[log] Add debug logging to copilot permissions, gh-aw-ref resolution, and add command

pkg/cli/add_command.go

@@ -155,6 +155,7 @@ func runAddCommand(cmd *cobra.Command, args []string, validateEngine func(string
 	if err := validateEngine(engineOverride); err != nil {
 		return err
 	}
+	addLog.Printf("Adding %d workflow source(s): force=%t, create_pr=%t", len(args), forceFlag, createPRFlag || prFlagAlias)
 
 	opts := AddOptions{
 		Verbose:                verbose,
@@ -181,6 +182,7 @@ func runAddCommand(cmd *cobra.Command, args []string, validateEngine func(string
 		return err
 	}
 	if _, err := AddResolvedWorkflows(cmd.Context(), args, resolved, opts); err != nil {
+		addLog.Printf("Add command failed while installing resolved workflows: %v", err)
 		return err
 	}
 	return nil

pkg/cli/add_copilot_permissions.go

@@ -5,8 +5,11 @@ import (
 	"strings"
 
 	"github.com/github/gh-aw/pkg/constants"
+	"github.com/github/gh-aw/pkg/logger"
 )
 
+var copilotPermissionsLog = logger.New("cli:add_copilot_permissions")
+
 // This file handles Copilot-specific workflow permission injection.
 
 // isCopilotWorkflowContent returns true when the workflow frontmatter declares engine: copilot.
@@ -40,7 +43,7 @@ func isCopilotWorkflowContent(content string) bool {
 // (e.g., when `permissions:` is a non-mapping scalar like `read-all`).
 func addCopilotRequestsPermissionToContent(content string) (string, error) {
 	var injectionFailed bool
-	newContent, _, err := applyFrontmatterLineTransform(content, func(lines []string) ([]string, bool) {
+	newContent, modified, err := applyFrontmatterLineTransform(content, func(lines []string) ([]string, bool) {
 		updated := ensureCopilotRequestsWritePermission(lines)
 		// Detect whether ensureCopilotRequestsWritePermission actually made a change.
 		// When lengths differ, a line was added — modified is true without needing element comparison.
@@ -64,11 +67,13 @@ func addCopilotRequestsPermissionToContent(content string) (string, error) {
 		return updated, modified
 	})
 	if injectionFailed {
+		copilotPermissionsLog.Print("Failed to inject copilot-requests permission: permissions block is a non-mapping scalar")
 		return content, errors.New("permissions.copilot-requests could not be injected because 'permissions' is a non-mapping scalar value. Expected 'permissions' to be a mapping object. Example:\npermissions:\n  contents: read\n  copilot-requests: write")
 	}
 	if err != nil {
 		return content, err
 	}
+	copilotPermissionsLog.Printf("copilot-requests permission injection complete: modified=%t", modified)
 	return newContent, nil
 }
 

pkg/cli/add_gh_aw_ref.go

@@ -4,16 +4,22 @@ import (
 	"context"
 	"fmt"
 
+	"github.com/github/gh-aw/pkg/logger"
 	"github.com/github/gh-aw/pkg/workflow"
 )
 
+var addGhAwRefLog = logger.New("cli:add_gh_aw_ref")
+
 func resolveAddGhAwRef(ctx context.Context, ref string) (string, error) {
 	if ref == "" {
 		return "", nil
 	}
+	addGhAwRefLog.Printf("Resolving --gh-aw-ref %q to a commit SHA", ref)
 	resolvedRef, err := workflow.ResolveGhAwRef(ctx, ref)
 	if err != nil {
+		addGhAwRefLog.Printf("Failed to resolve --gh-aw-ref %q: %v", ref, err)
 		return "", fmt.Errorf("--gh-aw-ref: %w", err)
 	}
+	addGhAwRefLog.Printf("Resolved --gh-aw-ref %q to %s", ref, resolvedRef)
 	return resolvedRef, nil
 }