From ded82586452d36dc6b0d16667f33ab3576858f5e Mon Sep 17 00:00:00 2001
From: Musiker15 <info@musiker15.de>
Date: Sat, 10 Oct 2026 17:40:58 +0200
Subject: [PATCH] Security-Review nennt den Grund, wenn Claude Code ohne
 Bericht endet

Der erste Lauf endete nach einem Zug mit Exit 1, und das Protokoll sagte
nicht, warum.
---
 .github/workflows/security-review.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/security-review.yml b/.github/workflows/security-review.yml
index fbc697a..802e8fb 100644
--- a/.github/workflows/security-review.yml
+++ b/.github/workflows/security-review.yml
@@ -288,6 +288,14 @@ jobs:
           rm -f "$token_file" "$token_file.next"
           echo "Claude Code endete mit Exit $code."
           tail -n 1 "$RUNNER_TEMP/claude.jsonl" | jq -r '"Kosten: \(.total_cost_usd // "?") USD, Züge: \(.num_turns // "?")"' 2> /dev/null || true
+          # Without a report the reason goes into the log: the kind of the
+          # error and its message, which name no token. The rest of the stream
+          # stays out of the public log; it holds what the agent read and ran.
+          if [ "$code" -ne 0 ]; then
+            jq -r 'select(.type == "result" or .error != null or .api_error_status != null)
+              | "Fehler: \(.subtype // .type) \(.api_error_status // "") \((.result // .error // "") | tostring | .[0:600])"' \
+              "$RUNNER_TEMP/claude.jsonl" 2> /dev/null | tail -n 5 || true
+          fi
 
       - name: Bericht prüfen
         run: |