@gh-symphony/cli 0.2.4 → 0.3.0

package/dist/{chunk-BOM2BYZQ.js → chunk-SMNIGNS3.js}

@@ -517,9 +517,10 @@ var PROJECT_ITEMS_PAGE_QUERY = `
 import { execFileSync, spawnSync } from "child_process";
 var REQUIRED_GH_SCOPES = ["repo", "read:org", "project"];
 var GhAuthError = class extends Error {
-  constructor(code, message) {
+  constructor(code, message, details = {}) {
     super(message);
     this.code = code;
+    this.details = details;
     this.name = "GhAuthError";
   }
 };
@@ -527,7 +528,77 @@ function ghTokenReadErrorMessage() {
   return "Failed to read a GitHub token from gh CLI. Run 'gh auth status' and try again.";
 }
 function missingGhScopesMessage(missing) {
-  return `Run 'gh auth refresh --scopes repo,read:org,project'. Missing scopes: ${missing.join(", ")}`;
+  return `Run 'gh auth refresh --scopes ${REQUIRED_GH_SCOPES.join(",")}'. Missing scopes: ${missing.join(", ")}`;
+}
+function parseMissingScopes(message) {
+  const matched = message.match(/Missing scopes:\s*([^.\n]+)/i);
+  if (!matched) {
+    return [];
+  }
+  return matched[1].split(",").map((scope) => scope.trim()).filter((scope) => scope.length > 0);
+}
+function formatGhAuthRemediation(error, opts) {
+  const retryCommand = opts?.retryCommand ?? "gh-symphony repo start";
+  switch (error.code) {
+    case "not_installed":
+      return {
+        title: "GitHub authentication is not available",
+        message: error.message,
+        hint: "Install gh CLI from https://cli.github.com or set GITHUB_GRAPHQL_TOKEN."
+      };
+    case "not_authenticated": {
+      const command = `gh auth login --scopes ${REQUIRED_GH_SCOPES.join(",")}`;
+      return {
+        title: "GitHub authentication is required",
+        message: error.message,
+        command,
+        hint: `Run '${command}', then re-run '${retryCommand}'.`
+      };
+    }
+    case "missing_scopes": {
+      if (error.details.source === "env") {
+        return {
+          title: "GitHub token is missing required scopes",
+          message: error.message,
+          hint: `Update GITHUB_GRAPHQL_TOKEN with a token that has ${REQUIRED_GH_SCOPES.join(",")} scopes, or unset it to use gh CLI auth, then re-run '${retryCommand}'.`
+        };
+      }
+      const currentSet = new Set(
+        (error.details.currentScopes ?? []).map((scope) => scope.toLowerCase())
+      );
+      const inferredMissing = currentSet.size > 0 ? REQUIRED_GH_SCOPES.filter((scope) => !currentSet.has(scope)) : [];
+      const missing = error.details.missingScopes?.length ? error.details.missingScopes : inferredMissing.length > 0 ? inferredMissing : parseMissingScopes(error.message);
+      const scopeArg = missing.length > 0 ? missing.join(",") : REQUIRED_GH_SCOPES.join(",");
+      const command = `gh auth refresh --scopes ${scopeArg}`;
+      return {
+        title: "GitHub token is missing required scopes",
+        message: error.message,
+        command,
+        hint: `Run '${command}', then re-run '${retryCommand}'.`
+      };
+    }
+    case "invalid_token":
+    case "token_failed": {
+      if (error.details.source === "env") {
+        return {
+          title: "GitHub token validation failed",
+          message: error.message,
+          hint: `Update or unset GITHUB_GRAPHQL_TOKEN, then re-run '${retryCommand}'.`
+        };
+      }
+      const command = `gh auth login --scopes ${REQUIRED_GH_SCOPES.join(",")}`;
+      return {
+        title: "GitHub token validation failed",
+        message: error.message,
+        command,
+        hint: `Run '${command}' to re-authenticate, then re-run '${retryCommand}'.`
+      };
+    }
+    default: {
+      const exhaustive = error.code;
+      throw new Error(`Unhandled GhAuthError code: ${exhaustive}`);
+    }
+  }
 }
 function classifyTokenValidationError(error, source) {
   if (error instanceof GhAuthError) {
@@ -537,19 +608,25 @@ function classifyTokenValidationError(error, source) {
     if (error.status === 401) {
       return new GhAuthError(
         source === "env" ? "invalid_token" : "token_failed",
-        source === "env" ? "GITHUB_GRAPHQL_TOKEN is invalid or expired." : ghTokenReadErrorMessage()
+        source === "env" ? "GITHUB_GRAPHQL_TOKEN is invalid or expired." : ghTokenReadErrorMessage(),
+        { source }
       );
     }
     const prefix = source === "env" ? "GITHUB_GRAPHQL_TOKEN could not be validated" : "gh CLI token could not be validated";
-    return new GhAuthError("token_failed", `${prefix}: ${error.message}`);
+    return new GhAuthError("token_failed", `${prefix}: ${error.message}`, {
+      source
+    });
   }
   if (error instanceof Error) {
     const prefix = source === "env" ? "GITHUB_GRAPHQL_TOKEN could not be validated" : "gh CLI token could not be validated";
-    return new GhAuthError("token_failed", `${prefix}: ${error.message}`);
+    return new GhAuthError("token_failed", `${prefix}: ${error.message}`, {
+      source
+    });
   }
   return new GhAuthError(
     "token_failed",
-    source === "env" ? "GITHUB_GRAPHQL_TOKEN could not be validated." : "gh CLI token could not be validated."
+    source === "env" ? "GITHUB_GRAPHQL_TOKEN could not be validated." : "gh CLI token could not be validated.",
+    { source }
   );
 }
 function getEnvGitHubToken() {
@@ -651,12 +728,22 @@ async function validateGitHubToken(token, source, opts) {
     if (source === "env") {
       throw new GhAuthError(
         "missing_scopes",
-        `GITHUB_GRAPHQL_TOKEN is missing required scopes: ${scopeCheck.missing.join(", ")}`
+        `GITHUB_GRAPHQL_TOKEN is missing required scopes: ${scopeCheck.missing.join(", ")}`,
+        {
+          missingScopes: [...scopeCheck.missing],
+          currentScopes: viewer.scopes,
+          source
+        }
       );
     }
     throw new GhAuthError(
       "missing_scopes",
-      missingGhScopesMessage(scopeCheck.missing)
+      missingGhScopesMessage(scopeCheck.missing),
+      {
+        missingScopes: [...scopeCheck.missing],
+        currentScopes: viewer.scopes,
+        source
+      }
     );
   }
   return {
@@ -696,21 +783,28 @@ function ensureGhAuth(opts) {
   if (!checkGhInstalled({ execImpl })) {
     throw new GhAuthError(
       "not_installed",
-      "gh CLI is not installed. Install it from https://cli.github.com or set GITHUB_GRAPHQL_TOKEN."
+      "gh CLI is not installed. Install it from https://cli.github.com or set GITHUB_GRAPHQL_TOKEN.",
+      { source: "gh" }
     );
   }
   const auth = checkGhAuthenticated({ spawnImpl });
   if (!auth.authenticated) {
     throw new GhAuthError(
       "not_authenticated",
-      "Run 'gh auth login --scopes repo,read:org,project' or set GITHUB_GRAPHQL_TOKEN."
+      "Run 'gh auth login --scopes repo,read:org,project' or set GITHUB_GRAPHQL_TOKEN.",
+      { source: "gh" }
     );
   }
   const scopeCheck = checkGhScopes({ spawnImpl });
   if (!scopeCheck.valid) {
     throw new GhAuthError(
       "missing_scopes",
-      missingGhScopesMessage(scopeCheck.missing)
+      missingGhScopesMessage(scopeCheck.missing),
+      {
+        missingScopes: [...scopeCheck.missing],
+        currentScopes: scopeCheck.scopes,
+        source: "gh"
+      }
     );
   }
   const { token } = getGhTokenWithSource({
@@ -789,6 +883,7 @@ export {
   getProjectDetail,
   REQUIRED_GH_SCOPES,
   GhAuthError,
+  formatGhAuthRemediation,
   getEnvGitHubToken,
   checkGhInstalled,
   checkGhAuthenticated,

package/dist/{chunk-NRABQNAX.js → chunk-VHEGRYK7.js}

@@ -30,7 +30,7 @@ import {
   resolveWorkflowRuntimeTimeouts,
   safeReadDir,
   scheduleRetryAt
-} from "./chunk-3SKN5L3I.js";
+} from "./chunk-5HQLPZR5.js";
 import {
   loadGlobalConfig,
   loadProjectConfig
@@ -4156,7 +4156,8 @@ var OrchestratorService = class {
         stateFieldName: "Status",
         activeStates: ["Todo", "In Progress"],
         terminalStates: ["Done"],
-        blockerCheckStates: ["Todo"]
+        blockerCheckStates: ["Todo"],
+        planningStates: ["Todo"]
       }
     };
   }

package/dist/{doctor-MD4MD6SZ.js → doctor-3IIM4UYS.js}

@@ -5,14 +5,14 @@ import {
   parseIssueReference,
   readGitHubProjectBinding,
   renderIssueWorkflowPreview
-} from "./chunk-7Z7WYGDL.js";
-import "./chunk-PLBG7TZA.js";
+} from "./chunk-GTNWFVFU.js";
+import "./chunk-GL55AKBI.js";
 import {
   fetchGithubProjectIssueByRepositoryAndNumber,
   fetchGithubProjectIssues,
   inspectManagedProjectSelection
-} from "./chunk-NRABQNAX.js";
-import "./chunk-FAU72YC2.js";
+} from "./chunk-VHEGRYK7.js";
+import "./chunk-A7EFL6EJ.js";
 import {
   resolveRuntimeRoot
 } from "./chunk-RZ3WO7OV.js";
@@ -31,7 +31,7 @@ import {
   runGhAuthLogin,
   runGhAuthRefresh,
   validateGitHubToken
-} from "./chunk-BOM2BYZQ.js";
+} from "./chunk-SMNIGNS3.js";
 import {
   isClaudeRuntimeCommand,
   parseWorkflowMarkdown,
@@ -40,7 +40,7 @@ import {
   resolveClaudeCommandBinary,
   resolveRuntimeCommandBinary,
   runClaudePreflight
-} from "./chunk-3SKN5L3I.js";
+} from "./chunk-5HQLPZR5.js";
 import {
   configFilePath,
   orchestratorLogPath,

package/dist/index.js

@@ -282,7 +282,7 @@ var HELP_SECTIONS = [
       },
       {
         name: "repo start",
-        description: "Start the orchestrator (foreground)"
+        description: "Start the orchestrator after validating tracker authentication"
       },
       {
         name: "repo start --daemon",
@@ -417,13 +417,13 @@ function createRemovedCommandHandler(message) {
 
 // src/index.ts
 var COMMANDS = {
-  workflow: () => import("./workflow-7Y6GTV2C.js"),
-  setup: () => import("./setup-KZ3U53PY.js"),
-  doctor: () => import("./doctor-MD4MD6SZ.js"),
-  upgrade: () => import("./upgrade-2WPPOUZL.js"),
-  repo: () => import("./repo-CK2IDMZF.js"),
+  workflow: () => import("./workflow-4OFPSVZ3.js"),
+  setup: () => import("./setup-G5VYN6FV.js"),
+  doctor: () => import("./doctor-3IIM4UYS.js"),
+  upgrade: () => import("./upgrade-BXIHAENU.js"),
+  repo: () => import("./repo-SLK4DDXH.js"),
   config: () => import("./config-cmd-AOZVS6GU.js"),
-  version: () => import("./version-Z2T42H5M.js")
+  version: () => import("./version-MC2KSPJB.js")
 };
 function addGlobalOptions(command) {
   return command.option("--config <dir>", "Config directory").addOption(new Option("--config-dir <dir>").hideHelp()).option("-v, --verbose", "Enable verbose output").option("--json", "Output in JSON format").option("--no-color", "Disable color output");

package/dist/{repo-CK2IDMZF.js → repo-SLK4DDXH.js}

@@ -17,7 +17,7 @@ import {
 import {
   initRepoRuntime,
   parseRepoRuntimeFlags
-} from "./chunk-DLZ2XHWY.js";
+} from "./chunk-2ZIPQ7ZS.js";
 import {
   OrchestratorService,
   acquireProjectLock,
@@ -33,16 +33,22 @@ import {
   resolveOrchestratorLogLevel,
   resolveTrackerAdapter,
   runCli
-} from "./chunk-NRABQNAX.js";
-import "./chunk-FAU72YC2.js";
+} from "./chunk-VHEGRYK7.js";
+import "./chunk-A7EFL6EJ.js";
 import {
   resolveRepoRuntimeRoot,
   resolveRuntimeRoot
 } from "./chunk-RZ3WO7OV.js";
 import {
   GhAuthError,
-  getGhToken
-} from "./chunk-BOM2BYZQ.js";
+  GitHubApiError,
+  GitHubScopeError,
+  formatGhAuthRemediation,
+  getGhToken,
+  resolveGitHubAuth,
+  runGhAuthLogin,
+  runGhAuthRefresh
+} from "./chunk-SMNIGNS3.js";
 import {
   WorkflowConfigStore,
   deriveIssueWorkspaceKeyFromIdentifier,
@@ -52,7 +58,7 @@ import {
   parseRecentEvents,
   readJsonFile,
   safeReadDir
-} from "./chunk-3SKN5L3I.js";
+} from "./chunk-5HQLPZR5.js";
 import {
   daemonPidPath,
   httpStatusPath,
@@ -765,6 +771,7 @@ import { writeFile, mkdir, readFile as readFile5, rm } from "fs/promises";
 import { dirname as dirname2, join as join6 } from "path";
 import { spawn } from "child_process";
 import { createServer as createServer3 } from "http";
+import * as p from "@clack/prompts";
 
 // ../dashboard/src/store.ts
 import { open } from "fs/promises";
@@ -1437,6 +1444,149 @@ function logLine(icon, msg) {
   process.stdout.write(`${timestamp()} ${icon} ${msg}
 `);
 }
+var REPO_START_COMMAND = "gh-symphony repo start";
+function isInteractiveTerminal() {
+  return process.stdin.isTTY === true && process.stdout.isTTY === true;
+}
+function displayGhAuthError(error) {
+  const remediation = formatGhAuthRemediation(error, {
+    retryCommand: REPO_START_COMMAND
+  });
+  process.stderr.write(`${remediation.title}: ${remediation.message}
+`);
+  process.stderr.write(`${remediation.hint}
+`);
+}
+function formatAuthSource(source) {
+  return source === "env" ? "GITHUB_GRAPHQL_TOKEN" : "gh CLI";
+}
+function displayGitHubAuthSuccess(auth) {
+  process.stdout.write(
+    `Authenticated via ${formatAuthSource(auth.source)} as ${auth.login}
+`
+  );
+}
+async function resolveRepoStartGitHubAuth(input) {
+  try {
+    const auth = await resolveGitHubAuth();
+    process.env.GITHUB_GRAPHQL_TOKEN = auth.token;
+    displayGitHubAuthSuccess(auth);
+    return { ok: true, githubAuthSource: auth.source };
+  } catch (error) {
+    if (!(error instanceof GhAuthError)) {
+      throw error;
+    }
+    displayGhAuthError(error);
+    const remediation = formatGhAuthRemediation(error, {
+      retryCommand: REPO_START_COMMAND
+    });
+    const canRemediate = input.allowInteractiveRemediation && isInteractiveTerminal() && remediation.command !== void 0 && error.details.source !== "env";
+    if (!canRemediate) {
+      process.exitCode = 1;
+      return { ok: false };
+    }
+    const shouldRun = await p.confirm({
+      message: `Run '${remediation.command}' now?`,
+      initialValue: true
+    });
+    if (p.isCancel(shouldRun) || shouldRun !== true) {
+      process.exitCode = 1;
+      return { ok: false };
+    }
+    const result = error.code === "missing_scopes" ? runGhAuthRefresh({ interactive: true }) : runGhAuthLogin({ interactive: true });
+    process.stderr.write(`${result.summary}
+`);
+    if (result.status !== "applied") {
+      process.exitCode = 1;
+      return { ok: false };
+    }
+    try {
+      const auth = await resolveGitHubAuth();
+      process.env.GITHUB_GRAPHQL_TOKEN = auth.token;
+      displayGitHubAuthSuccess(auth);
+      return { ok: true, githubAuthSource: auth.source };
+    } catch (retryError) {
+      if (retryError instanceof GhAuthError) {
+        displayGhAuthError(retryError);
+        process.exitCode = 1;
+        return { ok: false };
+      }
+      throw retryError;
+    }
+  }
+}
+async function preflightRepoStartAuth(projectConfig, input) {
+  if (projectConfig.tracker.adapter === "github-project") {
+    return resolveRepoStartGitHubAuth({
+      allowInteractiveRemediation: !input.daemon
+    });
+  }
+  if (projectConfig.tracker.adapter === "linear") {
+    if (process.env.LINEAR_API_KEY?.trim()) {
+      return { ok: true };
+    }
+    process.stderr.write(
+      "Linear authentication is required. Set LINEAR_API_KEY in the environment before running 'gh-symphony repo start'.\n"
+    );
+    process.exitCode = 1;
+    return { ok: false };
+  }
+  return { ok: true };
+}
+function isGitHubAuthRuntimeError(error) {
+  if (error instanceof GitHubScopeError) {
+    return true;
+  }
+  if (error instanceof GhAuthError) {
+    return error.code === "missing_scopes" || error.code === "invalid_token";
+  }
+  if (error instanceof GitHubApiError) {
+    return error.status === 401;
+  }
+  if (error instanceof Error) {
+    const maybeStatus = error.status;
+    if (maybeStatus === 401) {
+      return true;
+    }
+    const message = error.message.toLowerCase();
+    return message.includes("missing required github scopes") || message.includes("missing required scopes") || message.includes("missing required scope") || message.includes("missing_scopes") || message.includes("bad credentials") || message.includes("invalid token") || message.includes("authentication failed") || message.includes("status 401") || message.includes("401 unauthorized");
+  }
+  return false;
+}
+function ghRuntimeErrorToAuthError(error, source) {
+  if (error instanceof GhAuthError) {
+    return error;
+  }
+  if (error instanceof GitHubScopeError) {
+    return new GhAuthError(
+      "missing_scopes",
+      `GitHub token is missing required scopes: ${error.requiredScopes.join(", ")}`,
+      {
+        missingScopes: [...error.requiredScopes],
+        currentScopes: [...error.currentScopes],
+        source
+      }
+    );
+  }
+  if (error.message.toLowerCase().includes("missing required github scopes") || error.message.toLowerCase().includes("missing required scopes") || error.message.toLowerCase().includes("missing_scopes")) {
+    return new GhAuthError("missing_scopes", error.message, { source });
+  }
+  return new GhAuthError(
+    "invalid_token",
+    error.message || "GitHub token validation failed.",
+    { source }
+  );
+}
+function displayRuntimeAuthShutdown(error, source) {
+  const authError = ghRuntimeErrorToAuthError(error, source);
+  displayGhAuthError(authError);
+  process.stderr.write(
+    "Stopping repo start because GitHub authentication can no longer be validated.\n"
+  );
+}
+function shouldElevateGitHubAuthRuntimeError(projectConfig, error) {
+  return projectConfig.tracker.adapter === "github-project" && isGitHubAuthRuntimeError(error);
+}
 var DEFAULT_HTTP_PORT = 4680;
 var HTTP_HOST = "0.0.0.0";
 function parseStartArgs(args) {
@@ -1762,6 +1912,12 @@ var handler5 = async (args, options) => {
     process.exitCode = 2;
     return;
   }
+  const authPreflight = await preflightRepoStartAuth(projectConfig, {
+    daemon: parsed.daemon
+  });
+  if (!authPreflight.ok) {
+    return;
+  }
   if (parsed.daemon) {
     await startDaemon(
       options,
@@ -1773,12 +1929,6 @@ var handler5 = async (args, options) => {
     );
     return;
   }
-  if (!process.env.GITHUB_GRAPHQL_TOKEN) {
-    try {
-      process.env.GITHUB_GRAPHQL_TOKEN = getGhToken();
-    } catch {
-    }
-  }
   let projectLock = null;
   try {
     projectLock = await acquireProjectLock({
@@ -1789,11 +1939,29 @@ var handler5 = async (args, options) => {
     const store = createStore(runtimeRoot);
     let prevSnapshot = null;
     let isFirst = true;
+    let requestShutdown = null;
+    let authShutdownRequested = false;
     const service = new OrchestratorService(store, projectConfig, {
       logLevel,
       assignedOnly: parsed.assignedOnly,
       onTick: async (snapshot) => {
         try {
+          if (authShutdownRequested) {
+            return;
+          }
+          if (projectConfig.tracker.adapter === "github-project" && snapshot.lastError) {
+            const runtimeError = new Error(snapshot.lastError);
+            if (isGitHubAuthRuntimeError(runtimeError)) {
+              authShutdownRequested = true;
+              displayRuntimeAuthShutdown(
+                runtimeError,
+                authPreflight.githubAuthSource
+              );
+              process.exitCode = 1;
+              requestShutdown?.();
+              return;
+            }
+          }
           logTickResult(snapshot, prevSnapshot, isFirst);
           if (!isFirst) {
             const currentRunIds = new Set(
@@ -1813,6 +1981,13 @@ var handler5 = async (args, options) => {
           prevSnapshot = snapshot;
           isFirst = false;
         } catch (error) {
+          if (shouldElevateGitHubAuthRuntimeError(projectConfig, error)) {
+            authShutdownRequested = true;
+            displayRuntimeAuthShutdown(error, authPreflight.githubAuthSource);
+            process.exitCode = 1;
+            requestShutdown?.();
+            return;
+          }
           logLine(
             red("\u2717"),
             red(
@@ -1850,6 +2025,9 @@ var handler5 = async (args, options) => {
     const handleSigterm = () => {
       void shutdown();
     };
+    requestShutdown = () => {
+      void shutdown();
+    };
     process.on("SIGINT", handleSigint);
     process.on("SIGTERM", handleSigterm);
     try {
@@ -1923,6 +2101,13 @@ var handler5 = async (args, options) => {
           if (shuttingDown) {
             break;
           }
+          if (shouldElevateGitHubAuthRuntimeError(projectConfig, error)) {
+            authShutdownRequested = true;
+            displayRuntimeAuthShutdown(error, authPreflight.githubAuthSource);
+            process.exitCode = 1;
+            await shutdown();
+            return;
+          }
           logLine(
             red("\u2717"),
             red(
@@ -1998,7 +2183,7 @@ async function shutdownForegroundOrchestrator(input) {
       `Failed to release project lock: ${error instanceof Error ? error.message : "Unknown error"}`
     );
   }
-  return (input.exit ?? process.exit)(0);
+  return (input.exit ?? process.exit)(process.exitCode ?? 0);
 }
 function hasConfiguredRepository(config) {
   return Boolean(config.repository?.owner && config.repository.name);