@kylecheng3146/agent-ops 0.7.3 → 0.8.3

package/README.md

@@ -257,6 +257,8 @@ Init and update pre-authorize `agent-ops run` for Claude Code and Codex.
 
 ```bash
 agent-ops init --scope project --harness codex,claude --profile run --yes
+# an existing installation: add it, or later remove it (loop stays)
+agent-ops update --auto-run on
 ```
 
 ## Quick start from a source checkout

package/dist/packages/cli/src/args.js

@@ -75,6 +75,12 @@ export function parseArgs(argv) {
     let targetVersion;
     let title;
     let intent;
+    let taskGoal;
+    let debug = false;
+    let debugAction;
+    let payloadFile;
+    let commandId;
+    let eventId;
     let sessionId;
     let base;
     let parentBase;
@@ -95,6 +101,7 @@ export function parseArgs(argv) {
     const checkAuthTargets = [];
     let completionGate;
     let office;
+    let autoRun;
     let dryRun = false;
     let json = false;
     let yes = false;
@@ -209,6 +216,40 @@ export function parseArgs(argv) {
                 index += 1;
                 break;
             }
+            case "--goal":
+                if (taskGoal !== undefined)
+                    duplicate(token);
+                taskGoal = readOptionValue(argv, index++, token);
+                break;
+            case "--debug":
+                if (debug)
+                    duplicate(token);
+                debug = true;
+                break;
+            case "--debug-action": {
+                if (debugAction !== undefined)
+                    duplicate(token);
+                const value = readOptionValue(argv, index++, token);
+                if (!["status", "hypothesis", "strategy", "investigate", "checkpoint", "resume", "extend"].includes(value))
+                    invalidValue(token, value);
+                debugAction = value;
+                break;
+            }
+            case "--payload-file":
+                if (payloadFile !== undefined)
+                    duplicate(token);
+                payloadFile = readOptionValue(argv, index++, token);
+                break;
+            case "--command-id":
+                if (commandId !== undefined)
+                    duplicate(token);
+                commandId = readOptionValue(argv, index++, token);
+                break;
+            case "--event-id":
+                if (eventId !== undefined)
+                    duplicate(token);
+                eventId = readOptionValue(argv, index++, token);
+                break;
             case "--tree": {
                 if (tree)
                     duplicate(token);
@@ -328,6 +369,16 @@ export function parseArgs(argv) {
                 index += 1;
                 break;
             }
+            case "--auto-run": {
+                if (autoRun !== undefined)
+                    duplicate(token);
+                const value = readOptionValue(argv, index, token);
+                if (value !== "on" && value !== "off")
+                    invalidValue(token, value);
+                autoRun = value;
+                index += 1;
+                break;
+            }
             case "--worktree": {
                 if (worktree !== undefined) {
                     duplicate(token);
@@ -442,7 +493,7 @@ export function parseArgs(argv) {
                         "complete",
                         "create",
                         "export",
-                        "status", "revise", "replan", "pin-finding"
+                        "status", "revise", "replan", "pin-finding", "debug"
                     ].includes(token)) {
                     action = token;
                     break;
@@ -523,6 +574,7 @@ export function parseArgs(argv) {
             reviewTargets.length > 0 ||
             completionGate !== undefined ||
             office !== undefined ||
+            autoRun !== undefined ||
             sessionId !== undefined ||
             base !== undefined ||
             parentBase !== undefined ||
@@ -616,10 +668,22 @@ export function parseArgs(argv) {
     if (office !== undefined && command !== "init" && command !== "update") {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--office may be used only with init or update.");
     }
+    if (autoRun !== undefined && command !== "update") {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--auto-run may be used only with update; init selects the run profile.");
+    }
     if (worktree !== undefined && command !== "init" && command !== "update") {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--worktree may be used only with init or update.");
     }
     const revisionAction = command === "task" && ["revise", "replan", "pin-finding"].includes(action ?? "");
+    if ((taskGoal !== undefined || debug) && !(command === "task" && action === "create"))
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--goal and --debug apply only to task create.");
+    if ((debugAction !== undefined || commandId !== undefined || eventId !== undefined || payloadFile !== undefined) && !(command === "task" && action === "debug"))
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Debug operation options apply only to task debug.");
+    if (command === "task" && action === "debug" && (taskId === undefined || debugAction === undefined || title !== undefined || intent !== undefined ||
+        parentTaskId !== undefined || criteria.length > 0 || evidence.length > 0 ||
+        ((debugAction === "hypothesis" || debugAction === "strategy") !== (payloadFile !== undefined)) ||
+        ((debugAction === "investigate") !== (commandId !== undefined)) || ((debugAction === "extend") !== (eventId !== undefined))))
+        throw new CliArgumentError("CLI_MISSING_VALUE", "Task debug requires --task, --debug-action and the operation's exact payload/command/event options.");
     if ((criterionFiles.length > 0 && !(command === "task" && (action === "create" || action === "pin-finding"))) ||
         (criteriaFile !== undefined && !(command === "task" && action === "revise")) ||
         (planFile !== undefined && !(command === "task" && action === "replan")) ||
@@ -790,9 +854,16 @@ export function parseArgs(argv) {
         ...(targetVersion === undefined ? {} : { targetVersion }),
         ...(title === undefined ? {} : { title }),
         ...(intent === undefined ? {} : { intent }),
+        ...(taskGoal === undefined ? {} : { goal: taskGoal }),
+        ...(debug ? { debug: true } : {}),
+        ...(debugAction === undefined ? {} : { debugAction }),
+        ...(payloadFile === undefined ? {} : { payloadFile }),
+        ...(commandId === undefined ? {} : { commandId }),
+        ...(eventId === undefined ? {} : { eventId }),
         ...(reviewTargets.length === 0 ? {} : { reviewTargets }),
         ...(completionGate === undefined ? {} : { completionGate }),
         ...(office === undefined ? {} : { office }),
+        ...(autoRun === undefined ? {} : { autoRun }),
         ...(criteria.length === 0 ? {} : { criteria }),
         ...(criterionFiles.length === 0 ? {} : { criterionFiles }),
         ...(criteriaFile === undefined ? {} : { criteriaFile }),

package/dist/packages/cli/src/bin.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import { productionRunContext, runPhaseObserver } from "./run-deps.js";
+import { advancePhaseObserver, productionRunContext } from "./run-deps.js";
 import { AgentOpsError } from "../../../runtime/src/fs/paths.js";
 import { recordRunVerification } from "../../../runtime/src/run/verification.js";
 import { runOwnedLocalProof } from "./owned-run-step.js";
 import { runRunCommand } from "./commands/run.js";
 import { runOfficeCommand } from "./commands/office.js";
-import { ensureBackgroundOffice, observeOfficeSession, openOfficeBrowser, serveOffice } from "./office-entry.js";
+import { ensureBackgroundOffice, observeOfficeSession, officePhaseReporter, openOfficeBrowser, serveOffice } from "./office-entry.js";
 import { readFile, readdir, stat } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
@@ -42,6 +42,7 @@ import { hasFreshVerification, runReviewCommand } from "./commands/review.js";
 import { runBatchCommand } from "./commands/batch.js";
 import { createSourceGuard } from "../../../runtime/src/review/batch-guard.js";
 import { withReviewSlot } from "../../../runtime/src/review/slots.js";
+import { withActivity } from "../../../runtime/src/office/activity.js";
 import { memoizePreflight } from "../../../runtime/src/review/batch.js";
 import { createReviewExecutor, ReviewInterruptedError } from "../../../runtime/src/review/execute.js";
 import { probeReviewTargetDetailed } from "../../../runtime/src/review/probe.js";
@@ -60,6 +61,16 @@ import { runWorktreeCommand } from "./commands/parallel.js";
 import { ensureSessionWorktree, readWorktreeRecord, resolveCheckouts } from "../../../runtime/src/parallel/service.js";
 import { listWorktrees, branchLockDoctorResult, worktreeDoctorResult } from "../../../runtime/src/parallel/manage.js";
 import { detectGhostFiles, ghostFilesDoctorResult } from "../../../runtime/src/install/doctor.js";
+/** The repository's common Git directory, where display-only office records live; undefined when git cannot say. */
+async function officeCommonDir(dir) {
+    try {
+        const result = await gitRunner(dir).run(["rev-parse", "--path-format=absolute", "--git-common-dir"]);
+        return result.exitCode === 0 ? new TextDecoder().decode(result.stdout).trim() || undefined : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 const HOOK_RUNTIME_PATH = fileURLToPath(new URL("./hook-entry.js", import.meta.url));
 async function readOptionalText(path) {
     try {
@@ -413,6 +424,7 @@ else {
                         calculateTrustBinding: async (config) => await plannedTrustBinding(root, config),
                         confirm: async (plan, trust) => await confirmPlan(formatUpdatePlan(plan, trust)),
                         promptOffice: async (message, enabled) => await selectYesNo(message, { input: process.stdin, output: process.stdout }, enabled),
+                        promptAutoRun: async (message, enabled) => await selectYesNo(message, { input: process.stdin, output: process.stdout }, enabled),
                         promptWorktree: async (message) => await selectYesNo(message, { input: process.stdin, output: process.stdout }, true),
                         ...(updateArgs.targetVersion === undefined
                             ? {}
@@ -450,13 +462,13 @@ else {
                         ? await resolveCommandSessionId(root)
                         : sessionIdFromEnvironment() ?? await readRecordedSessionId(root));
                     if (args.action === "advance") {
+                        const advanceSession = sessionId ?? await resolveCommandSessionId(root);
                         return await runAdvanceCommand({
                             cwd: root,
-                            sessionId: sessionId ?? await resolveCommandSessionId(root),
+                            sessionId: advanceSession,
                             parentTaskId: args.taskId,
                             deps: worktreeDependencies(),
-                            ...(process.env.AGENT_OPS_RUN_ID === undefined || process.env.AGENT_OPS_WORKER_ID === undefined ? {} :
-                                { onPhase: await runPhaseObserver(root, process.env.AGENT_OPS_RUN_ID, process.env.AGENT_OPS_WORKER_ID) })
+                            onPhase: await advancePhaseObserver(root, advanceSession)
                         });
                     }
                     const createConfig = args.action === "create"
@@ -476,6 +488,7 @@ else {
                     return await runTaskCommand({
                         args,
                         service: taskService,
+                        ...(args.action !== "debug" ? {} : { trusted: await (async () => { const binding = await plannedTrustBinding(root, (await loadEffectiveConfig(root, "project")).config); return binding !== null && (await trustStore().status(binding)).status === "TRUSTED"; })() }),
                         ...(policyConfigHash === undefined ? {} : { policyConfigHash }),
                         ...(sessionId === undefined ? {} : { sessionId }),
                         ...(fromMain
@@ -521,16 +534,53 @@ else {
                     const slotDir = commonDirResult.exitCode === 0
                         ? new TextDecoder().decode(commonDirResult.stdout).trim()
                         : undefined;
+                    let reviewActivity;
+                    const inActivity = (executor) => async (request) => await withActivity(slotDir, { kind: "review", root,
+                        ...(reviewArgs.taskId === undefined ? {} : { taskId: reviewArgs.taskId }),
+                        ...(reviewSessionId === undefined ? {} : { sessionId: reviewSessionId }) }, async (handle) => {
+                        reviewActivity = handle;
+                        try {
+                            return await executor(request);
+                        }
+                        finally {
+                            reviewActivity = undefined;
+                        }
+                    });
+                    const debugRecord = reviewArgs.taskId === undefined ? undefined : await taskService.status({ taskId: reviewArgs.taskId });
+                    const inDebug = (executor) => debugRecord?.task.debug === undefined ? executor : async (request) => await taskService.debugService().review(debugRecord.task.id, () => executor(request));
                     const inSlot = (executor) => slotDir === undefined
-                        ? executor
+                        ? inDebug(executor)
                         : async (request) => await withReviewSlot({
                             dir: slotDir,
                             signal,
                             holder: { root, ...(reviewArgs.taskId === undefined ? {} : { taskId: reviewArgs.taskId }) },
+                            ...(debugRecord?.task.debug === undefined || reviewSessionId === undefined
+                                ? {}
+                                : (() => {
+                                    let paused = false;
+                                    const debug = taskService.debugService();
+                                    return {
+                                        onWaitStart: async () => {
+                                            if (paused)
+                                                return;
+                                            const current = await debug.root(debugRecord.task.id).catch(() => null);
+                                            if (current?.debug.foreground?.sessionId !== reviewSessionId)
+                                                return;
+                                            await debug.foregroundStop(debugRecord.task.id, reviewSessionId);
+                                            paused = true;
+                                        },
+                                        onWaitEnd: async () => {
+                                            if (!paused)
+                                                return;
+                                            await debug.foregroundStart(debugRecord.task.id, reviewSessionId);
+                                            paused = false;
+                                        }
+                                    };
+                                })()),
                             onWait: (line) => {
                                 process.stderr.write(`${progressPrefix}${line}\n`);
                             }
-                        }, async () => await executor(request));
+                        }, async () => await inDebug(executor)(request));
                     return {
                         args: reviewArgs,
                         authorized: reviewArgs.yes,
@@ -549,7 +599,8 @@ else {
                         currentPolicyConfigHash: async () => calculateConfigHash((await loadEffectiveConfig(root, reviewArgs.scope === "user" ? "user" : "project")).config),
                         config: reviewConfig,
                         evidenceStore: new FileEvidenceStore(root, root),
-                        execute: inSlot(createReviewExecutor({
+                        execute: inActivity(inSlot(createReviewExecutor({
+                            ...(debugRecord?.task.debug === undefined ? {} : { remainingBudgetMs: () => taskService.debugService().remaining(debugRecord.task.id) }),
                             runner: registeredRunProofRunner(),
                             targets: configuredReviewTargets,
                             cwd: root,
@@ -575,8 +626,11 @@ else {
                             signal,
                             onProgress: (line) => {
                                 process.stderr.write(`${progressPrefix}${line}\n`);
+                            },
+                            onRound: (round, target, targets) => {
+                                void reviewActivity?.update({ round, target, targets });
                             }
-                        }))
+                        })))
                     };
                 };
                 if (args.command === "review") {
@@ -662,7 +716,10 @@ else {
                             signal: controller.signal,
                             onProgress: (line) => {
                                 process.stderr.write(`batch: ${line}\n`);
-                            }
+                            },
+                            // The batch's tasks name the sessions whose people follow its steps.
+                            phaseReporter: async (taskIds) => await officePhaseReporter(root, (await new FileTaskStore(join(root, ".agent-ops", "tasks", "state.json"), root).read()).sessions
+                                .filter(({ taskId }) => taskIds.includes(taskId)).map(({ sessionId }) => sessionId))
                         });
                         if (interruptedBy !== undefined) {
                             process.exit(interruptedBy === "SIGINT" ? 130 : 143);
@@ -681,9 +738,11 @@ else {
                     const merged = await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project");
                     const config = merged.config;
                     const trustStatus = await repositoryTrust(root, config, CLI_VERSION);
+                    const verifySessionId = sessionIdFromEnvironment();
                     return await runVerifyCommand({
                         args,
                         taskService,
+                        activity: { commonDir: await officeCommonDir(root), root, ...(verifySessionId === undefined ? {} : { sessionId: verifySessionId }) },
                         service: { verify: async (taskId) => {
                                 const run = await runPolicyContext(root);
                                 const report = await new VerificationService({

package/dist/packages/cli/src/cli.js

@@ -25,7 +25,7 @@ Commands:
   doctor     Diagnose an installation
   update     Update managed artifacts
   uninstall  Remove managed artifacts
-  task <create|status|attach|revise|replan|pin-finding|advance|complete|archive|export>
+  task <create|status|attach|revise|replan|pin-finding|debug|advance|complete|archive|export>
              Manage independent task acceptance state
   verify     Run configured verification
   review     Run an independent review or show recorded reports
@@ -45,6 +45,7 @@ Options:
   --review-target <codex|agy|claude>  Repeatable init option; review pair order
   --completion-gate                  Init only: enable the project-loop completion gate
   --office <on|off>                   Init/update: enable or disable Office (Preview)
+  --auto-run <on|off>                 Update: add or remove the run profile (loop stays)
   --worktree <auto|off>              Init/update: configure session worktree isolation
   --check-auth                        Doctor only: probe selected review targets'
                                       authentication with one real call
@@ -152,6 +153,7 @@ Options:
   --harness <all|both|agy|claude|codex|opencode|comma-separated>
   --target-version <version>   Offline-capable update target
   --office <on|off>           Office (Preview); preserve choice unless supplied
+  --auto-run <on|off>          Add or remove the run profile (loop stays); preserve unless supplied
   --worktree <auto|off>        Configure session worktree isolation
   --dry-run
   --json
@@ -168,13 +170,19 @@ Options:
   --json
   --yes
 `,
-    task: `Usage: agent-ops task <create|status|attach|revise|replan|pin-finding|advance|complete|archive|export> [options]
+    task: `Usage: agent-ops task <create|status|attach|revise|replan|pin-finding|debug|advance|complete|archive|export> [options]
 
 Manage independent task acceptance state. Task commands accept none of
 --harness, --profile or --dry-run. Only advance accepts --yes.
 
 Options:
   --title <text>                        create
+  --goal <text>                         create: immutable original issue/goal
+  --debug                               create: task-level investigation tag
+  --debug-action <status|hypothesis|strategy|investigate|checkpoint|resume|extend>
+  --payload-file <path>                 debug hypothesis/strategy: bounded JSON
+  --command-id <id>                     debug investigate: trusted configured command
+  --event-id <native-event-id|latest>    debug extend: authentic human continue event
   --intent <text>                       create: intended behavior and constraints before editing
   --criterion <json>                    create, repeatable, two to five total
   --criterion-file <path>               create: one criterion object, repeatable; pin-finding: exactly one
@@ -186,7 +194,7 @@ Options:
   --baseline <git-ref>                  create/revise: baseline for new mechanical requirements
   --parent <task-id>                    create: record a subtask; status: list subtasks
   --task <id>                           status, attach, revise, replan, pin-finding, complete, archive, export, advance
-  --session <id>                        create, attach, status, advance
+  --session <id>                        create, attach, status, advance, debug
   --evidence <criterion-id=reference>   complete, repeatable
   --base <git-ref>                      complete: a clean committed range
   --yes                                 advance: authorize the two review sessions

package/dist/packages/cli/src/codex-loop-process.js

@@ -1,5 +1,6 @@
 import { PROJECT_LOOP_EVENTS, resolveProjectLoopRoot, runProjectLoop } from "../../../runtime/src/hooks/codex-loop.js";
 import { officeEnabled, officeLoopPhaseHint } from "./office-entry.js";
+import { routeDebugPrompt } from "./debug-intake.js";
 const MAX_LOOP_INPUT_BYTES = 64 * 1024;
 function isLoopHarness(value) {
     return value === "claude" || value === "codex";
@@ -73,6 +74,11 @@ export async function runLoopProcess(argv, io, dependencies = {}) {
                 ? {}
                 : { telemetryMaxBytes: dependencies.telemetryMaxBytes })
         });
+        if (event === "UserPromptSubmit" && managedRoot !== null && result.exitCode === 0 && result.stdout === "" && result.stderr === "") {
+            const context = await routeDebugPrompt(managedRoot, input, harness).catch(error => `DEBUG intake unavailable: ${error instanceof Error ? error.message : "preserve current state"}`);
+            if (context !== null)
+                io.writeStdout(harness === "claude" ? JSON.stringify({ hookSpecificOutput: { hookEventName: "UserPromptSubmit", additionalContext: context } }) : context + "\n");
+        }
         if (result.stdout.length > 0) {
             io.writeStdout(result.stdout);
         }

package/dist/packages/cli/src/commands/batch.js

@@ -66,6 +66,7 @@ export async function runBatchCommand(options) {
         };
     }
     const width = args.width ?? DEFAULT_BATCH_WIDTH;
+    const report = await options.phaseReporter?.(plan.map((item) => item.record.task.id)).catch(() => undefined);
     const outcomes = await runBatch(plan.map((item) => item.record.task.id), {
         isVerified: (id) => options.isVerified(id, base(id)),
         verify: (id, signal) => options.verify(id, base(id), signal),
@@ -74,7 +75,8 @@ export async function runBatchCommand(options) {
     }, {
         width,
         ...(options.signal === undefined ? {} : { signal: options.signal }),
-        ...(options.onProgress === undefined ? {} : { onProgress: options.onProgress })
+        ...(options.onProgress === undefined ? {} : { onProgress: options.onProgress }),
+        ...(report === undefined ? {} : { onPhase: (phase) => void report(phase).catch(() => { }) })
     });
     const byId = new Map(outcomes.map((outcome) => [outcome.id, outcome]));
     const tasks = plan.map((item) => {

package/dist/packages/cli/src/commands/hook.js

@@ -28,7 +28,9 @@ export async function runHookCommand(options) {
         const { capabilities } = options.config.profiles.length === 0
             ? { capabilities: [] }
             : resolveCapabilities(options.config);
-        const input = JSON.parse(options.stdin);
+        const input = options.input === undefined
+            ? JSON.parse(options.stdin)
+            : options.input;
         const descriptor = harnessDescriptor(options.harness);
         const normalized = normalizeHookInput(options.harness, input);
         if (normalized === null ||
@@ -55,6 +57,7 @@ export async function runHookCommand(options) {
                 ? {}
                 : { worktreeEnter: options.worktreeEnter })
         });
+        options.onResult?.(result);
         return descriptor.runtime.formatOutput(options.event, result);
     }
     catch {

package/dist/packages/cli/src/commands/review.js

@@ -15,6 +15,7 @@ import { assertSafeSupportingPaths, isReviewerPolicyPath, resolveReviewScope, re
 import { calculateSourceFingerprint } from "../../../../runtime/src/verify/source-fingerprint.js";
 import { calculateConfigHash, isPassingVerificationEvidence } from "../../../../runtime/src/verify/evidence.js";
 import { validateEvidence } from "../../../../runtime/src/schema/validate.js";
+import { loadDebugProof, debugProofDigest } from "../../../../runtime/src/task/debug-state.js";
 import { okEnvelope } from "../output.js";
 /**
  * Review runs against one target. Argument parsing already rejects a
@@ -640,6 +641,7 @@ export async function runReviewCommand(options) {
         }
         context.coverage = rows;
         context.binding = {
+            ...(context.records.every(r => r.task.debug === undefined) || options.root === undefined ? {} : { debugProofs: Object.fromEntries(await Promise.all(context.records.filter(r => r.task.debug !== undefined).map(async (r) => [r.task.id, debugProofDigest(await loadDebugProof(options.root, r.task.debug.rootTaskId))]))) }),
             taskContractHash: taskContractHash(context.records.find(r => r.task.id === context.taskId).task),
             taskContracts: Object.fromEntries(context.records.map(r => [r.task.id, taskContractHash(r.task)])),
             ...(context.treeTasks === undefined ? {} : { treeContractHash: treeContractHash(context.records.map(r => r.task)) }),
@@ -682,7 +684,8 @@ export async function runReviewCommand(options) {
             const content = redactSecrets(JSON.stringify({ binding: context.binding, coverage: context.coverage,
                 executionPolicy: options.config,
                 artifacts: contractArtifacts.map(({ path, digest }) => ({ path, digest })),
-                tasks: context.records.map(r => ({ task: r.task, revisions: r.revisions ?? [] })),
+                tasks: await Promise.all(context.records.map(async (r) => ({ task: r.task, revisions: r.revisions ?? [],
+                    ...(r.task.debug === undefined ? {} : { debugProof: await loadDebugProof(options.root, r.task.debug.rootTaskId) }) }))),
                 superseded: context.historyRecords ?? [] }, null, 2));
             const digest = sha256(content);
             const path = ".agent-ops/tasks/review-contracts/" + digest + ".json";
@@ -719,7 +722,7 @@ export async function runReviewCommand(options) {
     const priorFindings = options.root === undefined || context === undefined
         ? []
         : await findPriorFailingFindings(options.root, context.taskId);
-    const result = await runIndependentReview({
+    const executeReview = async () => await runIndependentReview({
         invocation: {
             harness: target,
             plannedTargets,
@@ -738,6 +741,7 @@ export async function runReviewCommand(options) {
             reason: "missing-cli"
         }))
     });
+    const result = await executeReview();
     if (scope !== undefined && result.report !== undefined && options.root !== undefined) {
         try {
             if (result.report.changedFilesInspected.length !== scope.changedFiles.length ||
@@ -781,7 +785,9 @@ export async function runReviewCommand(options) {
                     await options.tasks.treeContract(context.taskId) !== context.binding.treeContractHash) ||
                 (context !== undefined && options.tasks !== undefined &&
                     (await Promise.all(context.records.map(async (r) => taskContractHash((await options.tasks.status({ taskId: r.task.id })).task))))
-                        .some((hash, i) => hash !== taskContractHash(context.records[i].task)))) {
+                        .some((hash, i) => hash !== taskContractHash(context.records[i].task))) ||
+                (context?.binding?.debugProofs !== undefined && options.root !== undefined &&
+                    (await Promise.all(context.records.filter(r => r.task.debug !== undefined).map(async (r) => debugProofDigest(await loadDebugProof(options.root, r.task.debug.rootTaskId)) !== context.binding.debugProofs[r.task.id]))).some(Boolean))) {
                 const changed = await persistReviewEvidence(options, sourceChangedResult(result), sourceFingerprint, context);
                 return notRunEnvelope(changed);
             }

package/dist/packages/cli/src/commands/task.js

@@ -60,7 +60,7 @@ function taskAction(args) {
             "complete",
             "create",
             "export",
-            "status", "revise", "replan", "pin-finding"
+            "status", "revise", "replan", "pin-finding", "debug"
         ].includes(args.action)) {
         throw new AgentOpsError("TASK_ACTION_INVALID", "A supported task action is required.");
     }
@@ -72,7 +72,7 @@ function taskEnvelope(action, code, message, record) {
         message,
         record,
         contractHash: taskContractHash(record.task),
-        text: renderTaskMarkdown(record) + "\nContract: " + taskContractHash(record.task)
+        text: renderTaskMarkdown(record) + "\nContract: " + taskContractHash(record.task) + (record.debug === undefined ? "" : "\nDEBUG: " + JSON.stringify(record.debug))
     });
 }
 function renderTaskList(records) {
@@ -91,11 +91,15 @@ export async function runTaskCommand(options) {
             if (options.args.title === undefined) {
                 throw new AgentOpsError("TASK_TITLE_REQUIRED", "Task creation requires --title.");
             }
+            if (options.args.debug)
+                await options.service.assertDebugBaseline();
             const worktree = sessionId === undefined || options.sessionWorktree === undefined
                 ? undefined
                 : await options.sessionWorktree(sessionId);
             const record = await (worktree?.service ?? options.service).create({
                 title: options.args.title,
+                ...(options.args.goal === undefined ? {} : { goal: options.args.goal }),
+                ...(options.args.debug ? { debug: {} } : {}),
                 ...(options.args.intent === undefined ? {} : { intent: options.args.intent }),
                 criteria: [...(options.args.criteria ?? []).map(parseCriterion),
                     ...await Promise.all((options.args.criterionFiles ?? []).map(async (path) => await jsonFile(path)))]
@@ -109,6 +113,12 @@ export async function runTaskCommand(options) {
                     : { parentTaskId: options.args.parentTaskId }),
                 ...(sessionId === undefined ? {} : { sessionId })
             });
+            // An explicit CLI DEBUG intake may be the only start signal on hosts
+            // without a prompt hook (notably agy). The native session owns the clock;
+            // foregroundStart is idempotent for a repeated hook or command.
+            if (options.args.debug && sessionId !== undefined) {
+                await (worktree?.service ?? options.service).debugService().foregroundStart(record.task.id, sessionId);
+            }
             const created = taskEnvelope(action, "TASK_CREATED", sessionId === undefined
                 ? `Created task ${record.task.id}.`
                 : record.task.parentTaskId === undefined
@@ -134,6 +144,38 @@ export async function runTaskCommand(options) {
                 }
             };
         }
+        if (action === "debug") {
+            const id = requireTaskId(options.args), service = options.service.debugService();
+            switch (options.args.debugAction) {
+                case "hypothesis":
+                    await service.hypothesis(id, await jsonFile(options.args.payloadFile));
+                    break;
+                case "strategy":
+                    await service.strategy(id, await jsonFile(options.args.payloadFile));
+                    break;
+                case "investigate":
+                    await service.investigate(id, options.args.commandId, options.trusted === true);
+                    break;
+                case "checkpoint":
+                    if (sessionId === undefined)
+                        throw new AgentOpsError("TASK_SESSION_REQUIRED", "Debug checkpoint requires a session.");
+                    await service.checkpoint(id, sessionId);
+                    break;
+                case "resume":
+                    if (sessionId === undefined)
+                        throw new AgentOpsError("TASK_SESSION_REQUIRED", "Debug resume requires a session.");
+                    await service.resume(id, sessionId);
+                    break;
+                case "extend":
+                    if (sessionId === undefined)
+                        throw new AgentOpsError("TASK_SESSION_REQUIRED", "Debug extension requires a native session.");
+                    await service.extend(id, sessionId, options.args.eventId);
+                    break;
+                case "status": break;
+                default: throw new AgentOpsError("TASK_DEBUG_ACTION_INVALID", "A supported debug operation is required.");
+            }
+            return taskEnvelope(action, "TASK_DEBUG_UPDATED", "Original issue debug state preserved.", await service.root(id));
+        }
         if (action === "revise") {
             const payload = await jsonFile(options.args.criteriaFile);
             if (!Array.isArray(payload))

package/dist/packages/cli/src/commands/update.js

@@ -1,6 +1,7 @@
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { loadConfigFile } from "../../../../runtime/src/config/load.js";
+import { parseInstallManifest } from "../../../../runtime/src/fs/manifest.js";
 import { detectWorktreeSetup } from "../../../../runtime/src/install/parallel-setup.js";
 import { applyUpdatePlan, createUpdatePlan } from "../../../../runtime/src/install/update.js";
 import { okEnvelope } from "../output.js";
@@ -17,6 +18,7 @@ export function formatUpdatePlan(plan, trust) {
         metadata: [
             `Target version: ${plan.targetVersion}`,
             `Office (Preview): ${plan.installation.config.features.office?.enabled === true ? "enabled" : "disabled"}`,
+            `Auto-run: ${plan.installation.config.profiles.includes("run") ? "enabled" : "disabled"}`,
             `Harness: ${plan.installation.harness.join(", ")}`,
             ...(plan.installation.config.worktree === undefined
                 ? []
@@ -73,6 +75,14 @@ async function existingConfigHasWorktree(root) {
         return false;
     }
 }
+async function installedHarness(root) {
+    try {
+        return parseInstallManifest(await readFile(join(root, ".agent-ops", "manifest.json"), "utf8")).harness;
+    }
+    catch {
+        return [];
+    }
+}
 export async function runUpdateCommand(options) {
     let worktree;
     if (options.args.worktree === "auto") {
@@ -102,10 +112,18 @@ export async function runUpdateCommand(options) {
         const { config } = await loadConfigFile(join(options.root, ".agent-ops", "config.json"));
         officeEnabled = await options.promptOffice("Enable Office (Preview)?", config.features.office?.enabled === true);
     }
+    let autoRun = options.args.autoRun === undefined ? undefined : options.args.autoRun === "on";
+    if (autoRun === undefined && options.promptAutoRun !== undefined && options.isTTY && !options.args.yes &&
+        (options.platform ?? process.platform) === "darwin" &&
+        (options.args.harness ?? await installedHarness(options.root)).some((harness) => harness === "claude" || harness === "codex")) {
+        const { config } = await loadConfigFile(join(options.root, ".agent-ops", "config.json"));
+        autoRun = await options.promptAutoRun("Enable auto-run (hand changes needing more than five acceptance criteria to agent-ops run)?", config.profiles.includes("run"));
+    }
     const plan = await createUpdatePlan({
         root: options.root,
         adapters: options.adapters,
         ...(officeEnabled === undefined ? {} : { officeEnabled }),
+        ...(autoRun === undefined ? {} : { autoRun }),
         ...(options.args.harness === undefined
             ? {}
             : { harness: options.args.harness }),

package/dist/packages/cli/src/commands/verify.js

@@ -1,3 +1,4 @@
+import { withActivity } from "../../../../runtime/src/office/activity.js";
 import { AgentOpsError } from "../../../../runtime/src/fs/paths.js";
 import { redactSecrets } from "../../../../runtime/src/security/redact.js";
 import { safeTaskText } from "../../../../runtime/src/task/render.js";
@@ -90,7 +91,8 @@ async function resolveTaskId(options) {
 }
 export async function runVerifyCommand(options) {
     try {
-        const report = publicReport(await options.service.verify(await resolveTaskId(options)));
+        const taskId = await resolveTaskId(options), activity = options.activity;
+        const report = publicReport(await withActivity(activity?.commonDir, { kind: "verify", root: activity?.root ?? "", taskId, ...(activity?.sessionId === undefined ? {} : { sessionId: activity.sessionId }) }, async () => await options.service.verify(taskId)));
         const text = formatReport(report);
         if (report.status === "PASS") {
             return okEnvelope("VERIFICATION_PASSED", {