diff --git a/AGENTS.md b/AGENTS.md
index fc9073a..4095328 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -62,8 +62,9 @@ This repo uses two Mix projects side-by-side, not nested:
 
 - `app/` — The CLI itself (`LinearCli` application, version-managed,
   Burrito-released). All end-user features live here.
-- `lib/`, `mix.exs` (root) — Repo-management tooling (`RepoTasks` project,
-  no deps). Mix tasks that operate on the repo as a whole: `mix lc`,
+- `lib/`, `mix.exs` (root) — Repo-management tooling (`RepoTasks` project;
+  its own small deps, such as `req`, so a fresh clone needs `mix deps.get`
+  here as well as in `app/`). Mix tasks that operate on the repo as a whole: `mix lc`,
   `mix setup`, `mix git_hooks`, `mix stokowski`, `mix container.build/publish`.
   These tasks orchestrate other tools as child processes and know nothing
   about `app/`'s internal modules.
diff --git a/mise.toml b/mise.toml
index 03f9765..97f263a 100644
--- a/mise.toml
+++ b/mise.toml
@@ -8,8 +8,8 @@ erlang = "29.0.3"
 elixir = "1.20.3"
 python = "3.14.7"
 uv = "0.12.18"
-codex = "0.157.0"
-claude = "2.1.282"
+codex = "0.157.1"
+claude = "2.1.283"
 [env]
 #ANTHROPIC_BASE_URL = "http://127.0.0.1:13305"
 #ANTHROPIC_AUTH_TOKEN = "lemonade"
diff --git a/vendor/stokowski b/vendor/stokowski
index 35f4a55..1f843c0 160000
--- a/vendor/stokowski
+++ b/vendor/stokowski
@@ -1 +1 @@
-Subproject commit 35f4a5585082f75b90b6ce06a23aab066ece535a
+Subproject commit 1f843c0915bba42b4ca7372c3315c748d1297bd8
diff --git a/workflow.claude.yaml b/workflow.claude.yaml
index 5f70a42..e10e356 100644
--- a/workflow.claude.yaml
+++ b/workflow.claude.yaml
@@ -115,16 +115,31 @@ workspace:
 hooks:
   after_create: |
     git clone --depth 1 --recursive git@github.com:rubyists/linear-cli .
+    mix deps.get
     mix setup
   before_run: |
-    set -eu
-    git fetch origin main
-    changes="$(git status --porcelain)"
+    # Best-effort refresh onto origin/main. A failed hook fails the whole agent
+    # run, so only a rebase that cannot be cleaned up is fatal.
+    if ! git fetch origin main; then
+      echo "before_run: git fetch origin main failed; skipping rebase" >&2
+      exit 0
+    fi
+    if ! changes="$(git status --porcelain)"; then
+      echo "before_run: git status failed; skipping rebase" >&2
+      exit 0
+    fi
     if [ -n "$changes" ]; then
       echo "before_run: preserving uncommitted workspace changes; skipping rebase"
-    else
-      git rebase origin/main
+      exit 0
+    fi
+    if ! git rebase origin/main; then
+      echo "before_run: rebase onto origin/main failed; aborting it" >&2
+      if ! git rebase --abort; then
+        echo "before_run: git rebase --abort failed; the workspace needs manual repair" >&2
+        exit 1
+      fi
     fi
+    exit 0
   timeout_ms: 120000
 
 # ---------------------------------------------------------------------------
diff --git a/workflow.codex.yaml b/workflow.codex.yaml
index e5f8ffb..ce8eefd 100644
--- a/workflow.codex.yaml
+++ b/workflow.codex.yaml
@@ -116,16 +116,31 @@ workspace:
 hooks:
   after_create: |
     git clone --depth 1 --recursive git@github.com:rubyists/linear-cli .
+    mix deps.get
     mix setup
   before_run: |
-    set -eu
-    git fetch origin main
-    changes="$(git status --porcelain)"
+    # Best-effort refresh onto origin/main. A failed hook fails the whole agent
+    # run, so only a rebase that cannot be cleaned up is fatal.
+    if ! git fetch origin main; then
+      echo "before_run: git fetch origin main failed; skipping rebase" >&2
+      exit 0
+    fi
+    if ! changes="$(git status --porcelain)"; then
+      echo "before_run: git status failed; skipping rebase" >&2
+      exit 0
+    fi
     if [ -n "$changes" ]; then
       echo "before_run: preserving uncommitted workspace changes; skipping rebase"
-    else
-      git rebase origin/main
+      exit 0
+    fi
+    if ! git rebase origin/main; then
+      echo "before_run: rebase onto origin/main failed; aborting it" >&2
+      if ! git rebase --abort; then
+        echo "before_run: git rebase --abort failed; the workspace needs manual repair" >&2
+        exit 1
+      fi
     fi
+    exit 0
   timeout_ms: 120000
 
 # ---------------------------------------------------------------------------
diff --git a/workflow.glean.yaml b/workflow.glean.yaml
index d8665c8..e0e7272 100644
--- a/workflow.glean.yaml
+++ b/workflow.glean.yaml
@@ -24,10 +24,31 @@ hooks:
     git clone --depth 1 --recursive git@github.com:rubyists/linear-cli .
     mise trust
     mise install
+    mise exec -- mix deps.get
     mise exec -- mix setup
   before_run: |
-    git fetch origin main
-    git rebase origin/main 2>/dev/null || git rebase --abort
+    # Best-effort refresh onto origin/main. A failed hook fails the whole agent
+    # run, so only a rebase that cannot be cleaned up is fatal.
+    if ! git fetch origin main; then
+      echo "before_run: git fetch origin main failed; skipping rebase" >&2
+      exit 0
+    fi
+    if ! changes="$(git status --porcelain)"; then
+      echo "before_run: git status failed; skipping rebase" >&2
+      exit 0
+    fi
+    if [ -n "$changes" ]; then
+      echo "before_run: preserving uncommitted workspace changes; skipping rebase"
+      exit 0
+    fi
+    if ! git rebase origin/main; then
+      echo "before_run: rebase onto origin/main failed; aborting it" >&2
+      if ! git rebase --abort; then
+        echo "before_run: git rebase --abort failed; the workspace needs manual repair" >&2
+        exit 1
+      fi
+    fi
+    exit 0
   timeout_ms: 240000
 
 claude:
diff --git a/workflow.opus.yaml b/workflow.opus.yaml
index 5c23899..3440f1a 100644
--- a/workflow.opus.yaml
+++ b/workflow.opus.yaml
@@ -115,21 +115,32 @@ workspace:
 hooks:
   after_create: |
     git clone --depth 1 --recursive git@github.com:rubyists/linear-cli .
-    mix setup
-<<<<<<< HEAD
     mix deps.get
-=======
+    mix setup
     cd app && mix deps.get
->>>>>>> main
   before_run: |
-    set -eu
-    git fetch origin main
-    changes="$(git status --porcelain)"
+    # Best-effort refresh onto origin/main. A failed hook fails the whole agent
+    # run, so only a rebase that cannot be cleaned up is fatal.
+    if ! git fetch origin main; then
+      echo "before_run: git fetch origin main failed; skipping rebase" >&2
+      exit 0
+    fi
+    if ! changes="$(git status --porcelain)"; then
+      echo "before_run: git status failed; skipping rebase" >&2
+      exit 0
+    fi
     if [ -n "$changes" ]; then
       echo "before_run: preserving uncommitted workspace changes; skipping rebase"
-    else
-      git rebase origin/main
+      exit 0
+    fi
+    if ! git rebase origin/main; then
+      echo "before_run: rebase onto origin/main failed; aborting it" >&2
+      if ! git rebase --abort; then
+        echo "before_run: git rebase --abort failed; the workspace needs manual repair" >&2
+        exit 1
+      fi
     fi
+    exit 0
   timeout_ms: 120000
 
 # ---------------------------------------------------------------------------