automata-cli 0.5.0-develop.176 → 0.5.0-develop.220

package/dist/index.js

@@ -1,15 +1,19 @@
 #!/usr/bin/env node
 import {
+  DEFAULT_CHECK_ISSUE_PROMPT,
   DEFAULT_CLAUDE_SYSTEM_PROMPT,
+  DEFAULT_DO_WORK,
+  DEFAULT_DO_WORK_ISSUE_DISCUSS_PROMPT,
+  DEFAULT_DO_WORK_PR_WORK_PROMPT,
   DEFAULT_FIX_COMMENTS_PROMPT,
   DEFAULT_SONAR_PROMPT,
   readConfig,
   readRawConfig,
   writeConfig
-} from "./chunk-LAIP3B6F.js";
+} from "./chunk-LTCVLM4I.js";
 
 // src/index.ts
-import { Command as Command6 } from "commander";
+import { Command as Command7 } from "commander";
 
 // src/version.ts
 import { readFileSync } from "fs";
@@ -23,6 +27,22 @@ var version = packageJson.version;
 import { Command } from "commander";
 var VALID_TYPES = ["gh", "azdo"];
 var VALID_TECHNIQUES = ["label", "assignee", "title-contains"];
+var VALID_EXECUTORS = ["claude", "codex"];
+var VALID_TURN_KINDS = ["issue-discuss", "pr-work"];
+function writeDoWork(patch) {
+  const current = readRawConfig();
+  writeConfig({ ...current, doWork: { ...current.doWork, ...patch } });
+}
+function parseNonNegativeInt(value, label) {
+  const trimmed = value.trim();
+  const parsed = Number.parseInt(trimmed, 10);
+  if (Number.isNaN(parsed) || parsed < 0 || String(parsed) !== trimmed || !Number.isSafeInteger(parsed)) {
+    process.stderr.write(`Error: ${label} must be a non-negative integer (got "${value}").
+`);
+    process.exit(1);
+  }
+  return parsed;
+}
 var configSetType = new Command("type").description("Set the remote environment type").argument("<value>", "Remote type: gh (GitHub) or azdo (Azure DevOps)").action((value) => {
   if (!VALID_TYPES.includes(value)) {
     process.stderr.write(`Error: invalid type "${value}". Must be one of: ${VALID_TYPES.join(", ")}
@@ -57,12 +77,124 @@ var configSetClaudeSystemPrompt = new Command("claude-system-prompt").descriptio
   process.stdout.write(`Claude system prompt set.
 `);
 });
-var configSet = new Command("set").description("Set a configuration value").addCommand(configSetType).addCommand(configSetIssueDiscoveryTechnique).addCommand(configSetIssueDiscoveryValue).addCommand(configSetClaudeSystemPrompt);
+var configSetAllowedUsers = new Command("allowed-users").description("Set the comma-separated list of users allowed to instruct the agent on an issue").argument("<value>", "Comma-separated GitHub logins, e.g. alice,bob").action((value) => {
+  const users = value.split(",").map((user) => user.trim()).filter((user) => user.length > 0);
+  if (users.length === 0) {
+    process.stderr.write("Error: allowed-users requires at least one login.\n");
+    process.exit(1);
+  }
+  const current = readRawConfig();
+  writeConfig({ ...current, allowedUsers: users });
+  process.stdout.write(`Allowed users set to: ${users.join(", ")}
+`);
+});
+var configSetAgentUser = new Command("agent-user").description("Set the login the agent itself posts as").argument("<value>", "GitHub login used by the agent").action((value) => {
+  const user = value.trim();
+  if (user.length === 0) {
+    process.stderr.write("Error: agent-user requires a non-empty login.\n");
+    process.exit(1);
+  }
+  const current = readRawConfig();
+  writeConfig({ ...current, agentUser: user });
+  process.stdout.write(`Agent user set to: ${user}
+`);
+});
+var configSetDoWorkBaseBranch = new Command("do-work-base-branch").description("Set the branch `do-work` returns to for discussion turns").argument("<value>", `Branch name (default: ${DEFAULT_DO_WORK.baseBranch})`).action((value) => {
+  const branch = value.trim();
+  if (branch.length === 0) {
+    process.stderr.write("Error: do-work-base-branch requires a non-empty branch name.\n");
+    process.exit(1);
+  }
+  writeDoWork({ baseBranch: branch });
+  process.stdout.write(`do-work base branch set to: ${branch}
+`);
+});
+var configSetDoWorkProtectedBranches = new Command("do-work-protected-branches").description("Set the branches a `do-work` build turn must never check out and push to").argument("<value>", `Comma-separated branch names (default: ${DEFAULT_DO_WORK.protectedBranches.join(",")})`).action((value) => {
+  const branches = value.split(",").map((branch) => branch.trim()).filter((branch) => branch.length > 0);
+  if (branches.length === 0) {
+    process.stderr.write("Error: do-work-protected-branches requires at least one branch name.\n");
+    process.exit(1);
+  }
+  writeDoWork({ protectedBranches: branches });
+  process.stdout.write(`do-work protected branches set to: ${branches.join(", ")}
+`);
+});
+var configSetDoWorkExecutor = new Command("do-work-executor").description("Set the default executor `do-work` invokes").argument("<value>", `Executor: ${VALID_EXECUTORS.join(", ")}`).action((value) => {
+  if (!VALID_EXECUTORS.includes(value)) {
+    process.stderr.write(`Error: invalid executor "${value}". Must be one of: ${VALID_EXECUTORS.join(", ")}
+`);
+    process.exit(1);
+  }
+  writeDoWork({ executor: value });
+  process.stdout.write(`do-work executor set to: ${value}
+`);
+});
+var configSetDoWorkModel = new Command("do-work-model").description("Set the default model `do-work` passes to one executor").argument("<executor>", `Executor: ${VALID_EXECUTORS.join(", ")}`).argument("<value>", "Model identifier").action((executor, value) => {
+  if (!VALID_EXECUTORS.includes(executor)) {
+    process.stderr.write(
+      `Error: invalid executor "${executor}". Must be one of: ${VALID_EXECUTORS.join(", ")}
+`
+    );
+    process.exit(1);
+  }
+  const model = value.trim();
+  if (model.length === 0) {
+    process.stderr.write("Error: do-work-model requires a non-empty model identifier.\n");
+    process.exit(1);
+  }
+  const current = readRawConfig();
+  writeDoWork({ models: { ...current.doWork?.models, [executor]: model } });
+  process.stdout.write(`do-work ${executor} model set to: ${model}
+`);
+});
+var configSetDoWorkMaxRuns = new Command("do-work-max-runs").description("Set the maximum number of model runs `do-work` performs per tick (0 = unlimited)").argument("<value>", "Non-negative integer").action((value) => {
+  const maxRunsPerTick = parseNonNegativeInt(value, "do-work-max-runs");
+  writeDoWork({ maxRunsPerTick });
+  process.stdout.write(
+    `do-work max runs per tick set to: ${String(maxRunsPerTick)}${maxRunsPerTick === 0 ? " (unlimited)" : ""}
+`
+  );
+});
+var configSetDoWorkLockStaleMinutes = new Command("do-work-lock-stale-minutes").description("Set how long a run lock may be held before it is treated as stale").argument("<value>", `Positive integer (default: ${String(DEFAULT_DO_WORK.lockStaleMinutes)})`).action((value) => {
+  const minutes = parseNonNegativeInt(value, "do-work-lock-stale-minutes");
+  if (minutes === 0) {
+    process.stderr.write("Error: do-work-lock-stale-minutes must be greater than zero.\n");
+    process.exit(1);
+  }
+  writeDoWork({ lockStaleMinutes: minutes });
+  process.stdout.write(`do-work lock staleness set to: ${String(minutes)} minutes
+`);
+});
+var configSetDoWorkPrompt = new Command("do-work-prompt").description("Set the turn instructions for a `do-work` turn kind (prompt text or a .md filename)").argument("<turn-kind>", `Turn kind: ${VALID_TURN_KINDS.join(", ")}`).argument("<value>", "Prompt text, or a plain .md filename inside .automata/").action((turnKind, value) => {
+  if (!VALID_TURN_KINDS.includes(turnKind)) {
+    process.stderr.write(
+      `Error: invalid turn kind "${turnKind}". Must be one of: ${VALID_TURN_KINDS.join(", ")}
+`
+    );
+    process.exit(1);
+  }
+  const prompt = value.trim();
+  if (prompt.length === 0) {
+    process.stderr.write("Error: do-work-prompt requires a non-empty value.\n");
+    process.exit(1);
+  }
+  const current = readRawConfig();
+  const prompts = { ...current.doWork?.prompts };
+  if (turnKind === "issue-discuss") {
+    prompts.issueDiscuss = prompt;
+  } else {
+    prompts.prWork = prompt;
+  }
+  writeDoWork({ prompts });
+  process.stdout.write(`do-work ${turnKind} prompt set.
+`);
+});
+var configSet = new Command("set").description("Set a configuration value").addCommand(configSetType).addCommand(configSetIssueDiscoveryTechnique).addCommand(configSetIssueDiscoveryValue).addCommand(configSetClaudeSystemPrompt).addCommand(configSetAllowedUsers).addCommand(configSetAgentUser).addCommand(configSetDoWorkBaseBranch).addCommand(configSetDoWorkProtectedBranches).addCommand(configSetDoWorkExecutor).addCommand(configSetDoWorkModel).addCommand(configSetDoWorkMaxRuns).addCommand(configSetDoWorkLockStaleMinutes).addCommand(configSetDoWorkPrompt);
 var configCommand = new Command("config").description("Configure automata settings").addCommand(configSet).action(async () => {
   const [{ render }, React, { ConfigWizard }] = await Promise.all([
     import("ink"),
     import("react"),
-    import("./ConfigWizard-WUGEM3PT.js")
+    import("./ConfigWizard-5B5AOGUU.js")
   ]);
   const { waitUntilExit } = render(React.createElement(ConfigWizard));
   await waitUntilExit();
@@ -195,8 +327,8 @@ function resolveSonarPullRequestUrl(url, prNumber) {
 }
 function isSonarUrl(url) {
   try {
-    const hostname = new URL(url).hostname;
-    return hostname === "sonarcloud.io" || hostname.endsWith(".sonarcloud.io");
+    const hostname2 = new URL(url).hostname;
+    return hostname2 === "sonarcloud.io" || hostname2.endsWith(".sonarcloud.io");
   } catch {
     return false;
   }
@@ -572,8 +704,12 @@ function isUpstreamGone(branch) {
   const { status } = run2("git", ["ls-remote", "--exit-code", "--heads", "origin", branch]);
   return status !== 0;
 }
-function hasUncommittedChanges() {
-  const { stdout } = run2("git", ["status", "--porcelain"]);
+function hasUncommittedChanges(excludePaths = []) {
+  const args = ["status", "--porcelain"];
+  if (excludePaths.length > 0) {
+    args.push("--", ".", ...excludePaths.map((path) => `:(exclude)${path}`));
+  }
+  const { stdout } = run2("git", args);
   return stdout.trim().length > 0;
 }
 function checkoutAndPull(targetBranch) {
@@ -586,6 +722,22 @@ function checkoutAndPull(targetBranch) {
     throw new Error(`Failed to pull ${targetBranch}: ${pull.stderr.trim()}`);
   }
 }
+function gitCommand(args) {
+  const { stderr, status } = run2("git", args);
+  return { ok: status === 0, stderr: stderr.trim() };
+}
+function checkoutBranch(branch) {
+  return gitCommand(["checkout", branch]);
+}
+function createTrackingBranch(branch) {
+  return gitCommand(["checkout", "-b", branch, `origin/${branch}`]);
+}
+function fetchBranch(branch) {
+  return gitCommand(["fetch", "origin", `+refs/heads/${branch}:refs/remotes/origin/${branch}`]);
+}
+function pullFastForwardOnly(branch) {
+  return gitCommand(branch === void 0 ? ["pull", "--ff-only"] : ["pull", "--ff-only", "origin", branch]);
+}
 function fetchPrune() {
   const result = run2("git", ["fetch", "--prune"]);
   if (result.status !== 0) {
@@ -772,8 +924,8 @@ function sleep(ms) {
 }
 function isSonarCheck(check) {
   try {
-    const hostname = new URL(check.detailsUrl).hostname;
-    return hostname === "sonarcloud.io" || hostname.endsWith(".sonarcloud.io");
+    const hostname2 = new URL(check.detailsUrl).hostname;
+    return hostname2 === "sonarcloud.io" || hostname2.endsWith(".sonarcloud.io");
   } catch {
     return false;
   }
@@ -1184,7 +1336,7 @@ minor segment is incremented (e.g. 1.2.0 \u2192 1.3.0).`
 `);
   }
 });
-var gitCommand = new Command2("git").description("Git workflow commands (some require gh CLI)").addCommand(getPrInfoCmd).addCommand(getPrCommentsCmd).addCommand(finishFeatureCmd).addCommand(publishReleaseCmd);
+var gitCommand2 = new Command2("git").description("Git workflow commands (some require gh CLI)").addCommand(getPrInfoCmd).addCommand(getPrCommentsCmd).addCommand(finishFeatureCmd).addCommand(publishReleaseCmd);
 
 // src/commands/getReady.ts
 import { createInterface as createInterface2 } from "readline";
@@ -1237,6 +1389,34 @@ function listIssues(technique, value, limit = 10) {
   }
   return JSON.parse(stdout);
 }
+function getIssueConversation(issueNumber) {
+  const { stdout, stderr, status } = run3("gh", [
+    "issue",
+    "view",
+    String(issueNumber),
+    "--json",
+    "number,title,body,url,author,createdAt,comments"
+  ]);
+  if (status !== 0) {
+    throw new Error(stderr.trim() || `Failed to read issue #${issueNumber}. Is \`gh\` installed and authenticated?`);
+  }
+  const raw = JSON.parse(stdout);
+  const comments = (raw.comments ?? []).map((comment) => ({
+    id: comment.id,
+    author: comment.author?.login ?? "",
+    body: comment.body,
+    createdAt: comment.createdAt
+  })).sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+  return {
+    number: raw.number,
+    title: raw.title,
+    body: raw.body,
+    url: raw.url,
+    author: raw.author?.login ?? "",
+    createdAt: raw.createdAt,
+    comments
+  };
+}
 function postComment(issueNumber, body) {
   const { stderr, status } = run3("gh", ["issue", "comment", String(issueNumber), "--body", body]);
   if (status !== 0) {
@@ -1318,6 +1498,12 @@ import { existsSync } from "fs";
 import { delimiter, join } from "path";
 
 // src/cli/spawnUtils.ts
+var SHELL_SAFE = /^[A-Za-z0-9_@%+=:,./-]+$/;
+var ESCAPED_QUOTE = String.raw`'\''`;
+function shellQuote(arg) {
+  if (SHELL_SAFE.test(arg)) return arg;
+  return "'" + arg.replaceAll("'", ESCAPED_QUOTE) + "'";
+}
 function truncate(str, max) {
   return str.length > max ? str.slice(0, max) + "..." : str;
 }
@@ -1346,6 +1532,48 @@ function handleExitCode(status, toolName) {
   }
 }
 
+// src/cli/childRegistry.ts
+var active = /* @__PURE__ */ new Set();
+function trackChild(child) {
+  active.add(child);
+}
+function untrackChild(child) {
+  active.delete(child);
+}
+function waitForExit(child) {
+  return new Promise((resolve2) => {
+    if (child.exitCode !== null || child.signalCode !== null) {
+      resolve2();
+      return;
+    }
+    child.once("exit", () => resolve2());
+  });
+}
+function afterDelay(ms) {
+  return new Promise((resolve2) => {
+    const timer = setTimeout(() => resolve2("timeout"), ms);
+    timer.unref();
+  });
+}
+async function terminateTrackedChildren(timeoutMs = 1e4, killGraceMs = 5e3) {
+  const children = [...active];
+  if (children.length === 0) return true;
+  const exits = children.map((child) => waitForExit(child));
+  for (const child of children) {
+    if (child.exitCode === null && child.signalCode === null) child.kill("SIGTERM");
+  }
+  const settled = await Promise.race([Promise.all(exits).then(() => "exited"), afterDelay(timeoutMs)]);
+  if (settled === "exited") return true;
+  for (const child of children) {
+    if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+  }
+  const escalated = await Promise.race([
+    Promise.all(exits).then(() => "exited"),
+    afterDelay(killGraceMs)
+  ]);
+  return escalated === "exited";
+}
+
 // src/claude/claudeService.ts
 function resolveCommand(name) {
   const pathDirs = (process.env["PATH"] ?? "").split(delimiter);
@@ -1355,6 +1583,52 @@ function resolveCommand(name) {
   }
   return name;
 }
+function buildClaudeArgs(prompt, options = {}) {
+  const args = [];
+  if (options.yolo) args.push("--dangerously-skip-permissions");
+  if (options.model) args.push("--model", options.model);
+  if (options.verbose) args.push("--verbose", "--output-format", "stream-json");
+  args.push("-p", prompt);
+  return args;
+}
+function runClaude(prompt, options = {}) {
+  return new Promise((resolve2, reject) => {
+    const claudeBin = resolveCommand("claude");
+    const args = buildClaudeArgs(prompt, { yolo: true, model: options.model, verbose: true });
+    const child = spawn(claudeBin, args, { stdio: ["inherit", "pipe", "inherit"] });
+    trackChild(child);
+    const rl = createInterface({ input: child.stdout });
+    let turnCount = 0;
+    rl.on("line", (line) => {
+      if (options.printSteps !== true) return;
+      try {
+        const event = JSON.parse(line);
+        formatEvent(event, turnCount);
+        if (event["type"] === "assistant") turnCount++;
+      } catch {
+      }
+    });
+    child.on("error", (err) => {
+      untrackChild(child);
+      const nodeErr = err;
+      reject(
+        nodeErr.code === "ENOENT" ? new Error("`claude` CLI is not installed or not on PATH.") : new Error(nodeErr.message)
+      );
+    });
+    child.on("close", (code, signal) => {
+      untrackChild(child);
+      if (code === 0) {
+        resolve2();
+        return;
+      }
+      reject(
+        new Error(
+          signal === null ? `Claude Code exited with code ${String(code)}.` : `Claude Code terminated on ${signal}.`
+        )
+      );
+    });
+  });
+}
 function invokeClaudeCode(prompt, options = {}) {
   if (options.verbose) {
     return invokeClaudeCodeVerbose(prompt, options.yolo ?? false, options.model);
@@ -1363,10 +1637,7 @@ function invokeClaudeCode(prompt, options = {}) {
 }
 function invokeClaudeCodeSync(prompt, yolo, model) {
   const claudeBin = resolveCommand("claude");
-  const args = [];
-  if (yolo) args.push("--dangerously-skip-permissions");
-  if (model) args.push("--model", model);
-  args.push("-p", prompt);
+  const args = buildClaudeArgs(prompt, { yolo, model, verbose: false });
   const result = spawnSync4(claudeBin, args, { encoding: "utf8", stdio: "inherit" });
   handleSpawnError(result.error, "claude");
   handleExitCode(result.status, "Claude Code");
@@ -1374,10 +1645,7 @@ function invokeClaudeCodeSync(prompt, yolo, model) {
 function invokeClaudeCodeVerbose(prompt, yolo, model) {
   return new Promise((resolve2) => {
     const claudeBin = resolveCommand("claude");
-    const args = [];
-    if (yolo) args.push("--dangerously-skip-permissions");
-    if (model) args.push("--model", model);
-    args.push("--verbose", "--output-format", "stream-json", "-p", prompt);
+    const args = buildClaudeArgs(prompt, { yolo, model, verbose: true });
     const child = spawn(claudeBin, args, { stdio: ["inherit", "pipe", "inherit"] });
     const rl = createInterface({ input: child.stdout });
     let turnCount = 0;
@@ -1463,7 +1731,14 @@ function summarizeTool(name, input) {
 }
 
 // src/codex/codexService.ts
-import { spawnSync as spawnSync5 } from "child_process";
+import { spawn as spawn2, spawnSync as spawnSync5 } from "child_process";
+function buildCodexArgs(prompt, options = {}) {
+  const args = ["exec"];
+  if (options.yolo) args.push("--dangerously-bypass-approvals-and-sandbox");
+  if (options.model) args.push("--model", options.model);
+  args.push(prompt);
+  return args;
+}
 function invokeCodexCode(prompt, options = {}) {
   if (options.verbose) {
     process.stderr.write("Warning: --verbose is not supported for Codex and will be ignored.\n");
@@ -1472,14 +1747,38 @@ function invokeCodexCode(prompt, options = {}) {
 }
 function invokeCodexCodeSync(prompt, yolo, model) {
   const codexBin = resolveCommand("codex");
-  const args = ["exec"];
-  if (yolo) args.push("--dangerously-bypass-approvals-and-sandbox");
-  if (model) args.push("--model", model);
-  args.push(prompt);
+  const args = buildCodexArgs(prompt, { yolo, model });
   const result = spawnSync5(codexBin, args, { encoding: "utf8", stdio: "inherit" });
   handleSpawnError(result.error, "codex");
   handleExitCode(result.status, "Codex");
 }
+function runCodex(prompt, options = {}) {
+  return new Promise((resolve2, reject) => {
+    const codexBin = resolveCommand("codex");
+    const args = buildCodexArgs(prompt, { yolo: true, model: options.model });
+    const child = spawn2(codexBin, args, { stdio: "inherit" });
+    trackChild(child);
+    child.on("error", (err) => {
+      untrackChild(child);
+      const nodeErr = err;
+      reject(
+        nodeErr.code === "ENOENT" ? new Error("`codex` CLI is not installed or not on PATH.") : new Error(nodeErr.message)
+      );
+    });
+    child.on("close", (code, signal) => {
+      untrackChild(child);
+      if (code === 0) {
+        resolve2();
+        return;
+      }
+      reject(
+        new Error(
+          signal === null ? `Codex exited with code ${String(code)}.` : `Codex terminated on ${signal}.`
+        )
+      );
+    });
+  });
+}
 
 // src/commands/getReady.ts
 function writeOverflowHint(output, issues, limit) {
@@ -1715,6 +2014,109 @@ var executeCommand = new Command4("execute").description("Delegate work to an AI
 
 // src/commands/executePrompt.ts
 import { Command as Command5 } from "commander";
+
+// src/github/conversation.ts
+var KIND_LABELS = {
+  "issue-body": "issue description",
+  "issue-comment": "comment",
+  "pr-comment": "pull request comment",
+  "pr-review": "pull request review",
+  "thread-comment": "review thread comment"
+};
+function byCreatedAt(a, b) {
+  return a.createdAt.localeCompare(b.createdAt);
+}
+function classify(author, p) {
+  const login2 = author.toLowerCase();
+  if (login2 === p.agentUser.toLowerCase()) return "agent";
+  return p.allowedUsers.some((user) => user.toLowerCase() === login2) ? "authorized" : "other";
+}
+function analyzeSurface(messages, p) {
+  const ordered = [...messages].sort(byCreatedAt);
+  let lastAgentAt = null;
+  for (const message of ordered) {
+    if (message.kind === "issue-body") continue;
+    if (classify(message.author, p) !== "agent") continue;
+    if (lastAgentAt === null || message.createdAt > lastAgentAt) {
+      lastAgentAt = message.createdAt;
+    }
+  }
+  const kept = [];
+  for (const message of ordered) {
+    const authorClass = classify(message.author, p);
+    if (authorClass === "other") continue;
+    const isNew = authorClass === "authorized" && (lastAgentAt === null || message.createdAt > lastAgentAt);
+    kept.push({ ...message, isNew });
+  }
+  const newMessages = kept.filter((message) => message.isNew);
+  return {
+    messages: kept,
+    newMessages,
+    newMessageCount: newMessages.length,
+    hasNewMessage: newMessages.length > 0,
+    lastAgentAt
+  };
+}
+function lastAuthorClass(messages, p) {
+  if (messages.length === 0) return "none";
+  const newest = [...messages].sort(byCreatedAt).at(-1);
+  return newest === void 0 ? "none" : classify(newest.author, p);
+}
+function formatMessages(messages) {
+  return messages.map((message) => {
+    const marker = message.isNew ? " \xB7 NEW since last agent run" : "";
+    return `[${message.author}] ${KIND_LABELS[message.kind]} \xB7 ${message.createdAt}${marker}
+${message.body}`;
+  }).join("\n\n");
+}
+
+// src/github/issueConversation.ts
+function analyzeConversation(conversation, allowedUsers, agentUser) {
+  const participants = { allowedUsers, agentUser };
+  const messages = [
+    {
+      kind: "issue-body",
+      author: conversation.author,
+      body: conversation.body,
+      createdAt: conversation.createdAt
+    },
+    ...conversation.comments.map((comment) => ({
+      kind: "issue-comment",
+      author: comment.author,
+      body: comment.body,
+      createdAt: comment.createdAt
+    }))
+  ];
+  const analysis = analyzeSurface(messages, participants);
+  return {
+    messages: analysis.messages.map(toConversationMessage),
+    newMessageCount: analysis.newMessageCount,
+    hasNewMessage: analysis.hasNewMessage,
+    lastAgentAt: analysis.lastAgentAt
+  };
+}
+function toConversationMessage(message) {
+  return {
+    kind: message.kind === "issue-body" ? "issue" : "comment",
+    author: message.author,
+    body: message.body,
+    createdAt: message.createdAt,
+    isNew: message.isNew
+  };
+}
+function formatConversation(messages) {
+  return formatMessages(
+    messages.map((message) => ({
+      kind: message.kind === "issue" ? "issue-body" : "issue-comment",
+      author: message.author,
+      body: message.body,
+      createdAt: message.createdAt,
+      isNew: message.isNew
+    }))
+  );
+}
+
+// src/commands/executePrompt.ts
 var PUSH_INSTRUCTION = "Once all changes are complete, stage every modified file, create a single commit with a clear and descriptive commit message that summarises what was fixed, and push the branch to the remote.";
 function withPush(prompt, push) {
   return push ? `${prompt}
@@ -1724,6 +2126,9 @@ ${PUSH_INSTRUCTION}` : prompt;
 function formatPrInfoContext(pr) {
   return JSON.stringify(pr, null, 2);
 }
+function pluralSuffix(count) {
+  return count === 1 ? "" : "s";
+}
 function addAiOptions(cmd) {
   return cmd.requiredOption("--with <executor>", "Executor to use: claude or codex").option("--model <string>", "Model identifier to pass to the executor").option("--silent", "Suppress step-by-step Claude output; show only the final summary").option("--push", "Append instruction to commit and push changes after the AI finishes");
 }
@@ -1841,16 +2246,1774 @@ ${formatComments(comments)}`,
   );
   await invokeSelectedExecutor(fullPrompt, executor, options);
 });
-var executePromptCommand = new Command5("execute-prompt").description("Execute a configured custom prompt using an AI assistant").addCommand(executeSonarCmd).addCommand(executeFixCommentsCmd);
+var executeCheckIssueCmd = addAiOptions(
+  new Command5("check-issue").description(
+    "Check a GitHub issue for a new message from an allowed user since the last agent run and invoke the AI with the issue conversation"
+  ).argument("<issue-number>", "GitHub issue number to check")
+).option("--force", "Skip the new-message check and invoke the AI directly").action(async (issueNumberArg, options) => {
+  const executor = resolveExecutor(options.with);
+  const issueNumber = Number.parseInt(issueNumberArg, 10);
+  if (Number.isNaN(issueNumber) || issueNumber <= 0) {
+    process.stderr.write(`Error: <issue-number> must be a positive integer (got '${issueNumberArg}').
+`);
+    process.exit(1);
+  }
+  const config = readConfig();
+  if (config.remoteType === "azdo") {
+    process.stderr.write(
+      "Error: check-issue is not supported for Azure DevOps. See docs/azdo-gap.md for details.\n"
+    );
+    process.exit(1);
+  }
+  const allowedUsers = (config.allowedUsers ?? []).filter((user) => user.trim().length > 0);
+  if (allowedUsers.length === 0) {
+    process.stderr.write(
+      "Error: No allowed users configured. Run `automata config` or `automata config set allowed-users <user1,user2>` to set them.\n"
+    );
+    process.exit(1);
+  }
+  const agentUser = (config.agentUser ?? "").trim();
+  if (agentUser.length === 0) {
+    process.stderr.write(
+      "Error: No agent user configured. Run `automata config` or `automata config set agent-user <login>` to set it.\n"
+    );
+    process.exit(1);
+  }
+  let conversation;
+  try {
+    conversation = getIssueConversation(issueNumber);
+  } catch (err) {
+    process.stderr.write(`Error: ${err.message}
+`);
+    process.exit(1);
+  }
+  const analysis = analyzeConversation(conversation, allowedUsers, agentUser);
+  if (!analysis.hasNewMessage && !options.force) {
+    const since = analysis.lastAgentAt === null ? "" : ` (last agent message: ${analysis.lastAgentAt})`;
+    process.stdout.write(
+      `No new messages from allowed users on issue #${String(issueNumber)}${since}. Use --force to invoke the AI anyway.
+`
+    );
+    return;
+  }
+  if (analysis.hasNewMessage) {
+    process.stdout.write(
+      `Found ${String(analysis.newMessageCount)} new message${pluralSuffix(analysis.newMessageCount)} on issue #${String(issueNumber)}. Invoking AI\u2026
+`
+    );
+  } else {
+    process.stdout.write(`No new messages on issue #${String(issueNumber)} \u2014 forced run. Invoking AI\u2026
+`);
+  }
+  const promptText = config.prompts?.checkIssue ?? DEFAULT_CHECK_ISSUE_PROMPT;
+  const fullPrompt = withPush(
+    `${promptText}
+
+Issue #${String(issueNumber)}: ${conversation.title}
+URL: ${conversation.url}
+
+Conversation (only messages from allowed users and the agent, oldest first):
+
+${formatConversation(analysis.messages)}`,
+    options.push
+  );
+  const marker = analysis.hasNewMessage ? `automata check-issue: picked up ${String(analysis.newMessageCount)} new message${pluralSuffix(analysis.newMessageCount)}, starting an agent run.` : "automata check-issue: forced run, starting an agent run.";
+  try {
+    postComment(issueNumber, marker);
+  } catch (err) {
+    process.stderr.write(
+      `Error: could not post the execution marker comment on issue #${String(issueNumber)}: ${err.message}
+`
+    );
+    process.exit(1);
+  }
+  await invokeSelectedExecutor(fullPrompt, executor, options);
+});
+var executePromptCommand = new Command5("execute-prompt").description("Execute a configured custom prompt using an AI assistant").addCommand(executeSonarCmd).addCommand(executeFixCommentsCmd).addCommand(executeCheckIssueCmd);
+
+// src/commands/doWork.ts
+import { Command as Command6 } from "commander";
+
+// src/github/ghWorkService.ts
+import { spawnSync as spawnSync6 } from "child_process";
+function run4(cmd, args) {
+  const result = spawnSync6(cmd, args, { encoding: "utf8" });
+  if (result.error) {
+    const err = result.error;
+    if (err.code === "ENOENT") {
+      throw new Error(`\`${cmd}\` CLI is not installed or not on PATH.`);
+    }
+    throw new Error(err.message);
+  }
+  return { stdout: result.stdout ?? "", stderr: result.stderr ?? "", status: result.status ?? 1 };
+}
+function ghJson(args, what) {
+  const { stdout, stderr, status } = run4("gh", args);
+  if (status !== 0) {
+    throw new Error(stderr.trim() || `Failed to ${what}. Is \`gh\` installed and authenticated?`);
+  }
+  return JSON.parse(stdout);
+}
+function login(author) {
+  return author?.login ?? "";
+}
+function byCreatedAt2(a, b) {
+  return a.createdAt.localeCompare(b.createdAt);
+}
+function visibleAt(createdAt, submittedAt) {
+  if (submittedAt === null || submittedAt === void 0) return createdAt;
+  return submittedAt > createdAt ? submittedAt : createdAt;
+}
+function getRepoSlug() {
+  const { stdout, status } = run4("git", ["remote", "get-url", "origin"]);
+  if (status !== 0) {
+    throw new Error("Could not read the `origin` remote. Is this a git repository with a remote?");
+  }
+  const url = stdout.trim();
+  const match = /github\.com\/([^/]+)\/([^/]+?)(?:\.git)?$/.exec(url) ?? /github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/.exec(url);
+  if (!match) {
+    throw new Error(`Could not determine the GitHub owner/repo from the origin remote: ${url}`);
+  }
+  return { owner: match[1], repo: match[2] };
+}
+function getAuthenticatedLogin() {
+  const { stdout, status } = run4("gh", ["api", "user", "--jq", ".login"]);
+  if (status !== 0) return null;
+  const login2 = stdout.trim();
+  return login2.length > 0 ? login2 : null;
+}
+function listCandidateIssues(technique, value, limit) {
+  const args = [
+    "issue",
+    "list",
+    "--state",
+    "open",
+    "--limit",
+    String(limit),
+    "--json",
+    "number,title,body,url"
+  ];
+  switch (technique) {
+    case "label":
+      args.push("--label", value);
+      break;
+    case "assignee":
+      args.push("--assignee", value);
+      break;
+    case "title-contains":
+      args.push("--search", `${value} in:title`);
+      break;
+  }
+  return ghJson(args, "query GitHub issues");
+}
+function getIssueSurface(issueNumber) {
+  const raw = ghJson(
+    [
+      "issue",
+      "view",
+      String(issueNumber),
+      "--json",
+      "number,title,body,url,state,author,createdAt,assignees,labels,comments"
+    ],
+    `read issue #${String(issueNumber)}`
+  );
+  const messages = [
+    {
+      kind: "issue-body",
+      author: login(raw.author),
+      body: raw.body,
+      createdAt: raw.createdAt
+    },
+    ...(raw.comments ?? []).map((comment) => ({
+      kind: "issue-comment",
+      author: login(comment.author),
+      body: comment.body,
+      createdAt: comment.createdAt
+    }))
+  ].sort(byCreatedAt2);
+  return {
+    issue: { number: raw.number, title: raw.title, body: raw.body, url: raw.url },
+    state: raw.state === "CLOSED" ? "CLOSED" : "OPEN",
+    assignees: (raw.assignees ?? []).map(login).filter((name) => name.length > 0),
+    labels: (raw.labels ?? []).map((label) => label.name ?? "").filter((name) => name.length > 0),
+    messages
+  };
+}
+var LINK_MAP_QUERY = `
+query($owner:String!,$repo:String!,$cursor:String){
+  repository(owner:$owner,name:$repo){
+    defaultBranchRef{ name }
+    pullRequests(states:OPEN, first:100, after:$cursor, orderBy:{field:UPDATED_AT, direction:DESC}){
+      pageInfo{ hasNextPage endCursor }
+      nodes{
+        number url title headRefName baseRefName isCrossRepository isDraft updatedAt
+        closingIssuesReferences(first:50){
+          pageInfo{ hasNextPage }
+          nodes{ number repository{ nameWithOwner } }
+        }
+      }
+    }
+  }
+}`.trim();
+var MAX_LINK_MAP_PAGES = 50;
+function indexPullRequest(map, node, nameWithOwner) {
+  const ref = {
+    number: node.number,
+    url: node.url,
+    title: node.title,
+    headRefName: node.headRefName,
+    baseRefName: node.baseRefName,
+    isCrossRepository: node.isCrossRepository,
+    state: "OPEN",
+    isDraft: node.isDraft,
+    updatedAt: node.updatedAt
+  };
+  if (node.closingIssuesReferences.pageInfo?.hasNextPage) {
+    throw new Error(
+      `Pull request #${String(node.number)} closes more than 50 issues, so the issue-to-pull-request map cannot be read completely. Refusing the tick rather than risk starting work on an issue that already has a pull request.`
+    );
+  }
+  for (const issue of node.closingIssuesReferences.nodes) {
+    if (issue.repository.nameWithOwner !== nameWithOwner) continue;
+    const existing = map.get(issue.number);
+    if (existing) {
+      existing.push(ref);
+    } else {
+      map.set(issue.number, [ref]);
+    }
+  }
+}
+function getOpenPrLinkMap() {
+  const { owner, repo } = getRepoSlug();
+  const map = /* @__PURE__ */ new Map();
+  let defaultBranch = null;
+  let cursor = null;
+  for (let page = 0; page < MAX_LINK_MAP_PAGES; page++) {
+    const args = ["api", "graphql", "-f", `query=${LINK_MAP_QUERY}`, "-f", `owner=${owner}`, "-f", `repo=${repo}`];
+    if (cursor !== null) args.push("-f", `cursor=${cursor}`);
+    const response = ghJson(args, "query open pull requests");
+    defaultBranch = response.data.repository.defaultBranchRef?.name ?? defaultBranch;
+    const connection = response.data.repository.pullRequests;
+    for (const node of connection.nodes) {
+      indexPullRequest(map, node, `${owner}/${repo}`);
+    }
+    if (!connection.pageInfo?.hasNextPage || connection.pageInfo.endCursor === null) {
+      return { byIssue: map, defaultBranch };
+    }
+    cursor = connection.pageInfo.endCursor;
+  }
+  throw new Error(
+    `Stopped paginating open pull requests after ${String(MAX_LINK_MAP_PAGES)} pages, so the issue-to-pull-request map cannot be trusted. Refusing the tick rather than risk starting work on an issue that already has a pull request.`
+  );
+}
+var REVIEW_THREADS_QUERY2 = `
+query($owner:String!,$repo:String!,$prNumber:Int!,$cursor:String){
+  repository(owner:$owner,name:$repo){
+    pullRequest(number:$prNumber){
+      reviewThreads(first:100, after:$cursor){
+        pageInfo{ hasNextPage endCursor }
+        nodes{
+          isResolved isOutdated path line
+          comments(last:100){
+            pageInfo{ hasPreviousPage }
+            nodes{ author{login} body createdAt url pullRequestReview{ submittedAt } }
+          }
+        }
+      }
+    }
+  }
+}`.trim();
+var MAX_THREAD_PAGES = 50;
+function normalizePrState(state) {
+  if (state === "MERGED") return "MERGED";
+  if (state === "CLOSED") return "CLOSED";
+  return "OPEN";
+}
+function getReviewThreads(prNumber) {
+  const { owner, repo } = getRepoSlug();
+  const threads = [];
+  let cursor = null;
+  for (let page = 0; page < MAX_THREAD_PAGES; page++) {
+    const args = [
+      "api",
+      "graphql",
+      "-f",
+      `query=${REVIEW_THREADS_QUERY2}`,
+      "-f",
+      `owner=${owner}`,
+      "-f",
+      `repo=${repo}`,
+      "-F",
+      `prNumber=${String(prNumber)}`
+    ];
+    if (cursor !== null) args.push("-f", `cursor=${cursor}`);
+    const response = ghJson(
+      args,
+      `query review threads for pull request #${String(prNumber)}`
+    );
+    const connection = response.data.repository.pullRequest.reviewThreads;
+    for (const node of connection.nodes) {
+      if (node.comments.pageInfo?.hasPreviousPage) {
+        throw new Error(
+          `Review thread on ${node.path} in pull request #${String(prNumber)} has more than 100 comments, so the earliest ones were not read. Refusing rather than risk suppressing a maintainer's request.`
+        );
+      }
+      threads.push({
+        path: node.path,
+        line: node.line ?? null,
+        isResolved: node.isResolved,
+        url: node.comments.nodes.at(-1)?.url ?? null,
+        comments: node.comments.nodes.map((comment) => ({
+          kind: "thread-comment",
+          author: login(comment.author),
+          body: comment.body,
+          // When the comment became *visible*, not when it was drafted.
+          // GitHub stamps `createdAt` the moment a comment is added to a
+          // pending review, and it only becomes visible when the review is
+          // submitted — minutes later for a human working through a diff.
+          // Using `createdAt` let an agent answer posted in between look newer
+          // than the review, which marked every one of its threads answered
+          // and discarded the whole review silently.
+          createdAt: visibleAt(comment.createdAt, comment.pullRequestReview?.submittedAt)
+        })).sort(byCreatedAt2)
+      });
+    }
+    if (!connection.pageInfo?.hasNextPage || connection.pageInfo.endCursor === null) {
+      return threads;
+    }
+    cursor = connection.pageInfo.endCursor;
+  }
+  throw new Error(
+    `Stopped paginating review threads for pull request #${String(prNumber)} after ${String(MAX_THREAD_PAGES)} pages; refusing rather than answering only part of the feedback.`
+  );
+}
+function getPrSurface(prNumber) {
+  const raw = ghJson(
+    [
+      "pr",
+      "view",
+      String(prNumber),
+      "--json",
+      "number,title,url,headRefName,baseRefName,isCrossRepository,state,isDraft,body,author,createdAt,updatedAt,comments,reviews"
+    ],
+    `read pull request #${String(prNumber)}`
+  );
+  const messages = [
+    ...(raw.comments ?? []).map((comment) => ({
+      kind: "pr-comment",
+      author: login(comment.author),
+      body: comment.body,
+      createdAt: comment.createdAt
+    })),
+    // A review with no body carries no message — only its inline comments do,
+    // and those arrive through the review-thread query.
+    ...(raw.reviews ?? []).filter((review) => review.body.trim().length > 0).map((review) => ({
+      kind: "pr-review",
+      author: login(review.author),
+      body: review.body,
+      createdAt: review.submittedAt ?? review.createdAt ?? ""
+    }))
+  ].sort(byCreatedAt2);
+  const threads = getReviewThreads(prNumber);
+  const state = normalizePrState(raw.state);
+  return {
+    pr: {
+      number: raw.number,
+      url: raw.url,
+      title: raw.title,
+      headRefName: raw.headRefName,
+      baseRefName: raw.baseRefName ?? "",
+      isCrossRepository: raw.isCrossRepository ?? false,
+      state,
+      isDraft: raw.isDraft ?? false,
+      updatedAt: raw.updatedAt ?? raw.createdAt
+    },
+    messages,
+    threads
+  };
+}
+function assignIssueToAgent(issueNumber, agentUser) {
+  const { stderr, status } = run4("gh", [
+    "issue",
+    "edit",
+    String(issueNumber),
+    "--add-assignee",
+    agentUser
+  ]);
+  if (status !== 0) {
+    throw new Error(stderr.trim() || `Failed to assign issue #${String(issueNumber)} to ${agentUser}.`);
+  }
+}
+function postMarker(_surface, number, body) {
+  const { owner, repo } = getRepoSlug();
+  const raw = ghJson(
+    [
+      "api",
+      "--method",
+      "POST",
+      `repos/${owner}/${repo}/issues/${String(number)}/comments`,
+      "-f",
+      `body=${body}`
+    ],
+    `post a comment on #${String(number)}`
+  );
+  return { commentId: String(raw.id), createdAt: raw.created_at };
+}
+function updateMarker(marker, body) {
+  const { owner, repo } = getRepoSlug();
+  const { stderr, status } = run4("gh", [
+    "api",
+    "--method",
+    "PATCH",
+    `repos/${owner}/${repo}/issues/comments/${marker.commentId}`,
+    "-f",
+    `body=${body}`
+  ]);
+  if (status !== 0) {
+    throw new Error(stderr.trim() || `Failed to update comment ${marker.commentId}.`);
+  }
+}
+function deleteMarker(marker) {
+  const { owner, repo } = getRepoSlug();
+  const { stderr, status } = run4("gh", [
+    "api",
+    "--method",
+    "DELETE",
+    `repos/${owner}/${repo}/issues/comments/${marker.commentId}`
+  ]);
+  if (status !== 0) {
+    if (/not found/i.test(stderr) || /HTTP 404/i.test(stderr)) return;
+    throw new Error(stderr.trim() || `Failed to delete comment ${marker.commentId}.`);
+  }
+}
+
+// src/github/workDetection.ts
+function isAssignedToAgent(assignees, agentUser) {
+  const agent = agentUser.toLowerCase();
+  return assignees.some((name) => name.toLowerCase() === agent);
+}
+function findActionableThreads(threads, p, prLastAgentAt) {
+  const actionable = [];
+  for (const thread of threads) {
+    if (thread.isResolved) continue;
+    const comments = thread.comments.filter((comment) => classifyForThread(comment.author, p) !== "other");
+    if (lastAuthorClass(comments, p) !== "authorized") continue;
+    const newestAuthorized = comments.at(-1)?.createdAt;
+    if (newestAuthorized !== void 0 && prLastAgentAt !== null && prLastAgentAt > newestAuthorized) {
+      continue;
+    }
+    actionable.push({ ...thread, comments });
+  }
+  return actionable;
+}
+function classifyForThread(author, p) {
+  const login2 = author.toLowerCase();
+  if (login2 === p.agentUser.toLowerCase()) return "agent";
+  return p.allowedUsers.some((user) => user.toLowerCase() === login2) ? "authorized" : "other";
+}
+function newestPr(prs) {
+  return [...prs].sort((a, b) => b.updatedAt.localeCompare(a.updatedAt))[0];
+}
+function plural(count, noun) {
+  return `${String(count)} ${noun}${count === 1 ? "" : "s"}`;
+}
+function protectedHeads(policy) {
+  return [policy.baseBranch, policy.defaultBranch ?? "", ...policy.protectedBranches ?? []].filter(
+    (branch) => branch.length > 0
+  );
+}
+function unsafeBranchSkip(pr, issue, policy) {
+  if (pr.isCrossRepository) {
+    return {
+      kind: "skip",
+      issue,
+      reason: "unsafe-pr-branch",
+      detail: `pull request #${String(pr.number)} comes from a fork; its head branch is not in this repository`
+    };
+  }
+  if (protectedHeads(policy).includes(pr.headRefName)) {
+    return {
+      kind: "skip",
+      issue,
+      reason: "unsafe-pr-branch",
+      detail: `pull request #${String(pr.number)} has a protected branch (${pr.headRefName}) as its head, so a turn would have to push to it`
+    };
+  }
+  return null;
+}
+function decideWork(state, p, policy) {
+  const baseBranch = policy.baseBranch;
+  const { issueSurface, prSurface } = state;
+  const issue = issueSurface.issue;
+  if (issueSurface.state === "CLOSED") {
+    return { kind: "skip", issue, reason: "issue-closed", detail: "the issue is closed" };
+  }
+  const issueAnalysis = analyzeSurface(issueSurface.messages, p);
+  const needsAssignment = !isAssignedToAgent(issueSurface.assignees, p.agentUser);
+  const openPrs = state.linkedPrs.filter((pr) => pr.state === "OPEN");
+  const hasOpenPr = openPrs.length > 0 && prSurface !== null && prSurface.pr.state === "OPEN";
+  if (!hasOpenPr) {
+    if (!issueAnalysis.hasNewMessage) {
+      return {
+        kind: "skip",
+        issue,
+        reason: "no-new-messages",
+        detail: issueAnalysis.lastAgentAt === null ? "no messages from authorized accounts" : `nothing new since the agent's message at ${issueAnalysis.lastAgentAt}`
+      };
+    }
+    return {
+      kind: "work",
+      item: {
+        issue,
+        turn: "issue-discuss",
+        pr: null,
+        branch: baseBranch,
+        needsAssignment,
+        issueAnalysis,
+        prAnalysis: null,
+        actionableThreads: [],
+        reason: `${plural(issueAnalysis.newMessageCount, "new issue message")}, no open pull request`,
+        ambiguousPrs: []
+      }
+    };
+  }
+  const surface = prSurface;
+  const unsafe = unsafeBranchSkip(surface.pr, issue, policy);
+  if (unsafe !== null) return unsafe;
+  const agentThreadMessages = surface.threads.flatMap((thread) => thread.comments).filter((comment) => comment.author.toLowerCase() === p.agentUser.toLowerCase());
+  const prAnalysis = analyzeSurface([...surface.messages, ...agentThreadMessages], p);
+  const actionableThreads = findActionableThreads(surface.threads, p, prAnalysis.lastAgentAt);
+  const hasPrWork = prAnalysis.hasNewMessage || actionableThreads.length > 0;
+  if (!hasPrWork && !issueAnalysis.hasNewMessage) {
+    return {
+      kind: "skip",
+      issue,
+      reason: "no-new-messages",
+      detail: `nothing new on issue or pull request #${String(surface.pr.number)}`
+    };
+  }
+  const reasons = [];
+  if (prAnalysis.hasNewMessage) {
+    reasons.push(plural(prAnalysis.newMessageCount, "new pull request message"));
+  }
+  if (actionableThreads.length > 0) {
+    reasons.push(plural(actionableThreads.length, "unresolved review thread"));
+  }
+  if (issueAnalysis.hasNewMessage) {
+    reasons.push(plural(issueAnalysis.newMessageCount, "new issue message"));
+  }
+  return {
+    kind: "work",
+    item: {
+      issue,
+      turn: "pr-work",
+      pr: surface.pr,
+      branch: surface.pr.headRefName,
+      needsAssignment,
+      issueAnalysis,
+      prAnalysis,
+      actionableThreads,
+      reason: `${reasons.join(", ")} on pull request #${String(surface.pr.number)}`,
+      // Several open PRs closing one issue is ambiguous rather than wrong; the
+      // most recently updated one is used and the rest are reported.
+      ambiguousPrs: openPrs.length > 1 ? openPrs.filter((pr) => pr.number !== surface.pr.number) : []
+    }
+  };
+}
+function selectLinkedPr(linkedPrs) {
+  const open = linkedPrs.filter((pr) => pr.state === "OPEN");
+  return open.length === 0 ? null : newestPr(open);
+}
+
+// src/github/workPrompt.ts
+function formatThreads(threads) {
+  return threads.map((thread) => {
+    const location = thread.line === null ? `${thread.path}:(file)` : `${thread.path}:${String(thread.line)}`;
+    const newest = thread.comments.at(-1);
+    const author = newest?.author ?? "unknown";
+    const body = newest?.body ?? "";
+    const link = thread.url === null ? "" : `
+${thread.url}`;
+    return `[${author}] ${location}${link}
+${body}`;
+  }).join("\n\n");
+}
+function composePrompt(input) {
+  const { item, repo, agentUser, baseBranch, frame } = input;
+  const lines = [
+    frame.trimEnd(),
+    "",
+    "--- Context assembled by automata ---",
+    `Repository: ${repo.owner}/${repo.repo}`,
+    `You are: ${agentUser}`,
+    `Turn: ${item.turn}`,
+    `Base branch: ${baseBranch}`,
+    `Issue #${String(item.issue.number)}: ${item.issue.title}`,
+    `Issue URL: ${item.issue.url}`
+  ];
+  if (item.pr) {
+    lines.push(
+      `Pull request #${String(item.pr.number)}: ${item.pr.title}`,
+      `Pull request URL: ${item.pr.url}`,
+      `Branch: ${item.pr.headRefName} (checked out and up to date)`
+    );
+  }
+  const newMessages = [
+    ...item.issueAnalysis.newMessages,
+    ...item.prAnalysis?.newMessages ?? []
+  ].sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+  if (newMessages.length > 0) {
+    lines.push("", "New since your last message \u2014 this is what you must answer:", "", formatMessages(newMessages));
+  }
+  lines.push(
+    "",
+    "Full conversation on the issue (authorized accounts and you only, oldest first):",
+    "",
+    formatMessages(item.issueAnalysis.messages)
+  );
+  if (item.prAnalysis && item.prAnalysis.messages.length > 0) {
+    lines.push(
+      "",
+      "Conversation on the pull request (authorized accounts and you only, oldest first):",
+      "",
+      formatMessages(item.prAnalysis.messages)
+    );
+  }
+  if (item.actionableThreads.length > 0) {
+    lines.push("", "Unresolved review threads needing an answer:", "", formatThreads(item.actionableThreads));
+  }
+  if (item.ambiguousPrs.length > 0) {
+    const others = item.ambiguousPrs.map((pr) => `#${String(pr.number)}`).join(", ");
+    lines.push(
+      "",
+      `Note: this issue is also closed by ${others}. You are working on #${String(item.pr?.number ?? 0)}, the most recently updated one.`
+    );
+  }
+  lines.push(
+    "",
+    "Only the messages above exist. Anything from other accounts has been withheld",
+    "deliberately \u2014 do not ask about it."
+  );
+  return lines.join("\n");
+}
+
+// src/github/markerReconciliation.ts
+function isAuthorized(author, p) {
+  const login2 = author.toLowerCase();
+  return login2 !== p.agentUser.toLowerCase() && p.allowedUsers.some((user) => user.toLowerCase() === login2);
+}
+function promptWatermark(messageSets) {
+  let watermark = null;
+  for (const messages of messageSets) {
+    for (const message of messages) {
+      if (watermark === null || message.createdAt > watermark) watermark = message.createdAt;
+    }
+  }
+  return watermark;
+}
+function messagesBetween(messages, p, watermark, until) {
+  const since = watermark ?? "";
+  return messages.filter(
+    (message) => isAuthorized(message.author, p) && message.createdAt > since && message.createdAt <= until
+  );
+}
+function analyseAnswer(messages, p, marker, watermark) {
+  let answeredAt = null;
+  for (const message of messages) {
+    if (message.kind === "issue-body") continue;
+    if (message.author.toLowerCase() !== p.agentUser.toLowerCase()) continue;
+    if (message.createdAt <= marker.createdAt) continue;
+    if (answeredAt === null || message.createdAt > answeredAt) answeredAt = message.createdAt;
+  }
+  const since = watermark ?? marker.createdAt;
+  const toReport = messages.filter(
+    (message) => isAuthorized(message.author, p) && message.createdAt > since
+  );
+  const missed = answeredAt === null ? [] : toReport.filter((message) => message.createdAt <= answeredAt);
+  return { answeredAt, missed, toReport };
+}
+
+// src/run/runLock.ts
+import { writeFileSync, readFileSync as readFileSync3, unlinkSync, mkdirSync, renameSync, linkSync, statSync } from "fs";
+import { randomUUID } from "crypto";
+import { hostname } from "os";
+import { join as join2 } from "path";
+var LOCK_DIR = ".automata";
+var LOCK_FILE = "automata.lock";
+var RUN_LOCK_RELATIVE_PATH = `${LOCK_DIR}/${LOCK_FILE}`;
+function lockPath() {
+  return join2(process.cwd(), LOCK_DIR, LOCK_FILE);
+}
+function processStartedAt(pid) {
+  try {
+    const stat = readFileSync3(`/proc/${String(pid)}/stat`, "utf8");
+    const afterComm = stat.slice(stat.lastIndexOf(")") + 2);
+    const field = afterComm.split(" ")[19];
+    return field === void 0 || field.length === 0 ? null : field;
+  } catch {
+    return null;
+  }
+}
+function isAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+function readOwner(path) {
+  try {
+    const parsed = JSON.parse(readFileSync3(path, "utf8"));
+    if (typeof parsed.pid !== "number" || typeof parsed.startedAt !== "string") return null;
+    return {
+      pid: parsed.pid,
+      startedAt: parsed.startedAt,
+      host: parsed.host ?? "unknown",
+      command: parsed.command ?? "unknown",
+      token: parsed.token ?? "",
+      pidStartedAt: parsed.pidStartedAt
+    };
+  } catch {
+    return null;
+  }
+}
+function isStale(owner, staleMinutes) {
+  if (owner === null) return true;
+  if (owner.host === hostname()) {
+    if (!isAlive(owner.pid)) return true;
+    const startedAt2 = processStartedAt(owner.pid);
+    if (owner.pidStartedAt !== void 0 && startedAt2 !== null && startedAt2 !== owner.pidStartedAt) {
+      return true;
+    }
+    return false;
+  }
+  const startedAt = Date.parse(owner.startedAt);
+  if (Number.isNaN(startedAt)) return true;
+  return Date.now() - startedAt > staleMinutes * 60 * 1e3;
+}
+function heldTooLong(owner, staleMinutes) {
+  if (owner.host !== hostname()) return false;
+  if (owner.pidStartedAt !== void 0 && processStartedAt(owner.pid) !== null) return false;
+  const startedAt = Date.parse(owner.startedAt);
+  if (Number.isNaN(startedAt)) return true;
+  return Date.now() - startedAt > staleMinutes * 60 * 1e3;
+}
+function makeHandle(path, token) {
+  let released = false;
+  return {
+    release() {
+      if (released) return;
+      released = true;
+      const current = readOwner(path);
+      if (current !== null && current.token !== token) {
+        return;
+      }
+      const takenAway = `${path}.releasing.${token}`;
+      try {
+        renameSync(path, takenAway);
+      } catch {
+        return;
+      }
+      const owner = readOwner(takenAway);
+      if (owner === null || owner.token === token) {
+        try {
+          unlinkSync(takenAway);
+        } catch {
+        }
+        return;
+      }
+      try {
+        linkSync(takenAway, path);
+      } catch {
+      }
+      try {
+        unlinkSync(takenAway);
+      } catch {
+      }
+    }
+  };
+}
+function publishLock(path, command, token) {
+  const owner = {
+    pid: process.pid,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    host: hostname(),
+    command,
+    token,
+    pidStartedAt: processStartedAt(process.pid) ?? void 0
+  };
+  const staging = `${path}.staging.${token}`;
+  try {
+    writeFileSync(staging, JSON.stringify(owner, null, 2) + "\n", { encoding: "utf8", flag: "wx" });
+  } catch {
+    return false;
+  }
+  try {
+    linkSync(staging, path);
+    return true;
+  } catch (err) {
+    if (err.code !== "EEXIST") throw err;
+    return false;
+  } finally {
+    try {
+      unlinkSync(staging);
+    } catch {
+    }
+  }
+}
+function acquireRunLock(command, staleMinutes) {
+  const path = lockPath();
+  const token = randomUUID();
+  mkdirSync(join2(process.cwd(), LOCK_DIR), { recursive: true });
+  if (publishLock(path, command, token)) {
+    return { ok: true, handle: makeHandle(path, token) };
+  }
+  const owner = readOwner(path);
+  if (!isStale(owner, staleMinutes)) {
+    const held = owner;
+    return { ok: false, heldBy: held, suspect: heldTooLong(held, staleMinutes) };
+  }
+  return reclaim(path, command, token, owner);
+}
+var UNKNOWN_OWNER = {
+  pid: 0,
+  startedAt: "unknown",
+  host: "unknown",
+  command: "unknown",
+  token: ""
+};
+function claimStaleLock(path, token, expected) {
+  const claimed = `${path}.stale.${token}`;
+  try {
+    renameSync(path, claimed);
+  } catch (err) {
+    if (err.code === "ENOENT") return false;
+    throw err;
+  }
+  if (expected !== void 0) {
+    const taken = readOwner(claimed);
+    const sameFile = expected === null && taken === null || expected !== null && taken !== null && taken.token === expected.token;
+    if (!sameFile) {
+      try {
+        linkSync(claimed, path);
+      } catch {
+      }
+      try {
+        unlinkSync(claimed);
+      } catch {
+      }
+      return false;
+    }
+  }
+  return true;
+}
+var CLAIM_STALE_MS = 6e4;
+function acquireClaim(path) {
+  const claimPath = `${path}.claim`;
+  try {
+    writeFileSync(claimPath, JSON.stringify({ pid: process.pid, at: (/* @__PURE__ */ new Date()).toISOString() }), {
+      encoding: "utf8",
+      flag: "wx"
+    });
+    return claimPath;
+  } catch (err) {
+    if (err.code !== "EEXIST") throw err;
+  }
+  if (!claimIsAbandoned(claimPath)) return null;
+  try {
+    renameSync(claimPath, `${claimPath}.abandoned.${String(process.pid)}`);
+  } catch {
+    return null;
+  }
+  try {
+    unlinkSync(`${claimPath}.abandoned.${String(process.pid)}`);
+  } catch {
+  }
+  try {
+    writeFileSync(claimPath, JSON.stringify({ pid: process.pid, at: (/* @__PURE__ */ new Date()).toISOString() }), {
+      encoding: "utf8",
+      flag: "wx"
+    });
+    return claimPath;
+  } catch {
+    return null;
+  }
+}
+function claimIsAbandoned(claimPath) {
+  let at = Number.NaN;
+  try {
+    const raw = JSON.parse(readFileSync3(claimPath, "utf8"));
+    if (raw.at !== void 0) at = Date.parse(raw.at);
+  } catch {
+  }
+  if (Number.isNaN(at)) {
+    try {
+      at = statSync(claimPath).mtimeMs;
+    } catch {
+      return true;
+    }
+  }
+  return Date.now() - at >= CLAIM_STALE_MS;
+}
+function reclaim(path, command, token, expected) {
+  const claimPath = acquireClaim(path);
+  if (claimPath === null) {
+    const owner = readOwner(path);
+    const ownerDead = owner !== null && owner.host === hostname() && !isAlive(owner.pid);
+    return { ok: false, heldBy: owner ?? UNKNOWN_OWNER, suspect: ownerDead };
+  }
+  try {
+    if (!claimStaleLock(path, token, expected)) {
+      return { ok: false, heldBy: readOwner(path) ?? UNKNOWN_OWNER, suspect: false };
+    }
+    const claimed = `${path}.stale.${token}`;
+    try {
+      if (publishLock(path, command, token)) {
+        return { ok: true, handle: makeHandle(path, token) };
+      }
+      return { ok: false, heldBy: readOwner(path) ?? UNKNOWN_OWNER, suspect: false };
+    } finally {
+      try {
+        unlinkSync(claimed);
+      } catch {
+      }
+    }
+  } finally {
+    try {
+      unlinkSync(claimPath);
+    } catch {
+    }
+  }
+}
+
+// src/git/workspaceService.ts
+function dirtyTree() {
+  return {
+    ok: false,
+    reason: "dirty-tree",
+    detail: "the working tree has uncommitted changes; commit or stash them yourself and re-run"
+  };
+}
+function prepareBaseBranch(baseBranch) {
+  if (hasUncommittedChanges([RUN_LOCK_RELATIVE_PATH])) return dirtyTree();
+  const checkout = checkoutBranch(baseBranch);
+  if (!checkout.ok) {
+    return { ok: false, reason: "checkout-failed", detail: checkout.stderr };
+  }
+  const pull = pullFastForwardOnly();
+  if (!pull.ok) {
+    return { ok: false, reason: "pull-failed", detail: pull.stderr };
+  }
+  return { ok: true, branch: baseBranch };
+}
+function preparePrBranch(headRefName) {
+  if (hasUncommittedChanges([RUN_LOCK_RELATIVE_PATH])) return dirtyTree();
+  const fetched = fetchBranch(headRefName);
+  if (!fetched.ok) {
+    return { ok: false, reason: "checkout-failed", detail: fetched.stderr };
+  }
+  const checkout = checkoutBranch(headRefName);
+  if (!checkout.ok) {
+    const created = createTrackingBranch(headRefName);
+    if (!created.ok) {
+      return { ok: false, reason: "checkout-failed", detail: created.stderr };
+    }
+    return { ok: true, branch: headRefName };
+  }
+  const pull = pullFastForwardOnly(headRefName);
+  if (!pull.ok) {
+    return { ok: false, reason: "pull-failed", detail: pull.stderr };
+  }
+  return { ok: true, branch: headRefName };
+}
+
+// src/commands/doWork.ts
+var inFlightMarker = null;
+function out(message) {
+  process.stdout.write(message);
+}
+function progress(message) {
+  process.stderr.write(message);
+}
+function fail(message) {
+  process.stderr.write(`Error: ${message}
+`);
+  process.exit(1);
+}
+function parsePositiveInt(value, label) {
+  const trimmed = value.trim();
+  if (!/^\d+$/.test(trimmed)) {
+    fail(`${label} must be a positive integer (got "${value}").`);
+  }
+  const parsed = Number(trimmed);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0) {
+    fail(`${label} must be a positive integer within the safe range (got "${value}").`);
+  }
+  return parsed;
+}
+function resolveSettings(options) {
+  let config;
+  try {
+    config = readConfig();
+  } catch (err) {
+    fail(err.message);
+  }
+  if (config.remoteType !== "gh") {
+    fail(
+      "do-work is only supported for GitHub remotes. Set it with `automata config set type gh`. Azure DevOps lacks the issue conversation APIs this needs \u2014 see docs/azdo-gap.md."
+    );
+  }
+  if (!config.issueDiscoveryTechnique) {
+    fail("No issue discovery technique configured. Run `automata config set issue-discovery-technique <value>`.");
+  }
+  if (!config.issueDiscoveryValue) {
+    fail("No issue discovery value configured. Run `automata config set issue-discovery-value <value>`.");
+  }
+  const allowedUsers = (config.allowedUsers ?? []).filter((user) => user.trim().length > 0);
+  if (allowedUsers.length === 0) {
+    fail("No allowed users configured. Run `automata config set allowed-users <user1,user2>`.");
+  }
+  const agentUser = (config.agentUser ?? "").trim();
+  if (agentUser.length === 0) {
+    fail("No agent user configured. Run `automata config set agent-user <login>`.");
+  }
+  validateDoWorkConfig(config.doWork);
+  const doWork = config.doWork ?? {};
+  let executor = doWork.executor ?? DEFAULT_DO_WORK.executor;
+  if (options.with !== void 0) {
+    const requested = options.with.toLowerCase();
+    if (requested !== "claude" && requested !== "codex") {
+      fail(`--with must be 'claude' or 'codex', got '${options.with}'.`);
+    }
+    executor = requested;
+  }
+  if (options.dryRun !== true) {
+    checkAuthenticatedIdentity(agentUser, allowedUsers);
+  }
+  return {
+    baseBranch: doWork.baseBranch ?? DEFAULT_DO_WORK.baseBranch,
+    protectedBranches: doWork.protectedBranches ?? DEFAULT_DO_WORK.protectedBranches,
+    executor,
+    // --model wins; otherwise take the default for the executor in use.
+    model: options.model ?? doWork.models?.[executor],
+    maxRuns: options.maxRuns !== void 0 ? parsePositiveInt(options.maxRuns, "--max-runs") : doWork.maxRunsPerTick ?? DEFAULT_DO_WORK.maxRunsPerTick,
+    lockStaleMinutes: doWork.lockStaleMinutes ?? DEFAULT_DO_WORK.lockStaleMinutes,
+    limit: parsePositiveInt(options.limit, "--limit"),
+    participants: { allowedUsers, agentUser },
+    prompts: {
+      "issue-discuss": doWork.prompts?.issueDiscuss ?? DEFAULT_DO_WORK_ISSUE_DISCUSS_PROMPT,
+      "pr-work": doWork.prompts?.prWork ?? DEFAULT_DO_WORK_PR_WORK_PROMPT
+    },
+    technique: config.issueDiscoveryTechnique,
+    discoveryValue: config.issueDiscoveryValue,
+    onlyIssue: options.issue === void 0 ? void 0 : parsePositiveInt(options.issue, "--issue")
+  };
+}
+function checkAuthenticatedIdentity(agentUser, allowedUsers) {
+  const login2 = getAuthenticatedLogin();
+  if (login2 === null) {
+    progress(
+      `Warning: could not determine which account \`gh\` is authenticated as; assuming it is the agent (${agentUser}).
+`
+    );
+    return;
+  }
+  if (login2.toLowerCase() === agentUser.toLowerCase()) return;
+  if (allowedUsers.some((user) => user.toLowerCase() === login2.toLowerCase())) {
+    fail(
+      `\`gh\` is authenticated as "${login2}", which is listed in allowedUsers. Everything do-work posts would be attributed to an account that is allowed to instruct the agent, so its own marker comment would look like a new instruction and each tick would answer the previous tick forever. Authenticate \`gh\` as the agent account (${agentUser}) in this environment, or correct \`agentUser\`.`
+    );
+  }
+  fail(
+    `\`gh\` is authenticated as "${login2}" but agentUser is "${agentUser}". Comments posted under that identity are neither the agent's nor an authorized user's, so they are filtered out of the conversation: the answer boundary would never advance and the same message would start a run on every tick. Authenticate \`gh\` as the agent account (${agentUser}) in this environment, or correct \`agentUser\`.`
+  );
+}
+function planRun(item, settings) {
+  const prompt = composePrompt({
+    item,
+    repo: getRepoSlug(),
+    agentUser: settings.participants.agentUser,
+    baseBranch: settings.baseBranch,
+    frame: settings.prompts[item.turn]
+  });
+  const bin = resolveCommand(settings.executor === "codex" ? "codex" : "claude");
+  const args = settings.executor === "codex" ? buildCodexArgs(prompt, { yolo: true, model: settings.model }) : buildClaudeArgs(prompt, { yolo: true, verbose: true, model: settings.model });
+  return { prompt, bin, args, command: [bin, ...args].map(shellQuote).join(" ") };
+}
+function describePlannedRun(item, settings, run5) {
+  const rule = "\u2500".repeat(72);
+  const branchAction = item.turn === "pr-work" ? " and fast-forward" : " and pull";
+  const assignment = item.needsAssignment ? `would assign to ${settings.participants.agentUser}` : "already assigned";
+  const markerTarget = item.turn === "pr-work" && item.pr ? `pull request #${String(item.pr.number)}` : `issue #${String(item.issue.number)}`;
+  const modelNote = settings.model === void 0 ? " (no model override)" : ` \xB7 model ${settings.model}`;
+  const lines = [
+    rule,
+    `Issue #${String(item.issue.number)} \u2014 ${item.issue.title}`,
+    rule,
+    `  Turn         ${item.turn}`,
+    `  Why          ${item.reason}`,
+    `  Branch       ${item.branch} (would check out${branchAction})`,
+    `  Assign       ${assignment}`,
+    `  Marker       would post on ${markerTarget}`,
+    `  Executor     ${settings.executor}${modelNote}`,
+    "  Permissions  bypassed (do-work always runs unattended)",
+    `  Prompt       ${String(run5.prompt.length)} chars \u2014 frame + assembled context`,
+    "",
+    "  Command that would be launched:",
+    // Printed flush-left and unindented on purpose: the prompt is a multi-line
+    // quoted argument, so indenting the continuation lines would inject leading
+    // whitespace into the prompt itself and the command would no longer be the
+    // one that runs.
+    rule,
+    run5.command,
+    rule,
+    ""
+  ];
+  return lines.join("\n") + "\n";
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function validateOptionalString(container, key, path) {
+  const value = container[key];
+  if (value === void 0 || value === null) return;
+  if (typeof value !== "string" || value.trim().length === 0) {
+    fail(`${path} must be a non-empty string.`);
+  }
+}
+function validateOptionalInt(container, key, path, min, hint) {
+  const value = container[key];
+  if (value === void 0 || value === null) return;
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < min) {
+    fail(`${path} must be ${hint}, got ${JSON.stringify(value)}.`);
+  }
+}
+function validateDoWorkConfig(section) {
+  if (section === void 0 || section === null) return;
+  if (!isPlainObject(section)) {
+    fail(`doWork must be an object, got ${JSON.stringify(section)}.`);
+  }
+  const executor = section["executor"];
+  if (executor !== void 0 && executor !== "claude" && executor !== "codex") {
+    fail(`doWork.executor must be 'claude' or 'codex', got ${JSON.stringify(executor)}.`);
+  }
+  validateOptionalString(section, "baseBranch", "doWork.baseBranch");
+  validateOptionalInt(section, "maxRunsPerTick", "doWork.maxRunsPerTick", 0, "a non-negative integer (0 = unlimited)");
+  validateOptionalInt(section, "lockStaleMinutes", "doWork.lockStaleMinutes", 1, "a positive integer");
+  const protectedBranches = section["protectedBranches"];
+  if (protectedBranches !== void 0 && protectedBranches !== null) {
+    if (!Array.isArray(protectedBranches) || protectedBranches.some((b) => typeof b !== "string" || b.trim().length === 0)) {
+      fail("doWork.protectedBranches must be an array of non-empty strings.");
+    }
+  }
+  for (const container of ["models", "prompts"]) {
+    const value = section[container];
+    if (value === void 0 || value === null) continue;
+    if (!isPlainObject(value)) {
+      fail(`doWork.${container} must be an object, got ${JSON.stringify(value)}.`);
+    }
+    const keys = container === "models" ? ["claude", "codex"] : ["issueDiscuss", "prWork"];
+    for (const key of keys) {
+      validateOptionalString(value, key, `doWork.${container}.${key}`);
+    }
+    for (const key of Object.keys(value)) {
+      if (!keys.includes(key)) {
+        fail(`doWork.${container}.${key} is not a recognised setting; expected one of: ${keys.join(", ")}.`);
+      }
+    }
+  }
+}
+function discoverIssues(settings) {
+  const candidates = listCandidateIssues(settings.technique, settings.discoveryValue, settings.limit);
+  if (settings.onlyIssue === void 0) {
+    if (candidates.length === settings.limit) {
+      progress(
+        `Note: fetched the maximum of ${String(settings.limit)} issues \u2014 there may be more. Use --limit to raise it.
+`
+      );
+    }
+    return candidates;
+  }
+  const match = candidates.find((issue) => issue.number === settings.onlyIssue);
+  if (match) return [match];
+  const surface = getIssueSurface(settings.onlyIssue);
+  if (!issueMatchesFilter(surface, settings)) {
+    progress(
+      `Note: issue #${String(settings.onlyIssue)} does not match the configured discovery filter (${settings.technique} = ${settings.discoveryValue}); processing it anyway because --issue was given.
+`
+    );
+  }
+  return [surface.issue];
+}
+function issueMatchesFilter(surface, settings) {
+  const value = settings.discoveryValue.toLowerCase();
+  switch (settings.technique) {
+    case "label":
+      return surface.labels.some((label) => label.toLowerCase() === value);
+    case "assignee":
+      return surface.assignees.some((assignee) => assignee.toLowerCase() === value);
+    case "title-contains":
+      return surface.issue.title.toLowerCase().includes(value);
+  }
+}
+function buildIssueState(issue, linkMap) {
+  const issueSurface = getIssueSurface(issue.number);
+  const linkedPrs = linkMap.byIssue.get(issue.number) ?? [];
+  const selected = selectLinkedPr(linkedPrs);
+  return {
+    issueSurface,
+    linkedPrs,
+    prSurface: selected === null ? null : getPrSurface(selected.number)
+  };
+}
+function describePlan(decisions) {
+  const lines = decisions.map((decision) => {
+    if (decision.kind === "skip") {
+      return `  #${String(decision.issue.number)} nothing to do \u2014 ${decision.detail}`;
+    }
+    const item = decision.item;
+    const claim = item.needsAssignment ? ", will assign to the agent" : "";
+    return `  #${String(item.issue.number)} ${item.turn} on ${item.branch} \u2014 ${item.reason}${claim}`;
+  });
+  return lines.length === 0 ? "  (no issues matched the discovery filter)\n" : lines.join("\n") + "\n";
+}
+function claimIssue(item, settings) {
+  if (!item.needsAssignment) return;
+  try {
+    assignIssueToAgent(item.issue.number, settings.participants.agentUser);
+    progress(`  assigned issue #${String(item.issue.number)} to ${settings.participants.agentUser}.
+`);
+  } catch (err) {
+    progress(`  warning: could not assign issue #${String(item.issue.number)}: ${err.message}
+`);
+  }
+}
+function notePickupOnIssue(item, marker) {
+  if (item.turn !== "pr-work" || item.pr === null || !item.issueAnalysis.hasNewMessage) return null;
+  try {
+    return postMarker(
+      "issue",
+      item.issue.number,
+      `automata do-work: picked this up on pull request #${String(item.pr.number)} \u2014 ${item.pr.url}`
+    );
+  } catch (err) {
+    progress(`  skipped: could not note the pickup on issue #${String(item.issue.number)} \u2014 ${err.message}
+`);
+    try {
+      deleteMarker(marker);
+    } catch (deleteErr) {
+      progress(`  warning: could not withdraw the working marker: ${deleteErr.message}
+`);
+    }
+    return false;
+  }
+}
+function reportIssueMessagesBuriedByNote(item, note, participants) {
+  const watermark = promptWatermark([item.issueAnalysis.messages]);
+  let buried;
+  try {
+    const messages = getIssueSurface(item.issue.number).messages;
+    buried = messagesBetween(messages, participants, watermark, note.createdAt);
+  } catch (err) {
+    progress(`  warning: could not re-read issue #${String(item.issue.number)}: ${err.message}
+`);
+    return 0;
+  }
+  if (buried.length === 0) return 0;
+  const authors = [...new Set(buried.map((message) => message.author))].join(", ");
+  try {
+    postMarker(
+      "issue",
+      item.issue.number,
+      `automata do-work: ${authors} posted here while this issue was being picked up, so ${buried.length === 1 ? "that message was" : "those messages were"} not included in the run. Please post again to have them acted on.`
+    );
+  } catch (err) {
+    progress(`  warning: could not report the buried issue message(s): ${err.message}
+`);
+  }
+  return buried.length;
+}
+function refreshItem(item, settings) {
+  const linkMap = getOpenPrLinkMap();
+  return decideWork(buildIssueState(item.issue, linkMap), settings.participants, {
+    baseBranch: settings.baseBranch,
+    defaultBranch: linkMap.defaultBranch,
+    protectedBranches: settings.protectedBranches
+  });
+}
+function readAnsweringSurface(item) {
+  if (item.turn === "issue-discuss" || item.pr === null) {
+    return getIssueSurface(item.issue.number).messages;
+  }
+  const surface = getPrSurface(item.pr.number);
+  return [...surface.messages, ...surface.threads.flatMap((thread) => thread.comments)];
+}
+function markerSurfaceLabel(item) {
+  return item.turn === "pr-work" && item.pr ? `pull request #${String(item.pr.number)}` : `issue #${String(item.issue.number)}`;
+}
+function markerSurfaceTarget(item) {
+  return item.turn === "pr-work" && item.pr ? { surface: "pr", number: item.pr.number } : { surface: "issue", number: item.issue.number };
+}
+function reportOvertakenMessages(item, analysis) {
+  if (analysis.missed.length === 0) return;
+  const authors = [...new Set(analysis.toReport.map((message) => message.author))].join(", ");
+  const count = analysis.toReport.length;
+  const target = markerSurfaceTarget(item);
+  try {
+    postMarker(
+      target.surface,
+      target.number,
+      `automata do-work: ${authors} posted here while this run was already in progress, so ${count === 1 ? "that message was" : "those messages were"} not included in it. Please post again to have them acted on.`
+    );
+  } catch (err) {
+    progress(`  warning: could not report the overtaken message(s): ${err.message}
+`);
+  }
+}
+function reconcileMarker(item, marker, participants, watermark, runError) {
+  let analysis;
+  try {
+    analysis = analyseAnswer(readAnsweringSurface(item), participants, marker, watermark);
+  } catch (err) {
+    progress(
+      `  warning: could not re-read issue #${String(item.issue.number)} to check for an answer: ${err.message}
+`
+    );
+    return reportUnverified(item, marker);
+  }
+  if (analysis.answeredAt !== null) {
+    reportOvertakenMessages(item, analysis);
+    try {
+      deleteMarker(marker);
+    } catch (err) {
+      progress(`  warning: could not delete the marker comment: ${err.message}
+`);
+    }
+    if (analysis.missed.length > 0) {
+      return {
+        outcome: "answered-no-reply",
+        detail: `answered (${String(analysis.toReport.length)} message(s) arrived mid-run and were flagged)`,
+        reason: "flagged"
+      };
+    }
+    return runError === null ? { outcome: "answered", detail: "answered", reason: "answered" } : { outcome: "answered", detail: `answered, but the run reported: ${runError.message}`, reason: "answered" };
+  }
+  return reportNoAnswer(item, marker, runError);
+}
+function reportUnverified(item, marker) {
+  const surface = markerSurfaceLabel(item);
+  try {
+    updateMarker(
+      marker,
+      `automata do-work: the agent run finished, but automata could not read ${surface} afterwards to confirm whether an answer was posted. Check this thread and the branch before assuming either. Reply here to have another attempt made.`
+    );
+  } catch (err) {
+    progress(`  warning: could not update the marker comment: ${err.message}
+`);
+  }
+  return {
+    outcome: "answered-no-reply",
+    detail: "could not verify whether an answer was posted",
+    reason: "unverified"
+  };
+}
+function reportNoAnswer(item, marker, runError) {
+  const surface = markerSurfaceLabel(item);
+  const sideEffects = item.turn === "issue-discuss" ? "It may still have created a branch or opened a pull request \u2014 check before assuming otherwise." : `It may still have changed the branch \`${item.branch}\` \u2014 check it before assuming otherwise.`;
+  const explanation = runError === null ? `automata do-work: the agent run finished without posting an answer on ${surface}. ${sideEffects} Reply on ${surface} to have another attempt made.` : `automata do-work: the agent run failed before posting an answer (${runError.message}). ${sideEffects} Reply on ${surface} to have another attempt made.`;
+  try {
+    updateMarker(marker, explanation);
+  } catch (err) {
+    progress(
+      `  warning: could not update the marker comment on issue #${String(item.issue.number)}: ${err.message}
+  the humans have not been told that this run produced no answer.
+`
+    );
+  }
+  return runError === null ? { outcome: "answered-no-reply", detail: "run finished but posted no answer", reason: "no-answer" } : { outcome: "failed", detail: `run failed: ${runError.message}`, reason: "no-answer" };
+}
+async function invokeExecutor(prompt, settings, silent) {
+  if (settings.executor === "codex") {
+    await runCodex(prompt, { model: settings.model });
+    return;
+  }
+  await runClaude(prompt, { model: settings.model, printSteps: !silent });
+}
+function repairIssueLink(item, baseBranch) {
+  try {
+    const branch = getCurrentBranch();
+    if (branch === baseBranch) {
+      progress(`  issue #${String(item.issue.number)} is still in discussion (no branch was created).
+`);
+      return false;
+    }
+    const pr = getCurrentBranchPr();
+    if (!pr) {
+      progress(`  issue #${String(item.issue.number)} is still in discussion (no pull request).
+`);
+      return false;
+    }
+    const closesRef = new RegExp(String.raw`\bcloses\s+#` + String(item.issue.number) + String.raw`\b`, "i");
+    if (closesRef.test(pr.body)) {
+      progress(`  pull request #${String(pr.number)} already closes issue #${String(item.issue.number)}.
+`);
+      return true;
+    }
+    addClosesRefToPr(pr.number, item.issue.number);
+    progress(`  linked pull request #${String(pr.number)} to issue #${String(item.issue.number)}.
+`);
+    return true;
+  } catch (err) {
+    progress(`  warning: could not link a pull request to issue #${String(item.issue.number)}: ${err.message}
+`);
+    return false;
+  }
+}
+async function processItem(planned, settings, silent) {
+  progress(`
+#${String(planned.issue.number)} ${planned.turn}: ${planned.reason}
+`);
+  const refreshed = refreshItem(planned, settings);
+  if (refreshed.kind === "skip") {
+    progress(`  skipped: ${refreshed.detail}
+`);
+    return {
+      issue: planned.issue.number,
+      title: planned.issue.title,
+      turn: planned.turn,
+      outcome: "skipped",
+      detail: `no longer actionable: ${refreshed.detail}`
+    };
+  }
+  const item = refreshed.item;
+  if (item.turn !== planned.turn) {
+    progress(`  turn changed to ${item.turn} since the plan was built; using the current state.
+`);
+  }
+  const base = {
+    issue: item.issue.number,
+    title: item.issue.title,
+    turn: item.turn
+  };
+  const prepared = item.turn === "issue-discuss" ? prepareBaseBranch(item.branch) : preparePrBranch(item.branch);
+  if (!prepared.ok) {
+    progress(`  skipped: ${prepared.reason} \u2014 ${prepared.detail}
+`);
+    return { ...base, outcome: "skipped", detail: `${prepared.reason}: ${prepared.detail}` };
+  }
+  claimIssue(item, settings);
+  let marker;
+  const markerSurface = item.turn === "pr-work" && item.pr ? item.pr.number : item.issue.number;
+  try {
+    marker = postMarker(item.turn === "pr-work" ? "pr" : "issue", markerSurface, "automata do-work: working\u2026");
+  } catch (err) {
+    progress(`  skipped: could not post the working marker \u2014 ${err.message}
+`);
+    return { ...base, outcome: "skipped", detail: `marker failed: ${err.message}` };
+  }
+  inFlightMarker = { marker, item };
+  const note = notePickupOnIssue(item, marker);
+  if (note === false) {
+    inFlightMarker = null;
+    return { ...base, outcome: "skipped", detail: "issue pickup note failed" };
+  }
+  let buriedByNote = 0;
+  if (note !== null) {
+    progress(`  noted on issue #${String(item.issue.number)} that the work is on pull request #${String(item.pr?.number ?? 0)}.
+`);
+    buriedByNote = reportIssueMessagesBuriedByNote(item, note, settings.participants);
+  }
+  const watermark = promptWatermark([
+    item.issueAnalysis.messages,
+    item.prAnalysis?.messages ?? [],
+    item.actionableThreads.flatMap((thread) => thread.comments)
+  ]);
+  const prompt = composePrompt({
+    item,
+    repo: getRepoSlug(),
+    agentUser: settings.participants.agentUser,
+    baseBranch: settings.baseBranch,
+    frame: settings.prompts[item.turn]
+  });
+  const MAX_PROMPT_BYTES = 96 * 1024;
+  const promptBytes = Buffer.byteLength(prompt, "utf8");
+  if (promptBytes > MAX_PROMPT_BYTES) {
+    const detail = `the composed prompt is ${String(Math.round(promptBytes / 1024))} KiB, over the ${String(MAX_PROMPT_BYTES / 1024)} KiB limit for a single command-line argument. The conversation is too long to hand to the executor this way.`;
+    progress(`  failed: ${detail}
+`);
+    inFlightMarker = null;
+    try {
+      updateMarker(
+        marker,
+        `automata do-work: could not start a run because ${detail} Summarise the discussion in a new issue, or shorten the thread, and try again.`
+      );
+    } catch (err) {
+      progress(`  warning: could not update the marker comment: ${err.message}
+`);
+    }
+    return { ...base, outcome: "failed", detail };
+  }
+  let runError = null;
+  try {
+    await invokeExecutor(prompt, settings, silent);
+  } catch (err) {
+    runError = err;
+  }
+  const ranExecutor = true;
+  inFlightMarker = null;
+  const reconciled = reconcileMarker(item, marker, settings.participants, watermark, runError);
+  progress(`  ${reconciled.detail}
+`);
+  let outcome = reconciled;
+  if (buriedByNote > 0 && outcome.outcome === "answered") {
+    outcome = {
+      outcome: "answered-no-reply",
+      detail: `${outcome.detail} (${String(buriedByNote)} issue message(s) were buried by the pickup note and flagged)`,
+      reason: "flagged"
+    };
+  }
+  if (item.turn === "issue-discuss") {
+    const linked = repairIssueLink(item, settings.baseBranch);
+    if (linked && outcome.reason === "no-answer") {
+      outcome = {
+        outcome: "answered",
+        detail: "opened a pull request (no issue comment)",
+        reason: "answered"
+      };
+      progress("  a pull request was opened, so the turn is counted as answered.\n");
+    }
+  }
+  return { ...base, outcome: outcome.outcome, detail: outcome.detail, ranExecutor };
+}
+function summarize(reports) {
+  out("\nTick summary:\n");
+  if (reports.length === 0) {
+    out("  nothing to do\n");
+    return;
+  }
+  for (const report of reports) {
+    out(`  #${String(report.issue)} ${report.turn ?? "-"} ${report.outcome} \u2014 ${report.detail}
+`);
+  }
+}
+var doWorkCommand = new Command6("do-work").description(
+  "Run one tick of the autonomous loop: find the issues whose newest authorized message the agent has not answered, and answer them"
+).option("--with <executor>", "Executor to use: claude or codex (default: from config, else claude)").option("--model <string>", "Model identifier to pass to the executor, overriding the configured default for it").option("--issue <number>", "Restrict the tick to a single issue").option("--limit <n>", "Maximum number of issues to fetch", "10").option("--max-runs <n>", "Maximum number of model runs this tick").option(
+  "--dry-run",
+  "Print the work plan, plus a summary and the exact command that would be launched for each item, and exit without changing anything"
+).option("--json", "Emit the work plan and outcomes as JSON on stdout").option("--silent", "Suppress step-by-step Claude output; show only the final summary").action(async (options) => {
+  const settings = resolveSettings(options);
+  if (options.dryRun === true) {
+    const exitCode2 = await runTick(settings, options);
+    if (exitCode2 !== 0) process.exit(exitCode2);
+    return;
+  }
+  const lock = acquireRunLock("do-work", settings.lockStaleMinutes);
+  if (!lock.ok) {
+    const held = lock.heldBy;
+    const sentence = `Another automata instance is already running here (pid ${String(held.pid)} on ${held.host}, started ${held.startedAt}, command ${held.command}). Doing nothing.
+`;
+    const suspectSentence = lock.suspect ? `Warning: that lock has been held longer than ${String(settings.lockStaleMinutes)} minutes. If no tick is really running, its process id was probably reused; remove ${RUN_LOCK_RELATIVE_PATH} once you have confirmed that.
+` : "";
+    const exitCode2 = lock.suspect ? 2 : 0;
+    if (options.json === true) {
+      progress(sentence + suspectSentence);
+      out(
+        JSON.stringify(
+          { lockHeld: true, suspect: lock.suspect, heldBy: held, plan: [], items: [], exitCode: exitCode2 },
+          null,
+          2
+        ) + "\n"
+      );
+    } else {
+      out(sentence);
+      if (suspectSentence) progress(suspectSentence);
+    }
+    if (exitCode2 !== 0) process.exit(exitCode2);
+    return;
+  }
+  const handle = lock.handle;
+  let shuttingDown = false;
+  const onSignal = () => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    progress("\nInterrupted: stopping the executor before releasing the run lock\u2026\n");
+    const pending = inFlightMarker;
+    if (pending !== null) {
+      try {
+        updateMarker(
+          pending.marker,
+          `automata do-work: this run was interrupted before it finished, so no answer was produced. The branch \`${pending.item.branch}\` may have been changed. Reply here to have another attempt made.`
+        );
+      } catch (err) {
+        progress(`Warning: could not update the in-flight marker: ${err.message}
+`);
+      }
+    }
+    void terminateTrackedChildren().then((allExited) => {
+      if (allExited) {
+        handle.release();
+      } else {
+        progress(
+          "Warning: could not confirm the executor exited; leaving the run lock in place. Check for a stray executor process before the next tick.\n"
+        );
+      }
+      process.exit(130);
+    });
+  };
+  process.once("SIGINT", onSignal);
+  process.once("SIGTERM", onSignal);
+  let exitCode;
+  try {
+    exitCode = await runTick(settings, options);
+  } catch (err) {
+    process.stderr.write(`Error: ${err.message}
+`);
+    exitCode = 1;
+  } finally {
+    handle.release();
+    process.removeListener("SIGINT", onSignal);
+    process.removeListener("SIGTERM", onSignal);
+  }
+  if (exitCode !== 0) process.exit(exitCode);
+});
+async function runTick(settings, options) {
+  const issues = discoverIssues(settings);
+  const linkMap = getOpenPrLinkMap();
+  const decisions = issues.map(
+    (issue) => decideWork(buildIssueState(issue, linkMap), settings.participants, {
+      baseBranch: settings.baseBranch,
+      defaultBranch: linkMap.defaultBranch,
+      protectedBranches: settings.protectedBranches
+    })
+  );
+  const items = decisions.flatMap((decision) => decision.kind === "work" ? [decision.item] : []);
+  const planText = `Work plan (${String(items.length)} of ${String(issues.length)} issues need an answer):
+${describePlan(decisions)}`;
+  if (options.json) {
+    progress(planText);
+  } else {
+    out(planText);
+  }
+  if (options.dryRun) {
+    reportDryRun(items, decisions, settings, options);
+    return 0;
+  }
+  const reports = [];
+  const deferred = [];
+  let runsUsed = 0;
+  for (const item of items) {
+    if (settings.maxRuns > 0 && runsUsed >= settings.maxRuns) {
+      deferred.push(item);
+      continue;
+    }
+    let report;
+    try {
+      report = await processItem(item, settings, options.silent === true);
+    } catch (err) {
+      progress(`  failed: ${err.message}
+`);
+      report = {
+        issue: item.issue.number,
+        title: item.issue.title,
+        turn: item.turn,
+        outcome: "failed",
+        detail: err.message
+      };
+    }
+    if (report.ranExecutor === true) runsUsed++;
+    reports.push(report);
+  }
+  for (const item of deferred) {
+    progress(`
+#${String(item.issue.number)} deferred: --max-runs / maxRunsPerTick reached.
+`);
+    reports.push({
+      issue: item.issue.number,
+      title: item.issue.title,
+      turn: item.turn,
+      outcome: "deferred",
+      detail: `run cap of ${String(settings.maxRuns)} reached`
+    });
+  }
+  const degraded = reports.some((report) => report.outcome !== "answered");
+  const exitCode = degraded ? 2 : 0;
+  if (options.json) {
+    out(JSON.stringify({ dryRun: false, plan: decisions.map(toPlanJson), items: reports, exitCode }, null, 2) + "\n");
+  } else {
+    summarize(reports);
+  }
+  return exitCode;
+}
+function reportDryRun(items, decisions, settings, options) {
+  const describable = settings.maxRuns > 0 ? items.slice(0, settings.maxRuns) : items;
+  const planned = describable.map((item) => planRun(item, settings));
+  if (options.json) {
+    out(
+      JSON.stringify(
+        {
+          dryRun: true,
+          plan: decisions.map(toPlanJson),
+          runs: planned.map((run5, index) => ({
+            issue: describable[index].issue.number,
+            turn: describable[index].turn,
+            executor: settings.executor,
+            model: settings.model ?? null,
+            bin: run5.bin,
+            args: run5.args,
+            command: run5.command,
+            prompt: run5.prompt
+          }))
+        },
+        null,
+        2
+      ) + "\n"
+    );
+    return;
+  }
+  for (const [index, run5] of planned.entries()) {
+    out("\n" + describePlannedRun(describable[index], settings, run5));
+  }
+  const deferred = items.length - describable.length;
+  if (deferred > 0) {
+    out(`
+(${String(deferred)} further item(s) deferred by the run cap.)
+`);
+  }
+  out("\nDry run: nothing was assigned, posted, checked out or executed.\n");
+}
+function toPlanJson(decision) {
+  if (decision.kind === "skip") {
+    return {
+      issue: decision.issue.number,
+      title: decision.issue.title,
+      turn: null,
+      skipReason: decision.reason,
+      reason: decision.detail
+    };
+  }
+  const item = decision.item;
+  return {
+    issue: item.issue.number,
+    title: item.issue.title,
+    turn: item.turn,
+    branch: item.branch,
+    pr: item.pr?.number ?? null,
+    needsAssignment: item.needsAssignment,
+    reason: item.reason
+  };
+}
 
 // src/index.ts
-var program = new Command6();
+var program = new Command7();
 program.name("automata").description("Automata CLI tool").version(version, "-v, --version");
 program.addCommand(configCommand);
-program.addCommand(gitCommand);
+program.addCommand(gitCommand2);
 program.addCommand(implementNextCommand);
 program.addCommand(executeCommand);
 program.addCommand(executePromptCommand);
+program.addCommand(doWorkCommand);
 program.showHelpAfterError();
 program.parse();
 if (process.argv.length <= 2) {