) result.oneOf = source.oneOf.map(sanitizeForGemini);
-    return result;
-  }
-  const sanitized = {};
-  for (const [key, value2] of Object.entries(source)) {
-    if (key === "$schema") continue;
-    if (key === "$defs") {
-      sanitized.definitions = sanitizeForGemini(value2);
-      continue;
-    }
-    sanitized[key] = sanitizeForGemini(value2);
-  }
-  return sanitized;
-}
-function wrapJsonSchemaProducer(producer) {
-  return new Proxy(producer, {
-    get(target, prop, receiver) {
-      const value2 = Reflect.get(target, prop, receiver);
-      if ((prop === "input" || prop === "output") && typeof value2 === "function") {
-        const fn2 = value2;
-        return (...args2) => sanitizeForGemini(fn2.apply(target, args2));
-      }
-      return value2;
-    }
-  });
-}
-function wrapStandard(standard) {
-  return new Proxy(standard, {
-    get(target, prop, receiver) {
-      if (prop === "jsonSchema") {
-        const value2 = Reflect.get(target, prop, receiver);
-        if (value2 && typeof value2 === "object") {
-          return wrapJsonSchemaProducer(value2);
-        }
-        return value2;
-      }
-      return Reflect.get(target, prop, receiver);
-    }
-  });
-}
-function wrapSchemaForGemini(schema2) {
-  return new Proxy(schema2, {
-    get(target, prop, receiver) {
-      if (prop === "~standard") {
-        const value2 = Reflect.get(target, prop, receiver);
-        if (value2 && typeof value2 === "object") {
-          return wrapStandard(value2);
-        }
-        return value2;
-      }
-      if (prop === "toJsonSchema") {
-        const method = Reflect.get(target, prop, receiver);
-        if (typeof method === "function") {
-          return () => sanitizeForGemini(method.call(target));
-        }
-        return method;
-      }
-      return Reflect.get(target, prop, receiver);
-    }
-  });
-}
-function sanitizeToolForGemini(tool2) {
-  if (!tool2.parameters) return tool2;
-  return { ...tool2, parameters: wrapSchemaForGemini(tool2.parameters) };
-}
-function isGeminiRouted(ctx) {
-  const effective = ctx.payload.proxyModel ?? ctx.resolvedModel ?? ctx.payload.model;
-  if (!effective) return true;
-  const normalized = effective.toLowerCase();
-  if (normalized.includes("gemini")) return true;
-  if (!normalized.includes("/")) return true;
-  return false;
-}
-
-// mcp/shared.ts
-function getHttpStatus(err) {
-  if (typeof err !== "object" || err === null || !("status" in err)) return void 0;
-  return typeof err.status === "number" ? err.status : void 0;
-}
-var tool = (toolDef) => toolDef;
-var handleToolSuccess = (data) => {
-  const text = typeof data === "string" ? data : encode4(data);
-  return {
-    content: [{ type: "text", text }]
-  };
-};
-var handleToolError = (error62) => {
-  const errorMessage = error62 instanceof Error ? error62.message : String(error62);
-  return {
-    content: [
-      {
-        type: "text",
-        text: `Error: ${errorMessage}`
-      }
-    ],
-    isError: true
-  };
-};
-var execute = (fn2, toolName) => {
-  const _fn = async (params) => {
-    try {
-      const result = await fn2(params);
-      return handleToolSuccess(result);
-    } catch (error62) {
-      const errorMessage = error62 instanceof Error ? error62.message : String(error62);
-      const prefix = toolName ? `[${toolName}]` : "tool";
-      log.info(`${prefix} error: ${errorMessage}`);
-      log.debug(`${prefix} params: ${formatJsonValue(params)}`);
-      return handleToolError(error62);
-    }
-  };
-  return _fn;
-};
-var addTools = (ctx, server, tools) => {
-  const shouldSanitize = isGeminiRouted(ctx);
-  for (const tool2 of tools) {
-    server.addTool(shouldSanitize ? sanitizeToolForGemini(tool2) : tool2);
-  }
-  return server;
-};
-
 // mcp/git.ts
 function getPushDestination(branch, storedDest, cwd) {
   if (storedDest && storedDest.localBranch === branch) {
@@ -191818,7 +192299,8 @@ async function runPrepushHook(ctx, retryTool) {
   if (!ctx.prepushScript) return false;
   const prepushHook = await executeLifecycleHook({
     event: "prepush",
-    script: ctx.prepushScript
+    script: ctx.prepushScript,
+    shell: ctx.payload.shell
   });
   if (prepushHook.failure) {
     ctx.toolState.prepushFailureCount += 1;
@@ -192213,8 +192695,8 @@ function countAhead(head, base, cwd) {
 function spillGitOutput(params) {
   const tempDir = process.env.PULLFROG_TEMP_DIR;
   if (!tempDir) throw new Error("PULLFROG_TEMP_DIR not set");
-  const outputPath = join12(tempDir, `git-${params.command}-${randomUUID3().slice(0, 8)}.txt`);
-  writeFileSync8(outputPath, params.output);
+  const outputPath = join13(tempDir, `git-${params.command}-${randomUUID4().slice(0, 8)}.txt`);
+  writeFileSync9(outputPath, params.output);
   const previewByLines = params.output.split("\n").slice(0, OVERFLOW_PREVIEW_LINES).join("\n");
   const preview = previewByLines.length <= OVERFLOW_PREVIEW_MAX_CHARS ? previewByLines : `${previewByLines.slice(0, OVERFLOW_PREVIEW_MAX_CHARS)}\u2026`;
   log.info(
@@ -193740,9 +194222,9 @@ async function reportReviewNodeId(ctx, params) {
 import { execFileSync as execFileSync6, execSync as execSync2 } from "node:child_process";
 import { mkdtempSync, readdirSync, realpathSync as realpathSync2, unlinkSync as unlinkSync2 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 function createTempDirectory() {
-  const sharedTempDir = mkdtempSync(join13(tmpdir2(), "pullfrog-"));
+  const sharedTempDir = mkdtempSync(join14(tmpdir2(), "pullfrog-"));
   process.env.PULLFROG_TEMP_DIR = sharedTempDir;
   log.info(`\xBB created temp dir at ${sharedTempDir}`);
   return sharedTempDir;
@@ -193787,13 +194269,13 @@ function wipeRunnerLeakSurface() {
       return [];
     }
   };
-  const fileCommandsDir = join13(runnerTemp, "_runner_file_commands");
+  const fileCommandsDir = join14(runnerTemp, "_runner_file_commands");
   for (const entry of listDir(fileCommandsDir)) {
-    tryUnlink(join13(fileCommandsDir, entry));
+    tryUnlink(join14(fileCommandsDir, entry));
   }
   for (const entry of listDir(runnerTemp)) {
     if (entry.endsWith(".sh") || /^git-credentials-.*\.config$/.test(entry)) {
-      tryUnlink(join13(runnerTemp, entry));
+      tryUnlink(join14(runnerTemp, entry));
     }
   }
   if (wiped.length > 0) {
@@ -194268,6 +194750,7 @@ async function checkoutPrBranch(pr, params) {
   const postCheckoutHook = await executeLifecycleHook({
     event: "post-checkout",
     script: params.postCheckoutScript,
+    shell: params.shell,
     normalizeWorkingTreeAfter: true
   });
   return { hookWarning: postCheckoutHook.warning };
@@ -194349,11 +194832,11 @@ function CheckoutPrTool(ctx) {
         headSha: checkoutSha
       });
       if (incremental.status === "ok") {
-        incrementalDiffPath = join14(
+        incrementalDiffPath = join15(
           tempDir,
           `pr-${pull_number}-${beforeShort}-${headShort}-incremental.diff`
         );
-        writeFileSync9(incrementalDiffPath, incremental.diff);
+        writeFileSync10(incrementalDiffPath, incremental.diff);
         log.info(
           `\xBB incremental diff computed (${incremental.diff.length} bytes) \u2192 ${incrementalDiffPath}`
         );
@@ -194366,8 +194849,8 @@ function CheckoutPrTool(ctx) {
     const diffPreview = formatResult.content.split("\n").slice(0, 100).join("\n");
     log.debug(`formatted diff preview (first 100 lines):
 ${diffPreview}`);
-    const diffPath = join14(tempDir, `pr-${pull_number}-${headShort}.diff`);
-    writeFileSync9(diffPath, formatResult.content);
+    const diffPath = join15(tempDir, `pr-${pull_number}-${headShort}.diff`);
+    writeFileSync10(diffPath, formatResult.content);
     log.debug(`wrote diff to ${diffPath} (${formatResult.content.length} bytes)`);
     primary.diffCoverage = createDiffCoverageState({
       diffPath,
@@ -194524,8 +195007,8 @@ ${dirty}`
 }
 
 // mcp/checkSuite.ts
-import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join15 } from "node:path";
+import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join16 } from "node:path";
 var GetCheckSuiteLogs = type({
   check_suite_id: type.number.describe("the id from check_suite.id")
 });
@@ -194621,7 +195104,7 @@ function GetCheckSuiteLogsTool(ctx) {
       if (!tempDir) {
         throw new Error("PULLFROG_TEMP_DIR not set");
       }
-      const logsDir = join15(tempDir, "ci-logs");
+      const logsDir = join16(tempDir, "ci-logs");
       mkdirSync8(logsDir, { recursive: true });
       const jobResults = [];
       for (const run of failedRuns) {
@@ -194648,8 +195131,8 @@ function GetCheckSuiteLogsTool(ctx) {
               );
             }
             const logsText = await logsResult.text();
-            const logPath = join15(logsDir, `job-${job.id}.log`);
-            writeFileSync10(logPath, logsText);
+            const logPath = join16(logsDir, `job-${job.id}.log`);
+            writeFileSync11(logPath, logsText);
             const analysis = analyzeLog(logsText, 80);
             const failedSteps = job.steps?.filter((s) => s.conclusion === "failure").map((s) => `Step ${s.number}: ${s.name}`) ?? [];
             jobResults.push({
@@ -194697,8 +195180,8 @@ function GetCheckSuiteLogsTool(ctx) {
 }
 
 // mcp/commitInfo.ts
-import { writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join16 } from "node:path";
+import { writeFileSync as writeFileSync12 } from "node:fs";
+import { join as join17 } from "node:path";
 var CommitInfo = type({
   sha: type.string.describe("the commit SHA (full or abbreviated) to fetch")
 });
@@ -194722,8 +195205,8 @@ function CommitInfoTool(ctx) {
           "PULLFROG_TEMP_DIR not set - get_commit_info must run in pullfrog action context"
         );
       }
-      const diffFile = join16(tempDir, `commit-${sha.slice(0, 7)}.diff`);
-      writeFileSync11(diffFile, formatResult.content);
+      const diffFile = join17(tempDir, `commit-${sha.slice(0, 7)}.diff`);
+      writeFileSync12(diffFile, formatResult.content);
       log.debug(`wrote commit diff to ${diffFile} (${formatResult.content.length} bytes)`);
       return {
         sha: data.sha,
@@ -194860,13 +195343,13 @@ import { performance as performance9 } from "node:perf_hooks";
 
 // prep/installNodeDependencies.ts
 import { existsSync as existsSync8 } from "node:fs";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 
 // utils/packageManager.ts
 var import_semver2 = __toESM(require_semver2(), 1);
 import { existsSync as existsSync7 } from "node:fs";
 import { mkdir, readFile as readFile2 } from "node:fs/promises";
-import { delimiter, join as join17 } from "node:path";
+import { delimiter, join as join18 } from "node:path";
 var SUPPORTED_NAMES = ["npm", "pnpm", "yarn", "bun"];
 var COREPACK_MANAGED = ["pnpm", "yarn"];
 function isSupported(name) {
@@ -194904,7 +195387,7 @@ function parseDevEnginesField(field) {
   };
 }
 async function resolvePackageManagerSpec(cwd) {
-  const pkgPath = join17(cwd, "package.json");
+  const pkgPath = join18(cwd, "package.json");
   if (!existsSync7(pkgPath)) return null;
   let pkg;
   try {
@@ -194963,7 +195446,7 @@ async function currentVersion(name) {
   return result.stdout.trim();
 }
 function packageManagerBinDir(tmpdir3) {
-  return join17(tmpdir3, "pm-bin");
+  return join18(tmpdir3, "pm-bin");
 }
 async function ensurePackageManager(params) {
   const spec = params.spec;
@@ -195026,7 +195509,7 @@ async function installFallback(name, installSpec) {
   });
   if (result.exitCode !== 0) return result.stderr || `failed to install ${name}`;
   if (name === "deno") {
-    const denoPath = join17(process.env.HOME || "", ".deno", "bin");
+    const denoPath = join18(process.env.HOME || "", ".deno", "bin");
     process.env.PATH = `${denoPath}:${process.env.PATH}`;
   }
   log.info(`\xBB installed ${name}`);
@@ -195059,7 +195542,7 @@ async function isCommandAvailable2(command) {
 var installNodeDependencies = {
   name: "installNodeDependencies",
   shouldRun: () => {
-    const packageJsonPath = join18(process.cwd(), "package.json");
+    const packageJsonPath = join19(process.cwd(), "package.json");
     return existsSync8(packageJsonPath);
   },
   run: async (options) => {
@@ -195155,12 +195638,12 @@ ${errorMessage}`]
 
 // prep/installPythonDependencies.ts
 import { existsSync as existsSync9, readFileSync as readFileSync5 } from "node:fs";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 function declaresBuildSystem(path4) {
   return /^\s*\[\s*build-system\s*\]/m.test(readFileSync5(path4, "utf8"));
 }
 function configApplies(config3, cwd) {
-  const path4 = join19(cwd, config3.file);
+  const path4 = join20(cwd, config3.file);
   return existsSync9(path4) && (config3.applies?.(path4) ?? true);
 }
 var PYTHON_CONFIGS = [
@@ -195484,411 +195967,6 @@ function AwaitDependencyInstallationTool(ctx) {
 // mcp/gh.ts
 import { mkdirSync as mkdirSync9 } from "node:fs";
 import { join as join21 } from "node:path";
-
-// mcp/shell.ts
-import { spawn as spawn3, spawnSync as spawnSync6 } from "node:child_process";
-import { randomUUID as randomUUID4 } from "node:crypto";
-import { closeSync, openSync, writeFileSync as writeFileSync12 } from "node:fs";
-import { userInfo as userInfo2 } from "node:os";
-import { join as join20 } from "node:path";
-import { setTimeout as sleep3 } from "node:timers/promises";
-var ShellParams = type({
-  command: "string",
-  // advisory and unread — no code path consumes it. kept in the schema only
-  // because it nudges the model to state intent before running a command;
-  // REQUIRING it cost a full rejected turn every time one was omitted. #1140.
-  "description?": "string",
-  "timeout?": type.number.describe(
-    "Timeout in MILLISECONDS (not seconds). Default 30000 (30s), max 120000 (2m). e.g. timeout: 180000 for 3 minutes; timeout: 180 means 180ms and will kill the process almost immediately."
-  ),
-  "working_directory?": "string",
-  "background?": "boolean"
-});
-var detectedSandboxMethod;
-var usernsProbeError;
-function getSandboxMethod() {
-  return detectSandboxMethod();
-}
-function detectSandboxMethod() {
-  if (detectedSandboxMethod !== void 0) {
-    return detectedSandboxMethod;
-  }
-  if (process.env.CI !== "true") {
-    detectedSandboxMethod = "none";
-    log.debug("sandbox disabled (CI !== true)");
-    return "none";
-  }
-  try {
-    const result = spawnSync6("unshare", ["--pid", "--fork", "--mount-proc", "true"], {
-      timeout: 5e3,
-      stdio: "ignore"
-    });
-    if (result.status === 0) {
-      detectedSandboxMethod = "unshare";
-      log.debug("PID namespace isolation enabled (unprivileged unshare)");
-      return "unshare";
-    }
-  } catch {
-  }
-  try {
-    const result = spawnSync6("sudo", ["unshare", "--pid", "--fork", "--mount-proc", "true"], {
-      timeout: 5e3,
-      stdio: "ignore"
-    });
-    if (result.status === 0) {
-      detectedSandboxMethod = "sudo-unshare";
-      log.debug("PID namespace isolation enabled (sudo unshare)");
-      return "sudo-unshare";
-    }
-  } catch {
-  }
-  try {
-    const result = spawnSync6(
-      "unshare",
-      [
-        "--user",
-        "--map-root-user",
-        "--pid",
-        "--fork",
-        "--mount",
-        "setpriv",
-        "--no-new-privs",
-        "--bounding-set",
-        "-all",
-        "--inh-caps",
-        "-all",
-        "--ambient-caps",
-        "-all",
-        "true"
-      ],
-      { timeout: 5e3, stdio: ["ignore", "ignore", "pipe"] }
-    );
-    if (result.status === 0) {
-      detectedSandboxMethod = "userns-unshare";
-      log.debug("PID namespace isolation enabled (unprivileged userns unshare)");
-      return "userns-unshare";
-    }
-    usernsProbeError = result.stderr?.toString().trim() || result.error?.message;
-  } catch {
-  }
-  detectedSandboxMethod = "none";
-  log.info("PID namespace isolation not available");
-  return "none";
-}
-var PROC_CLEANUP = "umount /proc 2>/dev/null; umount /proc 2>/dev/null; mount -t proc proc /proc 2>/dev/null;";
-var SOCKET_CLEANUP = [
-  "/var/run/docker.sock",
-  "/run/docker.sock",
-  "/var/run/podman/podman.sock",
-  "/run/podman/podman.sock",
-  "/run/containerd/containerd.sock",
-  "/var/run/crio/crio.sock"
-].map((path4) => `mount --bind /dev/null ${path4} 2>/dev/null;`).join(" ");
-function buildFsMounts(repoDir) {
-  const escaped = repoDir.replace(/'/g, "'\\''");
-  return [
-    `mkdir -p /var/lib/pullfrog 2>/dev/null;`,
-    `mount -t tmpfs tmpfs /var/lib/pullfrog 2>/dev/null;`,
-    `[ -n "$RUNNER_TEMP" ] && [ -d "$RUNNER_TEMP/_runner_file_commands" ] && mount -t tmpfs tmpfs "$RUNNER_TEMP/_runner_file_commands" 2>/dev/null;`,
-    `[ -e '${escaped}/.git' ] && mount --bind '${escaped}/.git' '${escaped}/.git' 2>/dev/null && mount -o remount,bind,ro '${escaped}/.git' 2>/dev/null;`
-  ].join(" ");
-}
-var _repoRoot;
-function resolveRepoRoot() {
-  if (_repoRoot) return _repoRoot;
-  const fromEnv = process.env.GITHUB_WORKSPACE;
-  if (fromEnv) {
-    _repoRoot = fromEnv;
-    return _repoRoot;
-  }
-  try {
-    _repoRoot = spawnSync6("git", ["rev-parse", "--show-toplevel"], {
-      cwd: process.cwd(),
-      stdio: ["ignore", "pipe", "ignore"],
-      encoding: "utf-8"
-    }).stdout?.trim();
-  } catch {
-  }
-  if (!_repoRoot) _repoRoot = process.cwd();
-  return _repoRoot;
-}
-function spawnShell(params) {
-  const spawnOpts = { env: params.env, cwd: params.cwd, stdio: params.stdio, detached: true };
-  const sandboxMethod = detectSandboxMethod();
-  const ci = process.env.CI === "true";
-  if (ci && sandboxMethod === "none") {
-    throw new Error(
-      "PID-namespace isolation is required in CI but unavailable: unprivileged unshare, sudo unshare, and userns-nested unshare all failed. " + (usernsProbeError ? `userns probe said: ${usernsProbeError}. ` : "") + "on a containerized / Kubernetes self-hosted runner the cause is usually one of: the pod's seccomp profile blocks user-namespace creation (Pod Security Standards baseline/restricted); the pod runs as root without CAP_SETFCAP, which the kernel requires to map uid 0; or the node kernel disallows unprivileged user namespaces (Ubuntu >= 23.10, Bottlerocket, Talos). elsewhere, check that `unshare` and `setpriv` (util-linux >= 2.31, which is what added --ambient-caps) are on PATH. see https://docs.pullfrog.com/security#self-hosted-runners"
-    );
-  }
-  const repoRoot = resolveRepoRoot();
-  const fsMounts = buildFsMounts(repoRoot);
-  if (sandboxMethod === "unshare") {
-    return spawn3(
-      "unshare",
-      [
-        "--pid",
-        "--fork",
-        "--mount-proc",
-        "bash",
-        "-c",
-        `${PROC_CLEANUP} ${SOCKET_CLEANUP} ${fsMounts} ${params.command}`
-      ],
-      spawnOpts
-    );
-  }
-  if (sandboxMethod === "userns-unshare") {
-    const escaped = params.command.replace(/'/g, "'\\''");
-    return spawn3(
-      "unshare",
-      [
-        "--user",
-        "--map-root-user",
-        "--pid",
-        "--fork",
-        "--mount",
-        "bash",
-        "-c",
-        `${PROC_CLEANUP} ${SOCKET_CLEANUP} ${fsMounts} exec setpriv --no-new-privs --bounding-set -all --inh-caps -all --ambient-caps -all bash -c '${escaped}'`
-      ],
-      spawnOpts
-    );
-  }
-  if (sandboxMethod === "sudo-unshare") {
-    const envArgs = [];
-    for (const [k2, v] of Object.entries(params.env)) {
-      if (v !== void 0) {
-        envArgs.push(`${k2}=${v}`);
-      }
-    }
-    const username = userInfo2().username;
-    const pathRestore = 'export PATH="${SANDBOX_PATH:-$PATH}"; ';
-    const escaped = (pathRestore + params.command).replace(/'/g, "'\\''");
-    envArgs.push(`SANDBOX_PATH=${params.env.PATH ?? ""}`);
-    return spawn3(
-      "sudo",
-      [
-        "env",
-        ...envArgs,
-        "unshare",
-        "--pid",
-        "--fork",
-        "--mount-proc",
-        "bash",
-        "-c",
-        `${PROC_CLEANUP} ${SOCKET_CLEANUP} ${fsMounts} exec su -p -s /bin/bash ${username} -c '${escaped}'`
-      ],
-      { ...spawnOpts, env: {} }
-    );
-  }
-  return spawn3("bash", ["-c", params.command], spawnOpts);
-}
-async function killProcessGroup(proc) {
-  if (!proc.pid) return;
-  try {
-    process.kill(-proc.pid, "SIGTERM");
-    await new Promise((r) => setTimeout(r, 200));
-    process.kill(-proc.pid, "SIGKILL");
-  } catch {
-    try {
-      proc.kill("SIGKILL");
-    } catch {
-    }
-  }
-}
-function getTempDir() {
-  const tempDir = process.env.PULLFROG_TEMP_DIR;
-  if (!tempDir) {
-    throw new Error("PULLFROG_TEMP_DIR not set");
-  }
-  return tempDir;
-}
-var MAX_OUTPUT_CHARS = 5e3;
-async function runSandboxed(params) {
-  const proc = spawnShell({
-    command: params.command,
-    env: params.env,
-    cwd: params.cwd,
-    stdio: ["ignore", "pipe", "pipe"]
-  });
-  const stdout = new TailBuffer(DEFAULT_MAX_RETAINED_BYTES);
-  const stderr = new TailBuffer(DEFAULT_MAX_RETAINED_BYTES);
-  let timedOut = false, exited = false, spawnError = "";
-  proc.stdout?.on("data", (chunk) => {
-    stdout.append(chunk.toString());
-  });
-  proc.stderr?.on("data", (chunk) => {
-    stderr.append(chunk.toString());
-  });
-  const timeoutId = setTimeout(async () => {
-    if (!exited) {
-      timedOut = true;
-      await killProcessGroup(proc);
-    }
-  }, params.timeout);
-  const exitCode = await new Promise((resolve3) => {
-    const done = (code) => {
-      exited = true;
-      clearTimeout(timeoutId);
-      resolve3(code);
-    };
-    proc.on("exit", done);
-    proc.on("error", (err) => {
-      spawnError = err.message;
-      done(null);
-    });
-  });
-  proc.stdout?.destroy();
-  proc.stderr?.destroy();
-  const outText = stdout.toString();
-  const errText = stderr.toString();
-  let output2 = errText ? outText ? `${outText}
-${errText}` : errText : outText;
-  if (spawnError) output2 = output2 ? `${output2}
-${spawnError}` : spawnError;
-  if (timedOut)
-    output2 = output2 ? `${output2}
-[timed out after ${params.timeout}ms]` : `[timed out after ${params.timeout}ms]`;
-  return {
-    output: output2.trim(),
-    exitCode: exitCode ?? (timedOut ? 124 : -1),
-    timedOut
-  };
-}
-function capOutput(output2) {
-  if (output2.length <= MAX_OUTPUT_CHARS) return output2;
-  const fullPath = join20(getTempDir(), `shell-${randomUUID4().slice(0, 8)}.log`);
-  writeFileSync12(fullPath, output2);
-  const elided = output2.length - MAX_OUTPUT_CHARS;
-  return `... [${elided} chars truncated; output saved to ${fullPath}] ...
-${output2.slice(-MAX_OUTPUT_CHARS)}`;
-}
-function isGitCommand(command) {
-  const trimmed = command.trim();
-  if (trimmed === "git" || trimmed.startsWith("git ")) return true;
-  if (trimmed.startsWith("sudo git")) return true;
-  return /[;&|]\s*(?:sudo\s+)?git(?:\s|$)/.test(trimmed);
-}
-function ShellTool(ctx) {
-  return tool({
-    name: "shell",
-    timeoutMs: 12e4,
-    description: `Execute shell commands securely. Environment is filtered to remove API keys and secrets.
-
-Example: \`shell({ command: "pnpm test", description: "run the test suite" })\`.
-
-Use this tool to:
-- Run shell commands (ls, cat, grep, find, etc.)
-- Execute build tools (npm, pnpm, cargo, make, etc.)
-- Run tests and linters
-
-Output is capped at ${MAX_OUTPUT_CHARS} chars: if exceeded, only the tail is returned and the captured output is saved to a tempfile (path included in the response). Re-read the tempfile with cat/tail/grep when you need more.
-
-Do NOT use this tool for git commands \u2014 use the dedicated git tools instead.`,
-    parameters: ShellParams,
-    execute: execute(async (params) => {
-      if (isGitCommand(params.command)) {
-        throw new Error(
-          'git commands are not allowed in the shell tool. use the dedicated git tools instead:\n- git: local operations, e.g. git({ command: "log", args: ["--oneline"] }) \u2014 `command` is the subcommand ONLY\n- push_branch: push to remote (handles authentication)\n- git_fetch: fetch from remote (handles authentication)\n- checkout_pr: check out PR branches'
-        );
-      }
-      const timeout = Math.min(params.timeout ?? 3e4, 12e4);
-      const cwd = params.working_directory ?? process.cwd();
-      const env2 = resolveEnv(ctx.payload.shell === "enabled" ? "inherit" : "restricted");
-      if (params.command.includes("agent-browser")) {
-        const daemonError = ensureBrowserDaemon(ctx.toolState);
-        if (daemonError) {
-          return {
-            output: `browser daemon unavailable: ${daemonError}`,
-            exit_code: 1,
-            timed_out: false
-          };
-        }
-        const binDir = ctx.toolState.browserDaemon?.binDir;
-        if (binDir) {
-          env2.PATH = `${binDir}:${env2.PATH ?? ""}`;
-        }
-      }
-      if (params.background) {
-        const tempDir = getTempDir();
-        const handle = `bg-${randomUUID4().slice(0, 8)}`;
-        const outputPath = join20(tempDir, `${handle}.log`);
-        const pidPath = join20(tempDir, `${handle}.pid`);
-        const logFd = openSync(outputPath, "a");
-        let proc;
-        try {
-          proc = spawnShell({
-            command: params.command,
-            env: env2,
-            cwd,
-            stdio: ["ignore", logFd, logFd]
-          });
-        } finally {
-          closeSync(logFd);
-        }
-        if (!proc.pid) {
-          throw new Error("failed to start background process");
-        }
-        proc.unref();
-        writeFileSync12(pidPath, `${proc.pid}
-`);
-        ctx.toolState.backgroundProcesses.set(handle, { pid: proc.pid, outputPath, pidPath });
-        return {
-          handle,
-          outputPath,
-          pidPath,
-          message: `started background process ${handle} (pid ${proc.pid})`
-        };
-      }
-      const result = await runSandboxed({ command: params.command, env: env2, cwd, timeout });
-      if (result.exitCode !== 0) {
-        log.info(`shell command failed with exit code ${result.exitCode}: ${params.command}`);
-        if (result.output) log.info(`output: ${result.output}`);
-      }
-      return {
-        output: capOutput(result.output),
-        exit_code: result.exitCode,
-        timed_out: result.timedOut
-      };
-    })
-  });
-}
-var KillBackgroundParams = type({
-  handle: type.string.describe("The handle of the background process to kill (e.g., bg-a1b2c3d4)")
-});
-function KillBackgroundTool(ctx) {
-  return tool({
-    name: "kill_background",
-    mutates: true,
-    description: `Kill a background process by its handle. Use this to stop dev servers or other long-running processes started with shell({ background: true }).`,
-    parameters: KillBackgroundParams,
-    execute: execute(async (params) => {
-      const proc = ctx.toolState.backgroundProcesses.get(params.handle);
-      if (!proc) {
-        return {
-          success: false,
-          message: `no background process with handle ${params.handle}`
-        };
-      }
-      try {
-        process.kill(-proc.pid, "SIGTERM");
-      } catch {
-      }
-      await sleep3(200);
-      try {
-        process.kill(-proc.pid, "SIGKILL");
-      } catch {
-      }
-      ctx.toolState.backgroundProcesses.delete(params.handle);
-      return {
-        success: true,
-        message: `killed background process ${params.handle} (pid ${proc.pid})`
-      };
-    })
-  });
-}
-
-// mcp/gh.ts
 var GH_TIMEOUT_MS = 12e4;
 var GhParams = type({
   args: type.string.array().describe(
@@ -197139,7 +197217,7 @@ function GetReviewCommentsTool(ctx) {
         threadCount: threadBlocks.length,
         commentsPath,
         toc: formatted.toc,
-        instructions: `the file at commentsPath contains ${threadBlocks.length} review threads with full conversation history. comments marked with * are from the target review (${params.review_id}); any other thread is open feedback on this PR that is also yours to address, including comments that landed after this run started. the TOC shows each thread's file:line and the line number where it appears in the file. to read a specific thread, use: grep -A 50 "^## <file:line>" ${commentsPath} (replace <file:line> with the path from the TOC, e.g. "^## action/utils/foo.ts:42"). address each thread in order, working through one file at a time.`
+        instructions: `the file at commentsPath contains ${threadBlocks.length} review threads with full conversation history. comments marked with * are from the target review (${params.review_id}); any other thread is open feedback on this PR, including comments that landed after this run started. Being returned does not authorize a code change; follow the task's scope and each thread's latest request. the TOC shows each thread's file:line and the line number where it appears in the file. to read a specific thread, use: grep -A 50 "^## <file:line>" ${commentsPath} (replace <file:line> with the path from the TOC, e.g. "^## action/utils/foo.ts:42"). read each full thread before deciding whether it calls for a reply or a code change.`
       };
     })
   });
@@ -197262,8 +197340,7 @@ An existing plan comment was found for this issue. Update that comment with the
   };
 }
 var modeInstructionParent = {
-  IncrementalReview: "Review",
-  Fix: "Build"
+  IncrementalReview: "Review"
 };
 function buildOrchestratorGuidance(ctx, mode, overrideGuidance) {
   const hardcoded = overrideGuidance ?? mode.prompt ?? "";
@@ -198475,18 +198552,13 @@ function hasEnvVar4(name) {
   const value2 = process.env[name];
   return typeof value2 === "string" && value2.length > 0;
 }
-var HOST_OVERRIDES = {
-  ANTHROPIC_API_KEY: "ANTHROPIC_BASE_URL",
-  CLAUDE_CODE_OAUTH_TOKEN: "ANTHROPIC_BASE_URL"
-};
 function envVarsFor(model) {
   return model.includes("/") ? getModelEnvVars(model) : [];
 }
 async function checkOne(params) {
   const value2 = process.env[params.envVar];
   if (!value2) return null;
-  const hostOverride = HOST_OVERRIDES[params.envVar];
-  if (hostOverride && hasEnvVar4(hostOverride)) return null;
+  if (getProviderGatewayUrl(params.model)) return null;
   if (params.envVar === "CLAUDE_CODE_OAUTH_TOKEN") {
     const preflight = await preflightClaudeSubscription({
       token: value2,
@@ -201687,6 +201759,7 @@ async function main() {
         const setupHook = await executeLifecycleHook({
           event: "setup",
           script: runContext.repoSettings.setupScript,
+          shell: payload.shell,
           normalizeWorkingTreeAfter: true
         });
         if (setupHook.warning) {