pullfrog 0.1.96 → 0.1.98

package/dist/index.js

@@ -98088,14 +98088,14 @@ var require_turndown_cjs = __commonJS({
         } else if (node2.nodeType === 1) {
           replacement = replacementForNode.call(self2, node2);
         }
-        return join28(output, replacement);
+        return join29(output, replacement);
       }, "");
     }
     function postProcess(output) {
       var self2 = this;
       this.rules.forEach(function(rule) {
         if (typeof rule.append === "function") {
-          output = join28(output, rule.append(self2.options));
+          output = join29(output, rule.append(self2.options));
         }
       });
       return output.replace(/^[\t\r\n]+/, "").replace(/[\t\r\n\s]+$/, "");
@@ -98107,7 +98107,7 @@ var require_turndown_cjs = __commonJS({
       if (whitespace.leading || whitespace.trailing) content = content.trim();
       return whitespace.leading + rule.replacement(content, node2, this.options) + whitespace.trailing;
     }
-    function join28(output, replacement) {
+    function join29(output, replacement) {
       var s1 = trimTrailingNewlines(output);
       var s2 = trimLeadingNewlines(replacement);
       var nls = Math.max(output.length - s1.length, replacement.length - s2.length);
@@ -102898,9 +102898,9 @@ var init_file_type = __esm({
 });
 
 // main.ts
-import { existsSync as existsSync10, readdirSync as readdirSync2 } from "node:fs";
+import { existsSync as existsSync11, readdirSync as readdirSync2 } from "node:fs";
 import { readFile as readFile5 } from "node:fs/promises";
-import { join as join27 } from "node:path";
+import { join as join28 } from "node:path";
 
 // node_modules/.pnpm/package-manager-detector@1.8.0/node_modules/package-manager-detector/dist/commands.mjs
 function splitRunArgs(args2, valueFlags = []) {
@@ -103333,8 +103333,9 @@ var providers = {
       },
       "claude-haiku": {
         displayName: "Claude Haiku",
-        resolve: "anthropic/claude-haiku-4-5",
-        openRouterResolve: "openrouter/anthropic/claude-haiku-4.5"
+        resolve: "anthropic/claude-haiku-5-5",
+        effort: ["low", "medium", "high", "xhigh", "max"],
+        openRouterResolve: "openrouter/anthropic/claude-haiku-5.5"
       }
     }
   }),
@@ -103752,8 +103753,9 @@ var providers = {
       },
       "claude-haiku": {
         displayName: "Claude Haiku",
-        resolve: "opencode/claude-haiku-4-5",
-        openRouterResolve: "openrouter/anthropic/claude-haiku-4.5"
+        resolve: "opencode/claude-haiku-5-5",
+        effort: ["low", "medium", "high", "xhigh", "max"],
+        openRouterResolve: "openrouter/anthropic/claude-haiku-5.5"
       },
       "gpt-sol": {
         displayName: "GPT Sol",
@@ -103909,6 +103911,14 @@ var providers = {
         openRouterEffort: [],
         openRouterResolve: "openrouter/qwen/qwen3.8-flash"
       },
+      // Zen lists Mistral Large 4 at half its list price for launch, level with
+      // the routers.
+      "mistral-large": {
+        displayName: "Mistral Large",
+        resolve: "opencode/mistral-large-4",
+        effort: ["none", "high"],
+        openRouterResolve: "openrouter/mistralai/mistral-large-4-0"
+      },
       "gpt-5-nano": {
         displayName: "GPT Nano",
         resolve: "opencode/gpt-5.4-nano",
@@ -103957,12 +103967,12 @@ var providers = {
         fallback: "opencode/big-pickle"
       },
       // Zen's FREE stealth preview (listed 2026-09-23), the third after
-      // big-pickle and union-alpha. OpenRouter's listing: prompts and
-      // completions may be retained by the provider, not trained on. unlike the
-      // first two it publishes an effort ladder, so the gate mirrors one here.
+      // big-pickle and union-alpha. Zen's docs: zero retention, no training.
+      // unlike the first two it publishes an effort ladder, so the gate
+      // mirrors one here.
       "space-bunny": {
         displayName: "Space Bunny",
-        description: "Stealth preview; prompts may be retained",
+        description: "Stealth preview, free for a limited time",
         resolve: "opencode/space-bunny-free",
         effort: ["low", "medium", "high", "xhigh", "max"],
         // free to run, still gated on the provider's own OPENCODE_API_KEY —
@@ -103980,17 +103990,46 @@ var providers = {
         // see the big-pickle note above (#1077).
         isFree: true
       },
-      // Zen's FREE stealth preview (listed 2026-10-01), the fifth promo. Zen
-      // has not published its data terms yet, so the description claims none.
+      // Zen's FREE stealth preview (listed 2026-10-01), the fifth promo. Zen's
+      // docs: data may be used to improve the model during the free period.
       "fledge-alpha": {
         displayName: "Fledge Alpha",
-        description: "Stealth preview, free for a limited time",
+        description: "Stealth preview; data may be used to improve it",
         resolve: "opencode/fledge-alpha-free",
         effort: ["low", "high", "max"],
         // free to run, still gated on the provider's own OPENCODE_API_KEY —
         // see the big-pickle note above (#1077).
+        isFree: true,
+        // Zen dropped the id from `/v1/models` and its docs on 2026-10-08 and
+        // answers a 500 for it; stored picks land on the other free stealth
+        // model, as `union-alpha` does.
+        fallback: "opencode/big-pickle"
+      },
+      // Zen's FREE preview (listed 2026-10-06), the sixth promo, on Fledge
+      // Alpha's terms.
+      exo: {
+        displayName: "Exo",
+        description: "Preview; data may be used to improve it",
+        resolve: "opencode/exo-free",
+        // Zen publishes a single rung.
+        effort: ["high"],
+        // free to run, still gated on the provider's own OPENCODE_API_KEY —
+        // see the big-pickle note above (#1077).
         isFree: true
       },
+      // Zen's FREE StepFun preview (listed 2026-10-08), the seventh promo. Zen's
+      // docs: zero retention, no training. Go lists the same free id; one key
+      // reaches both. hidden until a published `pullfrog` resolves it.
+      "step-5-preview": {
+        displayName: "Step 5 Preview",
+        description: "StepFun preview, free for a limited time",
+        resolve: "opencode/step-5-preview-free",
+        effort: ["low", "medium", "high"],
+        // free to run, still gated on the provider's own OPENCODE_API_KEY —
+        // see the big-pickle note above (#1077).
+        isFree: true,
+        hidden: true
+      },
       // Zen's live free MiMo, and the second free row in a menu that big-pickle
       // was alone in since `mimo-v2-pro-free` lost its model.
       mimo: {
@@ -104275,6 +104314,9 @@ var providers = {
       "claude-haiku": {
         displayName: "Claude Haiku",
         resolve: "openrouter/~anthropic/claude-haiku-latest",
+        // the rolling alias moved to Haiku 5.5 on 2026-10-07, which publishes
+        // the ladder Haiku 4.5 did not.
+        effort: ["low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/~anthropic/claude-haiku-latest"
       },
       // pinned to the explicit Sol/Terra/Luna tiers (not the ~openai/gpt-latest
@@ -104446,6 +104488,14 @@ var providers = {
         resolve: "openrouter/meta/muse-spark-1.3-contributor",
         effort: ["minimal", "low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/meta/muse-spark-1.3-contributor"
+      },
+      // Mistral's flagship (public preview, 2026-10-06), on the routers and
+      // Zen only: the catalog carries no direct Mistral provider.
+      "mistral-large": {
+        displayName: "Mistral Large",
+        resolve: "openrouter/mistralai/mistral-large-4-0",
+        effort: ["none", "high"],
+        openRouterResolve: "openrouter/mistralai/mistral-large-4-0"
       }
     }
   }),
@@ -104476,7 +104526,8 @@ var providers = {
       },
       "claude-haiku": {
         displayName: "Claude Haiku",
-        resolve: "vercel/anthropic/claude-haiku-4.5"
+        resolve: "vercel/anthropic/claude-haiku-5.5",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"]
       },
       "gpt-sol": {
         displayName: "GPT Sol",
@@ -104537,6 +104588,11 @@ var providers = {
         displayName: "Muse Spark",
         resolve: "vercel/meta/muse-spark-1.3",
         effort: ["minimal", "low", "medium", "high", "xhigh"]
+      },
+      "mistral-large": {
+        displayName: "Mistral Large",
+        resolve: "vercel/mistral/mistral-large-4",
+        effort: ["none", "low", "medium", "high"]
       }
     }
   })
@@ -105417,7 +105473,13 @@ var PROVIDER_ERROR_PATTERNS = [
   // …/settings/credits`) matched neither this nor `requires more credits`, so
   // the one run in that episode that was a genuinely empty wallet rendered with
   // no CTA at all while runs 1-6 rendered correctly.
-  { regex: /Insufficient (?:balance|credits)/i, label: PROVIDER_BILLING_EXHAUSTED_LABEL },
+  // `account funds` is Zen's (#1474).
+  {
+    regex: /Insufficient (?:balance|credits|account funds)/i,
+    label: PROVIDER_BILLING_EXHAUSTED_LABEL
+  },
+  // OpenAI's `You have no credits remaining` (#1474).
+  { regex: /no credits remaining/i, label: PROVIDER_BILLING_EXHAUSTED_LABEL },
   { regex: /credit balance is too low/i, label: PROVIDER_BILLING_EXHAUSTED_LABEL },
   // "spending cap" (Gemini) and "spending limit" (xAI, #1076) are the same
   // condition in two house styles — a configured ceiling was reached.
@@ -105538,6 +105600,9 @@ function isRouterKeylimitExhaustedError(text) {
 function isProviderBillingExhausted(text) {
   return findProviderErrorMatch(text)?.label === PROVIDER_BILLING_EXHAUSTED_LABEL;
 }
+function isProviderUsageLimit(text) {
+  return findProviderErrorMatch(text)?.label === PROVIDER_USAGE_LIMIT_LABEL;
+}
 function isProviderNoRoutableEndpoints(text) {
   return findProviderErrorMatch(text)?.label === PROVIDER_NO_ENDPOINTS_LABEL;
 }
@@ -105609,7 +105674,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.96",
+  version: "0.1.98",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -105637,7 +105702,7 @@ var package_default = {
   },
   devDependencies: {
     "@actions/core": "^1.11.1",
-    "@anthropic-ai/claude-code": "2.1.284",
+    "@anthropic-ai/claude-code": "2.1.293",
     "@ark/fs": "0.56.0",
     "@ark/util": "0.56.0",
     "@clack/prompts": "^1.2.0",
@@ -105906,6 +105971,7 @@ ${this.buffer}`;
 };
 async function spawn(options) {
   const activityTimeoutMs = options.activityTimeout ?? DEFAULT_ACTIVITY_TIMEOUT_MS;
+  options.signal?.throwIfAborted();
   installSignalHandler();
   const startTime = performance3.now();
   const retain = options.retain ?? "tail";
@@ -105941,17 +106007,18 @@ async function spawn(options) {
     let isActivityTimedOut = false;
     let lastActivityTime = performance3.now();
     let killedAtIdleMs;
+    const terminate = () => {
+      if (sigkillEscalatorId) return;
+      killSelf("SIGTERM");
+      sigkillEscalatorId = setTimeout(() => killSelf("SIGKILL"), 5e3);
+    };
     if (options.timeout) {
       timeoutId = setTimeout(() => {
         isTimedOut = true;
-        killSelf("SIGTERM");
-        sigkillEscalatorId = setTimeout(() => {
-          if (!child.killed) {
-            killSelf("SIGKILL");
-          }
-        }, 5e3);
+        terminate();
       }, options.timeout);
     }
+    options.signal?.addEventListener("abort", terminate, { once: true });
     if (activityTimeoutMs > 0) {
       log.debug(
         `spawn activity timer: pid=${child.pid} cmd=${options.cmd} timeout=${activityTimeoutMs}ms`
@@ -106016,6 +106083,11 @@ async function spawn(options) {
       if (timeoutId) clearTimeout(timeoutId);
       if (sigkillEscalatorId) clearTimeout(sigkillEscalatorId);
       if (activityCheckIntervalId) clearInterval(activityCheckIntervalId);
+      options.signal?.removeEventListener("abort", terminate);
+      if (options.signal?.aborted) {
+        reject(options.signal.reason);
+        return;
+      }
       if (isTimedOut) {
         reject(
           new SpawnTimeoutError(`process timed out after ${options.timeout}ms`, SPAWN_TIMEOUT_CODE)
@@ -106054,6 +106126,7 @@ ${killMsg}` : killMsg;
       if (timeoutId) clearTimeout(timeoutId);
       if (sigkillEscalatorId) clearTimeout(sigkillEscalatorId);
       if (activityCheckIntervalId) clearInterval(activityCheckIntervalId);
+      options.signal?.removeEventListener("abort", terminate);
       const errMsg = `[spawn] ${options.cmd}: ${error49.message}`;
       console.error(errMsg);
       const existingStderr = stderrBuffer?.toString() ?? "";
@@ -106295,17 +106368,16 @@ Report findings clearly with file:line references and quoted evidence where poss
 // modes.ts
 var PR_SUMMARY_FORMAT = `### Default format
 
-The body has at most three parts, in this order:
+The body has at most two parts, in this order:
 
 1. **Reviewed changes preamble** \u2014 a bolded \`**Reviewed changes**\` lead-in with one sentence on what was reviewed in this run (for \`IncrementalReview\`: what changed since the prior pullfrog review), then a bullet list of the substantive changes \u2014 short bolded title, one sentence each. A reviewer should understand the full reviewed scope from this list alone. Close the preamble with the metadata comment below.
 2. **Cross-cutting issue sections** (zero or more) \u2014 one \`### {emoji} {what's wrong, not what to do}\` heading per concern.
-3. **\`### \u2139\uFE0F Nitpicks\`** at the very bottom, if any \u2014 a flat bullet list, no technical-details block. Only for what has no runtime effect: a stale or wrong comment or doc, a misleading name, a typo, dead code, a missing test. Never formatting or whitespace.
 
 **Inline vs. body.** Concerns that anchor to a specific line go inline (the \`comments\` parameter), even when their implications are broad. Body \`### \` sections are reserved for concerns that have **no line to anchor to** \u2014 *absence* (something the diff should have done but didn't), *sequencing* (rollout / deletion / migration order), *design decisions only the human can make*, or *scope questions the diff raises but doesn't address*. With no non-anchorable concerns, the body is just the preamble + metadata.
 
 **Severity emoji** on every \`### \` heading, and nowhere else: \u{1F6A8} critical (blocks merge \u2014 data loss, security, broken core flow) \xB7 \u26A0\uFE0F important (must address before merging) \xB7 \u2139\uFE0F informational (mergeable as-is).
 
-**Behavior decides placement, not fix size.** A finding that changes what the code does \u2014 a wrong value or message, a crash, a race, a leak, a missed cleanup, a slow path \u2014 gets its own inline comment (or a \`### \` section if no line anchors it) at its real severity, however small the fix. Never put it in Nitpicks: before submitting, re-read each Nitpicks bullet and move any that fails this test inline.
+**Behavior decides placement, not fix size.** A finding that changes what the code does \u2014 a wrong value or message, a crash, a race, a leak, a missed cleanup, a slow path \u2014 gets its own inline comment (or a \`### \` section if no line anchors it) at its real severity, however small the fix.
 
 **Blank line between every block-level element.** GitHub's markdown parser requires one before and after HTML tags (\`<details>\`, \`<summary>\`, \`<sub>\`, \`<br/>\`) \u2014 without it GitHub treats what follows as a continuation of the HTML block and renders your markdown as literal text. This is a parser quirk, not a style preference, and it permanently breaks the posted review.
 
@@ -106454,8 +106526,6 @@ For simple, well-defined tasks, skip the plan phase and go straight to build.`
 
 3. **triage**: orient yourself on the PR \u2014 identify *what kind of thing this is* (domain it touches, seams it crosses, external contracts it depends on, user-facing surfaces it changes). pull as much context as you need to render a confident, well-grounded review: read related files, grep for callers of changed symbols, check tests that exercise the touched paths, fetch related GitHub state. **you are the synthesizer** \u2014 never delegate understanding to subagents.
 
-   when the diff adds or changes a test, check that it can actually fail: a test that would still pass with the bug present is theatre, not coverage. the usual tell is a loose assertion standing where an exact one belongs \u2014 \`>=\` or a truthiness check over an expected value, or a snapshot that absorbs whatever it is handed. read the assertion against the behavior it claims to pin, not against whether it currently passes.
-
    skip the deeper pass and submit a \`No new issues found.\` review per step 7 only when the diff has **no behavioral surface at all** \u2014 doc typos, whitespace/formatting, lockfile or generated-code regeneration, a mechanical rename whose only effect is import-path updates. line count is not the signal: a one-line change to auth, money, SQL, a comparison operator, a redirect, or a config default is not trivial.
 
 4. **specialist decision**: after reading the complete diff, name the questions you still cannot answer confidently yourself, and dispatch one \`${REVIEWER_AGENT_NAME}\` specialist per question. a question qualifies only when a specialist could return evidence that **changes your disposition** on the PR \u2014 generic requests for another look, extra confidence, or polish do not. most reviews need zero or one; some need several.
@@ -106479,8 +106549,6 @@ For simple, well-defined tasks, skip the plan phase and go straight to build.`
 
 6. **aggregate & draft**: when specialist results land, merge findings; de-dup overlaps (two specialists catching the same issue = higher-confidence signal); trace each finding yourself before accepting it. drop praise, style preferences, speculative/unverified claims, findings about pre-existing code unrelated to the PR (heuristic: if the finding's root cause lives in lines this PR added or modified, it's in scope; otherwise drop unless the PR plausibly introduced or amplified the regression), and anything not actionable. also drop **bloat-shaped findings** \u2014 proposed fixes that would add defensive checks for cases that can't happen, abstractions used once, comments restating obvious code, tests asserting tautologies, or "just-in-case" guards. subagents are fallible and bias toward recommending changes; the bar for an actionable inline comment is sound + correct + elegant. recommending a change that improves only one of the three (or worse, degrades elegance to nominally improve correctness) makes the codebase worse, not better.
 
-   **Hunt for non-anchored concerns before drafting.** After collecting your anchored findings, deliberately scan for concerns that have no specific line to point at \u2014 typically: deletion / cleanup plans for code the diff replaces or shadows; rollout sequencing (what happens to in-flight state during deploy / revert?); scope questions that only the human can answer (e.g. is the legacy path going away or is this a long-term dual track?); architectural risks the diff opens up that aren't a single-line bug.
-
    for surviving findings, draft inline comments with NEW line numbers from the diff \u2014 attach a \`<details>Technical details</details>\` block to any inline comment whose fix is non-trivial or has cross-file implications (see Inline technical details in the format below). every comment must be actionable, 2-3 sentences max in the visible part, one per root cause \u2014 name its other sites in that comment rather than repeating it. use GitHub permalink format for code references. for impact-analysis findings (stale references after rename/remove), report them in the review body ordered by severity (runtime breakage > incorrect docs > stale comments) rather than as inline comments unless they're anchored to a specific line.
 
 7. **submit**: ALWAYS submit exactly one review via \`${t("create_pull_request_review")}\`. Do NOT call \`report_progress\` \u2014 the review is the final record and the progress comment will be cleaned up automatically.
@@ -106502,7 +106570,7 @@ For simple, well-defined tasks, skip the plan phase and go straight to build.`
      \`approved: false\`. Body opens with \`> [!CAUTION]\\n> This PR introduces ...\`, followed by the PR summary. Include all inline comments via \`comments\`.
    - **must-address non-critical findings** (real consequences if shipped \u2014 incorrect behavior in non-critical paths, missing validation on user input, regressions the author should fix before merge):
      \`approved: false\`. Body opens with \`> [!IMPORTANT]\\n> ...\`, followed by the PR summary. Reserve this tier for findings with concrete fallout \u2014 do NOT use \`[!IMPORTANT]\` for nits, style preferences, or "consider also" suggestions. Include all inline comments via \`comments\`.
-   - **minor suggestions only** (low-stakes findings, or Nitpicks only):
+   - **minor suggestions only** (low-stakes findings):
      \`approved: false\`. Body opens with \`> \u2139\uFE0F No critical issues \u2014 minor suggestions inline.\\n\\n\` followed by the PR summary. Include all inline comments via \`comments\`. Vary the wording after the emoji to fit the review (e.g. "Minor suggestions only.", "Two rough edges worth a look."), but always keep the \u2139\uFE0F prefix and keep it short.
    - **informational observations** (mergeable as-is, nothing actionable \u2014 e.g. prior feedback addressed cleanly, calling out something noteworthy without recommending a change):
      \`approved: true\`. Body opens with \`> \u2705 No new issues found.\\n\\n\` followed by the PR summary. Do NOT include inline \`comments\` \u2014 the \u2705 signals "no action needed", which contradicts an actionable anchor; if a point is concrete enough to anchor to a line, downgrade the whole review to "minor suggestions only" (\`approved: false\`) instead.
@@ -106545,8 +106613,6 @@ ${PR_SUMMARY_FORMAT}`
 
 5. **triage**: orient on the *incremental* changes \u2014 domain, seams, external contracts, user-facing surfaces. pull as much context as you need to render a confident review: read related files, grep for callers of changed symbols, check tests that exercise the touched paths. **you are the synthesizer.**
 
-   a test added or changed in this delta must be able to fail \u2014 one that would still pass with the bug present is theatre, not coverage. the tell is a loose assertion where an exact one belongs (\`>=\` or a truthiness check over an expected value, a snapshot that absorbs whatever it is handed).
-
    skip the deeper pass and jump to step 10's non-substantive path (do NOT submit a review) only when the incremental changes have **no behavioral surface at all** \u2014 formatting, comment tweaks, import reordering, lockfile regen, a mechanical rename of import paths. line count is not the signal: a one-line change to auth, money, SQL, a comparison operator, a redirect, or a config default is not trivial.
 
 6. **specialist decision**: after covering the incremental and full diffs, name the questions about the new changes that you still cannot answer confidently yourself, and dispatch one \`${REVIEWER_AGENT_NAME}\` specialist per question. a question qualifies only when a specialist could return evidence that **changes your disposition** on the PR \u2014 generic requests for another look, extra confidence, or polish do not. most incremental reviews need zero or one, especially thread-reply re-reviews; some need several.
@@ -106570,11 +106636,9 @@ ${PR_SUMMARY_FORMAT}`
 
 8. **aggregate, draft, self-critique**: merge findings (yours + output from every specialist you dispatched); de-dup overlaps; trace each finding yourself. drop praise, style preferences, speculative/unverified claims, findings about pre-existing code unrelated to the new commits, anything not actionable, and anything that re-states prior review feedback (heuristic: if the finding's root cause lives in lines the *new commits* added or modified, it's in scope; otherwise drop). also drop **bloat-shaped findings** \u2014 proposed fixes that would add defensive checks for cases that can't happen, abstractions used once, comments restating obvious code, tests asserting tautologies, or "just-in-case" guards. subagents are fallible and bias toward recommending changes; the bar for an actionable inline comment is sound + correct + elegant. recommending a change that improves only one of the three (or degrades elegance to nominally improve correctness) makes the codebase worse, not better. To compute "lines the new commits added or modified": if \`incrementalDiffPath\` from step 2 is present, use it directly. Otherwise, take the prior Pullfrog review's \`commit_id\` (returned alongside each entry from \`${t("list_pull_request_reviews")}\` in step 4) and run \`git diff <prior-review-sha>..HEAD\` to isolate the lines added since that review.
 
-   **Hunt for non-anchored concerns before drafting.** After collecting your anchored findings, deliberately scan for concerns that have no specific line to point at \u2014 typically: deletion / cleanup plans for code the new commits replace or shadow; rollout sequencing (what happens to in-flight state during deploy / revert?); scope questions that only the human can answer (e.g. is the legacy path going away or is this a long-term dual track?); architectural risks the new commits open up that aren't a single-line bug.
-
    draft inline comments with NEW line numbers from the full PR diff \u2014 attach a \`<details>Technical details</details>\` block to any inline comment whose fix is non-trivial or has cross-file implications (see Inline technical details in the format below). every comment must be actionable, 2-3 sentences max in the visible part, one per root cause \u2014 name its other sites in that comment rather than repeating it.
 
-9. **build the review body**: use the same default format as Review mode (preamble + optional cross-cutting \`### \` sections + optional \`### \u2139\uFE0F Nitpicks\`) \u2014 scoped to the **incremental delta**, not the full PR. The "Reviewed changes" bullets describe what changed since the prior pullfrog review (each bullet starts with a past-tense verb, e.g. \`- Extracted shared CLI runtime into a single module\`). Do NOT include a separate "Prior review feedback" checklist \u2014 that's tracked in the rolling PR summary snapshot for the next agent run, and surfacing it in the user-facing body is noise (changes that addressed prior feedback are already covered by the Reviewed-changes bullets). In some cases you may receive a complete diff for the whole PR instead of an incremental one; when this happens, determine what changed since Pullfrog's most recent review yourself before drafting bullets.
+9. **build the review body**: use the same default format as Review mode (preamble + optional cross-cutting \`### \` sections) \u2014 scoped to the **incremental delta**, not the full PR. The "Reviewed changes" bullets describe what changed since the prior pullfrog review (each bullet starts with a past-tense verb, e.g. \`- Extracted shared CLI runtime into a single module\`). Do NOT include a separate "Prior review feedback" checklist \u2014 that's tracked in the rolling PR summary snapshot for the next agent run, and surfacing it in the user-facing body is noise (changes that addressed prior feedback are already covered by the Reviewed-changes bullets). In some cases you may receive a complete diff for the whole PR instead of an incremental one; when this happens, determine what changed since Pullfrog's most recent review yourself before drafting bullets.
 
 10. Submit \u2014 every run must end with EXACTLY ONE of \`${t("create_pull_request_review")}\` (substantive review) or \`${t("report_progress")}\` (no-review acknowledgement). do NOT call \`create_issue_comment\` for review output.
 
@@ -106585,7 +106649,7 @@ ${PR_SUMMARY_FORMAT}`
    - IF NO NEW ISSUES, NON-SUBSTANTIVE CHANGES ONLY (trivial formatting, import reordering, comment tweaks): do NOT submit a review. Instead call \`${t("report_progress")}\` with \`no_review_needed: true\` and a 1-2 sentence note explaining no review was warranted (e.g. "No new issues. Changes since last review are formatting-only."). this leaves a visible signal that the run completed.
    - ELSE IF NEW CRITICAL ISSUES (blocks merge \u2014 bugs, security, data loss, broken core flows): call \`${t("create_pull_request_review")}\` with \`approved: false\`, all comments, and the review body. body opens with \`> [!CAUTION]\\n> This PR introduces ...\`, followed by the PR summary using the default format below.
    - ELSE IF NEW MUST-ADDRESS NON-CRITICAL FINDINGS (real consequences if shipped \u2014 incorrect behavior, missing validation, regressions the author should fix before merge): call \`${t("create_pull_request_review")}\` with \`approved: false\`, all comments, and the review body. body opens with \`> [!IMPORTANT]\\n> ...\`, followed by the PR summary using the default format below. Do NOT use this tier for nits, style preferences, or "consider also" suggestions.
-   - ELSE IF NEW MINOR SUGGESTIONS ONLY (low-stakes findings, or Nitpicks only): call \`${t("create_pull_request_review")}\` with \`approved: false\`, all comments, and the review body. body opens with \`> \u2139\uFE0F No critical issues \u2014 minor suggestions inline.\\n\\n\` (vary the wording after \u2139\uFE0F to fit the review), followed by the PR summary using the default format below.
+   - ELSE IF NEW MINOR SUGGESTIONS ONLY (low-stakes findings): call \`${t("create_pull_request_review")}\` with \`approved: false\`, all comments, and the review body. body opens with \`> \u2139\uFE0F No critical issues \u2014 minor suggestions inline.\\n\\n\` (vary the wording after \u2139\uFE0F to fit the review), followed by the PR summary using the default format below.
    - ELSE IF INFORMATIONAL OBSERVATIONS (mergeable as-is, but worth surfacing \u2014 e.g. prior feedback addressed cleanly, or a noteworthy positive observation): call \`${t("create_pull_request_review")}\` with \`approved: true\`, NO inline comments, and the review body. body opens with \`> \u2705 No new issues found.\\n\\n\` (or similar friendly green opener), followed by the PR summary using the default format below. If a point is concrete enough to anchor to a line, downgrade the whole review to "minor suggestions only" (\`approved: false\`) instead \u2014 the \u2705 signals "no action needed", which contradicts an actionable anchor.
    - ELSE IF NO NEW ISSUES, SUBSTANTIVE CHANGES (new functionality, behavior changes, or fixes to prior review feedback): call \`${t("create_pull_request_review")}\` to create a PR review. If all previous reviews have been properly addressed and no new issues were discovered, set \`approved: true\`. body opens with \`> \u2705 No new issues found.\\n\\n\`, followed by the PR summary using the default format below.
 
@@ -107802,7 +107866,7 @@ import { performance as performance6 } from "node:perf_hooks";
 
 // utils/codexHome.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync5, mkdtempSync, readFileSync as readFileSync2, writeFileSync as writeFileSync4 } from "node:fs";
 import { homedir as homedir2, userInfo } from "node:os";
 import { join as join5 } from "node:path";
 
@@ -107853,205 +107917,6 @@ function stringifyCodexAuthBody(body) {
 `;
 }
 
-// utils/xaiOAuth.ts
-function parseXaiAuthBody(raw2) {
-  let parsed2;
-  try {
-    parsed2 = JSON.parse(raw2);
-  } catch {
-    return null;
-  }
-  if (!parsed2 || typeof parsed2 !== "object") return null;
-  const v = parsed2;
-  if (v.auth_mode !== "grok") return null;
-  const tokens = v.tokens;
-  if (!tokens || typeof tokens !== "object") return null;
-  const t = tokens;
-  if (typeof t.access_token !== "string" || t.access_token.length === 0) return null;
-  if (typeof t.refresh_token !== "string" || t.refresh_token.length === 0) return null;
-  return {
-    auth_mode: "grok",
-    ...typeof v.refresh_rejected_at === "string" ? { refresh_rejected_at: v.refresh_rejected_at } : {},
-    tokens: { access_token: t.access_token, refresh_token: t.refresh_token },
-    ...typeof v.last_refresh === "string" ? { last_refresh: v.last_refresh } : {}
-  };
-}
-
-// utils/codexHome.ts
-var CODEX_AUTH_ENV = "CODEX_AUTH_JSON";
-var XAI_AUTH_ENV = "GROK_AUTH_JSON";
-var installedSubscriptionPaths = /* @__PURE__ */ new Map();
-function clearInstalledSubscription(name) {
-  const path4 = installedSubscriptionPaths.get(name);
-  if (!path4 || !existsSync4(path4)) return;
-  const value2 = JSON.parse(readFileSync2(path4, "utf8"));
-  if (!value2 || typeof value2 !== "object") return;
-  if (name === "CODEX_AUTH_JSON" && "openai" in value2) delete value2.openai;
-  if (name === "GROK_AUTH_JSON" && "xai" in value2) delete value2.xai;
-  writeFileSync4(path4, `${JSON.stringify(value2)}
-`, { mode: 384 });
-  installedSubscriptionPaths.delete(name);
-}
-var PULLFROG_DATA_DIR = "/var/lib/pullfrog";
-function isRejectedChain(body) {
-  if (!body.refresh_rejected_at) return false;
-  log.warning(
-    `\xBB ${CODEX_AUTH_ENV} was rejected by OpenAI at ${body.refresh_rejected_at} and cannot be refreshed \u2014 re-run \`npx pullfrog auth codex\`. skipping it for this run.`
-  );
-  return true;
-}
-function installCodexAuth() {
-  const raw2 = process.env[CODEX_AUTH_ENV];
-  if (!raw2) return null;
-  const body = parseCodexAuthBody(raw2);
-  if (!body) {
-    log.warning(`\xBB ${CODEX_AUTH_ENV} present but malformed; ignoring`);
-    return null;
-  }
-  if (isRejectedChain(body)) return null;
-  const expiresMs = decodeJwtExpMs(body.tokens.access_token) ?? 0;
-  const xdgDataHome = resolveDataHome();
-  if (!xdgDataHome) return null;
-  const opencodeDir = join5(xdgDataHome, "opencode");
-  const authPath = join5(opencodeDir, "auth.json");
-  writeOpenCodeAuthEntry({
-    opencodeDir,
-    authPath,
-    provider: "openai",
-    entry: {
-      type: "oauth",
-      refresh: body.tokens.refresh_token,
-      access: body.tokens.access_token,
-      expires: expiresMs,
-      ...body.tokens.account_id ? { accountId: body.tokens.account_id } : {}
-    }
-  });
-  process.env.XDG_DATA_HOME = xdgDataHome;
-  log.info(`\xBB installed Codex auth at ${authPath}`);
-  installedSubscriptionPaths.set(CODEX_AUTH_ENV, authPath);
-  return {
-    authPath,
-    xdgDataHome,
-    originalRefresh: body.tokens.refresh_token,
-    originalIdToken: body.tokens.id_token
-  };
-}
-function writeOpenCodeAuthEntry(params) {
-  let existing = {};
-  if (existsSync4(params.authPath)) {
-    try {
-      const parsed2 = JSON.parse(readFileSync2(params.authPath, "utf8"));
-      if (parsed2 && typeof parsed2 === "object") existing = parsed2;
-    } catch {
-      log.warning(`\xBB ${params.authPath} was unreadable; rewriting it`);
-    }
-  }
-  const merged = { ...existing, [params.provider]: params.entry };
-  mkdirSync5(params.opencodeDir, { recursive: true });
-  writeFileSync4(params.authPath, `${JSON.stringify(merged, null, 2)}
-`, { mode: 384 });
-}
-function installXaiAuth() {
-  const raw2 = process.env[XAI_AUTH_ENV];
-  if (!raw2) return null;
-  const body = parseXaiAuthBody(raw2);
-  if (!body) {
-    log.warning(`\xBB ${XAI_AUTH_ENV} present but malformed; ignoring`);
-    return null;
-  }
-  if (isXaiRejectedChain(body)) return null;
-  const xdgDataHome = resolveDataHome();
-  if (!xdgDataHome) return null;
-  const opencodeDir = join5(xdgDataHome, "opencode");
-  const authPath = join5(opencodeDir, "auth.json");
-  writeOpenCodeAuthEntry({
-    opencodeDir,
-    authPath,
-    provider: "xai",
-    // opencode refreshes when `expires` is inside its skew window, and falls
-    // back to the JWT's own exp when the stored value is absent. Decoding it
-    // here means the first request uses the token we already hold instead of
-    // burning a rotation on startup.
-    entry: {
-      type: "oauth",
-      refresh: body.tokens.refresh_token,
-      access: body.tokens.access_token,
-      expires: decodeJwtExpMs(body.tokens.access_token) ?? 0
-    }
-  });
-  process.env.XDG_DATA_HOME = xdgDataHome;
-  log.info(`\xBB installed Grok auth at ${authPath}`);
-  installedSubscriptionPaths.set(XAI_AUTH_ENV, authPath);
-  return { authPath, xdgDataHome, originalRefresh: body.tokens.refresh_token };
-}
-function isXaiRejectedChain(body) {
-  if (!body.refresh_rejected_at) return false;
-  log.warning(
-    `\xBB ${XAI_AUTH_ENV} was rejected by xAI at ${body.refresh_rejected_at} and cannot be refreshed \u2014 re-run \`npx pullfrog auth grok\`. skipping it for this run.`
-  );
-  return true;
-}
-function installCodexHome() {
-  const raw2 = process.env[CODEX_AUTH_ENV];
-  if (!raw2) return null;
-  const body = parseCodexAuthBody(raw2);
-  if (!body) {
-    log.warning(`\xBB ${CODEX_AUTH_ENV} present but malformed; ignoring`);
-    return null;
-  }
-  if (isRejectedChain(body)) return null;
-  if (!body.tokens.id_token) {
-    log.warning(
-      `\xBB ${CODEX_AUTH_ENV} carries no id_token \u2014 the codex CLI cannot load it. re-run \`npx pullfrog auth codex\` to mint a complete credential.`
-    );
-    return null;
-  }
-  const root = resolveDataHome();
-  if (!root) return null;
-  const codexHome = join5(root, "codex");
-  const authPath = join5(codexHome, "auth.json");
-  mkdirSync5(codexHome, { recursive: true });
-  writeFileSync4(authPath, stringifyCodexAuthBody(body), { mode: 384 });
-  log.info(`\xBB installed Codex auth at ${authPath}`);
-  return { codexHome, authPath, originalRefresh: body.tokens.refresh_token };
-}
-var dataHome;
-var unhostedSubscriptions = /* @__PURE__ */ new Set();
-function canInstallSubscription(name) {
-  return name !== CODEX_AUTH_ENV && name !== XAI_AUTH_ENV || resolveDataHome() !== null;
-}
-function resolveDataHome() {
-  if (process.env.CI !== "true") return join5(homedir2(), ".local", "share");
-  if (dataHome === void 0) dataHome = bootstrapPullfrogDataDir();
-  return dataHome;
-}
-function bootstrapPullfrogDataDir() {
-  const user = userInfo().username;
-  let primaryGroup;
-  try {
-    primaryGroup = execFileSync3("id", ["-gn", user], { stdio: "pipe", encoding: "utf-8" }).trim();
-  } catch {
-    primaryGroup = user;
-  }
-  try {
-    execFileSync3("sudo", ["-n", "mkdir", "-p", PULLFROG_DATA_DIR], { stdio: "pipe" });
-    execFileSync3("sudo", ["-n", "chown", `${user}:${primaryGroup}`, PULLFROG_DATA_DIR], {
-      stdio: "pipe"
-    });
-    execFileSync3("sudo", ["-n", "chmod", "700", PULLFROG_DATA_DIR], { stdio: "pipe" });
-  } catch (err) {
-    log.warning(
-      `\xBB subscription auth skipped: could not create ${PULLFROG_DATA_DIR} (${err instanceof Error ? err.message : String(err)}). it must live outside the agent sandbox's reach, which needs passwordless sudo on this runner; runs on a model that needs the subscription will report no key.`
-    );
-    for (const name of [CODEX_AUTH_ENV, XAI_AUTH_ENV]) {
-      if (process.env[name]) unhostedSubscriptions.add(name);
-      delete process.env[name];
-    }
-    return null;
-  }
-  return PULLFROG_DATA_DIR;
-}
-
 // utils/oauthWriteback.ts
 var core2 = __toESM(require_core(), 1);
 
@@ -110281,6 +110146,7 @@ async function apiFetch(options) {
 
 // utils/oauthWriteback.ts
 var OAUTH_WRITEBACK_STATE = "oauth_writeback";
+var SUBSCRIPTION_DATA_DIR_STATE = "subscription_data_dir";
 
 // utils/secretCommands.ts
 var core3 = __toESM(require_core(), 1);
@@ -110291,6 +110157,212 @@ function saveSecretState(name, value2) {
   if (isGitHubActions) core3.saveState(name, value2);
 }
 
+// utils/xaiOAuth.ts
+function parseXaiAuthBody(raw2) {
+  let parsed2;
+  try {
+    parsed2 = JSON.parse(raw2);
+  } catch {
+    return null;
+  }
+  if (!parsed2 || typeof parsed2 !== "object") return null;
+  const v = parsed2;
+  if (v.auth_mode !== "grok") return null;
+  const tokens = v.tokens;
+  if (!tokens || typeof tokens !== "object") return null;
+  const t = tokens;
+  if (typeof t.access_token !== "string" || t.access_token.length === 0) return null;
+  if (typeof t.refresh_token !== "string" || t.refresh_token.length === 0) return null;
+  return {
+    auth_mode: "grok",
+    ...typeof v.refresh_rejected_at === "string" ? { refresh_rejected_at: v.refresh_rejected_at } : {},
+    tokens: { access_token: t.access_token, refresh_token: t.refresh_token },
+    ...typeof v.last_refresh === "string" ? { last_refresh: v.last_refresh } : {}
+  };
+}
+
+// utils/codexHome.ts
+var CODEX_AUTH_ENV = "CODEX_AUTH_JSON";
+var XAI_AUTH_ENV = "GROK_AUTH_JSON";
+var installedSubscriptionPaths = /* @__PURE__ */ new Map();
+var installedDataHome;
+function getSubscriptionDataHome() {
+  return installedDataHome;
+}
+function clearInstalledSubscription(name) {
+  const path4 = installedSubscriptionPaths.get(name);
+  if (!path4 || !existsSync4(path4)) return;
+  const value2 = JSON.parse(readFileSync2(path4, "utf8"));
+  if (!value2 || typeof value2 !== "object") return;
+  if (name === "CODEX_AUTH_JSON" && "openai" in value2) delete value2.openai;
+  if (name === "GROK_AUTH_JSON" && "xai" in value2) delete value2.xai;
+  writeFileSync4(path4, `${JSON.stringify(value2)}
+`, { mode: 384 });
+  installedSubscriptionPaths.delete(name);
+}
+var PULLFROG_DATA_DIR = "/var/lib/pullfrog";
+function isRejectedChain(body) {
+  if (!body.refresh_rejected_at) return false;
+  log.warning(
+    `\xBB ${CODEX_AUTH_ENV} was rejected by OpenAI at ${body.refresh_rejected_at} and cannot be refreshed \u2014 re-run \`npx pullfrog auth codex\`. skipping it for this run.`
+  );
+  return true;
+}
+function installCodexAuth() {
+  const raw2 = process.env[CODEX_AUTH_ENV];
+  if (!raw2) return null;
+  const body = parseCodexAuthBody(raw2);
+  if (!body) {
+    log.warning(`\xBB ${CODEX_AUTH_ENV} present but malformed; ignoring`);
+    return null;
+  }
+  if (isRejectedChain(body)) return null;
+  const expiresMs = decodeJwtExpMs(body.tokens.access_token) ?? 0;
+  const xdgDataHome = resolveDataHome();
+  if (!xdgDataHome) return null;
+  const opencodeDir = join5(xdgDataHome, "opencode");
+  const authPath = join5(opencodeDir, "auth.json");
+  writeOpenCodeAuthEntry({
+    opencodeDir,
+    authPath,
+    provider: "openai",
+    entry: {
+      type: "oauth",
+      refresh: body.tokens.refresh_token,
+      access: body.tokens.access_token,
+      expires: expiresMs,
+      ...body.tokens.account_id ? { accountId: body.tokens.account_id } : {}
+    }
+  });
+  installedDataHome = xdgDataHome;
+  log.info(`\xBB installed Codex auth at ${authPath}`);
+  installedSubscriptionPaths.set(CODEX_AUTH_ENV, authPath);
+  return {
+    authPath,
+    originalRefresh: body.tokens.refresh_token,
+    originalIdToken: body.tokens.id_token
+  };
+}
+function writeOpenCodeAuthEntry(params) {
+  let existing = {};
+  if (existsSync4(params.authPath)) {
+    try {
+      const parsed2 = JSON.parse(readFileSync2(params.authPath, "utf8"));
+      if (parsed2 && typeof parsed2 === "object") existing = parsed2;
+    } catch {
+      log.warning(`\xBB ${params.authPath} was unreadable; rewriting it`);
+    }
+  }
+  const merged = { ...existing, [params.provider]: params.entry };
+  mkdirSync5(params.opencodeDir, { recursive: true });
+  writeFileSync4(params.authPath, `${JSON.stringify(merged, null, 2)}
+`, { mode: 384 });
+}
+function installXaiAuth() {
+  const raw2 = process.env[XAI_AUTH_ENV];
+  if (!raw2) return null;
+  const body = parseXaiAuthBody(raw2);
+  if (!body) {
+    log.warning(`\xBB ${XAI_AUTH_ENV} present but malformed; ignoring`);
+    return null;
+  }
+  if (isXaiRejectedChain(body)) return null;
+  const xdgDataHome = resolveDataHome();
+  if (!xdgDataHome) return null;
+  const opencodeDir = join5(xdgDataHome, "opencode");
+  const authPath = join5(opencodeDir, "auth.json");
+  writeOpenCodeAuthEntry({
+    opencodeDir,
+    authPath,
+    provider: "xai",
+    // opencode refreshes when `expires` is inside its skew window, and falls
+    // back to the JWT's own exp when the stored value is absent. Decoding it
+    // here means the first request uses the token we already hold instead of
+    // burning a rotation on startup.
+    entry: {
+      type: "oauth",
+      refresh: body.tokens.refresh_token,
+      access: body.tokens.access_token,
+      expires: decodeJwtExpMs(body.tokens.access_token) ?? 0
+    }
+  });
+  installedDataHome = xdgDataHome;
+  log.info(`\xBB installed Grok auth at ${authPath}`);
+  installedSubscriptionPaths.set(XAI_AUTH_ENV, authPath);
+  return { authPath, originalRefresh: body.tokens.refresh_token };
+}
+function isXaiRejectedChain(body) {
+  if (!body.refresh_rejected_at) return false;
+  log.warning(
+    `\xBB ${XAI_AUTH_ENV} was rejected by xAI at ${body.refresh_rejected_at} and cannot be refreshed \u2014 re-run \`npx pullfrog auth grok\`. skipping it for this run.`
+  );
+  return true;
+}
+function installCodexHome() {
+  const raw2 = process.env[CODEX_AUTH_ENV];
+  if (!raw2) return null;
+  const body = parseCodexAuthBody(raw2);
+  if (!body) {
+    log.warning(`\xBB ${CODEX_AUTH_ENV} present but malformed; ignoring`);
+    return null;
+  }
+  if (isRejectedChain(body)) return null;
+  if (!body.tokens.id_token) {
+    log.warning(
+      `\xBB ${CODEX_AUTH_ENV} carries no id_token \u2014 the codex CLI cannot load it. re-run \`npx pullfrog auth codex\` to mint a complete credential.`
+    );
+    return null;
+  }
+  const root = resolveDataHome();
+  if (!root) return null;
+  const codexHome = join5(root, "codex");
+  const authPath = join5(codexHome, "auth.json");
+  mkdirSync5(codexHome, { recursive: true });
+  writeFileSync4(authPath, stringifyCodexAuthBody(body), { mode: 384 });
+  log.info(`\xBB installed Codex auth at ${authPath}`);
+  return { codexHome, authPath, originalRefresh: body.tokens.refresh_token };
+}
+var dataHome;
+var unhostedSubscriptions = /* @__PURE__ */ new Set();
+function canInstallSubscription(name) {
+  return name !== CODEX_AUTH_ENV && name !== XAI_AUTH_ENV || resolveDataHome() !== null;
+}
+function resolveDataHome() {
+  if (process.env.CI !== "true") return join5(homedir2(), ".local", "share");
+  if (dataHome === void 0) dataHome = bootstrapPullfrogDataDir();
+  return dataHome;
+}
+function bootstrapPullfrogDataDir() {
+  const user = userInfo().username;
+  let primaryGroup;
+  try {
+    primaryGroup = execFileSync3("id", ["-gn", user], { stdio: "pipe", encoding: "utf-8" }).trim();
+  } catch {
+    primaryGroup = user;
+  }
+  try {
+    execFileSync3("sudo", ["-n", "mkdir", "-p", PULLFROG_DATA_DIR], { stdio: "pipe" });
+    execFileSync3("sudo", ["-n", "chown", `${user}:${primaryGroup}`, PULLFROG_DATA_DIR], {
+      stdio: "pipe"
+    });
+    execFileSync3("sudo", ["-n", "chmod", "700", PULLFROG_DATA_DIR], { stdio: "pipe" });
+  } catch (err) {
+    log.warning(
+      `\xBB subscription auth skipped: could not create ${PULLFROG_DATA_DIR} (${err instanceof Error ? err.message : String(err)}). it must live outside the agent sandbox's reach, which needs passwordless sudo on this runner; runs on a model that needs the subscription will report no key.`
+    );
+    for (const name of [CODEX_AUTH_ENV, XAI_AUTH_ENV]) {
+      if (process.env[name]) unhostedSubscriptions.add(name);
+      delete process.env[name];
+    }
+    return null;
+  }
+  const runDir = mkdtempSync(join5(PULLFROG_DATA_DIR, "run-"));
+  if (process.env.RUNNER_ENVIRONMENT !== "github-hosted") {
+    saveSecretState(SUBSCRIPTION_DATA_DIR_STATE, runDir);
+  }
+  return runDir;
+}
+
 // utils/secrets.ts
 var SENSITIVE_PATTERNS = [
   /_KEY$/i,
@@ -110937,9 +111009,8 @@ var codex = agent({
       initialUsage: initial.usage,
       reflectionPrompt: buildReflectionPrompt(ctx.toolState),
       // a resume needs the thread codex recorded. without one there is nothing
-      // to continue, and `resume --last` would be worse than not resuming: it
-      // picks the newest recorded session in this cwd, which on a self-hosted
-      // runner with a shared CODEX_HOME is somebody else's run.
+      // to continue, and `resume --last` could pick another run's session off CI,
+      // where CODEX_HOME is the shared ~/.local/share/codex (in CI it is per run).
       canResume: (r) => r.threadId !== void 0,
       resume: async (c) => runCodex({
         ...runnerArgs,
@@ -110966,7 +111037,7 @@ var codex = agent({
 import { spawn as nodeSpawn2 } from "node:child_process";
 import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync6 } from "node:fs";
 import { totalmem } from "node:os";
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 import { performance as performance7 } from "node:perf_hooks";
 
 // node_modules/.pnpm/@opencode-ai+sdk@1.18.29/node_modules/@opencode-ai/sdk/dist/v2/gen/core/serverSentEvents.gen.js
@@ -116375,200 +116446,27 @@ var import_cross_spawn = __toESM(require_cross_spawn(), 1);
 // agents/opencode.ts
 var import_undici = __toESM(require_undici2(), 1);
 
-// utils/worktree.ts
-async function dirtyTrackedPaths(params = {}) {
-  const result = await spawn({
-    cmd: "git",
-    args: ["diff", "--name-only", "HEAD"],
-    env: process.env,
-    cwd: params.cwd ?? process.cwd(),
-    activityTimeout: 0
-  });
-  if (result.exitCode !== 0) {
-    throw new Error(
-      `git diff --name-only HEAD failed (exit ${result.exitCode}): ${result.stderr.trim() || "(no stderr)"}`
-    );
-  }
-  return new Set(result.stdout.split("\n").filter(Boolean));
-}
-async function restoreDirtiedSince(params) {
-  const dirtied = [...await dirtyTrackedPaths({ cwd: params.cwd ?? process.cwd() })].filter(
-    (path4) => !params.before.has(path4)
-  );
-  if (dirtied.length === 0) return;
-  const result = await spawn({
-    cmd: "git",
-    args: ["restore", "--staged", "--worktree", "--", ...dirtied],
-    env: process.env,
-    cwd: params.cwd ?? process.cwd(),
-    activityTimeout: 0
-  });
-  if (result.exitCode !== 0) {
-    log.warning(
-      `\xBB failed to restore ${dirtied.length} tracked file(s) modified by ${params.actor}: ${result.stderr.trim() || "(no stderr)"}`
-    );
-    return;
-  }
-  log.info(
-    `\xBB restored ${dirtied.length} tracked file(s) modified by ${params.actor}: ${dirtied.join(", ")}`
-  );
-}
-
-// agents/opencodePlugin.ts
-var PULLFROG_BUS_EVENT_TYPE = "pullfrog_bus_event";
-var PULLFROG_OPENCODE_GATE_PLUGIN_FILENAME = "pullfrog-subagent-gate.ts";
-var PULLFROG_OPENCODE_PLUGIN_SOURCE = `// AUTOGENERATED by Pullfrog. do not edit; it'll be overwritten on the next run.
-// surfaces opencode subagent activity that the CLI's run-loop discards. see
-// action/agents/opencodePlugin.ts in pullfrog/app for why this exists. lives
-// inside the per-run tmpdir (XDG_CONFIG_HOME/opencode/plugin/), never inside
-// the user's working tree. the subagent gate ships as a separate plugin
-// (pullfrog-subagent-gate.ts).
-
-const PULLFROG_BUS_EVENT_TYPE = ${JSON.stringify(PULLFROG_BUS_EVENT_TYPE)};
-
-// orchestratorSessionID locks to the first sessionID we observe on the bus
-// (\`message.part.updated\`). opencode's run command creates exactly one
-// top-level session before any subagent is dispatched, and the orchestrator
-// emits at least one event before any subagent does \u2014 so first-seen-wins
-// captures the orchestrator; every subagent part has a non-matching
-// sessionID.
-let orchestratorSessionID: string | undefined;
-
-function isOrchestratorTaskDispatch(part: {
-  type?: string;
-  tool?: string;
-  state?: { status?: string };
-} | undefined): boolean {
-  if (!part || part.type !== "tool") return false;
-  if (part.tool !== "task") return false;
-  // only forward at status="running" (not "pending"). at pending the
-  // state.input is still {} \u2014 the orchestrator has emitted the part shell
-  // but the LLM hasn't filled in description/subagent_type/prompt yet. by
-  // running, input is populated and recordTaskDispatch can derive the lens
-  // label correctly.
-  return part.state?.status === "running";
-}
-
-export default async function pullfrogEventsPlugin() {
-  return {
-    event: async (input: {
-      event: {
-        type: string;
-        properties?: {
-          part?: {
-            sessionID?: string;
-            type?: string;
-            tool?: string;
-            state?: { status?: string };
-          };
-        };
-      };
-    }) => {
-      const event = input?.event;
-      if (!event || typeof event !== "object") return;
-      if (event.type !== "message.part.updated") return;
-      const part = event.properties?.part;
-      const sessionID = part?.sessionID;
-      if (typeof sessionID !== "string" || sessionID.length === 0) return;
-      if (orchestratorSessionID === undefined) orchestratorSessionID = sessionID;
-
-      if (sessionID === orchestratorSessionID) {
-        // skip orchestrator events EXCEPT early task dispatches.
-        if (!isOrchestratorTaskDispatch(part)) return;
-      }
-
-      try {
-        const line = JSON.stringify({
-          type: PULLFROG_BUS_EVENT_TYPE,
-          bus_event: event,
-        });
-        process.stdout.write(line + "\\n");
-      } catch {
-        // a circular reference or BigInt etc. would throw; swallow rather
-        // than letting a single bad event take down the plugin.
-      }
-    },
-  };
-}
-`;
-function buildOpencodeSubagentGateSource(deniedTools) {
-  return `// AUTOGENERATED by Pullfrog. do not edit; it'll be overwritten on the next run.
-// hard-blocks state-mutating MCP tool calls from opencode subagents (PR
-// following pullfrog/app#796 \u2014 see action/agents/subagentToolGates.ts). see
-// action/agents/opencodePlugin.ts in pullfrog/app for why this exists. lives
-// inside the per-run tmpdir (XDG_CONFIG_HOME/opencode/plugin/), never inside
-// the user's working tree.
-
-// embedded at template-render time so the plugin source has no imports. the
-// denied set is derived from each tool's \`mutates\` flag \u2014 see
-// action/agents/subagentToolGates.ts.
-const SUBAGENT_DENIED_TOOLS = new Set(${JSON.stringify(deniedTools)});
-
-// opencode presents MCP tools as \`pullfrog_<bare>\`; strip that to compare
-// against the canonical bare names in SUBAGENT_DENIED_TOOLS. native tools
-// (read, write, bash, task, etc.) lack the prefix and never match the deny
-// list anyway.
-function stripPullfrogPrefix(toolName: string): string {
-  if (toolName.startsWith("pullfrog_")) return toolName.slice("pullfrog_".length);
-  return toolName;
-}
-
-// orchestratorSessionID locks to the first sessionID we observe on
-// \`tool.execute.before\`. the orchestrator must invoke a tool (e.g. its
-// \`task\` dispatch) before any subagent session exists, so first-seen-wins
-// always captures the orchestrator; every subagent call therefore has a
-// non-matching sessionID and is subject to the deny check.
-let orchestratorSessionID: string | undefined;
-
-export default async function pullfrogSubagentGatePlugin() {
-  return {
-    "tool.execute.before": async (
-      input: { tool?: string; sessionID?: string; callID?: string },
-      _output: { args?: Record<string, unknown> }
-    ) => {
-      // input: { tool, sessionID, callID } \u2014 confirmed against
-      // anomalyco/opencode packages/opencode/src/session/tools.ts which
-      // calls plugin.trigger("tool.execute.before", { tool, sessionID,
-      // callID }, { args }). throwing here surfaces as a tool error to the
-      // model (Effect's run.promise propagates the rejection through the
-      // AI SDK's tool-runtime), so the subagent sees a denial and can
-      // pick a different action.
-      const sessionID = typeof input?.sessionID === "string" ? input.sessionID : "";
-      const tool = typeof input?.tool === "string" ? input.tool : "";
-      // above the sessionID check: the bash block must never depend on a
-      // session id being present.
-      if (tool === "bash") {
-        throw new Error("the native bash tool is disabled in Pullfrog runs.");
-      }
-      if (!sessionID || !tool) return;
-      if (orchestratorSessionID === undefined) orchestratorSessionID = sessionID;
-      if (sessionID === orchestratorSessionID) return;
-      const bare = stripPullfrogPrefix(tool);
-      if (!SUBAGENT_DENIED_TOOLS.has(bare)) return;
-      throw new Error(
-        "subagent attempted to call denied tool '" + bare + "'. " +
-        "subagents share the orchestrator's in-process working tree and toolState; " +
-        "state-changing MCP tools (checkout_pr, push_branch, create_pull_request_review, " +
-        "report_progress, etc.) are reserved for the orchestrator. " +
-        "report findings back to the orchestrator and let it perform the mutation."
-      );
-    },
-  };
-}
-`;
-}
-
 // utils/openCodeModels.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
+import { join as join7 } from "node:path";
 var baseline;
 var authorized;
 var failure;
 var ANSI_PATTERN = /\[[0-9;]*m/g;
-function readModels(cliPath) {
-  const result = spawnSync3(cliPath, ["models"], {
+function openCodeHomeEnv(tmpdir3) {
+  return {
+    HOME: tmpdir3,
+    XDG_CONFIG_HOME: join7(tmpdir3, ".config"),
+    XDG_DATA_HOME: getSubscriptionDataHome() ?? join7(tmpdir3, ".local", "share"),
+    XDG_CACHE_HOME: join7(tmpdir3, ".cache"),
+    XDG_STATE_HOME: join7(tmpdir3, ".local", "state")
+  };
+}
+function readModels(params) {
+  const result = spawnSync3(params.cliPath, ["models"], {
     encoding: "utf-8",
     timeout: 3e4,
-    env: process.env,
+    env: { ...process.env, ...openCodeHomeEnv(params.tmpdir) },
     stdio: ["ignore", "pipe", "pipe"]
   });
   if (result.status !== 0) {
@@ -116585,12 +116483,12 @@ function readModels(cliPath) {
 function getModelsFailure() {
   return failure;
 }
-function captureBaselineModels(cliPath) {
-  baseline = readModels(cliPath);
+function captureBaselineModels(params) {
+  baseline = readModels(params);
   log.debug(`\xBB opencode baseline: ${baseline.size} models`);
 }
-function captureAuthorizedModels(cliPath) {
-  authorized = readModels(cliPath);
+function captureAuthorizedModels(params) {
+  authorized = readModels(params);
   const base = baseline;
   if (base) {
     const diff = [...authorized].filter((m) => !base.has(m));
@@ -116610,6 +116508,190 @@ function getAuthorizedModels() {
   return authorized;
 }
 
+// utils/worktree.ts
+async function dirtyTrackedPaths(params = {}) {
+  const result = await spawn({
+    cmd: "git",
+    args: ["diff", "--name-only", "HEAD"],
+    env: process.env,
+    cwd: params.cwd ?? process.cwd(),
+    activityTimeout: 0
+  });
+  if (result.exitCode !== 0) {
+    throw new Error(
+      `git diff --name-only HEAD failed (exit ${result.exitCode}): ${result.stderr.trim() || "(no stderr)"}`
+    );
+  }
+  return new Set(result.stdout.split("\n").filter(Boolean));
+}
+async function restoreDirtiedSince(params) {
+  const dirtied = [...await dirtyTrackedPaths({ cwd: params.cwd ?? process.cwd() })].filter(
+    (path4) => !params.before.has(path4)
+  );
+  if (dirtied.length === 0) return;
+  const result = await spawn({
+    cmd: "git",
+    args: ["restore", "--staged", "--worktree", "--", ...dirtied],
+    env: process.env,
+    cwd: params.cwd ?? process.cwd(),
+    activityTimeout: 0
+  });
+  if (result.exitCode !== 0) {
+    log.warning(
+      `\xBB failed to restore ${dirtied.length} tracked file(s) modified by ${params.actor}: ${result.stderr.trim() || "(no stderr)"}`
+    );
+    return;
+  }
+  log.info(
+    `\xBB restored ${dirtied.length} tracked file(s) modified by ${params.actor}: ${dirtied.join(", ")}`
+  );
+}
+
+// agents/opencodePlugin.ts
+var PULLFROG_BUS_EVENT_TYPE = "pullfrog_bus_event";
+var PULLFROG_OPENCODE_GATE_PLUGIN_FILENAME = "pullfrog-subagent-gate.ts";
+var PULLFROG_OPENCODE_PLUGIN_SOURCE = `// AUTOGENERATED by Pullfrog. do not edit; it'll be overwritten on the next run.
+// surfaces opencode subagent activity that the CLI's run-loop discards. see
+// action/agents/opencodePlugin.ts in pullfrog/app for why this exists. lives
+// inside the per-run tmpdir (XDG_CONFIG_HOME/opencode/plugin/), never inside
+// the user's working tree. the subagent gate ships as a separate plugin
+// (pullfrog-subagent-gate.ts).
+
+const PULLFROG_BUS_EVENT_TYPE = ${JSON.stringify(PULLFROG_BUS_EVENT_TYPE)};
+
+// orchestratorSessionID locks to the first sessionID we observe on the bus
+// (\`message.part.updated\`). opencode's run command creates exactly one
+// top-level session before any subagent is dispatched, and the orchestrator
+// emits at least one event before any subagent does \u2014 so first-seen-wins
+// captures the orchestrator; every subagent part has a non-matching
+// sessionID.
+let orchestratorSessionID: string | undefined;
+
+function isOrchestratorTaskDispatch(part: {
+  type?: string;
+  tool?: string;
+  state?: { status?: string };
+} | undefined): boolean {
+  if (!part || part.type !== "tool") return false;
+  if (part.tool !== "task") return false;
+  // only forward at status="running" (not "pending"). at pending the
+  // state.input is still {} \u2014 the orchestrator has emitted the part shell
+  // but the LLM hasn't filled in description/subagent_type/prompt yet. by
+  // running, input is populated and recordTaskDispatch can derive the lens
+  // label correctly.
+  return part.state?.status === "running";
+}
+
+export default async function pullfrogEventsPlugin() {
+  return {
+    event: async (input: {
+      event: {
+        type: string;
+        properties?: {
+          part?: {
+            sessionID?: string;
+            type?: string;
+            tool?: string;
+            state?: { status?: string };
+          };
+        };
+      };
+    }) => {
+      const event = input?.event;
+      if (!event || typeof event !== "object") return;
+      if (event.type !== "message.part.updated") return;
+      const part = event.properties?.part;
+      const sessionID = part?.sessionID;
+      if (typeof sessionID !== "string" || sessionID.length === 0) return;
+      if (orchestratorSessionID === undefined) orchestratorSessionID = sessionID;
+
+      if (sessionID === orchestratorSessionID) {
+        // skip orchestrator events EXCEPT early task dispatches.
+        if (!isOrchestratorTaskDispatch(part)) return;
+      }
+
+      try {
+        const line = JSON.stringify({
+          type: PULLFROG_BUS_EVENT_TYPE,
+          bus_event: event,
+        });
+        process.stdout.write(line + "\\n");
+      } catch {
+        // a circular reference or BigInt etc. would throw; swallow rather
+        // than letting a single bad event take down the plugin.
+      }
+    },
+  };
+}
+`;
+function buildOpencodeSubagentGateSource(ctx) {
+  const bashRefusal = ctx.payload.shell === "disabled" ? "shell execution is disabled for this run and no shell tool exists \u2014 use read, grep and glob instead." : `native bash is disabled in Pullfrog runs \u2014 call ${formatMcpToolRef("opencode", "shell")} with the same command instead.`;
+  return `// AUTOGENERATED by Pullfrog. do not edit; it'll be overwritten on the next run.
+// hard-blocks state-mutating MCP tool calls from opencode subagents (PR
+// following pullfrog/app#796 \u2014 see action/agents/subagentToolGates.ts). see
+// action/agents/opencodePlugin.ts in pullfrog/app for why this exists. lives
+// inside the per-run tmpdir (XDG_CONFIG_HOME/opencode/plugin/), never inside
+// the user's working tree.
+
+// embedded at template-render time so the plugin source has no imports. the
+// denied set is derived from each tool's \`mutates\` flag \u2014 see
+// action/agents/subagentToolGates.ts.
+const SUBAGENT_DENIED_TOOLS = new Set(${JSON.stringify(ctx.subagentDeniedTools)});
+
+// opencode presents MCP tools as \`pullfrog_<bare>\`; strip that to compare
+// against the canonical bare names in SUBAGENT_DENIED_TOOLS. native tools
+// (read, write, bash, task, etc.) lack the prefix and never match the deny
+// list anyway.
+function stripPullfrogPrefix(toolName: string): string {
+  if (toolName.startsWith("pullfrog_")) return toolName.slice("pullfrog_".length);
+  return toolName;
+}
+
+// orchestratorSessionID locks to the first sessionID we observe on
+// \`tool.execute.before\`. the orchestrator must invoke a tool (e.g. its
+// \`task\` dispatch) before any subagent session exists, so first-seen-wins
+// always captures the orchestrator; every subagent call therefore has a
+// non-matching sessionID and is subject to the deny check.
+let orchestratorSessionID: string | undefined;
+
+export default async function pullfrogSubagentGatePlugin() {
+  return {
+    "tool.execute.before": async (
+      input: { tool?: string; sessionID?: string; callID?: string },
+      _output: { args?: Record<string, unknown> }
+    ) => {
+      // input: { tool, sessionID, callID } \u2014 confirmed against
+      // anomalyco/opencode packages/opencode/src/session/tools.ts which
+      // calls plugin.trigger("tool.execute.before", { tool, sessionID,
+      // callID }, { args }). throwing here surfaces as a tool error to the
+      // model (Effect's run.promise propagates the rejection through the
+      // AI SDK's tool-runtime), so the subagent sees a denial and can
+      // pick a different action.
+      const sessionID = typeof input?.sessionID === "string" ? input.sessionID : "";
+      const tool = typeof input?.tool === "string" ? input.tool : "";
+      // above the sessionID check: the bash block must never depend on a
+      // session id being present.
+      if (tool === "bash") {
+        throw new Error(${JSON.stringify(bashRefusal)});
+      }
+      if (!sessionID || !tool) return;
+      if (orchestratorSessionID === undefined) orchestratorSessionID = sessionID;
+      if (sessionID === orchestratorSessionID) return;
+      const bare = stripPullfrogPrefix(tool);
+      if (!SUBAGENT_DENIED_TOOLS.has(bare)) return;
+      throw new Error(
+        "subagent attempted to call denied tool '" + bare + "'. " +
+        "subagents share the orchestrator's in-process working tree and toolState; " +
+        "state-changing MCP tools (checkout_pr, push_branch, create_pull_request_review, " +
+        "report_progress, etc.) are reserved for the orchestrator. " +
+        "report findings back to the orchestrator and let it perform the mutation."
+      );
+    },
+  };
+}
+`;
+}
+
 // agents/subagentModels.ts
 function deriveSubagentModels(orchestratorSpec) {
   if (!orchestratorSpec) return { reviewer: void 0 };
@@ -116984,6 +117066,7 @@ async function dispatchEvent(ctx, event) {
     const err = event.properties.error;
     const message = err ? extractErrorMessage(err) : "(no error payload)";
     log.info(`\xBB ${ctx.label} session error: ${message}`);
+    if (err) ctx.lastSessionError = message;
     return;
   }
 }
@@ -117122,6 +117205,7 @@ async function runPromptTurn(ctx, params) {
   ctx.promptMessageID = void 0;
   ctx.diagnostic.sawModelOutput = false;
   ctx.diagnostic.idleSec = void 0;
+  ctx.lastSessionError = void 0;
   let assistant;
   let returnedParts;
   let networkError = null;
@@ -117166,11 +117250,12 @@ async function runPromptTurn(ctx, params) {
   }
   const cause = ctx.serverExitCause() ?? ctx.diagnostic.lastProviderError;
   const diagnosis = cause ? ` \u2014 likely cause: ${cause}` : "";
+  const promptCause = ctx.serverExitCause() ?? (ctx.diagnostic.sawModelOutput ? void 0 : ctx.lastSessionError) ?? ctx.diagnostic.lastProviderError;
   if (networkError) {
     return {
       success: false,
       output: finalText,
-      error: params.signal.aborted ? `activity timeout: the model went silent and the turn was aborted by the activity watchdog (${networkError})${diagnosis}` : `opencode prompt failed: ${networkError}${diagnosis}`,
+      error: params.signal.aborted ? `activity timeout: the model went silent and the turn was aborted by the activity watchdog (${networkError})${diagnosis}` : `opencode prompt failed: ${networkError}${promptCause ? ` \u2014 likely cause: ${promptCause}` : ""}`,
       usage
     };
   }
@@ -117362,15 +117447,14 @@ var opencode = agent({
     const isBedrockRoute = rawModel !== void 0 && bedrockModelId !== void 0 && bedrockModelId === rawModel;
     const vertexModel = resolveVertexOpenCodeModel(rawModel);
     const model = vertexModel ?? (isBedrockRoute ? `amazon-bedrock/${rawModel}` : rawModel);
-    const homeEnv = {
-      HOME: ctx.tmpdir,
-      XDG_CONFIG_HOME: join7(ctx.tmpdir, ".config")
-    };
-    const opencodePluginDir = join7(homeEnv.XDG_CONFIG_HOME, "opencode", "plugin");
+    const codexAuth = installCodexAuth();
+    const xaiAuth = installXaiAuth();
+    const homeEnv = openCodeHomeEnv(ctx.tmpdir);
+    const opencodePluginDir = join8(homeEnv.XDG_CONFIG_HOME, "opencode", "plugin");
     mkdirSync7(opencodePluginDir, { recursive: true });
     writeFileSync6(
-      join7(opencodePluginDir, PULLFROG_OPENCODE_GATE_PLUGIN_FILENAME),
-      buildOpencodeSubagentGateSource(ctx.subagentDeniedTools)
+      join8(opencodePluginDir, PULLFROG_OPENCODE_GATE_PLUGIN_FILENAME),
+      buildOpencodeSubagentGateSource(ctx)
     );
     const agentBrowserVersion = getDevDependencyVersion("agent-browser");
     addSkill({
@@ -117380,8 +117464,6 @@ var opencode = agent({
       agent: "opencode"
     });
     installBundledSkills({ home: homeEnv.HOME });
-    const codexAuth = installCodexAuth();
-    const xaiAuth = installXaiAuth();
     const permissionOverride = JSON.stringify({
       external_directory: { "*": "deny", "/tmp/*": "allow" },
       read: { "*": "allow", ...GIT_NATIVE_READ_DENY_OPENCODE },
@@ -117400,7 +117482,6 @@ var opencode = agent({
     delete env2.OPENCODE_EXPERIMENTAL_CODE_MODE;
     const writebacks = [];
     if (codexAuth) {
-      env2.XDG_DATA_HOME = codexAuth.xdgDataHome;
       delete env2.OPENAI_API_KEY;
       writebacks.push({
         secretName: "CODEX_AUTH_JSON",
@@ -117411,7 +117492,6 @@ var opencode = agent({
       });
     }
     if (xaiAuth) {
-      env2.XDG_DATA_HOME = xaiAuth.xdgDataHome;
       delete env2.XAI_API_KEY;
       writebacks.push({
         secretName: "GROK_AUTH_JSON",
@@ -117484,6 +117564,7 @@ var opencode = agent({
         mcpToolCalls: 0,
         recentStderr: server.recentStderr,
         serverExitCause: server.exitCause,
+        lastSessionError: void 0,
         diagnostic: {
           label: "Pullfrog",
           recentStderr: server.recentStderr,
@@ -172402,7 +172483,7 @@ function closeBrowserDaemon(toolState) {
 // mcp/checkout.ts
 import { createHash as createHash2 } from "node:crypto";
 import { statSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 
 // node_modules/.pnpm/@ark+schema@0.56.0/node_modules/@ark/schema/out/shared/errors.js
 var ArkError = class _ArkError extends CastableBase {
@@ -180773,13 +180854,14 @@ function ensureRepoState(toolState, init) {
 // utils/changeImpact.ts
 import { spawn as spawn2 } from "node:child_process";
 import { writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 var MAX_CANDIDATES = 24;
 var MAX_ATOM_LENGTH = 128;
 var MAX_ATOMS = 12;
 var MAX_REFERENCES = 6;
 var MAX_EXCERPT = 160;
 var MAX_BYTES = 16e3;
+var LOOKUP_BUDGET_MS = 6e4;
 function isSymbolShaped(atom) {
   return atom.length >= 4 && atom.length <= MAX_ATOM_LENGTH && /[A-Z_]/.test(atom);
 }
@@ -180982,7 +181064,7 @@ function consumeGrepChunk(params) {
 async function lookupReferences(params) {
   const buckets = emptyBuckets(params.candidates);
   if (params.candidates.length === 0) return { buckets, error: void 0 };
-  const patterns = params.candidates.flatMap((candidate) => ["-e", candidate.atom]);
+  const pattern = params.candidates.map((candidate) => candidate.atom).join("|");
   const child = spawn2(
     "git",
     [
@@ -180993,13 +181075,14 @@ async function lookupReferences(params) {
       "-z",
       "-I",
       "-w",
-      "-F",
-      ...patterns,
+      "-E",
+      "-e",
+      pattern,
       params.treeish,
       "--",
       ":(top)"
     ],
-    { env: resolveEnv(void 0), stdio: ["ignore", "pipe", "pipe"] }
+    { env: resolveEnv(void 0), stdio: ["ignore", "pipe", "pipe"], signal: params.signal }
   );
   const state = createGrepRecordState();
   const maxAtomLength = Math.max(...params.candidates.map((candidate) => candidate.atom.length));
@@ -181019,7 +181102,7 @@ async function lookupReferences(params) {
   child.stderr.resume();
   const status = await new Promise((resolve3) => {
     child.once("error", (error49) => {
-      spawnError = error49.message;
+      spawnError = error49.cause instanceof Error ? error49.cause.message : error49.message;
       resolve3(null);
     });
     child.once("close", resolve3);
@@ -181107,8 +181190,10 @@ async function createChangeImpactArtifact(ctx, params) {
   const lookup2 = await lookupReferences({
     candidates: candidates.selected,
     addedLines: candidates.addedLines,
-    treeish: params.headSha
+    treeish: params.headSha,
+    signal: AbortSignal.any([params.signal, AbortSignal.timeout(LOOKUP_BUDGET_MS)])
   });
+  params.signal.throwIfAborted();
   const artifact = formatArtifact({
     entries: candidates.selected.map((change) => {
       return { change, bucket: lookup2.buckets.get(change.atom) ?? { count: 0, samples: [] } };
@@ -181120,7 +181205,7 @@ async function createChangeImpactArtifact(ctx, params) {
     headSha: params.headSha,
     lookupError: lookup2.error
   });
-  const path4 = join8(ctx.tmpdir, `pr-${params.pullNumber}-${params.headSha.slice(0, 7)}-impact.md`);
+  const path4 = join9(ctx.tmpdir, `pr-${params.pullNumber}-${params.headSha.slice(0, 7)}-impact.md`);
   writeFileSync7(path4, artifact.content);
   return {
     path: path4,
@@ -181374,7 +181459,7 @@ function readNumber(params) {
 import { execSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { readFileSync as readFileSync4, realpathSync, unlinkSync } from "node:fs";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 
 // utils/shell.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
@@ -181464,7 +181549,7 @@ function resolveHooksDir(cwd, gitPath) {
     cwd,
     log: false
   }).trim();
-  const hooksDir = join9(commonDir, "hooks");
+  const hooksDir = join10(commonDir, "hooks");
   hooksDirCache.set(cwd, hooksDir);
   return hooksDir;
 }
@@ -181511,7 +181596,8 @@ async function $git(subcommand, args2, options) {
         GIT_CONFIG_COUNT: "0",
         GIT_CONFIG_PARAMETERS: ""
       },
-      activityTimeout: 0
+      activityTimeout: 0,
+      signal: options.signal
     });
     if (result.stderr.includes("askpass-compromised")) {
       log.info("askpass code was replayed after revoke \u2014 token has been revoked");
@@ -181578,9 +181664,10 @@ import { spawnSync as spawnSync7 } from "node:child_process";
 // mcp/shell.ts
 import { spawn as spawn3, spawnSync as spawnSync6 } from "node:child_process";
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { closeSync, openSync, writeFileSync as writeFileSync8 } from "node:fs";
+import { once } from "node:events";
+import { closeSync, existsSync as existsSync7, openSync, writeFileSync as writeFileSync8 } from "node:fs";
 import { userInfo as userInfo2 } from "node:os";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 import { setTimeout as sleep3 } from "node:timers/promises";
 
 // node_modules/.pnpm/@toon-format+toon@1.4.0/node_modules/@toon-format/toon/dist/index.mjs
@@ -182224,7 +182311,7 @@ function buildFsMounts(repoDir) {
 function shimMount() {
   const tempDir = process.env.PULLFROG_TEMP_DIR;
   if (!tempDir) return "";
-  const dir = join10(tempDir, "pm-bin").replace(/'/g, "'\\''");
+  const dir = join11(tempDir, "pm-bin").replace(/'/g, "'\\''");
   return `[ -d '${dir}' ] && mount --bind '${dir}' '${dir}' 2>/dev/null && mount -o remount,bind,ro '${dir}' 2>/dev/null;`;
 }
 var _repoRoot;
@@ -182395,7 +182482,7 @@ ${spawnError}` : spawnError;
 }
 function capOutput(output) {
   if (output.length <= MAX_OUTPUT_CHARS) return output;
-  const fullPath = join10(getTempDir(), `shell-${randomUUID3().slice(0, 8)}.log`);
+  const fullPath = join11(getTempDir(), `shell-${randomUUID3().slice(0, 8)}.log`);
   writeFileSync8(fullPath, output);
   const elided = output.length - MAX_OUTPUT_CHARS;
   return `... [${elided} chars truncated; output saved to ${fullPath}] ...
@@ -182432,6 +182519,7 @@ Do NOT use this tool for git commands \u2014 use the dedicated git tools instead
       }
       const timeout = Math.min(params.timeout ?? 3e4, 12e4);
       const cwd = params.working_directory ?? process.cwd();
+      if (!existsSync7(cwd)) throw new Error(`working_directory does not exist: ${cwd}`);
       const env2 = resolveEnv(ctx.payload.shell === "enabled" ? "inherit" : "restricted");
       if (params.command.includes("agent-browser")) {
         const daemonError = ensureBrowserDaemon(ctx.toolState);
@@ -182450,8 +182538,8 @@ Do NOT use this tool for git commands \u2014 use the dedicated git tools instead
       if (params.background) {
         const tempDir = getTempDir();
         const handle = `bg-${randomUUID3().slice(0, 8)}`;
-        const outputPath = join10(tempDir, `${handle}.log`);
-        const pidPath = join10(tempDir, `${handle}.pid`);
+        const outputPath = join11(tempDir, `${handle}.log`);
+        const pidPath = join11(tempDir, `${handle}.pid`);
         const logFd = openSync(outputPath, "a");
         let proc;
         try {
@@ -182465,7 +182553,8 @@ Do NOT use this tool for git commands \u2014 use the dedicated git tools instead
           closeSync(logFd);
         }
         if (!proc.pid) {
-          throw new Error("failed to start background process");
+          const [error49] = await once(proc, "error");
+          throw new Error(`failed to start background process: ${error49.message}`);
         }
         proc.unref();
         writeFileSync8(pidPath, `${proc.pid}
@@ -182742,12 +182831,12 @@ function postProcessRangeDiff(raw2, contextLines = 3) {
 // mcp/git.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 
 // utils/apiCommit.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { lstat, readlink } from "node:fs/promises";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 var GITHUB_API = "https://api.github.com";
 var MAX_BLOB_BYTES = 30 * 1024 * 1024;
 var BLOB_UPLOAD_CONCURRENCY = 8;
@@ -182812,7 +182901,7 @@ async function assertApiCommittable(files) {
   const root = getRepoRoot();
   const attrs = $(
     "git",
-    ["check-attr", "filter", "-z", "--", ...present.map((p) => join11(root, p))],
+    ["check-attr", "filter", "-z", "--", ...present.map((p) => join12(root, p))],
     { log: false }
   );
   const parts = attrs.split("\0");
@@ -182824,7 +182913,7 @@ async function assertApiCommittable(files) {
     }
   }
   for (const path4 of present) {
-    const stat = await lstat(join11(root, path4));
+    const stat = await lstat(join12(root, path4));
     if (stat.isDirectory()) {
       throw new Error(
         `'${path4}' is a directory (nested repository or submodule?) \u2014 signed commits only support files and symlinks.`
@@ -182833,7 +182922,7 @@ async function assertApiCommittable(files) {
   }
 }
 async function createBlobEntry(params) {
-  const absPath = join11(params.repoRoot, params.path);
+  const absPath = join12(params.repoRoot, params.path);
   const stat = await lstat(absPath);
   if (stat.size > MAX_BLOB_BYTES) {
     throw new Error(
@@ -183013,7 +183102,7 @@ this usually means your local branch has commits that were never pushed \u2014 s
 var core4 = __toESM(require_core(), 1);
 import { createSign } from "node:crypto";
 import { rename, writeFile } from "node:fs/promises";
-import { dirname as dirname3, join as join12 } from "node:path";
+import { dirname as dirname3, join as join13 } from "node:path";
 
 // node_modules/.pnpm/@octokit+plugin-throttling@11.0.5_@octokit+core@7.0.8/node_modules/@octokit/plugin-throttling/dist-bundle/index.js
 var import_light = __toESM(require_light(), 1);
@@ -187562,7 +187651,7 @@ function getGitHubUsageSummary() {
 }
 async function writeGitHubUsageSummaryToFile(path4) {
   const summary2 = getGitHubUsageSummary();
-  const tmpPath = join12(dirname3(path4), `.usage-summary-${process.pid}.tmp`);
+  const tmpPath = join13(dirname3(path4), `.usage-summary-${process.pid}.tmp`);
   await writeFile(tmpPath, JSON.stringify(summary2));
   await rename(tmpPath, path4);
 }
@@ -188190,7 +188279,7 @@ function countAhead(head, base, cwd) {
 function spillGitOutput(params) {
   const tempDir = process.env.PULLFROG_TEMP_DIR;
   if (!tempDir) throw new Error("PULLFROG_TEMP_DIR not set");
-  const outputPath = join13(tempDir, `git-${params.command}-${randomUUID4().slice(0, 8)}.txt`);
+  const outputPath = join14(tempDir, `git-${params.command}-${randomUUID4().slice(0, 8)}.txt`);
   writeFileSync9(outputPath, params.output);
   const previewByLines = params.output.split("\n").slice(0, OVERFLOW_PREVIEW_LINES).join("\n");
   const preview = previewByLines.length <= OVERFLOW_PREVIEW_MAX_CHARS ? previewByLines : `${previewByLines.slice(0, OVERFLOW_PREVIEW_MAX_CHARS)}\u2026`;
@@ -189845,11 +189934,11 @@ async function reportReviewNodeId(ctx, params) {
 
 // utils/setup.ts
 import { execFileSync as execFileSync6, execSync as execSync2 } from "node:child_process";
-import { mkdtempSync, readdirSync, realpathSync as realpathSync2, rmSync as rmSync2, unlinkSync as unlinkSync2 } from "node:fs";
+import { mkdtempSync as mkdtempSync2, readdirSync, realpathSync as realpathSync2, rmSync as rmSync2, unlinkSync as unlinkSync2 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 function createTempDirectory() {
-  const path4 = mkdtempSync(join14(tmpdir2(), "pullfrog-"));
+  const path4 = mkdtempSync2(join15(tmpdir2(), "pullfrog-"));
   process.env.PULLFROG_TEMP_DIR = path4;
   log.info(`\xBB created temp dir at ${path4}`);
   return { path: path4, [Symbol.dispose]: () => removeTempDirectory(path4) };
@@ -189909,13 +189998,13 @@ function wipeRunnerLeakSurface() {
       return [];
     }
   };
-  const fileCommandsDir = join14(runnerTemp, "_runner_file_commands");
+  const fileCommandsDir = join15(runnerTemp, "_runner_file_commands");
   for (const entry of listDir(fileCommandsDir)) {
-    tryUnlink(join14(fileCommandsDir, entry));
+    tryUnlink(join15(fileCommandsDir, entry));
   }
   for (const entry of listDir(runnerTemp)) {
     if (entry.endsWith(".sh") || /^git-credentials-.*\.config$/.test(entry)) {
-      tryUnlink(join14(runnerTemp, entry));
+      tryUnlink(join15(runnerTemp, entry));
     }
   }
   if (wiped.length > 0) {
@@ -190187,7 +190276,7 @@ async function ensureBeforeShaReachable(params) {
           "origin",
           tempBranch
         ],
-        { token: params.gitToken, refreshGitToken: params.refreshGitToken },
+        { token: params.gitToken, refreshGitToken: params.refreshGitToken, signal: params.signal },
         `before_sha temp branch ${tempBranch}`
       );
       log.debug(`\xBB fetched before_sha via temp branch ${tempBranch}`);
@@ -190228,7 +190317,7 @@ function cleanupStaleGitLocks() {
     } catch {
       continue;
     }
-    if (now - mtimeMs < STALE_LOCK_AGE_MS) continue;
+    if (now - mtimeMs < STALE_LOCK_AGE_MS || mtimeMs >= performance.timeOrigin) continue;
     try {
       unlinkSync3(relPath);
       log.warning(`\xBB removed stale ${relPath} from prior run`);
@@ -190261,7 +190350,7 @@ async function abortIfPullRequestMoved(args2) {
   );
 }
 async function checkoutPrBranch(pr, params) {
-  const { octokit, owner, name, gitToken, refreshGitToken, toolState, beforeSha } = params;
+  const { octokit, owner, name, gitToken, refreshGitToken, toolState, beforeSha, signal } = params;
   rejectIfLeadingDash(pr.baseRef, "PR base ref");
   rejectIfLeadingDash(pr.headRef, "PR head ref");
   const repoState = requireRepoState(toolState, owner, name);
@@ -190275,7 +190364,7 @@ async function checkoutPrBranch(pr, params) {
   log.debug(`\xBB fetching base branch (${pr.baseRef})...`);
   await $gitFetchWithDeepen(
     ["--no-tags", "origin", pr.baseRef],
-    { token: gitToken, refreshGitToken },
+    { token: gitToken, refreshGitToken, signal },
     `base branch ${pr.baseRef}`
   );
   if (!alreadyOnBranch) {
@@ -190286,7 +190375,7 @@ async function checkoutPrBranch(pr, params) {
         try {
           await $gitFetchWithDeepen(
             ["--no-tags", "origin", `+pull/${pr.number}/head:${localBranch}`],
-            { token: gitToken, refreshGitToken },
+            { token: gitToken, refreshGitToken, signal },
             `PR #${pr.number}`
           );
         } catch (e) {
@@ -190311,7 +190400,8 @@ async function checkoutPrBranch(pr, params) {
     repo: name,
     gitToken,
     refreshGitToken,
-    isShallow
+    isShallow,
+    signal
   }) : false;
   if (isShallow) {
     let deepenDepth = 0;
@@ -190346,7 +190436,8 @@ async function checkoutPrBranch(pr, params) {
     if (deepenDepth) {
       log.debug(`\xBB deepening by ${deepenDepth} to reach merge base...`);
       await $git("fetch", [`--deepen=${deepenDepth}`, "--no-tags", "origin"], {
-        token: gitToken
+        token: gitToken,
+        signal
       });
     }
   }
@@ -190384,6 +190475,7 @@ async function checkoutPrBranch(pr, params) {
     remoteBranch: pr.headRef,
     localBranch
   };
+  signal.throwIfAborted();
   const postCheckoutHook = await executeLifecycleHook({
     event: "post-checkout",
     script: params.postCheckoutScript,
@@ -190394,19 +190486,30 @@ async function checkoutPrBranch(pr, params) {
 }
 var inFlightCheckouts = /* @__PURE__ */ new Map();
 var CHECKOUT_DEADLINE_MS = 57e4;
-function withCheckoutDeadline(promise2, pullNumber) {
-  let timer;
-  const deadline = new Promise((_, reject) => {
-    timer = setTimeout(
+var CHECKOUT_ABORT_GRACE_MS = 15e3;
+function withCheckoutDeadline(run, pullNumber) {
+  const exceeded = `checkout_pr #${pullNumber} exceeded ${CHECKOUT_DEADLINE_MS / 1e3}s`;
+  const retry = "retry the call to start a fresh attempt.";
+  const controller = new AbortController();
+  const abortTimer = setTimeout(
+    () => controller.abort(new Error(`${exceeded} and was cancelled; ${retry}`)),
+    CHECKOUT_DEADLINE_MS
+  );
+  let backstopTimer;
+  const backstop = new Promise((_, reject) => {
+    backstopTimer = setTimeout(
       () => reject(
         new Error(
-          `checkout_pr #${pullNumber} exceeded ${CHECKOUT_DEADLINE_MS / 1e3}s. the fetch may still be running in the background; retry the call to start a fresh attempt.`
+          `${exceeded} and was asked to cancel, but a step that cannot be interrupted (the post-checkout hook or a GitHub API call) was still running ${CHECKOUT_ABORT_GRACE_MS / 1e3}s later. ${retry}`
         )
       ),
-      CHECKOUT_DEADLINE_MS
+      CHECKOUT_DEADLINE_MS + CHECKOUT_ABORT_GRACE_MS
     );
   });
-  return Promise.race([promise2, deadline]).finally(() => clearTimeout(timer));
+  return Promise.race([run(controller.signal), backstop]).finally(() => {
+    clearTimeout(abortTimer);
+    clearTimeout(backstopTimer);
+  });
 }
 function headsEqual(a, b) {
   if (a.kind === "branch" && b.kind === "branch") return a.name === b.name;
@@ -190418,7 +190521,7 @@ function describeHead(h) {
   return `detached HEAD \`${h.sha}\``;
 }
 function CheckoutPrTool(ctx) {
-  const runCheckout = async (pull_number) => {
+  const runCheckout = async (pull_number, signal) => {
     const prResponse = await ctx.octokit.rest.pulls.get({
       owner: ctx.repo.owner,
       repo: ctx.repo.name,
@@ -190447,7 +190550,8 @@ function CheckoutPrTool(ctx) {
       toolState: ctx.toolState,
       shell: ctx.payload.shell,
       postCheckoutScript: ctx.postCheckoutScript,
-      beforeSha: primary.beforeSha
+      beforeSha: primary.beforeSha,
+      signal
     });
     const tempDir = process.env.PULLFROG_TEMP_DIR;
     if (!tempDir) {
@@ -190469,7 +190573,7 @@ function CheckoutPrTool(ctx) {
         headSha: checkoutSha
       });
       if (incremental.status === "ok") {
-        incrementalDiffPath = join15(
+        incrementalDiffPath = join16(
           tempDir,
           `pr-${pull_number}-${beforeShort}-${headShort}-incremental.diff`
         );
@@ -190486,7 +190590,7 @@ function CheckoutPrTool(ctx) {
     const diffPreview = formatResult.content.split("\n").slice(0, 100).join("\n");
     log.debug(`formatted diff preview (first 100 lines):
 ${diffPreview}`);
-    const diffPath = join15(tempDir, `pr-${pull_number}-${headShort}.diff`);
+    const diffPath = join16(tempDir, `pr-${pull_number}-${headShort}.diff`);
     writeFileSync10(diffPath, formatResult.content);
     log.debug(`wrote diff to ${diffPath} (${formatResult.content.length} bytes)`);
     primary.diffCoverage = createDiffCoverageState({
@@ -190526,7 +190630,8 @@ ${diffPreview}`);
             files: formatResult.files,
             pullNumber: pull_number,
             baseSha: prResponse.data.base.sha,
-            headSha: checkoutSha
+            headSha: checkoutSha,
+            signal
           });
           impactPath = impact.path;
           log.info(
@@ -190632,7 +190737,10 @@ ${dirty}`
           );
         }
       }
-      const promise2 = withCheckoutDeadline(runCheckout(pull_number), pull_number);
+      const promise2 = withCheckoutDeadline(
+        (signal) => runCheckout(pull_number, signal),
+        pull_number
+      );
       inFlightCheckouts.set(pull_number, promise2);
       try {
         return await promise2;
@@ -190645,7 +190753,7 @@ ${dirty}`
 
 // mcp/checkSuite.ts
 import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 var GetCheckSuiteLogs = type({
   check_suite_id: type.number.describe("the id from check_suite.id")
 });
@@ -190741,7 +190849,7 @@ function GetCheckSuiteLogsTool(ctx) {
       if (!tempDir) {
         throw new Error("PULLFROG_TEMP_DIR not set");
       }
-      const logsDir = join16(tempDir, "ci-logs");
+      const logsDir = join17(tempDir, "ci-logs");
       mkdirSync8(logsDir, { recursive: true });
       const jobResults = [];
       for (const run of failedRuns) {
@@ -190768,7 +190876,7 @@ function GetCheckSuiteLogsTool(ctx) {
               );
             }
             const logsText = await logsResult.text();
-            const logPath = join16(logsDir, `job-${job.id}.log`);
+            const logPath = join17(logsDir, `job-${job.id}.log`);
             writeFileSync11(logPath, logsText);
             const analysis = analyzeLog(logsText, 80);
             const failedSteps = job.steps?.filter((s) => s.conclusion === "failure").map((s) => `Step ${s.number}: ${s.name}`) ?? [];
@@ -190818,7 +190926,7 @@ function GetCheckSuiteLogsTool(ctx) {
 
 // mcp/commitInfo.ts
 import { writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 var CommitInfo = type({
   sha: type.string.describe("the commit SHA (full or abbreviated) to fetch")
 });
@@ -190842,7 +190950,7 @@ function CommitInfoTool(ctx) {
           "PULLFROG_TEMP_DIR not set - get_commit_info must run in pullfrog action context"
         );
       }
-      const diffFile = join17(tempDir, `commit-${sha.slice(0, 7)}.diff`);
+      const diffFile = join18(tempDir, `commit-${sha.slice(0, 7)}.diff`);
       writeFileSync12(diffFile, formatResult.content);
       log.debug(`wrote commit diff to ${diffFile} (${formatResult.content.length} bytes)`);
       return {
@@ -190979,14 +191087,14 @@ function ReopenCurrentTool(ctx) {
 import { performance as performance8 } from "node:perf_hooks";
 
 // prep/installNodeDependencies.ts
-import { existsSync as existsSync8 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync9 } from "node:fs";
+import { join as join20 } from "node:path";
 
 // utils/packageManager.ts
 var import_semver2 = __toESM(require_semver2(), 1);
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 import { mkdir, readFile as readFile2 } from "node:fs/promises";
-import { delimiter, join as join18 } from "node:path";
+import { delimiter, join as join19 } from "node:path";
 var SUPPORTED_NAMES = ["npm", "pnpm", "yarn", "bun"];
 var COREPACK_MANAGED = ["pnpm", "yarn"];
 function isSupported(name) {
@@ -191024,8 +191132,8 @@ function parseDevEnginesField(field) {
   };
 }
 async function resolvePackageManagerSpec(cwd) {
-  const pkgPath = join18(cwd, "package.json");
-  if (!existsSync7(pkgPath)) return null;
+  const pkgPath = join19(cwd, "package.json");
+  if (!existsSync8(pkgPath)) return null;
   let pkg;
   try {
     pkg = JSON.parse(await readFile2(pkgPath, "utf-8"));
@@ -191083,7 +191191,7 @@ async function currentVersion(name) {
   return result.stdout.trim();
 }
 function packageManagerBinDir(tmpdir3) {
-  return join18(tmpdir3, "pm-bin");
+  return join19(tmpdir3, "pm-bin");
 }
 async function ensurePackageManager(params) {
   const spec = params.spec;
@@ -191146,7 +191254,7 @@ async function installFallback(name, installSpec) {
   });
   if (result.exitCode !== 0) return result.stderr || `failed to install ${name}`;
   if (name === "deno") {
-    const denoPath = join18(process.env.HOME || "", ".deno", "bin");
+    const denoPath = join19(process.env.HOME || "", ".deno", "bin");
     process.env.PATH = `${denoPath}:${process.env.PATH}`;
   }
   log.info(`\xBB installed ${name}`);
@@ -191179,8 +191287,8 @@ async function isCommandAvailable2(command) {
 var installNodeDependencies = {
   name: "installNodeDependencies",
   shouldRun: () => {
-    const packageJsonPath = join19(process.cwd(), "package.json");
-    return existsSync8(packageJsonPath);
+    const packageJsonPath = join20(process.cwd(), "package.json");
+    return existsSync9(packageJsonPath);
   },
   run: async (options) => {
     const declared = await resolvePackageManagerSpec(process.cwd());
@@ -191274,14 +191382,14 @@ ${errorMessage}`]
 };
 
 // prep/installPythonDependencies.ts
-import { existsSync as existsSync9, readFileSync as readFileSync5 } from "node:fs";
-import { join as join20 } from "node:path";
+import { existsSync as existsSync10, readFileSync as readFileSync5 } from "node:fs";
+import { join as join21 } from "node:path";
 function declaresBuildSystem(path4) {
   return /^\s*\[\s*build-system\s*\]/m.test(readFileSync5(path4, "utf8"));
 }
 function configApplies(config3, cwd) {
-  const path4 = join20(cwd, config3.file);
-  return existsSync9(path4) && (config3.applies?.(path4) ?? true);
+  const path4 = join21(cwd, config3.file);
+  return existsSync10(path4) && (config3.applies?.(path4) ?? true);
 }
 var PYTHON_CONFIGS = [
   {
@@ -191603,7 +191711,7 @@ function AwaitDependencyInstallationTool(ctx) {
 
 // mcp/gh.ts
 import { mkdirSync as mkdirSync9 } from "node:fs";
-import { join as join21 } from "node:path";
+import { join as join22 } from "node:path";
 var GH_TIMEOUT_MS = 12e4;
 var GhParams = type({
   args: type.string.array().describe(
@@ -191625,7 +191733,7 @@ function GhTool(ctx) {
     description: `Run the GitHub CLI against ${ctx.repo.owner}/${ctx.repo.name}. Pass argv as an array \u2014 there is no shell, so pipes, redirects and \`&&\` do not work; use gh's own \`--json\`/\`--jq\` flags instead. \`gh api graphql\` is available. Authenticated with ${permissions ? formatPermissions(permissions) : "no permissions"} on this repo only; anything else 403s. Pushing, merging and ref writes are not available \u2014 use the git tools.`,
     parameters: GhParams,
     execute: execute(async (params) => {
-      const configDir = join21(ctx.tmpdir, "gh-config");
+      const configDir = join22(ctx.tmpdir, "gh-config");
       mkdirSync9(configDir, { recursive: true });
       const command = ["gh", ...params.args.map(shellQuote)].join(" ");
       const result = await runSandboxed({
@@ -192349,7 +192457,7 @@ function PullRequestInfoTool(ctx) {
 
 // mcp/reviewComments.ts
 import { writeFileSync as writeFileSync13 } from "node:fs";
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 var COMMENTS_PER_THREAD = 50;
 var REVIEW_THREADS_QUERY = `
 query ($owner: String!, $name: String!, $prNumber: Int!, $cursor: String) {
@@ -192843,7 +192951,7 @@ function GetReviewCommentsTool(ctx) {
         throw new Error("PULLFROG_TEMP_DIR not set");
       }
       const filename = `review-${params.review_id}-threads.md`;
-      const commentsPath = join22(tempDir, filename);
+      const commentsPath = join23(tempDir, filename);
       writeFileSync13(commentsPath, formatted.content);
       log.debug(`wrote ${threadBlocks.length} threads to ${commentsPath}`);
       return {
@@ -193213,7 +193321,7 @@ function UploadFileTool(ctx) {
 
 // mcp/xrepo.ts
 import { mkdirSync as mkdirSync10, rmSync as rmSync3 } from "node:fs";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 function assertValidRepoName(name) {
   if (!/^[A-Za-z0-9._-]+$/.test(name) || name.startsWith("-") || name.includes("..")) {
     throw new Error(
@@ -193293,7 +193401,7 @@ function CheckoutRepoTool(ctx) {
         return { path: existing.dir, access: existing.access, note: "already checked out." };
       }
       const access = accessFor(ctx, repo);
-      const dir = join23(ctx.tmpdir, "xrepo", repo);
+      const dir = join24(ctx.tmpdir, "xrepo", repo);
       mkdirSync10(dir, { recursive: true });
       const state = ensureRepoState(ctx.toolState, { owner, name: repo, dir, access });
       const rc = resolveRepoCtx(ctx, repo);
@@ -193659,6 +193767,7 @@ function isByokSetupError(text) {
 var SECRETS_UNAVAILABLE_MARKER = "couldn't load your Pullfrog secrets";
 var ROUTER_UNFUNDED_MARKER = "your Pullfrog Router balance is empty";
 var CREDENTIAL_REJECTED_MARKER = "was rejected by its provider";
+var CREDENTIAL_POOL_REFUSED_MARKER = "No configured credential can serve this run";
 var NoUsableCredentialError = class extends Error {
 };
 function throwKeyError(params) {
@@ -193925,7 +194034,8 @@ function isOAuthCredentialExpiredError(text) {
       text
     ) || // the provider no longer recognises the token at all (#1086) — same dead
     // credential, phrased as a lookup miss rather than a state transition.
-    /Could not find the appropriate key in your authentication token/i.test(text) || /Token refresh failed/i.test(text)
+    /Could not find the appropriate key in your authentication token/i.test(text) || // the reversed word order: `Encountered invalidated oauth token for user` (#1474).
+    /(?:expired|invalidated|revoked) (?:OAuth|authentication) token/i.test(text) || /Token refresh failed/i.test(text)
   );
 }
 function isMalformedKeyError(text) {
@@ -193972,7 +194082,7 @@ function buildRejectedCredentialError(params) {
     ].join("\n");
   }
   const where = params.inPullfrogStore ? `[Update it in Pullfrog \u2192](${settingsUrl})` : `[Update the GitHub Actions secret \u2192](https://github.com/${params.owner}/${params.name}/settings/secrets/actions)`;
-  const keysUrl = providerKeysUrl(params.credential);
+  const keysUrl = providerDashboard(params.credential)?.keys;
   const issue3 = keysUrl ? `[Issue a new key \u2192](${keysUrl}) \xB7 ` : "";
   return [
     `**Your \`${params.credential}\` ${CREDENTIAL_REJECTED_MARKER}**${detail}, so the agent never ran.`,
@@ -193982,12 +194092,43 @@ function buildRejectedCredentialError(params) {
     `${issue3}${where} \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Setup docs \u2192](https://docs.pullfrog.com/keys) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
   ].join("\n");
 }
-function providerKeysUrl(credential) {
+function providerDashboard(credential) {
   for (const [id, provider2] of Object.entries(providers)) {
-    if (provider2.envVars.includes(credential)) return PROVIDER_DASHBOARDS[id]?.keys;
+    if (provider2.envVars.includes(credential)) return PROVIDER_DASHBOARDS[id];
   }
   return void 0;
 }
+function buildCredentialPoolRefusedError(params) {
+  const settingsUrl = `${getApiUrl()}/console/${params.owner}/${params.name}`;
+  return [
+    `**${CREDENTIAL_POOL_REFUSED_MARKER}.** Every credential configured for \`${params.model}\` was rejected or is out of quota, so the agent never ran.`,
+    "",
+    ...params.refused.map(
+      (credential) => `- ${describeRefusal({ ...params, credential, settingsUrl })}`
+    ),
+    "",
+    `[Model settings \u2192](${settingsUrl}) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
+  ].join("\n");
+}
+function describeRefusal(params) {
+  const credential = params.credential;
+  const verdict = credential.verdict;
+  const workflow = credential.source === "workflow";
+  const head = `\`${credential.name}\` from ${workflow ? "the workflow" : `${credential.source} scope`}: \`${verdict.detail}\` \u2014`;
+  const subscription = SUBSCRIPTION_CREDENTIALS[credential.name];
+  const dashboard = providerDashboard(credential.name);
+  if (verdict.status === "exhausted" && subscription) {
+    const wait = verdict.resetAt ? `it resets at **${verdict.resetAt.toISOString().slice(0, 16).replace("T", " ")} UTC**; re-trigger after that` : "re-trigger after the limit resets";
+    return `${head} ${wait}, or add an API key for this provider, which Pullfrog falls back to automatically.`;
+  }
+  if (verdict.status === "exhausted")
+    return `${head} add credit or raise its quota with the provider.${dashboard ? ` [Top up \u2192](${dashboard.billing})` : ""}`;
+  if (subscription)
+    return `${head} re-authenticate with \`${subscription.command}\`, or switch this repo to a model you hold an API key for. [Re-authenticate \u2192](${subscription.docs})`;
+  const where = workflow ? `[Update the GitHub Actions secret \u2192](https://github.com/${params.owner}/${params.name}/settings/secrets/actions)` : `[Update it in Pullfrog \u2192](${params.settingsUrl})`;
+  const issue3 = dashboard?.keys ? `[Issue a new key \u2192](${dashboard.keys}) \xB7 ` : "";
+  return `${head} issue a new key and update the copy Pullfrog uses. ${issue3}${where}`;
+}
 function formatApiKeyErrorSummary(params) {
   if (params.raw.includes(MISSING_KEY_MARKER)) {
     if (params.raw.startsWith(`**${MISSING_KEY_MARKER}**`)) return params.raw;
@@ -194760,11 +194901,16 @@ async function selectConfiguredCredential(input) {
       if (option.candidate) log.info(`\xBB selected ${option.name} from ${from}`);
       return true;
     }
-    refused.push(`${option.name} from ${from}: ${verdict.detail}`);
+    refused.push({ name: option.name, source: option.candidate?.source ?? "workflow", verdict });
     log.info(`\xBB ${option.name} from ${from} unavailable; trying the next credential`);
   }
   throw new Error(
-    `all configured credentials for ${model} were rejected or exhausted (${refused.join("; ")}); no other model or provider was selected`
+    buildCredentialPoolRefusedError({
+      model,
+      refused,
+      owner: input.ctx.repo.owner,
+      name: input.ctx.repo.name
+    })
   );
 }
 async function probe(input) {
@@ -194805,7 +194951,7 @@ function activate(input) {
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { writeFileSync as writeFileSync14 } from "node:fs";
 import { createServer as createServer3 } from "node:http";
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 var REVOKED_TRAP_MS = 6e4;
 function revokeGitHubToken(token) {
   fetch("https://api.github.com/installation/token", {
@@ -194874,7 +195020,7 @@ async function startGitAuthServer(tmpdir3) {
   function writeAskpassScript(code) {
     const scriptId = randomUUID6();
     const scriptName = `askpass-${scriptId}.js`;
-    const scriptPath = join24(tmpdir3, scriptName);
+    const scriptPath = join25(tmpdir3, scriptName);
     const content = [
       `#!/usr/bin/env node`,
       `var a=process.argv[2]||"";`,
@@ -195323,7 +195469,7 @@ function resolveInstructions(ctx) {
 
 // utils/learnings.ts
 import { mkdir as mkdir2, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname4, join as join25 } from "node:path";
+import { dirname as dirname4, join as join26 } from "node:path";
 
 // utils/learningsTruncate.ts
 var MAX_LEARNINGS_LENGTH = 1e5;
@@ -195341,10 +195487,10 @@ function truncateAtLineBoundary(body, cap) {
 var LEARNINGS_FILE_NAME = "pullfrog-learnings.md";
 var XREPO_LEARNINGS_FILE_NAME = "pullfrog-xrepo-learnings.md";
 function learningsFilePath(tmpdir3) {
-  return join25(tmpdir3, LEARNINGS_FILE_NAME);
+  return join26(tmpdir3, LEARNINGS_FILE_NAME);
 }
 function xrepoLearningsFilePath(tmpdir3) {
-  return join25(tmpdir3, XREPO_LEARNINGS_FILE_NAME);
+  return join26(tmpdir3, XREPO_LEARNINGS_FILE_NAME);
 }
 async function seedLearningsFile(params) {
   const path4 = learningsFilePath(params.tmpdir);
@@ -195895,7 +196041,9 @@ async function resolveTokens(params) {
     // commit-status check-runs for branch protection. the app already grants
     // checks:write; this scopes the MCP token up to use it.
     checks: "write",
-    actions: "read"
+    // write (not read) so postReviewCleanup can dispatch the follow-up re-review
+    // for commits pushed while a review was in flight; read 403s it.
+    actions: "write"
   };
   const mcpToken = await acquireNewToken({
     repos: writeRepos,
@@ -196281,7 +196429,7 @@ async function resolveTrialFallback(ctx) {
 
 // utils/prSummary.ts
 import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname5, join as join26 } from "node:path";
+import { dirname as dirname5, join as join27 } from "node:path";
 var SUMMARY_FILE_NAME = "pullfrog-summary.md";
 var SUMMARY_SCAFFOLD = `# PR summary
 
@@ -196291,7 +196439,7 @@ var SUMMARY_SCAFFOLD = `# PR summary
 var MIN_SNAPSHOT_LENGTH = 60;
 var MAX_SNAPSHOT_LENGTH = 32768;
 function summaryFilePath(tmpdir3) {
-  return join26(tmpdir3, SUMMARY_FILE_NAME);
+  return join27(tmpdir3, SUMMARY_FILE_NAME);
 }
 async function seedSummaryFile(params) {
   const path4 = summaryFilePath(params.tmpdir);
@@ -196560,7 +196708,7 @@ function formatBillingExhaustedBody(diagnostic) {
 
 // utils/runErrorRenderer.ts
 function isProviderModelNotFoundError(message) {
-  return message.includes("ProviderModelNotFoundError");
+  return /ProviderModelNotFoundError|\bModel not found: /.test(message);
 }
 function isContextOverflowError(message) {
   return /Prompt is too long/i.test(message) || /Input exceeds context window/i.test(message) || /maximum context length is \d+ tokens/i.test(message) || /Session too large to compact/i.test(message);
@@ -196657,6 +196805,7 @@ function detectProviderId(message) {
   if (/requires more credits|Key limit exceeded \(total limit\)|openrouter\.ai/i.test(message)) {
     return "openrouter";
   }
+  if (/platform\.openai\.com/i.test(message)) return "openai";
   return null;
 }
 var OPENROUTER_PRIVACY_URL = "https://openrouter.ai/settings/privacy";
@@ -196754,12 +196903,38 @@ function formatByokSetupSummary(input) {
   ].join("\n");
 }
 function formatProviderModelNotFoundSummary(input) {
-  return `The configured model is no longer available in OpenCode's catalog. Pick a different model in the Pullfrog console for \`${input.owner}/${input.name}\`, or contact support if this persists.
+  return `The configured model is not in OpenCode's catalog. Pick a different model for \`${input.owner}/${input.name}\` where it is set \u2014 the Pullfrog console, the workflow's \`model\` input, or the \`PULLFROG_MODEL\` variable \u2014 or contact support if this persists.
 
 \`\`\`
 ${input.raw}
 \`\`\``;
 }
+function formatProviderUsageLimit(input) {
+  return [
+    "**The provider's usage limit for this account has been reached.**",
+    "",
+    "A subscription window resets on its own, so re-trigger after it does; a limit set on a pay-as-you-go workspace has to be raised. A model on another provider can run in the meantime.",
+    "",
+    `[Model settings \u2192](${getApiUrl()}/console/${input.owner}/${input.name}) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`,
+    "",
+    `\`\`\`
+${input.raw}
+\`\`\``
+  ].join("\n");
+}
+function formatProviderErrorBody(input) {
+  return [
+    "**The model provider returned an error, so this run stopped.**",
+    "",
+    "The error is below. If it names your key, plan or balance, fix that with the provider or pick another model before re-triggering.",
+    "",
+    `[Model settings \u2192](${getApiUrl()}/console/${input.owner}/${input.name}) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`,
+    "",
+    `\`\`\`
+${input.raw}
+\`\`\``
+  ].join("\n");
+}
 function renderRunError(input) {
   const billingError = input.routerActive && isRouterKeylimitExhaustedError(input.errorMessage) ? new BillingError(input.errorMessage, { code: "router_keylimit_exhausted" }) : null;
   if (billingError) {
@@ -196775,7 +196950,7 @@ function renderRunError(input) {
   if (input.errorMessage.includes(ROUTER_UNFUNDED_MARKER)) {
     return { summary: input.errorMessage, comment: input.errorMessage };
   }
-  if (input.errorMessage.includes(CREDENTIAL_REJECTED_MARKER)) {
+  if (input.errorMessage.includes(CREDENTIAL_REJECTED_MARKER) || input.errorMessage.includes(CREDENTIAL_POOL_REFUSED_MARKER)) {
     return { summary: input.errorMessage, comment: input.errorMessage };
   }
   const isHang = input.errorMessage.startsWith("activity timeout") || input.errorMessage.startsWith("agent still pending");
@@ -196798,6 +196973,16 @@ ${body}`, comment: body };
     });
     return { summary: `### \u274C Pullfrog failed
 
+${body}`, comment: body };
+  }
+  if (isProviderUsageLimit(input.errorMessage)) {
+    const body = formatProviderUsageLimit({
+      owner: input.repo.owner,
+      name: input.repo.name,
+      raw: input.errorMessage
+    });
+    return { summary: `### \u274C Pullfrog failed
+
 ${body}`, comment: body };
   }
   if (isProviderMissingCredential(input.errorMessage)) {
@@ -196892,6 +197077,16 @@ ${hangBody}`,
       comment: explained ? hangBody : formatMinimalFailureComment(input.repo)
     };
   }
+  if (input.errorMessage.startsWith("provider error: ")) {
+    const body = formatProviderErrorBody({
+      owner: input.repo.owner,
+      name: input.repo.name,
+      raw: input.errorMessage
+    });
+    return { summary: `### \u274C Pullfrog failed
+
+${body}`, comment: body };
+  }
   const genericBody = formatGenericFailure(input.errorMessage);
   return {
     summary: `### \u274C Pullfrog failed
@@ -197702,7 +197897,7 @@ async function main() {
     const repoDir = payload.cwd;
     const preIntrospectionDirty = repoDir ? await dirtyTrackedPaths({ cwd: repoDir }) : null;
     const opencodeCliPath = await agents.opencode.install();
-    captureBaselineModels(opencodeCliPath);
+    captureBaselineModels({ cliPath: opencodeCliPath, tmpdir: tmpdir3 });
     const injected = [];
     if (runContext.dbSecrets) {
       for (const [key, value2] of Object.entries(runContext.dbSecrets)) {
@@ -197719,7 +197914,7 @@ async function main() {
     await initializeCredentialPool({ ctx: runContext, slug: payload.model, injected });
     installCodexAuth();
     installXaiAuth();
-    captureAuthorizedModels(opencodeCliPath);
+    captureAuthorizedModels({ cliPath: opencodeCliPath, tmpdir: tmpdir3 });
     if (preIntrospectionDirty && repoDir) {
       await restoreDirtiedSince({
         before: preIntrospectionDirty,
@@ -198057,8 +198252,8 @@ ${instructions.user}` : null,
           log.info(instructions.full);
         });
         if (agentId === "opencode") {
-          const pluginDir = join27(process.cwd(), ".opencode", "plugin");
-          const hasPlugins = existsSync10(pluginDir) && readdirSync2(pluginDir).some((f) => /\.[jt]sx?$/.test(f));
+          const pluginDir = join28(process.cwd(), ".opencode", "plugin");
+          const hasPlugins = existsSync11(pluginDir) && readdirSync2(pluginDir).some((f) => /\.[jt]sx?$/.test(f));
           if (hasPlugins && toolState.dependencyInstallation?.promise) {
             log.info(
               "\xBB .opencode/plugin/ detected \u2014 awaiting dependency installation before agent start"