xforce 0.1.0 → 0.1.2

package/dist/cli/index.js

@@ -310,10 +310,10 @@ function resolveRepoConfig(config, owner, name) {
   };
 }
 
-// src/pipeline/orchestrator.ts
-import { nanoid } from "nanoid";
-import { rm } from "fs/promises";
-import ora from "ora";
+// src/core/credentials.ts
+import { existsSync as existsSync2, mkdirSync, writeFileSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
 
 // src/core/logger.ts
 import pino from "pino";
@@ -335,6 +335,44 @@ function createChildLogger(name) {
   return logger.child({ component: name });
 }
 
+// src/core/credentials.ts
+var log = createChildLogger("credentials");
+function getClaudeConfigDir() {
+  return process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), ".claude");
+}
+function ensureCredentials() {
+  const configDir = getClaudeConfigDir();
+  const credPath = join(configDir, ".credentials.json");
+  const envCreds = process.env.CLAUDE_CREDENTIALS;
+  if (existsSync2(credPath)) {
+    log.debug({ path: credPath }, "Credentials file exists");
+    return;
+  }
+  if (!envCreds) {
+    throw new Error(
+      `Claude Code credentials not found. Either:
+  1. Log in with 'claude' CLI locally, or
+  2. Set CLAUDE_CREDENTIALS env var with the JSON credentials content.
+  Checked path: ${credPath}`
+    );
+  }
+  try {
+    JSON.parse(envCreds);
+  } catch {
+    throw new Error(
+      "CLAUDE_CREDENTIALS env var contains invalid JSON. It should be the contents of .credentials.json from a Claude Code login."
+    );
+  }
+  mkdirSync(configDir, { recursive: true });
+  writeFileSync(credPath, envCreds, { mode: 384 });
+  log.info({ path: credPath }, "Wrote Claude Code credentials from env var");
+}
+
+// src/pipeline/orchestrator.ts
+import { nanoid } from "nanoid";
+import { rm } from "fs/promises";
+import ora from "ora";
+
 // src/pipeline/state-machine.ts
 var VALID_TRANSITIONS = {
   parsing_issue: ["creating_branch", "failed"],
@@ -374,13 +412,13 @@ ${truncated}`;
 
 // src/github/client.ts
 import { Octokit } from "@octokit/rest";
-var log = createChildLogger("github");
+var log2 = createChildLogger("github");
 var RETRY_OPTIONS = {
   maxRetries: 3,
   baseDelayMs: 1e3,
   maxDelayMs: 3e4,
   onRetry: (error, attempt) => {
-    log.warn({ error: error.message, attempt }, "GitHub API call failed, retrying");
+    log2.warn({ error: error.message, attempt }, "GitHub API call failed, retrying");
   }
 };
 async function withGitHubRetry(fn) {
@@ -415,7 +453,7 @@ function getOctokit() {
 async function getIssue(owner, repo, issueNumber) {
   return withGitHubRetry(async () => {
     const octokit = getOctokit();
-    log.debug({ owner, repo, issueNumber }, "Fetching issue");
+    log2.debug({ owner, repo, issueNumber }, "Fetching issue");
     const { data } = await octokit.issues.get({ owner, repo, issue_number: issueNumber });
     return data;
   });
@@ -434,13 +472,13 @@ async function getIssueLabels(owner, repo, issueNumber) {
 async function addLabel(owner, repo, issueNumber, label) {
   return withGitHubRetry(async () => {
     const octokit = getOctokit();
-    log.debug({ owner, repo, issueNumber, label }, "Adding label");
+    log2.debug({ owner, repo, issueNumber, label }, "Adding label");
     await octokit.issues.addLabels({ owner, repo, issue_number: issueNumber, labels: [label] });
   });
 }
 async function removeLabel(owner, repo, issueNumber, label) {
   const octokit = getOctokit();
-  log.debug({ owner, repo, issueNumber, label }, "Removing label");
+  log2.debug({ owner, repo, issueNumber, label }, "Removing label");
   try {
     await octokit.issues.removeLabel({ owner, repo, issue_number: issueNumber, name: label });
   } catch {
@@ -449,7 +487,7 @@ async function removeLabel(owner, repo, issueNumber, label) {
 async function addComment(owner, repo, issueNumber, body) {
   return withGitHubRetry(async () => {
     const octokit = getOctokit();
-    log.debug({ owner, repo, issueNumber }, "Adding comment");
+    log2.debug({ owner, repo, issueNumber }, "Adding comment");
     const { data } = await octokit.issues.createComment({
       owner,
       repo,
@@ -462,7 +500,7 @@ async function addComment(owner, repo, issueNumber, body) {
 async function getPRDiff(owner, repo, prNumber) {
   return withGitHubRetry(async () => {
     const octokit = getOctokit();
-    log.debug({ owner, repo, prNumber }, "Fetching PR diff");
+    log2.debug({ owner, repo, prNumber }, "Fetching PR diff");
     const { data } = await octokit.pulls.get({
       owner,
       repo,
@@ -497,7 +535,7 @@ function parsePRUrl(url) {
 async function getPR(owner, repo, prNumber) {
   return withGitHubRetry(async () => {
     const octokit = getOctokit();
-    log.debug({ owner, repo, prNumber }, "Fetching PR");
+    log2.debug({ owner, repo, prNumber }, "Fetching PR");
     const { data } = await octokit.pulls.get({ owner, repo, pull_number: prNumber });
     return data;
   });
@@ -601,7 +639,7 @@ function parseIssueBody(params) {
 
 // src/github/branch.ts
 import { tmpdir } from "os";
-import { join } from "path";
+import { join as join2 } from "path";
 import { mkdtemp, access, writeFile } from "fs/promises";
 import { simpleGit } from "simple-git";
 var DEFAULT_GITIGNORE = `node_modules/
@@ -614,7 +652,7 @@ build/
 *.tsbuildinfo
 .DS_Store
 `;
-var log2 = createChildLogger("git");
+var log3 = createChildLogger("git");
 function slugify(text) {
   return text.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 40);
 }
@@ -623,13 +661,13 @@ async function setupBranch(params) {
   const slug = slugify(issueTitle);
   const branchName = `${branchPrefix}/${issueNumber}-${slug}`;
   if (localDir) {
-    log2.info({ workDir: localDir, branchName }, "Using local repository");
+    log3.info({ workDir: localDir, branchName }, "Using local repository");
     const repoGit2 = simpleGit(localDir);
     await repoGit2.fetch("origin");
     const status = await repoGit2.status();
     const hadChanges = status.files.length > 0;
     if (hadChanges) {
-      log2.info("Stashing local changes");
+      log3.info("Stashing local changes");
       await repoGit2.stash();
     }
     try {
@@ -639,34 +677,34 @@ async function setupBranch(params) {
     }
     await repoGit2.addConfig("user.name", "X-Force Bot");
     await repoGit2.addConfig("user.email", "xforce-bot@users.noreply.github.com");
-    log2.info({ branchName }, "Branch created");
+    log3.info({ branchName }, "Branch created");
     return { workDir: localDir, branchName, git: repoGit2, isLocal: true };
   }
   const cloneUrl = `https://x-access-token:${process.env.GITHUB_TOKEN}@github.com/${owner}/${repo}.git`;
-  const workDir = await mkdtemp(join(tmpdir(), `xforce-${repo}-`));
-  log2.info({ workDir, branchName }, "Cloning repository");
+  const workDir = await mkdtemp(join2(tmpdir(), `xforce-${repo}-`));
+  log3.info({ workDir, branchName }, "Cloning repository");
   const git = simpleGit();
   await git.clone(cloneUrl, workDir, ["--depth", "1", "--branch", defaultBranch]);
   const repoGit = simpleGit(workDir);
   await repoGit.addConfig("user.name", "X-Force Bot");
   await repoGit.addConfig("user.email", "xforce-bot@users.noreply.github.com");
   await repoGit.checkoutLocalBranch(branchName);
-  const gitignorePath = join(workDir, ".gitignore");
+  const gitignorePath = join2(workDir, ".gitignore");
   try {
     await access(gitignorePath);
   } catch {
-    log2.info("Creating default .gitignore");
+    log3.info("Creating default .gitignore");
     await writeFile(gitignorePath, DEFAULT_GITIGNORE, "utf-8");
   }
-  log2.info({ branchName }, "Branch created");
+  log3.info({ branchName }, "Branch created");
   return { workDir, branchName, git: repoGit, isLocal: false };
 }
 async function restoreDefaultBranch(git, defaultBranch) {
   try {
     await git.checkout(defaultBranch);
-    log2.info({ branch: defaultBranch }, "Restored default branch");
+    log3.info({ branch: defaultBranch }, "Restored default branch");
   } catch (error) {
-    log2.warn({ error: String(error) }, "Failed to restore default branch");
+    log3.warn({ error: String(error) }, "Failed to restore default branch");
   }
 }
 async function commitAndPush(params) {
@@ -674,23 +712,23 @@ async function commitAndPush(params) {
   await git.add("-A");
   const status = await git.status();
   if (status.staged.length === 0 && status.files.length === 0) {
-    log2.warn("No changes to commit");
+    log3.warn("No changes to commit");
     return "";
   }
   const commitResult = await git.commit(message);
-  log2.info({ sha: commitResult.commit }, "Changes committed");
+  log3.info({ sha: commitResult.commit }, "Changes committed");
   await git.push("origin", branchName, ["--set-upstream", "--force"]);
-  log2.info({ branchName }, "Pushed to remote");
+  log3.info({ branchName }, "Pushed to remote");
   return commitResult.commit;
 }
 
 // src/github/pr.ts
-var log3 = createChildLogger("pr");
+var log4 = createChildLogger("pr");
 async function createPullRequest(params) {
   const { owner, repo, branchName, defaultBranch, taskSpec, pipeline } = params;
   const octokit = getOctokit();
   const body = buildPRBody(taskSpec, pipeline);
-  log3.info({ owner, repo, branchName }, "Creating pull request");
+  log4.info({ owner, repo, branchName }, "Creating pull request");
   const { data } = await octokit.pulls.create({
     owner,
     repo,
@@ -699,7 +737,7 @@ async function createPullRequest(params) {
     head: branchName,
     base: defaultBranch
   });
-  log3.info({ prNumber: data.number, prUrl: data.html_url }, "PR created");
+  log4.info({ prNumber: data.number, prUrl: data.html_url }, "PR created");
   return { prNumber: data.number, prUrl: data.html_url };
 }
 async function updatePullRequest(params) {
@@ -719,7 +757,7 @@ async function commentOnPR(owner, repo, prNumber, body) {
 async function mergePR(params) {
   const { owner, repo, prNumber, strategy, commitTitle } = params;
   const octokit = getOctokit();
-  log3.info({ owner, repo, prNumber, strategy }, "Attempting to merge PR");
+  log4.info({ owner, repo, prNumber, strategy }, "Attempting to merge PR");
   try {
     const { data } = await octokit.pulls.merge({
       owner,
@@ -728,14 +766,14 @@ async function mergePR(params) {
       merge_method: strategy,
       commit_title: commitTitle
     });
-    log3.info({ sha: data.sha, merged: data.merged }, "PR merge result");
+    log4.info({ sha: data.sha, merged: data.merged }, "PR merge result");
     return { merged: data.merged, sha: data.sha };
   } catch (error) {
     const err = error;
     const message = err.message ?? String(error);
     const status = err.status;
     if (status === 405 || status === 409) {
-      log3.warn({ status, message }, "PR cannot be auto-merged");
+      log4.warn({ status, message }, "PR cannot be auto-merged");
       return { merged: false, error: message };
     }
     throw error;
@@ -916,7 +954,7 @@ Follow this plan closely. If you discover the plan is incorrect or incomplete, a
 }
 
 // src/agents/coder.ts
-var log4 = createChildLogger("coder");
+var log5 = createChildLogger("coder");
 function truncate(s, max) {
   return s.length > max ? s.slice(0, max) + "..." : s;
 }
@@ -954,7 +992,7 @@ async function runCodingAgent(params) {
   if (commandFailures) {
     prompt += "\n\n" + buildCommandFailureFeedbackSection(commandFailures.kind, commandFailures.output);
   }
-  log4.info(
+  log5.info(
     {
       task: taskSpec.title,
       model: repoConfig.model,
@@ -965,6 +1003,7 @@ async function runCodingAgent(params) {
     },
     "Starting coding agent"
   );
+  let stderrOutput = "";
   const result = query({
     prompt,
     options: {
@@ -980,30 +1019,45 @@ async function runCodingAgent(params) {
         preset: "claude_code",
         append: CODER_SYSTEM_PROMPT_APPEND
       },
+      stderr: (data) => {
+        stderrOutput += data;
+        log5.debug({ stderr: data.trimEnd() }, "Agent SDK stderr");
+      },
       ...sessionId ? { resume: sessionId } : {}
     }
   });
   let resultMessage;
-  for await (const message of result) {
-    if (message.type === "assistant" && "content" in message) {
-      const content = message.content;
-      for (const block of content) {
-        if (block.type === "tool_use" && block.name) {
-          const detail = describeToolUse(block.name, block.input);
-          log4.info({ tool: block.name }, detail);
-          onProgress?.(detail);
+  try {
+    for await (const message of result) {
+      if (message.type === "assistant" && "content" in message) {
+        const content = message.content;
+        for (const block of content) {
+          if (block.type === "tool_use" && block.name) {
+            const detail = describeToolUse(block.name, block.input);
+            log5.info({ tool: block.name }, detail);
+            onProgress?.(detail);
+          }
         }
       }
+      if (message.type === "result") {
+        resultMessage = message;
+      }
     }
-    if (message.type === "result") {
-      resultMessage = message;
-    }
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    const stderrDetail = stderrOutput ? `
+stderr:
+${stderrOutput.slice(0, 2e3)}` : "";
+    throw new CodingAgentError(`Coding agent process failed: ${msg}${stderrDetail}`, [], 0);
   }
   if (!resultMessage) {
-    throw new CodingAgentError("No result message received from coding agent", [], 0);
+    const detail = stderrOutput ? `
+stderr:
+${stderrOutput.slice(0, 2e3)}` : "";
+    throw new CodingAgentError(`No result message received from coding agent${detail}`, [], 0);
   }
   if (resultMessage.subtype === "error_max_turns") {
-    log4.warn(
+    log5.warn(
       {
         cost: resultMessage.total_cost_usd,
         turns: resultMessage.num_turns
@@ -1018,13 +1072,16 @@ async function runCodingAgent(params) {
     };
   }
   if (resultMessage.subtype !== "success") {
+    const stderrDetail = stderrOutput ? `
+stderr:
+${stderrOutput.slice(0, 2e3)}` : "";
     throw new CodingAgentError(
-      `Coding agent failed: ${resultMessage.subtype}`,
+      `Coding agent failed: ${resultMessage.subtype}${stderrDetail}`,
       "errors" in resultMessage ? resultMessage.errors : [],
       resultMessage.total_cost_usd
     );
   }
-  log4.info(
+  log5.info(
     {
       cost: resultMessage.total_cost_usd,
       turns: resultMessage.num_turns
@@ -1042,7 +1099,7 @@ async function runCodingAgent(params) {
 // src/agents/planner.ts
 import { query as query2 } from "@anthropic-ai/claude-agent-sdk";
 import { z as z2 } from "zod";
-var log5 = createChildLogger("planner");
+var log6 = createChildLogger("planner");
 var ImplementationStepSchema = z2.object({
   order: z2.number().int().positive(),
   description: z2.string(),
@@ -1109,10 +1166,11 @@ function validatePlan(parsed) {
 async function runPlanningAgent(params) {
   const { taskSpec, repoConfig, workingDir, onProgress } = params;
   const prompt = buildPlannerPrompt(taskSpec);
-  log5.info(
+  log6.info(
     { task: taskSpec.title, model: repoConfig.plannerModel },
     "Starting planning agent"
   );
+  let stderrOutput = "";
   const result = query2({
     prompt,
     options: {
@@ -1126,34 +1184,49 @@ async function runPlanningAgent(params) {
       outputFormat: {
         type: "json_schema",
         schema: PLAN_JSON_SCHEMA
+      },
+      stderr: (data) => {
+        stderrOutput += data;
+        log6.debug({ stderr: data.trimEnd() }, "Agent SDK stderr");
       }
     }
   });
   let resultMessage;
   let lastAssistantText = "";
-  for await (const message of result) {
-    if (message.type === "assistant" && "content" in message) {
-      const content = message.content;
-      for (const block of content) {
-        if (block.type === "tool_use" && block.name) {
-          const detail = describeToolUse(block.name, block.input);
-          log5.info({ tool: block.name }, detail);
-          onProgress?.(detail);
+  try {
+    for await (const message of result) {
+      if (message.type === "assistant" && "content" in message) {
+        const content = message.content;
+        for (const block of content) {
+          if (block.type === "tool_use" && block.name) {
+            const detail = describeToolUse(block.name, block.input);
+            log6.info({ tool: block.name }, detail);
+            onProgress?.(detail);
+          }
+        }
+        const textParts = content.filter((c) => c.type === "text" && c.text).map((c) => c.text);
+        if (textParts.length > 0) {
+          lastAssistantText = textParts.join("\n");
         }
       }
-      const textParts = content.filter((c) => c.type === "text" && c.text).map((c) => c.text);
-      if (textParts.length > 0) {
-        lastAssistantText = textParts.join("\n");
+      if (message.type === "result") {
+        resultMessage = message;
       }
     }
-    if (message.type === "result") {
-      resultMessage = message;
-    }
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    const stderrDetail = stderrOutput ? `
+stderr:
+${stderrOutput.slice(0, 2e3)}` : "";
+    throw new PipelineError(`Planning agent process failed: ${msg}${stderrDetail}`);
   }
   if (!resultMessage) {
-    throw new PipelineError("No result message received from planning agent");
+    const detail = stderrOutput ? `
+stderr:
+${stderrOutput.slice(0, 2e3)}` : "";
+    throw new PipelineError(`No result message received from planning agent${detail}`);
   }
-  log5.debug(
+  log6.debug(
     {
       subtype: resultMessage.subtype,
       hasStructuredOutput: "structured_output" in resultMessage && !!resultMessage.structured_output,
@@ -1167,12 +1240,15 @@ async function runPlanningAgent(params) {
   const isMaxTurns = resultMessage.subtype === "error_max_turns";
   if (!isSuccess && !isMaxTurns) {
     const errorDetail = "errors" in resultMessage ? resultMessage.errors.join(", ") : "unknown";
+    const stderrDetail = stderrOutput ? `
+stderr:
+${stderrOutput.slice(0, 2e3)}` : "";
     throw new PipelineError(
-      `Planning agent failed (${resultMessage.subtype}): ${errorDetail}`
+      `Planning agent failed (${resultMessage.subtype}): ${errorDetail}${stderrDetail}`
     );
   }
   if (isMaxTurns) {
-    log5.warn("Planning agent hit max turns \u2014 attempting to extract plan");
+    log6.warn("Planning agent hit max turns \u2014 attempting to extract plan");
   }
   let parsed;
   if ("structured_output" in resultMessage && resultMessage.structured_output) {
@@ -1187,7 +1263,7 @@ async function runPlanningAgent(params) {
       );
     }
   } else if (lastAssistantText) {
-    log5.warn("No result output \u2014 extracting plan from last assistant message");
+    log6.warn("No result output \u2014 extracting plan from last assistant message");
     const jsonStr = extractJSON(lastAssistantText);
     try {
       parsed = JSON.parse(jsonStr);
@@ -1200,7 +1276,7 @@ async function runPlanningAgent(params) {
     throw new PipelineError("Planning agent produced no output");
   }
   const plan = validatePlan(parsed);
-  log5.info(
+  log6.info(
     {
       complexity: plan.estimatedComplexity,
       steps: plan.implementationSteps.length,
@@ -1282,7 +1358,7 @@ Provide your review as a JSON object matching the specified schema.`;
 }
 
 // src/agents/reviewer.ts
-var log6 = createChildLogger("reviewer");
+var log7 = createChildLogger("reviewer");
 var ReviewIssueSchema = z3.object({
   severity: z3.enum(["critical", "major", "minor", "suggestion"]),
   file: z3.string(),
@@ -1355,11 +1431,12 @@ function validateReviewResult(parsed) {
 }
 async function runReviewerAgent(params) {
   const { taskSpec, diff, repoConfig, reviewCycle } = params;
-  log6.info(
+  log7.info(
     { model: repoConfig.reviewerModel, cycle: reviewCycle },
     "Starting reviewer agent"
   );
   const userPrompt = buildReviewerUserPrompt(taskSpec, diff, reviewCycle);
+  let stderrOutput = "";
   const agentResult = query3({
     prompt: userPrompt,
     options: {
@@ -1372,33 +1449,51 @@ async function runReviewerAgent(params) {
       outputFormat: {
         type: "json_schema",
         schema: REVIEW_JSON_SCHEMA
+      },
+      stderr: (data) => {
+        stderrOutput += data;
+        log7.debug({ stderr: data.trimEnd() }, "Agent SDK stderr");
       }
     }
   });
   let resultMessage;
   let lastAssistantText = "";
-  for await (const message of agentResult) {
-    if (message.type === "assistant" && "content" in message) {
-      const textParts = message.content.filter((c) => c.type === "text" && c.text).map((c) => c.text);
-      if (textParts.length > 0) {
-        lastAssistantText = textParts.join("\n");
+  try {
+    for await (const message of agentResult) {
+      if (message.type === "assistant" && "content" in message) {
+        const textParts = message.content.filter((c) => c.type === "text" && c.text).map((c) => c.text);
+        if (textParts.length > 0) {
+          lastAssistantText = textParts.join("\n");
+        }
+      }
+      if (message.type === "result") {
+        resultMessage = message;
       }
     }
-    if (message.type === "result") {
-      resultMessage = message;
-    }
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    const stderrDetail = stderrOutput ? `
+stderr:
+${stderrOutput.slice(0, 2e3)}` : "";
+    throw new ReviewerError(`Reviewer agent process failed: ${msg}${stderrDetail}`);
   }
   if (!resultMessage) {
-    throw new ReviewerError("No result message received from reviewer agent");
+    const detail = stderrOutput ? `
+stderr:
+${stderrOutput.slice(0, 2e3)}` : "";
+    throw new ReviewerError(`No result message received from reviewer agent${detail}`);
   }
   const isSuccess = resultMessage.subtype === "success";
   const isMaxTurns = resultMessage.subtype === "error_max_turns";
   if (!isSuccess && !isMaxTurns) {
     const errorDetail = "errors" in resultMessage ? resultMessage.errors.join(", ") : "unknown";
-    throw new ReviewerError(`Reviewer agent failed (${resultMessage.subtype}): ${errorDetail}`);
+    const stderrDetail = stderrOutput ? `
+stderr:
+${stderrOutput.slice(0, 2e3)}` : "";
+    throw new ReviewerError(`Reviewer agent failed (${resultMessage.subtype}): ${errorDetail}${stderrDetail}`);
   }
   if (isMaxTurns) {
-    log6.warn("Reviewer hit max turns \u2014 attempting to extract result");
+    log7.warn("Reviewer hit max turns \u2014 attempting to extract result");
   }
   let parsed;
   if ("structured_output" in resultMessage && resultMessage.structured_output) {
@@ -1411,7 +1506,7 @@ async function runReviewerAgent(params) {
       throw new ReviewerError(`Reviewer returned invalid JSON: ${String(resultMessage.result).slice(0, 200)}`);
     }
   } else if (lastAssistantText) {
-    log6.warn("No result output \u2014 extracting review from last assistant message");
+    log7.warn("No result output \u2014 extracting review from last assistant message");
     const jsonStr = extractJSON2(lastAssistantText);
     try {
       parsed = JSON.parse(jsonStr);
@@ -1424,7 +1519,7 @@ async function runReviewerAgent(params) {
     throw new ReviewerError("Reviewer agent produced no output");
   }
   const review = validateReviewResult(parsed);
-  log6.info(
+  log7.info(
     {
       approved: review.approved,
       issueCount: review.issues.length,
@@ -1438,7 +1533,7 @@ async function runReviewerAgent(params) {
 // src/agents/security-scanner.ts
 import { query as query4 } from "@anthropic-ai/claude-agent-sdk";
 import { z as z4 } from "zod";
-var log7 = createChildLogger("security-scanner");
+var log8 = createChildLogger("security-scanner");
 var SecurityFindingSchema = z4.object({
   severity: z4.enum(["critical", "high", "medium", "low", "info"]),
   category: z4.string(),
@@ -1517,7 +1612,7 @@ function validateReport(parsed) {
 }
 async function runSecurityScanner(params) {
   const { taskSpec, diff, repoConfig } = params;
-  log7.info({ task: taskSpec.title, model: repoConfig.reviewerModel }, "Starting security scan");
+  log8.info({ task: taskSpec.title, model: repoConfig.reviewerModel }, "Starting security scan");
   const prompt = `## Security Review Request
 
 **Task**: ${taskSpec.title}
@@ -1530,6 +1625,7 @@ ${diff}
 \`\`\`
 
 Analyze this diff for security vulnerabilities. Provide your report as a JSON object matching the required schema.`;
+  let stderrOutput = "";
   const result = query4({
     prompt,
     options: {
@@ -1542,31 +1638,49 @@ Analyze this diff for security vulnerabilities. Provide your report as a JSON ob
       outputFormat: {
         type: "json_schema",
         schema: SECURITY_REPORT_JSON_SCHEMA
+      },
+      stderr: (data) => {
+        stderrOutput += data;
+        log8.debug({ stderr: data.trimEnd() }, "Agent SDK stderr");
       }
     }
   });
   let resultMessage;
   let lastAssistantText = "";
-  for await (const message of result) {
-    if (message.type === "assistant" && "content" in message) {
-      const textParts = message.content.filter((c) => c.type === "text" && c.text).map((c) => c.text);
-      if (textParts.length > 0) {
-        lastAssistantText = textParts.join("\n");
+  try {
+    for await (const message of result) {
+      if (message.type === "assistant" && "content" in message) {
+        const textParts = message.content.filter((c) => c.type === "text" && c.text).map((c) => c.text);
+        if (textParts.length > 0) {
+          lastAssistantText = textParts.join("\n");
+        }
+      }
+      if (message.type === "result") {
+        resultMessage = message;
       }
     }
-    if (message.type === "result") {
-      resultMessage = message;
-    }
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    const stderrDetail = stderrOutput ? `
+stderr:
+${stderrOutput.slice(0, 2e3)}` : "";
+    throw new PipelineError(`Security scanner process failed: ${msg}${stderrDetail}`);
   }
   if (!resultMessage) {
-    throw new PipelineError("No result message received from security scanner");
+    const detail = stderrOutput ? `
+stderr:
+${stderrOutput.slice(0, 2e3)}` : "";
+    throw new PipelineError(`No result message received from security scanner${detail}`);
   }
   const isSuccess = resultMessage.subtype === "success";
   const isMaxTurns = resultMessage.subtype === "error_max_turns";
   if (!isSuccess && !isMaxTurns) {
     const errorDetail = "errors" in resultMessage ? resultMessage.errors.join(", ") : "unknown";
+    const stderrDetail = stderrOutput ? `
+stderr:
+${stderrOutput.slice(0, 2e3)}` : "";
     throw new PipelineError(
-      `Security scanner failed (${resultMessage.subtype}): ${errorDetail}`
+      `Security scanner failed (${resultMessage.subtype}): ${errorDetail}${stderrDetail}`
     );
   }
   let parsed;
@@ -1582,7 +1696,7 @@ Analyze this diff for security vulnerabilities. Provide your report as a JSON ob
       );
     }
   } else if (lastAssistantText) {
-    log7.warn("No result output \u2014 extracting report from last assistant message");
+    log8.warn("No result output \u2014 extracting report from last assistant message");
     const jsonStr = extractJSON3(lastAssistantText);
     try {
       parsed = JSON.parse(jsonStr);
@@ -1595,7 +1709,7 @@ Analyze this diff for security vulnerabilities. Provide your report as a JSON ob
     throw new PipelineError("Security scanner produced no output");
   }
   const report = validateReport(parsed);
-  log7.info(
+  log8.info(
     {
       riskLevel: report.riskLevel,
       findingCount: report.findings.length
@@ -1610,11 +1724,11 @@ Analyze this diff for security vulnerabilities. Provide your report as a JSON ob
 
 // src/testing/test-runner.ts
 import { execa } from "execa";
-var log8 = createChildLogger("test-runner");
+var log9 = createChildLogger("test-runner");
 async function runCommand(params) {
   const { workingDir, command, kind, timeoutMs = 3e5 } = params;
   const [cmd, ...args] = command.split(" ");
-  log8.info({ kind, command, workingDir }, `Running ${kind} command`);
+  log9.info({ kind, command, workingDir }, `Running ${kind} command`);
   const start = Date.now();
   try {
     const result = await execa(cmd, args, {
@@ -1625,7 +1739,7 @@ async function runCommand(params) {
     });
     const durationMs = Date.now() - start;
     const passed = result.exitCode === 0;
-    log8.info({ kind, passed, durationMs, exitCode: result.exitCode }, `${kind} completed`);
+    log9.info({ kind, passed, durationMs, exitCode: result.exitCode }, `${kind} completed`);
     return {
       passed,
       output: result.all ?? result.stdout + "\n" + result.stderr,
@@ -1634,7 +1748,7 @@ async function runCommand(params) {
   } catch (error) {
     const durationMs = Date.now() - start;
     const message = error instanceof Error ? error.message : String(error);
-    log8.error({ kind, error: message, durationMs }, `${kind} execution failed`);
+    log9.error({ kind, error: message, durationMs }, `${kind} execution failed`);
     return {
       passed: false,
       output: message,
@@ -1652,7 +1766,7 @@ async function runTests(params) {
 }
 
 // src/notifications/sender.ts
-var log9 = createChildLogger("notifications");
+var log10 = createChildLogger("notifications");
 async function sendSlackWebhook(webhookUrl, message) {
   try {
     const response = await fetch(webhookUrl, {
@@ -1661,11 +1775,11 @@ async function sendSlackWebhook(webhookUrl, message) {
       body: JSON.stringify(message)
     });
     if (!response.ok) {
-      log9.warn({ status: response.status }, "Slack webhook request failed");
+      log10.warn({ status: response.status }, "Slack webhook request failed");
     }
   } catch (error) {
     const msg = error instanceof Error ? error.message : String(error);
-    log9.warn({ error: msg }, "Failed to send Slack notification");
+    log10.warn({ error: msg }, "Failed to send Slack notification");
   }
 }
 function formatSlackMessage(state, event) {
@@ -1718,7 +1832,7 @@ async function postGitHubMentions(config, owner, repo, issueNumber, event, state
       await addComment(owner, repo, issueNumber, message);
     } catch (error) {
       const msg = error instanceof Error ? error.message : String(error);
-      log9.warn({ error: msg }, "Failed to post GitHub mention");
+      log10.warn({ error: msg }, "Failed to post GitHub mention");
     }
   }
 }
@@ -1735,7 +1849,7 @@ async function notify(params) {
 }
 
 // src/pipeline/auto-merge.ts
-var log10 = createChildLogger("auto-merge");
+var log11 = createChildLogger("auto-merge");
 var SIZE_ORDER = {
   xs: 1,
   s: 2,
@@ -1767,20 +1881,20 @@ function isAutoMergeEligible(params) {
     }
   }
   if (reasons.length > 0) {
-    log10.info({ reasons }, "PR not eligible for auto-merge");
+    log11.info({ reasons }, "PR not eligible for auto-merge");
   }
   return { eligible: reasons.length === 0, reasons };
 }
 
 // src/tracking/cost-tracker.ts
-import { homedir } from "os";
-import { join as join2 } from "path";
+import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
 import { mkdir, appendFile, readFile } from "fs/promises";
-var log11 = createChildLogger("cost-tracker");
-var HISTORY_DIR = join2(homedir(), ".xforce");
+var log12 = createChildLogger("cost-tracker");
+var HISTORY_DIR = join3(homedir2(), ".xforce");
 var HISTORY_FILE = "history.jsonl";
 function getHistoryPath(basePath) {
-  return join2(basePath ?? HISTORY_DIR, HISTORY_FILE);
+  return join3(basePath ?? HISTORY_DIR, HISTORY_FILE);
 }
 function buildRecordFromState(state, repoConfig) {
   const startedAt = state.startedAt instanceof Date ? state.startedAt : new Date(state.startedAt);
@@ -1808,10 +1922,10 @@ function buildRecordFromState(state, repoConfig) {
 async function appendRecord(record, basePath) {
   const dir = basePath ?? HISTORY_DIR;
   await mkdir(dir, { recursive: true });
-  const filePath = join2(dir, HISTORY_FILE);
+  const filePath = join3(dir, HISTORY_FILE);
   const line = JSON.stringify(record) + "\n";
   await appendFile(filePath, line, "utf-8");
-  log11.debug({ id: record.id, repo: record.repo }, "Persisted pipeline run record");
+  log12.debug({ id: record.id, repo: record.repo }, "Persisted pipeline run record");
 }
 async function readRecords(filter, basePath) {
   const filePath = getHistoryPath(basePath);
@@ -1832,7 +1946,7 @@ async function readRecords(filter, basePath) {
       if (filter?.until && new Date(record.startedAt) > filter.until) continue;
       records.push(record);
     } catch {
-      log11.warn("Skipping malformed line in history file");
+      log12.warn("Skipping malformed line in history file");
     }
   }
   return records;
@@ -1869,12 +1983,12 @@ function summarize(records) {
 }
 
 // src/pipeline/orchestrator.ts
-var log12 = createChildLogger("orchestrator");
+var log13 = createChildLogger("orchestrator");
 function transition(state, to, message) {
   validateTransition(state.status, to);
   state.status = to;
   state.logs.push({ timestamp: /* @__PURE__ */ new Date(), status: to, message });
-  log12.info({ status: to }, message);
+  log13.info({ status: to }, message);
 }
 async function runPipeline(params) {
   const { config } = params;
@@ -1915,7 +2029,7 @@ async function runPipeline(params) {
     await removeLabel(owner, repo, issueNumber, repoConfig.labels.failed).catch(() => {
     });
     await addLabel(owner, repo, issueNumber, repoConfig.labels.inProgress);
-    log12.info({ owner, repo, issueNumber }, "Fetching and parsing issue");
+    log13.info({ owner, repo, issueNumber }, "Fetching and parsing issue");
     const issue = await getIssue(owner, repo, issueNumber);
     const labels = await getIssueLabels(owner, repo, issueNumber);
     const taskSpec = parseIssueBody({
@@ -1982,7 +2096,7 @@ async function runPipeline(params) {
     await notify({ config: config.notifications, state, event: "completed", owner, repo, issueNumber });
     state.completedAt = /* @__PURE__ */ new Date();
     await appendRecord(buildRecordFromState(state, repoConfig)).catch((err) => {
-      log12.warn({ error: err.message }, "Failed to persist cost tracking record");
+      log13.warn({ error: err.message }, "Failed to persist cost tracking record");
     });
     if (state.status === "merging") {
       transition(state, "completed", "PR auto-merged");
@@ -1995,7 +2109,7 @@ async function runPipeline(params) {
     state.status = "failed";
     state.error = message;
     state.completedAt = /* @__PURE__ */ new Date();
-    log12.error({ error: message }, "Pipeline failed");
+    log13.error({ error: message }, "Pipeline failed");
     await notify({ config: config.notifications, state, event: "failed", owner, repo, issueNumber }).catch(() => {
     });
     await appendRecord(buildRecordFromState(state, repoConfig)).catch(() => {
@@ -2013,7 +2127,7 @@ async function runPipeline(params) {
 **Cost**: $${state.totalCostUsd.toFixed(4)}`
       );
     } catch {
-      log12.warn("Failed to update issue labels/comments after pipeline failure");
+      log13.warn("Failed to update issue labels/comments after pipeline failure");
     }
     return state;
   } finally {
@@ -2023,7 +2137,7 @@ async function runPipeline(params) {
       try {
         await rm(workDir, { recursive: true, force: true });
       } catch {
-        log12.warn({ workDir }, "Failed to clean up working directory");
+        log13.warn({ workDir }, "Failed to clean up working directory");
       }
     }
   }
@@ -2326,6 +2440,7 @@ ${review.securityConcerns.map((c) => `- ${c}`).join("\n")}` : ""}
 async function runCommand2(params) {
   const spinner = ora2("Loading configuration...").start();
   try {
+    ensureCredentials();
     const config = loadConfig(params.configPath);
     spinner.succeed("Configuration loaded");
     let owner;
@@ -2450,7 +2565,7 @@ async function reviewCommand(params) {
 }
 
 // src/cli/commands/init.ts
-import { join as join3, resolve as resolve3 } from "path";
+import { join as join4, resolve as resolve3 } from "path";
 import { mkdir as mkdir2, writeFile as writeFile2, readFile as readFile2, access as access2 } from "fs/promises";
 import { fileURLToPath } from "url";
 import ora4 from "ora";
@@ -2459,9 +2574,9 @@ async function findTemplateDir() {
   const thisFile = fileURLToPath(import.meta.url);
   let dir = resolve3(thisFile, "..");
   for (let i = 0; i < 6; i++) {
-    const pkgPath = join3(dir, "package.json");
+    const pkgPath = join4(dir, "package.json");
     if (await fileExists(pkgPath)) {
-      return join3(dir, "templates");
+      return join4(dir, "templates");
     }
     dir = resolve3(dir, "..");
   }
@@ -2532,21 +2647,21 @@ async function initCommand(params) {
     const testCommand = params.testCommand ?? "npm test";
     const created = [];
     const skipped = [];
-    const issueTemplateDir = join3(targetDir, ".github", "ISSUE_TEMPLATE");
+    const issueTemplateDir = join4(targetDir, ".github", "ISSUE_TEMPLATE");
     await mkdir2(issueTemplateDir, { recursive: true });
     const templateNames = ["feature-request.yml", "bug-fix.yml", "refactor.yml"];
-    const srcTemplateDir = join3(await findTemplateDir(), "issue-templates");
+    const srcTemplateDir = join4(await findTemplateDir(), "issue-templates");
     for (const tmpl of templateNames) {
-      const destPath = join3(issueTemplateDir, tmpl);
+      const destPath = join4(issueTemplateDir, tmpl);
       if (await fileExists(destPath)) {
         skipped.push(`.github/ISSUE_TEMPLATE/${tmpl}`);
       } else {
-        const content = await readFile2(join3(srcTemplateDir, tmpl), "utf-8");
+        const content = await readFile2(join4(srcTemplateDir, tmpl), "utf-8");
         await writeFile2(destPath, content, "utf-8");
         created.push(`.github/ISSUE_TEMPLATE/${tmpl}`);
       }
     }
-    const envPath = join3(targetDir, ".env.xforce");
+    const envPath = join4(targetDir, ".env.xforce");
     if (await fileExists(envPath)) {
       skipped.push(".env.xforce");
     } else {
@@ -2563,7 +2678,7 @@ XFORCE_WEBHOOK_SECRET=
       );
       created.push(".env.xforce");
     }
-    const gitignorePath = join3(targetDir, ".gitignore");
+    const gitignorePath = join4(targetDir, ".gitignore");
     let gitignoreContent = "";
     try {
       gitignoreContent = await readFile2(gitignorePath, "utf-8");
@@ -2577,7 +2692,7 @@ XFORCE_WEBHOOK_SECRET=
         created.push(".gitignore");
       }
     }
-    const configPath = join3(targetDir, "xforce.config.yaml");
+    const configPath = join4(targetDir, "xforce.config.yaml");
     if (await fileExists(configPath)) {
       skipped.push("xforce.config.yaml");
     } else {
@@ -2702,7 +2817,7 @@ import crypto from "crypto";
 
 // src/server/queue.ts
 import { nanoid as nanoid2 } from "nanoid";
-var log13 = createChildLogger("queue");
+var log14 = createChildLogger("queue");
 var DEFAULT_OPTIONS = {
   maxSize: 10,
   historySize: 50
@@ -2739,7 +2854,7 @@ var JobQueue = class {
       enqueuedAt: /* @__PURE__ */ new Date()
     };
     this.pending.push(job);
-    log13.info(
+    log14.info(
       { jobId: job.id, owner: job.owner, repo: job.repo, issue: job.issueNumber },
       "Job enqueued"
     );
@@ -2776,7 +2891,7 @@ var JobQueue = class {
     job.status = "running";
     job.startedAt = /* @__PURE__ */ new Date();
     this.active = job;
-    log13.info(
+    log14.info(
       { jobId: job.id, owner: job.owner, repo: job.repo, issue: job.issueNumber },
       "Processing job"
     );
@@ -2787,7 +2902,7 @@ var JobQueue = class {
     } catch (error) {
       job.status = "failed";
       job.error = error instanceof Error ? error.message : String(error);
-      log13.error(
+      log14.error(
         { jobId: job.id, error: job.error },
         "Job failed"
       );
@@ -2800,7 +2915,7 @@ var JobQueue = class {
         this.completed = this.completed.slice(0, this.options.historySize);
       }
       this.processing = false;
-      log13.info(
+      log14.info(
         { jobId: job.id, status: job.status, totalProcessed: this.totalProcessed },
         "Job finished"
       );
@@ -2810,7 +2925,7 @@ var JobQueue = class {
 };
 
 // src/server/webhook.ts
-var log14 = createChildLogger("webhook-server");
+var log15 = createChildLogger("webhook-server");
 var MAX_BODY_SIZE = 1048576;
 function readBody(req) {
   return new Promise((resolve4, reject) => {
@@ -2927,7 +3042,7 @@ function createWebhookServer(config, options) {
     }
     try {
       const job = queue.enqueue({ owner, repo, issueNumber, issueUrl });
-      log14.info(
+      log15.info(
         { jobId: job.id, owner, repo, issueNumber },
         "Webhook accepted, job enqueued"
       );
@@ -2946,7 +3061,7 @@ function createWebhookServer(config, options) {
   const server = createServer(async (req, res) => {
     const method = req.method ?? "GET";
     const url = req.url ?? "/";
-    log14.debug({ method, url }, "Request received");
+    log15.debug({ method, url }, "Request received");
     try {
       if (method === "GET" && url === "/health") {
         handleHealth(req, res);
@@ -2959,7 +3074,7 @@ function createWebhookServer(config, options) {
       }
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log14.error({ error: message }, "Request handler error");
+      log15.error({ error: message }, "Request handler error");
       if (!res.headersSent) {
         sendJson(res, 500, { error: "Internal server error" });
       }
@@ -2969,7 +3084,7 @@ function createWebhookServer(config, options) {
     start() {
       return new Promise((resolve4, reject) => {
         server.listen(options.port, options.host, () => {
-          log14.info({ port: options.port, host: options.host }, "Webhook server started");
+          log15.info({ port: options.port, host: options.host }, "Webhook server started");
           resolve4();
         });
         server.on("error", reject);
@@ -2978,7 +3093,7 @@ function createWebhookServer(config, options) {
     stop() {
       return new Promise((resolve4) => {
         server.close(() => {
-          log14.info("Webhook server stopped");
+          log15.info("Webhook server stopped");
           resolve4();
         });
       });
@@ -3003,6 +3118,13 @@ async function serveCommand(params) {
     );
     process.exit(1);
   }
+  try {
+    ensureCredentials();
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(chalk5.red(`Credentials error: ${message}`));
+    process.exit(1);
+  }
   let config;
   try {
     config = loadConfig(params.configPath);