automata-cli 0.12.0-develop.533 → 0.12.0-develop.562

package/dist/index.js

@@ -2633,7 +2633,7 @@ function addLabel(target, name, description) {
   const edit = target.kind === "pr" ? "pr" : "issue";
   const args = [edit, "edit", String(target.number), "--add-label", name];
   let result = run4("gh", args);
-  if (result.status !== 0 && isMissingLabelError(result.stderr)) {
+  if (result.status !== 0 && isMissingLabelError(result.stderr, name)) {
     const created = run4("gh", ["label", "create", name, "--description", description]);
     if (created.status !== 0 && !/already exists/i.test(created.stderr)) {
       throw new Error(created.stderr.trim() || `Failed to create the label ${name}.`);
@@ -2732,8 +2732,11 @@ var MISSING_LABEL_PATTERNS = [
   /could not resolve to a label/i,
   /\blabels?\b[^\n]*\b(?:not found|does not exist)\b/i
 ];
-function isMissingLabelError(stderr) {
-  return MISSING_LABEL_PATTERNS.some((pattern) => pattern.test(stderr));
+function isMissingLabelError(stderr, name) {
+  if (MISSING_LABEL_PATTERNS.some((pattern) => pattern.test(stderr))) {
+    return true;
+  }
+  return name !== void 0 && stderr.includes(`'${name}' not found`);
 }
 function createDraftPullRequest(input) {
   const base = [
@@ -2752,7 +2755,7 @@ function createDraftPullRequest(input) {
   if (input.label !== void 0 && input.label.length > 0) {
     const labelled = run4("gh", [...base, "--label", input.label]);
     if (labelled.status === 0) return parseCreatedPrUrl(labelled.stdout, input.head);
-    if (!isMissingLabelError(labelled.stderr)) {
+    if (!isMissingLabelError(labelled.stderr, input.label)) {
       throw new Error(
         labelled.stderr.trim() || `Failed to open a draft pull request for ${input.head}.`
       );
@@ -2966,7 +2969,7 @@ function runClaude(prompt, options = {}) {
       if (options.printSteps !== true) return;
       try {
         const event = JSON.parse(line);
-        formatEvent(event, turnCount);
+        formatEvent(event, turnCount, options.echoResult !== false);
         if (event["type"] === "assistant") turnCount++;
       } catch {
       }
@@ -3056,7 +3059,7 @@ function formatContentBlock(block) {
   }
   return null;
 }
-function formatResultEvent(event) {
+function formatResultEvent(event, echoResult) {
   const result = event["result"];
   const cost = event["cost_usd"];
   const duration = event["duration_ms"];
@@ -3070,16 +3073,16 @@ function formatResultEvent(event) {
     process.stderr.write(`  [info] ${parts.join(" | ")}
 `);
   }
-  if (result) {
+  if (result && echoResult) {
     process.stdout.write(result + "\n");
   }
 }
-function formatEvent(event, turnCount) {
+function formatEvent(event, turnCount, echoResult = true) {
   const type = event["type"];
   if (type === "assistant") {
     formatAssistantEvent(event, turnCount);
   } else if (type === "result") {
-    formatResultEvent(event);
+    formatResultEvent(event, echoResult);
   }
 }
 function asText(value, fallback) {
@@ -5432,6 +5435,44 @@ async function scrubExcerpt(execution, excerpt, timeoutMs = SECOND_OPINION_TIMEO
   return result.ok ? interpretScrubOutput(result.stdout, excerpt) : result;
 }
 
+// src/run/claudeAuth.ts
+var CLAUDE_AUTH_PATTERNS = [
+  /Failed to authenticate/i,
+  /OAuth (?:session|token) (?:has )?expired/i,
+  /Invalid API key\s*[·\-:]\s*Please run \/login/i,
+  /Please run \/login/i
+];
+var CLAUDE_AUTH_MARKER = "<!-- automata:claude-auth -->";
+function detectClaudeAuthFailure(text) {
+  return CLAUDE_AUTH_PATTERNS.some((pattern) => pattern.test(text));
+}
+var CLAUDE_AUTH_TAIL_MAX = 8192;
+var ClaudeAuthTail = class {
+  text = "";
+  output(_stream, chunk) {
+    this.text = (this.text + chunk).slice(-CLAUDE_AUTH_TAIL_MAX);
+  }
+  exited() {
+  }
+  get tail() {
+    return this.text;
+  }
+};
+var CLAUDE_AUTH_REASON = "Claude Code is not signed in (its login expired and could not be refreshed)";
+var CLAUDE_AUTH_REMEDY = "Run `claude /login` again on the machine that runs automata (inside the devcontainer, if it runs there), then reply to have another attempt made.";
+function renderClaudeAuthComment(surface, excerpt) {
+  const lines = [
+    `automata do-work: the agent run stopped before it posted an answer on ${surface}. ${CLAUDE_AUTH_REASON}.`,
+    CLAUDE_AUTH_REMEDY,
+    "This comment is posted once. Automata does not post it again while the problem remains."
+  ];
+  if (excerpt.trim() !== "") {
+    lines.push("", "Last lines of the agent's output:", "```text", excerpt.replaceAll("```", "'''"), "```");
+  }
+  return `${lines.join("\n")}
+${CLAUDE_AUTH_MARKER}`;
+}
+
 // src/run/answerRecovery.ts
 import { closeSync, fstatSync, openSync, readSync } from "fs";
 var RECOVERY_TIMEOUT_MS = 3e5;
@@ -6256,6 +6297,14 @@ function describeTickHistory(ticks, cadence, now, logPath, lines, problems) {
       )
     );
   }
+  if (ticks[0].note === "claude-auth") {
+    problems.push(
+      finding(
+        `${CLAUDE_AUTH_REASON}, so the last tick stopped before it answered; ${CLAUDE_AUTH_REMEDY}`,
+        "claude /login"
+      )
+    );
+  }
   const lockHeld = ticks.filter((tick) => tick.note === "lock-held").length;
   const withRuns = ticks.filter((tick) => tick.runs > 0).length;
   lines.push(
@@ -6635,14 +6684,20 @@ function requireParticipants(config) {
     );
   }
   if (!config.issueDiscoveryTechnique) {
-    failSettings("No issue discovery technique configured. Run `automata config set issue-discovery-technique <value>`.");
+    failSettings(
+      "No issue discovery technique configured. Run `automata config set issue-discovery-technique <value>`."
+    );
   }
   if (!config.issueDiscoveryValue) {
-    failSettings("No issue discovery value configured. Run `automata config set issue-discovery-value <value>`.");
+    failSettings(
+      "No issue discovery value configured. Run `automata config set issue-discovery-value <value>`."
+    );
   }
   const allowedUsers = (config.allowedUsers ?? []).filter((user) => user.trim().length > 0);
   if (allowedUsers.length === 0) {
-    failSettings("No allowed users configured. Run `automata config set allowed-users <user1,user2>`.");
+    failSettings(
+      "No allowed users configured. Run `automata config set allowed-users <user1,user2>`."
+    );
   }
   const agentUser = (config.agentUser ?? "").trim();
   if (agentUser.length === 0) {
@@ -6861,8 +6916,20 @@ function validateDoWorkConfig(section2) {
     failSettings(`doWork.executor must be 'claude' or 'codex', got ${JSON.stringify(executor)}.`);
   }
   validateOptionalString(section2, "baseBranch", "doWork.baseBranch");
-  validateOptionalInt(section2, "maxRunsPerTick", "doWork.maxRunsPerTick", 0, "a non-negative integer (0 = unlimited)");
-  validateOptionalInt(section2, "lockStaleMinutes", "doWork.lockStaleMinutes", 1, "a positive integer");
+  validateOptionalInt(
+    section2,
+    "maxRunsPerTick",
+    "doWork.maxRunsPerTick",
+    0,
+    "a non-negative integer (0 = unlimited)"
+  );
+  validateOptionalInt(
+    section2,
+    "lockStaleMinutes",
+    "doWork.lockStaleMinutes",
+    1,
+    "a positive integer"
+  );
   validateOptionalBoolean(section2, "dumpOnBlock", "doWork.dumpOnBlock");
   validateOptionalBoolean(section2, "postRunLog", "doWork.postRunLog");
   validateProtectedBranches(section2["protectedBranches"]);
@@ -6894,7 +6961,9 @@ function validateSettingContainer(value, container, keys) {
   }
   for (const key2 of Object.keys(value)) {
     if (!keys.includes(key2)) {
-      failSettings(`doWork.${container}.${key2} is not a recognised setting; expected one of: ${keys.join(", ")}.`);
+      failSettings(
+        `doWork.${container}.${key2} is not a recognised setting; expected one of: ${keys.join(", ")}.`
+      );
     }
   }
 }
@@ -6906,7 +6975,11 @@ function orphanPassEnabled(settings) {
 }
 function discoverIssues(settings) {
   if (!issuePassEnabled(settings)) return [];
-  const candidates = listCandidateIssues(settings.technique, settings.discoveryValue, settings.limit);
+  const candidates = listCandidateIssues(
+    settings.technique,
+    settings.discoveryValue,
+    settings.limit
+  );
   if (settings.onlyIssue === void 0) {
     if (candidates.length === settings.limit) {
       progress(
@@ -7003,11 +7076,15 @@ function claimIssue(item, settings) {
   if (!item.needsAssignment || item.issue === null) return;
   try {
     assignIssueToAgent(item.issue.number, settings.participants.agentUser);
-    progress(`  assigned issue #${String(item.issue.number)} to ${settings.participants.agentUser}.
-`);
+    progress(
+      `  assigned issue #${String(item.issue.number)} to ${settings.participants.agentUser}.
+`
+    );
   } catch (err) {
-    progress(`  warning: could not assign issue #${String(item.issue.number)}: ${err.message}
-`);
+    progress(
+      `  warning: could not assign issue #${String(item.issue.number)}: ${err.message}
+`
+    );
   }
 }
 function claimPr(prNumber, agentUser) {
@@ -7016,8 +7093,10 @@ function claimPr(prNumber, agentUser) {
     progress(`  assigned pull request #${String(prNumber)} to ${agentUser}.
 `);
   } catch (err) {
-    progress(`  warning: could not assign pull request #${String(prNumber)}: ${err.message}
-`);
+    progress(
+      `  warning: could not assign pull request #${String(prNumber)}: ${err.message}
+`
+    );
   }
 }
 function notePickupOnIssue(item, marker) {
@@ -7030,13 +7109,17 @@ function notePickupOnIssue(item, marker) {
       `automata do-work: picked this up on pull request #${String(item.pr.number)} \u2014 ${item.pr.url}`
     );
   } catch (err) {
-    progress(`  skipped: could not note the pickup on issue #${String(item.issue.number)} \u2014 ${err.message}
-`);
+    progress(
+      `  skipped: could not note the pickup on issue #${String(item.issue.number)} \u2014 ${err.message}
+`
+    );
     try {
       deleteMarker(marker);
     } catch (deleteErr) {
-      progress(`  warning: could not withdraw the working marker: ${deleteErr.message}
-`);
+      progress(
+        `  warning: could not withdraw the working marker: ${deleteErr.message}
+`
+      );
     }
     return false;
   }
@@ -7049,8 +7132,10 @@ function reportIssueMessagesBuriedByNote(item, note, participants) {
     const messages = getIssueSurface(item.issue.number).messages;
     buried = messagesBetween(messages, participants, watermark, note.createdAt);
   } catch (err) {
-    progress(`  warning: could not re-read issue #${String(item.issue.number)}: ${err.message}
-`);
+    progress(
+      `  warning: could not re-read issue #${String(item.issue.number)}: ${err.message}
+`
+    );
     return 0;
   }
   if (buried.length === 0) return 0;
@@ -7062,8 +7147,10 @@ function reportIssueMessagesBuriedByNote(item, note, participants) {
       `automata do-work: ${authors} posted here while this issue was being picked up, so ${buried.length === 1 ? "that message was" : "those messages were"} not included in the run. Please post again to have them acted on.`
     );
   } catch (err) {
-    progress(`  warning: could not report the buried issue message(s): ${err.message}
-`);
+    progress(
+      `  warning: could not report the buried issue message(s): ${err.message}
+`
+    );
   }
   return buried.length;
 }
@@ -7081,7 +7168,9 @@ function refreshOrphanItem(item, linkMap, settings, policy) {
   const number = item.pr?.number ?? 0;
   const stillOrphan = linkMap.orphans.some((candidate) => candidate.pr.number === number);
   if (!stillOrphan) {
-    const linkedTo = issuesClosedBy(linkMap, number).map((issueNumber) => `#${String(issueNumber)}`);
+    const linkedTo = issuesClosedBy(linkMap, number).map(
+      (issueNumber) => `#${String(issueNumber)}`
+    );
     return {
       kind: "skip",
       issue: null,
@@ -7123,7 +7212,8 @@ function reportOvertakenMessages(item, analysis) {
 `);
   }
 }
-async function reconcileMarker(item, marker, participants, watermark, runError, diagnostics, recovery = null) {
+async function reconcileMarker(item, marker, participants, watermark, run5) {
+  const { runError, diagnostics, recovery, claudeAuth } = run5;
   let analysis;
   try {
     analysis = analyseAnswer(readAnsweringSurface(item), participants, marker, watermark);
@@ -7136,7 +7226,8 @@ async function reconcileMarker(item, marker, participants, watermark, runError,
   }
   let recoveryNote = null;
   let recovered = false;
-  if (analysis.answeredAt === null && runError === null && recovery !== null) {
+  const canRecover = runError === null && recovery !== null && claudeAuth === null;
+  if (analysis.answeredAt === null && canRecover) {
     const attempt = await attemptRecovery(item, marker, participants, watermark, recovery);
     if ("analysis" in attempt) {
       analysis = attempt.analysis;
@@ -7146,31 +7237,74 @@ async function reconcileMarker(item, marker, participants, watermark, runError,
     }
   }
   if (analysis.answeredAt !== null) {
-    reportOvertakenMessages(item, analysis);
-    try {
-      deleteMarker(marker);
-    } catch (err) {
-      progress(`  warning: could not delete the marker comment: ${err.message}
-`);
-    }
-    if (analysis.missed.length > 0) {
-      return {
-        outcome: "answered-no-reply",
-        detail: `answered (${String(analysis.toReport.length)} message(s) arrived mid-run and were flagged)`,
-        reason: "flagged"
-      };
-    }
-    if (recovered) {
-      return { outcome: "answered", detail: "answered (recovered from the run transcript)", reason: "answered" };
-    }
-    return runError === null ? { outcome: "answered", detail: "answered", reason: "answered" } : { outcome: "answered", detail: `answered, but the run reported: ${runError.message}`, reason: "answered" };
+    return reportAnswered(item, marker, analysis, runError, recovered);
   }
+  if (claudeAuth !== null) return reportClaudeAuth(item, marker, participants, claudeAuth);
   return reportNoAnswer(item, marker, runError, diagnostics, recoveryNote);
 }
+function reportAnswered(item, marker, analysis, runError, recovered) {
+  reportOvertakenMessages(item, analysis);
+  try {
+    deleteMarker(marker);
+  } catch (err) {
+    progress(`  warning: could not delete the marker comment: ${err.message}
+`);
+  }
+  if (analysis.missed.length > 0) {
+    return {
+      outcome: "answered-no-reply",
+      detail: `answered (${String(analysis.toReport.length)} message(s) arrived mid-run and were flagged)`,
+      reason: "flagged"
+    };
+  }
+  if (recovered) {
+    return {
+      outcome: "answered",
+      detail: "answered (recovered from the run transcript)",
+      reason: "answered"
+    };
+  }
+  return runError === null ? { outcome: "answered", detail: "answered", reason: "answered" } : {
+    outcome: "answered",
+    detail: `answered, but the run reported: ${runError.message}`,
+    reason: "answered"
+  };
+}
+function hasClaudeAuthComment(item, marker, participants) {
+  try {
+    const before = new Date(marker.createdAt).getTime();
+    const agent = participants.agentUser.toLowerCase();
+    const last = readAnsweringSurface(item).findLast(
+      (message) => message.author.toLowerCase() === agent && new Date(message.createdAt).getTime() < before
+    );
+    return last?.body.includes(CLAUDE_AUTH_MARKER) === true;
+  } catch {
+    return false;
+  }
+}
+function reportClaudeAuth(item, marker, participants, excerpt) {
+  const surface = markerSurfaceLabel(item);
+  const result = {
+    outcome: "failed",
+    detail: `${CLAUDE_AUTH_REASON}. ${CLAUDE_AUTH_REMEDY}`,
+    reason: "no-answer",
+    claudeAuth: true
+  };
+  const alreadyTold = hasClaudeAuthComment(item, marker, participants);
+  try {
+    if (alreadyTold) deleteMarker(marker);
+    else updateMarker(marker, renderClaudeAuthComment(surface, excerpt));
+  } catch (err) {
+    warnMarkerNotUpdated(surface, err, "that Claude Code is not signed in");
+  }
+  return result;
+}
 async function attemptRecovery(item, marker, participants, watermark, recovery) {
   const surface = markerSurfaceLabel(item);
-  progress(`  recovery: the run posted no answer on ${surface}; asking the model to write it from the transcript.
-`);
+  progress(
+    `  recovery: the run posted no answer on ${surface}; asking the model to write it from the transcript.
+`
+  );
   const reread = () => analyseAnswer(readAnsweringSurface(item), participants, marker, watermark);
   const fail3 = (reason) => {
     progress(`  recovery: failed \u2014 ${reason}
@@ -7202,12 +7336,15 @@ async function attemptRecovery(item, marker, participants, watermark, recovery)
   }
   try {
     const verified2 = reread();
-    if (verified2.answeredAt === null) return fail3(`the recovered answer is not visible on ${surface} after posting`);
+    if (verified2.answeredAt === null)
+      return fail3(`the recovered answer is not visible on ${surface} after posting`);
     progress(`  recovery: posted the answer recovered from the run transcript on ${surface}.
 `);
     return { analysis: verified2, posted: true };
   } catch (err) {
-    return fail3(`could not re-read ${surface} to verify the recovered answer: ${err.message}`);
+    return fail3(
+      `could not re-read ${surface} to verify the recovered answer: ${err.message}`
+    );
   }
 }
 function reportUnverified(item, marker) {
@@ -7227,6 +7364,13 @@ function reportUnverified(item, marker) {
     reason: "unverified"
   };
 }
+function warnMarkerNotUpdated(surface, err, what) {
+  progress(
+    `  warning: could not update the marker comment on ${surface}: ${err.message}
+  the humans have not been told ${what}.
+`
+  );
+}
 async function reportNoAnswer(item, marker, runError, diagnostics, recoveryNote = null) {
   const surface = markerSurfaceLabel(item);
   const sideEffects = item.turn === "issue-discuss" ? "It may still have created a branch or opened a pull request \u2014 check before assuming otherwise." : `It may still have changed the branch \`${item.branch}\` \u2014 check it before assuming otherwise.`;
@@ -7235,13 +7379,13 @@ async function reportNoAnswer(item, marker, runError, diagnostics, recoveryNote
   try {
     updateMarker(marker, explanation + recovery + (await diagnostics?.() ?? ""));
   } catch (err) {
-    progress(
-      `  warning: could not update the marker comment on ${surface}: ${err.message}
-  the humans have not been told that this run produced no answer.
-`
-    );
+    warnMarkerNotUpdated(surface, err, "that this run produced no answer");
   }
-  return runError === null ? { outcome: "answered-no-reply", detail: "run finished but posted no answer", reason: "no-answer" } : { outcome: "failed", detail: `run failed: ${runError.message}`, reason: "no-answer" };
+  return runError === null ? {
+    outcome: "answered-no-reply",
+    detail: "run finished but posted no answer",
+    reason: "no-answer"
+  } : { outcome: "failed", detail: `run failed: ${runError.message}`, reason: "no-answer" };
 }
 async function invokeExecutor(prompt, execution, silent, sink2) {
   beat({
@@ -7253,7 +7397,12 @@ async function invokeExecutor(prompt, execution, silent, sink2) {
     await runCodex(prompt, { model: execution.model, effort: execution.effort, sink: sink2 });
     return;
   }
-  await runClaude(prompt, { model: execution.model, effort: execution.effort, printSteps: !silent, sink: sink2 });
+  await runClaude(prompt, {
+    model: execution.model,
+    effort: execution.effort,
+    printSteps: !silent,
+    sink: sink2
+  });
 }
 function repairIssueLink(item, baseBranch, agentUser) {
   const issue = item.issue;
@@ -7261,8 +7410,10 @@ function repairIssueLink(item, baseBranch, agentUser) {
   try {
     const branch = getCurrentBranch();
     if (branch === baseBranch) {
-      progress(`  issue #${String(issue.number)} is still in discussion (no branch was created).
-`);
+      progress(
+        `  issue #${String(issue.number)} is still in discussion (no branch was created).
+`
+      );
       return false;
     }
     const pr = getCurrentBranchPr();
@@ -7274,10 +7425,15 @@ function repairIssueLink(item, baseBranch, agentUser) {
     if (pr.assignees.length === 0) {
       claimPr(pr.number, agentUser);
     }
-    const closesRef = new RegExp(String.raw`\bcloses\s+#` + String(issue.number) + String.raw`\b`, "i");
+    const closesRef = new RegExp(
+      String.raw`\bcloses\s+#` + String(issue.number) + String.raw`\b`,
+      "i"
+    );
     if (closesRef.test(pr.body)) {
-      progress(`  pull request #${String(pr.number)} already closes issue #${String(issue.number)}.
-`);
+      progress(
+        `  pull request #${String(pr.number)} already closes issue #${String(issue.number)}.
+`
+      );
       return true;
     }
     addClosesRefToPr(pr.number, issue.number);
@@ -7285,8 +7441,10 @@ function repairIssueLink(item, baseBranch, agentUser) {
 `);
     return true;
   } catch (err) {
-    progress(`  warning: could not link a pull request to issue #${String(issue.number)}: ${err.message}
-`);
+    progress(
+      `  warning: could not link a pull request to issue #${String(issue.number)}: ${err.message}
+`
+    );
     return false;
   }
 }
@@ -7375,8 +7533,10 @@ ${itemLabel(planned)} ${planned.turn}: ${planned.reason}
   }
   let buriedByNote = 0;
   if (note !== null) {
-    progress(`  noted on issue #${String(item.issue?.number ?? 0)} that the work is on pull request #${String(item.pr?.number ?? 0)}.
-`);
+    progress(
+      `  noted on issue #${String(item.issue?.number ?? 0)} that the work is on pull request #${String(item.pr?.number ?? 0)}.
+`
+    );
     buriedByNote = reportIssueMessagesBuriedByNote(item, note, settings.participants);
   }
   const watermark = promptWatermark([
@@ -7411,43 +7571,64 @@ ${itemLabel(planned)} ${planned.turn}: ${planned.reason}
     );
   }
   const execution = toExecution(resolved);
-  const { runError, diagnostics, recovery } = await runRecorded(item, prompt, execution, settings, silent);
+  const { runError, diagnostics, recovery, claudeAuth } = await runRecorded(
+    item,
+    prompt,
+    execution,
+    settings,
+    silent
+  );
   const ranExecutor = true;
   let reconciled;
   try {
-    reconciled = await reconcileMarker(
-      item,
-      marker,
-      settings.participants,
-      watermark,
+    reconciled = await reconcileMarker(item, marker, settings.participants, watermark, {
       runError,
       diagnostics,
-      recovery
-    );
+      recovery,
+      claudeAuth
+    });
   } finally {
     inFlightMarker = null;
   }
   progress(`  ${reconciled.detail}
 `);
   const outcome = adjustOutcome(reconciled, item, settings, buriedByNote);
-  return { ...base, outcome: outcome.outcome, detail: outcome.detail, ranExecutor, execution };
+  return {
+    ...base,
+    outcome: outcome.outcome,
+    detail: outcome.detail,
+    ranExecutor,
+    execution,
+    claudeAuth: outcome.claudeAuth
+  };
 }
 async function runRecorded(item, prompt, execution, settings, silent) {
   const transcript = settings.postRunLog ? new RunTranscript(transcriptLabel(item)) : null;
   const before = transcript === null ? null : snapshotCheckout();
+  const authTail = transcript === null && execution.executor === "claude" ? new ClaudeAuthTail() : null;
   let runError = null;
   try {
-    await invokeExecutor(prompt, execution, silent, transcript ?? void 0);
+    await invokeExecutor(prompt, execution, silent, transcript ?? authTail ?? void 0);
   } catch (err) {
     runError = err;
   }
-  if (transcript === null) return { runError, diagnostics: null, recovery: null };
+  if (transcript === null) {
+    const claudeAuth2 = runError !== null && authTail !== null && detectClaudeAuthFailure(authTail.tail) ? "" : null;
+    return { runError, diagnostics: null, recovery: null, claudeAuth: claudeAuth2 };
+  }
+  const tail = transcript.excerpt();
+  const claudeAuth = runError !== null && execution.executor === "claude" && detectClaudeAuthFailure(tail) ? tail : null;
   return {
     runError,
+    claudeAuth,
     recovery: async () => {
       const text = (transcript.saved ? readTranscriptTail(transcript.path) : null) ?? transcript.excerpt();
       if (text.trim() === "") return { ok: false, reason: "the run transcript is empty" };
-      return recoverAnswer(execution, { subject: markerSurfaceLabel(item), transcript: text, conversation: prompt });
+      return recoverAnswer(execution, {
+        subject: markerSurfaceLabel(item),
+        transcript: text,
+        conversation: prompt
+      });
     },
     diagnostics: async () => {
       const excerpt = transcript.excerpt();
@@ -7527,8 +7708,10 @@ function summarize(reports) {
   }
   for (const report of reports) {
     const ran = report.execution === void 0 ? "" : ` \xB7 ${describeExecution(report.execution)}`;
-    out(`  ${reportLabel(report)} ${report.turn ?? "-"} ${report.outcome} \u2014 ${report.detail}${ran}
-`);
+    out(
+      `  ${reportLabel(report)} ${report.turn ?? "-"} ${report.outcome} \u2014 ${report.detail}${ran}
+`
+    );
   }
 }
 function toItemJson(report) {
@@ -7550,7 +7733,13 @@ function toItemJson(report) {
 }
 var doWorkCommand = new Command6("do-work").description(
   "Run one tick of the autonomous loop: answer the issues whose newest authorized message the agent has not answered, then the open pull requests that close no issue of this repository and have one"
-).option("--with <executor>", "Executor to use: claude or codex (default: from config, else claude)").option("--model <string>", "Model identifier to pass to the executor, overriding the configured default for it").option(
+).option(
+  "--with <executor>",
+  "Executor to use: claude or codex (default: from config, else claude)"
+).option(
+  "--model <string>",
+  "Model identifier to pass to the executor, overriding the configured default for it"
+).option(
   "--effort <level>",
   "Reasoning effort to pass to the executor, overriding the configured default for it"
 ).option("--issue <number>", "Restrict the tick to a single issue").option(
@@ -7616,7 +7805,12 @@ async function runDoWorkTraced(options) {
     return exitCode2;
   }
   const { exitCode, reports } = await runTickUnderLock(lock.handle, settings, options);
-  logTick(reports, exitCode, startedAt);
+  logTick(
+    reports,
+    exitCode,
+    startedAt,
+    reports.some((report) => report.claudeAuth === true) ? "claude-auth" : void 0
+  );
   return exitCode;
 }
 async function runTickUnderLock(handle, settings, options) {
@@ -7682,6 +7876,20 @@ function buildSelectionEvidence(settings, issues, linkMap, decisions, verbose) {
     })) : null
   };
 }
+function decideAll(settings, issues, linkMap, policy) {
+  return skipDuplicateHeadBranches([
+    ...issues.map(
+      (issue) => decideWork(buildIssueState(issue, linkMap), settings.participants, policy)
+    ),
+    ...discoverOrphanPrs(settings, linkMap).map(
+      (candidate) => decideOrphanPrWork(
+        { prSurface: getPrSurface(candidate.pr.number) },
+        settings.participants,
+        policy
+      )
+    )
+  ]);
+}
 function collectSelection(settings, verbose) {
   const issues = discoverIssues(settings);
   const linkMap = getOpenPrLinkMap();
@@ -7690,12 +7898,7 @@ function collectSelection(settings, verbose) {
     defaultBranch: linkMap.defaultBranch,
     protectedBranches: settings.protectedBranches
   };
-  const decisions = skipDuplicateHeadBranches([
-    ...issues.map((issue) => decideWork(buildIssueState(issue, linkMap), settings.participants, policy)),
-    ...discoverOrphanPrs(settings, linkMap).map(
-      (candidate) => decideOrphanPrWork({ prSurface: getPrSurface(candidate.pr.number) }, settings.participants, policy)
-    )
-  ]);
+  const decisions = decideAll(settings, issues, linkMap, policy);
   return buildSelectionEvidence(settings, issues, linkMap, decisions, verbose);
 }
 function makeSelectionSection(lines, problems, data) {
@@ -7727,7 +7930,12 @@ function describeIssueEvidence(settings, evidence) {
     `discovery query: ${settings.technique} = ${settings.discoveryValue}, limit ${String(settings.limit)}${restriction}`
   ];
   if (evidence.issues === null) return lines;
-  lines.push(heading(`discovery returned ${String(evidence.issues.length)} issue(s)`, evidence.issues.length));
+  lines.push(
+    heading(
+      `discovery returned ${String(evidence.issues.length)} issue(s)`,
+      evidence.issues.length
+    )
+  );
   for (const issue of evidence.issues) {
     lines.push(`    #${String(issue.number)} ${issue.title}`);
   }
@@ -7809,11 +8017,11 @@ function selectionData(evidence) {
 }
 function selectionSectionFromEvidence(settings, evidence, verbose) {
   if (evidence === null) {
-    return makeSelectionSection(
-      ["not run: the tick was blocked before discovery"],
-      [],
-      { ran: false, detail: "blocked before discovery", plan: [] }
-    );
+    return makeSelectionSection(["not run: the tick was blocked before discovery"], [], {
+      ran: false,
+      detail: "blocked before discovery",
+      plan: []
+    });
   }
   const lines = [];
   if (verbose && settings !== null) describeSelectionEvidence(settings, evidence, lines);
@@ -8048,6 +8256,9 @@ function dumpBlocked(options, context) {
   }
 }
 function classifyBlocked(hygiene, decisions, items, reports) {
+  if (reports.some((report) => report.claudeAuth === true)) {
+    return { reason: "claude-auth", trigger: `${CLAUDE_AUTH_REASON}; run \`claude /login\` again` };
+  }
   const ran = reports.some((report) => report.ranExecutor === true);
   if (ran) return null;
   if (hygiene.degraded) {
@@ -8165,12 +8376,7 @@ async function runTick(settings, options) {
     defaultBranch: linkMap.defaultBranch,
     protectedBranches: settings.protectedBranches
   };
-  const decisions = skipDuplicateHeadBranches([
-    ...issues.map((issue) => decideWork(buildIssueState(issue, linkMap), settings.participants, policy)),
-    ...discoverOrphanPrs(settings, linkMap).map(
-      (candidate) => decideOrphanPrWork({ prSurface: getPrSurface(candidate.pr.number) }, settings.participants, policy)
-    )
-  ]);
+  const decisions = decideAll(settings, issues, linkMap, policy);
   const items = decisions.flatMap((decision) => decision.kind === "work" ? [decision.item] : []);
   const planText = `Work plan (${String(items.length)} of ${String(decisions.length)} candidates need an answer):
 ${describePlan(decisions)}`;
@@ -8219,9 +8425,23 @@ async function processItems(items, settings, options, hygiene) {
     const report = await reportForItem(item, settings, options, preflightCauses);
     if (report.ranExecutor === true) runsUsed++;
     reports.push(report);
+    if (report.claudeAuth === true) {
+      reports.push(...items.slice(index + 1).map((rest) => skipForClaudeAuth(rest)));
+      break;
+    }
   }
   return { reports, deferred };
 }
+function skipForClaudeAuth(item) {
+  return {
+    issue: item.issue?.number ?? null,
+    pr: item.pr?.number ?? null,
+    title: itemTitle(item),
+    turn: item.turn,
+    outcome: "skipped",
+    detail: `${CLAUDE_AUTH_REASON}; run \`claude /login\` again`
+  };
+}
 async function reportForItem(item, settings, options, preflightCauses) {
   try {
     return await processItem(item, settings, options.silent === true, preflightCauses);
@@ -8892,6 +9112,48 @@ function withoutWatched(list, id) {
   return list.filter((entry) => entry !== id);
 }
 
+// src/conductor/permissionDenials.ts
+var MAX_TARGET_LENGTH = 300;
+function targetOf(input) {
+  if (typeof input !== "object" || input === null) return "";
+  const record = input;
+  for (const key2 of ["command", "file_path", "path", "pattern"]) {
+    const value = record[key2];
+    if (typeof value === "string") return value;
+  }
+  return JSON.stringify(input);
+}
+function denialOf(entry) {
+  if (typeof entry !== "object" || entry === null) return null;
+  const record = entry;
+  const tool = record["tool_name"];
+  if (typeof tool !== "string") return null;
+  return { tool, target: targetOf(record["tool_input"]) };
+}
+function parsePermissionDenials(stdout) {
+  const denials = [];
+  for (const line of stdout.split("\n")) {
+    if (!line.trim().startsWith("{")) continue;
+    try {
+      const event = JSON.parse(line);
+      const listed = event["type"] === "result" ? event["permission_denials"] : void 0;
+      if (!Array.isArray(listed)) continue;
+      for (const entry of listed) {
+        const denial = denialOf(entry);
+        if (denial !== null) denials.push(denial);
+      }
+    } catch {
+    }
+  }
+  return denials;
+}
+function describePermissionDenials(denials) {
+  return denials.map((denial) => {
+    const flat = `${denial.tool} ${denial.target}`.replace(/[\u0000-\u001f\u007f-\u009f]+/g, " ").replace(/\s+/g, " ").trim();
+    return flat.length <= MAX_TARGET_LENGTH ? flat : `${flat.slice(0, MAX_TARGET_LENGTH)}\u2026`;
+  });
+}
+
 // src/commands/conductor.ts
 function fail2(message) {
   process.stderr.write(`Error: ${message}
@@ -8956,7 +9218,29 @@ function readTargetMessages(target) {
 }
 function runModel(prompt, execution, replyTo, sink2) {
   const { owner, repo } = getRepoSlug();
-  return runClaude(prompt, { model: execution.model, effort: execution.effort, readOnly: true, replyTo, ghRepo: `${owner}/${repo}`, sink: sink2 });
+  return runClaude(prompt, { model: execution.model, effort: execution.effort, readOnly: true, replyTo, ghRepo: `${owner}/${repo}`, sink: sink2, printSteps: verboseRun, echoResult: false });
+}
+var verboseRun = false;
+function reportDenials(stdout, label2) {
+  if (!verboseRun || stdout.length === 0) return;
+  const lines = describePermissionDenials(parsePermissionDenials(stdout));
+  if (lines.length === 0) {
+    process.stderr.write(`Conductor: the run for ${label2} reported no denied tool call.
+`);
+    return;
+  }
+  process.stderr.write(`Conductor: the run for ${label2} was denied ${String(lines.length)} tool call(s):
+`);
+  for (const line of lines) process.stderr.write(`  - ${line}
+`);
+}
+function reportCommandTrace() {
+  const trace = takeCommandTrace();
+  if (trace === null) return;
+  process.stderr.write(`Commands (${String(trace.length)})
+`);
+  for (const traced of trace) process.stderr.write(`  ${describeTracedCommand(traced)}
+`);
 }
 function captureStdout() {
   let stdout = "";
@@ -8971,8 +9255,12 @@ function captureStdout() {
 async function runModelForText(prompt, execution) {
   const { owner, repo } = getRepoSlug();
   const captured = captureStdout();
-  const options = { model: execution.model, effort: execution.effort, readOnly: true, ghRepo: `${owner}/${repo}`, sink: captured.sink };
-  await runClaude(prompt, options);
+  const options = { model: execution.model, effort: execution.effort, readOnly: true, ghRepo: `${owner}/${repo}`, sink: captured.sink, printSteps: verboseRun, echoResult: false };
+  try {
+    await runClaude(prompt, options);
+  } finally {
+    reportDenials(captured.text(), "the dry run");
+  }
   return extractDryRunReply(execution.executor, captured.text());
 }
 function coveredOf(watch, linkMap) {
@@ -9052,6 +9340,7 @@ async function conductItem(id, config, login2, participants, execution, dryRun,
     read: () => readTargetMessages(replyTo),
     run: () => runModel(prompt, execution, replyTo, captured.sink)
   });
+  reportDenials(captured.text(), label2);
   const needsHuman = parseNeedsHuman(extractDryRunReply(execution.executor, captured.text()) ?? "");
   if (needsHuman !== null && outcome.kind !== "run-failed" && outcome.kind !== "unverified") {
     return blockItem(item, label2, needsHuman);
@@ -9300,6 +9589,17 @@ function reportHeldLock(held, suspect, staleMinutes) {
   return 2;
 }
 async function runConductor(options = {}) {
+  verboseRun = options.verbose === true;
+  if (verboseRun) startCommandTrace();
+  try {
+    return await runConductorTick(options);
+  } finally {
+    reportCommandTrace();
+    verboseRun = false;
+    stopCommandTrace();
+  }
+}
+async function runConductorTick(options) {
   if (options.check === true && options.dryRun === true) {
     return fail2("--check and --dry-run cannot be used together.");
   }
@@ -9340,7 +9640,10 @@ async function runConductor(options = {}) {
 }
 var conductorCommand = new Command7("conductor").description(
   "Run one conductor tick as an allowed (human) account: verify the identity, take the conductor's own run lock, then act"
-).option("--check", "Report what a tick would do, including pending prunes, and change nothing; exit 1 on a problem").option("--dry-run", "Run the model for each owed reply and print it instead of posting; no lock, no prune").action(async (options) => {
+).option("--check", "Report what a tick would do, including pending prunes, and change nothing; exit 1 on a problem").option("--dry-run", "Run the model for each owed reply and print it instead of posting; no lock, no prune").option(
+  "--verbose",
+  "Trace every `git` and `gh` call with its duration and exit code, show the model's steps, and list the tool calls the run was denied"
+).action(async (options) => {
   exitWith(await runConductor(options));
 });
 conductorCommand.command("add <id>").description("Watch an issue or pull request and make do-work pick it up (an issue also follows its linked PR)").action((id) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "automata-cli",
-  "version": "0.12.0-develop.533",
+  "version": "0.12.0-develop.562",
   "description": "Automata CLI tool",
   "type": "module",
   "engines": {