automata-cli 0.11.0-develop.501 → 0.11.0-develop.514

package/dist/index.js

@@ -2,6 +2,8 @@
 import {
   DEFAULT_CHECK_ISSUE_PROMPT,
   DEFAULT_CLAUDE_SYSTEM_PROMPT,
+  DEFAULT_CONDUCTOR_ISSUE_PROMPT,
+  DEFAULT_CONDUCTOR_PR_PROMPT,
   DEFAULT_DO_WORK,
   DEFAULT_DO_WORK_ISSUE_DISCUSS_PROMPT,
   DEFAULT_DO_WORK_PR_ORPHAN_PROMPT,
@@ -313,6 +315,45 @@ var configSetConductorPrompt = new Command("conductor-prompt").description("Set
   process.stdout.write(`conductor ${kind} prompt set.
 `);
 });
+function writeConductor(patch) {
+  const current = readRawConfig();
+  writeConfig({ ...current, conductor: { ...current.conductor, ...patch } });
+}
+function requireExecutor(value) {
+  if (!VALID_EXECUTORS.includes(value)) {
+    process.stderr.write(`Error: invalid executor "${value}". Must be one of: ${VALID_EXECUTORS.join(", ")}
+`);
+    process.exit(1);
+  }
+  return value;
+}
+var configSetConductorExecutor = new Command("conductor-executor").description("Set the executor the conductor runs").argument("<value>", `Executor: ${VALID_EXECUTORS.join(", ")}`).action((value) => {
+  writeConductor({ executor: requireExecutor(value) });
+  process.stdout.write(`conductor executor set to: ${value}
+`);
+});
+var configSetConductorModel = new Command("conductor-model").description("Set the model the conductor passes to one executor").argument("<executor>", `Executor: ${VALID_EXECUTORS.join(", ")}`).argument("<value>", "Model identifier").action((executor, value) => {
+  const which = requireExecutor(executor);
+  const model = value.trim();
+  if (model.length === 0) {
+    process.stderr.write("Error: conductor-model requires a non-empty model identifier.\n");
+    process.exit(1);
+  }
+  writeConductor({ models: { ...readRawConfig().conductor?.models, [which]: model } });
+  process.stdout.write(`conductor ${which} model set to: ${model}
+`);
+});
+var configSetConductorEffort = new Command("conductor-effort").description("Set the reasoning effort the conductor passes to one executor").argument("<executor>", `Executor: ${VALID_EXECUTORS.join(", ")}`).argument("<value>", "Effort level, forwarded to the executor unchanged").action((executor, value) => {
+  const which = requireExecutor(executor);
+  const effort = value.trim();
+  if (effort.length === 0) {
+    process.stderr.write("Error: conductor-effort requires a non-empty effort level.\n");
+    process.exit(1);
+  }
+  writeConductor({ effort: { ...readRawConfig().conductor?.effort, [which]: effort } });
+  process.stdout.write(`conductor ${which} effort set to: ${effort}
+`);
+});
 var configSetGitTrunkBranch = new Command("git-trunk-branch").description("Pin the branch `publish-release` releases to, instead of detecting it").argument("<value>", "Branch name (unset = detect it from the remote)").action((value) => {
   const branch = value.trim();
   if (branch.length === 0) {
@@ -336,7 +377,7 @@ var configSetGitReleaseFlow = new Command("git-release-flow").description("Pin t
   process.stdout.write(`git release flow set to: ${flow}
 `);
 });
-var configSet = new Command("set").description("Set a configuration value").addCommand(configSetType).addCommand(configSetIssueDiscoveryTechnique).addCommand(configSetIssueDiscoveryValue).addCommand(configSetClaudeSystemPrompt).addCommand(configSetAllowedUsers).addCommand(configSetAgentUser).addCommand(configSetDoWorkBaseBranch).addCommand(configSetDoWorkProtectedBranches).addCommand(configSetDoWorkExecutor).addCommand(configSetDoWorkModel).addCommand(configSetDoWorkEffort).addCommand(configSetDoWorkMaxRuns).addCommand(configSetDoWorkLockStaleMinutes).addCommand(configSetDoWorkDumpOnBlock).addCommand(configSetDoWorkPostRunLog).addCommand(configSetDoWorkPrompt).addCommand(configSetConductorPrompt).addCommand(configSetGitTrunkBranch).addCommand(configSetGitReleaseFlow);
+var configSet = new Command("set").description("Set a configuration value").addCommand(configSetType).addCommand(configSetIssueDiscoveryTechnique).addCommand(configSetIssueDiscoveryValue).addCommand(configSetClaudeSystemPrompt).addCommand(configSetAllowedUsers).addCommand(configSetAgentUser).addCommand(configSetDoWorkBaseBranch).addCommand(configSetDoWorkProtectedBranches).addCommand(configSetDoWorkExecutor).addCommand(configSetDoWorkModel).addCommand(configSetDoWorkEffort).addCommand(configSetDoWorkMaxRuns).addCommand(configSetDoWorkLockStaleMinutes).addCommand(configSetDoWorkDumpOnBlock).addCommand(configSetDoWorkPostRunLog).addCommand(configSetDoWorkPrompt).addCommand(configSetConductorPrompt).addCommand(configSetConductorExecutor).addCommand(configSetConductorModel).addCommand(configSetConductorEffort).addCommand(configSetGitTrunkBranch).addCommand(configSetGitReleaseFlow);
 var configCommand = new Command("config").description("Configure automata settings").addCommand(configSet).action(async () => {
   const [{ render }, React, { ConfigWizard }] = await Promise.all([
     import("ink"),
@@ -392,8 +433,8 @@ function extractIdentity(stdout) {
     if (typeof id === "string" && id) return id;
     if (id && typeof id === "object") {
       const o = id;
-      for (const key of ["displayName", "uniqueName", "providerDisplayName", "id"]) {
-        if (typeof o[key] === "string" && o[key]) return o[key];
+      for (const key2 of ["displayName", "uniqueName", "providerDisplayName", "id"]) {
+        if (typeof o[key2] === "string" && o[key2]) return o[key2];
       }
     }
   } catch {
@@ -2544,6 +2585,19 @@ function getPrSurface(prNumber) {
     description: { author: login(raw.author), body: raw.body }
   };
 }
+function getPrChecks(prNumber) {
+  const raw = ghJson(
+    ["pr", "view", String(prNumber), "--json", "statusCheckRollup"],
+    `read the checks of pull request #${String(prNumber)}`
+  );
+  return (raw.statusCheckRollup ?? []).map((check) => {
+    const name = check.name ?? check.context ?? "unnamed check";
+    if (check.status !== void 0) return { name, status: check.status, conclusion: check.conclusion ?? null };
+    const state = check.state ?? "";
+    const pending = state === "PENDING" || state === "EXPECTED";
+    return { name, status: pending ? "PENDING" : "COMPLETED", conclusion: pending || state === "" ? null : state };
+  });
+}
 function assignIssueToAgent(issueNumber, agentUser) {
   const { stderr, status } = run4("gh", [
     "issue",
@@ -2821,9 +2875,47 @@ async function terminateTrackedChildren(timeoutMs = 1e4, killGraceMs = 5e3) {
 }
 
 // src/claude/claudeService.ts
+function claudeReadOnlyTools(replyTo) {
+  const tools = [
+    "Read(./**)",
+    "Grep(./**)",
+    "Glob(./**)",
+    "Bash(gh issue view:*)",
+    "Bash(gh pr view:*)",
+    "Bash(gh pr diff:*)",
+    "Bash(gh pr checks:*)",
+    "Bash(git status:*)"
+  ];
+  if (replyTo) {
+    const command = replyTo.kind === "pr" ? "pr" : "issue";
+    tools.push(`Bash(gh ${command} comment ${String(replyTo.number)} --body-file -:*)`);
+  }
+  return tools;
+}
+var CLAUDE_READ_ONLY_DENIED = [
+  "Edit",
+  "Write",
+  "NotebookEdit",
+  "Bash(gh * --repo*)",
+  "Bash(gh * -R*)"
+];
+function readOnlyEnv(ghRepo) {
+  return ghRepo ? { ...process.env, GH_REPO: ghRepo } : process.env;
+}
 function buildClaudeArgs(prompt, options = {}) {
   const args = [];
-  if (options.yolo) args.push("--dangerously-skip-permissions");
+  if (options.readOnly) {
+    args.push(
+      "--permission-mode",
+      "dontAsk",
+      "--allowed-tools",
+      claudeReadOnlyTools(options.replyTo).join(","),
+      "--disallowed-tools",
+      CLAUDE_READ_ONLY_DENIED.join(",")
+    );
+  } else if (options.yolo) {
+    args.push("--dangerously-skip-permissions");
+  }
   if (options.model) args.push("--model", options.model);
   if (options.effort) args.push("--effort", options.effort);
   if (options.verbose) args.push("--verbose", "--output-format", "stream-json");
@@ -2835,12 +2927,17 @@ function runClaude(prompt, options = {}) {
     const claudeBin = resolveCommand("claude");
     const args = buildClaudeArgs(prompt, {
       yolo: true,
+      readOnly: options.readOnly,
+      replyTo: options.replyTo,
       model: options.model,
       effort: options.effort,
       verbose: true
     });
     const sink2 = options.sink;
-    const child = spawn(claudeBin, args, { stdio: ["inherit", "pipe", "pipe"] });
+    const child = spawn(claudeBin, args, {
+      stdio: ["inherit", "pipe", "pipe"],
+      env: options.readOnly ? readOnlyEnv(options.ghRepo) : process.env
+    });
     trackChild(child);
     child.stderr.on("data", (chunk) => {
       process.stderr.write(chunk);
@@ -2882,21 +2979,21 @@ function runClaude(prompt, options = {}) {
 }
 function invokeClaudeCode(prompt, options = {}) {
   if (options.verbose) {
-    return invokeClaudeCodeVerbose(prompt, options.yolo ?? false, options.model, options.effort);
+    return invokeClaudeCodeVerbose(prompt, options);
   }
-  invokeClaudeCodeSync(prompt, options.yolo ?? false, options.model, options.effort);
+  invokeClaudeCodeSync(prompt, options);
 }
-function invokeClaudeCodeSync(prompt, yolo, model, effort) {
+function invokeClaudeCodeSync(prompt, options) {
   const claudeBin = resolveCommand("claude");
-  const args = buildClaudeArgs(prompt, { yolo, model, effort, verbose: false });
+  const args = buildClaudeArgs(prompt, { ...options, verbose: false });
   const result = spawnSync6(claudeBin, args, { encoding: "utf8", stdio: "inherit" });
   handleSpawnError(result.error, "claude");
   handleExitCode(result.status, "Claude Code");
 }
-function invokeClaudeCodeVerbose(prompt, yolo, model, effort) {
+function invokeClaudeCodeVerbose(prompt, options) {
   return new Promise((resolve2) => {
     const claudeBin = resolveCommand("claude");
-    const args = buildClaudeArgs(prompt, { yolo, model, effort, verbose: true });
+    const args = buildClaudeArgs(prompt, { ...options, verbose: true });
     const child = spawn(claudeBin, args, { stdio: ["inherit", "pipe", "inherit"] });
     const rl = createInterface({ input: child.stdout });
     let turnCount = 0;
@@ -3001,7 +3098,8 @@ function toTomlBasicString(value) {
 }
 function buildCodexArgs(prompt, options = {}) {
   const args = ["exec"];
-  if (options.yolo) args.push("--dangerously-bypass-approvals-and-sandbox");
+  if (options.readOnly) args.push("--sandbox", "read-only");
+  else if (options.yolo) args.push("--dangerously-bypass-approvals-and-sandbox");
   if (options.model) args.push("--model", options.model);
   if (options.effort) args.push("-c", `model_reasoning_effort=${toTomlBasicString(options.effort)}`);
   args.push(prompt);
@@ -3011,11 +3109,11 @@ function invokeCodexCode(prompt, options = {}) {
   if (options.verbose) {
     process.stderr.write("Warning: --verbose is not supported for Codex and will be ignored.\n");
   }
-  invokeCodexCodeSync(prompt, options.yolo ?? false, options.model, options.effort);
+  invokeCodexCodeSync(prompt, options);
 }
-function invokeCodexCodeSync(prompt, yolo, model, effort) {
+function invokeCodexCodeSync(prompt, options) {
   const codexBin = resolveCommand("codex");
-  const args = buildCodexArgs(prompt, { yolo, model, effort });
+  const args = buildCodexArgs(prompt, options);
   const result = spawnSync7(codexBin, args, { encoding: "utf8", stdio: "inherit" });
   handleSpawnError(result.error, "codex");
   handleExitCode(result.status, "Codex");
@@ -3023,12 +3121,20 @@ function invokeCodexCodeSync(prompt, yolo, model, effort) {
 function runCodex(prompt, options = {}) {
   return new Promise((resolve2, reject) => {
     const codexBin = resolveCommand("codex");
-    const args = buildCodexArgs(prompt, { yolo: true, model: options.model, effort: options.effort });
+    const args = buildCodexArgs(prompt, {
+      yolo: true,
+      readOnly: options.readOnly,
+      model: options.model,
+      effort: options.effort
+    });
     const sink2 = options.sink;
-    const child = spawn2(codexBin, args, { stdio: ["inherit", "pipe", "pipe"] });
+    const child = spawn2(codexBin, args, {
+      stdio: ["inherit", "pipe", "pipe"],
+      env: options.readOnly ? readOnlyEnv(options.ghRepo) : process.env
+    });
     trackChild(child);
     child.stdout.on("data", (chunk) => {
-      process.stdout.write(chunk);
+      if (options.quiet !== true) process.stdout.write(chunk);
       sink2?.output("stdout", chunk.toString("utf8"));
     });
     child.stderr.on("data", (chunk) => {
@@ -3884,6 +3990,12 @@ function selectLinkedPr(linkedPrs) {
   const open = linkedPrs.filter((pr) => pr.state === "OPEN");
   return open.length === 0 ? null : newestPr(open);
 }
+function agentAnsweredAfter(messages, agentUser, marker) {
+  const agent = agentUser.toLowerCase();
+  return messages.some(
+    (message) => message.author.toLowerCase() === agent && message.kind !== "issue-body" && message.createdAt > marker.createdAt
+  );
+}
 function claimStates(item) {
   const states = [];
   if (item.issue !== null) {
@@ -5440,9 +5552,9 @@ function summarizeSync(items) {
   const counts = /* @__PURE__ */ new Map();
   for (const item of items) {
     if (item.sync === void 0) continue;
-    const key = oneLine(item.sync);
-    if (key.length === 0 || QUIET_SYNC.has(key)) continue;
-    counts.set(key, (counts.get(key) ?? 0) + 1);
+    const key2 = oneLine(item.sync);
+    if (key2.length === 0 || QUIET_SYNC.has(key2)) continue;
+    counts.set(key2, (counts.get(key2) ?? 0) + 1);
   }
   if (counts.size === 0) return null;
   return [...counts].map(([strategy, count]) => `${strategy}:${String(count)}`).join(",");
@@ -5691,9 +5803,9 @@ function parseExecution(bracket) {
   if (bracket === void 0) return { executor: null, model: null, effort: null };
   const parts = bracket.split(" ").filter((part) => part.length > 0);
   const executor = parts[0] ?? null;
-  const find = (key) => {
-    const hit = parts.find((part) => part.startsWith(`${key}=`));
-    return hit === void 0 ? null : hit.slice(key.length + 1);
+  const find = (key2) => {
+    const hit = parts.find((part) => part.startsWith(`${key2}=`));
+    return hit === void 0 ? null : hit.slice(key2.length + 1);
   };
   return { executor, model: find("model"), effort: find("effort") };
 }
@@ -6706,15 +6818,15 @@ function describeRefusedRun(item, refusal) {
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function validateOptionalString(container, key, path) {
-  const value = container[key];
+function validateOptionalString(container, key2, path) {
+  const value = container[key2];
   if (value === void 0 || value === null) return;
   if (typeof value !== "string" || value.trim().length === 0) {
     failSettings(`${path} must be a non-empty string.`);
   }
 }
-function validateOptionalInt(container, key, path, min, hint) {
-  const value = container[key];
+function validateOptionalInt(container, key2, path, min, hint) {
+  const value = container[key2];
   if (value === void 0 || value === null) return;
   if (typeof value !== "number" || !Number.isSafeInteger(value) || value < min) {
     failSettings(`${path} must be ${hint}, got ${JSON.stringify(value)}.`);
@@ -6739,8 +6851,8 @@ function validateDoWorkConfig(section) {
   validateSettingContainer(section["effort"], "effort", ["claude", "codex"]);
   validateSettingContainer(section["prompts"], "prompts", ["issueDiscuss", "prWork", "prOrphan"]);
 }
-function validateOptionalBoolean(container, key, path) {
-  const value = container[key];
+function validateOptionalBoolean(container, key2, path) {
+  const value = container[key2];
   if (value === void 0 || value === null) return;
   if (typeof value !== "boolean") {
     failSettings(`${path} must be true or false, got ${JSON.stringify(value)}.`);
@@ -6758,12 +6870,12 @@ function validateSettingContainer(value, container, keys) {
   if (!isPlainObject(value)) {
     failSettings(`doWork.${container} must be an object, got ${JSON.stringify(value)}.`);
   }
-  for (const key of keys) {
-    validateOptionalString(value, key, `doWork.${container}.${key}`);
+  for (const key2 of keys) {
+    validateOptionalString(value, key2, `doWork.${container}.${key2}`);
   }
-  for (const key of Object.keys(value)) {
-    if (!keys.includes(key)) {
-      failSettings(`doWork.${container}.${key} is not a recognised setting; expected one of: ${keys.join(", ")}.`);
+  for (const key2 of Object.keys(value)) {
+    if (!keys.includes(key2)) {
+      failSettings(`doWork.${container}.${key2} is not a recognised setting; expected one of: ${keys.join(", ")}.`);
     }
   }
 }
@@ -8311,6 +8423,249 @@ import { Command as Command7 } from "commander";
 function isWatchClosed(state) {
   return state === "closed";
 }
+function issueConversation(surface) {
+  return {
+    kind: "issue",
+    number: surface.issue.number,
+    state: surface.state === "CLOSED" ? "closed" : "open",
+    messages: surface.messages
+  };
+}
+function prConversation(surface) {
+  return {
+    kind: "pr",
+    number: surface.pr.number,
+    state: surface.pr.state === "OPEN" ? "open" : "closed",
+    messages: [...surface.messages, ...surface.threads.flatMap((thread) => thread.comments)]
+  };
+}
+function decideConversation(conversation, p) {
+  if (isWatchClosed(conversation.state)) {
+    return { kind: "skip", surface: conversation, reason: "closed", detail: "the item is closed or merged" };
+  }
+  const agent = p.agentUser.toLowerCase();
+  const allowed = new Set(p.allowedUsers.map((user) => user.toLowerCase()));
+  const relevant = conversation.messages.filter((message) => {
+    const author = message.author.toLowerCase();
+    return author === agent || allowed.has(author);
+  });
+  let newest2 = null;
+  for (const message of relevant) {
+    if (message.author.toLowerCase() !== agent) continue;
+    if (newest2 === null || message.createdAt > newest2.createdAt) newest2 = message;
+  }
+  if (newest2 === null) {
+    return {
+      kind: "skip",
+      surface: conversation,
+      reason: "no-agent-message",
+      detail: `${p.agentUser} has not written here`
+    };
+  }
+  const marker = { commentId: "", createdAt: newest2.createdAt };
+  const answeredBy = p.allowedUsers.find((user) => agentAnsweredAfter(relevant, user, marker));
+  if (answeredBy !== void 0) {
+    return {
+      kind: "skip",
+      surface: conversation,
+      reason: "answered",
+      detail: `${answeredBy} answered after ${p.agentUser}'s message at ${newest2.createdAt}`
+    };
+  }
+  return {
+    kind: "reply",
+    surface: conversation,
+    agentMessageAt: newest2.createdAt,
+    reason: `${p.agentUser}'s message at ${newest2.createdAt} has no answer from an allowed user`
+  };
+}
+function decideConductorReply(conversations, p) {
+  const decisions = conversations.map((conversation) => decideConversation(conversation, p));
+  return { needsReply: decisions.some((decision) => decision.kind === "reply"), decisions };
+}
+
+// src/conductor/thread.ts
+function defaultReplyTarget(thread) {
+  return thread.kind === "issue" ? { kind: "issue", number: thread.issue.issue.number } : { kind: "pr", number: thread.prs[0].surface.pr.number };
+}
+function postingInstruction(target) {
+  const command = target.kind === "pr" ? "pr" : "issue";
+  const number = String(target.number);
+  return [
+    `Post your reply as a comment on ${target.kind === "pr" ? "pull request" : "issue"} #${number}. What you print is discarded; only a posted comment counts.`,
+    `Run \`gh ${command} comment ${number} --body-file -\` and give the body on standard input, for example with a here-document.`,
+    "Post exactly one comment. Do not approve, merge or close anything."
+  ].join("\n");
+}
+function visible(messages, participants) {
+  return analyzeSurface(messages, participants).messages.map((message) => ({
+    kind: message.kind,
+    author: message.author,
+    body: message.body,
+    createdAt: message.createdAt
+  }));
+}
+function renderMessages(messages, participants) {
+  const kept = visible(messages, participants);
+  return kept.length === 0 ? "(no messages)" : formatMessages(kept.map((m) => ({ ...m, isNew: false })));
+}
+function renderThread(thread, participants) {
+  const comments = visible(thread.comments, participants);
+  if (comments.length === 0) return null;
+  const location = thread.line === null ? `${thread.path}:(file)` : `${thread.path}:${String(thread.line)}`;
+  const link = thread.url === null ? "" : `
+${thread.url}`;
+  return `${location}${link}
+${formatMessages(comments.map((m) => ({ ...m, isNew: false })))}`;
+}
+function renderChecks(checks) {
+  if (checks.length === 0) return "No checks reported.";
+  return checks.map((check) => `- ${check.name}: ${check.status === "COMPLETED" ? check.conclusion ?? "COMPLETED" : check.status}`).join("\n");
+}
+function descriptionLines(description, participants) {
+  if (description === void 0 || description.body.trim().length === 0) return [""];
+  const [kept] = visible([{ kind: "issue-body", author: description.author, body: description.body, createdAt: "" }], participants);
+  if (kept === void 0) return [""];
+  return ["", `Pull request description (by ${kept.author}):`, "", kept.body, ""];
+}
+function prSection(pr, participants) {
+  const { surface, checks } = pr;
+  const number = String(surface.pr.number);
+  const lines = [
+    "",
+    `Pull request #${number}: ${surface.pr.title}`,
+    `Pull request URL: ${surface.pr.url}`,
+    `State: ${surface.pr.state}${surface.pr.isDraft ? " (draft)" : ""} \xB7 Branch: ${surface.pr.headRefName} into ${surface.pr.baseRefName}`,
+    ...descriptionLines(surface.description, participants),
+    `Conversation on pull request #${number} (authorized accounts and you only, oldest first):`,
+    "",
+    renderMessages(surface.messages, participants)
+  ];
+  const threads = surface.threads.filter((thread) => !thread.isResolved).map((thread) => renderThread(thread, participants)).filter((text) => text !== null);
+  if (threads.length > 0) {
+    lines.push("", `Unresolved review threads on pull request #${number}:`, "", threads.join("\n\n"));
+  }
+  lines.push("", `CI status of pull request #${number}:`, "", renderChecks(checks));
+  return lines;
+}
+function composeConductorPrompt(input) {
+  const { thread, repo, participants, frame } = input;
+  const replyTo = input.replyTo ?? defaultReplyTarget(thread);
+  const lines = [
+    frame,
+    "",
+    "--- Thread assembled by automata ---",
+    `Repository: ${repo.owner}/${repo.repo}`,
+    `The agent is: ${participants.agentUser}`
+  ];
+  if (thread.kind === "issue") {
+    lines.push(
+      "",
+      `Issue #${String(thread.issue.issue.number)}: ${thread.issue.issue.title}`,
+      `Issue URL: ${thread.issue.issue.url}`,
+      `State: ${thread.issue.state}`,
+      "",
+      "Conversation on the issue (authorized accounts and you only, oldest first):",
+      "",
+      renderMessages(thread.issue.messages, participants)
+    );
+  }
+  for (const pr of thread.prs) lines.push(...prSection(pr, participants));
+  lines.push(
+    "",
+    "Only the messages above exist. Anything from other accounts has been withheld",
+    "deliberately \u2014 do not ask about it.",
+    "",
+    postingInstruction(replyTo)
+  );
+  return lines.join("\n");
+}
+
+// src/conductor/execution.ts
+var EXECUTORS = ["claude", "codex"];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function containerProblem(value, name) {
+  if (value === void 0 || value === null) return null;
+  if (!isRecord(value)) return `conductor.${name} must be an object, got ${JSON.stringify(value)}.`;
+  for (const [key2, entry] of Object.entries(value)) {
+    if (!EXECUTORS.includes(key2)) {
+      return `conductor.${name}.${key2} is not a recognised setting; expected one of: ${EXECUTORS.join(", ")}.`;
+    }
+    if (entry !== void 0 && typeof entry !== "string") {
+      return `conductor.${name}.${key2} must be a string, got ${JSON.stringify(entry)}.`;
+    }
+  }
+  return null;
+}
+function conductorExecutionProblem(conductor) {
+  const executor = conductor?.executor;
+  if (executor !== void 0 && executor !== null && (typeof executor !== "string" || !EXECUTORS.includes(executor))) {
+    return `conductor.executor must be one of: ${EXECUTORS.join(", ")}; got ${JSON.stringify(executor)}.`;
+  }
+  return containerProblem(conductor?.models, "models") ?? containerProblem(conductor?.effort, "effort");
+}
+function clean(value) {
+  const trimmed2 = value?.trim();
+  return trimmed2 === void 0 || trimmed2.length === 0 ? void 0 : trimmed2;
+}
+function resolveConductorExecution(conductor) {
+  const executor = conductor?.executor ?? "claude";
+  return {
+    executor,
+    model: clean(conductor?.models?.[executor]),
+    effort: clean(conductor?.effort?.[executor])
+  };
+}
+function describeConductorExecution(execution) {
+  const model = execution.model === void 0 ? " (no model override)" : ` \xB7 model ${execution.model}`;
+  const effort = execution.effort === void 0 ? "" : ` \xB7 effort ${execution.effort}`;
+  return `${execution.executor}${model}${effort}`;
+}
+
+// src/conductor/reply.ts
+function isComment(message) {
+  return message.kind === "issue-comment" || message.kind === "pr-comment";
+}
+function key(message) {
+  return `${message.createdAt}\0${message.body}`;
+}
+function newMessagesBy(before, after, login2) {
+  const who = login2.toLowerCase();
+  const own = (m) => isComment(m) && m.author.toLowerCase() === who;
+  const known = /* @__PURE__ */ new Map();
+  for (const m of before.filter(own)) known.set(key(m), (known.get(key(m)) ?? 0) + 1);
+  return after.filter((m) => {
+    if (!own(m)) return false;
+    const left = known.get(key(m)) ?? 0;
+    if (left > 0) known.set(key(m), left - 1);
+    return left === 0;
+  });
+}
+async function conductReply(input) {
+  let before;
+  try {
+    before = input.read();
+  } catch (err) {
+    return { kind: "unverified", error: `could not read the conversation before the run: ${err.message}` };
+  }
+  let runError = null;
+  try {
+    await input.run();
+  } catch (err) {
+    runError = err.message;
+  }
+  let after;
+  try {
+    after = input.read();
+  } catch (err) {
+    return { kind: "unverified", error: `could not read the conversation after the run: ${err.message}` };
+  }
+  const posted = newMessagesBy(before, after, input.login);
+  if (posted.length > 0) return { kind: "posted", count: posted.length, runError };
+  return runError === null ? { kind: "posted-nothing" } : { kind: "run-failed", error: runError };
+}
 
 // src/conductor/watchList.ts
 function parseWatchId(raw) {
@@ -8369,6 +8724,82 @@ function pruneWatchList(config) {
     }
   }
   if (dropped.length > 0) updateWatch((current) => current.filter((id) => !dropped.includes(id)));
+  return watch.filter((id) => !dropped.includes(id));
+}
+function readPr(number) {
+  return { surface: getPrSurface(number), checks: getPrChecks(number) };
+}
+function readWatchedItem(id) {
+  const target = getWatchTarget(id);
+  if (target.kind === "pr") {
+    const pr = readPr(id);
+    return { thread: { kind: "pr", prs: [pr] }, conversations: [prConversation(pr.surface)] };
+  }
+  const issue = getIssueSurface(id);
+  const prs = (getOpenPrLinkMap().byIssue.get(id) ?? []).map((ref) => readPr(ref.number));
+  return {
+    thread: { kind: "issue", issue, prs },
+    conversations: [issueConversation(issue), ...prs.map((pr) => prConversation(pr.surface))]
+  };
+}
+function readTargetMessages(target) {
+  return target.kind === "issue" ? issueConversation(getIssueSurface(target.number)).messages : prConversation(getPrSurface(target.number)).messages;
+}
+function runModel(prompt, execution, replyTo) {
+  const { owner, repo } = getRepoSlug();
+  return runClaude(prompt, { model: execution.model, effort: execution.effort, readOnly: true, replyTo, ghRepo: `${owner}/${repo}` });
+}
+async function conductItem(id, config, login2, participants, execution) {
+  const label = `#${String(id)}`;
+  let item;
+  try {
+    item = readWatchedItem(id);
+  } catch (err) {
+    process.stderr.write(`Warning: could not read ${label}, skipping it this tick: ${err.message}
+`);
+    return "idle";
+  }
+  const { thread, conversations } = item;
+  const verdict = decideConductorReply(conversations, participants);
+  const owed = verdict.decisions.find((decision) => decision.kind === "reply");
+  if (owed === void 0) {
+    process.stdout.write(`Conductor: ${label} needs no reply.
+`);
+    return "idle";
+  }
+  const replyTo = { kind: owed.surface.kind, number: owed.surface.number };
+  const frame = thread.kind === "issue" ? config.conductor?.prompts?.issue ?? DEFAULT_CONDUCTOR_ISSUE_PROMPT : config.conductor?.prompts?.pr ?? DEFAULT_CONDUCTOR_PR_PROMPT;
+  const prompt = composeConductorPrompt({ thread, repo: getRepoSlug(), participants, frame, replyTo });
+  const where = `${replyTo.kind === "pr" ? "pull request" : "issue"} #${String(replyTo.number)}`;
+  process.stdout.write(`Conductor: ${label} needs a reply on ${where}; running ${describeConductorExecution(execution)}.
+`);
+  const outcome = await conductReply({
+    login: login2,
+    read: () => readTargetMessages(replyTo),
+    run: () => runModel(prompt, execution, replyTo)
+  });
+  switch (outcome.kind) {
+    case "posted":
+      process.stdout.write(`Conductor: posted a reply on ${where}.
+`);
+      if (outcome.runError !== null) {
+        process.stderr.write(`Warning: the run reported "${outcome.runError}" but the reply is posted.
+`);
+      }
+      return "replied";
+    case "posted-nothing":
+      process.stderr.write(`Error: the run for ${label} finished but posted no comment on ${where}.
+`);
+      return "failed";
+    case "run-failed":
+      process.stderr.write(`Error: the run for ${label} failed and posted no comment on ${where}: ${outcome.error}
+`);
+      return "failed";
+    case "unverified":
+      process.stderr.write(`Error: could not tell whether ${label} got a reply: ${outcome.error}
+`);
+      return "failed";
+  }
 }
 function loadGitHubConfig() {
   const config = readRawConfig();
@@ -8440,43 +8871,59 @@ function runWatchList() {
 function exitWith(code) {
   if (code !== 0) process.exit(code);
 }
-function runConductor() {
+function preflight() {
   let config;
   try {
     config = readConfig();
   } catch (err) {
-    return fail2(err.message);
+    return { problem: err.message };
   }
   if (!isExplicitGitHub(config)) {
-    return fail2(
-      azdoUnsupportedMessage(
+    return {
+      problem: azdoUnsupportedMessage(
         "conductor",
         "It needs the GitHub APIs; set the remote with `automata config set type gh`."
       )
-    );
+    };
   }
   const allowedUsers = (config.allowedUsers ?? []).filter((user) => user.trim().length > 0);
   if (allowedUsers.length === 0) {
-    return fail2("No allowed users configured. Run `automata config set allowed-users <user1,user2>`.");
+    return { problem: "No allowed users configured. Run `automata config set allowed-users <user1,user2>`." };
   }
   const agentUser = (config.agentUser ?? "").trim();
   if (agentUser.length === 0) {
-    return fail2("No agent user configured. Run `automata config set agent-user <login>`.");
+    return { problem: "No agent user configured. Run `automata config set agent-user <login>`." };
   }
   let login2;
   try {
     login2 = getAuthenticatedLogin();
   } catch (err) {
-    return fail2(`\`gh\` could not be queried: ${err.message}`);
+    return { problem: `\`gh\` could not be queried: ${err.message}` };
   }
-  const problem = conductorIdentityProblemFor(login2, agentUser, allowedUsers);
-  if (problem !== null) return fail2(problem);
+  const identityProblem = conductorIdentityProblemFor(login2, agentUser, allowedUsers);
+  if (identityProblem !== null) return { problem: identityProblem };
   const rawStale = config.doWork?.lockStaleMinutes;
   if (rawStale !== void 0 && rawStale !== null) {
     if (typeof rawStale !== "number" || !Number.isSafeInteger(rawStale) || rawStale < 1) {
-      return fail2(`doWork.lockStaleMinutes must be a positive integer, got ${JSON.stringify(rawStale)}.`);
+      return { problem: `doWork.lockStaleMinutes must be a positive integer, got ${JSON.stringify(rawStale)}.` };
     }
   }
+  const executionProblem = conductorExecutionProblem(config.conductor);
+  if (executionProblem !== null) return { problem: executionProblem };
+  if (config.conductor?.executor === "codex") {
+    return { problem: "conductor.executor codex is not supported: Codex cannot be limited to comments on the reply target. Use claude." };
+  }
+  return {
+    config,
+    login: login2 ?? "",
+    participants: { allowedUsers, agentUser },
+    execution: resolveConductorExecution(config.conductor)
+  };
+}
+async function runConductor() {
+  const checked = preflight();
+  if ("problem" in checked) return fail2(checked.problem);
+  const { config, login: login2, participants, execution } = checked;
   const staleMinutes = config.doWork?.lockStaleMinutes ?? DEFAULT_DO_WORK.lockStaleMinutes;
   const lock = acquireConductorLock(staleMinutes);
   if (!lock.ok) {
@@ -8495,18 +8942,28 @@ function runConductor() {
     return 0;
   }
   try {
-    process.stdout.write(`Conductor: running as ${login2 ?? ""}.
+    process.stdout.write(`Conductor: running as ${login2}.
 `);
-    pruneWatchList(config);
-    return 0;
+    const watch = pruneWatchList(config);
+    let failed = 0;
+    for (const id of watch) {
+      try {
+        if (await conductItem(id, config, login2, participants, execution) === "failed") failed++;
+      } catch (err) {
+        process.stderr.write(`Error: #${String(id)} could not be conducted: ${err.message}
+`);
+        failed++;
+      }
+    }
+    return failed > 0 ? 1 : 0;
   } finally {
     lock.handle.release();
   }
 }
 var conductorCommand = new Command7("conductor").description(
   "Run one conductor tick as an allowed (human) account: verify the identity, take the conductor's own run lock, then act"
-).action(() => {
-  exitWith(runConductor());
+).action(async () => {
+  exitWith(await runConductor());
 });
 conductorCommand.command("add <id>").description("Watch an issue or pull request and make do-work pick it up (an issue also follows its linked PR)").action((id) => {
   exitWith(runWatchAdd(id));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "automata-cli",
-  "version": "0.11.0-develop.501",
+  "version": "0.11.0-develop.514",
   "description": "Automata CLI tool",
   "type": "module",
   "engines": {