@agent-native/core 0.49.12 → 0.49.13

package/dist/cli/pr-visual-recap-workflow.d.ts

@@ -7,5 +7,5 @@
  * recap.spec.ts fails if these drift. Regenerate from the YAML with the snippet
  * in recap.spec.ts.
  */
-export declare const PR_VISUAL_RECAP_WORKFLOW_YML = "name: PR Visual Recap\n\n# Visual code review: a coding agent runs the repo's visual-recap skill over the\n# PR diff, publishes a plan, and upserts one sticky comment with a screenshot.\n# Plain `pull_request` (NOT `pull_request_target`) so fork code never sees secrets.\n\non:\n  pull_request:\n    types: [opened, synchronize, reopened, ready_for_review]\n\npermissions:\n  contents: read\n\nconcurrency:\n  group: pr-visual-recap-${{ github.event.pull_request.number }}\n  cancel-in-progress: true\n\nenv:\n  VISUAL_RECAP_AGENT: ${{ vars.VISUAL_RECAP_AGENT || 'claude' }}\n  VISUAL_RECAP_SKILL_SOURCE: ${{ vars.VISUAL_RECAP_SKILL_SOURCE || 'auto' }}\n\njobs:\n  gate:\n    name: Gate\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n      issues: write\n      pull-requests: write\n    outputs:\n      run: ${{ steps.decide.outputs.run }}\n      agent: ${{ steps.decide.outputs.agent }}\n    steps:\n      - id: decide\n        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n        env:\n          # Presence-only signals \u2014 never expose secret VALUES to the gate.\n          HAS_PLAN: ${{ secrets.PLAN_RECAP_TOKEN != '' }}\n          HAS_ANTHROPIC: ${{ secrets.ANTHROPIC_API_KEY != '' }}\n          HAS_OPENAI: ${{ secrets.OPENAI_API_KEY != '' }}\n          AGENT: ${{ env.VISUAL_RECAP_AGENT }}\n          VISUAL_RECAP_MODEL: ${{ vars.VISUAL_RECAP_MODEL }}\n          HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n        with:\n          script: |\n            const pr = context.payload.pull_request;\n            const reasons = [];\n\n            if (!pr) reasons.push('no pull_request payload');\n            if (pr && pr.draft) reasons.push('draft PR');\n\n            // Fork PRs run with no secrets, so publishing would fail anyway \u2014 skip.\n            const headRepo = pr && pr.head && pr.head.repo && pr.head.repo.full_name;\n            if (pr && headRepo && headRepo !== process.env.GITHUB_REPOSITORY) {\n              reasons.push(`fork PR (${headRepo})`);\n            }\n\n            const login = (pr && pr.user && pr.user.login || '').toLowerCase();\n            const botAuthors = ['dependabot[bot]', 'dependabot', 'renovate[bot]', 'renovate'];\n            if (botAuthors.includes(login)) reasons.push(`bot author (${login})`);\n            if (pr && pr.user && pr.user.type === 'Bot') reasons.push('bot author (type=Bot)');\n\n            if (process.env.HAS_PLAN !== 'true') reasons.push('PLAN_RECAP_TOKEN not configured');\n\n            // Normalize + validate the agent so a mis-cased value can't pass the\n            // gate and then match neither agent step below.\n            const agent = (process.env.AGENT || 'claude').toLowerCase();\n            if (agent !== 'claude' && agent !== 'codex') {\n              reasons.push(`unsupported VISUAL_RECAP_AGENT \"${process.env.AGENT}\" (expected \"claude\" or \"codex\")`);\n            } else if (agent === 'codex') {\n              if (process.env.HAS_OPENAI !== 'true') reasons.push('OPENAI_API_KEY not configured (codex backend)');\n            } else {\n              if (process.env.HAS_ANTHROPIC !== 'true') reasons.push('ANTHROPIC_API_KEY not configured (claude backend)');\n            }\n\n            // Validate the model before it reaches the agent CLI.\n            const model = process.env.VISUAL_RECAP_MODEL || '';\n            if (model && !/^[a-zA-Z0-9._-]{1,80}$/.test(model)) {\n              reasons.push(`invalid VISUAL_RECAP_MODEL value (must match [a-zA-Z0-9._-]{1,80})`);\n            }\n\n            // Self-modifying guard, evaluated in the trusted gate (runs NO\n            // PR-checked-out code): skip the ENTIRE job if the PR touches the\n            // workflow, skill, or any agent config the runner loads, so a PR\n            // can't rewrite what runs and exfiltrate secrets.\n            if (pr) {\n              try {\n                const files = await github.paginate(github.rest.pulls.listFiles, {\n                  owner: context.repo.owner,\n                  repo: context.repo.repo,\n                  pull_number: pr.number,\n                  per_page: 100,\n                });\n                const isSensitive = (p) =>\n                  p === '.github/workflows/pr-visual-recap.yml' ||\n                  /(^|\\/)skills\\/visual-(recap|plan|plans)\\//.test(p) ||\n                  /(^|\\/)\\.claude\\//.test(p) ||\n                  /(^|\\/)CLAUDE\\.md$/.test(p) ||\n                  /(^|\\/)AGENTS\\.md$/.test(p) ||\n                  /(^|\\/)\\.mcp\\.json$/.test(p);\n                const hits = files.map((f) => f.filename).filter(isSensitive);\n                if (hits.length) {\n                  reasons.push(`PR modifies recap-control files (${hits.slice(0, 3).join(', ')}${hits.length > 3 ? ', \u2026' : ''}) \u2014 skipping so untrusted PR code never runs with secrets`);\n                }\n              } catch (e) {\n                // Fail closed: if the file list can't be read, skip.\n                reasons.push(`could not list PR files for the self-modifying guard (${e.message}); skipping to be safe`);\n              }\n            }\n\n            const run = reasons.length === 0;\n            core.setOutput('run', run ? 'true' : 'false');\n            core.setOutput('agent', agent);\n            core.info(run ? `Visual recap will run (${agent}).` : `Visual recap skipped: ${reasons.join('; ')}`);\n\n            // When skipping, refresh an EXISTING sticky recap comment with a\n            // short skip line so it does not silently go stale. Never create a\n            // new comment (no spam for repos where the recap has never run).\n            if (!run && pr) {\n              try {\n                const MARKER = '<!-- pr-visual-recap -->';\n                const { data: comments } = await github.rest.issues.listComments({\n                  owner: context.repo.owner,\n                  repo: context.repo.repo,\n                  issue_number: pr.number,\n                  per_page: 100,\n                });\n                const existing = comments.find(\n                  (c) => c.user && c.user.type === 'Bot' && c.body && c.body.includes(MARKER)\n                );\n                if (existing) {\n                  const headShort = (process.env.HEAD_SHA || '').slice(0, 7);\n                  const shaRef = headShort ? `\\`${headShort}\\`` : 'latest push';\n                  const primaryReason = reasons.filter(\n                    (r) => !r.startsWith('could not list PR files for the self-modifying guard')\n                  )[0] || reasons[0] || 'skipped';\n                  const skipLine = `_Recap skipped for ${shaRef}: ${primaryReason}._`;\n                  const withoutPrev = (existing.body || '')\n                    .split('\\n')\n                    .filter((l) => !/_Recap skipped for .+_$/.test(l.trim()))\n                    .join('\\n')\n                    .trimEnd();\n                  const updatedBody = `${withoutPrev}\\n\\n${skipLine}`;\n                  await github.rest.issues.updateComment({\n                    owner: context.repo.owner,\n                    repo: context.repo.repo,\n                    comment_id: existing.id,\n                    body: updatedBody,\n                  });\n                }\n              } catch (e) {\n                core.warning(`Could not update recap skip comment: ${e.message}`);\n              }\n            }\n\n  recap:\n    name: Generate visual recap\n    needs: gate\n    if: needs.gate.outputs.run == 'true'\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      actions: write\n      checks: write\n      contents: read\n      issues: write\n      pull-requests: write\n    env:\n      PLAN_RECAP_APP_URL: ${{ secrets.PLAN_RECAP_APP_URL || 'https://plan.agent-native.com' }}\n      PLAN_RECAP_TOKEN: ${{ secrets.PLAN_RECAP_TOKEN }}\n      GH_TOKEN: ${{ github.token }}\n      PR_NUMBER: ${{ github.event.pull_request.number }}\n      HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n      VISUAL_RECAP_MODEL: ${{ vars.VISUAL_RECAP_MODEL }}\n      VISUAL_RECAP_REASONING: ${{ vars.VISUAL_RECAP_REASONING }}\n      VISUAL_RECAP_SKILL_SOURCE: ${{ vars.VISUAL_RECAP_SKILL_SOURCE || 'auto' }}\n    steps:\n      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n        with:\n          fetch-depth: 0\n          # This job runs an agent over untrusted PR diff; don't leave the token\n          # in .git/config (it uses GH_TOKEN for gh API calls, never git push).\n          persist-credentials: false\n\n      # Dogfood trusted base-branch source inside this monorepo, else install the\n      # published package once. Never execute PR-head recap CLI code.\n      - name: Resolve recap CLI\n        id: cli\n        env:\n          # Optional: pin the consumer CLI version (e.g. \"1.2.3\"). Defaults to\n          # \"latest\" when unset. Set via repository variable RECAP_CLI_VERSION.\n          RECAP_CLI_VERSION: ${{ vars.RECAP_CLI_VERSION || 'latest' }}\n        run: |\n          if [ \"$GITHUB_REPOSITORY\" = \"BuilderIO/agent-native\" ] && [ -f packages/core/src/cli/index.ts ]; then\n            echo \"local=true\" >> \"$GITHUB_OUTPUT\"\n          else\n            echo \"local=false\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n        if: steps.cli.outputs.local == 'true'\n        with:\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .recap-cli-source\n          fetch-depth: 1\n          persist-credentials: false\n\n      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8\n        if: steps.cli.outputs.local == 'true'\n\n      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n        with:\n          node-version: \"22\"\n          cache: ${{ steps.cli.outputs.local == 'true' && 'pnpm' || '' }}\n\n      - name: Install trusted workspace recap CLI\n        if: steps.cli.outputs.local == 'true'\n        working-directory: .recap-cli-source\n        run: |\n          set -euo pipefail\n          pnpm install --frozen-lockfile --ignore-scripts\n          echo \"RECAP_CLI=$PWD/node_modules/.bin/tsx $PWD/packages/core/src/cli/index.ts\" >> \"$GITHUB_ENV\"\n\n      - name: Install published recap CLI\n        if: steps.cli.outputs.local != 'true'\n        env:\n          RECAP_CLI_VERSION: ${{ vars.RECAP_CLI_VERSION || 'latest' }}\n        run: |\n          set -euo pipefail\n          VERSION=\"$RECAP_CLI_VERSION\"\n          if [ \"$VERSION\" = \"latest\" ]; then\n            VERSION=\"$(npm view @agent-native/core@latest version)\"\n          fi\n          for attempt in 1 2 3; do\n            if npm install --prefix \"$RUNNER_TEMP/recap-cli\" --no-audit --no-fund \"@agent-native/core@$VERSION\"; then\n              break\n            fi\n            if [ \"$attempt\" = \"3\" ]; then exit 1; fi\n            sleep $((attempt * 10))\n          done\n          echo \"RECAP_CLI=$RUNNER_TEMP/recap-cli/node_modules/.bin/agent-native\" >> \"$GITHUB_ENV\"\n\n      - name: Start visual recap check\n        id: recap_check\n        continue-on-error: true\n        run: |\n          set -uo pipefail\n          $RECAP_CLI recap check start --sha \"$HEAD_SHA\" --workflow-url \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID\"\n\n      - name: Collect bounded diff\n        id: diff\n        env:\n          BASE_SHA: ${{ github.event.pull_request.base.sha }}\n        run: |\n          set -euo pipefail\n          $RECAP_CLI recap collect-diff --base \"$BASE_SHA\" --head \"$HEAD_SHA\" --out recap.diff --stat recap.stat\n\n      - name: Probe plan-app auth\n        id: auth_probe\n        if: steps.diff.outputs.tiny != 'true'\n        continue-on-error: true\n        run: |\n          set -uo pipefail\n          # Hit the plan app's action surface with the publish token. A 401 means\n          # the token is expired/revoked; surface it in the sticky comment so the\n          # repo owner knows to re-mint it instead of seeing a generic failure.\n          HTTP_STATUS=$(node -e '\n            const https = require(\"https\");\n            const url = new URL(\"/_agent-native/actions/record-recap-usage\", process.env.PLAN_RECAP_APP_URL || \"https://plan.agent-native.com\");\n            const req = https.request(url, { method: \"POST\", headers: { \"authorization\": \"Bearer \" + process.env.PLAN_RECAP_TOKEN, \"content-type\": \"application/json\" }, timeout: 8000 }, (res) => { process.stdout.write(String(res.statusCode)); req.destroy(); });\n            req.on(\"error\", () => process.stdout.write(\"0\"));\n            req.end(JSON.stringify({ planId: \"__probe__\" }));\n          ' 2>/dev/null || echo \"0\")\n          if [ \"$HTTP_STATUS\" = \"401\" ]; then\n            echo \"auth_failed=true\" >> \"$GITHUB_OUTPUT\"\n          else\n            echo \"auth_failed=false\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - name: Secret scan\n        id: scan\n        if: steps.diff.outputs.tiny != 'true'\n        run: |\n          set -uo pipefail\n          # Fail CLOSED: a scanner error or invalid JSON suppresses the diff so a\n          # credential-bearing diff is never handed to the agent / plan service.\n          if ! SCAN_JSON=\"$($RECAP_CLI recap scan --diff recap.diff)\"; then\n            SCAN_JSON='{\"suppressed\":true,\"reason\":\"secret scan failed to run; failing closed\"}'\n          fi\n          {\n            echo 'json<<__RECAP_SCAN_EOF__'\n            echo \"$SCAN_JSON\"\n            echo '__RECAP_SCAN_EOF__'\n          } >> \"$GITHUB_OUTPUT\"\n          SUPPRESSED=$(node -e 'try{process.stdout.write(JSON.parse(process.argv[1]).suppressed?\"true\":\"false\")}catch{process.stdout.write(\"true\")}' \"$SCAN_JSON\")\n          echo \"suppressed=$SUPPRESSED\" >> \"$GITHUB_OUTPUT\"\n\n      - name: Read previous plan id\n        id: prev\n        continue-on-error: true\n        run: |\n          set -euo pipefail\n          PLAN_ID=\"$($RECAP_CLI recap comment find-plan-id --repo \"$GITHUB_REPOSITORY\" --issue \"$PR_NUMBER\" --token \"$GH_TOKEN\")\"\n          echo \"plan_id=$PLAN_ID\" >> \"$GITHUB_OUTPUT\"\n\n      - name: Build recap prompt\n        id: prompt\n        if: steps.diff.outputs.tiny != 'true' && steps.scan.outputs.suppressed != 'true'\n        env:\n          # Pass step outputs via env, NOT ${{ }} interpolation into the run body:\n          # the prev plan id is parsed from a PR comment and could inject shell.\n          PREV_PLAN_ID: ${{ steps.prev.outputs.plan_id }}\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\n        run: |\n          set -euo pipefail\n          ARGS=(--diff recap.diff --stat recap.stat --pr \"$PR_NUMBER\" --repo \"$GITHUB_REPOSITORY\" --head \"$HEAD_SHA\" --app-url \"$PLAN_RECAP_APP_URL\" --skill-source \"$VISUAL_RECAP_SKILL_SOURCE\" --out recap-prompt.md)\n          if [ \"${DIFF_HUGE:-}\" = \"true\" ]; then ARGS+=(--huge); fi\n          if [ -n \"${PREV_PLAN_ID:-}\" ]; then ARGS+=(--prev-plan-id \"$PREV_PLAN_ID\"); fi\n          $RECAP_CLI recap build-prompt \"${ARGS[@]}\"\n\n      - name: Run agent (Claude Code)\n        id: claude\n        if: needs.gate.outputs.agent == 'claude' && steps.diff.outputs.tiny != 'true' && steps.scan.outputs.suppressed != 'true'\n        continue-on-error: true\n        env:\n          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}\n        run: |\n          set -uo pipefail\n          MCP_CONFIG=\"$RUNNER_TEMP/plan-mcp.json\"\n          $RECAP_CLI recap mcp-config --agent claude --app-url \"$PLAN_RECAP_APP_URL\" --out \"$MCP_CONFIG\"\n          CLAUDE_ARGS=(-p \"$(cat recap-prompt.md)\" --mcp-config \"$MCP_CONFIG\" --allowedTools \"Read,Write,Bash(git diff:*),mcp__plan__get-plan-blocks,mcp__plan__create-visual-recap,mcp__plan__set-resource-visibility\" --permission-mode dontAsk --output-format json)\n          if [ -n \"${VISUAL_RECAP_MODEL:-}\" ]; then CLAUDE_ARGS+=(--model \"$VISUAL_RECAP_MODEL\"); fi\n          rm -f recap-url.txt claude-result.json claude-stderr.log\n          run_claude() {\n            set +e\n            npx -y @anthropic-ai/claude-code@2 \"${CLAUDE_ARGS[@]}\" > claude-result.json 2> claude-stderr.log\n            CLAUDE_STATUS=\"$?\"\n            set -e\n            echo \"$CLAUDE_STATUS\" > claude-exit-code.txt\n          }\n          run_claude\n          if [ ! -s recap-url.txt ] && grep -Eiq 'schedule(d)? (a )?(wakeup|retry)|will retry|backoff|connector.*register|mcp.*(register|unreachable|not usable|zero tools|not callable)' claude-result.json claude-stderr.log 2>/dev/null; then\n            echo \"Plan MCP registration appears delayed; retrying Claude once after 20s.\"\n            sleep 20\n            run_claude\n          fi\n          rm -f \"$MCP_CONFIG\" || true\n\n      - name: Run agent (Codex)\n        id: codex\n        if: needs.gate.outputs.agent == 'codex' && steps.diff.outputs.tiny != 'true' && steps.scan.outputs.suppressed != 'true'\n        continue-on-error: true\n        env:\n          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\n        run: |\n          set -uo pipefail\n          $RECAP_CLI recap mcp-config --agent codex --app-url \"$PLAN_RECAP_APP_URL\" --force\n          # `codex login` writes ~/.codex/auth.json (the bare env var is dropped on\n          # the gpt-5.5 wss transport); stdin keeps the key out of process args.\n          printenv OPENAI_API_KEY | npx -y @openai/codex@0 login --with-api-key || true\n          # The runner is itself an ephemeral sandbox; bypass Codex's own sandbox\n          # (bubblewrap can't init here) and approval gate (cancels the MCP write).\n          CODEX_ARGS=(exec --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check)\n          if [ -n \"${VISUAL_RECAP_MODEL:-}\" ]; then CODEX_ARGS+=(--model \"$VISUAL_RECAP_MODEL\"); fi\n          # Validate reasoning against the enum before embedding it in the TOML override.\n          case \"${VISUAL_RECAP_REASONING:-}\" in\n            none|minimal|low|medium|high|xhigh)\n              CODEX_ARGS+=(-c \"model_reasoning_effort=\\\"$VISUAL_RECAP_REASONING\\\"\") ;;\n            \"\") ;;\n            *) echo \"Ignoring invalid VISUAL_RECAP_REASONING: $VISUAL_RECAP_REASONING\" ;;\n          esac\n          rm -f recap-url.txt codex-events.jsonl codex-stderr.log\n          run_codex() {\n            set +e\n            npx -y @openai/codex@0 \"${CODEX_ARGS[@]}\" --json \"$(cat recap-prompt.md)\" 2> codex-stderr.log | tee codex-events.jsonl\n            CODEX_STATUS=\"${PIPESTATUS[0]}\"\n            set -e\n            echo \"$CODEX_STATUS\" > codex-exit-code.txt\n          }\n          run_codex\n          if [ ! -s recap-url.txt ] && grep -Eiq 'schedule(d)? (a )?(wakeup|retry)|will retry|backoff|connector.*register|mcp.*(register|unreachable|not usable|zero tools|not callable)' codex-events.jsonl codex-stderr.log 2>/dev/null; then\n            echo \"Plan MCP registration appears delayed; retrying Codex once after 20s.\"\n            sleep 20\n            run_codex\n          fi\n\n      - name: Read plan URL\n        id: url\n        if: steps.diff.outputs.tiny != 'true' && steps.scan.outputs.suppressed != 'true'\n        run: |\n          set -uo pipefail\n          PLAN_URL=\"\"\n          URL_REASON=\"\"\n          if [ -f recap-url.txt ]; then\n            PLAN_URL=\"$(tr -d '\\r\\n' < recap-url.txt | tr -d ' ')\"\n          else\n            URL_REASON=\"recap-url.txt was not created by the agent\"\n          fi\n          # recap-url.txt is agent-written -> untrusted. Rebuild a canonical\n          # recap URL from the trusted app base and a strictly validated plan id,\n          # preserving path-prefixed self-hosted mounts.\n          if [ -z \"$URL_REASON\" ]; then\n            URL_RESULT=$(PLAN_URL=\"$PLAN_URL\" node <<'NODE'\n          const emit = (value) => process.stdout.write(JSON.stringify(value));\n          try {\n            const raw = process.env.PLAN_URL || \"\";\n            if (!raw) {\n              emit({ url: \"\", reason: \"recap-url.txt was empty\" });\n              process.exit(0);\n            }\n            const trusted = new URL(process.env.PLAN_RECAP_APP_URL || \"https://plan.agent-native.com\");\n            const parsed = /^https?:\\/\\//i.test(raw)\n              ? new URL(raw)\n              : new URL(raw, trusted);\n            if (parsed.origin !== trusted.origin) {\n              emit({ url: \"\", reason: `recap-url.txt points at ${parsed.origin}, expected ${trusted.origin}` });\n              process.exit(0);\n            }\n\n            const base = trusted.pathname.replace(/\\/$/, \"\");\n            const paths = [parsed.pathname];\n            if (base && parsed.pathname.startsWith(`${base}/`)) {\n              paths.push(parsed.pathname.slice(base.length) || \"/\");\n            }\n\n            for (const path of paths) {\n              const match = path.match(/^\\/(?:plans|recaps)\\/([A-Za-z0-9_-]+)\\/?$/);\n              if (match) {\n                emit({ url: `${trusted.origin}${base}/recaps/${match[1]}`, reason: \"\" });\n                process.exit(0);\n              }\n            }\n            emit({ url: \"\", reason: \"recap-url.txt did not contain a valid /plans/<id> or /recaps/<id> URL for the configured plan app\" });\n          } catch {\n            emit({ url: \"\", reason: \"recap-url.txt was not a valid URL or recap path\" });\n          }\n          NODE\n            )\n            CANONICAL_URL=$(node -e 'try{process.stdout.write(JSON.parse(process.argv[1]).url||\"\")}catch{process.stdout.write(\"\")}' \"$URL_RESULT\")\n            URL_REASON=$(node -e 'try{process.stdout.write(JSON.parse(process.argv[1]).reason||\"\")}catch{process.stdout.write(\"recap-url.txt URL validation failed\")}' \"$URL_RESULT\")\n          else\n            CANONICAL_URL=\"\"\n          fi\n          if [ -n \"$CANONICAL_URL\" ]; then\n            echo \"plan_url=$CANONICAL_URL\" >> \"$GITHUB_OUTPUT\"; echo \"ok=true\" >> \"$GITHUB_OUTPUT\"\n          else\n            echo \"plan_url=\" >> \"$GITHUB_OUTPUT\"; echo \"ok=false\" >> \"$GITHUB_OUTPUT\"\n          fi\n          {\n            echo 'reason<<__RECAP_URL_REASON_EOF__'\n            echo \"$URL_REASON\"\n            echo '__RECAP_URL_REASON_EOF__'\n          } >> \"$GITHUB_OUTPUT\"\n\n      - name: Summarize agent failure\n        id: agent_summary\n        if: steps.url.outputs.ok != 'true' && steps.diff.outputs.tiny != 'true' && steps.scan.outputs.suppressed != 'true'\n        continue-on-error: true\n        env:\n          RECAP_AGENT: ${{ needs.gate.outputs.agent }}\n        run: |\n          set -uo pipefail\n          RESULT=claude-result.json\n          STDERR=claude-stderr.log\n          EXIT_CODE=claude-exit-code.txt\n          if [ \"$RECAP_AGENT\" = \"codex\" ]; then\n            RESULT=codex-events.jsonl\n            STDERR=codex-stderr.log\n            EXIT_CODE=codex-exit-code.txt\n          fi\n          $RECAP_CLI recap agent-summary --agent \"$RECAP_AGENT\" --result-file \"$RESULT\" --stderr-file \"$STDERR\" --exit-code-file \"$EXIT_CODE\" || true\n\n      - name: Attach usage\n        if: steps.url.outputs.ok == 'true'\n        continue-on-error: true\n        env:\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\n          # Use the gate-normalized agent so \"Codex\" still selects the right file.\n          RECAP_AGENT: ${{ needs.gate.outputs.agent }}\n        run: |\n          set -uo pipefail\n          RESULT=claude-result.json\n          if [ \"$RECAP_AGENT\" = \"codex\" ]; then RESULT=codex-events.jsonl; fi\n          if [ -f \"$RESULT\" ]; then $RECAP_CLI recap usage --plan-url \"$PLAN_URL\" --agent \"$RECAP_AGENT\" --result-file \"$RESULT\" --model \"${VISUAL_RECAP_MODEL:-}\" --app-url \"$PLAN_RECAP_APP_URL\" --token \"$PLAN_RECAP_TOKEN\" || true; fi\n\n      - name: Cache Playwright browsers\n        if: steps.url.outputs.ok == 'true'\n        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3\n        with:\n          path: ~/.cache/ms-playwright\n          key: playwright-1-${{ runner.os }}\n\n      - name: Screenshot + upload\n        id: shot\n        if: steps.url.outputs.ok == 'true'\n        continue-on-error: true\n        env:\n          # recap-url.txt is untrusted agent output; pass via env, never ${{ }}.\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\n        run: |\n          set -uo pipefail\n          pnpm exec playwright install --with-deps chromium 2>/dev/null || npx -y playwright@1 install --with-deps chromium || true\n          LIGHT_SHOT_JSON=\"$($RECAP_CLI recap shot --url \"$PLAN_URL\" --token \"$PLAN_RECAP_TOKEN\" --app-url \"$PLAN_RECAP_APP_URL\" --out recap.png --theme light || echo '{}')\"\n          DARK_SHOT_JSON=\"$($RECAP_CLI recap shot --url \"$PLAN_URL\" --token \"$PLAN_RECAP_TOKEN\" --app-url \"$PLAN_RECAP_APP_URL\" --out recap-dark.png --theme dark || echo '{}')\"\n          IMAGE_URL=$(node -e 'try{process.stdout.write(JSON.parse(process.argv[1]).imageUrl||\"\")}catch{process.stdout.write(\"\")}' \"$LIGHT_SHOT_JSON\")\n          DARK_IMAGE_URL=$(node -e 'try{process.stdout.write(JSON.parse(process.argv[1]).imageUrl||\"\")}catch{process.stdout.write(\"\")}' \"$DARK_SHOT_JSON\")\n          echo \"image_url=$IMAGE_URL\" >> \"$GITHUB_OUTPUT\"\n          echo \"light_image_url=$IMAGE_URL\" >> \"$GITHUB_OUTPUT\"\n          echo \"dark_image_url=$DARK_IMAGE_URL\" >> \"$GITHUB_OUTPUT\"\n          if [ -f recap.png ] || [ -f recap-dark.png ]; then echo \"captured=true\" >> \"$GITHUB_OUTPUT\"; else echo \"captured=false\" >> \"$GITHUB_OUTPUT\"; fi\n\n      - name: Upload recap screenshot artifact\n        if: steps.shot.outputs.captured == 'true'\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n        with:\n          name: pr-visual-recap-${{ github.event.pull_request.number }}\n          path: |\n            recap.png\n            recap-dark.png\n          if-no-files-found: ignore\n          retention-days: 14\n\n      - name: Upsert sticky comment\n        if: always()\n        continue-on-error: true\n        env:\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\n          RECAP_IMAGE_URL: ${{ steps.shot.outputs.image_url }}\n          RECAP_LIGHT_IMAGE_URL: ${{ steps.shot.outputs.light_image_url }}\n          RECAP_DARK_IMAGE_URL: ${{ steps.shot.outputs.dark_image_url }}\n          SUPPRESSED: ${{ steps.scan.outputs.suppressed }}\n          SUPPRESSED_JSON: ${{ steps.scan.outputs.json }}\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\n          DIFF_TINY: ${{ steps.diff.outputs.tiny }}\n          PREV_PLAN_ID: ${{ steps.prev.outputs.plan_id }}\n          RECAP_AUTH_FAILED: ${{ steps.auth_probe.outputs.auth_failed }}\n          RECAP_AGENT_SUMMARY: ${{ steps.agent_summary.outputs.summary }}\n          RECAP_URL_REASON: ${{ steps.url.outputs.reason }}\n        run: |\n          set -euo pipefail\n          ARGS=(recap comment upsert --repo \"$GITHUB_REPOSITORY\" --issue \"$PR_NUMBER\" --token \"$GH_TOKEN\")\n          # On a tiny diff, only REFRESH an existing comment, never create one.\n          if [ \"${DIFF_TINY:-}\" = \"true\" ]; then ARGS+=(--update-only); fi\n          $RECAP_CLI \"${ARGS[@]}\"\n\n      - name: Complete visual recap check\n        if: always() && steps.recap_check.outputs.check_run_id != ''\n        continue-on-error: true\n        env:\n          # Untrusted/step values via env (NOT ${{ }}-interpolated into the run\n          # body): the agent-written plan URL and the scan JSON could inject shell.\n          CHECK_RUN_ID: ${{ steps.recap_check.outputs.check_run_id }}\n          PLAN_OK: ${{ steps.url.outputs.ok }}\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\n          SUPPRESSED: ${{ steps.scan.outputs.suppressed }}\n          SUPPRESSED_JSON: ${{ steps.scan.outputs.json }}\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\n          DIFF_TINY: ${{ steps.diff.outputs.tiny }}\n          RECAP_AGENT_SUMMARY: ${{ steps.agent_summary.outputs.summary }}\n          RECAP_URL_REASON: ${{ steps.url.outputs.reason }}\n        run: |\n          set -uo pipefail\n          $RECAP_CLI recap check complete \\\n            --check-run-id \"$CHECK_RUN_ID\" \\\n            --plan-ok \"$PLAN_OK\" \\\n            --plan-url \"$PLAN_URL\" \\\n            --suppressed \"$SUPPRESSED\" \\\n            --suppressed-json \"$SUPPRESSED_JSON\" \\\n            --huge \"$DIFF_HUGE\" \\\n            --tiny \"$DIFF_TINY\" \\\n            --failure-summary \"$RECAP_AGENT_SUMMARY\" \\\n            --url-reason \"$RECAP_URL_REASON\" \\\n            --workflow-url \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID\"\n";
+export declare const PR_VISUAL_RECAP_WORKFLOW_YML = "name: PR Visual Recap\n\n# Visual code review: a coding agent runs the repo's visual-recap skill over the\n# PR diff, publishes a plan, and upserts one sticky comment with a screenshot.\n# Plain `pull_request` (NOT `pull_request_target`) so fork code never sees secrets.\n\non:\n  pull_request:\n    types: [opened, synchronize, reopened, ready_for_review]\n\npermissions:\n  contents: read\n\nconcurrency:\n  group: pr-visual-recap-${{ github.event.pull_request.number }}\n  cancel-in-progress: true\n\nenv:\n  VISUAL_RECAP_AGENT: ${{ vars.VISUAL_RECAP_AGENT || 'claude' }}\n  VISUAL_RECAP_SKILL_SOURCE: ${{ vars.VISUAL_RECAP_SKILL_SOURCE || 'auto' }}\n\njobs:\n  gate:\n    name: Gate\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n      issues: write\n      pull-requests: write\n    outputs:\n      run: ${{ steps.decide.outputs.run }}\n      agent: ${{ steps.decide.outputs.agent }}\n    steps:\n      - id: decide\n        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n        env:\n          # Presence-only signals \u2014 never expose secret VALUES to the gate.\n          HAS_PLAN: ${{ secrets.PLAN_RECAP_TOKEN != '' }}\n          HAS_ANTHROPIC: ${{ secrets.ANTHROPIC_API_KEY != '' }}\n          HAS_OPENAI: ${{ secrets.OPENAI_API_KEY != '' }}\n          AGENT: ${{ env.VISUAL_RECAP_AGENT }}\n          VISUAL_RECAP_MODEL: ${{ vars.VISUAL_RECAP_MODEL }}\n          HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n        with:\n          script: |\n            const pr = context.payload.pull_request;\n            const reasons = [];\n\n            if (!pr) reasons.push('no pull_request payload');\n            if (pr && pr.draft) reasons.push('draft PR');\n\n            // Fork PRs run with no secrets, so publishing would fail anyway \u2014 skip.\n            const headRepo = pr && pr.head && pr.head.repo && pr.head.repo.full_name;\n            if (pr && headRepo && headRepo !== process.env.GITHUB_REPOSITORY) {\n              reasons.push(`fork PR (${headRepo})`);\n            }\n\n            const login = (pr && pr.user && pr.user.login || '').toLowerCase();\n            const botAuthors = ['dependabot[bot]', 'dependabot', 'renovate[bot]', 'renovate'];\n            if (botAuthors.includes(login)) reasons.push(`bot author (${login})`);\n            if (pr && pr.user && pr.user.type === 'Bot') reasons.push('bot author (type=Bot)');\n\n            if (process.env.HAS_PLAN !== 'true') reasons.push('PLAN_RECAP_TOKEN not configured');\n\n            // Normalize + validate the agent so a mis-cased value can't pass the\n            // gate and then match neither agent step below.\n            const agent = (process.env.AGENT || 'claude').toLowerCase();\n            if (agent !== 'claude' && agent !== 'codex') {\n              reasons.push(`unsupported VISUAL_RECAP_AGENT \"${process.env.AGENT}\" (expected \"claude\" or \"codex\")`);\n            } else if (agent === 'codex') {\n              if (process.env.HAS_OPENAI !== 'true') reasons.push('OPENAI_API_KEY not configured (codex backend)');\n            } else {\n              if (process.env.HAS_ANTHROPIC !== 'true') reasons.push('ANTHROPIC_API_KEY not configured (claude backend)');\n            }\n\n            // Validate the model before it reaches the agent CLI.\n            const model = process.env.VISUAL_RECAP_MODEL || '';\n            if (model && !/^[a-zA-Z0-9._-]{1,80}$/.test(model)) {\n              reasons.push(`invalid VISUAL_RECAP_MODEL value (must match [a-zA-Z0-9._-]{1,80})`);\n            }\n\n            // Self-modifying guard, evaluated in the trusted gate (runs NO\n            // PR-checked-out code): skip the ENTIRE job if the PR touches the\n            // workflow, skill, or any agent config the runner loads, so a PR\n            // can't rewrite what runs and exfiltrate secrets.\n            if (pr) {\n              try {\n                const files = await github.paginate(github.rest.pulls.listFiles, {\n                  owner: context.repo.owner,\n                  repo: context.repo.repo,\n                  pull_number: pr.number,\n                  per_page: 100,\n                });\n                const isSensitive = (p) =>\n                  p === '.github/workflows/pr-visual-recap.yml' ||\n                  /(^|\\/)skills\\/visual-(recap|plan|plans)\\//.test(p) ||\n                  /(^|\\/)\\.claude\\//.test(p) ||\n                  /(^|\\/)CLAUDE\\.md$/.test(p) ||\n                  /(^|\\/)AGENTS\\.md$/.test(p) ||\n                  /(^|\\/)\\.mcp\\.json$/.test(p);\n                const hits = files.map((f) => f.filename).filter(isSensitive);\n                if (hits.length) {\n                  reasons.push(`PR modifies recap-control files (${hits.slice(0, 3).join(', ')}${hits.length > 3 ? ', \u2026' : ''}) \u2014 skipping so untrusted PR code never runs with secrets`);\n                }\n              } catch (e) {\n                // Fail closed: if the file list can't be read, skip.\n                reasons.push(`could not list PR files for the self-modifying guard (${e.message}); skipping to be safe`);\n              }\n            }\n\n            const run = reasons.length === 0;\n            core.setOutput('run', run ? 'true' : 'false');\n            core.setOutput('agent', agent);\n            core.info(run ? `Visual recap will run (${agent}).` : `Visual recap skipped: ${reasons.join('; ')}`);\n\n            // When skipping, refresh an EXISTING sticky recap comment with a\n            // short skip line so it does not silently go stale. Never create a\n            // new comment (no spam for repos where the recap has never run).\n            if (!run && pr) {\n              try {\n                const MARKER = '<!-- pr-visual-recap -->';\n                const { data: comments } = await github.rest.issues.listComments({\n                  owner: context.repo.owner,\n                  repo: context.repo.repo,\n                  issue_number: pr.number,\n                  per_page: 100,\n                });\n                const existing = comments.find(\n                  (c) => c.user && c.user.type === 'Bot' && c.body && c.body.includes(MARKER)\n                );\n                if (existing) {\n                  const headShort = (process.env.HEAD_SHA || '').slice(0, 7);\n                  const shaRef = headShort ? `\\`${headShort}\\`` : 'latest push';\n                  const primaryReason = reasons.filter(\n                    (r) => !r.startsWith('could not list PR files for the self-modifying guard')\n                  )[0] || reasons[0] || 'skipped';\n                  const skipLine = `_Recap skipped for ${shaRef}: ${primaryReason}._`;\n                  const withoutPrev = (existing.body || '')\n                    .split('\\n')\n                    .filter((l) => !/_Recap skipped for .+_$/.test(l.trim()))\n                    .join('\\n')\n                    .trimEnd();\n                  const updatedBody = `${withoutPrev}\\n\\n${skipLine}`;\n                  await github.rest.issues.updateComment({\n                    owner: context.repo.owner,\n                    repo: context.repo.repo,\n                    comment_id: existing.id,\n                    body: updatedBody,\n                  });\n                }\n              } catch (e) {\n                core.warning(`Could not update recap skip comment: ${e.message}`);\n              }\n            }\n\n  recap:\n    name: Generate visual recap\n    needs: gate\n    if: needs.gate.outputs.run == 'true'\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      actions: write\n      checks: write\n      contents: read\n      issues: write\n      pull-requests: write\n    env:\n      PLAN_RECAP_APP_URL: ${{ secrets.PLAN_RECAP_APP_URL || 'https://plan.agent-native.com' }}\n      PLAN_RECAP_TOKEN: ${{ secrets.PLAN_RECAP_TOKEN }}\n      GH_TOKEN: ${{ github.token }}\n      PR_NUMBER: ${{ github.event.pull_request.number }}\n      HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n      VISUAL_RECAP_MODEL: ${{ vars.VISUAL_RECAP_MODEL }}\n      VISUAL_RECAP_REASONING: ${{ vars.VISUAL_RECAP_REASONING }}\n      VISUAL_RECAP_SKILL_SOURCE: ${{ vars.VISUAL_RECAP_SKILL_SOURCE || 'auto' }}\n    steps:\n      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n        with:\n          fetch-depth: 0\n          # This job runs an agent over untrusted PR diff; don't leave the token\n          # in .git/config (it uses GH_TOKEN for gh API calls, never git push).\n          persist-credentials: false\n\n      # Dogfood trusted base-branch source inside this monorepo, else install the\n      # published package once. Never execute PR-head recap CLI code.\n      - name: Resolve recap CLI\n        id: cli\n        env:\n          # Optional: pin the consumer CLI version (e.g. \"1.2.3\"). Defaults to\n          # \"latest\" when unset. Set via repository variable RECAP_CLI_VERSION.\n          RECAP_CLI_VERSION: ${{ vars.RECAP_CLI_VERSION || 'latest' }}\n        run: |\n          if [ \"$GITHUB_REPOSITORY\" = \"BuilderIO/agent-native\" ] && [ -f packages/core/src/cli/index.ts ]; then\n            echo \"local=true\" >> \"$GITHUB_OUTPUT\"\n          else\n            echo \"local=false\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n        if: steps.cli.outputs.local == 'true'\n        with:\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .recap-cli-source\n          fetch-depth: 1\n          persist-credentials: false\n\n      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8\n        if: steps.cli.outputs.local == 'true'\n\n      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n        with:\n          node-version: \"22\"\n          cache: ${{ steps.cli.outputs.local == 'true' && 'pnpm' || '' }}\n\n      - name: Install trusted workspace recap CLI\n        if: steps.cli.outputs.local == 'true'\n        working-directory: .recap-cli-source\n        run: |\n          set -euo pipefail\n          pnpm install --frozen-lockfile --ignore-scripts\n          echo \"RECAP_CLI=$PWD/node_modules/.bin/tsx $PWD/packages/core/src/cli/index.ts\" >> \"$GITHUB_ENV\"\n\n      - name: Install published recap CLI\n        if: steps.cli.outputs.local != 'true'\n        env:\n          RECAP_CLI_VERSION: ${{ vars.RECAP_CLI_VERSION || 'latest' }}\n        run: |\n          set -euo pipefail\n          VERSION=\"$RECAP_CLI_VERSION\"\n          if [ \"$VERSION\" = \"latest\" ]; then\n            VERSION=\"$(npm view @agent-native/core@latest version)\"\n          fi\n          for attempt in 1 2 3; do\n            if npm install --prefix \"$RUNNER_TEMP/recap-cli\" --no-audit --no-fund \"@agent-native/core@$VERSION\"; then\n              break\n            fi\n            if [ \"$attempt\" = \"3\" ]; then exit 1; fi\n            sleep $((attempt * 10))\n          done\n          echo \"RECAP_CLI=$RUNNER_TEMP/recap-cli/node_modules/.bin/agent-native\" >> \"$GITHUB_ENV\"\n\n      - name: Start visual recap check\n        id: recap_check\n        continue-on-error: true\n        run: |\n          set -uo pipefail\n          $RECAP_CLI recap check start --sha \"$HEAD_SHA\" --workflow-url \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID\"\n\n      - name: Collect bounded diff\n        id: diff\n        env:\n          BASE_SHA: ${{ github.event.pull_request.base.sha }}\n        run: |\n          set -euo pipefail\n          $RECAP_CLI recap collect-diff --base \"$BASE_SHA\" --head \"$HEAD_SHA\" --out recap.diff --stat recap.stat\n\n      - name: Probe plan-app auth\n        id: auth_probe\n        if: steps.diff.outputs.tiny != 'true'\n        continue-on-error: true\n        run: |\n          set -uo pipefail\n          # Hit the plan app's action surface with the publish token. A 401 means\n          # the token is expired/revoked; surface it in the sticky comment so the\n          # repo owner knows to re-mint it instead of seeing a generic failure.\n          HTTP_STATUS=$(node -e '\n            const https = require(\"https\");\n            const url = new URL(\"/_agent-native/actions/record-recap-usage\", process.env.PLAN_RECAP_APP_URL || \"https://plan.agent-native.com\");\n            const req = https.request(url, { method: \"POST\", headers: { \"authorization\": \"Bearer \" + process.env.PLAN_RECAP_TOKEN, \"content-type\": \"application/json\" }, timeout: 8000 }, (res) => { process.stdout.write(String(res.statusCode)); req.destroy(); });\n            req.on(\"error\", () => process.stdout.write(\"0\"));\n            req.end(JSON.stringify({ planId: \"__probe__\" }));\n          ' 2>/dev/null || echo \"0\")\n          if [ \"$HTTP_STATUS\" = \"401\" ]; then\n            echo \"auth_failed=true\" >> \"$GITHUB_OUTPUT\"\n          else\n            echo \"auth_failed=false\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - name: Secret scan\n        id: scan\n        if: steps.diff.outputs.tiny != 'true'\n        run: |\n          set -uo pipefail\n          # Fail CLOSED: a scanner error or invalid JSON suppresses the diff so a\n          # credential-bearing diff is never handed to the agent / plan service.\n          if ! SCAN_JSON=\"$($RECAP_CLI recap scan --diff recap.diff)\"; then\n            SCAN_JSON='{\"suppressed\":true,\"reason\":\"secret scan failed to run; failing closed\"}'\n          fi\n          {\n            echo 'json<<__RECAP_SCAN_EOF__'\n            echo \"$SCAN_JSON\"\n            echo '__RECAP_SCAN_EOF__'\n          } >> \"$GITHUB_OUTPUT\"\n          SUPPRESSED=$(node -e 'try{process.stdout.write(JSON.parse(process.argv[1]).suppressed?\"true\":\"false\")}catch{process.stdout.write(\"true\")}' \"$SCAN_JSON\")\n          echo \"suppressed=$SUPPRESSED\" >> \"$GITHUB_OUTPUT\"\n\n      - name: Read previous plan id\n        id: prev\n        continue-on-error: true\n        run: |\n          set -euo pipefail\n          PLAN_ID=\"$($RECAP_CLI recap comment find-plan-id --repo \"$GITHUB_REPOSITORY\" --issue \"$PR_NUMBER\" --token \"$GH_TOKEN\")\"\n          echo \"plan_id=$PLAN_ID\" >> \"$GITHUB_OUTPUT\"\n\n      - name: Smoke-test Plan MCP tools\n        id: mcp_smoke\n        if: steps.diff.outputs.tiny != 'true' && steps.scan.outputs.suppressed != 'true'\n        continue-on-error: true\n        run: |\n          set -uo pipefail\n          $RECAP_CLI recap mcp-smoke --app-url \"$PLAN_RECAP_APP_URL\"\n\n      - name: Build recap prompt\n        id: prompt\n        if: steps.diff.outputs.tiny != 'true' && steps.scan.outputs.suppressed != 'true' && steps.mcp_smoke.outputs.ok == 'true'\n        env:\n          # Pass step outputs via env, NOT ${{ }} interpolation into the run body:\n          # the prev plan id is parsed from a PR comment and could inject shell.\n          PREV_PLAN_ID: ${{ steps.prev.outputs.plan_id }}\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\n        run: |\n          set -euo pipefail\n          ARGS=(--diff recap.diff --stat recap.stat --pr \"$PR_NUMBER\" --repo \"$GITHUB_REPOSITORY\" --head \"$HEAD_SHA\" --app-url \"$PLAN_RECAP_APP_URL\" --skill-source \"$VISUAL_RECAP_SKILL_SOURCE\" --out recap-prompt.md)\n          if [ \"${DIFF_HUGE:-}\" = \"true\" ]; then ARGS+=(--huge); fi\n          if [ -n \"${PREV_PLAN_ID:-}\" ]; then ARGS+=(--prev-plan-id \"$PREV_PLAN_ID\"); fi\n          $RECAP_CLI recap build-prompt \"${ARGS[@]}\"\n\n      - name: Run agent (Claude Code)\n        id: claude\n        if: needs.gate.outputs.agent == 'claude' && steps.diff.outputs.tiny != 'true' && steps.scan.outputs.suppressed != 'true' && steps.mcp_smoke.outputs.ok == 'true'\n        continue-on-error: true\n        env:\n          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}\n        run: |\n          set -uo pipefail\n          MCP_CONFIG=\"$RUNNER_TEMP/plan-mcp.json\"\n          $RECAP_CLI recap mcp-config --agent claude --app-url \"$PLAN_RECAP_APP_URL\" --out \"$MCP_CONFIG\"\n          CLAUDE_ARGS=(-p \"$(cat recap-prompt.md)\" --mcp-config \"$MCP_CONFIG\" --allowedTools \"Read,Write,Bash(git diff:*),mcp__plan__get-plan-blocks,mcp__plan__create-visual-recap,mcp__plan__set-resource-visibility\" --permission-mode dontAsk --output-format json)\n          if [ -n \"${VISUAL_RECAP_MODEL:-}\" ]; then CLAUDE_ARGS+=(--model \"$VISUAL_RECAP_MODEL\"); fi\n          rm -f recap-url.txt claude-result.json claude-stderr.log\n          run_claude() {\n            set +e\n            npx -y @anthropic-ai/claude-code@2 \"${CLAUDE_ARGS[@]}\" > claude-result.json 2> claude-stderr.log\n            CLAUDE_STATUS=\"$?\"\n            set -e\n            echo \"$CLAUDE_STATUS\" > claude-exit-code.txt\n          }\n          run_claude\n          if [ ! -s recap-url.txt ] && grep -Eiq 'schedule(d)? (a )?(wakeup|retry)|will retry|backoff|connector.*register|mcp.*(register|unreachable|not usable|zero tools|not callable)' claude-result.json claude-stderr.log 2>/dev/null; then\n            echo \"Plan MCP registration appears delayed; retrying Claude once after 20s.\"\n            sleep 20\n            run_claude\n          fi\n          rm -f \"$MCP_CONFIG\" || true\n\n      - name: Run agent (Codex)\n        id: codex\n        if: needs.gate.outputs.agent == 'codex' && steps.diff.outputs.tiny != 'true' && steps.scan.outputs.suppressed != 'true' && steps.mcp_smoke.outputs.ok == 'true'\n        continue-on-error: true\n        env:\n          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\n        run: |\n          set -uo pipefail\n          $RECAP_CLI recap mcp-config --agent codex --app-url \"$PLAN_RECAP_APP_URL\" --force\n          # `codex login` writes ~/.codex/auth.json (the bare env var is dropped on\n          # the gpt-5.5 wss transport); stdin keeps the key out of process args.\n          printenv OPENAI_API_KEY | npx -y @openai/codex@0 login --with-api-key || true\n          # The runner is itself an ephemeral sandbox; bypass Codex's own sandbox\n          # (bubblewrap can't init here) and approval gate (cancels the MCP write).\n          CODEX_ARGS=(exec --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check)\n          if [ -n \"${VISUAL_RECAP_MODEL:-}\" ]; then CODEX_ARGS+=(--model \"$VISUAL_RECAP_MODEL\"); fi\n          # Validate reasoning against the enum before embedding it in the TOML override.\n          case \"${VISUAL_RECAP_REASONING:-}\" in\n            none|minimal|low|medium|high|xhigh)\n              CODEX_ARGS+=(-c \"model_reasoning_effort=\\\"$VISUAL_RECAP_REASONING\\\"\") ;;\n            \"\") ;;\n            *) echo \"Ignoring invalid VISUAL_RECAP_REASONING: $VISUAL_RECAP_REASONING\" ;;\n          esac\n          rm -f recap-url.txt codex-events.jsonl codex-stderr.log\n          run_codex() {\n            set +e\n            npx -y @openai/codex@0 \"${CODEX_ARGS[@]}\" --json \"$(cat recap-prompt.md)\" 2> codex-stderr.log | tee codex-events.jsonl\n            CODEX_STATUS=\"${PIPESTATUS[0]}\"\n            set -e\n            echo \"$CODEX_STATUS\" > codex-exit-code.txt\n          }\n          run_codex\n          if [ ! -s recap-url.txt ] && grep -Eiq 'schedule(d)? (a )?(wakeup|retry)|will retry|backoff|connector.*register|mcp.*(register|unreachable|not usable|zero tools|not callable)' codex-events.jsonl codex-stderr.log 2>/dev/null; then\n            echo \"Plan MCP registration appears delayed; retrying Codex once after 20s.\"\n            sleep 20\n            run_codex\n          fi\n\n      - name: Read plan URL\n        id: url\n        if: steps.diff.outputs.tiny != 'true' && steps.scan.outputs.suppressed != 'true'\n        run: |\n          set -uo pipefail\n          PLAN_URL=\"\"\n          URL_REASON=\"\"\n          if [ -f recap-url.txt ]; then\n            PLAN_URL=\"$(tr -d '\\r\\n' < recap-url.txt | tr -d ' ')\"\n          else\n            URL_REASON=\"recap-url.txt was not created by the agent\"\n          fi\n          # recap-url.txt is agent-written -> untrusted. Rebuild a canonical\n          # recap URL from the trusted app base and a strictly validated plan id,\n          # preserving path-prefixed self-hosted mounts.\n          if [ -z \"$URL_REASON\" ]; then\n            URL_RESULT=$(PLAN_URL=\"$PLAN_URL\" node <<'NODE'\n          const emit = (value) => process.stdout.write(JSON.stringify(value));\n          try {\n            const raw = process.env.PLAN_URL || \"\";\n            if (!raw) {\n              emit({ url: \"\", reason: \"recap-url.txt was empty\" });\n              process.exit(0);\n            }\n            const trusted = new URL(process.env.PLAN_RECAP_APP_URL || \"https://plan.agent-native.com\");\n            const parsed = /^https?:\\/\\//i.test(raw)\n              ? new URL(raw)\n              : new URL(raw, trusted);\n            if (parsed.origin !== trusted.origin) {\n              emit({ url: \"\", reason: `recap-url.txt points at ${parsed.origin}, expected ${trusted.origin}` });\n              process.exit(0);\n            }\n\n            const base = trusted.pathname.replace(/\\/$/, \"\");\n            const paths = [parsed.pathname];\n            if (base && parsed.pathname.startsWith(`${base}/`)) {\n              paths.push(parsed.pathname.slice(base.length) || \"/\");\n            }\n\n            for (const path of paths) {\n              const match = path.match(/^\\/(?:plans|recaps)\\/([A-Za-z0-9_-]+)\\/?$/);\n              if (match) {\n                emit({ url: `${trusted.origin}${base}/recaps/${match[1]}`, reason: \"\" });\n                process.exit(0);\n              }\n            }\n            emit({ url: \"\", reason: \"recap-url.txt did not contain a valid /plans/<id> or /recaps/<id> URL for the configured plan app\" });\n          } catch {\n            emit({ url: \"\", reason: \"recap-url.txt was not a valid URL or recap path\" });\n          }\n          NODE\n            )\n            CANONICAL_URL=$(node -e 'try{process.stdout.write(JSON.parse(process.argv[1]).url||\"\")}catch{process.stdout.write(\"\")}' \"$URL_RESULT\")\n            URL_REASON=$(node -e 'try{process.stdout.write(JSON.parse(process.argv[1]).reason||\"\")}catch{process.stdout.write(\"recap-url.txt URL validation failed\")}' \"$URL_RESULT\")\n          else\n            CANONICAL_URL=\"\"\n          fi\n          if [ -n \"$CANONICAL_URL\" ]; then\n            echo \"plan_url=$CANONICAL_URL\" >> \"$GITHUB_OUTPUT\"; echo \"ok=true\" >> \"$GITHUB_OUTPUT\"\n          else\n            echo \"plan_url=\" >> \"$GITHUB_OUTPUT\"; echo \"ok=false\" >> \"$GITHUB_OUTPUT\"\n          fi\n          {\n            echo 'reason<<__RECAP_URL_REASON_EOF__'\n            echo \"$URL_REASON\"\n            echo '__RECAP_URL_REASON_EOF__'\n          } >> \"$GITHUB_OUTPUT\"\n\n      - name: Summarize agent failure\n        id: agent_summary\n        if: steps.url.outputs.ok != 'true' && steps.diff.outputs.tiny != 'true' && steps.scan.outputs.suppressed != 'true'\n        continue-on-error: true\n        env:\n          RECAP_AGENT: ${{ needs.gate.outputs.agent }}\n          RECAP_MCP_SMOKE_OK: ${{ steps.mcp_smoke.outputs.ok }}\n          RECAP_MCP_SMOKE_SUMMARY: ${{ steps.mcp_smoke.outputs.summary }}\n        run: |\n          set -uo pipefail\n          if [ -n \"${RECAP_MCP_SMOKE_SUMMARY:-}\" ] && [ \"${RECAP_MCP_SMOKE_OK:-}\" != \"true\" ]; then\n            {\n              echo 'summary<<__RECAP_MCP_SMOKE_SUMMARY_EOF__'\n              echo \"$RECAP_MCP_SMOKE_SUMMARY\"\n              echo '__RECAP_MCP_SMOKE_SUMMARY_EOF__'\n            } >> \"$GITHUB_OUTPUT\"\n            node -e 'process.stdout.write(JSON.stringify({ ok: true, summary: process.env.RECAP_MCP_SMOKE_SUMMARY || \"\" }) + \"\\n\")'\n            exit 0\n          fi\n          RESULT=claude-result.json\n          STDERR=claude-stderr.log\n          EXIT_CODE=claude-exit-code.txt\n          if [ \"$RECAP_AGENT\" = \"codex\" ]; then\n            RESULT=codex-events.jsonl\n            STDERR=codex-stderr.log\n            EXIT_CODE=codex-exit-code.txt\n          fi\n          $RECAP_CLI recap agent-summary --agent \"$RECAP_AGENT\" --result-file \"$RESULT\" --stderr-file \"$STDERR\" --exit-code-file \"$EXIT_CODE\" || true\n\n      - name: Attach usage\n        if: steps.url.outputs.ok == 'true'\n        continue-on-error: true\n        env:\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\n          # Use the gate-normalized agent so \"Codex\" still selects the right file.\n          RECAP_AGENT: ${{ needs.gate.outputs.agent }}\n        run: |\n          set -uo pipefail\n          RESULT=claude-result.json\n          if [ \"$RECAP_AGENT\" = \"codex\" ]; then RESULT=codex-events.jsonl; fi\n          if [ -f \"$RESULT\" ]; then $RECAP_CLI recap usage --plan-url \"$PLAN_URL\" --agent \"$RECAP_AGENT\" --result-file \"$RESULT\" --model \"${VISUAL_RECAP_MODEL:-}\" --app-url \"$PLAN_RECAP_APP_URL\" --token \"$PLAN_RECAP_TOKEN\" || true; fi\n\n      - name: Cache Playwright browsers\n        if: steps.url.outputs.ok == 'true'\n        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3\n        with:\n          path: ~/.cache/ms-playwright\n          key: playwright-1-${{ runner.os }}\n\n      - name: Screenshot + upload\n        id: shot\n        if: steps.url.outputs.ok == 'true'\n        continue-on-error: true\n        env:\n          # recap-url.txt is untrusted agent output; pass via env, never ${{ }}.\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\n        run: |\n          set -uo pipefail\n          pnpm exec playwright install --with-deps chromium 2>/dev/null || npx -y playwright@1 install --with-deps chromium || true\n          LIGHT_SHOT_JSON=\"$($RECAP_CLI recap shot --url \"$PLAN_URL\" --token \"$PLAN_RECAP_TOKEN\" --app-url \"$PLAN_RECAP_APP_URL\" --out recap.png --theme light || echo '{}')\"\n          DARK_SHOT_JSON=\"$($RECAP_CLI recap shot --url \"$PLAN_URL\" --token \"$PLAN_RECAP_TOKEN\" --app-url \"$PLAN_RECAP_APP_URL\" --out recap-dark.png --theme dark || echo '{}')\"\n          IMAGE_URL=$(node -e 'try{process.stdout.write(JSON.parse(process.argv[1]).imageUrl||\"\")}catch{process.stdout.write(\"\")}' \"$LIGHT_SHOT_JSON\")\n          DARK_IMAGE_URL=$(node -e 'try{process.stdout.write(JSON.parse(process.argv[1]).imageUrl||\"\")}catch{process.stdout.write(\"\")}' \"$DARK_SHOT_JSON\")\n          echo \"image_url=$IMAGE_URL\" >> \"$GITHUB_OUTPUT\"\n          echo \"light_image_url=$IMAGE_URL\" >> \"$GITHUB_OUTPUT\"\n          echo \"dark_image_url=$DARK_IMAGE_URL\" >> \"$GITHUB_OUTPUT\"\n          if [ -f recap.png ] || [ -f recap-dark.png ]; then echo \"captured=true\" >> \"$GITHUB_OUTPUT\"; else echo \"captured=false\" >> \"$GITHUB_OUTPUT\"; fi\n\n      - name: Upload recap screenshot artifact\n        if: steps.shot.outputs.captured == 'true'\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n        with:\n          name: pr-visual-recap-${{ github.event.pull_request.number }}\n          path: |\n            recap.png\n            recap-dark.png\n          if-no-files-found: ignore\n          retention-days: 14\n\n      - name: Upsert sticky comment\n        if: always()\n        continue-on-error: true\n        env:\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\n          RECAP_IMAGE_URL: ${{ steps.shot.outputs.image_url }}\n          RECAP_LIGHT_IMAGE_URL: ${{ steps.shot.outputs.light_image_url }}\n          RECAP_DARK_IMAGE_URL: ${{ steps.shot.outputs.dark_image_url }}\n          SUPPRESSED: ${{ steps.scan.outputs.suppressed }}\n          SUPPRESSED_JSON: ${{ steps.scan.outputs.json }}\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\n          DIFF_TINY: ${{ steps.diff.outputs.tiny }}\n          PREV_PLAN_ID: ${{ steps.prev.outputs.plan_id }}\n          RECAP_AUTH_FAILED: ${{ steps.auth_probe.outputs.auth_failed }}\n          RECAP_AGENT_SUMMARY: ${{ steps.agent_summary.outputs.summary }}\n          RECAP_URL_REASON: ${{ steps.url.outputs.reason }}\n        run: |\n          set -euo pipefail\n          ARGS=(recap comment upsert --repo \"$GITHUB_REPOSITORY\" --issue \"$PR_NUMBER\" --token \"$GH_TOKEN\")\n          # On a tiny diff, only REFRESH an existing comment, never create one.\n          if [ \"${DIFF_TINY:-}\" = \"true\" ]; then ARGS+=(--update-only); fi\n          $RECAP_CLI \"${ARGS[@]}\"\n\n      - name: Complete visual recap check\n        if: always() && steps.recap_check.outputs.check_run_id != ''\n        continue-on-error: true\n        env:\n          # Untrusted/step values via env (NOT ${{ }}-interpolated into the run\n          # body): the agent-written plan URL and the scan JSON could inject shell.\n          CHECK_RUN_ID: ${{ steps.recap_check.outputs.check_run_id }}\n          PLAN_OK: ${{ steps.url.outputs.ok }}\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\n          SUPPRESSED: ${{ steps.scan.outputs.suppressed }}\n          SUPPRESSED_JSON: ${{ steps.scan.outputs.json }}\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\n          DIFF_TINY: ${{ steps.diff.outputs.tiny }}\n          RECAP_AGENT_SUMMARY: ${{ steps.agent_summary.outputs.summary }}\n          RECAP_URL_REASON: ${{ steps.url.outputs.reason }}\n        run: |\n          set -uo pipefail\n          $RECAP_CLI recap check complete \\\n            --check-run-id \"$CHECK_RUN_ID\" \\\n            --plan-ok \"$PLAN_OK\" \\\n            --plan-url \"$PLAN_URL\" \\\n            --suppressed \"$SUPPRESSED\" \\\n            --suppressed-json \"$SUPPRESSED_JSON\" \\\n            --huge \"$DIFF_HUGE\" \\\n            --tiny \"$DIFF_TINY\" \\\n            --failure-summary \"$RECAP_AGENT_SUMMARY\" \\\n            --url-reason \"$RECAP_URL_REASON\" \\\n            --workflow-url \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID\"\n";
 //# sourceMappingURL=pr-visual-recap-workflow.d.ts.map

package/dist/cli/pr-visual-recap-workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pr-visual-recap-workflow.d.ts","sourceRoot":"","sources":["../../src/cli/pr-visual-recap-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,4BAA4B,4u4BACg/3B,CAAC"}
+{"version":3,"file":"pr-visual-recap-workflow.d.ts","sourceRoot":"","sources":["../../src/cli/pr-visual-recap-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,4BAA4B,kx6BACsh6B,CAAC"}

package/dist/cli/pr-visual-recap-workflow.js

@@ -7,5 +7,5 @@
  * recap.spec.ts fails if these drift. Regenerate from the YAML with the snippet
  * in recap.spec.ts.
  */
-export const PR_VISUAL_RECAP_WORKFLOW_YML = 'name: PR Visual Recap\n\n# Visual code review: a coding agent runs the repo\'s visual-recap skill over the\n# PR diff, publishes a plan, and upserts one sticky comment with a screenshot.\n# Plain `pull_request` (NOT `pull_request_target`) so fork code never sees secrets.\n\non:\n  pull_request:\n    types: [opened, synchronize, reopened, ready_for_review]\n\npermissions:\n  contents: read\n\nconcurrency:\n  group: pr-visual-recap-${{ github.event.pull_request.number }}\n  cancel-in-progress: true\n\nenv:\n  VISUAL_RECAP_AGENT: ${{ vars.VISUAL_RECAP_AGENT || \'claude\' }}\n  VISUAL_RECAP_SKILL_SOURCE: ${{ vars.VISUAL_RECAP_SKILL_SOURCE || \'auto\' }}\n\njobs:\n  gate:\n    name: Gate\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n      issues: write\n      pull-requests: write\n    outputs:\n      run: ${{ steps.decide.outputs.run }}\n      agent: ${{ steps.decide.outputs.agent }}\n    steps:\n      - id: decide\n        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n        env:\n          # Presence-only signals — never expose secret VALUES to the gate.\n          HAS_PLAN: ${{ secrets.PLAN_RECAP_TOKEN != \'\' }}\n          HAS_ANTHROPIC: ${{ secrets.ANTHROPIC_API_KEY != \'\' }}\n          HAS_OPENAI: ${{ secrets.OPENAI_API_KEY != \'\' }}\n          AGENT: ${{ env.VISUAL_RECAP_AGENT }}\n          VISUAL_RECAP_MODEL: ${{ vars.VISUAL_RECAP_MODEL }}\n          HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n        with:\n          script: |\n            const pr = context.payload.pull_request;\n            const reasons = [];\n\n            if (!pr) reasons.push(\'no pull_request payload\');\n            if (pr && pr.draft) reasons.push(\'draft PR\');\n\n            // Fork PRs run with no secrets, so publishing would fail anyway — skip.\n            const headRepo = pr && pr.head && pr.head.repo && pr.head.repo.full_name;\n            if (pr && headRepo && headRepo !== process.env.GITHUB_REPOSITORY) {\n              reasons.push(`fork PR (${headRepo})`);\n            }\n\n            const login = (pr && pr.user && pr.user.login || \'\').toLowerCase();\n            const botAuthors = [\'dependabot[bot]\', \'dependabot\', \'renovate[bot]\', \'renovate\'];\n            if (botAuthors.includes(login)) reasons.push(`bot author (${login})`);\n            if (pr && pr.user && pr.user.type === \'Bot\') reasons.push(\'bot author (type=Bot)\');\n\n            if (process.env.HAS_PLAN !== \'true\') reasons.push(\'PLAN_RECAP_TOKEN not configured\');\n\n            // Normalize + validate the agent so a mis-cased value can\'t pass the\n            // gate and then match neither agent step below.\n            const agent = (process.env.AGENT || \'claude\').toLowerCase();\n            if (agent !== \'claude\' && agent !== \'codex\') {\n              reasons.push(`unsupported VISUAL_RECAP_AGENT "${process.env.AGENT}" (expected "claude" or "codex")`);\n            } else if (agent === \'codex\') {\n              if (process.env.HAS_OPENAI !== \'true\') reasons.push(\'OPENAI_API_KEY not configured (codex backend)\');\n            } else {\n              if (process.env.HAS_ANTHROPIC !== \'true\') reasons.push(\'ANTHROPIC_API_KEY not configured (claude backend)\');\n            }\n\n            // Validate the model before it reaches the agent CLI.\n            const model = process.env.VISUAL_RECAP_MODEL || \'\';\n            if (model && !/^[a-zA-Z0-9._-]{1,80}$/.test(model)) {\n              reasons.push(`invalid VISUAL_RECAP_MODEL value (must match [a-zA-Z0-9._-]{1,80})`);\n            }\n\n            // Self-modifying guard, evaluated in the trusted gate (runs NO\n            // PR-checked-out code): skip the ENTIRE job if the PR touches the\n            // workflow, skill, or any agent config the runner loads, so a PR\n            // can\'t rewrite what runs and exfiltrate secrets.\n            if (pr) {\n              try {\n                const files = await github.paginate(github.rest.pulls.listFiles, {\n                  owner: context.repo.owner,\n                  repo: context.repo.repo,\n                  pull_number: pr.number,\n                  per_page: 100,\n                });\n                const isSensitive = (p) =>\n                  p === \'.github/workflows/pr-visual-recap.yml\' ||\n                  /(^|\\/)skills\\/visual-(recap|plan|plans)\\//.test(p) ||\n                  /(^|\\/)\\.claude\\//.test(p) ||\n                  /(^|\\/)CLAUDE\\.md$/.test(p) ||\n                  /(^|\\/)AGENTS\\.md$/.test(p) ||\n                  /(^|\\/)\\.mcp\\.json$/.test(p);\n                const hits = files.map((f) => f.filename).filter(isSensitive);\n                if (hits.length) {\n                  reasons.push(`PR modifies recap-control files (${hits.slice(0, 3).join(\', \')}${hits.length > 3 ? \', …\' : \'\'}) — skipping so untrusted PR code never runs with secrets`);\n                }\n              } catch (e) {\n                // Fail closed: if the file list can\'t be read, skip.\n                reasons.push(`could not list PR files for the self-modifying guard (${e.message}); skipping to be safe`);\n              }\n            }\n\n            const run = reasons.length === 0;\n            core.setOutput(\'run\', run ? \'true\' : \'false\');\n            core.setOutput(\'agent\', agent);\n            core.info(run ? `Visual recap will run (${agent}).` : `Visual recap skipped: ${reasons.join(\'; \')}`);\n\n            // When skipping, refresh an EXISTING sticky recap comment with a\n            // short skip line so it does not silently go stale. Never create a\n            // new comment (no spam for repos where the recap has never run).\n            if (!run && pr) {\n              try {\n                const MARKER = \'<!-- pr-visual-recap -->\';\n                const { data: comments } = await github.rest.issues.listComments({\n                  owner: context.repo.owner,\n                  repo: context.repo.repo,\n                  issue_number: pr.number,\n                  per_page: 100,\n                });\n                const existing = comments.find(\n                  (c) => c.user && c.user.type === \'Bot\' && c.body && c.body.includes(MARKER)\n                );\n                if (existing) {\n                  const headShort = (process.env.HEAD_SHA || \'\').slice(0, 7);\n                  const shaRef = headShort ? `\\`${headShort}\\`` : \'latest push\';\n                  const primaryReason = reasons.filter(\n                    (r) => !r.startsWith(\'could not list PR files for the self-modifying guard\')\n                  )[0] || reasons[0] || \'skipped\';\n                  const skipLine = `_Recap skipped for ${shaRef}: ${primaryReason}._`;\n                  const withoutPrev = (existing.body || \'\')\n                    .split(\'\\n\')\n                    .filter((l) => !/_Recap skipped for .+_$/.test(l.trim()))\n                    .join(\'\\n\')\n                    .trimEnd();\n                  const updatedBody = `${withoutPrev}\\n\\n${skipLine}`;\n                  await github.rest.issues.updateComment({\n                    owner: context.repo.owner,\n                    repo: context.repo.repo,\n                    comment_id: existing.id,\n                    body: updatedBody,\n                  });\n                }\n              } catch (e) {\n                core.warning(`Could not update recap skip comment: ${e.message}`);\n              }\n            }\n\n  recap:\n    name: Generate visual recap\n    needs: gate\n    if: needs.gate.outputs.run == \'true\'\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      actions: write\n      checks: write\n      contents: read\n      issues: write\n      pull-requests: write\n    env:\n      PLAN_RECAP_APP_URL: ${{ secrets.PLAN_RECAP_APP_URL || \'https://plan.agent-native.com\' }}\n      PLAN_RECAP_TOKEN: ${{ secrets.PLAN_RECAP_TOKEN }}\n      GH_TOKEN: ${{ github.token }}\n      PR_NUMBER: ${{ github.event.pull_request.number }}\n      HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n      VISUAL_RECAP_MODEL: ${{ vars.VISUAL_RECAP_MODEL }}\n      VISUAL_RECAP_REASONING: ${{ vars.VISUAL_RECAP_REASONING }}\n      VISUAL_RECAP_SKILL_SOURCE: ${{ vars.VISUAL_RECAP_SKILL_SOURCE || \'auto\' }}\n    steps:\n      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n        with:\n          fetch-depth: 0\n          # This job runs an agent over untrusted PR diff; don\'t leave the token\n          # in .git/config (it uses GH_TOKEN for gh API calls, never git push).\n          persist-credentials: false\n\n      # Dogfood trusted base-branch source inside this monorepo, else install the\n      # published package once. Never execute PR-head recap CLI code.\n      - name: Resolve recap CLI\n        id: cli\n        env:\n          # Optional: pin the consumer CLI version (e.g. "1.2.3"). Defaults to\n          # "latest" when unset. Set via repository variable RECAP_CLI_VERSION.\n          RECAP_CLI_VERSION: ${{ vars.RECAP_CLI_VERSION || \'latest\' }}\n        run: |\n          if [ "$GITHUB_REPOSITORY" = "BuilderIO/agent-native" ] && [ -f packages/core/src/cli/index.ts ]; then\n            echo "local=true" >> "$GITHUB_OUTPUT"\n          else\n            echo "local=false" >> "$GITHUB_OUTPUT"\n          fi\n\n      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n        if: steps.cli.outputs.local == \'true\'\n        with:\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .recap-cli-source\n          fetch-depth: 1\n          persist-credentials: false\n\n      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8\n        if: steps.cli.outputs.local == \'true\'\n\n      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n        with:\n          node-version: "22"\n          cache: ${{ steps.cli.outputs.local == \'true\' && \'pnpm\' || \'\' }}\n\n      - name: Install trusted workspace recap CLI\n        if: steps.cli.outputs.local == \'true\'\n        working-directory: .recap-cli-source\n        run: |\n          set -euo pipefail\n          pnpm install --frozen-lockfile --ignore-scripts\n          echo "RECAP_CLI=$PWD/node_modules/.bin/tsx $PWD/packages/core/src/cli/index.ts" >> "$GITHUB_ENV"\n\n      - name: Install published recap CLI\n        if: steps.cli.outputs.local != \'true\'\n        env:\n          RECAP_CLI_VERSION: ${{ vars.RECAP_CLI_VERSION || \'latest\' }}\n        run: |\n          set -euo pipefail\n          VERSION="$RECAP_CLI_VERSION"\n          if [ "$VERSION" = "latest" ]; then\n            VERSION="$(npm view @agent-native/core@latest version)"\n          fi\n          for attempt in 1 2 3; do\n            if npm install --prefix "$RUNNER_TEMP/recap-cli" --no-audit --no-fund "@agent-native/core@$VERSION"; then\n              break\n            fi\n            if [ "$attempt" = "3" ]; then exit 1; fi\n            sleep $((attempt * 10))\n          done\n          echo "RECAP_CLI=$RUNNER_TEMP/recap-cli/node_modules/.bin/agent-native" >> "$GITHUB_ENV"\n\n      - name: Start visual recap check\n        id: recap_check\n        continue-on-error: true\n        run: |\n          set -uo pipefail\n          $RECAP_CLI recap check start --sha "$HEAD_SHA" --workflow-url "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"\n\n      - name: Collect bounded diff\n        id: diff\n        env:\n          BASE_SHA: ${{ github.event.pull_request.base.sha }}\n        run: |\n          set -euo pipefail\n          $RECAP_CLI recap collect-diff --base "$BASE_SHA" --head "$HEAD_SHA" --out recap.diff --stat recap.stat\n\n      - name: Probe plan-app auth\n        id: auth_probe\n        if: steps.diff.outputs.tiny != \'true\'\n        continue-on-error: true\n        run: |\n          set -uo pipefail\n          # Hit the plan app\'s action surface with the publish token. A 401 means\n          # the token is expired/revoked; surface it in the sticky comment so the\n          # repo owner knows to re-mint it instead of seeing a generic failure.\n          HTTP_STATUS=$(node -e \'\n            const https = require("https");\n            const url = new URL("/_agent-native/actions/record-recap-usage", process.env.PLAN_RECAP_APP_URL || "https://plan.agent-native.com");\n            const req = https.request(url, { method: "POST", headers: { "authorization": "Bearer " + process.env.PLAN_RECAP_TOKEN, "content-type": "application/json" }, timeout: 8000 }, (res) => { process.stdout.write(String(res.statusCode)); req.destroy(); });\n            req.on("error", () => process.stdout.write("0"));\n            req.end(JSON.stringify({ planId: "__probe__" }));\n          \' 2>/dev/null || echo "0")\n          if [ "$HTTP_STATUS" = "401" ]; then\n            echo "auth_failed=true" >> "$GITHUB_OUTPUT"\n          else\n            echo "auth_failed=false" >> "$GITHUB_OUTPUT"\n          fi\n\n      - name: Secret scan\n        id: scan\n        if: steps.diff.outputs.tiny != \'true\'\n        run: |\n          set -uo pipefail\n          # Fail CLOSED: a scanner error or invalid JSON suppresses the diff so a\n          # credential-bearing diff is never handed to the agent / plan service.\n          if ! SCAN_JSON="$($RECAP_CLI recap scan --diff recap.diff)"; then\n            SCAN_JSON=\'{"suppressed":true,"reason":"secret scan failed to run; failing closed"}\'\n          fi\n          {\n            echo \'json<<__RECAP_SCAN_EOF__\'\n            echo "$SCAN_JSON"\n            echo \'__RECAP_SCAN_EOF__\'\n          } >> "$GITHUB_OUTPUT"\n          SUPPRESSED=$(node -e \'try{process.stdout.write(JSON.parse(process.argv[1]).suppressed?"true":"false")}catch{process.stdout.write("true")}\' "$SCAN_JSON")\n          echo "suppressed=$SUPPRESSED" >> "$GITHUB_OUTPUT"\n\n      - name: Read previous plan id\n        id: prev\n        continue-on-error: true\n        run: |\n          set -euo pipefail\n          PLAN_ID="$($RECAP_CLI recap comment find-plan-id --repo "$GITHUB_REPOSITORY" --issue "$PR_NUMBER" --token "$GH_TOKEN")"\n          echo "plan_id=$PLAN_ID" >> "$GITHUB_OUTPUT"\n\n      - name: Build recap prompt\n        id: prompt\n        if: steps.diff.outputs.tiny != \'true\' && steps.scan.outputs.suppressed != \'true\'\n        env:\n          # Pass step outputs via env, NOT ${{ }} interpolation into the run body:\n          # the prev plan id is parsed from a PR comment and could inject shell.\n          PREV_PLAN_ID: ${{ steps.prev.outputs.plan_id }}\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\n        run: |\n          set -euo pipefail\n          ARGS=(--diff recap.diff --stat recap.stat --pr "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --head "$HEAD_SHA" --app-url "$PLAN_RECAP_APP_URL" --skill-source "$VISUAL_RECAP_SKILL_SOURCE" --out recap-prompt.md)\n          if [ "${DIFF_HUGE:-}" = "true" ]; then ARGS+=(--huge); fi\n          if [ -n "${PREV_PLAN_ID:-}" ]; then ARGS+=(--prev-plan-id "$PREV_PLAN_ID"); fi\n          $RECAP_CLI recap build-prompt "${ARGS[@]}"\n\n      - name: Run agent (Claude Code)\n        id: claude\n        if: needs.gate.outputs.agent == \'claude\' && steps.diff.outputs.tiny != \'true\' && steps.scan.outputs.suppressed != \'true\'\n        continue-on-error: true\n        env:\n          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}\n        run: |\n          set -uo pipefail\n          MCP_CONFIG="$RUNNER_TEMP/plan-mcp.json"\n          $RECAP_CLI recap mcp-config --agent claude --app-url "$PLAN_RECAP_APP_URL" --out "$MCP_CONFIG"\n          CLAUDE_ARGS=(-p "$(cat recap-prompt.md)" --mcp-config "$MCP_CONFIG" --allowedTools "Read,Write,Bash(git diff:*),mcp__plan__get-plan-blocks,mcp__plan__create-visual-recap,mcp__plan__set-resource-visibility" --permission-mode dontAsk --output-format json)\n          if [ -n "${VISUAL_RECAP_MODEL:-}" ]; then CLAUDE_ARGS+=(--model "$VISUAL_RECAP_MODEL"); fi\n          rm -f recap-url.txt claude-result.json claude-stderr.log\n          run_claude() {\n            set +e\n            npx -y @anthropic-ai/claude-code@2 "${CLAUDE_ARGS[@]}" > claude-result.json 2> claude-stderr.log\n            CLAUDE_STATUS="$?"\n            set -e\n            echo "$CLAUDE_STATUS" > claude-exit-code.txt\n          }\n          run_claude\n          if [ ! -s recap-url.txt ] && grep -Eiq \'schedule(d)? (a )?(wakeup|retry)|will retry|backoff|connector.*register|mcp.*(register|unreachable|not usable|zero tools|not callable)\' claude-result.json claude-stderr.log 2>/dev/null; then\n            echo "Plan MCP registration appears delayed; retrying Claude once after 20s."\n            sleep 20\n            run_claude\n          fi\n          rm -f "$MCP_CONFIG" || true\n\n      - name: Run agent (Codex)\n        id: codex\n        if: needs.gate.outputs.agent == \'codex\' && steps.diff.outputs.tiny != \'true\' && steps.scan.outputs.suppressed != \'true\'\n        continue-on-error: true\n        env:\n          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\n        run: |\n          set -uo pipefail\n          $RECAP_CLI recap mcp-config --agent codex --app-url "$PLAN_RECAP_APP_URL" --force\n          # `codex login` writes ~/.codex/auth.json (the bare env var is dropped on\n          # the gpt-5.5 wss transport); stdin keeps the key out of process args.\n          printenv OPENAI_API_KEY | npx -y @openai/codex@0 login --with-api-key || true\n          # The runner is itself an ephemeral sandbox; bypass Codex\'s own sandbox\n          # (bubblewrap can\'t init here) and approval gate (cancels the MCP write).\n          CODEX_ARGS=(exec --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check)\n          if [ -n "${VISUAL_RECAP_MODEL:-}" ]; then CODEX_ARGS+=(--model "$VISUAL_RECAP_MODEL"); fi\n          # Validate reasoning against the enum before embedding it in the TOML override.\n          case "${VISUAL_RECAP_REASONING:-}" in\n            none|minimal|low|medium|high|xhigh)\n              CODEX_ARGS+=(-c "model_reasoning_effort=\\"$VISUAL_RECAP_REASONING\\"") ;;\n            "") ;;\n            *) echo "Ignoring invalid VISUAL_RECAP_REASONING: $VISUAL_RECAP_REASONING" ;;\n          esac\n          rm -f recap-url.txt codex-events.jsonl codex-stderr.log\n          run_codex() {\n            set +e\n            npx -y @openai/codex@0 "${CODEX_ARGS[@]}" --json "$(cat recap-prompt.md)" 2> codex-stderr.log | tee codex-events.jsonl\n            CODEX_STATUS="${PIPESTATUS[0]}"\n            set -e\n            echo "$CODEX_STATUS" > codex-exit-code.txt\n          }\n          run_codex\n          if [ ! -s recap-url.txt ] && grep -Eiq \'schedule(d)? (a )?(wakeup|retry)|will retry|backoff|connector.*register|mcp.*(register|unreachable|not usable|zero tools|not callable)\' codex-events.jsonl codex-stderr.log 2>/dev/null; then\n            echo "Plan MCP registration appears delayed; retrying Codex once after 20s."\n            sleep 20\n            run_codex\n          fi\n\n      - name: Read plan URL\n        id: url\n        if: steps.diff.outputs.tiny != \'true\' && steps.scan.outputs.suppressed != \'true\'\n        run: |\n          set -uo pipefail\n          PLAN_URL=""\n          URL_REASON=""\n          if [ -f recap-url.txt ]; then\n            PLAN_URL="$(tr -d \'\\r\\n\' < recap-url.txt | tr -d \' \')"\n          else\n            URL_REASON="recap-url.txt was not created by the agent"\n          fi\n          # recap-url.txt is agent-written -> untrusted. Rebuild a canonical\n          # recap URL from the trusted app base and a strictly validated plan id,\n          # preserving path-prefixed self-hosted mounts.\n          if [ -z "$URL_REASON" ]; then\n            URL_RESULT=$(PLAN_URL="$PLAN_URL" node <<\'NODE\'\n          const emit = (value) => process.stdout.write(JSON.stringify(value));\n          try {\n            const raw = process.env.PLAN_URL || "";\n            if (!raw) {\n              emit({ url: "", reason: "recap-url.txt was empty" });\n              process.exit(0);\n            }\n            const trusted = new URL(process.env.PLAN_RECAP_APP_URL || "https://plan.agent-native.com");\n            const parsed = /^https?:\\/\\//i.test(raw)\n              ? new URL(raw)\n              : new URL(raw, trusted);\n            if (parsed.origin !== trusted.origin) {\n              emit({ url: "", reason: `recap-url.txt points at ${parsed.origin}, expected ${trusted.origin}` });\n              process.exit(0);\n            }\n\n            const base = trusted.pathname.replace(/\\/$/, "");\n            const paths = [parsed.pathname];\n            if (base && parsed.pathname.startsWith(`${base}/`)) {\n              paths.push(parsed.pathname.slice(base.length) || "/");\n            }\n\n            for (const path of paths) {\n              const match = path.match(/^\\/(?:plans|recaps)\\/([A-Za-z0-9_-]+)\\/?$/);\n              if (match) {\n                emit({ url: `${trusted.origin}${base}/recaps/${match[1]}`, reason: "" });\n                process.exit(0);\n              }\n            }\n            emit({ url: "", reason: "recap-url.txt did not contain a valid /plans/<id> or /recaps/<id> URL for the configured plan app" });\n          } catch {\n            emit({ url: "", reason: "recap-url.txt was not a valid URL or recap path" });\n          }\n          NODE\n            )\n            CANONICAL_URL=$(node -e \'try{process.stdout.write(JSON.parse(process.argv[1]).url||"")}catch{process.stdout.write("")}\' "$URL_RESULT")\n            URL_REASON=$(node -e \'try{process.stdout.write(JSON.parse(process.argv[1]).reason||"")}catch{process.stdout.write("recap-url.txt URL validation failed")}\' "$URL_RESULT")\n          else\n            CANONICAL_URL=""\n          fi\n          if [ -n "$CANONICAL_URL" ]; then\n            echo "plan_url=$CANONICAL_URL" >> "$GITHUB_OUTPUT"; echo "ok=true" >> "$GITHUB_OUTPUT"\n          else\n            echo "plan_url=" >> "$GITHUB_OUTPUT"; echo "ok=false" >> "$GITHUB_OUTPUT"\n          fi\n          {\n            echo \'reason<<__RECAP_URL_REASON_EOF__\'\n            echo "$URL_REASON"\n            echo \'__RECAP_URL_REASON_EOF__\'\n          } >> "$GITHUB_OUTPUT"\n\n      - name: Summarize agent failure\n        id: agent_summary\n        if: steps.url.outputs.ok != \'true\' && steps.diff.outputs.tiny != \'true\' && steps.scan.outputs.suppressed != \'true\'\n        continue-on-error: true\n        env:\n          RECAP_AGENT: ${{ needs.gate.outputs.agent }}\n        run: |\n          set -uo pipefail\n          RESULT=claude-result.json\n          STDERR=claude-stderr.log\n          EXIT_CODE=claude-exit-code.txt\n          if [ "$RECAP_AGENT" = "codex" ]; then\n            RESULT=codex-events.jsonl\n            STDERR=codex-stderr.log\n            EXIT_CODE=codex-exit-code.txt\n          fi\n          $RECAP_CLI recap agent-summary --agent "$RECAP_AGENT" --result-file "$RESULT" --stderr-file "$STDERR" --exit-code-file "$EXIT_CODE" || true\n\n      - name: Attach usage\n        if: steps.url.outputs.ok == \'true\'\n        continue-on-error: true\n        env:\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\n          # Use the gate-normalized agent so "Codex" still selects the right file.\n          RECAP_AGENT: ${{ needs.gate.outputs.agent }}\n        run: |\n          set -uo pipefail\n          RESULT=claude-result.json\n          if [ "$RECAP_AGENT" = "codex" ]; then RESULT=codex-events.jsonl; fi\n          if [ -f "$RESULT" ]; then $RECAP_CLI recap usage --plan-url "$PLAN_URL" --agent "$RECAP_AGENT" --result-file "$RESULT" --model "${VISUAL_RECAP_MODEL:-}" --app-url "$PLAN_RECAP_APP_URL" --token "$PLAN_RECAP_TOKEN" || true; fi\n\n      - name: Cache Playwright browsers\n        if: steps.url.outputs.ok == \'true\'\n        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3\n        with:\n          path: ~/.cache/ms-playwright\n          key: playwright-1-${{ runner.os }}\n\n      - name: Screenshot + upload\n        id: shot\n        if: steps.url.outputs.ok == \'true\'\n        continue-on-error: true\n        env:\n          # recap-url.txt is untrusted agent output; pass via env, never ${{ }}.\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\n        run: |\n          set -uo pipefail\n          pnpm exec playwright install --with-deps chromium 2>/dev/null || npx -y playwright@1 install --with-deps chromium || true\n          LIGHT_SHOT_JSON="$($RECAP_CLI recap shot --url "$PLAN_URL" --token "$PLAN_RECAP_TOKEN" --app-url "$PLAN_RECAP_APP_URL" --out recap.png --theme light || echo \'{}\')"\n          DARK_SHOT_JSON="$($RECAP_CLI recap shot --url "$PLAN_URL" --token "$PLAN_RECAP_TOKEN" --app-url "$PLAN_RECAP_APP_URL" --out recap-dark.png --theme dark || echo \'{}\')"\n          IMAGE_URL=$(node -e \'try{process.stdout.write(JSON.parse(process.argv[1]).imageUrl||"")}catch{process.stdout.write("")}\' "$LIGHT_SHOT_JSON")\n          DARK_IMAGE_URL=$(node -e \'try{process.stdout.write(JSON.parse(process.argv[1]).imageUrl||"")}catch{process.stdout.write("")}\' "$DARK_SHOT_JSON")\n          echo "image_url=$IMAGE_URL" >> "$GITHUB_OUTPUT"\n          echo "light_image_url=$IMAGE_URL" >> "$GITHUB_OUTPUT"\n          echo "dark_image_url=$DARK_IMAGE_URL" >> "$GITHUB_OUTPUT"\n          if [ -f recap.png ] || [ -f recap-dark.png ]; then echo "captured=true" >> "$GITHUB_OUTPUT"; else echo "captured=false" >> "$GITHUB_OUTPUT"; fi\n\n      - name: Upload recap screenshot artifact\n        if: steps.shot.outputs.captured == \'true\'\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n        with:\n          name: pr-visual-recap-${{ github.event.pull_request.number }}\n          path: |\n            recap.png\n            recap-dark.png\n          if-no-files-found: ignore\n          retention-days: 14\n\n      - name: Upsert sticky comment\n        if: always()\n        continue-on-error: true\n        env:\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\n          RECAP_IMAGE_URL: ${{ steps.shot.outputs.image_url }}\n          RECAP_LIGHT_IMAGE_URL: ${{ steps.shot.outputs.light_image_url }}\n          RECAP_DARK_IMAGE_URL: ${{ steps.shot.outputs.dark_image_url }}\n          SUPPRESSED: ${{ steps.scan.outputs.suppressed }}\n          SUPPRESSED_JSON: ${{ steps.scan.outputs.json }}\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\n          DIFF_TINY: ${{ steps.diff.outputs.tiny }}\n          PREV_PLAN_ID: ${{ steps.prev.outputs.plan_id }}\n          RECAP_AUTH_FAILED: ${{ steps.auth_probe.outputs.auth_failed }}\n          RECAP_AGENT_SUMMARY: ${{ steps.agent_summary.outputs.summary }}\n          RECAP_URL_REASON: ${{ steps.url.outputs.reason }}\n        run: |\n          set -euo pipefail\n          ARGS=(recap comment upsert --repo "$GITHUB_REPOSITORY" --issue "$PR_NUMBER" --token "$GH_TOKEN")\n          # On a tiny diff, only REFRESH an existing comment, never create one.\n          if [ "${DIFF_TINY:-}" = "true" ]; then ARGS+=(--update-only); fi\n          $RECAP_CLI "${ARGS[@]}"\n\n      - name: Complete visual recap check\n        if: always() && steps.recap_check.outputs.check_run_id != \'\'\n        continue-on-error: true\n        env:\n          # Untrusted/step values via env (NOT ${{ }}-interpolated into the run\n          # body): the agent-written plan URL and the scan JSON could inject shell.\n          CHECK_RUN_ID: ${{ steps.recap_check.outputs.check_run_id }}\n          PLAN_OK: ${{ steps.url.outputs.ok }}\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\n          SUPPRESSED: ${{ steps.scan.outputs.suppressed }}\n          SUPPRESSED_JSON: ${{ steps.scan.outputs.json }}\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\n          DIFF_TINY: ${{ steps.diff.outputs.tiny }}\n          RECAP_AGENT_SUMMARY: ${{ steps.agent_summary.outputs.summary }}\n          RECAP_URL_REASON: ${{ steps.url.outputs.reason }}\n        run: |\n          set -uo pipefail\n          $RECAP_CLI recap check complete \\\n            --check-run-id "$CHECK_RUN_ID" \\\n            --plan-ok "$PLAN_OK" \\\n            --plan-url "$PLAN_URL" \\\n            --suppressed "$SUPPRESSED" \\\n            --suppressed-json "$SUPPRESSED_JSON" \\\n            --huge "$DIFF_HUGE" \\\n            --tiny "$DIFF_TINY" \\\n            --failure-summary "$RECAP_AGENT_SUMMARY" \\\n            --url-reason "$RECAP_URL_REASON" \\\n            --workflow-url "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"\n';
+export const PR_VISUAL_RECAP_WORKFLOW_YML = 'name: PR Visual Recap\n\n# Visual code review: a coding agent runs the repo\'s visual-recap skill over the\n# PR diff, publishes a plan, and upserts one sticky comment with a screenshot.\n# Plain `pull_request` (NOT `pull_request_target`) so fork code never sees secrets.\n\non:\n  pull_request:\n    types: [opened, synchronize, reopened, ready_for_review]\n\npermissions:\n  contents: read\n\nconcurrency:\n  group: pr-visual-recap-${{ github.event.pull_request.number }}\n  cancel-in-progress: true\n\nenv:\n  VISUAL_RECAP_AGENT: ${{ vars.VISUAL_RECAP_AGENT || \'claude\' }}\n  VISUAL_RECAP_SKILL_SOURCE: ${{ vars.VISUAL_RECAP_SKILL_SOURCE || \'auto\' }}\n\njobs:\n  gate:\n    name: Gate\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n      issues: write\n      pull-requests: write\n    outputs:\n      run: ${{ steps.decide.outputs.run }}\n      agent: ${{ steps.decide.outputs.agent }}\n    steps:\n      - id: decide\n        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n        env:\n          # Presence-only signals — never expose secret VALUES to the gate.\n          HAS_PLAN: ${{ secrets.PLAN_RECAP_TOKEN != \'\' }}\n          HAS_ANTHROPIC: ${{ secrets.ANTHROPIC_API_KEY != \'\' }}\n          HAS_OPENAI: ${{ secrets.OPENAI_API_KEY != \'\' }}\n          AGENT: ${{ env.VISUAL_RECAP_AGENT }}\n          VISUAL_RECAP_MODEL: ${{ vars.VISUAL_RECAP_MODEL }}\n          HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n        with:\n          script: |\n            const pr = context.payload.pull_request;\n            const reasons = [];\n\n            if (!pr) reasons.push(\'no pull_request payload\');\n            if (pr && pr.draft) reasons.push(\'draft PR\');\n\n            // Fork PRs run with no secrets, so publishing would fail anyway — skip.\n            const headRepo = pr && pr.head && pr.head.repo && pr.head.repo.full_name;\n            if (pr && headRepo && headRepo !== process.env.GITHUB_REPOSITORY) {\n              reasons.push(`fork PR (${headRepo})`);\n            }\n\n            const login = (pr && pr.user && pr.user.login || \'\').toLowerCase();\n            const botAuthors = [\'dependabot[bot]\', \'dependabot\', \'renovate[bot]\', \'renovate\'];\n            if (botAuthors.includes(login)) reasons.push(`bot author (${login})`);\n            if (pr && pr.user && pr.user.type === \'Bot\') reasons.push(\'bot author (type=Bot)\');\n\n            if (process.env.HAS_PLAN !== \'true\') reasons.push(\'PLAN_RECAP_TOKEN not configured\');\n\n            // Normalize + validate the agent so a mis-cased value can\'t pass the\n            // gate and then match neither agent step below.\n            const agent = (process.env.AGENT || \'claude\').toLowerCase();\n            if (agent !== \'claude\' && agent !== \'codex\') {\n              reasons.push(`unsupported VISUAL_RECAP_AGENT "${process.env.AGENT}" (expected "claude" or "codex")`);\n            } else if (agent === \'codex\') {\n              if (process.env.HAS_OPENAI !== \'true\') reasons.push(\'OPENAI_API_KEY not configured (codex backend)\');\n            } else {\n              if (process.env.HAS_ANTHROPIC !== \'true\') reasons.push(\'ANTHROPIC_API_KEY not configured (claude backend)\');\n            }\n\n            // Validate the model before it reaches the agent CLI.\n            const model = process.env.VISUAL_RECAP_MODEL || \'\';\n            if (model && !/^[a-zA-Z0-9._-]{1,80}$/.test(model)) {\n              reasons.push(`invalid VISUAL_RECAP_MODEL value (must match [a-zA-Z0-9._-]{1,80})`);\n            }\n\n            // Self-modifying guard, evaluated in the trusted gate (runs NO\n            // PR-checked-out code): skip the ENTIRE job if the PR touches the\n            // workflow, skill, or any agent config the runner loads, so a PR\n            // can\'t rewrite what runs and exfiltrate secrets.\n            if (pr) {\n              try {\n                const files = await github.paginate(github.rest.pulls.listFiles, {\n                  owner: context.repo.owner,\n                  repo: context.repo.repo,\n                  pull_number: pr.number,\n                  per_page: 100,\n                });\n                const isSensitive = (p) =>\n                  p === \'.github/workflows/pr-visual-recap.yml\' ||\n                  /(^|\\/)skills\\/visual-(recap|plan|plans)\\//.test(p) ||\n                  /(^|\\/)\\.claude\\//.test(p) ||\n                  /(^|\\/)CLAUDE\\.md$/.test(p) ||\n                  /(^|\\/)AGENTS\\.md$/.test(p) ||\n                  /(^|\\/)\\.mcp\\.json$/.test(p);\n                const hits = files.map((f) => f.filename).filter(isSensitive);\n                if (hits.length) {\n                  reasons.push(`PR modifies recap-control files (${hits.slice(0, 3).join(\', \')}${hits.length > 3 ? \', …\' : \'\'}) — skipping so untrusted PR code never runs with secrets`);\n                }\n              } catch (e) {\n                // Fail closed: if the file list can\'t be read, skip.\n                reasons.push(`could not list PR files for the self-modifying guard (${e.message}); skipping to be safe`);\n              }\n            }\n\n            const run = reasons.length === 0;\n            core.setOutput(\'run\', run ? \'true\' : \'false\');\n            core.setOutput(\'agent\', agent);\n            core.info(run ? `Visual recap will run (${agent}).` : `Visual recap skipped: ${reasons.join(\'; \')}`);\n\n            // When skipping, refresh an EXISTING sticky recap comment with a\n            // short skip line so it does not silently go stale. Never create a\n            // new comment (no spam for repos where the recap has never run).\n            if (!run && pr) {\n              try {\n                const MARKER = \'<!-- pr-visual-recap -->\';\n                const { data: comments } = await github.rest.issues.listComments({\n                  owner: context.repo.owner,\n                  repo: context.repo.repo,\n                  issue_number: pr.number,\n                  per_page: 100,\n                });\n                const existing = comments.find(\n                  (c) => c.user && c.user.type === \'Bot\' && c.body && c.body.includes(MARKER)\n                );\n                if (existing) {\n                  const headShort = (process.env.HEAD_SHA || \'\').slice(0, 7);\n                  const shaRef = headShort ? `\\`${headShort}\\`` : \'latest push\';\n                  const primaryReason = reasons.filter(\n                    (r) => !r.startsWith(\'could not list PR files for the self-modifying guard\')\n                  )[0] || reasons[0] || \'skipped\';\n                  const skipLine = `_Recap skipped for ${shaRef}: ${primaryReason}._`;\n                  const withoutPrev = (existing.body || \'\')\n                    .split(\'\\n\')\n                    .filter((l) => !/_Recap skipped for .+_$/.test(l.trim()))\n                    .join(\'\\n\')\n                    .trimEnd();\n                  const updatedBody = `${withoutPrev}\\n\\n${skipLine}`;\n                  await github.rest.issues.updateComment({\n                    owner: context.repo.owner,\n                    repo: context.repo.repo,\n                    comment_id: existing.id,\n                    body: updatedBody,\n                  });\n                }\n              } catch (e) {\n                core.warning(`Could not update recap skip comment: ${e.message}`);\n              }\n            }\n\n  recap:\n    name: Generate visual recap\n    needs: gate\n    if: needs.gate.outputs.run == \'true\'\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      actions: write\n      checks: write\n      contents: read\n      issues: write\n      pull-requests: write\n    env:\n      PLAN_RECAP_APP_URL: ${{ secrets.PLAN_RECAP_APP_URL || \'https://plan.agent-native.com\' }}\n      PLAN_RECAP_TOKEN: ${{ secrets.PLAN_RECAP_TOKEN }}\n      GH_TOKEN: ${{ github.token }}\n      PR_NUMBER: ${{ github.event.pull_request.number }}\n      HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n      VISUAL_RECAP_MODEL: ${{ vars.VISUAL_RECAP_MODEL }}\n      VISUAL_RECAP_REASONING: ${{ vars.VISUAL_RECAP_REASONING }}\n      VISUAL_RECAP_SKILL_SOURCE: ${{ vars.VISUAL_RECAP_SKILL_SOURCE || \'auto\' }}\n    steps:\n      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n        with:\n          fetch-depth: 0\n          # This job runs an agent over untrusted PR diff; don\'t leave the token\n          # in .git/config (it uses GH_TOKEN for gh API calls, never git push).\n          persist-credentials: false\n\n      # Dogfood trusted base-branch source inside this monorepo, else install the\n      # published package once. Never execute PR-head recap CLI code.\n      - name: Resolve recap CLI\n        id: cli\n        env:\n          # Optional: pin the consumer CLI version (e.g. "1.2.3"). Defaults to\n          # "latest" when unset. Set via repository variable RECAP_CLI_VERSION.\n          RECAP_CLI_VERSION: ${{ vars.RECAP_CLI_VERSION || \'latest\' }}\n        run: |\n          if [ "$GITHUB_REPOSITORY" = "BuilderIO/agent-native" ] && [ -f packages/core/src/cli/index.ts ]; then\n            echo "local=true" >> "$GITHUB_OUTPUT"\n          else\n            echo "local=false" >> "$GITHUB_OUTPUT"\n          fi\n\n      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n        if: steps.cli.outputs.local == \'true\'\n        with:\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .recap-cli-source\n          fetch-depth: 1\n          persist-credentials: false\n\n      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8\n        if: steps.cli.outputs.local == \'true\'\n\n      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n        with:\n          node-version: "22"\n          cache: ${{ steps.cli.outputs.local == \'true\' && \'pnpm\' || \'\' }}\n\n      - name: Install trusted workspace recap CLI\n        if: steps.cli.outputs.local == \'true\'\n        working-directory: .recap-cli-source\n        run: |\n          set -euo pipefail\n          pnpm install --frozen-lockfile --ignore-scripts\n          echo "RECAP_CLI=$PWD/node_modules/.bin/tsx $PWD/packages/core/src/cli/index.ts" >> "$GITHUB_ENV"\n\n      - name: Install published recap CLI\n        if: steps.cli.outputs.local != \'true\'\n        env:\n          RECAP_CLI_VERSION: ${{ vars.RECAP_CLI_VERSION || \'latest\' }}\n        run: |\n          set -euo pipefail\n          VERSION="$RECAP_CLI_VERSION"\n          if [ "$VERSION" = "latest" ]; then\n            VERSION="$(npm view @agent-native/core@latest version)"\n          fi\n          for attempt in 1 2 3; do\n            if npm install --prefix "$RUNNER_TEMP/recap-cli" --no-audit --no-fund "@agent-native/core@$VERSION"; then\n              break\n            fi\n            if [ "$attempt" = "3" ]; then exit 1; fi\n            sleep $((attempt * 10))\n          done\n          echo "RECAP_CLI=$RUNNER_TEMP/recap-cli/node_modules/.bin/agent-native" >> "$GITHUB_ENV"\n\n      - name: Start visual recap check\n        id: recap_check\n        continue-on-error: true\n        run: |\n          set -uo pipefail\n          $RECAP_CLI recap check start --sha "$HEAD_SHA" --workflow-url "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"\n\n      - name: Collect bounded diff\n        id: diff\n        env:\n          BASE_SHA: ${{ github.event.pull_request.base.sha }}\n        run: |\n          set -euo pipefail\n          $RECAP_CLI recap collect-diff --base "$BASE_SHA" --head "$HEAD_SHA" --out recap.diff --stat recap.stat\n\n      - name: Probe plan-app auth\n        id: auth_probe\n        if: steps.diff.outputs.tiny != \'true\'\n        continue-on-error: true\n        run: |\n          set -uo pipefail\n          # Hit the plan app\'s action surface with the publish token. A 401 means\n          # the token is expired/revoked; surface it in the sticky comment so the\n          # repo owner knows to re-mint it instead of seeing a generic failure.\n          HTTP_STATUS=$(node -e \'\n            const https = require("https");\n            const url = new URL("/_agent-native/actions/record-recap-usage", process.env.PLAN_RECAP_APP_URL || "https://plan.agent-native.com");\n            const req = https.request(url, { method: "POST", headers: { "authorization": "Bearer " + process.env.PLAN_RECAP_TOKEN, "content-type": "application/json" }, timeout: 8000 }, (res) => { process.stdout.write(String(res.statusCode)); req.destroy(); });\n            req.on("error", () => process.stdout.write("0"));\n            req.end(JSON.stringify({ planId: "__probe__" }));\n          \' 2>/dev/null || echo "0")\n          if [ "$HTTP_STATUS" = "401" ]; then\n            echo "auth_failed=true" >> "$GITHUB_OUTPUT"\n          else\n            echo "auth_failed=false" >> "$GITHUB_OUTPUT"\n          fi\n\n      - name: Secret scan\n        id: scan\n        if: steps.diff.outputs.tiny != \'true\'\n        run: |\n          set -uo pipefail\n          # Fail CLOSED: a scanner error or invalid JSON suppresses the diff so a\n          # credential-bearing diff is never handed to the agent / plan service.\n          if ! SCAN_JSON="$($RECAP_CLI recap scan --diff recap.diff)"; then\n            SCAN_JSON=\'{"suppressed":true,"reason":"secret scan failed to run; failing closed"}\'\n          fi\n          {\n            echo \'json<<__RECAP_SCAN_EOF__\'\n            echo "$SCAN_JSON"\n            echo \'__RECAP_SCAN_EOF__\'\n          } >> "$GITHUB_OUTPUT"\n          SUPPRESSED=$(node -e \'try{process.stdout.write(JSON.parse(process.argv[1]).suppressed?"true":"false")}catch{process.stdout.write("true")}\' "$SCAN_JSON")\n          echo "suppressed=$SUPPRESSED" >> "$GITHUB_OUTPUT"\n\n      - name: Read previous plan id\n        id: prev\n        continue-on-error: true\n        run: |\n          set -euo pipefail\n          PLAN_ID="$($RECAP_CLI recap comment find-plan-id --repo "$GITHUB_REPOSITORY" --issue "$PR_NUMBER" --token "$GH_TOKEN")"\n          echo "plan_id=$PLAN_ID" >> "$GITHUB_OUTPUT"\n\n      - name: Smoke-test Plan MCP tools\n        id: mcp_smoke\n        if: steps.diff.outputs.tiny != \'true\' && steps.scan.outputs.suppressed != \'true\'\n        continue-on-error: true\n        run: |\n          set -uo pipefail\n          $RECAP_CLI recap mcp-smoke --app-url "$PLAN_RECAP_APP_URL"\n\n      - name: Build recap prompt\n        id: prompt\n        if: steps.diff.outputs.tiny != \'true\' && steps.scan.outputs.suppressed != \'true\' && steps.mcp_smoke.outputs.ok == \'true\'\n        env:\n          # Pass step outputs via env, NOT ${{ }} interpolation into the run body:\n          # the prev plan id is parsed from a PR comment and could inject shell.\n          PREV_PLAN_ID: ${{ steps.prev.outputs.plan_id }}\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\n        run: |\n          set -euo pipefail\n          ARGS=(--diff recap.diff --stat recap.stat --pr "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --head "$HEAD_SHA" --app-url "$PLAN_RECAP_APP_URL" --skill-source "$VISUAL_RECAP_SKILL_SOURCE" --out recap-prompt.md)\n          if [ "${DIFF_HUGE:-}" = "true" ]; then ARGS+=(--huge); fi\n          if [ -n "${PREV_PLAN_ID:-}" ]; then ARGS+=(--prev-plan-id "$PREV_PLAN_ID"); fi\n          $RECAP_CLI recap build-prompt "${ARGS[@]}"\n\n      - name: Run agent (Claude Code)\n        id: claude\n        if: needs.gate.outputs.agent == \'claude\' && steps.diff.outputs.tiny != \'true\' && steps.scan.outputs.suppressed != \'true\' && steps.mcp_smoke.outputs.ok == \'true\'\n        continue-on-error: true\n        env:\n          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}\n        run: |\n          set -uo pipefail\n          MCP_CONFIG="$RUNNER_TEMP/plan-mcp.json"\n          $RECAP_CLI recap mcp-config --agent claude --app-url "$PLAN_RECAP_APP_URL" --out "$MCP_CONFIG"\n          CLAUDE_ARGS=(-p "$(cat recap-prompt.md)" --mcp-config "$MCP_CONFIG" --allowedTools "Read,Write,Bash(git diff:*),mcp__plan__get-plan-blocks,mcp__plan__create-visual-recap,mcp__plan__set-resource-visibility" --permission-mode dontAsk --output-format json)\n          if [ -n "${VISUAL_RECAP_MODEL:-}" ]; then CLAUDE_ARGS+=(--model "$VISUAL_RECAP_MODEL"); fi\n          rm -f recap-url.txt claude-result.json claude-stderr.log\n          run_claude() {\n            set +e\n            npx -y @anthropic-ai/claude-code@2 "${CLAUDE_ARGS[@]}" > claude-result.json 2> claude-stderr.log\n            CLAUDE_STATUS="$?"\n            set -e\n            echo "$CLAUDE_STATUS" > claude-exit-code.txt\n          }\n          run_claude\n          if [ ! -s recap-url.txt ] && grep -Eiq \'schedule(d)? (a )?(wakeup|retry)|will retry|backoff|connector.*register|mcp.*(register|unreachable|not usable|zero tools|not callable)\' claude-result.json claude-stderr.log 2>/dev/null; then\n            echo "Plan MCP registration appears delayed; retrying Claude once after 20s."\n            sleep 20\n            run_claude\n          fi\n          rm -f "$MCP_CONFIG" || true\n\n      - name: Run agent (Codex)\n        id: codex\n        if: needs.gate.outputs.agent == \'codex\' && steps.diff.outputs.tiny != \'true\' && steps.scan.outputs.suppressed != \'true\' && steps.mcp_smoke.outputs.ok == \'true\'\n        continue-on-error: true\n        env:\n          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\n        run: |\n          set -uo pipefail\n          $RECAP_CLI recap mcp-config --agent codex --app-url "$PLAN_RECAP_APP_URL" --force\n          # `codex login` writes ~/.codex/auth.json (the bare env var is dropped on\n          # the gpt-5.5 wss transport); stdin keeps the key out of process args.\n          printenv OPENAI_API_KEY | npx -y @openai/codex@0 login --with-api-key || true\n          # The runner is itself an ephemeral sandbox; bypass Codex\'s own sandbox\n          # (bubblewrap can\'t init here) and approval gate (cancels the MCP write).\n          CODEX_ARGS=(exec --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check)\n          if [ -n "${VISUAL_RECAP_MODEL:-}" ]; then CODEX_ARGS+=(--model "$VISUAL_RECAP_MODEL"); fi\n          # Validate reasoning against the enum before embedding it in the TOML override.\n          case "${VISUAL_RECAP_REASONING:-}" in\n            none|minimal|low|medium|high|xhigh)\n              CODEX_ARGS+=(-c "model_reasoning_effort=\\"$VISUAL_RECAP_REASONING\\"") ;;\n            "") ;;\n            *) echo "Ignoring invalid VISUAL_RECAP_REASONING: $VISUAL_RECAP_REASONING" ;;\n          esac\n          rm -f recap-url.txt codex-events.jsonl codex-stderr.log\n          run_codex() {\n            set +e\n            npx -y @openai/codex@0 "${CODEX_ARGS[@]}" --json "$(cat recap-prompt.md)" 2> codex-stderr.log | tee codex-events.jsonl\n            CODEX_STATUS="${PIPESTATUS[0]}"\n            set -e\n            echo "$CODEX_STATUS" > codex-exit-code.txt\n          }\n          run_codex\n          if [ ! -s recap-url.txt ] && grep -Eiq \'schedule(d)? (a )?(wakeup|retry)|will retry|backoff|connector.*register|mcp.*(register|unreachable|not usable|zero tools|not callable)\' codex-events.jsonl codex-stderr.log 2>/dev/null; then\n            echo "Plan MCP registration appears delayed; retrying Codex once after 20s."\n            sleep 20\n            run_codex\n          fi\n\n      - name: Read plan URL\n        id: url\n        if: steps.diff.outputs.tiny != \'true\' && steps.scan.outputs.suppressed != \'true\'\n        run: |\n          set -uo pipefail\n          PLAN_URL=""\n          URL_REASON=""\n          if [ -f recap-url.txt ]; then\n            PLAN_URL="$(tr -d \'\\r\\n\' < recap-url.txt | tr -d \' \')"\n          else\n            URL_REASON="recap-url.txt was not created by the agent"\n          fi\n          # recap-url.txt is agent-written -> untrusted. Rebuild a canonical\n          # recap URL from the trusted app base and a strictly validated plan id,\n          # preserving path-prefixed self-hosted mounts.\n          if [ -z "$URL_REASON" ]; then\n            URL_RESULT=$(PLAN_URL="$PLAN_URL" node <<\'NODE\'\n          const emit = (value) => process.stdout.write(JSON.stringify(value));\n          try {\n            const raw = process.env.PLAN_URL || "";\n            if (!raw) {\n              emit({ url: "", reason: "recap-url.txt was empty" });\n              process.exit(0);\n            }\n            const trusted = new URL(process.env.PLAN_RECAP_APP_URL || "https://plan.agent-native.com");\n            const parsed = /^https?:\\/\\//i.test(raw)\n              ? new URL(raw)\n              : new URL(raw, trusted);\n            if (parsed.origin !== trusted.origin) {\n              emit({ url: "", reason: `recap-url.txt points at ${parsed.origin}, expected ${trusted.origin}` });\n              process.exit(0);\n            }\n\n            const base = trusted.pathname.replace(/\\/$/, "");\n            const paths = [parsed.pathname];\n            if (base && parsed.pathname.startsWith(`${base}/`)) {\n              paths.push(parsed.pathname.slice(base.length) || "/");\n            }\n\n            for (const path of paths) {\n              const match = path.match(/^\\/(?:plans|recaps)\\/([A-Za-z0-9_-]+)\\/?$/);\n              if (match) {\n                emit({ url: `${trusted.origin}${base}/recaps/${match[1]}`, reason: "" });\n                process.exit(0);\n              }\n            }\n            emit({ url: "", reason: "recap-url.txt did not contain a valid /plans/<id> or /recaps/<id> URL for the configured plan app" });\n          } catch {\n            emit({ url: "", reason: "recap-url.txt was not a valid URL or recap path" });\n          }\n          NODE\n            )\n            CANONICAL_URL=$(node -e \'try{process.stdout.write(JSON.parse(process.argv[1]).url||"")}catch{process.stdout.write("")}\' "$URL_RESULT")\n            URL_REASON=$(node -e \'try{process.stdout.write(JSON.parse(process.argv[1]).reason||"")}catch{process.stdout.write("recap-url.txt URL validation failed")}\' "$URL_RESULT")\n          else\n            CANONICAL_URL=""\n          fi\n          if [ -n "$CANONICAL_URL" ]; then\n            echo "plan_url=$CANONICAL_URL" >> "$GITHUB_OUTPUT"; echo "ok=true" >> "$GITHUB_OUTPUT"\n          else\n            echo "plan_url=" >> "$GITHUB_OUTPUT"; echo "ok=false" >> "$GITHUB_OUTPUT"\n          fi\n          {\n            echo \'reason<<__RECAP_URL_REASON_EOF__\'\n            echo "$URL_REASON"\n            echo \'__RECAP_URL_REASON_EOF__\'\n          } >> "$GITHUB_OUTPUT"\n\n      - name: Summarize agent failure\n        id: agent_summary\n        if: steps.url.outputs.ok != \'true\' && steps.diff.outputs.tiny != \'true\' && steps.scan.outputs.suppressed != \'true\'\n        continue-on-error: true\n        env:\n          RECAP_AGENT: ${{ needs.gate.outputs.agent }}\n          RECAP_MCP_SMOKE_OK: ${{ steps.mcp_smoke.outputs.ok }}\n          RECAP_MCP_SMOKE_SUMMARY: ${{ steps.mcp_smoke.outputs.summary }}\n        run: |\n          set -uo pipefail\n          if [ -n "${RECAP_MCP_SMOKE_SUMMARY:-}" ] && [ "${RECAP_MCP_SMOKE_OK:-}" != "true" ]; then\n            {\n              echo \'summary<<__RECAP_MCP_SMOKE_SUMMARY_EOF__\'\n              echo "$RECAP_MCP_SMOKE_SUMMARY"\n              echo \'__RECAP_MCP_SMOKE_SUMMARY_EOF__\'\n            } >> "$GITHUB_OUTPUT"\n            node -e \'process.stdout.write(JSON.stringify({ ok: true, summary: process.env.RECAP_MCP_SMOKE_SUMMARY || "" }) + "\\n")\'\n            exit 0\n          fi\n          RESULT=claude-result.json\n          STDERR=claude-stderr.log\n          EXIT_CODE=claude-exit-code.txt\n          if [ "$RECAP_AGENT" = "codex" ]; then\n            RESULT=codex-events.jsonl\n            STDERR=codex-stderr.log\n            EXIT_CODE=codex-exit-code.txt\n          fi\n          $RECAP_CLI recap agent-summary --agent "$RECAP_AGENT" --result-file "$RESULT" --stderr-file "$STDERR" --exit-code-file "$EXIT_CODE" || true\n\n      - name: Attach usage\n        if: steps.url.outputs.ok == \'true\'\n        continue-on-error: true\n        env:\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\n          # Use the gate-normalized agent so "Codex" still selects the right file.\n          RECAP_AGENT: ${{ needs.gate.outputs.agent }}\n        run: |\n          set -uo pipefail\n          RESULT=claude-result.json\n          if [ "$RECAP_AGENT" = "codex" ]; then RESULT=codex-events.jsonl; fi\n          if [ -f "$RESULT" ]; then $RECAP_CLI recap usage --plan-url "$PLAN_URL" --agent "$RECAP_AGENT" --result-file "$RESULT" --model "${VISUAL_RECAP_MODEL:-}" --app-url "$PLAN_RECAP_APP_URL" --token "$PLAN_RECAP_TOKEN" || true; fi\n\n      - name: Cache Playwright browsers\n        if: steps.url.outputs.ok == \'true\'\n        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3\n        with:\n          path: ~/.cache/ms-playwright\n          key: playwright-1-${{ runner.os }}\n\n      - name: Screenshot + upload\n        id: shot\n        if: steps.url.outputs.ok == \'true\'\n        continue-on-error: true\n        env:\n          # recap-url.txt is untrusted agent output; pass via env, never ${{ }}.\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\n        run: |\n          set -uo pipefail\n          pnpm exec playwright install --with-deps chromium 2>/dev/null || npx -y playwright@1 install --with-deps chromium || true\n          LIGHT_SHOT_JSON="$($RECAP_CLI recap shot --url "$PLAN_URL" --token "$PLAN_RECAP_TOKEN" --app-url "$PLAN_RECAP_APP_URL" --out recap.png --theme light || echo \'{}\')"\n          DARK_SHOT_JSON="$($RECAP_CLI recap shot --url "$PLAN_URL" --token "$PLAN_RECAP_TOKEN" --app-url "$PLAN_RECAP_APP_URL" --out recap-dark.png --theme dark || echo \'{}\')"\n          IMAGE_URL=$(node -e \'try{process.stdout.write(JSON.parse(process.argv[1]).imageUrl||"")}catch{process.stdout.write("")}\' "$LIGHT_SHOT_JSON")\n          DARK_IMAGE_URL=$(node -e \'try{process.stdout.write(JSON.parse(process.argv[1]).imageUrl||"")}catch{process.stdout.write("")}\' "$DARK_SHOT_JSON")\n          echo "image_url=$IMAGE_URL" >> "$GITHUB_OUTPUT"\n          echo "light_image_url=$IMAGE_URL" >> "$GITHUB_OUTPUT"\n          echo "dark_image_url=$DARK_IMAGE_URL" >> "$GITHUB_OUTPUT"\n          if [ -f recap.png ] || [ -f recap-dark.png ]; then echo "captured=true" >> "$GITHUB_OUTPUT"; else echo "captured=false" >> "$GITHUB_OUTPUT"; fi\n\n      - name: Upload recap screenshot artifact\n        if: steps.shot.outputs.captured == \'true\'\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n        with:\n          name: pr-visual-recap-${{ github.event.pull_request.number }}\n          path: |\n            recap.png\n            recap-dark.png\n          if-no-files-found: ignore\n          retention-days: 14\n\n      - name: Upsert sticky comment\n        if: always()\n        continue-on-error: true\n        env:\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\n          RECAP_IMAGE_URL: ${{ steps.shot.outputs.image_url }}\n          RECAP_LIGHT_IMAGE_URL: ${{ steps.shot.outputs.light_image_url }}\n          RECAP_DARK_IMAGE_URL: ${{ steps.shot.outputs.dark_image_url }}\n          SUPPRESSED: ${{ steps.scan.outputs.suppressed }}\n          SUPPRESSED_JSON: ${{ steps.scan.outputs.json }}\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\n          DIFF_TINY: ${{ steps.diff.outputs.tiny }}\n          PREV_PLAN_ID: ${{ steps.prev.outputs.plan_id }}\n          RECAP_AUTH_FAILED: ${{ steps.auth_probe.outputs.auth_failed }}\n          RECAP_AGENT_SUMMARY: ${{ steps.agent_summary.outputs.summary }}\n          RECAP_URL_REASON: ${{ steps.url.outputs.reason }}\n        run: |\n          set -euo pipefail\n          ARGS=(recap comment upsert --repo "$GITHUB_REPOSITORY" --issue "$PR_NUMBER" --token "$GH_TOKEN")\n          # On a tiny diff, only REFRESH an existing comment, never create one.\n          if [ "${DIFF_TINY:-}" = "true" ]; then ARGS+=(--update-only); fi\n          $RECAP_CLI "${ARGS[@]}"\n\n      - name: Complete visual recap check\n        if: always() && steps.recap_check.outputs.check_run_id != \'\'\n        continue-on-error: true\n        env:\n          # Untrusted/step values via env (NOT ${{ }}-interpolated into the run\n          # body): the agent-written plan URL and the scan JSON could inject shell.\n          CHECK_RUN_ID: ${{ steps.recap_check.outputs.check_run_id }}\n          PLAN_OK: ${{ steps.url.outputs.ok }}\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\n          SUPPRESSED: ${{ steps.scan.outputs.suppressed }}\n          SUPPRESSED_JSON: ${{ steps.scan.outputs.json }}\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\n          DIFF_TINY: ${{ steps.diff.outputs.tiny }}\n          RECAP_AGENT_SUMMARY: ${{ steps.agent_summary.outputs.summary }}\n          RECAP_URL_REASON: ${{ steps.url.outputs.reason }}\n        run: |\n          set -uo pipefail\n          $RECAP_CLI recap check complete \\\n            --check-run-id "$CHECK_RUN_ID" \\\n            --plan-ok "$PLAN_OK" \\\n            --plan-url "$PLAN_URL" \\\n            --suppressed "$SUPPRESSED" \\\n            --suppressed-json "$SUPPRESSED_JSON" \\\n            --huge "$DIFF_HUGE" \\\n            --tiny "$DIFF_TINY" \\\n            --failure-summary "$RECAP_AGENT_SUMMARY" \\\n            --url-reason "$RECAP_URL_REASON" \\\n            --workflow-url "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"\n';
 //# sourceMappingURL=pr-visual-recap-workflow.js.map

package/dist/cli/pr-visual-recap-workflow.js.map

@@ -1 +1 @@
-{"version":3,"file":"pr-visual-recap-workflow.js","sourceRoot":"","sources":["../../src/cli/pr-visual-recap-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GACvC,uh4BAAuh4B,CAAC","sourcesContent":["/**\n * Bundled copy of .github/workflows/pr-visual-recap.yml so the CLI can write the\n * PR Visual Recap workflow into a user repo via\n * `agent-native skills add visual-plan --with-github-action`.\n *\n * AUTO-GENERATED — keep byte-identical with the source workflow. A sync test in\n * recap.spec.ts fails if these drift. Regenerate from the YAML with the snippet\n * in recap.spec.ts.\n */\n\nexport const PR_VISUAL_RECAP_WORKFLOW_YML =\n  'name: PR Visual Recap\\n\\n# Visual code review: a coding agent runs the repo\\'s visual-recap skill over the\\n# PR diff, publishes a plan, and upserts one sticky comment with a screenshot.\\n# Plain `pull_request` (NOT `pull_request_target`) so fork code never sees secrets.\\n\\non:\\n  pull_request:\\n    types: [opened, synchronize, reopened, ready_for_review]\\n\\npermissions:\\n  contents: read\\n\\nconcurrency:\\n  group: pr-visual-recap-${{ github.event.pull_request.number }}\\n  cancel-in-progress: true\\n\\nenv:\\n  VISUAL_RECAP_AGENT: ${{ vars.VISUAL_RECAP_AGENT || \\'claude\\' }}\\n  VISUAL_RECAP_SKILL_SOURCE: ${{ vars.VISUAL_RECAP_SKILL_SOURCE || \\'auto\\' }}\\n\\njobs:\\n  gate:\\n    name: Gate\\n    runs-on: ubuntu-latest\\n    timeout-minutes: 10\\n    permissions:\\n      contents: read\\n      issues: write\\n      pull-requests: write\\n    outputs:\\n      run: ${{ steps.decide.outputs.run }}\\n      agent: ${{ steps.decide.outputs.agent }}\\n    steps:\\n      - id: decide\\n        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\\n        env:\\n          # Presence-only signals — never expose secret VALUES to the gate.\\n          HAS_PLAN: ${{ secrets.PLAN_RECAP_TOKEN != \\'\\' }}\\n          HAS_ANTHROPIC: ${{ secrets.ANTHROPIC_API_KEY != \\'\\' }}\\n          HAS_OPENAI: ${{ secrets.OPENAI_API_KEY != \\'\\' }}\\n          AGENT: ${{ env.VISUAL_RECAP_AGENT }}\\n          VISUAL_RECAP_MODEL: ${{ vars.VISUAL_RECAP_MODEL }}\\n          HEAD_SHA: ${{ github.event.pull_request.head.sha }}\\n        with:\\n          script: |\\n            const pr = context.payload.pull_request;\\n            const reasons = [];\\n\\n            if (!pr) reasons.push(\\'no pull_request payload\\');\\n            if (pr && pr.draft) reasons.push(\\'draft PR\\');\\n\\n            // Fork PRs run with no secrets, so publishing would fail anyway — skip.\\n            const headRepo = pr && pr.head && pr.head.repo && pr.head.repo.full_name;\\n            if (pr && headRepo && headRepo !== process.env.GITHUB_REPOSITORY) {\\n              reasons.push(`fork PR (${headRepo})`);\\n            }\\n\\n            const login = (pr && pr.user && pr.user.login || \\'\\').toLowerCase();\\n            const botAuthors = [\\'dependabot[bot]\\', \\'dependabot\\', \\'renovate[bot]\\', \\'renovate\\'];\\n            if (botAuthors.includes(login)) reasons.push(`bot author (${login})`);\\n            if (pr && pr.user && pr.user.type === \\'Bot\\') reasons.push(\\'bot author (type=Bot)\\');\\n\\n            if (process.env.HAS_PLAN !== \\'true\\') reasons.push(\\'PLAN_RECAP_TOKEN not configured\\');\\n\\n            // Normalize + validate the agent so a mis-cased value can\\'t pass the\\n            // gate and then match neither agent step below.\\n            const agent = (process.env.AGENT || \\'claude\\').toLowerCase();\\n            if (agent !== \\'claude\\' && agent !== \\'codex\\') {\\n              reasons.push(`unsupported VISUAL_RECAP_AGENT \"${process.env.AGENT}\" (expected \"claude\" or \"codex\")`);\\n            } else if (agent === \\'codex\\') {\\n              if (process.env.HAS_OPENAI !== \\'true\\') reasons.push(\\'OPENAI_API_KEY not configured (codex backend)\\');\\n            } else {\\n              if (process.env.HAS_ANTHROPIC !== \\'true\\') reasons.push(\\'ANTHROPIC_API_KEY not configured (claude backend)\\');\\n            }\\n\\n            // Validate the model before it reaches the agent CLI.\\n            const model = process.env.VISUAL_RECAP_MODEL || \\'\\';\\n            if (model && !/^[a-zA-Z0-9._-]{1,80}$/.test(model)) {\\n              reasons.push(`invalid VISUAL_RECAP_MODEL value (must match [a-zA-Z0-9._-]{1,80})`);\\n            }\\n\\n            // Self-modifying guard, evaluated in the trusted gate (runs NO\\n            // PR-checked-out code): skip the ENTIRE job if the PR touches the\\n            // workflow, skill, or any agent config the runner loads, so a PR\\n            // can\\'t rewrite what runs and exfiltrate secrets.\\n            if (pr) {\\n              try {\\n                const files = await github.paginate(github.rest.pulls.listFiles, {\\n                  owner: context.repo.owner,\\n                  repo: context.repo.repo,\\n                  pull_number: pr.number,\\n                  per_page: 100,\\n                });\\n                const isSensitive = (p) =>\\n                  p === \\'.github/workflows/pr-visual-recap.yml\\' ||\\n                  /(^|\\\\/)skills\\\\/visual-(recap|plan|plans)\\\\//.test(p) ||\\n                  /(^|\\\\/)\\\\.claude\\\\//.test(p) ||\\n                  /(^|\\\\/)CLAUDE\\\\.md$/.test(p) ||\\n                  /(^|\\\\/)AGENTS\\\\.md$/.test(p) ||\\n                  /(^|\\\\/)\\\\.mcp\\\\.json$/.test(p);\\n                const hits = files.map((f) => f.filename).filter(isSensitive);\\n                if (hits.length) {\\n                  reasons.push(`PR modifies recap-control files (${hits.slice(0, 3).join(\\', \\')}${hits.length > 3 ? \\', …\\' : \\'\\'}) — skipping so untrusted PR code never runs with secrets`);\\n                }\\n              } catch (e) {\\n                // Fail closed: if the file list can\\'t be read, skip.\\n                reasons.push(`could not list PR files for the self-modifying guard (${e.message}); skipping to be safe`);\\n              }\\n            }\\n\\n            const run = reasons.length === 0;\\n            core.setOutput(\\'run\\', run ? \\'true\\' : \\'false\\');\\n            core.setOutput(\\'agent\\', agent);\\n            core.info(run ? `Visual recap will run (${agent}).` : `Visual recap skipped: ${reasons.join(\\'; \\')}`);\\n\\n            // When skipping, refresh an EXISTING sticky recap comment with a\\n            // short skip line so it does not silently go stale. Never create a\\n            // new comment (no spam for repos where the recap has never run).\\n            if (!run && pr) {\\n              try {\\n                const MARKER = \\'<!-- pr-visual-recap -->\\';\\n                const { data: comments } = await github.rest.issues.listComments({\\n                  owner: context.repo.owner,\\n                  repo: context.repo.repo,\\n                  issue_number: pr.number,\\n                  per_page: 100,\\n                });\\n                const existing = comments.find(\\n                  (c) => c.user && c.user.type === \\'Bot\\' && c.body && c.body.includes(MARKER)\\n                );\\n                if (existing) {\\n                  const headShort = (process.env.HEAD_SHA || \\'\\').slice(0, 7);\\n                  const shaRef = headShort ? `\\\\`${headShort}\\\\`` : \\'latest push\\';\\n                  const primaryReason = reasons.filter(\\n                    (r) => !r.startsWith(\\'could not list PR files for the self-modifying guard\\')\\n                  )[0] || reasons[0] || \\'skipped\\';\\n                  const skipLine = `_Recap skipped for ${shaRef}: ${primaryReason}._`;\\n                  const withoutPrev = (existing.body || \\'\\')\\n                    .split(\\'\\\\n\\')\\n                    .filter((l) => !/_Recap skipped for .+_$/.test(l.trim()))\\n                    .join(\\'\\\\n\\')\\n                    .trimEnd();\\n                  const updatedBody = `${withoutPrev}\\\\n\\\\n${skipLine}`;\\n                  await github.rest.issues.updateComment({\\n                    owner: context.repo.owner,\\n                    repo: context.repo.repo,\\n                    comment_id: existing.id,\\n                    body: updatedBody,\\n                  });\\n                }\\n              } catch (e) {\\n                core.warning(`Could not update recap skip comment: ${e.message}`);\\n              }\\n            }\\n\\n  recap:\\n    name: Generate visual recap\\n    needs: gate\\n    if: needs.gate.outputs.run == \\'true\\'\\n    runs-on: ubuntu-latest\\n    timeout-minutes: 30\\n    permissions:\\n      actions: write\\n      checks: write\\n      contents: read\\n      issues: write\\n      pull-requests: write\\n    env:\\n      PLAN_RECAP_APP_URL: ${{ secrets.PLAN_RECAP_APP_URL || \\'https://plan.agent-native.com\\' }}\\n      PLAN_RECAP_TOKEN: ${{ secrets.PLAN_RECAP_TOKEN }}\\n      GH_TOKEN: ${{ github.token }}\\n      PR_NUMBER: ${{ github.event.pull_request.number }}\\n      HEAD_SHA: ${{ github.event.pull_request.head.sha }}\\n      VISUAL_RECAP_MODEL: ${{ vars.VISUAL_RECAP_MODEL }}\\n      VISUAL_RECAP_REASONING: ${{ vars.VISUAL_RECAP_REASONING }}\\n      VISUAL_RECAP_SKILL_SOURCE: ${{ vars.VISUAL_RECAP_SKILL_SOURCE || \\'auto\\' }}\\n    steps:\\n      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\\n        with:\\n          fetch-depth: 0\\n          # This job runs an agent over untrusted PR diff; don\\'t leave the token\\n          # in .git/config (it uses GH_TOKEN for gh API calls, never git push).\\n          persist-credentials: false\\n\\n      # Dogfood trusted base-branch source inside this monorepo, else install the\\n      # published package once. Never execute PR-head recap CLI code.\\n      - name: Resolve recap CLI\\n        id: cli\\n        env:\\n          # Optional: pin the consumer CLI version (e.g. \"1.2.3\"). Defaults to\\n          # \"latest\" when unset. Set via repository variable RECAP_CLI_VERSION.\\n          RECAP_CLI_VERSION: ${{ vars.RECAP_CLI_VERSION || \\'latest\\' }}\\n        run: |\\n          if [ \"$GITHUB_REPOSITORY\" = \"BuilderIO/agent-native\" ] && [ -f packages/core/src/cli/index.ts ]; then\\n            echo \"local=true\" >> \"$GITHUB_OUTPUT\"\\n          else\\n            echo \"local=false\" >> \"$GITHUB_OUTPUT\"\\n          fi\\n\\n      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\\n        if: steps.cli.outputs.local == \\'true\\'\\n        with:\\n          ref: ${{ github.event.pull_request.base.sha }}\\n          path: .recap-cli-source\\n          fetch-depth: 1\\n          persist-credentials: false\\n\\n      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8\\n        if: steps.cli.outputs.local == \\'true\\'\\n\\n      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\\n        with:\\n          node-version: \"22\"\\n          cache: ${{ steps.cli.outputs.local == \\'true\\' && \\'pnpm\\' || \\'\\' }}\\n\\n      - name: Install trusted workspace recap CLI\\n        if: steps.cli.outputs.local == \\'true\\'\\n        working-directory: .recap-cli-source\\n        run: |\\n          set -euo pipefail\\n          pnpm install --frozen-lockfile --ignore-scripts\\n          echo \"RECAP_CLI=$PWD/node_modules/.bin/tsx $PWD/packages/core/src/cli/index.ts\" >> \"$GITHUB_ENV\"\\n\\n      - name: Install published recap CLI\\n        if: steps.cli.outputs.local != \\'true\\'\\n        env:\\n          RECAP_CLI_VERSION: ${{ vars.RECAP_CLI_VERSION || \\'latest\\' }}\\n        run: |\\n          set -euo pipefail\\n          VERSION=\"$RECAP_CLI_VERSION\"\\n          if [ \"$VERSION\" = \"latest\" ]; then\\n            VERSION=\"$(npm view @agent-native/core@latest version)\"\\n          fi\\n          for attempt in 1 2 3; do\\n            if npm install --prefix \"$RUNNER_TEMP/recap-cli\" --no-audit --no-fund \"@agent-native/core@$VERSION\"; then\\n              break\\n            fi\\n            if [ \"$attempt\" = \"3\" ]; then exit 1; fi\\n            sleep $((attempt * 10))\\n          done\\n          echo \"RECAP_CLI=$RUNNER_TEMP/recap-cli/node_modules/.bin/agent-native\" >> \"$GITHUB_ENV\"\\n\\n      - name: Start visual recap check\\n        id: recap_check\\n        continue-on-error: true\\n        run: |\\n          set -uo pipefail\\n          $RECAP_CLI recap check start --sha \"$HEAD_SHA\" --workflow-url \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID\"\\n\\n      - name: Collect bounded diff\\n        id: diff\\n        env:\\n          BASE_SHA: ${{ github.event.pull_request.base.sha }}\\n        run: |\\n          set -euo pipefail\\n          $RECAP_CLI recap collect-diff --base \"$BASE_SHA\" --head \"$HEAD_SHA\" --out recap.diff --stat recap.stat\\n\\n      - name: Probe plan-app auth\\n        id: auth_probe\\n        if: steps.diff.outputs.tiny != \\'true\\'\\n        continue-on-error: true\\n        run: |\\n          set -uo pipefail\\n          # Hit the plan app\\'s action surface with the publish token. A 401 means\\n          # the token is expired/revoked; surface it in the sticky comment so the\\n          # repo owner knows to re-mint it instead of seeing a generic failure.\\n          HTTP_STATUS=$(node -e \\'\\n            const https = require(\"https\");\\n            const url = new URL(\"/_agent-native/actions/record-recap-usage\", process.env.PLAN_RECAP_APP_URL || \"https://plan.agent-native.com\");\\n            const req = https.request(url, { method: \"POST\", headers: { \"authorization\": \"Bearer \" + process.env.PLAN_RECAP_TOKEN, \"content-type\": \"application/json\" }, timeout: 8000 }, (res) => { process.stdout.write(String(res.statusCode)); req.destroy(); });\\n            req.on(\"error\", () => process.stdout.write(\"0\"));\\n            req.end(JSON.stringify({ planId: \"__probe__\" }));\\n          \\' 2>/dev/null || echo \"0\")\\n          if [ \"$HTTP_STATUS\" = \"401\" ]; then\\n            echo \"auth_failed=true\" >> \"$GITHUB_OUTPUT\"\\n          else\\n            echo \"auth_failed=false\" >> \"$GITHUB_OUTPUT\"\\n          fi\\n\\n      - name: Secret scan\\n        id: scan\\n        if: steps.diff.outputs.tiny != \\'true\\'\\n        run: |\\n          set -uo pipefail\\n          # Fail CLOSED: a scanner error or invalid JSON suppresses the diff so a\\n          # credential-bearing diff is never handed to the agent / plan service.\\n          if ! SCAN_JSON=\"$($RECAP_CLI recap scan --diff recap.diff)\"; then\\n            SCAN_JSON=\\'{\"suppressed\":true,\"reason\":\"secret scan failed to run; failing closed\"}\\'\\n          fi\\n          {\\n            echo \\'json<<__RECAP_SCAN_EOF__\\'\\n            echo \"$SCAN_JSON\"\\n            echo \\'__RECAP_SCAN_EOF__\\'\\n          } >> \"$GITHUB_OUTPUT\"\\n          SUPPRESSED=$(node -e \\'try{process.stdout.write(JSON.parse(process.argv[1]).suppressed?\"true\":\"false\")}catch{process.stdout.write(\"true\")}\\' \"$SCAN_JSON\")\\n          echo \"suppressed=$SUPPRESSED\" >> \"$GITHUB_OUTPUT\"\\n\\n      - name: Read previous plan id\\n        id: prev\\n        continue-on-error: true\\n        run: |\\n          set -euo pipefail\\n          PLAN_ID=\"$($RECAP_CLI recap comment find-plan-id --repo \"$GITHUB_REPOSITORY\" --issue \"$PR_NUMBER\" --token \"$GH_TOKEN\")\"\\n          echo \"plan_id=$PLAN_ID\" >> \"$GITHUB_OUTPUT\"\\n\\n      - name: Build recap prompt\\n        id: prompt\\n        if: steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        env:\\n          # Pass step outputs via env, NOT ${{ }} interpolation into the run body:\\n          # the prev plan id is parsed from a PR comment and could inject shell.\\n          PREV_PLAN_ID: ${{ steps.prev.outputs.plan_id }}\\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\\n        run: |\\n          set -euo pipefail\\n          ARGS=(--diff recap.diff --stat recap.stat --pr \"$PR_NUMBER\" --repo \"$GITHUB_REPOSITORY\" --head \"$HEAD_SHA\" --app-url \"$PLAN_RECAP_APP_URL\" --skill-source \"$VISUAL_RECAP_SKILL_SOURCE\" --out recap-prompt.md)\\n          if [ \"${DIFF_HUGE:-}\" = \"true\" ]; then ARGS+=(--huge); fi\\n          if [ -n \"${PREV_PLAN_ID:-}\" ]; then ARGS+=(--prev-plan-id \"$PREV_PLAN_ID\"); fi\\n          $RECAP_CLI recap build-prompt \"${ARGS[@]}\"\\n\\n      - name: Run agent (Claude Code)\\n        id: claude\\n        if: needs.gate.outputs.agent == \\'claude\\' && steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        continue-on-error: true\\n        env:\\n          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}\\n        run: |\\n          set -uo pipefail\\n          MCP_CONFIG=\"$RUNNER_TEMP/plan-mcp.json\"\\n          $RECAP_CLI recap mcp-config --agent claude --app-url \"$PLAN_RECAP_APP_URL\" --out \"$MCP_CONFIG\"\\n          CLAUDE_ARGS=(-p \"$(cat recap-prompt.md)\" --mcp-config \"$MCP_CONFIG\" --allowedTools \"Read,Write,Bash(git diff:*),mcp__plan__get-plan-blocks,mcp__plan__create-visual-recap,mcp__plan__set-resource-visibility\" --permission-mode dontAsk --output-format json)\\n          if [ -n \"${VISUAL_RECAP_MODEL:-}\" ]; then CLAUDE_ARGS+=(--model \"$VISUAL_RECAP_MODEL\"); fi\\n          rm -f recap-url.txt claude-result.json claude-stderr.log\\n          run_claude() {\\n            set +e\\n            npx -y @anthropic-ai/claude-code@2 \"${CLAUDE_ARGS[@]}\" > claude-result.json 2> claude-stderr.log\\n            CLAUDE_STATUS=\"$?\"\\n            set -e\\n            echo \"$CLAUDE_STATUS\" > claude-exit-code.txt\\n          }\\n          run_claude\\n          if [ ! -s recap-url.txt ] && grep -Eiq \\'schedule(d)? (a )?(wakeup|retry)|will retry|backoff|connector.*register|mcp.*(register|unreachable|not usable|zero tools|not callable)\\' claude-result.json claude-stderr.log 2>/dev/null; then\\n            echo \"Plan MCP registration appears delayed; retrying Claude once after 20s.\"\\n            sleep 20\\n            run_claude\\n          fi\\n          rm -f \"$MCP_CONFIG\" || true\\n\\n      - name: Run agent (Codex)\\n        id: codex\\n        if: needs.gate.outputs.agent == \\'codex\\' && steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        continue-on-error: true\\n        env:\\n          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\\n        run: |\\n          set -uo pipefail\\n          $RECAP_CLI recap mcp-config --agent codex --app-url \"$PLAN_RECAP_APP_URL\" --force\\n          # `codex login` writes ~/.codex/auth.json (the bare env var is dropped on\\n          # the gpt-5.5 wss transport); stdin keeps the key out of process args.\\n          printenv OPENAI_API_KEY | npx -y @openai/codex@0 login --with-api-key || true\\n          # The runner is itself an ephemeral sandbox; bypass Codex\\'s own sandbox\\n          # (bubblewrap can\\'t init here) and approval gate (cancels the MCP write).\\n          CODEX_ARGS=(exec --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check)\\n          if [ -n \"${VISUAL_RECAP_MODEL:-}\" ]; then CODEX_ARGS+=(--model \"$VISUAL_RECAP_MODEL\"); fi\\n          # Validate reasoning against the enum before embedding it in the TOML override.\\n          case \"${VISUAL_RECAP_REASONING:-}\" in\\n            none|minimal|low|medium|high|xhigh)\\n              CODEX_ARGS+=(-c \"model_reasoning_effort=\\\\\"$VISUAL_RECAP_REASONING\\\\\"\") ;;\\n            \"\") ;;\\n            *) echo \"Ignoring invalid VISUAL_RECAP_REASONING: $VISUAL_RECAP_REASONING\" ;;\\n          esac\\n          rm -f recap-url.txt codex-events.jsonl codex-stderr.log\\n          run_codex() {\\n            set +e\\n            npx -y @openai/codex@0 \"${CODEX_ARGS[@]}\" --json \"$(cat recap-prompt.md)\" 2> codex-stderr.log | tee codex-events.jsonl\\n            CODEX_STATUS=\"${PIPESTATUS[0]}\"\\n            set -e\\n            echo \"$CODEX_STATUS\" > codex-exit-code.txt\\n          }\\n          run_codex\\n          if [ ! -s recap-url.txt ] && grep -Eiq \\'schedule(d)? (a )?(wakeup|retry)|will retry|backoff|connector.*register|mcp.*(register|unreachable|not usable|zero tools|not callable)\\' codex-events.jsonl codex-stderr.log 2>/dev/null; then\\n            echo \"Plan MCP registration appears delayed; retrying Codex once after 20s.\"\\n            sleep 20\\n            run_codex\\n          fi\\n\\n      - name: Read plan URL\\n        id: url\\n        if: steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        run: |\\n          set -uo pipefail\\n          PLAN_URL=\"\"\\n          URL_REASON=\"\"\\n          if [ -f recap-url.txt ]; then\\n            PLAN_URL=\"$(tr -d \\'\\\\r\\\\n\\' < recap-url.txt | tr -d \\' \\')\"\\n          else\\n            URL_REASON=\"recap-url.txt was not created by the agent\"\\n          fi\\n          # recap-url.txt is agent-written -> untrusted. Rebuild a canonical\\n          # recap URL from the trusted app base and a strictly validated plan id,\\n          # preserving path-prefixed self-hosted mounts.\\n          if [ -z \"$URL_REASON\" ]; then\\n            URL_RESULT=$(PLAN_URL=\"$PLAN_URL\" node <<\\'NODE\\'\\n          const emit = (value) => process.stdout.write(JSON.stringify(value));\\n          try {\\n            const raw = process.env.PLAN_URL || \"\";\\n            if (!raw) {\\n              emit({ url: \"\", reason: \"recap-url.txt was empty\" });\\n              process.exit(0);\\n            }\\n            const trusted = new URL(process.env.PLAN_RECAP_APP_URL || \"https://plan.agent-native.com\");\\n            const parsed = /^https?:\\\\/\\\\//i.test(raw)\\n              ? new URL(raw)\\n              : new URL(raw, trusted);\\n            if (parsed.origin !== trusted.origin) {\\n              emit({ url: \"\", reason: `recap-url.txt points at ${parsed.origin}, expected ${trusted.origin}` });\\n              process.exit(0);\\n            }\\n\\n            const base = trusted.pathname.replace(/\\\\/$/, \"\");\\n            const paths = [parsed.pathname];\\n            if (base && parsed.pathname.startsWith(`${base}/`)) {\\n              paths.push(parsed.pathname.slice(base.length) || \"/\");\\n            }\\n\\n            for (const path of paths) {\\n              const match = path.match(/^\\\\/(?:plans|recaps)\\\\/([A-Za-z0-9_-]+)\\\\/?$/);\\n              if (match) {\\n                emit({ url: `${trusted.origin}${base}/recaps/${match[1]}`, reason: \"\" });\\n                process.exit(0);\\n              }\\n            }\\n            emit({ url: \"\", reason: \"recap-url.txt did not contain a valid /plans/<id> or /recaps/<id> URL for the configured plan app\" });\\n          } catch {\\n            emit({ url: \"\", reason: \"recap-url.txt was not a valid URL or recap path\" });\\n          }\\n          NODE\\n            )\\n            CANONICAL_URL=$(node -e \\'try{process.stdout.write(JSON.parse(process.argv[1]).url||\"\")}catch{process.stdout.write(\"\")}\\' \"$URL_RESULT\")\\n            URL_REASON=$(node -e \\'try{process.stdout.write(JSON.parse(process.argv[1]).reason||\"\")}catch{process.stdout.write(\"recap-url.txt URL validation failed\")}\\' \"$URL_RESULT\")\\n          else\\n            CANONICAL_URL=\"\"\\n          fi\\n          if [ -n \"$CANONICAL_URL\" ]; then\\n            echo \"plan_url=$CANONICAL_URL\" >> \"$GITHUB_OUTPUT\"; echo \"ok=true\" >> \"$GITHUB_OUTPUT\"\\n          else\\n            echo \"plan_url=\" >> \"$GITHUB_OUTPUT\"; echo \"ok=false\" >> \"$GITHUB_OUTPUT\"\\n          fi\\n          {\\n            echo \\'reason<<__RECAP_URL_REASON_EOF__\\'\\n            echo \"$URL_REASON\"\\n            echo \\'__RECAP_URL_REASON_EOF__\\'\\n          } >> \"$GITHUB_OUTPUT\"\\n\\n      - name: Summarize agent failure\\n        id: agent_summary\\n        if: steps.url.outputs.ok != \\'true\\' && steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        continue-on-error: true\\n        env:\\n          RECAP_AGENT: ${{ needs.gate.outputs.agent }}\\n        run: |\\n          set -uo pipefail\\n          RESULT=claude-result.json\\n          STDERR=claude-stderr.log\\n          EXIT_CODE=claude-exit-code.txt\\n          if [ \"$RECAP_AGENT\" = \"codex\" ]; then\\n            RESULT=codex-events.jsonl\\n            STDERR=codex-stderr.log\\n            EXIT_CODE=codex-exit-code.txt\\n          fi\\n          $RECAP_CLI recap agent-summary --agent \"$RECAP_AGENT\" --result-file \"$RESULT\" --stderr-file \"$STDERR\" --exit-code-file \"$EXIT_CODE\" || true\\n\\n      - name: Attach usage\\n        if: steps.url.outputs.ok == \\'true\\'\\n        continue-on-error: true\\n        env:\\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\\n          # Use the gate-normalized agent so \"Codex\" still selects the right file.\\n          RECAP_AGENT: ${{ needs.gate.outputs.agent }}\\n        run: |\\n          set -uo pipefail\\n          RESULT=claude-result.json\\n          if [ \"$RECAP_AGENT\" = \"codex\" ]; then RESULT=codex-events.jsonl; fi\\n          if [ -f \"$RESULT\" ]; then $RECAP_CLI recap usage --plan-url \"$PLAN_URL\" --agent \"$RECAP_AGENT\" --result-file \"$RESULT\" --model \"${VISUAL_RECAP_MODEL:-}\" --app-url \"$PLAN_RECAP_APP_URL\" --token \"$PLAN_RECAP_TOKEN\" || true; fi\\n\\n      - name: Cache Playwright browsers\\n        if: steps.url.outputs.ok == \\'true\\'\\n        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3\\n        with:\\n          path: ~/.cache/ms-playwright\\n          key: playwright-1-${{ runner.os }}\\n\\n      - name: Screenshot + upload\\n        id: shot\\n        if: steps.url.outputs.ok == \\'true\\'\\n        continue-on-error: true\\n        env:\\n          # recap-url.txt is untrusted agent output; pass via env, never ${{ }}.\\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\\n        run: |\\n          set -uo pipefail\\n          pnpm exec playwright install --with-deps chromium 2>/dev/null || npx -y playwright@1 install --with-deps chromium || true\\n          LIGHT_SHOT_JSON=\"$($RECAP_CLI recap shot --url \"$PLAN_URL\" --token \"$PLAN_RECAP_TOKEN\" --app-url \"$PLAN_RECAP_APP_URL\" --out recap.png --theme light || echo \\'{}\\')\"\\n          DARK_SHOT_JSON=\"$($RECAP_CLI recap shot --url \"$PLAN_URL\" --token \"$PLAN_RECAP_TOKEN\" --app-url \"$PLAN_RECAP_APP_URL\" --out recap-dark.png --theme dark || echo \\'{}\\')\"\\n          IMAGE_URL=$(node -e \\'try{process.stdout.write(JSON.parse(process.argv[1]).imageUrl||\"\")}catch{process.stdout.write(\"\")}\\' \"$LIGHT_SHOT_JSON\")\\n          DARK_IMAGE_URL=$(node -e \\'try{process.stdout.write(JSON.parse(process.argv[1]).imageUrl||\"\")}catch{process.stdout.write(\"\")}\\' \"$DARK_SHOT_JSON\")\\n          echo \"image_url=$IMAGE_URL\" >> \"$GITHUB_OUTPUT\"\\n          echo \"light_image_url=$IMAGE_URL\" >> \"$GITHUB_OUTPUT\"\\n          echo \"dark_image_url=$DARK_IMAGE_URL\" >> \"$GITHUB_OUTPUT\"\\n          if [ -f recap.png ] || [ -f recap-dark.png ]; then echo \"captured=true\" >> \"$GITHUB_OUTPUT\"; else echo \"captured=false\" >> \"$GITHUB_OUTPUT\"; fi\\n\\n      - name: Upload recap screenshot artifact\\n        if: steps.shot.outputs.captured == \\'true\\'\\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\\n        with:\\n          name: pr-visual-recap-${{ github.event.pull_request.number }}\\n          path: |\\n            recap.png\\n            recap-dark.png\\n          if-no-files-found: ignore\\n          retention-days: 14\\n\\n      - name: Upsert sticky comment\\n        if: always()\\n        continue-on-error: true\\n        env:\\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\\n          RECAP_IMAGE_URL: ${{ steps.shot.outputs.image_url }}\\n          RECAP_LIGHT_IMAGE_URL: ${{ steps.shot.outputs.light_image_url }}\\n          RECAP_DARK_IMAGE_URL: ${{ steps.shot.outputs.dark_image_url }}\\n          SUPPRESSED: ${{ steps.scan.outputs.suppressed }}\\n          SUPPRESSED_JSON: ${{ steps.scan.outputs.json }}\\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\\n          DIFF_TINY: ${{ steps.diff.outputs.tiny }}\\n          PREV_PLAN_ID: ${{ steps.prev.outputs.plan_id }}\\n          RECAP_AUTH_FAILED: ${{ steps.auth_probe.outputs.auth_failed }}\\n          RECAP_AGENT_SUMMARY: ${{ steps.agent_summary.outputs.summary }}\\n          RECAP_URL_REASON: ${{ steps.url.outputs.reason }}\\n        run: |\\n          set -euo pipefail\\n          ARGS=(recap comment upsert --repo \"$GITHUB_REPOSITORY\" --issue \"$PR_NUMBER\" --token \"$GH_TOKEN\")\\n          # On a tiny diff, only REFRESH an existing comment, never create one.\\n          if [ \"${DIFF_TINY:-}\" = \"true\" ]; then ARGS+=(--update-only); fi\\n          $RECAP_CLI \"${ARGS[@]}\"\\n\\n      - name: Complete visual recap check\\n        if: always() && steps.recap_check.outputs.check_run_id != \\'\\'\\n        continue-on-error: true\\n        env:\\n          # Untrusted/step values via env (NOT ${{ }}-interpolated into the run\\n          # body): the agent-written plan URL and the scan JSON could inject shell.\\n          CHECK_RUN_ID: ${{ steps.recap_check.outputs.check_run_id }}\\n          PLAN_OK: ${{ steps.url.outputs.ok }}\\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\\n          SUPPRESSED: ${{ steps.scan.outputs.suppressed }}\\n          SUPPRESSED_JSON: ${{ steps.scan.outputs.json }}\\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\\n          DIFF_TINY: ${{ steps.diff.outputs.tiny }}\\n          RECAP_AGENT_SUMMARY: ${{ steps.agent_summary.outputs.summary }}\\n          RECAP_URL_REASON: ${{ steps.url.outputs.reason }}\\n        run: |\\n          set -uo pipefail\\n          $RECAP_CLI recap check complete \\\\\\n            --check-run-id \"$CHECK_RUN_ID\" \\\\\\n            --plan-ok \"$PLAN_OK\" \\\\\\n            --plan-url \"$PLAN_URL\" \\\\\\n            --suppressed \"$SUPPRESSED\" \\\\\\n            --suppressed-json \"$SUPPRESSED_JSON\" \\\\\\n            --huge \"$DIFF_HUGE\" \\\\\\n            --tiny \"$DIFF_TINY\" \\\\\\n            --failure-summary \"$RECAP_AGENT_SUMMARY\" \\\\\\n            --url-reason \"$RECAP_URL_REASON\" \\\\\\n            --workflow-url \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID\"\\n';\n"]}
+{"version":3,"file":"pr-visual-recap-workflow.js","sourceRoot":"","sources":["../../src/cli/pr-visual-recap-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GACvC,6j6BAA6j6B,CAAC","sourcesContent":["/**\n * Bundled copy of .github/workflows/pr-visual-recap.yml so the CLI can write the\n * PR Visual Recap workflow into a user repo via\n * `agent-native skills add visual-plan --with-github-action`.\n *\n * AUTO-GENERATED — keep byte-identical with the source workflow. A sync test in\n * recap.spec.ts fails if these drift. Regenerate from the YAML with the snippet\n * in recap.spec.ts.\n */\n\nexport const PR_VISUAL_RECAP_WORKFLOW_YML =\n  'name: PR Visual Recap\\n\\n# Visual code review: a coding agent runs the repo\\'s visual-recap skill over the\\n# PR diff, publishes a plan, and upserts one sticky comment with a screenshot.\\n# Plain `pull_request` (NOT `pull_request_target`) so fork code never sees secrets.\\n\\non:\\n  pull_request:\\n    types: [opened, synchronize, reopened, ready_for_review]\\n\\npermissions:\\n  contents: read\\n\\nconcurrency:\\n  group: pr-visual-recap-${{ github.event.pull_request.number }}\\n  cancel-in-progress: true\\n\\nenv:\\n  VISUAL_RECAP_AGENT: ${{ vars.VISUAL_RECAP_AGENT || \\'claude\\' }}\\n  VISUAL_RECAP_SKILL_SOURCE: ${{ vars.VISUAL_RECAP_SKILL_SOURCE || \\'auto\\' }}\\n\\njobs:\\n  gate:\\n    name: Gate\\n    runs-on: ubuntu-latest\\n    timeout-minutes: 10\\n    permissions:\\n      contents: read\\n      issues: write\\n      pull-requests: write\\n    outputs:\\n      run: ${{ steps.decide.outputs.run }}\\n      agent: ${{ steps.decide.outputs.agent }}\\n    steps:\\n      - id: decide\\n        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\\n        env:\\n          # Presence-only signals — never expose secret VALUES to the gate.\\n          HAS_PLAN: ${{ secrets.PLAN_RECAP_TOKEN != \\'\\' }}\\n          HAS_ANTHROPIC: ${{ secrets.ANTHROPIC_API_KEY != \\'\\' }}\\n          HAS_OPENAI: ${{ secrets.OPENAI_API_KEY != \\'\\' }}\\n          AGENT: ${{ env.VISUAL_RECAP_AGENT }}\\n          VISUAL_RECAP_MODEL: ${{ vars.VISUAL_RECAP_MODEL }}\\n          HEAD_SHA: ${{ github.event.pull_request.head.sha }}\\n        with:\\n          script: |\\n            const pr = context.payload.pull_request;\\n            const reasons = [];\\n\\n            if (!pr) reasons.push(\\'no pull_request payload\\');\\n            if (pr && pr.draft) reasons.push(\\'draft PR\\');\\n\\n            // Fork PRs run with no secrets, so publishing would fail anyway — skip.\\n            const headRepo = pr && pr.head && pr.head.repo && pr.head.repo.full_name;\\n            if (pr && headRepo && headRepo !== process.env.GITHUB_REPOSITORY) {\\n              reasons.push(`fork PR (${headRepo})`);\\n            }\\n\\n            const login = (pr && pr.user && pr.user.login || \\'\\').toLowerCase();\\n            const botAuthors = [\\'dependabot[bot]\\', \\'dependabot\\', \\'renovate[bot]\\', \\'renovate\\'];\\n            if (botAuthors.includes(login)) reasons.push(`bot author (${login})`);\\n            if (pr && pr.user && pr.user.type === \\'Bot\\') reasons.push(\\'bot author (type=Bot)\\');\\n\\n            if (process.env.HAS_PLAN !== \\'true\\') reasons.push(\\'PLAN_RECAP_TOKEN not configured\\');\\n\\n            // Normalize + validate the agent so a mis-cased value can\\'t pass the\\n            // gate and then match neither agent step below.\\n            const agent = (process.env.AGENT || \\'claude\\').toLowerCase();\\n            if (agent !== \\'claude\\' && agent !== \\'codex\\') {\\n              reasons.push(`unsupported VISUAL_RECAP_AGENT \"${process.env.AGENT}\" (expected \"claude\" or \"codex\")`);\\n            } else if (agent === \\'codex\\') {\\n              if (process.env.HAS_OPENAI !== \\'true\\') reasons.push(\\'OPENAI_API_KEY not configured (codex backend)\\');\\n            } else {\\n              if (process.env.HAS_ANTHROPIC !== \\'true\\') reasons.push(\\'ANTHROPIC_API_KEY not configured (claude backend)\\');\\n            }\\n\\n            // Validate the model before it reaches the agent CLI.\\n            const model = process.env.VISUAL_RECAP_MODEL || \\'\\';\\n            if (model && !/^[a-zA-Z0-9._-]{1,80}$/.test(model)) {\\n              reasons.push(`invalid VISUAL_RECAP_MODEL value (must match [a-zA-Z0-9._-]{1,80})`);\\n            }\\n\\n            // Self-modifying guard, evaluated in the trusted gate (runs NO\\n            // PR-checked-out code): skip the ENTIRE job if the PR touches the\\n            // workflow, skill, or any agent config the runner loads, so a PR\\n            // can\\'t rewrite what runs and exfiltrate secrets.\\n            if (pr) {\\n              try {\\n                const files = await github.paginate(github.rest.pulls.listFiles, {\\n                  owner: context.repo.owner,\\n                  repo: context.repo.repo,\\n                  pull_number: pr.number,\\n                  per_page: 100,\\n                });\\n                const isSensitive = (p) =>\\n                  p === \\'.github/workflows/pr-visual-recap.yml\\' ||\\n                  /(^|\\\\/)skills\\\\/visual-(recap|plan|plans)\\\\//.test(p) ||\\n                  /(^|\\\\/)\\\\.claude\\\\//.test(p) ||\\n                  /(^|\\\\/)CLAUDE\\\\.md$/.test(p) ||\\n                  /(^|\\\\/)AGENTS\\\\.md$/.test(p) ||\\n                  /(^|\\\\/)\\\\.mcp\\\\.json$/.test(p);\\n                const hits = files.map((f) => f.filename).filter(isSensitive);\\n                if (hits.length) {\\n                  reasons.push(`PR modifies recap-control files (${hits.slice(0, 3).join(\\', \\')}${hits.length > 3 ? \\', …\\' : \\'\\'}) — skipping so untrusted PR code never runs with secrets`);\\n                }\\n              } catch (e) {\\n                // Fail closed: if the file list can\\'t be read, skip.\\n                reasons.push(`could not list PR files for the self-modifying guard (${e.message}); skipping to be safe`);\\n              }\\n            }\\n\\n            const run = reasons.length === 0;\\n            core.setOutput(\\'run\\', run ? \\'true\\' : \\'false\\');\\n            core.setOutput(\\'agent\\', agent);\\n            core.info(run ? `Visual recap will run (${agent}).` : `Visual recap skipped: ${reasons.join(\\'; \\')}`);\\n\\n            // When skipping, refresh an EXISTING sticky recap comment with a\\n            // short skip line so it does not silently go stale. Never create a\\n            // new comment (no spam for repos where the recap has never run).\\n            if (!run && pr) {\\n              try {\\n                const MARKER = \\'<!-- pr-visual-recap -->\\';\\n                const { data: comments } = await github.rest.issues.listComments({\\n                  owner: context.repo.owner,\\n                  repo: context.repo.repo,\\n                  issue_number: pr.number,\\n                  per_page: 100,\\n                });\\n                const existing = comments.find(\\n                  (c) => c.user && c.user.type === \\'Bot\\' && c.body && c.body.includes(MARKER)\\n                );\\n                if (existing) {\\n                  const headShort = (process.env.HEAD_SHA || \\'\\').slice(0, 7);\\n                  const shaRef = headShort ? `\\\\`${headShort}\\\\`` : \\'latest push\\';\\n                  const primaryReason = reasons.filter(\\n                    (r) => !r.startsWith(\\'could not list PR files for the self-modifying guard\\')\\n                  )[0] || reasons[0] || \\'skipped\\';\\n                  const skipLine = `_Recap skipped for ${shaRef}: ${primaryReason}._`;\\n                  const withoutPrev = (existing.body || \\'\\')\\n                    .split(\\'\\\\n\\')\\n                    .filter((l) => !/_Recap skipped for .+_$/.test(l.trim()))\\n                    .join(\\'\\\\n\\')\\n                    .trimEnd();\\n                  const updatedBody = `${withoutPrev}\\\\n\\\\n${skipLine}`;\\n                  await github.rest.issues.updateComment({\\n                    owner: context.repo.owner,\\n                    repo: context.repo.repo,\\n                    comment_id: existing.id,\\n                    body: updatedBody,\\n                  });\\n                }\\n              } catch (e) {\\n                core.warning(`Could not update recap skip comment: ${e.message}`);\\n              }\\n            }\\n\\n  recap:\\n    name: Generate visual recap\\n    needs: gate\\n    if: needs.gate.outputs.run == \\'true\\'\\n    runs-on: ubuntu-latest\\n    timeout-minutes: 30\\n    permissions:\\n      actions: write\\n      checks: write\\n      contents: read\\n      issues: write\\n      pull-requests: write\\n    env:\\n      PLAN_RECAP_APP_URL: ${{ secrets.PLAN_RECAP_APP_URL || \\'https://plan.agent-native.com\\' }}\\n      PLAN_RECAP_TOKEN: ${{ secrets.PLAN_RECAP_TOKEN }}\\n      GH_TOKEN: ${{ github.token }}\\n      PR_NUMBER: ${{ github.event.pull_request.number }}\\n      HEAD_SHA: ${{ github.event.pull_request.head.sha }}\\n      VISUAL_RECAP_MODEL: ${{ vars.VISUAL_RECAP_MODEL }}\\n      VISUAL_RECAP_REASONING: ${{ vars.VISUAL_RECAP_REASONING }}\\n      VISUAL_RECAP_SKILL_SOURCE: ${{ vars.VISUAL_RECAP_SKILL_SOURCE || \\'auto\\' }}\\n    steps:\\n      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\\n        with:\\n          fetch-depth: 0\\n          # This job runs an agent over untrusted PR diff; don\\'t leave the token\\n          # in .git/config (it uses GH_TOKEN for gh API calls, never git push).\\n          persist-credentials: false\\n\\n      # Dogfood trusted base-branch source inside this monorepo, else install the\\n      # published package once. Never execute PR-head recap CLI code.\\n      - name: Resolve recap CLI\\n        id: cli\\n        env:\\n          # Optional: pin the consumer CLI version (e.g. \"1.2.3\"). Defaults to\\n          # \"latest\" when unset. Set via repository variable RECAP_CLI_VERSION.\\n          RECAP_CLI_VERSION: ${{ vars.RECAP_CLI_VERSION || \\'latest\\' }}\\n        run: |\\n          if [ \"$GITHUB_REPOSITORY\" = \"BuilderIO/agent-native\" ] && [ -f packages/core/src/cli/index.ts ]; then\\n            echo \"local=true\" >> \"$GITHUB_OUTPUT\"\\n          else\\n            echo \"local=false\" >> \"$GITHUB_OUTPUT\"\\n          fi\\n\\n      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\\n        if: steps.cli.outputs.local == \\'true\\'\\n        with:\\n          ref: ${{ github.event.pull_request.base.sha }}\\n          path: .recap-cli-source\\n          fetch-depth: 1\\n          persist-credentials: false\\n\\n      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8\\n        if: steps.cli.outputs.local == \\'true\\'\\n\\n      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\\n        with:\\n          node-version: \"22\"\\n          cache: ${{ steps.cli.outputs.local == \\'true\\' && \\'pnpm\\' || \\'\\' }}\\n\\n      - name: Install trusted workspace recap CLI\\n        if: steps.cli.outputs.local == \\'true\\'\\n        working-directory: .recap-cli-source\\n        run: |\\n          set -euo pipefail\\n          pnpm install --frozen-lockfile --ignore-scripts\\n          echo \"RECAP_CLI=$PWD/node_modules/.bin/tsx $PWD/packages/core/src/cli/index.ts\" >> \"$GITHUB_ENV\"\\n\\n      - name: Install published recap CLI\\n        if: steps.cli.outputs.local != \\'true\\'\\n        env:\\n          RECAP_CLI_VERSION: ${{ vars.RECAP_CLI_VERSION || \\'latest\\' }}\\n        run: |\\n          set -euo pipefail\\n          VERSION=\"$RECAP_CLI_VERSION\"\\n          if [ \"$VERSION\" = \"latest\" ]; then\\n            VERSION=\"$(npm view @agent-native/core@latest version)\"\\n          fi\\n          for attempt in 1 2 3; do\\n            if npm install --prefix \"$RUNNER_TEMP/recap-cli\" --no-audit --no-fund \"@agent-native/core@$VERSION\"; then\\n              break\\n            fi\\n            if [ \"$attempt\" = \"3\" ]; then exit 1; fi\\n            sleep $((attempt * 10))\\n          done\\n          echo \"RECAP_CLI=$RUNNER_TEMP/recap-cli/node_modules/.bin/agent-native\" >> \"$GITHUB_ENV\"\\n\\n      - name: Start visual recap check\\n        id: recap_check\\n        continue-on-error: true\\n        run: |\\n          set -uo pipefail\\n          $RECAP_CLI recap check start --sha \"$HEAD_SHA\" --workflow-url \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID\"\\n\\n      - name: Collect bounded diff\\n        id: diff\\n        env:\\n          BASE_SHA: ${{ github.event.pull_request.base.sha }}\\n        run: |\\n          set -euo pipefail\\n          $RECAP_CLI recap collect-diff --base \"$BASE_SHA\" --head \"$HEAD_SHA\" --out recap.diff --stat recap.stat\\n\\n      - name: Probe plan-app auth\\n        id: auth_probe\\n        if: steps.diff.outputs.tiny != \\'true\\'\\n        continue-on-error: true\\n        run: |\\n          set -uo pipefail\\n          # Hit the plan app\\'s action surface with the publish token. A 401 means\\n          # the token is expired/revoked; surface it in the sticky comment so the\\n          # repo owner knows to re-mint it instead of seeing a generic failure.\\n          HTTP_STATUS=$(node -e \\'\\n            const https = require(\"https\");\\n            const url = new URL(\"/_agent-native/actions/record-recap-usage\", process.env.PLAN_RECAP_APP_URL || \"https://plan.agent-native.com\");\\n            const req = https.request(url, { method: \"POST\", headers: { \"authorization\": \"Bearer \" + process.env.PLAN_RECAP_TOKEN, \"content-type\": \"application/json\" }, timeout: 8000 }, (res) => { process.stdout.write(String(res.statusCode)); req.destroy(); });\\n            req.on(\"error\", () => process.stdout.write(\"0\"));\\n            req.end(JSON.stringify({ planId: \"__probe__\" }));\\n          \\' 2>/dev/null || echo \"0\")\\n          if [ \"$HTTP_STATUS\" = \"401\" ]; then\\n            echo \"auth_failed=true\" >> \"$GITHUB_OUTPUT\"\\n          else\\n            echo \"auth_failed=false\" >> \"$GITHUB_OUTPUT\"\\n          fi\\n\\n      - name: Secret scan\\n        id: scan\\n        if: steps.diff.outputs.tiny != \\'true\\'\\n        run: |\\n          set -uo pipefail\\n          # Fail CLOSED: a scanner error or invalid JSON suppresses the diff so a\\n          # credential-bearing diff is never handed to the agent / plan service.\\n          if ! SCAN_JSON=\"$($RECAP_CLI recap scan --diff recap.diff)\"; then\\n            SCAN_JSON=\\'{\"suppressed\":true,\"reason\":\"secret scan failed to run; failing closed\"}\\'\\n          fi\\n          {\\n            echo \\'json<<__RECAP_SCAN_EOF__\\'\\n            echo \"$SCAN_JSON\"\\n            echo \\'__RECAP_SCAN_EOF__\\'\\n          } >> \"$GITHUB_OUTPUT\"\\n          SUPPRESSED=$(node -e \\'try{process.stdout.write(JSON.parse(process.argv[1]).suppressed?\"true\":\"false\")}catch{process.stdout.write(\"true\")}\\' \"$SCAN_JSON\")\\n          echo \"suppressed=$SUPPRESSED\" >> \"$GITHUB_OUTPUT\"\\n\\n      - name: Read previous plan id\\n        id: prev\\n        continue-on-error: true\\n        run: |\\n          set -euo pipefail\\n          PLAN_ID=\"$($RECAP_CLI recap comment find-plan-id --repo \"$GITHUB_REPOSITORY\" --issue \"$PR_NUMBER\" --token \"$GH_TOKEN\")\"\\n          echo \"plan_id=$PLAN_ID\" >> \"$GITHUB_OUTPUT\"\\n\\n      - name: Smoke-test Plan MCP tools\\n        id: mcp_smoke\\n        if: steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        continue-on-error: true\\n        run: |\\n          set -uo pipefail\\n          $RECAP_CLI recap mcp-smoke --app-url \"$PLAN_RECAP_APP_URL\"\\n\\n      - name: Build recap prompt\\n        id: prompt\\n        if: steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\' && steps.mcp_smoke.outputs.ok == \\'true\\'\\n        env:\\n          # Pass step outputs via env, NOT ${{ }} interpolation into the run body:\\n          # the prev plan id is parsed from a PR comment and could inject shell.\\n          PREV_PLAN_ID: ${{ steps.prev.outputs.plan_id }}\\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\\n        run: |\\n          set -euo pipefail\\n          ARGS=(--diff recap.diff --stat recap.stat --pr \"$PR_NUMBER\" --repo \"$GITHUB_REPOSITORY\" --head \"$HEAD_SHA\" --app-url \"$PLAN_RECAP_APP_URL\" --skill-source \"$VISUAL_RECAP_SKILL_SOURCE\" --out recap-prompt.md)\\n          if [ \"${DIFF_HUGE:-}\" = \"true\" ]; then ARGS+=(--huge); fi\\n          if [ -n \"${PREV_PLAN_ID:-}\" ]; then ARGS+=(--prev-plan-id \"$PREV_PLAN_ID\"); fi\\n          $RECAP_CLI recap build-prompt \"${ARGS[@]}\"\\n\\n      - name: Run agent (Claude Code)\\n        id: claude\\n        if: needs.gate.outputs.agent == \\'claude\\' && steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\' && steps.mcp_smoke.outputs.ok == \\'true\\'\\n        continue-on-error: true\\n        env:\\n          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}\\n        run: |\\n          set -uo pipefail\\n          MCP_CONFIG=\"$RUNNER_TEMP/plan-mcp.json\"\\n          $RECAP_CLI recap mcp-config --agent claude --app-url \"$PLAN_RECAP_APP_URL\" --out \"$MCP_CONFIG\"\\n          CLAUDE_ARGS=(-p \"$(cat recap-prompt.md)\" --mcp-config \"$MCP_CONFIG\" --allowedTools \"Read,Write,Bash(git diff:*),mcp__plan__get-plan-blocks,mcp__plan__create-visual-recap,mcp__plan__set-resource-visibility\" --permission-mode dontAsk --output-format json)\\n          if [ -n \"${VISUAL_RECAP_MODEL:-}\" ]; then CLAUDE_ARGS+=(--model \"$VISUAL_RECAP_MODEL\"); fi\\n          rm -f recap-url.txt claude-result.json claude-stderr.log\\n          run_claude() {\\n            set +e\\n            npx -y @anthropic-ai/claude-code@2 \"${CLAUDE_ARGS[@]}\" > claude-result.json 2> claude-stderr.log\\n            CLAUDE_STATUS=\"$?\"\\n            set -e\\n            echo \"$CLAUDE_STATUS\" > claude-exit-code.txt\\n          }\\n          run_claude\\n          if [ ! -s recap-url.txt ] && grep -Eiq \\'schedule(d)? (a )?(wakeup|retry)|will retry|backoff|connector.*register|mcp.*(register|unreachable|not usable|zero tools|not callable)\\' claude-result.json claude-stderr.log 2>/dev/null; then\\n            echo \"Plan MCP registration appears delayed; retrying Claude once after 20s.\"\\n            sleep 20\\n            run_claude\\n          fi\\n          rm -f \"$MCP_CONFIG\" || true\\n\\n      - name: Run agent (Codex)\\n        id: codex\\n        if: needs.gate.outputs.agent == \\'codex\\' && steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\' && steps.mcp_smoke.outputs.ok == \\'true\\'\\n        continue-on-error: true\\n        env:\\n          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\\n        run: |\\n          set -uo pipefail\\n          $RECAP_CLI recap mcp-config --agent codex --app-url \"$PLAN_RECAP_APP_URL\" --force\\n          # `codex login` writes ~/.codex/auth.json (the bare env var is dropped on\\n          # the gpt-5.5 wss transport); stdin keeps the key out of process args.\\n          printenv OPENAI_API_KEY | npx -y @openai/codex@0 login --with-api-key || true\\n          # The runner is itself an ephemeral sandbox; bypass Codex\\'s own sandbox\\n          # (bubblewrap can\\'t init here) and approval gate (cancels the MCP write).\\n          CODEX_ARGS=(exec --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check)\\n          if [ -n \"${VISUAL_RECAP_MODEL:-}\" ]; then CODEX_ARGS+=(--model \"$VISUAL_RECAP_MODEL\"); fi\\n          # Validate reasoning against the enum before embedding it in the TOML override.\\n          case \"${VISUAL_RECAP_REASONING:-}\" in\\n            none|minimal|low|medium|high|xhigh)\\n              CODEX_ARGS+=(-c \"model_reasoning_effort=\\\\\"$VISUAL_RECAP_REASONING\\\\\"\") ;;\\n            \"\") ;;\\n            *) echo \"Ignoring invalid VISUAL_RECAP_REASONING: $VISUAL_RECAP_REASONING\" ;;\\n          esac\\n          rm -f recap-url.txt codex-events.jsonl codex-stderr.log\\n          run_codex() {\\n            set +e\\n            npx -y @openai/codex@0 \"${CODEX_ARGS[@]}\" --json \"$(cat recap-prompt.md)\" 2> codex-stderr.log | tee codex-events.jsonl\\n            CODEX_STATUS=\"${PIPESTATUS[0]}\"\\n            set -e\\n            echo \"$CODEX_STATUS\" > codex-exit-code.txt\\n          }\\n          run_codex\\n          if [ ! -s recap-url.txt ] && grep -Eiq \\'schedule(d)? (a )?(wakeup|retry)|will retry|backoff|connector.*register|mcp.*(register|unreachable|not usable|zero tools|not callable)\\' codex-events.jsonl codex-stderr.log 2>/dev/null; then\\n            echo \"Plan MCP registration appears delayed; retrying Codex once after 20s.\"\\n            sleep 20\\n            run_codex\\n          fi\\n\\n      - name: Read plan URL\\n        id: url\\n        if: steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        run: |\\n          set -uo pipefail\\n          PLAN_URL=\"\"\\n          URL_REASON=\"\"\\n          if [ -f recap-url.txt ]; then\\n            PLAN_URL=\"$(tr -d \\'\\\\r\\\\n\\' < recap-url.txt | tr -d \\' \\')\"\\n          else\\n            URL_REASON=\"recap-url.txt was not created by the agent\"\\n          fi\\n          # recap-url.txt is agent-written -> untrusted. Rebuild a canonical\\n          # recap URL from the trusted app base and a strictly validated plan id,\\n          # preserving path-prefixed self-hosted mounts.\\n          if [ -z \"$URL_REASON\" ]; then\\n            URL_RESULT=$(PLAN_URL=\"$PLAN_URL\" node <<\\'NODE\\'\\n          const emit = (value) => process.stdout.write(JSON.stringify(value));\\n          try {\\n            const raw = process.env.PLAN_URL || \"\";\\n            if (!raw) {\\n              emit({ url: \"\", reason: \"recap-url.txt was empty\" });\\n              process.exit(0);\\n            }\\n            const trusted = new URL(process.env.PLAN_RECAP_APP_URL || \"https://plan.agent-native.com\");\\n            const parsed = /^https?:\\\\/\\\\//i.test(raw)\\n              ? new URL(raw)\\n              : new URL(raw, trusted);\\n            if (parsed.origin !== trusted.origin) {\\n              emit({ url: \"\", reason: `recap-url.txt points at ${parsed.origin}, expected ${trusted.origin}` });\\n              process.exit(0);\\n            }\\n\\n            const base = trusted.pathname.replace(/\\\\/$/, \"\");\\n            const paths = [parsed.pathname];\\n            if (base && parsed.pathname.startsWith(`${base}/`)) {\\n              paths.push(parsed.pathname.slice(base.length) || \"/\");\\n            }\\n\\n            for (const path of paths) {\\n              const match = path.match(/^\\\\/(?:plans|recaps)\\\\/([A-Za-z0-9_-]+)\\\\/?$/);\\n              if (match) {\\n                emit({ url: `${trusted.origin}${base}/recaps/${match[1]}`, reason: \"\" });\\n                process.exit(0);\\n              }\\n            }\\n            emit({ url: \"\", reason: \"recap-url.txt did not contain a valid /plans/<id> or /recaps/<id> URL for the configured plan app\" });\\n          } catch {\\n            emit({ url: \"\", reason: \"recap-url.txt was not a valid URL or recap path\" });\\n          }\\n          NODE\\n            )\\n            CANONICAL_URL=$(node -e \\'try{process.stdout.write(JSON.parse(process.argv[1]).url||\"\")}catch{process.stdout.write(\"\")}\\' \"$URL_RESULT\")\\n            URL_REASON=$(node -e \\'try{process.stdout.write(JSON.parse(process.argv[1]).reason||\"\")}catch{process.stdout.write(\"recap-url.txt URL validation failed\")}\\' \"$URL_RESULT\")\\n          else\\n            CANONICAL_URL=\"\"\\n          fi\\n          if [ -n \"$CANONICAL_URL\" ]; then\\n            echo \"plan_url=$CANONICAL_URL\" >> \"$GITHUB_OUTPUT\"; echo \"ok=true\" >> \"$GITHUB_OUTPUT\"\\n          else\\n            echo \"plan_url=\" >> \"$GITHUB_OUTPUT\"; echo \"ok=false\" >> \"$GITHUB_OUTPUT\"\\n          fi\\n          {\\n            echo \\'reason<<__RECAP_URL_REASON_EOF__\\'\\n            echo \"$URL_REASON\"\\n            echo \\'__RECAP_URL_REASON_EOF__\\'\\n          } >> \"$GITHUB_OUTPUT\"\\n\\n      - name: Summarize agent failure\\n        id: agent_summary\\n        if: steps.url.outputs.ok != \\'true\\' && steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        continue-on-error: true\\n        env:\\n          RECAP_AGENT: ${{ needs.gate.outputs.agent }}\\n          RECAP_MCP_SMOKE_OK: ${{ steps.mcp_smoke.outputs.ok }}\\n          RECAP_MCP_SMOKE_SUMMARY: ${{ steps.mcp_smoke.outputs.summary }}\\n        run: |\\n          set -uo pipefail\\n          if [ -n \"${RECAP_MCP_SMOKE_SUMMARY:-}\" ] && [ \"${RECAP_MCP_SMOKE_OK:-}\" != \"true\" ]; then\\n            {\\n              echo \\'summary<<__RECAP_MCP_SMOKE_SUMMARY_EOF__\\'\\n              echo \"$RECAP_MCP_SMOKE_SUMMARY\"\\n              echo \\'__RECAP_MCP_SMOKE_SUMMARY_EOF__\\'\\n            } >> \"$GITHUB_OUTPUT\"\\n            node -e \\'process.stdout.write(JSON.stringify({ ok: true, summary: process.env.RECAP_MCP_SMOKE_SUMMARY || \"\" }) + \"\\\\n\")\\'\\n            exit 0\\n          fi\\n          RESULT=claude-result.json\\n          STDERR=claude-stderr.log\\n          EXIT_CODE=claude-exit-code.txt\\n          if [ \"$RECAP_AGENT\" = \"codex\" ]; then\\n            RESULT=codex-events.jsonl\\n            STDERR=codex-stderr.log\\n            EXIT_CODE=codex-exit-code.txt\\n          fi\\n          $RECAP_CLI recap agent-summary --agent \"$RECAP_AGENT\" --result-file \"$RESULT\" --stderr-file \"$STDERR\" --exit-code-file \"$EXIT_CODE\" || true\\n\\n      - name: Attach usage\\n        if: steps.url.outputs.ok == \\'true\\'\\n        continue-on-error: true\\n        env:\\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\\n          # Use the gate-normalized agent so \"Codex\" still selects the right file.\\n          RECAP_AGENT: ${{ needs.gate.outputs.agent }}\\n        run: |\\n          set -uo pipefail\\n          RESULT=claude-result.json\\n          if [ \"$RECAP_AGENT\" = \"codex\" ]; then RESULT=codex-events.jsonl; fi\\n          if [ -f \"$RESULT\" ]; then $RECAP_CLI recap usage --plan-url \"$PLAN_URL\" --agent \"$RECAP_AGENT\" --result-file \"$RESULT\" --model \"${VISUAL_RECAP_MODEL:-}\" --app-url \"$PLAN_RECAP_APP_URL\" --token \"$PLAN_RECAP_TOKEN\" || true; fi\\n\\n      - name: Cache Playwright browsers\\n        if: steps.url.outputs.ok == \\'true\\'\\n        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3\\n        with:\\n          path: ~/.cache/ms-playwright\\n          key: playwright-1-${{ runner.os }}\\n\\n      - name: Screenshot + upload\\n        id: shot\\n        if: steps.url.outputs.ok == \\'true\\'\\n        continue-on-error: true\\n        env:\\n          # recap-url.txt is untrusted agent output; pass via env, never ${{ }}.\\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\\n        run: |\\n          set -uo pipefail\\n          pnpm exec playwright install --with-deps chromium 2>/dev/null || npx -y playwright@1 install --with-deps chromium || true\\n          LIGHT_SHOT_JSON=\"$($RECAP_CLI recap shot --url \"$PLAN_URL\" --token \"$PLAN_RECAP_TOKEN\" --app-url \"$PLAN_RECAP_APP_URL\" --out recap.png --theme light || echo \\'{}\\')\"\\n          DARK_SHOT_JSON=\"$($RECAP_CLI recap shot --url \"$PLAN_URL\" --token \"$PLAN_RECAP_TOKEN\" --app-url \"$PLAN_RECAP_APP_URL\" --out recap-dark.png --theme dark || echo \\'{}\\')\"\\n          IMAGE_URL=$(node -e \\'try{process.stdout.write(JSON.parse(process.argv[1]).imageUrl||\"\")}catch{process.stdout.write(\"\")}\\' \"$LIGHT_SHOT_JSON\")\\n          DARK_IMAGE_URL=$(node -e \\'try{process.stdout.write(JSON.parse(process.argv[1]).imageUrl||\"\")}catch{process.stdout.write(\"\")}\\' \"$DARK_SHOT_JSON\")\\n          echo \"image_url=$IMAGE_URL\" >> \"$GITHUB_OUTPUT\"\\n          echo \"light_image_url=$IMAGE_URL\" >> \"$GITHUB_OUTPUT\"\\n          echo \"dark_image_url=$DARK_IMAGE_URL\" >> \"$GITHUB_OUTPUT\"\\n          if [ -f recap.png ] || [ -f recap-dark.png ]; then echo \"captured=true\" >> \"$GITHUB_OUTPUT\"; else echo \"captured=false\" >> \"$GITHUB_OUTPUT\"; fi\\n\\n      - name: Upload recap screenshot artifact\\n        if: steps.shot.outputs.captured == \\'true\\'\\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\\n        with:\\n          name: pr-visual-recap-${{ github.event.pull_request.number }}\\n          path: |\\n            recap.png\\n            recap-dark.png\\n          if-no-files-found: ignore\\n          retention-days: 14\\n\\n      - name: Upsert sticky comment\\n        if: always()\\n        continue-on-error: true\\n        env:\\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\\n          RECAP_IMAGE_URL: ${{ steps.shot.outputs.image_url }}\\n          RECAP_LIGHT_IMAGE_URL: ${{ steps.shot.outputs.light_image_url }}\\n          RECAP_DARK_IMAGE_URL: ${{ steps.shot.outputs.dark_image_url }}\\n          SUPPRESSED: ${{ steps.scan.outputs.suppressed }}\\n          SUPPRESSED_JSON: ${{ steps.scan.outputs.json }}\\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\\n          DIFF_TINY: ${{ steps.diff.outputs.tiny }}\\n          PREV_PLAN_ID: ${{ steps.prev.outputs.plan_id }}\\n          RECAP_AUTH_FAILED: ${{ steps.auth_probe.outputs.auth_failed }}\\n          RECAP_AGENT_SUMMARY: ${{ steps.agent_summary.outputs.summary }}\\n          RECAP_URL_REASON: ${{ steps.url.outputs.reason }}\\n        run: |\\n          set -euo pipefail\\n          ARGS=(recap comment upsert --repo \"$GITHUB_REPOSITORY\" --issue \"$PR_NUMBER\" --token \"$GH_TOKEN\")\\n          # On a tiny diff, only REFRESH an existing comment, never create one.\\n          if [ \"${DIFF_TINY:-}\" = \"true\" ]; then ARGS+=(--update-only); fi\\n          $RECAP_CLI \"${ARGS[@]}\"\\n\\n      - name: Complete visual recap check\\n        if: always() && steps.recap_check.outputs.check_run_id != \\'\\'\\n        continue-on-error: true\\n        env:\\n          # Untrusted/step values via env (NOT ${{ }}-interpolated into the run\\n          # body): the agent-written plan URL and the scan JSON could inject shell.\\n          CHECK_RUN_ID: ${{ steps.recap_check.outputs.check_run_id }}\\n          PLAN_OK: ${{ steps.url.outputs.ok }}\\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\\n          SUPPRESSED: ${{ steps.scan.outputs.suppressed }}\\n          SUPPRESSED_JSON: ${{ steps.scan.outputs.json }}\\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\\n          DIFF_TINY: ${{ steps.diff.outputs.tiny }}\\n          RECAP_AGENT_SUMMARY: ${{ steps.agent_summary.outputs.summary }}\\n          RECAP_URL_REASON: ${{ steps.url.outputs.reason }}\\n        run: |\\n          set -uo pipefail\\n          $RECAP_CLI recap check complete \\\\\\n            --check-run-id \"$CHECK_RUN_ID\" \\\\\\n            --plan-ok \"$PLAN_OK\" \\\\\\n            --plan-url \"$PLAN_URL\" \\\\\\n            --suppressed \"$SUPPRESSED\" \\\\\\n            --suppressed-json \"$SUPPRESSED_JSON\" \\\\\\n            --huge \"$DIFF_HUGE\" \\\\\\n            --tiny \"$DIFF_TINY\" \\\\\\n            --failure-summary \"$RECAP_AGENT_SUMMARY\" \\\\\\n            --url-reason \"$RECAP_URL_REASON\" \\\\\\n            --workflow-url \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID\"\\n';\n"]}

package/dist/cli/recap.d.ts

@@ -16,6 +16,8 @@
  *                 huge/tiny flags.
  *   mcp-config    Write the plan MCP client config for the chosen backend
  *                 (Claude Code JSON or Codex config.toml).
+ *   mcp-smoke     Verify the configured Plan MCP endpoint exposes the publish
+ *                 tools before spending runner time on Claude/Codex.
  *   scan          Refuse to hand a secret-leaking diff to the agent.
  *   build-prompt  Assemble the agent prompt = latest visual-recap skill bundle
  *                 + a task wrapper (or repo-pinned skill with --skill-source).
@@ -84,6 +86,7 @@ export declare function writePrVisualRecapReusableCallerWorkflow(baseDir: string
 }): WriteWorkflowResult;
 type RecapAgentValue = "claude" | "codex";
 export type RecapAgent = "claude" | "codex";
+export declare const RECAP_MCP_REQUIRED_TOOLS: readonly ["get-plan-blocks", "create-visual-recap", "set-resource-visibility"];
 export declare function normalizeRecapAgent(value: string | undefined): RecapAgent;
 export declare function recapRequiredSecrets(agent: RecapAgent): string[];
 export interface RecapSetupPlan {
@@ -193,6 +196,40 @@ export declare function buildRecapClaudeMcpConfig(appUrl: string, token: string
  * it can be unit-tested.
  */
 export declare function buildRecapCodexMcpConfig(appUrl: string): string;
+type RecapMcpSmokeOk = {
+    ok: true;
+    appUrl: string;
+    mcpUrl: string;
+    toolCount: number;
+    tools: string[];
+    requiredTools: string[];
+    summary: string;
+};
+type RecapMcpSmokeFailure = {
+    ok: false;
+    appUrl: string;
+    mcpUrl: string;
+    toolCount: number;
+    tools: string[];
+    requiredTools: string[];
+    reason: string;
+    summary: string;
+};
+export type RecapMcpSmokeResult = RecapMcpSmokeOk | RecapMcpSmokeFailure;
+/**
+ * Non-mutating live contract check for PR Visual Recap publishing.
+ *
+ * The previous workflow discovered a broken Plan MCP catalog only after the
+ * agent tried to publish and failed to create `recap-url.txt`. This probes the
+ * same authenticated MCP endpoint first and requires the three tools that the
+ * visual-recap skill needs to publish a hosted recap.
+ */
+export declare function smokeRecapMcpTools(input: {
+    appUrl?: string;
+    token?: string;
+    requiredTools?: readonly string[];
+    fetchFn?: typeof fetch;
+}): Promise<RecapMcpSmokeResult>;
 /**
  * Locate the repo's visual-recap SKILL.md, preferring the host-agent install
  * locations so a user's `agent-native skills add` copy wins, then falling back

package/dist/cli/recap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recap.d.ts","sourceRoot":"","sources":["../../src/cli/recap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAsDH,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,EAAE,MAAM,EASzC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,+DAA+D;AAC/D,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAChC,mBAAmB,CAsBrB;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CACX,GACL,MAAM,CAuCR;AAKD,4EAA4E;AAC5E,wBAAgB,wCAAwC,CACtD,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IACP,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CACX,GACL,mBAAmB,CA2BrB;AAID,KAAK,eAAe,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE1C,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAC;AAK5C,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,CAOzE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE,CAKhE;AAuJD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAClD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,cAAc,CAsCjB;AAyPD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,MAAM,GACpB,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CA0BxB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,GAChC,OAAO,CAST;AAED,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAM,GACrC,OAAO,CAcT;AAUD,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,MAAgC,GACzC,MAAM,CAyBR;AA2CD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GACjB,MAAM,CA8DR;AASD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CAoBT;AAoCD,wBAAgB,0BAA0B,CACxC,KAAK,GAAE;IACL,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CACX,GACL,MAAM,CAqBR;AAMD,8DAA8D;AAC9D,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C,oEAAoE;AACpE,eAAO,MAAM,2BAA2B,wDACe,CAAC;AAyBxD;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAKnC;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA2CxD;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAU/D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOvD;AA4HD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,CAeR;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAU/D;AAmGD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAsB,GAAG;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAgBA;AAED,KAAK,oBAAoB,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAkEvD,wBAAgB,0BAA0B,CACxC,GAAG,GAAE,MAAsB,EAC3B,IAAI,GAAE,oBAA6B,GAClC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAKlC;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;gFAC4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CA4HT;AAcD,KAAK,oBAAoB,GAAG,OAAO,GAAG,MAAM,CAAC;AAE7C,KAAK,aAAa,GAAG;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CACxC,CAAC;AAiCF,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAoBhC;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qDAAqD;IACrD,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC,CAuCD;AAoCD,qEAAqE;AACrE,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CA2H7E;AAoFD;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,GAAG,OAAO,CAAC,OAAO,CAAC,CA0BnB;AAED,iFAAiF;AACjF,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,uBAAuB,CAAC;CACzC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA+CzB;AAYD,KAAK,gBAAgB,GAAG;IAAE,QAAQ,EAAE,OAAO,YAAY,EAAE,WAAW,CAAA;CAAE,CAAC;AAwBvE,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,oBAAoB,CAAA;CAAO,GAC7C,MAAM,CAcR;AAED,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;AACtC,kEAAkE;AAClE,gBAAgB,GAAE,MAAM,OAAO,CAAC,gBAAgB,CAA2B,GAC1E,OAAO,CAAC,IAAI,CAAC,CAiNf;AA0ED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9D,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CAC/D;AAED,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,EAAE,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAChC,wCAAwC;IACxC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,gCAAgC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,iCAAiC;IACjC,YAAY,EAAE,OAAO,CAAC;IACtB,8BAA8B;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,uDAAuD;IACvD,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,kEAAkE;IAClE,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAYvD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG;IACxD,GAAG,EAAE,OAAO,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAsEA;AAgLD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAG3E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,MAAM,CAQR;AAOD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAiBxE;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,GAAE;IACL,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACZ,GACL,MAAM,CA0BR;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAUT;AAED,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC,gFAAgF;IAChF,MAAM,EAAE,OAAO,CAAC;IAChB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,IAAI,EAAE,OAAO,CAAC;IACd,iEAAiE;IACjE,IAAI,EAAE,OAAO,CAAC;IACd,6EAA6E;IAC7E,UAAU,EAAE,OAAO,CAAC;IACpB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,kEAAkE;AAClE,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,sBAAsB,GAC5B,iBAAiB,CAqDnB;AAgLD,UAAU,WAAW;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAwBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAmBnE;AA2BD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAajE;AAgLD,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkD5D"}
+{"version":3,"file":"recap.d.ts","sourceRoot":"","sources":["../../src/cli/recap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAsDH,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,EAAE,MAAM,EASzC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,+DAA+D;AAC/D,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAChC,mBAAmB,CAsBrB;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CACX,GACL,MAAM,CAuCR;AAKD,4EAA4E;AAC5E,wBAAgB,wCAAwC,CACtD,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IACP,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CACX,GACL,mBAAmB,CA2BrB;AAID,KAAK,eAAe,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE1C,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAC;AAI5C,eAAO,MAAM,wBAAwB,gFAI3B,CAAC;AAEX,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,CAOzE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE,CAKhE;AAuJD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAClD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,cAAc,CAsCjB;AAyPD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,MAAM,GACpB,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CA0BxB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,GAChC,OAAO,CAST;AAED,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAM,GACrC,OAAO,CAcT;AAUD,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,MAAgC,GACzC,MAAM,CAyBR;AA2CD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GACjB,MAAM,CA8DR;AASD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CAoBT;AAoCD,wBAAgB,0BAA0B,CACxC,KAAK,GAAE;IACL,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CACX,GACL,MAAM,CAqBR;AAMD,8DAA8D;AAC9D,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C,oEAAoE;AACpE,eAAO,MAAM,2BAA2B,wDACe,CAAC;AAyBxD;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAKnC;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA2CxD;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAU/D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOvD;AA4HD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,CAeR;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAU/D;AAED,KAAK,eAAe,GAAG;IACrB,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,KAAK,oBAAoB,GAAG;IAC1B,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,eAAe,GAAG,oBAAoB,CAAC;AA2JzE;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAyF/B;AAkHD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAsB,GAAG;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAgBA;AAED,KAAK,oBAAoB,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAkEvD,wBAAgB,0BAA0B,CACxC,GAAG,GAAE,MAAsB,EAC3B,IAAI,GAAE,oBAA6B,GAClC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAKlC;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;gFAC4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CA4HT;AAcD,KAAK,oBAAoB,GAAG,OAAO,GAAG,MAAM,CAAC;AAE7C,KAAK,aAAa,GAAG;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CACxC,CAAC;AAiCF,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAoBhC;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qDAAqD;IACrD,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC,CAuCD;AAoCD,qEAAqE;AACrE,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CA2H7E;AAoFD;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,GAAG,OAAO,CAAC,OAAO,CAAC,CA0BnB;AAED,iFAAiF;AACjF,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,uBAAuB,CAAC;CACzC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA+CzB;AAYD,KAAK,gBAAgB,GAAG;IAAE,QAAQ,EAAE,OAAO,YAAY,EAAE,WAAW,CAAA;CAAE,CAAC;AAwBvE,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,oBAAoB,CAAA;CAAO,GAC7C,MAAM,CAcR;AAED,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;AACtC,kEAAkE;AAClE,gBAAgB,GAAE,MAAM,OAAO,CAAC,gBAAgB,CAA2B,GAC1E,OAAO,CAAC,IAAI,CAAC,CAiNf;AA0ED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9D,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CAC/D;AAED,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,EAAE,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAChC,wCAAwC;IACxC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,gCAAgC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,iCAAiC;IACjC,YAAY,EAAE,OAAO,CAAC;IACtB,8BAA8B;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,uDAAuD;IACvD,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,kEAAkE;IAClE,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAYvD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG;IACxD,GAAG,EAAE,OAAO,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAsEA;AAgLD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAG3E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,MAAM,CAQR;AAOD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAiBxE;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,GAAE;IACL,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACZ,GACL,MAAM,CA0BR;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAUT;AAED,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC,gFAAgF;IAChF,MAAM,EAAE,OAAO,CAAC;IAChB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,IAAI,EAAE,OAAO,CAAC;IACd,iEAAiE;IACjE,IAAI,EAAE,OAAO,CAAC;IACd,6EAA6E;IAC7E,UAAU,EAAE,OAAO,CAAC;IACpB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,kEAAkE;AAClE,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,sBAAsB,GAC5B,iBAAiB,CAqDnB;AAgLD,UAAU,WAAW;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAwBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAmBnE;AA2BD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAajE;AAsLD,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAqD5D"}