@gh-symphony/cli 0.2.3 → 0.2.5

package/dist/{chunk-AA3T5AAJ.js → chunk-5U36B7FC.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import {
   workflow_init_default
-} from "./chunk-PLBG7TZA.js";
+} from "./chunk-DTPIJO6S.js";
 import {
   fetchGithubProjectIssueByRepositoryAndNumber,
   inspectManagedProjectSelection,
   resolveTrackerAdapter
-} from "./chunk-ZGNAAHLD.js";
+} from "./chunk-NRABQNAX.js";
 import {
   GitHubApiError,
   createClient,
@@ -14,7 +14,7 @@ import {
   getGhTokenWithSource,
   getProjectDetail,
   validateGitHubToken
-} from "./chunk-BOM2BYZQ.js";
+} from "./chunk-SMNIGNS3.js";
 import {
   buildPromptVariables,
   parseWorkflowMarkdown,

package/dist/{chunk-PLBG7TZA.js → chunk-DTPIJO6S.js}

@@ -11,7 +11,7 @@ import {
   listUserProjects,
   resolveGitHubAuth,
   validateToken
-} from "./chunk-BOM2BYZQ.js";
+} from "./chunk-SMNIGNS3.js";
 import {
   formatClaudePreflightText,
   resolveClaudeCommandBinary,

package/dist/{chunk-ZGNAAHLD.js → chunk-NRABQNAX.js}

@@ -1810,18 +1810,14 @@ var LINEAR_ISSUES_BY_STATES_QUERY = (
   /* GraphQL */
   `
   query SymphonyLinearIssues(
-    $projectSlug: String!
-    $stateNames: [String!]!
+    $filter: IssueFilter!
     $first: Int!
     $after: String
   ) {
     issues(
       first: $first
       after: $after
-      filter: {
-        project: { slugId: { eq: $projectSlug } }
-        state: { name: { in: $stateNames } }
-      }
+      filter: $filter
     ) {
       ${LINEAR_ISSUE_FIELDS}
     }
@@ -1832,18 +1828,14 @@ var LINEAR_ISSUES_BY_IDS_QUERY = (
   /* GraphQL */
   `
   query SymphonyLinearIssueStates(
-    $projectSlug: String!
-    $issueIds: [ID!]!
+    $filter: IssueFilter!
     $first: Int!
     $after: String
   ) {
     issues(
       first: $first
       after: $after
-      filter: {
-        project: { slugId: { eq: $projectSlug } }
-        id: { in: $issueIds }
-      }
+      filter: $filter
     ) {
       ${LINEAR_ISSUE_FIELDS}
     }
@@ -1854,18 +1846,14 @@ var LINEAR_ISSUES_BY_IDENTIFIERS_QUERY = (
   /* GraphQL */
   `
   query SymphonyLinearIssueStatesByIdentifier(
-    $projectSlug: String!
-    $issueIdentifiers: [String!]!
+    $filter: IssueFilter!
     $first: Int!
     $after: String
   ) {
     issues(
       first: $first
       after: $after
-      filter: {
-        project: { slugId: { eq: $projectSlug } }
-        identifier: { in: $issueIdentifiers }
-      }
+      filter: $filter
     ) {
       ${LINEAR_ISSUE_FIELDS}
     }
@@ -1940,6 +1928,7 @@ async function listLinearIssues(project, stateNamesInput, dependencies, issueIds
     stateNames,
     issueIds: issueIds && !issueIds.every(isLinearIdentifier) ? [...issueIds] : void 0,
     issueIdentifiers: issueIds && issueIds.every(isLinearIdentifier) ? issueIds.map((identifier) => identifier.trim().toUpperCase()) : void 0,
+    assignedOnly: config.assignedOnly,
     pageSize: config.pageSize
   });
   const issues = result.nodes.map(
@@ -1951,6 +1940,12 @@ async function listLinearIssues(project, stateNamesInput, dependencies, issueIds
     value: result.rateLimits,
     writable: true
   });
+  if (config.assignedOnly) {
+    emitAssignedOnlyFilterEvent2({
+      projectSlug: config.projectSlug,
+      includedCount: issues.length
+    });
+  }
   return issues;
 }
 async function fetchPaginatedLinearIssues(client, input) {
@@ -1960,8 +1955,7 @@ async function fetchPaginatedLinearIssues(client, input) {
   do {
     const query = input.issueIdentifiers ? LINEAR_ISSUES_BY_IDENTIFIERS_QUERY : input.issueIds ? LINEAR_ISSUES_BY_IDS_QUERY : LINEAR_ISSUES_BY_STATES_QUERY;
     const response = await client(query, {
-      projectSlug: input.projectSlug,
-      ...input.issueIdentifiers ? { issueIdentifiers: input.issueIdentifiers } : input.issueIds ? { issueIds: input.issueIds } : { stateNames: input.stateNames ?? [] },
+      filter: buildLinearIssueFilter(input),
       first: input.pageSize,
       after
     });
@@ -1975,6 +1969,13 @@ async function fetchPaginatedLinearIssues(client, input) {
     rateLimits: latestRateLimits
   };
 }
+function buildLinearIssueFilter(input) {
+  return {
+    project: { slugId: { eq: input.projectSlug } },
+    ...input.issueIdentifiers ? { identifier: { in: input.issueIdentifiers } } : input.issueIds ? { id: { in: input.issueIds } } : { state: { name: { in: input.stateNames ?? [] } } },
+    ...input.assignedOnly ? { assignee: { isMe: { eq: true } } } : {}
+  };
+}
 function isLinearIdentifier(value) {
   const trimmed = value.trim();
   return trimmed === trimmed.toUpperCase() && LINEAR_IDENTIFIER_PATTERN.test(trimmed);
@@ -2097,11 +2098,29 @@ function resolveLinearTrackerConfig(project, dependencies) {
   }
   return {
     endpoint: resolveLinearEndpoint(project.tracker),
+    assignedOnly: resolveAssignedOnly2(project.tracker, dependencies),
     pageSize: readPositiveIntegerSetting(project.tracker, "pageSize") ?? DEFAULT_PAGE_SIZE2,
     projectSlug,
     token
   };
 }
+var warnedLegacyAssignedOnlyProjectIds2 = /* @__PURE__ */ new Set();
+function resolveAssignedOnly2(tracker, dependencies) {
+  if (dependencies.assignedOnly !== void 0) {
+    return dependencies.assignedOnly;
+  }
+  const legacyAssignedOnly = readBooleanSetting(tracker, "assignedOnly");
+  if (legacyAssignedOnly) {
+    const warningKey = `${tracker.adapter}:${tracker.bindingId}`;
+    if (!warnedLegacyAssignedOnlyProjectIds2.has(warningKey)) {
+      warnedLegacyAssignedOnlyProjectIds2.add(warningKey);
+      console.warn(
+        "[gh-symphony] Deprecated tracker.settings.assignedOnly detected. Use 'gh-symphony repo start --assigned-only' instead; persisted assignedOnly support will be removed in the next major release."
+      );
+    }
+  }
+  return legacyAssignedOnly;
+}
 function resolveLinearEndpoint(tracker) {
   return tracker.apiUrl?.trim() || DEFAULT_LINEAR_GRAPHQL_URL2;
 }
@@ -2132,6 +2151,10 @@ function readPositiveIntegerSetting(tracker, key) {
     `Tracker adapter "${tracker.adapter}" requires the "${key}" setting to be a positive integer when provided.`
   );
 }
+function readBooleanSetting(tracker, key) {
+  const value = tracker.settings?.[key];
+  return value === true || value === "true";
+}
 function readStringArray(value) {
   if (value === void 0) {
     return void 0;
@@ -2144,6 +2167,18 @@ function readStringArray(value) {
   }
   return value.filter((entry) => typeof entry === "string");
 }
+function emitAssignedOnlyFilterEvent2(input) {
+  console.info(
+    JSON.stringify({
+      event: "tracker-assigned-only-filtered",
+      tracker: "linear",
+      projectSlug: input.projectSlug,
+      assigneeFilter: "isMe",
+      includedCount: input.includedCount,
+      excludedCount: null
+    })
+  );
+}
 function requireString(value, label) {
   if (typeof value !== "string" || value.length === 0) {
     throw new Error(`${label} is required.`);

package/dist/{chunk-BOM2BYZQ.js → chunk-SMNIGNS3.js}

@@ -517,9 +517,10 @@ var PROJECT_ITEMS_PAGE_QUERY = `
 import { execFileSync, spawnSync } from "child_process";
 var REQUIRED_GH_SCOPES = ["repo", "read:org", "project"];
 var GhAuthError = class extends Error {
-  constructor(code, message) {
+  constructor(code, message, details = {}) {
     super(message);
     this.code = code;
+    this.details = details;
     this.name = "GhAuthError";
   }
 };
@@ -527,7 +528,77 @@ function ghTokenReadErrorMessage() {
   return "Failed to read a GitHub token from gh CLI. Run 'gh auth status' and try again.";
 }
 function missingGhScopesMessage(missing) {
-  return `Run 'gh auth refresh --scopes repo,read:org,project'. Missing scopes: ${missing.join(", ")}`;
+  return `Run 'gh auth refresh --scopes ${REQUIRED_GH_SCOPES.join(",")}'. Missing scopes: ${missing.join(", ")}`;
+}
+function parseMissingScopes(message) {
+  const matched = message.match(/Missing scopes:\s*([^.\n]+)/i);
+  if (!matched) {
+    return [];
+  }
+  return matched[1].split(",").map((scope) => scope.trim()).filter((scope) => scope.length > 0);
+}
+function formatGhAuthRemediation(error, opts) {
+  const retryCommand = opts?.retryCommand ?? "gh-symphony repo start";
+  switch (error.code) {
+    case "not_installed":
+      return {
+        title: "GitHub authentication is not available",
+        message: error.message,
+        hint: "Install gh CLI from https://cli.github.com or set GITHUB_GRAPHQL_TOKEN."
+      };
+    case "not_authenticated": {
+      const command = `gh auth login --scopes ${REQUIRED_GH_SCOPES.join(",")}`;
+      return {
+        title: "GitHub authentication is required",
+        message: error.message,
+        command,
+        hint: `Run '${command}', then re-run '${retryCommand}'.`
+      };
+    }
+    case "missing_scopes": {
+      if (error.details.source === "env") {
+        return {
+          title: "GitHub token is missing required scopes",
+          message: error.message,
+          hint: `Update GITHUB_GRAPHQL_TOKEN with a token that has ${REQUIRED_GH_SCOPES.join(",")} scopes, or unset it to use gh CLI auth, then re-run '${retryCommand}'.`
+        };
+      }
+      const currentSet = new Set(
+        (error.details.currentScopes ?? []).map((scope) => scope.toLowerCase())
+      );
+      const inferredMissing = currentSet.size > 0 ? REQUIRED_GH_SCOPES.filter((scope) => !currentSet.has(scope)) : [];
+      const missing = error.details.missingScopes?.length ? error.details.missingScopes : inferredMissing.length > 0 ? inferredMissing : parseMissingScopes(error.message);
+      const scopeArg = missing.length > 0 ? missing.join(",") : REQUIRED_GH_SCOPES.join(",");
+      const command = `gh auth refresh --scopes ${scopeArg}`;
+      return {
+        title: "GitHub token is missing required scopes",
+        message: error.message,
+        command,
+        hint: `Run '${command}', then re-run '${retryCommand}'.`
+      };
+    }
+    case "invalid_token":
+    case "token_failed": {
+      if (error.details.source === "env") {
+        return {
+          title: "GitHub token validation failed",
+          message: error.message,
+          hint: `Update or unset GITHUB_GRAPHQL_TOKEN, then re-run '${retryCommand}'.`
+        };
+      }
+      const command = `gh auth login --scopes ${REQUIRED_GH_SCOPES.join(",")}`;
+      return {
+        title: "GitHub token validation failed",
+        message: error.message,
+        command,
+        hint: `Run '${command}' to re-authenticate, then re-run '${retryCommand}'.`
+      };
+    }
+    default: {
+      const exhaustive = error.code;
+      throw new Error(`Unhandled GhAuthError code: ${exhaustive}`);
+    }
+  }
 }
 function classifyTokenValidationError(error, source) {
   if (error instanceof GhAuthError) {
@@ -537,19 +608,25 @@ function classifyTokenValidationError(error, source) {
     if (error.status === 401) {
       return new GhAuthError(
         source === "env" ? "invalid_token" : "token_failed",
-        source === "env" ? "GITHUB_GRAPHQL_TOKEN is invalid or expired." : ghTokenReadErrorMessage()
+        source === "env" ? "GITHUB_GRAPHQL_TOKEN is invalid or expired." : ghTokenReadErrorMessage(),
+        { source }
       );
     }
     const prefix = source === "env" ? "GITHUB_GRAPHQL_TOKEN could not be validated" : "gh CLI token could not be validated";
-    return new GhAuthError("token_failed", `${prefix}: ${error.message}`);
+    return new GhAuthError("token_failed", `${prefix}: ${error.message}`, {
+      source
+    });
   }
   if (error instanceof Error) {
     const prefix = source === "env" ? "GITHUB_GRAPHQL_TOKEN could not be validated" : "gh CLI token could not be validated";
-    return new GhAuthError("token_failed", `${prefix}: ${error.message}`);
+    return new GhAuthError("token_failed", `${prefix}: ${error.message}`, {
+      source
+    });
   }
   return new GhAuthError(
     "token_failed",
-    source === "env" ? "GITHUB_GRAPHQL_TOKEN could not be validated." : "gh CLI token could not be validated."
+    source === "env" ? "GITHUB_GRAPHQL_TOKEN could not be validated." : "gh CLI token could not be validated.",
+    { source }
   );
 }
 function getEnvGitHubToken() {
@@ -651,12 +728,22 @@ async function validateGitHubToken(token, source, opts) {
     if (source === "env") {
       throw new GhAuthError(
         "missing_scopes",
-        `GITHUB_GRAPHQL_TOKEN is missing required scopes: ${scopeCheck.missing.join(", ")}`
+        `GITHUB_GRAPHQL_TOKEN is missing required scopes: ${scopeCheck.missing.join(", ")}`,
+        {
+          missingScopes: [...scopeCheck.missing],
+          currentScopes: viewer.scopes,
+          source
+        }
       );
     }
     throw new GhAuthError(
       "missing_scopes",
-      missingGhScopesMessage(scopeCheck.missing)
+      missingGhScopesMessage(scopeCheck.missing),
+      {
+        missingScopes: [...scopeCheck.missing],
+        currentScopes: viewer.scopes,
+        source
+      }
     );
   }
   return {
@@ -696,21 +783,28 @@ function ensureGhAuth(opts) {
   if (!checkGhInstalled({ execImpl })) {
     throw new GhAuthError(
       "not_installed",
-      "gh CLI is not installed. Install it from https://cli.github.com or set GITHUB_GRAPHQL_TOKEN."
+      "gh CLI is not installed. Install it from https://cli.github.com or set GITHUB_GRAPHQL_TOKEN.",
+      { source: "gh" }
     );
   }
   const auth = checkGhAuthenticated({ spawnImpl });
   if (!auth.authenticated) {
     throw new GhAuthError(
       "not_authenticated",
-      "Run 'gh auth login --scopes repo,read:org,project' or set GITHUB_GRAPHQL_TOKEN."
+      "Run 'gh auth login --scopes repo,read:org,project' or set GITHUB_GRAPHQL_TOKEN.",
+      { source: "gh" }
     );
   }
   const scopeCheck = checkGhScopes({ spawnImpl });
   if (!scopeCheck.valid) {
     throw new GhAuthError(
       "missing_scopes",
-      missingGhScopesMessage(scopeCheck.missing)
+      missingGhScopesMessage(scopeCheck.missing),
+      {
+        missingScopes: [...scopeCheck.missing],
+        currentScopes: scopeCheck.scopes,
+        source: "gh"
+      }
     );
   }
   const { token } = getGhTokenWithSource({
@@ -789,6 +883,7 @@ export {
   getProjectDetail,
   REQUIRED_GH_SCOPES,
   GhAuthError,
+  formatGhAuthRemediation,
   getEnvGitHubToken,
   checkGhInstalled,
   checkGhAuthenticated,

package/dist/{doctor-GIJAH7MA.js → doctor-TQR54KNZ.js}

@@ -5,13 +5,13 @@ import {
   parseIssueReference,
   readGitHubProjectBinding,
   renderIssueWorkflowPreview
-} from "./chunk-AA3T5AAJ.js";
-import "./chunk-PLBG7TZA.js";
+} from "./chunk-5U36B7FC.js";
+import "./chunk-DTPIJO6S.js";
 import {
   fetchGithubProjectIssueByRepositoryAndNumber,
   fetchGithubProjectIssues,
   inspectManagedProjectSelection
-} from "./chunk-ZGNAAHLD.js";
+} from "./chunk-NRABQNAX.js";
 import "./chunk-FAU72YC2.js";
 import {
   resolveRuntimeRoot
@@ -31,7 +31,7 @@ import {
   runGhAuthLogin,
   runGhAuthRefresh,
   validateGitHubToken
-} from "./chunk-BOM2BYZQ.js";
+} from "./chunk-SMNIGNS3.js";
 import {
   isClaudeRuntimeCommand,
   parseWorkflowMarkdown,

package/dist/index.js

@@ -282,7 +282,7 @@ var HELP_SECTIONS = [
       },
       {
         name: "repo start",
-        description: "Start the orchestrator (foreground)"
+        description: "Start the orchestrator after validating tracker authentication"
       },
       {
         name: "repo start --daemon",
@@ -417,13 +417,13 @@ function createRemovedCommandHandler(message) {
 
 // src/index.ts
 var COMMANDS = {
-  workflow: () => import("./workflow-ZPERNZJT.js"),
-  setup: () => import("./setup-KZ3U53PY.js"),
-  doctor: () => import("./doctor-GIJAH7MA.js"),
-  upgrade: () => import("./upgrade-K2PNQNWE.js"),
-  repo: () => import("./repo-LNO3Q3O7.js"),
+  workflow: () => import("./workflow-AV676KAP.js"),
+  setup: () => import("./setup-T2QENR26.js"),
+  doctor: () => import("./doctor-TQR54KNZ.js"),
+  upgrade: () => import("./upgrade-7452LZXX.js"),
+  repo: () => import("./repo-Y6EF2DZP.js"),
   config: () => import("./config-cmd-AOZVS6GU.js"),
-  version: () => import("./version-E45DDQPQ.js")
+  version: () => import("./version-D3FB3PXO.js")
 };
 function addGlobalOptions(command) {
   return command.option("--config <dir>", "Config directory").addOption(new Option("--config-dir <dir>").hideHelp()).option("-v, --verbose", "Enable verbose output").option("--json", "Output in JSON format").option("--no-color", "Disable color output");

package/dist/{repo-LNO3Q3O7.js → repo-Y6EF2DZP.js}

@@ -33,7 +33,7 @@ import {
   resolveOrchestratorLogLevel,
   resolveTrackerAdapter,
   runCli
-} from "./chunk-ZGNAAHLD.js";
+} from "./chunk-NRABQNAX.js";
 import "./chunk-FAU72YC2.js";
 import {
   resolveRepoRuntimeRoot,
@@ -41,8 +41,14 @@ import {
 } from "./chunk-RZ3WO7OV.js";
 import {
   GhAuthError,
-  getGhToken
-} from "./chunk-BOM2BYZQ.js";
+  GitHubApiError,
+  GitHubScopeError,
+  formatGhAuthRemediation,
+  getGhToken,
+  resolveGitHubAuth,
+  runGhAuthLogin,
+  runGhAuthRefresh
+} from "./chunk-SMNIGNS3.js";
 import {
   WorkflowConfigStore,
   deriveIssueWorkspaceKeyFromIdentifier,
@@ -765,6 +771,7 @@ import { writeFile, mkdir, readFile as readFile5, rm } from "fs/promises";
 import { dirname as dirname2, join as join6 } from "path";
 import { spawn } from "child_process";
 import { createServer as createServer3 } from "http";
+import * as p from "@clack/prompts";
 
 // ../dashboard/src/store.ts
 import { open } from "fs/promises";
@@ -1437,6 +1444,149 @@ function logLine(icon, msg) {
   process.stdout.write(`${timestamp()} ${icon} ${msg}
 `);
 }
+var REPO_START_COMMAND = "gh-symphony repo start";
+function isInteractiveTerminal() {
+  return process.stdin.isTTY === true && process.stdout.isTTY === true;
+}
+function displayGhAuthError(error) {
+  const remediation = formatGhAuthRemediation(error, {
+    retryCommand: REPO_START_COMMAND
+  });
+  process.stderr.write(`${remediation.title}: ${remediation.message}
+`);
+  process.stderr.write(`${remediation.hint}
+`);
+}
+function formatAuthSource(source) {
+  return source === "env" ? "GITHUB_GRAPHQL_TOKEN" : "gh CLI";
+}
+function displayGitHubAuthSuccess(auth) {
+  process.stdout.write(
+    `Authenticated via ${formatAuthSource(auth.source)} as ${auth.login}
+`
+  );
+}
+async function resolveRepoStartGitHubAuth(input) {
+  try {
+    const auth = await resolveGitHubAuth();
+    process.env.GITHUB_GRAPHQL_TOKEN = auth.token;
+    displayGitHubAuthSuccess(auth);
+    return { ok: true, githubAuthSource: auth.source };
+  } catch (error) {
+    if (!(error instanceof GhAuthError)) {
+      throw error;
+    }
+    displayGhAuthError(error);
+    const remediation = formatGhAuthRemediation(error, {
+      retryCommand: REPO_START_COMMAND
+    });
+    const canRemediate = input.allowInteractiveRemediation && isInteractiveTerminal() && remediation.command !== void 0 && error.details.source !== "env";
+    if (!canRemediate) {
+      process.exitCode = 1;
+      return { ok: false };
+    }
+    const shouldRun = await p.confirm({
+      message: `Run '${remediation.command}' now?`,
+      initialValue: true
+    });
+    if (p.isCancel(shouldRun) || shouldRun !== true) {
+      process.exitCode = 1;
+      return { ok: false };
+    }
+    const result = error.code === "missing_scopes" ? runGhAuthRefresh({ interactive: true }) : runGhAuthLogin({ interactive: true });
+    process.stderr.write(`${result.summary}
+`);
+    if (result.status !== "applied") {
+      process.exitCode = 1;
+      return { ok: false };
+    }
+    try {
+      const auth = await resolveGitHubAuth();
+      process.env.GITHUB_GRAPHQL_TOKEN = auth.token;
+      displayGitHubAuthSuccess(auth);
+      return { ok: true, githubAuthSource: auth.source };
+    } catch (retryError) {
+      if (retryError instanceof GhAuthError) {
+        displayGhAuthError(retryError);
+        process.exitCode = 1;
+        return { ok: false };
+      }
+      throw retryError;
+    }
+  }
+}
+async function preflightRepoStartAuth(projectConfig, input) {
+  if (projectConfig.tracker.adapter === "github-project") {
+    return resolveRepoStartGitHubAuth({
+      allowInteractiveRemediation: !input.daemon
+    });
+  }
+  if (projectConfig.tracker.adapter === "linear") {
+    if (process.env.LINEAR_API_KEY?.trim()) {
+      return { ok: true };
+    }
+    process.stderr.write(
+      "Linear authentication is required. Set LINEAR_API_KEY in the environment before running 'gh-symphony repo start'.\n"
+    );
+    process.exitCode = 1;
+    return { ok: false };
+  }
+  return { ok: true };
+}
+function isGitHubAuthRuntimeError(error) {
+  if (error instanceof GitHubScopeError) {
+    return true;
+  }
+  if (error instanceof GhAuthError) {
+    return error.code === "missing_scopes" || error.code === "invalid_token";
+  }
+  if (error instanceof GitHubApiError) {
+    return error.status === 401;
+  }
+  if (error instanceof Error) {
+    const maybeStatus = error.status;
+    if (maybeStatus === 401) {
+      return true;
+    }
+    const message = error.message.toLowerCase();
+    return message.includes("missing required github scopes") || message.includes("missing required scopes") || message.includes("missing required scope") || message.includes("missing_scopes") || message.includes("bad credentials") || message.includes("invalid token") || message.includes("authentication failed") || message.includes("status 401") || message.includes("401 unauthorized");
+  }
+  return false;
+}
+function ghRuntimeErrorToAuthError(error, source) {
+  if (error instanceof GhAuthError) {
+    return error;
+  }
+  if (error instanceof GitHubScopeError) {
+    return new GhAuthError(
+      "missing_scopes",
+      `GitHub token is missing required scopes: ${error.requiredScopes.join(", ")}`,
+      {
+        missingScopes: [...error.requiredScopes],
+        currentScopes: [...error.currentScopes],
+        source
+      }
+    );
+  }
+  if (error.message.toLowerCase().includes("missing required github scopes") || error.message.toLowerCase().includes("missing required scopes") || error.message.toLowerCase().includes("missing_scopes")) {
+    return new GhAuthError("missing_scopes", error.message, { source });
+  }
+  return new GhAuthError(
+    "invalid_token",
+    error.message || "GitHub token validation failed.",
+    { source }
+  );
+}
+function displayRuntimeAuthShutdown(error, source) {
+  const authError = ghRuntimeErrorToAuthError(error, source);
+  displayGhAuthError(authError);
+  process.stderr.write(
+    "Stopping repo start because GitHub authentication can no longer be validated.\n"
+  );
+}
+function shouldElevateGitHubAuthRuntimeError(projectConfig, error) {
+  return projectConfig.tracker.adapter === "github-project" && isGitHubAuthRuntimeError(error);
+}
 var DEFAULT_HTTP_PORT = 4680;
 var HTTP_HOST = "0.0.0.0";
 function parseStartArgs(args) {
@@ -1762,6 +1912,12 @@ var handler5 = async (args, options) => {
     process.exitCode = 2;
     return;
   }
+  const authPreflight = await preflightRepoStartAuth(projectConfig, {
+    daemon: parsed.daemon
+  });
+  if (!authPreflight.ok) {
+    return;
+  }
   if (parsed.daemon) {
     await startDaemon(
       options,
@@ -1773,12 +1929,6 @@ var handler5 = async (args, options) => {
     );
     return;
   }
-  if (!process.env.GITHUB_GRAPHQL_TOKEN) {
-    try {
-      process.env.GITHUB_GRAPHQL_TOKEN = getGhToken();
-    } catch {
-    }
-  }
   let projectLock = null;
   try {
     projectLock = await acquireProjectLock({
@@ -1789,11 +1939,29 @@ var handler5 = async (args, options) => {
     const store = createStore(runtimeRoot);
     let prevSnapshot = null;
     let isFirst = true;
+    let requestShutdown = null;
+    let authShutdownRequested = false;
     const service = new OrchestratorService(store, projectConfig, {
       logLevel,
       assignedOnly: parsed.assignedOnly,
       onTick: async (snapshot) => {
         try {
+          if (authShutdownRequested) {
+            return;
+          }
+          if (projectConfig.tracker.adapter === "github-project" && snapshot.lastError) {
+            const runtimeError = new Error(snapshot.lastError);
+            if (isGitHubAuthRuntimeError(runtimeError)) {
+              authShutdownRequested = true;
+              displayRuntimeAuthShutdown(
+                runtimeError,
+                authPreflight.githubAuthSource
+              );
+              process.exitCode = 1;
+              requestShutdown?.();
+              return;
+            }
+          }
           logTickResult(snapshot, prevSnapshot, isFirst);
           if (!isFirst) {
             const currentRunIds = new Set(
@@ -1813,6 +1981,13 @@ var handler5 = async (args, options) => {
           prevSnapshot = snapshot;
           isFirst = false;
         } catch (error) {
+          if (shouldElevateGitHubAuthRuntimeError(projectConfig, error)) {
+            authShutdownRequested = true;
+            displayRuntimeAuthShutdown(error, authPreflight.githubAuthSource);
+            process.exitCode = 1;
+            requestShutdown?.();
+            return;
+          }
           logLine(
             red("\u2717"),
             red(
@@ -1850,6 +2025,9 @@ var handler5 = async (args, options) => {
     const handleSigterm = () => {
       void shutdown();
     };
+    requestShutdown = () => {
+      void shutdown();
+    };
     process.on("SIGINT", handleSigint);
     process.on("SIGTERM", handleSigterm);
     try {
@@ -1923,6 +2101,13 @@ var handler5 = async (args, options) => {
           if (shuttingDown) {
             break;
           }
+          if (shouldElevateGitHubAuthRuntimeError(projectConfig, error)) {
+            authShutdownRequested = true;
+            displayRuntimeAuthShutdown(error, authPreflight.githubAuthSource);
+            process.exitCode = 1;
+            await shutdown();
+            return;
+          }
           logLine(
             red("\u2717"),
             red(
@@ -1998,7 +2183,7 @@ async function shutdownForegroundOrchestrator(input) {
       `Failed to release project lock: ${error instanceof Error ? error.message : "Unknown error"}`
     );
   }
-  return (input.exit ?? process.exit)(0);
+  return (input.exit ?? process.exit)(process.exitCode ?? 0);
 }
 function hasConfiguredRepository(config) {
   return Boolean(config.repository?.owner && config.repository.name);

package/dist/{setup-KZ3U53PY.js → setup-T2QENR26.js}

@@ -12,7 +12,7 @@ import {
   validateStateMapping,
   writeEcosystem,
   writeWorkflowPlan
-} from "./chunk-PLBG7TZA.js";
+} from "./chunk-DTPIJO6S.js";
 import {
   initRepoRuntime
 } from "./chunk-DLZ2XHWY.js";
@@ -20,6 +20,7 @@ import "./chunk-RZ3WO7OV.js";
 import {
   GhAuthError,
   GitHubScopeError,
+  REQUIRED_GH_SCOPES,
   checkRequiredScopes,
   createClient,
   ensureGhAuth,
@@ -27,14 +28,13 @@ import {
   getProjectDetail,
   listUserProjects,
   validateToken
-} from "./chunk-BOM2BYZQ.js";
+} from "./chunk-SMNIGNS3.js";
 import "./chunk-3SKN5L3I.js";
 import "./chunk-4ICDSQCJ.js";
 
 // src/commands/setup.ts
 import * as p from "@clack/prompts";
 import { resolve } from "path";
-var KNOWN_REQUIRED_SCOPES = ["repo", "read:org", "project"];
 function parseSetupFlags(args) {
   const flags = {
     nonInteractive: false,
@@ -74,7 +74,7 @@ function displayScopeError(error, retryCommand) {
     `Token is missing required scope${plural}: ${error.requiredScopes.join(", ")}`
   );
   const currentSet = new Set(error.currentScopes.map((s) => s.toLowerCase()));
-  const scopesToAdd = KNOWN_REQUIRED_SCOPES.filter((s) => !currentSet.has(s));
+  const scopesToAdd = REQUIRED_GH_SCOPES.filter((s) => !currentSet.has(s));
   const scopeArg = scopesToAdd.length > 0 ? scopesToAdd.join(",") : error.requiredScopes.join(",");
   p.note(
     `gh auth refresh --scopes ${scopeArg}
@@ -283,11 +283,17 @@ async function runInteractive(flags, _options) {
     authSpinner.stop("Authentication failed.");
     if (error instanceof GhAuthError) {
       if (error.code === "not_installed") {
-        p.log.error("gh CLI\uAC00 \uC124\uCE58\uB418\uC5B4 \uC788\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4. https://cli.github.com \uC5D0\uC11C \uC124\uCE58\uD558\uC138\uC694.");
+        p.log.error(
+          "gh CLI\uAC00 \uC124\uCE58\uB418\uC5B4 \uC788\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4. https://cli.github.com \uC5D0\uC11C \uC124\uCE58\uD558\uC138\uC694."
+        );
       } else if (error.code === "not_authenticated") {
-        p.log.error("gh auth login --scopes repo,read:org,project \uB97C \uC2E4\uD589\uD558\uC138\uC694.");
+        p.log.error(
+          "gh auth login --scopes repo,read:org,project \uB97C \uC2E4\uD589\uD558\uC138\uC694."
+        );
       } else if (error.code === "missing_scopes") {
-        p.log.error("gh auth refresh --scopes repo,read:org,project \uB97C \uC2E4\uD589\uD558\uC138\uC694.");
+        p.log.error(
+          "gh auth refresh --scopes repo,read:org,project \uB97C \uC2E4\uD589\uD558\uC138\uC694."
+        );
       } else {
         p.log.error(error.message);
       }
@@ -409,7 +415,9 @@ async function runInteractive(flags, _options) {
       repoDir: process.cwd(),
       workflowFile: workflowPath
     });
-    writeSpinner.stop(`Setup saved for ${runtime.repository.owner}/${runtime.repository.name}.`);
+    writeSpinner.stop(
+      `Setup saved for ${runtime.repository.owner}/${runtime.repository.name}.`
+    );
   } catch (error) {
     writeSpinner.stop("Setup failed.");
     p.log.error(error instanceof Error ? error.message : "Unknown error");

package/dist/{upgrade-K2PNQNWE.js → upgrade-7452LZXX.js}

@@ -16,8 +16,8 @@ function execFileAsync(file, args, execFileImpl = execFileCallback) {
   });
 }
 function resolveCurrentCliVersion() {
-  if ("0.2.3".length > 0) {
-    return "0.2.3";
+  if ("0.2.5".length > 0) {
+    return "0.2.5";
   }
   const pkg = JSON.parse(
     readFileSync(new URL("../../package.json", import.meta.url), "utf8")

package/dist/{version-E45DDQPQ.js → version-D3FB3PXO.js}

@@ -2,7 +2,7 @@
 
 // src/commands/version.ts
 var handler = async (_args, options) => {
-  const version = "0.2.3";
+  const version = "0.2.5";
   if (options.json) {
     process.stdout.write(JSON.stringify({ version }) + "\n");
   } else {

package/dist/{workflow-ZPERNZJT.js → workflow-AV676KAP.js}

@@ -6,11 +6,11 @@ import {
   resetWorkflowCommandDependenciesForTest,
   setWorkflowCommandDependenciesForTest,
   workflow_default
-} from "./chunk-AA3T5AAJ.js";
-import "./chunk-PLBG7TZA.js";
-import "./chunk-ZGNAAHLD.js";
+} from "./chunk-5U36B7FC.js";
+import "./chunk-DTPIJO6S.js";
+import "./chunk-NRABQNAX.js";
 import "./chunk-FAU72YC2.js";
-import "./chunk-BOM2BYZQ.js";
+import "./chunk-SMNIGNS3.js";
 import "./chunk-3SKN5L3I.js";
 import "./chunk-4ICDSQCJ.js";
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gh-symphony/cli",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "license": "MIT",
   "author": "hojinzs",
   "description": "Interactive CLI for GitHub Symphony orchestration",
@@ -43,11 +43,11 @@
     "tsup": "^8.5.1",
     "@gh-symphony/core": "0.0.14",
     "@gh-symphony/dashboard": "0.0.14",
+    "@gh-symphony/control-plane": "0.0.15",
     "@gh-symphony/orchestrator": "0.0.14",
     "@gh-symphony/runtime-claude": "0.0.14",
-    "@gh-symphony/worker": "0.0.14",
     "@gh-symphony/tracker-github": "0.0.14",
-    "@gh-symphony/control-plane": "0.0.15"
+    "@gh-symphony/worker": "0.0.14"
   },
   "scripts": {
     "build": "tsup",