@sentry/warden 0.20.0 → 0.22.0

package/dist/cli/main.js

@@ -1,9 +1,11 @@
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { config as dotenvConfig } from 'dotenv';
 import { Sentry, flushSentry, setGlobalAttributes, emitRunMetric, getTraceId } from '../sentry.js';
 import { loadWardenConfig, resolveSkillConfigs } from '../config/loader.js';
 import { verifyAuth } from '../sdk/runner.js';
+import { mapExtractionErrorCode } from '../sdk/errors.js';
+import { mergeAuxiliaryUsage } from '../sdk/usage.js';
 import { resolveSkillAsync } from '../skills/loader.js';
 import { matchTrigger, filterContextByPaths, shouldFail, countFindingsAtOrAbove } from '../triggers/matcher.js';
 import { filterFindings } from '../types/index.js';
@@ -12,7 +14,7 @@ import { parseCliArgs, showHelp, showVersion, classifyTargets } from './args.js'
 import { buildLocalEventContext, buildFileEventContext } from './context.js';
 import { getRepoRoot, getHeadSha, refExists, hasUncommittedChanges } from './git.js';
 import { renderTerminalReport, filterReports } from './terminal.js';
-import { Reporter, detectOutputMode, parseVerbosity, Verbosity, runSkillTasks, runSkillTasksWithInk, pluralize, MODEL_DEFAULT_SENTINEL, writeJsonlContent, renderJsonlString, getRepoLogPath, generateRunId, } from './output/index.js';
+import { Reporter, detectOutputMode, parseVerbosity, Verbosity, runSkillTasks, runSkillTasksWithInk, pluralize, MODEL_DEFAULT_SENTINEL, writeJsonlContent, renderJsonlString, renderJsonlChunkLine, renderJsonlChunkRecords, initJsonlFile, appendJsonlLine, getRepoLogPath, generateRunId, } from './output/index.js';
 import { cleanupArtifacts } from './log-cleanup.js';
 import { collectFixableFindings, applyAllFixes, runInteractiveFixFlow, renderFixSummary, } from './fix.js';
 import { UserAbortError } from './input.js';
@@ -20,7 +22,7 @@ import { runInit } from './commands/init.js';
 import { runAdd } from './commands/add.js';
 import { runSetupApp } from './commands/setup-app.js';
 import { runSync } from './commands/sync.js';
-import { runLogs } from './commands/logs.js';
+import { runRuns } from './commands/runs.js';
 /**
  * Global abort controller for graceful shutdown on SIGINT.
  * Used to cancel in-progress SDK queries.
@@ -69,15 +71,18 @@ function resolveConfigPath(options, repoPath) {
     return options.config ? resolve(cwd, options.config) : resolve(repoPath, 'warden.toml');
 }
 /**
- * Write a minimal JSONL log (summary-only, 0 findings) for early-exit paths.
- * Returns the rendered content and the log file path. The content is always
- * available even if the file write fails, so callers can use it for --json
- * output without reading back from disk.
+ * Emit a minimal JSONL log (summary-only, 0 findings) for early-exit paths.
+ *
+ * Behavior:
+ * - `--json`: writes to stdout (the API contract for piping consumers).
+ * - `--output <path>`: writes to that explicit path (CI artifacts).
+ * - Default `.warden/logs/`: written only when `error` is set. Real
+ *   failures (auth, config load, etc.) belong in the on-disk audit trail;
+ *   pure no-ops (no files, no skills) would just clutter it.
  */
-function writeEmptyRunLog(repoPath, opts) {
+function emitEmptyRunLog(repoPath, options, error) {
     const runId = generateRunId();
     const timestamp = new Date();
-    const logPath = getRepoLogPath(repoPath, runId, timestamp);
     let headSha;
     try {
         headSha = getHeadSha(repoPath);
@@ -85,43 +90,319 @@ function writeEmptyRunLog(repoPath, opts) {
     catch {
         // Not in a git repo or HEAD is unborn
     }
-    const content = renderJsonlString([], 0, { runId, traceId: opts?.traceId, timestamp, headSha });
+    const content = renderJsonlString([], 0, {
+        runId,
+        traceId: getTraceId(),
+        timestamp,
+        headSha,
+        error,
+    });
+    if (error) {
+        const logPath = getRepoLogPath(repoPath, runId, timestamp);
+        try {
+            writeJsonlContent(logPath, content);
+        }
+        catch (err) {
+            console.warn(`Warning: Failed to write run log: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    if (options.output) {
+        try {
+            writeJsonlContent(options.output, content);
+        }
+        catch (err) {
+            console.warn(`Warning: Failed to write output file: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    if (options.json) {
+        process.stdout.write(content);
+    }
+}
+function initializeRunLog(args) {
+    const { repoPath, runId, timestamp, traceId, headSha, model, outputPath, reporter, startTime } = args;
+    const baseRun = {
+        timestamp: timestamp.toISOString(),
+        cwd: process.cwd(),
+        runId,
+        traceId,
+        model,
+        headSha,
+    };
+    const primaryLogPath = getRepoLogPath(repoPath, runId, timestamp);
+    let primaryLogWritten = false;
     try {
-        writeJsonlContent(logPath, content);
+        initJsonlFile(primaryLogPath);
+        primaryLogWritten = true;
     }
     catch (err) {
-        console.warn(`Warning: Failed to write run log: ${err instanceof Error ? err.message : String(err)}`);
+        reporter.warning(`Failed to write run log: ${err instanceof Error ? err.message : String(err)}`);
     }
-    if (opts?.outputPath) {
+    let resolvedOutputPath;
+    if (outputPath) {
         try {
-            writeJsonlContent(opts.outputPath, content);
+            initJsonlFile(outputPath);
+            resolvedOutputPath = outputPath;
         }
         catch (err) {
-            console.warn(`Warning: Failed to write output file: ${err instanceof Error ? err.message : String(err)}`);
+            reporter.warning(`Failed to write output file: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    const paths = [];
+    const seenPaths = new Set();
+    const addPath = (path) => {
+        const key = resolve(process.cwd(), path);
+        if (seenPaths.has(key))
+            return;
+        seenPaths.add(key);
+        paths.push(path);
+    };
+    if (primaryLogWritten)
+        addPath(primaryLogPath);
+    if (resolvedOutputPath)
+        addPath(resolvedOutputPath);
+    return { paths, primaryLogPath, primaryLogWritten, outputPath: resolvedOutputPath, startTime, baseRun, chunks: [] };
+}
+function appendChunkToRunLog(log, skillName, chunk) {
+    if (log.paths.length === 0)
+        return;
+    const auxiliaryUsage = chunk.auxiliaryUsage?.reduce((acc, entry) => mergeAuxiliaryUsage(acc, { [entry.agent]: entry.usage }), undefined);
+    const error = chunk.failed
+        ? {
+            code: chunk.failureCode ?? 'unknown',
+            message: chunk.failureMessage ?? 'unknown error',
+            timestamp: new Date().toISOString(),
+        }
+        : chunk.extractionFailed
+            ? {
+                code: mapExtractionErrorCode(chunk.extractionError),
+                message: chunk.extractionError ?? 'unknown extraction error',
+                timestamp: new Date().toISOString(),
+            }
+            : undefined;
+    const record = {
+        schemaVersion: 1,
+        run: { ...log.baseRun, durationMs: Date.now() - log.startTime },
+        skill: skillName,
+        model: chunk.model,
+        chunk: {
+            file: chunk.filename,
+            index: chunk.index,
+            total: chunk.total,
+            lineRange: chunk.lineRange,
+        },
+        status: error ? 'error' : 'ok',
+        findings: chunk.findings,
+        usage: chunk.usage,
+        durationMs: chunk.durationMs,
+        auxiliaryUsage,
+        error,
+    };
+    let line;
+    try {
+        line = renderJsonlChunkLine(record);
+    }
+    catch {
+        return;
+    }
+    log.chunks.push(record);
+    for (const p of log.paths) {
+        try {
+            appendJsonlLine(p, line);
+        }
+        catch { /* best-effort */ }
+    }
+}
+function buildReportChunkRecord(log, report, runDurationMs, index = 1, total = 1, error) {
+    const reportError = report.error ?? error;
+    return {
+        schemaVersion: 1,
+        run: { ...log.baseRun, durationMs: runDurationMs },
+        skill: report.skill,
+        model: report.model,
+        chunk: {
+            file: report.skippedFiles?.[0]?.filename ?? '',
+            index,
+            total,
+            lineRange: '',
+        },
+        status: reportError ? 'error' : report.skippedFiles?.length ? 'skipped' : 'ok',
+        findings: report.findings,
+        usage: report.usage,
+        durationMs: report.durationMs ?? runDurationMs,
+        auxiliaryUsage: report.auxiliaryUsage,
+        error: reportError,
+        skippedFiles: report.skippedFiles,
+    };
+}
+function buildRunErrorChunkRecord(log, runDurationMs, error) {
+    return {
+        schemaVersion: 1,
+        run: { ...log.baseRun, durationMs: runDurationMs },
+        skill: 'run',
+        chunk: {
+            file: '',
+            index: 1,
+            total: 1,
+            lineRange: '',
+        },
+        status: 'error',
+        findings: [],
+        durationMs: runDurationMs,
+        error,
+    };
+}
+function hasReportRecord(log, report) {
+    return log.chunks.some((chunk) => {
+        if (chunk.skill !== report.skill)
+            return false;
+        if (report.error) {
+            return chunk.error?.code === report.error.code && chunk.error.message === report.error.message;
+        }
+        if (report.skippedFiles?.length) {
+            return (chunk.skippedFiles?.length ?? 0) > 0;
+        }
+        return true;
+    });
+}
+function shouldStreamReportRecord(log, report) {
+    if (hasReportRecord(log, report))
+        return false;
+    return Boolean(report.error || report.skippedFiles?.length || !log.chunks.some((chunk) => chunk.skill === report.skill));
+}
+function appendReportToRunLog(log, report) {
+    if (!shouldStreamReportRecord(log, report))
+        return;
+    const record = buildReportChunkRecord(log, report, Date.now() - log.startTime);
+    let line;
+    try {
+        line = renderJsonlChunkLine(record);
+    }
+    catch {
+        return;
+    }
+    log.chunks.push(record);
+    for (const p of log.paths) {
+        try {
+            appendJsonlLine(p, line);
+        }
+        catch { /* best-effort */ }
+    }
+}
+function lineRangeIncludes(lineRange, line) {
+    if (!lineRange)
+        return false;
+    const [startText, endText] = lineRange.split('-');
+    const start = Number(startText);
+    const end = endText ? Number(endText) : start;
+    return Number.isFinite(start) && Number.isFinite(end) && line >= start && line <= end;
+}
+function findChunkForFinding(chunks, skill, finding) {
+    const sameSkill = chunks.filter((chunk) => chunk.skill === skill && chunk.chunk.file);
+    const location = finding.location;
+    if (!location)
+        return sameSkill[0];
+    return sameSkill.find((chunk) => chunk.chunk.file === location.path && lineRangeIncludes(chunk.chunk.lineRange, location.startLine)) ?? sameSkill.find((chunk) => chunk.chunk.file === location.path) ?? sameSkill[0];
+}
+function buildFinalChunkRecords(log, reports, totalDurationMs, error) {
+    const finalRun = { ...log.baseRun, durationMs: totalDurationMs };
+    if (log.chunks.length === 0) {
+        if (reports.length === 0 && error) {
+            return [buildRunErrorChunkRecord(log, totalDurationMs, error)];
+        }
+        return reports.map((report) => buildReportChunkRecord(log, report, totalDurationMs, undefined, undefined, error));
+    }
+    const findingsByChunk = new Map();
+    for (const report of reports) {
+        for (const finding of report.findings) {
+            const chunk = findChunkForFinding(log.chunks, report.skill, finding);
+            if (!chunk)
+                continue;
+            const findings = findingsByChunk.get(chunk) ?? [];
+            findings.push(finding);
+            findingsByChunk.set(chunk, findings);
+        }
+    }
+    const chunkRecords = log.chunks.map((chunk) => ({
+        ...chunk,
+        run: { ...finalRun },
+        findings: findingsByChunk.get(chunk) ?? [],
+    }));
+    const finalLog = { ...log, chunks: chunkRecords };
+    const missingReports = reports.filter((report) => shouldStreamReportRecord(finalLog, report));
+    return [
+        ...chunkRecords,
+        ...missingReports.map((report) => buildReportChunkRecord(log, report, totalDurationMs, undefined, undefined, error)),
+    ];
+}
+/**
+ * Rewrite the run log with final chunk records. Returns the set of paths that
+ * accepted the write, so the caller can decide whether to claim
+ * "wrote JSONL output to X" (only true when the final log actually landed).
+ */
+function finalizeRunLog(log, reports, totalDurationMs, error) {
+    const wrote = new Set();
+    if (log.paths.length === 0)
+        return wrote;
+    let content;
+    try {
+        const records = buildFinalChunkRecords(log, reports, totalDurationMs, error);
+        content = renderJsonlChunkRecords(records);
+    }
+    catch {
+        return wrote;
+    }
+    for (const p of log.paths) {
+        const targetPath = resolve(process.cwd(), p);
+        const tempPath = `${targetPath}.${process.pid}.${Date.now()}.tmp`;
+        const tempDonePath = `${tempPath}.done`;
+        try {
+            writeJsonlContent(tempPath, content);
+            writeFileSync(tempDonePath, '');
+            renameSync(tempPath, targetPath);
+            renameSync(tempDonePath, `${targetPath}.done`);
+            wrote.add(p);
+        }
+        catch {
+            try {
+                unlinkSync(tempPath);
+            }
+            catch { /* ignore */ }
+            try {
+                unlinkSync(tempDonePath);
+            }
+            catch { /* ignore */ }
+            // best-effort
         }
     }
-    return { logPath, content };
+    return wrote;
 }
 /**
  * Process skill task results into reports and check for failures.
+ * Exported for testing; callers inside main.ts use it directly.
  */
-function processTaskResults(results, reportOn, minConfidence) {
+export function processTaskResults(results, reportOn, minConfidence) {
     const reports = [];
     let hasFailure = false;
     const failureReasons = [];
     for (const result of results) {
-        if (result.report) {
-            reports.push(result.report);
-            // Apply confidence filtering before failOn evaluation so low-confidence findings
-            // don't cause exit code 1. Per-result minConfidence (from trigger config) takes
-            // precedence over the global default.
-            const effectiveConfidence = result.minConfidence ?? minConfidence;
-            const reportForFail = { ...result.report, findings: filterFindings(result.report.findings, undefined, effectiveConfidence) };
-            if (result.failOn && shouldFail(reportForFail, result.failOn)) {
-                hasFailure = true;
-                const count = countFindingsAtOrAbove(reportForFail, result.failOn);
-                failureReasons.push(`${result.name}: ${count} ${result.failOn}+ severity ${pluralize(count, 'issue')}`);
-            }
+        if (!result.report)
+            continue;
+        reports.push(result.report);
+        // Skill-level errors always fail the run, independent of failOn thresholds.
+        if (result.report.error) {
+            hasFailure = true;
+            failureReasons.push(`${result.name}: ${result.report.error.code}: ${result.report.error.message}`);
+            continue;
+        }
+        // Apply confidence filtering before failOn evaluation so low-confidence findings
+        // don't cause exit code 1. Per-result minConfidence (from trigger config) takes
+        // precedence over the global default.
+        const effectiveConfidence = result.minConfidence ?? minConfidence;
+        const reportForFail = { ...result.report, findings: filterFindings(result.report.findings, undefined, effectiveConfidence) };
+        if (result.failOn && shouldFail(reportForFail, result.failOn)) {
+            hasFailure = true;
+            const count = countFindingsAtOrAbove(reportForFail, result.failOn);
+            failureReasons.push(`${result.name}: ${count} ${result.failOn}+ severity ${pluralize(count, 'issue')}`);
         }
     }
     const filteredReports = filterReports(reports, reportOn, minConfidence);
@@ -130,39 +411,17 @@ function processTaskResults(results, reportOn, minConfidence) {
 /**
  * Output results and handle fixes. Returns exit code.
  */
-async function outputResultsAndHandleFixes(processed, options, reporter, repoPath, totalDuration, failFastAborted, resolvedModel) {
+async function outputResultsAndHandleFixes(processed, options, reporter, runLog, totalDuration, failFastAborted) {
     const { reports, filteredReports, hasFailure, failureReasons } = processed;
-    const traceId = getTraceId();
-    const runId = generateRunId();
-    const timestamp = new Date();
-    // Capture HEAD SHA safely (non-fatal if not in a git repo)
-    let headSha;
-    try {
-        headSha = getHeadSha(repoPath);
-    }
-    catch {
-        // Not in a git repo or HEAD is unborn
-    }
-    // Render JSONL content once so repo log and --output have identical timestamps
-    const jsonlContent = renderJsonlString(reports, totalDuration, { runId, traceId, timestamp, model: resolvedModel, headSha });
-    // Always write repo-local JSONL log (non-fatal — don't lose analysis output)
-    const logPath = getRepoLogPath(repoPath, runId, timestamp);
-    let logWritten = false;
-    try {
-        writeJsonlContent(logPath, jsonlContent);
-        logWritten = true;
-    }
-    catch (err) {
-        reporter.warning(`Failed to write run log: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    // Write additional copy to --output path if specified
-    if (options.output) {
-        try {
-            writeJsonlContent(options.output, jsonlContent);
-            reporter.success(`Wrote JSONL output to ${options.output}`);
+    const traceId = runLog.baseRun.traceId;
+    const finalizedPaths = finalizeRunLog(runLog, reports, totalDuration);
+    // Only claim --output succeeded if the summary actually landed there.
+    if (runLog.outputPath) {
+        if (finalizedPaths.has(runLog.outputPath)) {
+            reporter.success(`Wrote JSONL output to ${runLog.outputPath}`);
         }
-        catch (err) {
-            reporter.warning(`Failed to write output file: ${err instanceof Error ? err.message : String(err)}`);
+        else {
+            reporter.warning(`Failed to write output file: ${runLog.outputPath}`);
         }
     }
     // Collect fixable findings early so we know whether to suppress diffs in the report
@@ -175,14 +434,31 @@ async function outputResultsAndHandleFixes(processed, options, reporter, repoPat
         && reporter.verbosity !== Verbosity.Quiet
         && reporter.mode.isTTY
         && process.stdin.isTTY;
-    // Output results
     reporter.blank();
     if (options.json) {
-        // --json: output pre-rendered JSONL (identical to log file contents)
+        // Prefer reading the on-disk log (per-skill durationMs is a snapshot).
+        // Only read it back if finalize actually landed the summary there;
+        // a half-written file should fall through to the in-memory render.
+        // The fallback renders the same chunk-record shape in memory.
+        let jsonlContent;
+        if (finalizedPaths.has(runLog.primaryLogPath)) {
+            try {
+                jsonlContent = readFileSync(runLog.primaryLogPath, 'utf-8');
+            }
+            catch { /* fall through */ }
+        }
+        if (!jsonlContent) {
+            try {
+                jsonlContent = renderJsonlChunkRecords(buildFinalChunkRecords(runLog, reports, totalDuration));
+            }
+            catch (err) {
+                reporter.error(`Failed to render JSONL output: ${err instanceof Error ? err.message : String(err)}`);
+                return 1;
+            }
+        }
         process.stdout.write(jsonlContent);
     }
     else {
-        // Suppress fix diffs in report when interactive step-through will show them
         console.log(renderTerminalReport(filteredReports, reporter.mode, { suppressFixDiffs: willStepThrough, verbosity: reporter.verbosity }));
     }
     // Show interrupted / fail-fast banner before summary
@@ -198,8 +474,8 @@ async function outputResultsAndHandleFixes(processed, options, reporter, repoPat
     reporter.blank();
     reporter.renderSummary(filteredReports, totalDuration, { traceId });
     // Show log file path after summary (only if write succeeded)
-    if (!options.json && logWritten) {
-        reporter.dim(`Log: ${logPath}`);
+    if (!options.json && runLog.primaryLogWritten) {
+        reporter.dim(`Log: ${runLog.primaryLogPath}`);
     }
     // Handle fixes: --fix (automatic) always runs, interactive step-through in TTY mode
     if (fixableFindings.length > 0) {
@@ -250,15 +526,13 @@ async function runSkills(context, options, reporter) {
         verifyAuth({ apiKey });
     }
     catch (error) {
-        reporter.error(error.message);
-        const effectiveRepo = repoPath ?? cwd;
-        if (options.json) {
-            const { content } = writeEmptyRunLog(effectiveRepo, { traceId: getTraceId(), outputPath: options.output });
-            process.stdout.write(content);
-        }
-        else {
-            writeEmptyRunLog(effectiveRepo, { traceId: getTraceId(), outputPath: options.output });
-        }
+        const message = error.message;
+        reporter.error(message);
+        emitEmptyRunLog(repoPath ?? cwd, options, {
+            code: 'auth_failed',
+            message,
+            timestamp: new Date().toISOString(),
+        });
         return 1;
     }
     // Resolve config path
@@ -310,13 +584,8 @@ async function runSkills(context, options, reporter) {
     emitRunMetric();
     // Handle case where no skills to run
     if (skillsToRun.length === 0) {
-        const effectiveRepo = repoPath ?? cwd;
-        if (options.json) {
-            const { content } = writeEmptyRunLog(effectiveRepo, { traceId: getTraceId(), outputPath: options.output });
-            process.stdout.write(content);
-        }
-        else {
-            writeEmptyRunLog(effectiveRepo, { traceId: getTraceId(), outputPath: options.output });
+        emitEmptyRunLog(repoPath ?? cwd, options);
+        if (!options.json) {
             reporter.warning('No triggers matched for the changed files');
             reporter.tip('Specify a skill explicitly: warden <target> --skill <name>');
         }
@@ -347,6 +616,29 @@ async function runSkills(context, options, reporter) {
         context: filterContextByPaths(context, filters),
         runnerOptions,
     }));
+    // Open the run's JSONL log before launching skills so `warden runs
+    // follow <runId>` works from a second terminal while the run is live.
+    const runId = generateRunId();
+    const timestamp = new Date();
+    const traceId = getTraceId();
+    let headSha;
+    try {
+        headSha = getHeadSha(repoPath ?? cwd);
+    }
+    catch {
+        // Not a git repo or HEAD is unborn — non-fatal
+    }
+    const runLog = initializeRunLog({
+        repoPath: repoPath ?? cwd,
+        runId,
+        timestamp,
+        traceId,
+        headSha,
+        model: logModel,
+        outputPath: options.output,
+        reporter,
+        startTime,
+    });
     // Run skills with Ink UI (TTY) or simple console output (non-TTY)
     const concurrency = options.parallel ?? DEFAULT_CONCURRENCY;
     failFastController = options.failFast ? new AbortController() : undefined;
@@ -355,6 +647,8 @@ async function runSkills(context, options, reporter) {
         verbosity: reporter.verbosity,
         concurrency,
         failFastController,
+        onChunkComplete: (skillName, chunk) => appendChunkToRunLog(runLog, skillName, chunk),
+        onSkillComplete: (report) => appendReportToRunLog(runLog, report),
     };
     const results = reporter.mode.isTTY
         ? await runSkillTasksWithInk(tasks, taskOptions)
@@ -363,7 +657,7 @@ async function runSkills(context, options, reporter) {
     const totalDuration = Date.now() - startTime;
     const effectiveMinConfidence = options.minConfidence ?? config?.defaults?.minConfidence ?? 'medium';
     const processed = processTaskResults(results, options.reportOn, effectiveMinConfidence);
-    return outputResultsAndHandleFixes(processed, options, reporter, repoPath ?? cwd, totalDuration, failFastController?.signal.aborted, logModel);
+    return outputResultsAndHandleFixes(processed, options, reporter, runLog, totalDuration, failFastController?.signal.aborted);
 }
 /**
  * Run in file mode: analyze specific files.
@@ -382,12 +676,8 @@ async function runFileMode(filePatterns, options, reporter) {
         return 1;
     }
     if (pullRequest.files.length === 0) {
-        if (options.json) {
-            const { content } = writeEmptyRunLog(cwd, { traceId: getTraceId(), outputPath: options.output });
-            process.stdout.write(content);
-        }
-        else {
-            writeEmptyRunLog(cwd, { traceId: getTraceId(), outputPath: options.output });
+        emitEmptyRunLog(cwd, options);
+        if (!options.json) {
             reporter.blank();
             reporter.warning('No files matched the given patterns');
         }
@@ -456,12 +746,8 @@ async function runGitRefMode(gitRef, options, reporter) {
         return 1;
     }
     if (pullRequest.files.length === 0) {
-        if (options.json) {
-            const { content } = writeEmptyRunLog(repoPath, { traceId: getTraceId(), outputPath: options.output });
-            process.stdout.write(content);
-        }
-        else {
-            writeEmptyRunLog(repoPath, { traceId: getTraceId(), outputPath: options.output });
+        emitEmptyRunLog(repoPath, options);
+        if (!options.json) {
             reporter.renderEmptyState('No changes found');
             reporter.blank();
         }
@@ -509,12 +795,8 @@ async function runConfigMode(options, reporter) {
         return 1;
     }
     if (pullRequest.files.length === 0) {
-        if (options.json) {
-            const { content } = writeEmptyRunLog(repoPath, { traceId: getTraceId(), outputPath: options.output });
-            process.stdout.write(content);
-        }
-        else {
-            writeEmptyRunLog(repoPath, { traceId: getTraceId(), outputPath: options.output });
+        emitEmptyRunLog(repoPath, options);
+        if (!options.json) {
             if (options.staged) {
                 reporter.renderEmptyState('No staged changes found');
             }
@@ -549,12 +831,8 @@ async function runConfigMode(options, reporter) {
     }
     const triggersToRun = [...seen.values()];
     if (triggersToRun.length === 0) {
-        if (options.json) {
-            const { content } = writeEmptyRunLog(repoPath, { traceId: getTraceId(), outputPath: options.output });
-            process.stdout.write(content);
-        }
-        else {
-            writeEmptyRunLog(repoPath, { traceId: getTraceId(), outputPath: options.output });
+        emitEmptyRunLog(repoPath, options);
+        if (!options.json) {
             reporter.blank();
             if (options.skill) {
                 reporter.warning(`No triggers matched for skill: ${options.skill}`);
@@ -577,14 +855,13 @@ async function runConfigMode(options, reporter) {
         verifyAuth({ apiKey });
     }
     catch (error) {
-        reporter.error(error.message);
-        if (options.json) {
-            const { content } = writeEmptyRunLog(repoPath, { traceId: getTraceId(), outputPath: options.output });
-            process.stdout.write(content);
-        }
-        else {
-            writeEmptyRunLog(repoPath, { traceId: getTraceId(), outputPath: options.output });
-        }
+        const message = error.message;
+        reporter.error(message);
+        emitEmptyRunLog(repoPath, options, {
+            code: 'auth_failed',
+            message,
+            timestamp: new Date().toISOString(),
+        });
         return 1;
     }
     // Build trigger tasks
@@ -608,6 +885,33 @@ async function runConfigMode(options, reporter) {
             auxiliaryMaxRetries: config.defaults?.auxiliaryMaxRetries,
         },
     }));
+    // Initialize the run's JSONL log up front so a second terminal can
+    // `warden runs follow <runId>` while skills are still running.
+    // Skill records are appended on each completion; the trailing summary
+    // is appended in `outputResultsAndHandleFixes`.
+    // Run-level model is the default (ignoring per-trigger overrides); per-skill models are on each report.
+    const defaultModel = config.defaults?.model ?? options.model ?? process.env['WARDEN_MODEL'] ?? MODEL_DEFAULT_SENTINEL;
+    const runId = generateRunId();
+    const timestamp = new Date();
+    const traceId = getTraceId();
+    let headSha;
+    try {
+        headSha = getHeadSha(repoPath);
+    }
+    catch {
+        // Not a git repo or HEAD is unborn — non-fatal
+    }
+    const runLog = initializeRunLog({
+        repoPath,
+        runId,
+        timestamp,
+        traceId,
+        headSha,
+        model: defaultModel,
+        outputPath: options.output,
+        reporter,
+        startTime,
+    });
     // Run triggers with Ink UI (TTY) or simple console output (non-TTY)
     const concurrency = options.parallel ?? config.runner?.concurrency ?? DEFAULT_CONCURRENCY;
     failFastController = options.failFast ? new AbortController() : undefined;
@@ -616,6 +920,8 @@ async function runConfigMode(options, reporter) {
         verbosity: reporter.verbosity,
         concurrency,
         failFastController,
+        onChunkComplete: (skillName, chunk) => appendChunkToRunLog(runLog, skillName, chunk),
+        onSkillComplete: (report) => appendReportToRunLog(runLog, report),
     };
     const results = reporter.mode.isTTY
         ? await runSkillTasksWithInk(tasks, taskOptions)
@@ -623,9 +929,7 @@ async function runConfigMode(options, reporter) {
     // Process results and output
     const totalDuration = Date.now() - startTime;
     const processed = processTaskResults(results, options.reportOn, effectiveMinConfidence);
-    // Run-level model is the default (ignoring per-trigger overrides); per-skill models are on each report.
-    const defaultModel = config.defaults?.model ?? options.model ?? process.env['WARDEN_MODEL'] ?? MODEL_DEFAULT_SENTINEL;
-    return outputResultsAndHandleFixes(processed, options, reporter, repoPath, totalDuration, failFastController?.signal.aborted, defaultModel);
+    return outputResultsAndHandleFixes(processed, options, reporter, runLog, totalDuration, failFastController?.signal.aborted);
 }
 /**
  * Run in direct skill mode: run a specific skill on uncommitted changes.
@@ -660,12 +964,8 @@ async function runDirectSkillMode(options, reporter) {
         return 1;
     }
     if (pullRequest.files.length === 0) {
-        if (options.json) {
-            const { content } = writeEmptyRunLog(repoPath, { traceId: getTraceId(), outputPath: options.output });
-            process.stdout.write(content);
-        }
-        else {
-            writeEmptyRunLog(repoPath, { traceId: getTraceId(), outputPath: options.output });
+        emitEmptyRunLog(repoPath, options);
+        if (!options.json) {
             if (options.staged) {
                 reporter.renderEmptyState('No staged changes found');
             }
@@ -717,7 +1017,7 @@ async function runCommand(options, reporter) {
     return runFileMode(filePatterns, options, reporter);
 }
 export async function main() {
-    const { command, options, setupAppOptions, logsOptions } = parseCliArgs();
+    const { command, options, setupAppOptions, runsOptions } = parseCliArgs();
     if (command === 'help') {
         showHelp();
         process.exit(0);
@@ -762,12 +1062,12 @@ export async function main() {
                 return runSetupApp(setupAppOptions, reporter);
             case 'sync':
                 return runSync(options, reporter);
-            case 'logs':
-                if (!logsOptions) {
-                    reporter.error('Missing logs options');
+            case 'runs':
+                if (!runsOptions) {
+                    reporter.error('Missing runs options');
                     process.exit(1);
                 }
-                return runLogs(logsOptions, options, reporter);
+                return runRuns(runsOptions, options, reporter);
             default:
                 return runCommand(options, reporter);
         }