automata-cli 0.11.0-develop.501 → 0.11.0-develop.519

package/dist/index.js

@@ -2,6 +2,8 @@
 import {
   DEFAULT_CHECK_ISSUE_PROMPT,
   DEFAULT_CLAUDE_SYSTEM_PROMPT,
+  DEFAULT_CONDUCTOR_ISSUE_PROMPT,
+  DEFAULT_CONDUCTOR_PR_PROMPT,
   DEFAULT_DO_WORK,
   DEFAULT_DO_WORK_ISSUE_DISCUSS_PROMPT,
   DEFAULT_DO_WORK_PR_ORPHAN_PROMPT,
@@ -88,11 +90,11 @@ function writeDoWork(patch) {
   const current = readRawConfig();
   writeConfig({ ...current, doWork: { ...current.doWork, ...patch } });
 }
-function parseNonNegativeInt(value, label) {
+function parseNonNegativeInt(value, label2) {
   const trimmed2 = value.trim();
   const parsed = Number.parseInt(trimmed2, 10);
   if (Number.isNaN(parsed) || parsed < 0 || String(parsed) !== trimmed2 || !Number.isSafeInteger(parsed)) {
-    process.stderr.write(`Error: ${label} must be a non-negative integer (got "${value}").
+    process.stderr.write(`Error: ${label2} must be a non-negative integer (got "${value}").
 `);
     process.exit(1);
   }
@@ -313,6 +315,45 @@ var configSetConductorPrompt = new Command("conductor-prompt").description("Set
   process.stdout.write(`conductor ${kind} prompt set.
 `);
 });
+function writeConductor(patch) {
+  const current = readRawConfig();
+  writeConfig({ ...current, conductor: { ...current.conductor, ...patch } });
+}
+function requireExecutor(value) {
+  if (!VALID_EXECUTORS.includes(value)) {
+    process.stderr.write(`Error: invalid executor "${value}". Must be one of: ${VALID_EXECUTORS.join(", ")}
+`);
+    process.exit(1);
+  }
+  return value;
+}
+var configSetConductorExecutor = new Command("conductor-executor").description("Set the executor the conductor runs").argument("<value>", `Executor: ${VALID_EXECUTORS.join(", ")}`).action((value) => {
+  writeConductor({ executor: requireExecutor(value) });
+  process.stdout.write(`conductor executor set to: ${value}
+`);
+});
+var configSetConductorModel = new Command("conductor-model").description("Set the model the conductor passes to one executor").argument("<executor>", `Executor: ${VALID_EXECUTORS.join(", ")}`).argument("<value>", "Model identifier").action((executor, value) => {
+  const which = requireExecutor(executor);
+  const model = value.trim();
+  if (model.length === 0) {
+    process.stderr.write("Error: conductor-model requires a non-empty model identifier.\n");
+    process.exit(1);
+  }
+  writeConductor({ models: { ...readRawConfig().conductor?.models, [which]: model } });
+  process.stdout.write(`conductor ${which} model set to: ${model}
+`);
+});
+var configSetConductorEffort = new Command("conductor-effort").description("Set the reasoning effort the conductor passes to one executor").argument("<executor>", `Executor: ${VALID_EXECUTORS.join(", ")}`).argument("<value>", "Effort level, forwarded to the executor unchanged").action((executor, value) => {
+  const which = requireExecutor(executor);
+  const effort = value.trim();
+  if (effort.length === 0) {
+    process.stderr.write("Error: conductor-effort requires a non-empty effort level.\n");
+    process.exit(1);
+  }
+  writeConductor({ effort: { ...readRawConfig().conductor?.effort, [which]: effort } });
+  process.stdout.write(`conductor ${which} effort set to: ${effort}
+`);
+});
 var configSetGitTrunkBranch = new Command("git-trunk-branch").description("Pin the branch `publish-release` releases to, instead of detecting it").argument("<value>", "Branch name (unset = detect it from the remote)").action((value) => {
   const branch = value.trim();
   if (branch.length === 0) {
@@ -336,7 +377,7 @@ var configSetGitReleaseFlow = new Command("git-release-flow").description("Pin t
   process.stdout.write(`git release flow set to: ${flow}
 `);
 });
-var configSet = new Command("set").description("Set a configuration value").addCommand(configSetType).addCommand(configSetIssueDiscoveryTechnique).addCommand(configSetIssueDiscoveryValue).addCommand(configSetClaudeSystemPrompt).addCommand(configSetAllowedUsers).addCommand(configSetAgentUser).addCommand(configSetDoWorkBaseBranch).addCommand(configSetDoWorkProtectedBranches).addCommand(configSetDoWorkExecutor).addCommand(configSetDoWorkModel).addCommand(configSetDoWorkEffort).addCommand(configSetDoWorkMaxRuns).addCommand(configSetDoWorkLockStaleMinutes).addCommand(configSetDoWorkDumpOnBlock).addCommand(configSetDoWorkPostRunLog).addCommand(configSetDoWorkPrompt).addCommand(configSetConductorPrompt).addCommand(configSetGitTrunkBranch).addCommand(configSetGitReleaseFlow);
+var configSet = new Command("set").description("Set a configuration value").addCommand(configSetType).addCommand(configSetIssueDiscoveryTechnique).addCommand(configSetIssueDiscoveryValue).addCommand(configSetClaudeSystemPrompt).addCommand(configSetAllowedUsers).addCommand(configSetAgentUser).addCommand(configSetDoWorkBaseBranch).addCommand(configSetDoWorkProtectedBranches).addCommand(configSetDoWorkExecutor).addCommand(configSetDoWorkModel).addCommand(configSetDoWorkEffort).addCommand(configSetDoWorkMaxRuns).addCommand(configSetDoWorkLockStaleMinutes).addCommand(configSetDoWorkDumpOnBlock).addCommand(configSetDoWorkPostRunLog).addCommand(configSetDoWorkPrompt).addCommand(configSetConductorPrompt).addCommand(configSetConductorExecutor).addCommand(configSetConductorModel).addCommand(configSetConductorEffort).addCommand(configSetGitTrunkBranch).addCommand(configSetGitReleaseFlow);
 var configCommand = new Command("config").description("Configure automata settings").addCommand(configSet).action(async () => {
   const [{ render }, React, { ConfigWizard }] = await Promise.all([
     import("ink"),
@@ -392,8 +433,8 @@ function extractIdentity(stdout) {
     if (typeof id === "string" && id) return id;
     if (id && typeof id === "object") {
       const o = id;
-      for (const key of ["displayName", "uniqueName", "providerDisplayName", "id"]) {
-        if (typeof o[key] === "string" && o[key]) return o[key];
+      for (const key2 of ["displayName", "uniqueName", "providerDisplayName", "id"]) {
+        if (typeof o[key2] === "string" && o[key2]) return o[key2];
       }
     }
   } catch {
@@ -1664,7 +1705,7 @@ function formatSonarIssue(issue) {
   const location = formatLocation(issue.path, issue.line);
   if (location) lines.push(`      Location: ${location}`);
   if (issue.severity || issue.type) {
-    const labels = [issue.severity, issue.type].filter((label) => Boolean(label)).map(sanitizeText).join(" / ");
+    const labels = [issue.severity, issue.type].filter((label2) => Boolean(label2)).map(sanitizeText).join(" / ");
     lines.push(`      Classification: ${labels}`);
   }
   if (issue.rule) lines.push(`      Rule: ${sanitizeText(issue.rule)}`);
@@ -1677,7 +1718,7 @@ function formatSonarHotspot(hotspot) {
   if (location) lines.push(`      Location: ${location}`);
   if (hotspot.status) lines.push(`      Status: ${sanitizeText(hotspot.status)}`);
   if (hotspot.vulnerabilityProbability || hotspot.securityCategory) {
-    const labels = [hotspot.vulnerabilityProbability, hotspot.securityCategory].filter((label) => Boolean(label)).map(sanitizeText).join(" / ");
+    const labels = [hotspot.vulnerabilityProbability, hotspot.securityCategory].filter((label2) => Boolean(label2)).map(sanitizeText).join(" / ");
     lines.push(`      Classification: ${labels}`);
   }
   if (hotspot.rule) {
@@ -2327,7 +2368,7 @@ function getIssueSurface(issueNumber) {
     issue: { number: raw.number, title: raw.title, body: raw.body, url: raw.url },
     state: raw.state === "CLOSED" ? "CLOSED" : "OPEN",
     assignees: (raw.assignees ?? []).map(login).filter((name) => name.length > 0),
-    labels: (raw.labels ?? []).map((label) => label.name ?? "").filter((name) => name.length > 0),
+    labels: (raw.labels ?? []).map((label2) => label2.name ?? "").filter((name) => name.length > 0),
     messages
   };
 }
@@ -2386,7 +2427,7 @@ function toPullRequestRef(node) {
 function toOrphanPr(node) {
   return {
     pr: toPullRequestRef(node),
-    labels: (node.labels?.nodes ?? []).map((label) => label.name ?? "").filter((name) => name.length > 0),
+    labels: (node.labels?.nodes ?? []).map((label2) => label2.name ?? "").filter((name) => name.length > 0),
     assignees: (node.assignees?.nodes ?? []).map((assignee) => assignee.login ?? "").filter((login2) => login2.length > 0)
   };
 }
@@ -2544,6 +2585,19 @@ function getPrSurface(prNumber) {
     description: { author: login(raw.author), body: raw.body }
   };
 }
+function getPrChecks(prNumber) {
+  const raw = ghJson(
+    ["pr", "view", String(prNumber), "--json", "statusCheckRollup"],
+    `read the checks of pull request #${String(prNumber)}`
+  );
+  return (raw.statusCheckRollup ?? []).map((check) => {
+    const name = check.name ?? check.context ?? "unnamed check";
+    if (check.status !== void 0) return { name, status: check.status, conclusion: check.conclusion ?? null };
+    const state = check.state ?? "";
+    const pending = state === "PENDING" || state === "EXPECTED";
+    return { name, status: pending ? "PENDING" : "COMPLETED", conclusion: pending || state === "" ? null : state };
+  });
+}
 function assignIssueToAgent(issueNumber, agentUser) {
   const { stderr, status } = run4("gh", [
     "issue",
@@ -2821,9 +2875,47 @@ async function terminateTrackedChildren(timeoutMs = 1e4, killGraceMs = 5e3) {
 }
 
 // src/claude/claudeService.ts
+function claudeReadOnlyTools(replyTo) {
+  const tools = [
+    "Read(./**)",
+    "Grep(./**)",
+    "Glob(./**)",
+    "Bash(gh issue view:*)",
+    "Bash(gh pr view:*)",
+    "Bash(gh pr diff:*)",
+    "Bash(gh pr checks:*)",
+    "Bash(git status:*)"
+  ];
+  if (replyTo) {
+    const command = replyTo.kind === "pr" ? "pr" : "issue";
+    tools.push(`Bash(gh ${command} comment ${String(replyTo.number)} --body-file -:*)`);
+  }
+  return tools;
+}
+var CLAUDE_READ_ONLY_DENIED = [
+  "Edit",
+  "Write",
+  "NotebookEdit",
+  "Bash(gh * --repo*)",
+  "Bash(gh * -R*)"
+];
+function readOnlyEnv(ghRepo) {
+  return ghRepo ? { ...process.env, GH_REPO: ghRepo } : process.env;
+}
 function buildClaudeArgs(prompt, options = {}) {
   const args = [];
-  if (options.yolo) args.push("--dangerously-skip-permissions");
+  if (options.readOnly) {
+    args.push(
+      "--permission-mode",
+      "dontAsk",
+      "--allowed-tools",
+      claudeReadOnlyTools(options.replyTo).join(","),
+      "--disallowed-tools",
+      CLAUDE_READ_ONLY_DENIED.join(",")
+    );
+  } else if (options.yolo) {
+    args.push("--dangerously-skip-permissions");
+  }
   if (options.model) args.push("--model", options.model);
   if (options.effort) args.push("--effort", options.effort);
   if (options.verbose) args.push("--verbose", "--output-format", "stream-json");
@@ -2835,12 +2927,17 @@ function runClaude(prompt, options = {}) {
     const claudeBin = resolveCommand("claude");
     const args = buildClaudeArgs(prompt, {
       yolo: true,
+      readOnly: options.readOnly,
+      replyTo: options.replyTo,
       model: options.model,
       effort: options.effort,
       verbose: true
     });
     const sink2 = options.sink;
-    const child = spawn(claudeBin, args, { stdio: ["inherit", "pipe", "pipe"] });
+    const child = spawn(claudeBin, args, {
+      stdio: ["inherit", "pipe", "pipe"],
+      env: options.readOnly ? readOnlyEnv(options.ghRepo) : process.env
+    });
     trackChild(child);
     child.stderr.on("data", (chunk) => {
       process.stderr.write(chunk);
@@ -2882,21 +2979,21 @@ function runClaude(prompt, options = {}) {
 }
 function invokeClaudeCode(prompt, options = {}) {
   if (options.verbose) {
-    return invokeClaudeCodeVerbose(prompt, options.yolo ?? false, options.model, options.effort);
+    return invokeClaudeCodeVerbose(prompt, options);
   }
-  invokeClaudeCodeSync(prompt, options.yolo ?? false, options.model, options.effort);
+  invokeClaudeCodeSync(prompt, options);
 }
-function invokeClaudeCodeSync(prompt, yolo, model, effort) {
+function invokeClaudeCodeSync(prompt, options) {
   const claudeBin = resolveCommand("claude");
-  const args = buildClaudeArgs(prompt, { yolo, model, effort, verbose: false });
+  const args = buildClaudeArgs(prompt, { ...options, verbose: false });
   const result = spawnSync6(claudeBin, args, { encoding: "utf8", stdio: "inherit" });
   handleSpawnError(result.error, "claude");
   handleExitCode(result.status, "Claude Code");
 }
-function invokeClaudeCodeVerbose(prompt, yolo, model, effort) {
+function invokeClaudeCodeVerbose(prompt, options) {
   return new Promise((resolve2) => {
     const claudeBin = resolveCommand("claude");
-    const args = buildClaudeArgs(prompt, { yolo, model, effort, verbose: true });
+    const args = buildClaudeArgs(prompt, { ...options, verbose: true });
     const child = spawn(claudeBin, args, { stdio: ["inherit", "pipe", "inherit"] });
     const rl = createInterface({ input: child.stdout });
     let turnCount = 0;
@@ -3001,7 +3098,8 @@ function toTomlBasicString(value) {
 }
 function buildCodexArgs(prompt, options = {}) {
   const args = ["exec"];
-  if (options.yolo) args.push("--dangerously-bypass-approvals-and-sandbox");
+  if (options.readOnly) args.push("--sandbox", "read-only");
+  else if (options.yolo) args.push("--dangerously-bypass-approvals-and-sandbox");
   if (options.model) args.push("--model", options.model);
   if (options.effort) args.push("-c", `model_reasoning_effort=${toTomlBasicString(options.effort)}`);
   args.push(prompt);
@@ -3011,11 +3109,11 @@ function invokeCodexCode(prompt, options = {}) {
   if (options.verbose) {
     process.stderr.write("Warning: --verbose is not supported for Codex and will be ignored.\n");
   }
-  invokeCodexCodeSync(prompt, options.yolo ?? false, options.model, options.effort);
+  invokeCodexCodeSync(prompt, options);
 }
-function invokeCodexCodeSync(prompt, yolo, model, effort) {
+function invokeCodexCodeSync(prompt, options) {
   const codexBin = resolveCommand("codex");
-  const args = buildCodexArgs(prompt, { yolo, model, effort });
+  const args = buildCodexArgs(prompt, options);
   const result = spawnSync7(codexBin, args, { encoding: "utf8", stdio: "inherit" });
   handleSpawnError(result.error, "codex");
   handleExitCode(result.status, "Codex");
@@ -3023,12 +3121,20 @@ function invokeCodexCodeSync(prompt, yolo, model, effort) {
 function runCodex(prompt, options = {}) {
   return new Promise((resolve2, reject) => {
     const codexBin = resolveCommand("codex");
-    const args = buildCodexArgs(prompt, { yolo: true, model: options.model, effort: options.effort });
+    const args = buildCodexArgs(prompt, {
+      yolo: true,
+      readOnly: options.readOnly,
+      model: options.model,
+      effort: options.effort
+    });
     const sink2 = options.sink;
-    const child = spawn2(codexBin, args, { stdio: ["inherit", "pipe", "pipe"] });
+    const child = spawn2(codexBin, args, {
+      stdio: ["inherit", "pipe", "pipe"],
+      env: options.readOnly ? readOnlyEnv(options.ghRepo) : process.env
+    });
     trackChild(child);
     child.stdout.on("data", (chunk) => {
-      process.stdout.write(chunk);
+      if (options.quiet !== true) process.stdout.write(chunk);
       sink2?.output("stdout", chunk.toString("utf8"));
     });
     child.stderr.on("data", (chunk) => {
@@ -3884,6 +3990,12 @@ function selectLinkedPr(linkedPrs) {
   const open = linkedPrs.filter((pr) => pr.state === "OPEN");
   return open.length === 0 ? null : newestPr(open);
 }
+function agentAnsweredAfter(messages, agentUser, marker) {
+  const agent = agentUser.toLowerCase();
+  return messages.some(
+    (message) => message.author.toLowerCase() === agent && message.kind !== "issue-body" && message.createdAt > marker.createdAt
+  );
+}
 function claimStates(item) {
   const states = [];
   if (item.issue !== null) {
@@ -4377,6 +4489,9 @@ var UNKNOWN_OWNER = {
   command: "unknown",
   token: ""
 };
+function inspectConductorLock(staleMinutes, now = Date.now()) {
+  return inspectRunLock(staleMinutes, now, CONDUCTOR_LOCK_FILE);
+}
 function acquireConductorLock(staleMinutes) {
   return acquireRunLock("conductor", staleMinutes, CONDUCTOR_LOCK_FILE);
 }
@@ -4487,8 +4602,8 @@ function heldForMs(owner, now) {
   const startedAt = Date.parse(owner.startedAt);
   return Number.isNaN(startedAt) ? null : now - startedAt;
 }
-function inspectRunLock(staleMinutes, now = Date.now()) {
-  const path = lockPath();
+function inspectRunLock(staleMinutes, now = Date.now(), lockFile = LOCK_FILE) {
+  const path = lockPath(lockFile);
   try {
     statSync2(path);
   } catch (err) {
@@ -4673,9 +4788,9 @@ function detectRescueTarget(options, now) {
     return { branch: current, createdBranch: false, source: current };
   }
   const source = detached ? "detached HEAD" : current === options.baseBranch ? options.baseBranch : current;
-  const label = detached ? "detached" : flattenBranchName(source);
+  const label2 = detached ? "detached" : flattenBranchName(source);
   return {
-    branch: `${RESCUE_BRANCH_PREFIX}${label}-${utcStamp(now)}`,
+    branch: `${RESCUE_BRANCH_PREFIX}${label2}-${utcStamp(now)}`,
     createdBranch: true,
     source
   };
@@ -5091,9 +5206,9 @@ var RunTranscript = class {
   stderrAtLineStart = true;
   /** A private key began in an earlier line and has not ended yet. */
   inPrivateKey = false;
-  constructor(label, root = process.cwd(), now = /* @__PURE__ */ new Date()) {
+  constructor(label2, root = process.cwd(), now = /* @__PURE__ */ new Date()) {
     const stamp = now.toISOString().replace(/[:.]/g, "-");
-    this.fileName = `${stamp}-${label}.log`;
+    this.fileName = `${stamp}-${label2}.log`;
     const dir = join5(root, RUN_TRANSCRIPT_DIR);
     this.path = join5(dir, this.fileName);
     try {
@@ -5440,9 +5555,9 @@ function summarizeSync(items) {
   const counts = /* @__PURE__ */ new Map();
   for (const item of items) {
     if (item.sync === void 0) continue;
-    const key = oneLine(item.sync);
-    if (key.length === 0 || QUIET_SYNC.has(key)) continue;
-    counts.set(key, (counts.get(key) ?? 0) + 1);
+    const key2 = oneLine(item.sync);
+    if (key2.length === 0 || QUIET_SYNC.has(key2)) continue;
+    counts.set(key2, (counts.get(key2) ?? 0) + 1);
   }
   if (counts.size === 0) return null;
   return [...counts].map(([strategy, count]) => `${strategy}:${String(count)}`).join(",");
@@ -5691,9 +5806,9 @@ function parseExecution(bracket) {
   if (bracket === void 0) return { executor: null, model: null, effort: null };
   const parts = bracket.split(" ").filter((part) => part.length > 0);
   const executor = parts[0] ?? null;
-  const find = (key) => {
-    const hit = parts.find((part) => part.startsWith(`${key}=`));
-    return hit === void 0 ? null : hit.slice(key.length + 1);
+  const find = (key2) => {
+    const hit = parts.find((part) => part.startsWith(`${key2}=`));
+    return hit === void 0 ? null : hit.slice(key2.length + 1);
   };
   return { executor, model: find("model"), effort: find("effort") };
 }
@@ -6360,12 +6475,12 @@ function gitSection(status) {
   return build("git", lines, problems, { ...status });
 }
 function assembleReport(input) {
-  const byId = new Map(input.sections.map((section) => [section.id, section]));
+  const byId = new Map(input.sections.map((section2) => [section2.id, section2]));
   const ordered = SECTION_ORDER.flatMap((id) => {
-    const section = byId.get(id);
-    return section === void 0 ? [] : [section];
+    const section2 = byId.get(id);
+    return section2 === void 0 ? [] : [section2];
   });
-  const problems = ordered.flatMap((section) => section.problems);
+  const problems = ordered.flatMap((section2) => section2.problems);
   return {
     generatedAt: input.generatedAt,
     repo: input.repo,
@@ -6399,8 +6514,8 @@ function renderProblems(problems) {
 function renderText(report) {
   const head = `automata do-work --check \u2014 ${report.repo ?? "unknown repository"} \u2014 ${report.generatedAt.toISOString()}`;
   const parts = report.blocked === null ? [head, ""] : [`blocked: ${report.blocked.trigger}`, head, ""];
-  for (const section of report.sections) {
-    parts.push(...renderBlock(section.title, section.lines, "(nothing to report)"));
+  for (const section2 of report.sections) {
+    parts.push(...renderBlock(section2.title, section2.lines, "(nothing to report)"));
   }
   if (report.trace !== null) parts.push(...renderTrace(report.trace));
   if (report.problems.length > 0) parts.push(...renderProblems(report.problems));
@@ -6411,12 +6526,12 @@ function renderText(report) {
 }
 function toJson(report) {
   const sections = {};
-  for (const section of report.sections) {
-    sections[section.id] = {
-      title: section.title,
-      lines: section.lines,
-      problems: section.problems,
-      data: section.data
+  for (const section2 of report.sections) {
+    sections[section2.id] = {
+      title: section2.title,
+      lines: section2.lines,
+      problems: section2.problems,
+      data: section2.data
     };
   }
   return {
@@ -6475,14 +6590,14 @@ var SettingsError = class extends Error {
 function failSettings(message) {
   throw new SettingsError(message);
 }
-function parsePositiveInt(value, label) {
+function parsePositiveInt(value, label2) {
   const trimmed2 = value.trim();
   if (!/^\d+$/.test(trimmed2)) {
-    failSettings(`${label} must be a positive integer (got "${value}").`);
+    failSettings(`${label2} must be a positive integer (got "${value}").`);
   }
   const parsed = Number(trimmed2);
   if (!Number.isSafeInteger(parsed) || parsed <= 0) {
-    failSettings(`${label} must be a positive integer within the safe range (got "${value}").`);
+    failSettings(`${label2} must be a positive integer within the safe range (got "${value}").`);
   }
   return parsed;
 }
@@ -6637,14 +6752,14 @@ function planRun(item, settings, execution) {
 }
 function describeAssignment(item, agentUser) {
   return claimStates(item).map((claim) => {
-    const label = claim.surface === "issue" ? "issue" : `pull request #${String(claim.number)}`;
+    const label2 = claim.surface === "issue" ? "issue" : `pull request #${String(claim.number)}`;
     switch (claim.state) {
       case "would-claim":
-        return `would assign ${label} to ${agentUser}`;
+        return `would assign ${label2} to ${agentUser}`;
       case "already-assigned":
-        return `${label} already assigned`;
+        return `${label2} already assigned`;
       case "rule-exempt":
-        return `${label} not claimed (orphan pass)`;
+        return `${label2} not claimed (orphan pass)`;
     }
   }).join(" \xB7 ");
 }
@@ -6706,41 +6821,41 @@ function describeRefusedRun(item, refusal) {
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function validateOptionalString(container, key, path) {
-  const value = container[key];
+function validateOptionalString(container, key2, path) {
+  const value = container[key2];
   if (value === void 0 || value === null) return;
   if (typeof value !== "string" || value.trim().length === 0) {
     failSettings(`${path} must be a non-empty string.`);
   }
 }
-function validateOptionalInt(container, key, path, min, hint) {
-  const value = container[key];
+function validateOptionalInt(container, key2, path, min, hint) {
+  const value = container[key2];
   if (value === void 0 || value === null) return;
   if (typeof value !== "number" || !Number.isSafeInteger(value) || value < min) {
     failSettings(`${path} must be ${hint}, got ${JSON.stringify(value)}.`);
   }
 }
-function validateDoWorkConfig(section) {
-  if (section === void 0 || section === null) return;
-  if (!isPlainObject(section)) {
-    failSettings(`doWork must be an object, got ${JSON.stringify(section)}.`);
+function validateDoWorkConfig(section2) {
+  if (section2 === void 0 || section2 === null) return;
+  if (!isPlainObject(section2)) {
+    failSettings(`doWork must be an object, got ${JSON.stringify(section2)}.`);
   }
-  const executor = section["executor"];
+  const executor = section2["executor"];
   if (executor !== void 0 && executor !== "claude" && executor !== "codex") {
     failSettings(`doWork.executor must be 'claude' or 'codex', got ${JSON.stringify(executor)}.`);
   }
-  validateOptionalString(section, "baseBranch", "doWork.baseBranch");
-  validateOptionalInt(section, "maxRunsPerTick", "doWork.maxRunsPerTick", 0, "a non-negative integer (0 = unlimited)");
-  validateOptionalInt(section, "lockStaleMinutes", "doWork.lockStaleMinutes", 1, "a positive integer");
-  validateOptionalBoolean(section, "dumpOnBlock", "doWork.dumpOnBlock");
-  validateOptionalBoolean(section, "postRunLog", "doWork.postRunLog");
-  validateProtectedBranches(section["protectedBranches"]);
-  validateSettingContainer(section["models"], "models", ["claude", "codex"]);
-  validateSettingContainer(section["effort"], "effort", ["claude", "codex"]);
-  validateSettingContainer(section["prompts"], "prompts", ["issueDiscuss", "prWork", "prOrphan"]);
-}
-function validateOptionalBoolean(container, key, path) {
-  const value = container[key];
+  validateOptionalString(section2, "baseBranch", "doWork.baseBranch");
+  validateOptionalInt(section2, "maxRunsPerTick", "doWork.maxRunsPerTick", 0, "a non-negative integer (0 = unlimited)");
+  validateOptionalInt(section2, "lockStaleMinutes", "doWork.lockStaleMinutes", 1, "a positive integer");
+  validateOptionalBoolean(section2, "dumpOnBlock", "doWork.dumpOnBlock");
+  validateOptionalBoolean(section2, "postRunLog", "doWork.postRunLog");
+  validateProtectedBranches(section2["protectedBranches"]);
+  validateSettingContainer(section2["models"], "models", ["claude", "codex"]);
+  validateSettingContainer(section2["effort"], "effort", ["claude", "codex"]);
+  validateSettingContainer(section2["prompts"], "prompts", ["issueDiscuss", "prWork", "prOrphan"]);
+}
+function validateOptionalBoolean(container, key2, path) {
+  const value = container[key2];
   if (value === void 0 || value === null) return;
   if (typeof value !== "boolean") {
     failSettings(`${path} must be true or false, got ${JSON.stringify(value)}.`);
@@ -6758,12 +6873,12 @@ function validateSettingContainer(value, container, keys) {
   if (!isPlainObject(value)) {
     failSettings(`doWork.${container} must be an object, got ${JSON.stringify(value)}.`);
   }
-  for (const key of keys) {
-    validateOptionalString(value, key, `doWork.${container}.${key}`);
+  for (const key2 of keys) {
+    validateOptionalString(value, key2, `doWork.${container}.${key2}`);
   }
-  for (const key of Object.keys(value)) {
-    if (!keys.includes(key)) {
-      failSettings(`doWork.${container}.${key} is not a recognised setting; expected one of: ${keys.join(", ")}.`);
+  for (const key2 of Object.keys(value)) {
+    if (!keys.includes(key2)) {
+      failSettings(`doWork.${container}.${key2} is not a recognised setting; expected one of: ${keys.join(", ")}.`);
     }
   }
 }
@@ -6800,7 +6915,7 @@ function matchesDiscoveryFilter(subject, settings) {
   const value = settings.discoveryValue.toLowerCase();
   switch (settings.technique) {
     case "label":
-      return subject.labels.some((label) => label.toLowerCase() === value);
+      return subject.labels.some((label2) => label2.toLowerCase() === value);
     case "assignee":
       return subject.assignees.some((assignee) => assignee.toLowerCase() === value);
     case "title-contains":
@@ -8311,6 +8426,362 @@ import { Command as Command7 } from "commander";
 function isWatchClosed(state) {
   return state === "closed";
 }
+function issueConversation(surface) {
+  return {
+    kind: "issue",
+    number: surface.issue.number,
+    state: surface.state === "CLOSED" ? "closed" : "open",
+    messages: surface.messages
+  };
+}
+function prConversation(surface) {
+  return {
+    kind: "pr",
+    number: surface.pr.number,
+    state: surface.pr.state === "OPEN" ? "open" : "closed",
+    messages: [...surface.messages, ...surface.threads.flatMap((thread) => thread.comments)]
+  };
+}
+function decideConversation(conversation, p) {
+  if (isWatchClosed(conversation.state)) {
+    return { kind: "skip", surface: conversation, reason: "closed", detail: "the item is closed or merged" };
+  }
+  const agent = p.agentUser.toLowerCase();
+  const allowed = new Set(p.allowedUsers.map((user) => user.toLowerCase()));
+  const relevant = conversation.messages.filter((message) => {
+    const author = message.author.toLowerCase();
+    return author === agent || allowed.has(author);
+  });
+  let newest2 = null;
+  for (const message of relevant) {
+    if (message.author.toLowerCase() !== agent) continue;
+    if (newest2 === null || message.createdAt > newest2.createdAt) newest2 = message;
+  }
+  if (newest2 === null) {
+    return {
+      kind: "skip",
+      surface: conversation,
+      reason: "no-agent-message",
+      detail: `${p.agentUser} has not written here`
+    };
+  }
+  const marker = { commentId: "", createdAt: newest2.createdAt };
+  const answeredBy = p.allowedUsers.find((user) => agentAnsweredAfter(relevant, user, marker));
+  if (answeredBy !== void 0) {
+    return {
+      kind: "skip",
+      surface: conversation,
+      reason: "answered",
+      detail: `${answeredBy} answered after ${p.agentUser}'s message at ${newest2.createdAt}`
+    };
+  }
+  return {
+    kind: "reply",
+    surface: conversation,
+    agentMessageAt: newest2.createdAt,
+    reason: `${p.agentUser}'s message at ${newest2.createdAt} has no answer from an allowed user`
+  };
+}
+function decideConductorReply(conversations, p) {
+  const decisions = conversations.map((conversation) => decideConversation(conversation, p));
+  return { needsReply: decisions.some((decision) => decision.kind === "reply"), decisions };
+}
+
+// src/conductor/thread.ts
+function defaultReplyTarget(thread) {
+  return thread.kind === "issue" ? { kind: "issue", number: thread.issue.issue.number } : { kind: "pr", number: thread.prs[0].surface.pr.number };
+}
+function postingInstruction(target) {
+  const command = target.kind === "pr" ? "pr" : "issue";
+  const number = String(target.number);
+  return [
+    `Post your reply as a comment on ${target.kind === "pr" ? "pull request" : "issue"} #${number}. What you print is discarded; only a posted comment counts.`,
+    `Run \`gh ${command} comment ${number} --body-file -\` and give the body on standard input, for example with a here-document.`,
+    "Post exactly one comment. Do not approve, merge or close anything."
+  ].join("\n");
+}
+function dryRunInstruction(target) {
+  return [
+    `Write your reply to ${target.kind === "pr" ? "pull request" : "issue"} #${String(target.number)}. This is a dry run: you cannot post a comment, and you must not try.`,
+    "Make the reply, and nothing else, your final message. Do not approve, merge or close anything."
+  ].join("\n");
+}
+function visible(messages, participants) {
+  return analyzeSurface(messages, participants).messages.map((message) => ({
+    kind: message.kind,
+    author: message.author,
+    body: message.body,
+    createdAt: message.createdAt
+  }));
+}
+function renderMessages(messages, participants) {
+  const kept = visible(messages, participants);
+  return kept.length === 0 ? "(no messages)" : formatMessages(kept.map((m) => ({ ...m, isNew: false })));
+}
+function renderThread(thread, participants) {
+  const comments = visible(thread.comments, participants);
+  if (comments.length === 0) return null;
+  const location = thread.line === null ? `${thread.path}:(file)` : `${thread.path}:${String(thread.line)}`;
+  const link = thread.url === null ? "" : `
+${thread.url}`;
+  return `${location}${link}
+${formatMessages(comments.map((m) => ({ ...m, isNew: false })))}`;
+}
+function renderChecks(checks) {
+  if (checks.length === 0) return "No checks reported.";
+  return checks.map((check) => `- ${check.name}: ${check.status === "COMPLETED" ? check.conclusion ?? "COMPLETED" : check.status}`).join("\n");
+}
+function descriptionLines(description, participants) {
+  if (description === void 0 || description.body.trim().length === 0) return [""];
+  const [kept] = visible([{ kind: "issue-body", author: description.author, body: description.body, createdAt: "" }], participants);
+  if (kept === void 0) return [""];
+  return ["", `Pull request description (by ${kept.author}):`, "", kept.body, ""];
+}
+function prSection(pr, participants) {
+  const { surface, checks } = pr;
+  const number = String(surface.pr.number);
+  const lines = [
+    "",
+    `Pull request #${number}: ${surface.pr.title}`,
+    `Pull request URL: ${surface.pr.url}`,
+    `State: ${surface.pr.state}${surface.pr.isDraft ? " (draft)" : ""} \xB7 Branch: ${surface.pr.headRefName} into ${surface.pr.baseRefName}`,
+    ...descriptionLines(surface.description, participants),
+    `Conversation on pull request #${number} (authorized accounts and you only, oldest first):`,
+    "",
+    renderMessages(surface.messages, participants)
+  ];
+  const threads = surface.threads.filter((thread) => !thread.isResolved).map((thread) => renderThread(thread, participants)).filter((text) => text !== null);
+  if (threads.length > 0) {
+    lines.push("", `Unresolved review threads on pull request #${number}:`, "", threads.join("\n\n"));
+  }
+  lines.push("", `CI status of pull request #${number}:`, "", renderChecks(checks));
+  return lines;
+}
+function composeConductorPrompt(input) {
+  const { thread, repo, participants, frame } = input;
+  const replyTo = input.replyTo ?? defaultReplyTarget(thread);
+  const lines = [
+    frame,
+    "",
+    "--- Thread assembled by automata ---",
+    `Repository: ${repo.owner}/${repo.repo}`,
+    `The agent is: ${participants.agentUser}`
+  ];
+  if (thread.kind === "issue") {
+    lines.push(
+      "",
+      `Issue #${String(thread.issue.issue.number)}: ${thread.issue.issue.title}`,
+      `Issue URL: ${thread.issue.issue.url}`,
+      `State: ${thread.issue.state}`,
+      "",
+      "Conversation on the issue (authorized accounts and you only, oldest first):",
+      "",
+      renderMessages(thread.issue.messages, participants)
+    );
+  }
+  for (const pr of thread.prs) lines.push(...prSection(pr, participants));
+  lines.push(
+    "",
+    "Only the messages above exist. Anything from other accounts has been withheld",
+    "deliberately \u2014 do not ask about it.",
+    "",
+    input.dryRun === true ? dryRunInstruction(replyTo) : postingInstruction(replyTo)
+  );
+  return lines.join("\n");
+}
+
+// src/conductor/execution.ts
+var EXECUTORS = ["claude", "codex"];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function containerProblem(value, name) {
+  if (value === void 0 || value === null) return null;
+  if (!isRecord(value)) return `conductor.${name} must be an object, got ${JSON.stringify(value)}.`;
+  for (const [key2, entry] of Object.entries(value)) {
+    if (!EXECUTORS.includes(key2)) {
+      return `conductor.${name}.${key2} is not a recognised setting; expected one of: ${EXECUTORS.join(", ")}.`;
+    }
+    if (entry !== void 0 && typeof entry !== "string") {
+      return `conductor.${name}.${key2} must be a string, got ${JSON.stringify(entry)}.`;
+    }
+  }
+  return null;
+}
+function conductorExecutionProblem(conductor) {
+  const executor = conductor?.executor;
+  if (executor !== void 0 && executor !== null && (typeof executor !== "string" || !EXECUTORS.includes(executor))) {
+    return `conductor.executor must be one of: ${EXECUTORS.join(", ")}; got ${JSON.stringify(executor)}.`;
+  }
+  return containerProblem(conductor?.models, "models") ?? containerProblem(conductor?.effort, "effort");
+}
+function clean(value) {
+  const trimmed2 = value?.trim();
+  return trimmed2 === void 0 || trimmed2.length === 0 ? void 0 : trimmed2;
+}
+function resolveConductorExecution(conductor) {
+  const executor = conductor?.executor ?? "claude";
+  return {
+    executor,
+    model: clean(conductor?.models?.[executor]),
+    effort: clean(conductor?.effort?.[executor])
+  };
+}
+function describeConductorExecution(execution) {
+  const model = execution.model === void 0 ? " (no model override)" : ` \xB7 model ${execution.model}`;
+  const effort = execution.effort === void 0 ? "" : ` \xB7 effort ${execution.effort}`;
+  return `${execution.executor}${model}${effort}`;
+}
+
+// src/conductor/reply.ts
+function isComment(message) {
+  return message.kind === "issue-comment" || message.kind === "pr-comment";
+}
+function key(message) {
+  return `${message.createdAt}\0${message.body}`;
+}
+function newMessagesBy(before, after, login2) {
+  const who = login2.toLowerCase();
+  const own = (m) => isComment(m) && m.author.toLowerCase() === who;
+  const known = /* @__PURE__ */ new Map();
+  for (const m of before.filter(own)) known.set(key(m), (known.get(key(m)) ?? 0) + 1);
+  return after.filter((m) => {
+    if (!own(m)) return false;
+    const left = known.get(key(m)) ?? 0;
+    if (left > 0) known.set(key(m), left - 1);
+    return left === 0;
+  });
+}
+async function conductReply(input) {
+  let before;
+  try {
+    before = input.read();
+  } catch (err) {
+    return { kind: "unverified", error: `could not read the conversation before the run: ${err.message}` };
+  }
+  let runError = null;
+  try {
+    await input.run();
+  } catch (err) {
+    runError = err.message;
+  }
+  let after;
+  try {
+    after = input.read();
+  } catch (err) {
+    return { kind: "unverified", error: `could not read the conversation after the run: ${err.message}` };
+  }
+  const posted = newMessagesBy(before, after, input.login);
+  if (posted.length > 0) return { kind: "posted", count: posted.length, runError };
+  return runError === null ? { kind: "posted-nothing" } : { kind: "run-failed", error: runError };
+}
+
+// src/conductor/checkReport.ts
+function section(title, lines, problems = []) {
+  return { title, lines, problems };
+}
+function label(id, kind) {
+  return `${kind === "pr" ? "PR" : "issue"} #${String(id)}`;
+}
+function lockSection2(status, staleMinutes) {
+  const fix = "remove .automata/conductor.lock once you have confirmed that no conductor runs";
+  switch (status.kind) {
+    case "free":
+      return section("Run lock", ["no conductor is running in this checkout"]);
+    case "held": {
+      const held = status.heldForMs === null ? "" : ` (${describeDuration(status.heldForMs)} so far)`;
+      return section("Run lock", [
+        `a conductor is running: pid ${String(status.owner.pid)} on ${status.owner.host}, started ${status.owner.startedAt}${held}`,
+        "a tick started now would do nothing"
+      ]);
+    }
+    case "suspect":
+      return section(
+        "Run lock",
+        [`held longer than ${String(staleMinutes)} minutes by pid ${String(status.owner.pid)} on ${status.owner.host}`],
+        [{ section: "lock", summary: `the lock looks alive but outlived the stale window, probably a reused pid: ${fix}` }]
+      );
+    case "stale":
+      return section("Run lock", ["a stale lock is present; the next tick takes it over"]);
+    case "unreadable":
+      return section(
+        "Run lock",
+        [`the lock cannot be read: ${status.detail}`],
+        [{ section: "lock", summary: `the lock file cannot be read (${status.detail}); fix its permissions` }]
+      );
+  }
+}
+function decisionLine(decision) {
+  const where = label(decision.surface.number, decision.surface.kind);
+  return decision.kind === "reply" ? `reply on ${where}: ${decision.reason}` : `skip ${where} (${decision.reason}): ${decision.detail}`;
+}
+function watchSections(watched) {
+  const listLines = [];
+  const replyLines = [];
+  const problems = [];
+  for (const entry of watched) {
+    if ("unavailable" in entry) {
+      listLines.push(`#${String(entry.id)}: unavailable (${entry.unavailable}); a tick keeps it and skips it`);
+      problems.push({ section: "watch", summary: `#${String(entry.id)} could not be read: ${entry.unavailable}` });
+      continue;
+    }
+    const name = label(entry.id, entry.kind);
+    if (entry.state === "closed") {
+      listLines.push(`${name}: closed, a tick would drop it from the watch list`);
+      continue;
+    }
+    listLines.push(`${name}: open`);
+    for (const decision of entry.decisions) replyLines.push(decisionLine(decision));
+  }
+  return [
+    section(`Watch list (${String(watched.length)})`, listLines, problems),
+    section("Replies a tick would write", replyLines)
+  ];
+}
+function buildConductorCheck(input) {
+  const sections = input.configProblem === null ? [
+    section("Configuration", [`running as ${input.identity}`, `executor: ${input.execution}`]),
+    lockSection2(input.lock, input.staleMinutes),
+    ...watchSections(input.watched)
+  ] : [
+    section(
+      "Configuration",
+      [input.configProblem],
+      [{ section: "configuration", summary: input.configProblem }]
+    )
+  ];
+  const problems = sections.flatMap((s) => s.problems);
+  const parts = [
+    `automata conductor --check \u2014 ${input.repo ?? "unknown repository"} \u2014 ${input.generatedAt.toISOString()}`,
+    ""
+  ];
+  for (const s of sections) {
+    parts.push(s.title, ...(s.lines.length === 0 ? ["(nothing to report)"] : s.lines).map((l) => `  ${l}`), "");
+  }
+  if (problems.length > 0) {
+    parts.push(`Problems (${String(problems.length)})`, ...problems.map((p) => `  \xB7 ${p.section}: ${p.summary}`), "");
+  }
+  parts.push(problems.length === 0 ? "RESULT: healthy" : `RESULT: ${String(problems.length)} problem(s) found`);
+  return { text: parts.join("\n") + "\n", exitCode: problems.length === 0 ? 0 : 1, problems };
+}
+
+// src/conductor/dryRunReply.ts
+function claudeResult(raw) {
+  let result = null;
+  for (const line of raw.split("\n")) {
+    if (!line.trim().startsWith("{")) continue;
+    try {
+      const event = JSON.parse(line);
+      if (event["type"] === "result" && typeof event["result"] === "string") result = event["result"];
+    } catch {
+    }
+  }
+  return result;
+}
+function extractDryRunReply(executor, stdout) {
+  const text = (executor === "claude" ? claudeResult(stdout) : stdout)?.trim();
+  return text === void 0 || text.length === 0 ? null : text;
+}
 
 // src/conductor/watchList.ts
 function parseWatchId(raw) {
@@ -8369,6 +8840,118 @@ function pruneWatchList(config) {
     }
   }
   if (dropped.length > 0) updateWatch((current) => current.filter((id) => !dropped.includes(id)));
+  return watch.filter((id) => !dropped.includes(id));
+}
+function onceLinkMap() {
+  let map = null;
+  return () => map ??= getOpenPrLinkMap();
+}
+function readPr(number) {
+  return { surface: getPrSurface(number), checks: getPrChecks(number) };
+}
+function readWatchedItem(id, linkMap = getOpenPrLinkMap) {
+  const target = getWatchTarget(id);
+  if (target.kind === "pr") {
+    const pr = readPr(id);
+    return { thread: { kind: "pr", prs: [pr] }, conversations: [prConversation(pr.surface)] };
+  }
+  const issue = getIssueSurface(id);
+  const prs = (linkMap().byIssue.get(id) ?? []).map((ref) => readPr(ref.number));
+  return {
+    thread: { kind: "issue", issue, prs },
+    conversations: [issueConversation(issue), ...prs.map((pr) => prConversation(pr.surface))]
+  };
+}
+function readTargetMessages(target) {
+  return target.kind === "issue" ? issueConversation(getIssueSurface(target.number)).messages : prConversation(getPrSurface(target.number)).messages;
+}
+function runModel(prompt, execution, replyTo) {
+  const { owner, repo } = getRepoSlug();
+  return runClaude(prompt, { model: execution.model, effort: execution.effort, readOnly: true, replyTo, ghRepo: `${owner}/${repo}` });
+}
+async function runModelForText(prompt, execution) {
+  const { owner, repo } = getRepoSlug();
+  let stdout = "";
+  const sink2 = {
+    output: (stream, text) => {
+      if (stream === "stdout") stdout += text;
+    },
+    exited: () => void 0
+  };
+  const options = { model: execution.model, effort: execution.effort, readOnly: true, ghRepo: `${owner}/${repo}`, sink: sink2 };
+  await runClaude(prompt, options);
+  return extractDryRunReply(execution.executor, stdout);
+}
+function targetKey(target) {
+  return `${target.kind}#${String(target.number)}`;
+}
+async function conductItem(id, config, login2, participants, execution, dryRun) {
+  const label2 = `#${String(id)}`;
+  let item;
+  try {
+    item = readWatchedItem(id, dryRun?.linkMap);
+  } catch (err) {
+    process.stderr.write(`Warning: could not read ${label2}, skipping it this tick: ${err.message}
+`);
+    return "idle";
+  }
+  const { thread, conversations } = item;
+  const verdict = decideConductorReply(conversations, participants);
+  const owed = verdict.decisions.find(
+    (decision) => decision.kind === "reply" && dryRun?.answered.has(targetKey(decision.surface)) !== true
+  );
+  if (owed === void 0) {
+    process.stdout.write(`Conductor: ${label2} needs no reply.
+`);
+    return "idle";
+  }
+  const replyTo = { kind: owed.surface.kind, number: owed.surface.number };
+  const frame = thread.kind === "issue" ? config.conductor?.prompts?.issue ?? DEFAULT_CONDUCTOR_ISSUE_PROMPT : config.conductor?.prompts?.pr ?? DEFAULT_CONDUCTOR_PR_PROMPT;
+  const prompt = composeConductorPrompt({ thread, repo: getRepoSlug(), participants, frame, replyTo, dryRun: dryRun !== void 0 });
+  const where = `${replyTo.kind === "pr" ? "pull request" : "issue"} #${String(replyTo.number)}`;
+  process.stdout.write(`Conductor: ${label2} needs a reply on ${where}; running ${describeConductorExecution(execution)}.
+`);
+  if (dryRun) {
+    const reply = await runModelForText(prompt, execution);
+    if (reply === null) {
+      process.stderr.write(`Error: the dry run for ${label2} produced no reply text.
+`);
+      return "failed";
+    }
+    dryRun.answered.add(targetKey(replyTo));
+    process.stdout.write(`--- Dry run: reply for ${where} (not posted) ---
+${reply}
+---
+`);
+    return "replied";
+  }
+  const outcome = await conductReply({
+    login: login2,
+    read: () => readTargetMessages(replyTo),
+    run: () => runModel(prompt, execution, replyTo)
+  });
+  switch (outcome.kind) {
+    case "posted":
+      process.stdout.write(`Conductor: posted a reply on ${where}.
+`);
+      if (outcome.runError !== null) {
+        process.stderr.write(`Warning: the run reported "${outcome.runError}" but the reply is posted.
+`);
+      }
+      return "replied";
+    case "posted-nothing":
+      process.stderr.write(`Error: the run for ${label2} finished but posted no comment on ${where}.
+`);
+      return "failed";
+    case "run-failed":
+      process.stderr.write(`Error: the run for ${label2} failed and posted no comment on ${where}: ${outcome.error}
+`);
+      return "failed";
+    case "unverified":
+      process.stderr.write(`Error: could not tell whether ${label2} got a reply: ${outcome.error}
+`);
+      return "failed";
+  }
 }
 function loadGitHubConfig() {
   const config = readRawConfig();
@@ -8440,43 +9023,139 @@ function runWatchList() {
 function exitWith(code) {
   if (code !== 0) process.exit(code);
 }
-function runConductor() {
+function preflight() {
   let config;
   try {
     config = readConfig();
   } catch (err) {
-    return fail2(err.message);
+    return { problem: err.message };
   }
   if (!isExplicitGitHub(config)) {
-    return fail2(
-      azdoUnsupportedMessage(
+    return {
+      problem: azdoUnsupportedMessage(
         "conductor",
         "It needs the GitHub APIs; set the remote with `automata config set type gh`."
       )
-    );
+    };
   }
   const allowedUsers = (config.allowedUsers ?? []).filter((user) => user.trim().length > 0);
   if (allowedUsers.length === 0) {
-    return fail2("No allowed users configured. Run `automata config set allowed-users <user1,user2>`.");
+    return { problem: "No allowed users configured. Run `automata config set allowed-users <user1,user2>`." };
   }
   const agentUser = (config.agentUser ?? "").trim();
   if (agentUser.length === 0) {
-    return fail2("No agent user configured. Run `automata config set agent-user <login>`.");
+    return { problem: "No agent user configured. Run `automata config set agent-user <login>`." };
   }
   let login2;
   try {
     login2 = getAuthenticatedLogin();
   } catch (err) {
-    return fail2(`\`gh\` could not be queried: ${err.message}`);
+    return { problem: `\`gh\` could not be queried: ${err.message}` };
   }
-  const problem = conductorIdentityProblemFor(login2, agentUser, allowedUsers);
-  if (problem !== null) return fail2(problem);
+  const identityProblem = conductorIdentityProblemFor(login2, agentUser, allowedUsers);
+  if (identityProblem !== null) return { problem: identityProblem };
   const rawStale = config.doWork?.lockStaleMinutes;
   if (rawStale !== void 0 && rawStale !== null) {
     if (typeof rawStale !== "number" || !Number.isSafeInteger(rawStale) || rawStale < 1) {
-      return fail2(`doWork.lockStaleMinutes must be a positive integer, got ${JSON.stringify(rawStale)}.`);
+      return { problem: `doWork.lockStaleMinutes must be a positive integer, got ${JSON.stringify(rawStale)}.` };
+    }
+  }
+  const executionProblem = conductorExecutionProblem(config.conductor);
+  if (executionProblem !== null) return { problem: executionProblem };
+  if (config.conductor?.executor === "codex") {
+    return { problem: "conductor.executor codex is not supported: Codex cannot be limited to comments on the reply target. Use claude." };
+  }
+  return {
+    config,
+    login: login2 ?? "",
+    participants: { allowedUsers, agentUser },
+    execution: resolveConductorExecution(config.conductor)
+  };
+}
+function staleMinutesOf(config) {
+  return config.doWork?.lockStaleMinutes ?? DEFAULT_DO_WORK.lockStaleMinutes;
+}
+function checkWatched(id, participants, linkMap) {
+  try {
+    const target = getWatchTarget(id);
+    if (isWatchClosed(target.state)) return { id, kind: target.kind, state: "closed", decisions: [] };
+    const { conversations } = readWatchedItem(id, linkMap);
+    return { id, kind: target.kind, state: "open", decisions: decideConductorReply(conversations, participants).decisions };
+  } catch (err) {
+    return { id, unavailable: err.message };
+  }
+}
+function runConductorCheck() {
+  const checked = preflight();
+  const generatedAt = /* @__PURE__ */ new Date();
+  let repo = null;
+  try {
+    const slug = getRepoSlug();
+    repo = `${slug.owner}/${slug.repo}`;
+  } catch {
+  }
+  const linkMap = onceLinkMap();
+  const report = "problem" in checked ? buildConductorCheck({
+    generatedAt,
+    repo,
+    configProblem: checked.problem,
+    identity: "",
+    execution: "",
+    lock: { kind: "free" },
+    staleMinutes: DEFAULT_DO_WORK.lockStaleMinutes,
+    watched: []
+  }) : buildConductorCheck({
+    generatedAt,
+    repo,
+    configProblem: null,
+    identity: checked.login,
+    execution: describeConductorExecution(checked.execution),
+    lock: inspectConductorLock(staleMinutesOf(checked.config)),
+    staleMinutes: staleMinutesOf(checked.config),
+    watched: normalizeWatch(checked.config.conductor?.watch).map((id) => checkWatched(id, checked.participants, linkMap))
+  });
+  process.stdout.write(report.text);
+  return report.exitCode;
+}
+async function runConductorDryRun(checked) {
+  const { config, login: login2, participants, execution } = checked;
+  const lock = inspectConductorLock(staleMinutesOf(config));
+  if (lock.kind === "held" || lock.kind === "suspect") {
+    process.stderr.write(`Warning: a conductor is running here (pid ${String(lock.owner.pid)}); the dry run does not take the lock.
+`);
+  }
+  process.stdout.write(`Conductor: dry run as ${login2}; nothing is posted and the watch list is not changed.
+`);
+  let failed = 0;
+  const context = { linkMap: onceLinkMap(), answered: /* @__PURE__ */ new Set() };
+  for (const id of normalizeWatch(config.conductor?.watch)) {
+    try {
+      if (isWatchClosed(getWatchTarget(id).state)) {
+        process.stdout.write(`Conductor: #${String(id)} is closed; a tick would drop it from the watch list.
+`);
+        continue;
+      }
+    } catch {
+    }
+    try {
+      if (await conductItem(id, config, login2, participants, execution, context) === "failed") failed++;
+    } catch (err) {
+      process.stderr.write(`Error: #${String(id)} could not be conducted: ${err.message}
+`);
+      failed++;
     }
   }
+  return failed > 0 ? 1 : 0;
+}
+async function runConductor(options = {}) {
+  if (options.check === true && options.dryRun === true) {
+    return fail2("--check and --dry-run cannot be used together.");
+  }
+  if (options.check === true) return runConductorCheck();
+  const checked = preflight();
+  if ("problem" in checked) return fail2(checked.problem);
+  if (options.dryRun === true) return runConductorDryRun(checked);
+  const { config, login: login2, participants, execution } = checked;
   const staleMinutes = config.doWork?.lockStaleMinutes ?? DEFAULT_DO_WORK.lockStaleMinutes;
   const lock = acquireConductorLock(staleMinutes);
   if (!lock.ok) {
@@ -8495,18 +9174,28 @@ function runConductor() {
     return 0;
   }
   try {
-    process.stdout.write(`Conductor: running as ${login2 ?? ""}.
+    process.stdout.write(`Conductor: running as ${login2}.
 `);
-    pruneWatchList(config);
-    return 0;
+    const watch = pruneWatchList(config);
+    let failed = 0;
+    for (const id of watch) {
+      try {
+        if (await conductItem(id, config, login2, participants, execution) === "failed") failed++;
+      } catch (err) {
+        process.stderr.write(`Error: #${String(id)} could not be conducted: ${err.message}
+`);
+        failed++;
+      }
+    }
+    return failed > 0 ? 1 : 0;
   } finally {
     lock.handle.release();
   }
 }
 var conductorCommand = new Command7("conductor").description(
   "Run one conductor tick as an allowed (human) account: verify the identity, take the conductor's own run lock, then act"
-).action(() => {
-  exitWith(runConductor());
+).option("--check", "Report what a tick would do, including pending prunes, and change nothing; exit 1 on a problem").option("--dry-run", "Run the model for each owed reply and print it instead of posting; no lock, no prune").action(async (options) => {
+  exitWith(await runConductor(options));
 });
 conductorCommand.command("add <id>").description("Watch an issue or pull request and make do-work pick it up (an issue also follows its linked PR)").action((id) => {
   exitWith(runWatchAdd(id));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "automata-cli",
-  "version": "0.11.0-develop.501",
+  "version": "0.11.0-develop.519",
   "description": "Automata CLI tool",
   "type": "module",
   "engines": {