@agent-native/core 0.58.2 → 0.58.4

package/dist/cli/pr-visual-recap-workflow.js.map

@@ -1 +1 @@
-{"version":3,"file":"pr-visual-recap-workflow.js","sourceRoot":"","sources":["../../src/cli/pr-visual-recap-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GACvC,m2sCAAm2sC,CAAC","sourcesContent":["/**\n * Bundled copy of .github/workflows/pr-visual-recap.yml used by\n * `agent-native recap setup`. Keep byte-identical to the source workflow.\n *\n * This file is generated from the workflow source; tests assert the exported\n * string stays in sync.\n */\n\nexport const PR_VISUAL_RECAP_WORKFLOW_YML =\n  'name: PR Visual Recap\\n\\n# Visual code review: a coding agent runs the repo\\'s visual-recap skill over the\\n# PR diff, publishes a plan, and upserts one sticky comment with a screenshot.\\n# Plain `pull_request` (NOT `pull_request_target`) so fork code never sees secrets.\\n\\non:\\n  pull_request:\\n    types: [opened, synchronize, reopened, ready_for_review]\\n\\npermissions:\\n  contents: read\\n\\nconcurrency:\\n  group: pr-visual-recap-${{ github.event.pull_request.number }}\\n  cancel-in-progress: true\\n\\nenv:\\n  VISUAL_RECAP_AGENT: ${{ vars.VISUAL_RECAP_AGENT || \\'claude\\' }}\\n  VISUAL_RECAP_SKILL_SOURCE: ${{ vars.VISUAL_RECAP_SKILL_SOURCE || \\'auto\\' }}\\n  VISUAL_RECAP_SECRET_SCAN: ${{ vars.VISUAL_RECAP_SECRET_SCAN || \\'high-confidence\\' }}\\n\\njobs:\\n  gate:\\n    name: Gate\\n    runs-on: ubuntu-latest\\n    timeout-minutes: 10\\n    permissions:\\n      contents: read\\n      issues: write\\n      pull-requests: write\\n    outputs:\\n      run: ${{ steps.decide.outputs.run }}\\n      agent: ${{ steps.decide.outputs.agent }}\\n    steps:\\n      - id: decide\\n        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\\n        env:\\n          # Presence-only signals — never expose secret VALUES to the gate.\\n          HAS_PLAN: ${{ secrets.PLAN_RECAP_TOKEN != \\'\\' }}\\n          HAS_ANTHROPIC: ${{ secrets.ANTHROPIC_API_KEY != \\'\\' }}\\n          HAS_OPENAI: ${{ secrets.OPENAI_API_KEY != \\'\\' }}\\n          AGENT: ${{ env.VISUAL_RECAP_AGENT }}\\n          VISUAL_RECAP_MODEL: ${{ vars.VISUAL_RECAP_MODEL }}\\n          VISUAL_RECAP_SKILL_SOURCE: ${{ env.VISUAL_RECAP_SKILL_SOURCE }}\\n          HEAD_SHA: ${{ github.event.pull_request.head.sha }}\\n        with:\\n          script: |\\n            const pr = context.payload.pull_request;\\n            const reasons = [];\\n\\n            if (!pr) reasons.push(\\'no pull_request payload\\');\\n            if (pr && pr.draft) reasons.push(\\'draft PR\\');\\n\\n            // Fork PRs only receive repo secrets when the org/repo opts into\\n            // GitHub\\'s \"Send secrets to workflows from pull requests\" setting\\n            // (common in private orgs that use forks heavily). Gate on secret\\n            // availability, not fork-ness: run on forks that have the token,\\n            // and skip — with an actionable hint — those that don\\'t.\\n            const headRepo = pr && pr.head && pr.head.repo && pr.head.repo.full_name;\\n            const isFork = !!(pr && headRepo && headRepo !== process.env.GITHUB_REPOSITORY);\\n            const isPrivate = !!(context.payload.repository && context.payload.repository.private);\\n            if (isFork && process.env.HAS_PLAN !== \\'true\\') {\\n              reasons.push(`fork PR (${headRepo}) without secret access — enable \"Send secrets to workflows from pull requests\" (and write tokens) in the repo/org Actions settings to run recaps on forks`);\\n            }\\n\\n            const login = (pr && pr.user && pr.user.login || \\'\\').toLowerCase();\\n            const botAuthors = [\\'dependabot[bot]\\', \\'dependabot\\', \\'renovate[bot]\\', \\'renovate\\'];\\n            if (botAuthors.includes(login)) reasons.push(`bot author (${login})`);\\n            if (pr && pr.user && pr.user.type === \\'Bot\\') reasons.push(\\'bot author (type=Bot)\\');\\n\\n            if (!isFork && process.env.HAS_PLAN !== \\'true\\') reasons.push(\\'PLAN_RECAP_TOKEN not configured\\');\\n\\n            // Normalize + validate the agent so a mis-cased value can\\'t pass the\\n            // gate and then match neither agent step below.\\n            const agent = (process.env.AGENT || \\'claude\\').toLowerCase();\\n            if (agent !== \\'claude\\' && agent !== \\'codex\\') {\\n              reasons.push(`unsupported VISUAL_RECAP_AGENT \"${process.env.AGENT}\" (expected \"claude\" or \"codex\")`);\\n            } else if (agent === \\'codex\\') {\\n              if (process.env.HAS_OPENAI !== \\'true\\') reasons.push(\\'OPENAI_API_KEY not configured (codex backend)\\');\\n            } else {\\n              if (process.env.HAS_ANTHROPIC !== \\'true\\') reasons.push(\\'ANTHROPIC_API_KEY not configured (claude backend)\\');\\n            }\\n\\n            // Validate the model before it reaches the agent CLI.\\n            const model = process.env.VISUAL_RECAP_MODEL || \\'\\';\\n            if (model && !/^[a-zA-Z0-9._-]{1,80}$/.test(model)) {\\n              reasons.push(`invalid VISUAL_RECAP_MODEL value (must match [a-zA-Z0-9._-]{1,80})`);\\n            }\\n\\n            const skillSource = (process.env.VISUAL_RECAP_SKILL_SOURCE || \\'auto\\').toLowerCase();\\n            if (![\\'auto\\', \\'latest\\', \\'repo\\'].includes(skillSource)) {\\n              reasons.push(\\'invalid VISUAL_RECAP_SKILL_SOURCE value (expected \"auto\", \"latest\", or \"repo\")\\');\\n            }\\n            const usesRepoSkill = skillSource === \\'repo\\';\\n\\n            // Self-modifying guard, evaluated in the trusted gate (runs NO\\n            // PR-checked-out code): skip the ENTIRE job if the PR touches the\\n            // repo-pinned skill instructions or any agent config the runner\\n            // loads, so a PR can\\'t rewrite what the agent loads and exfiltrate\\n            // secrets. With the default bundled skill source, visual skill and\\n            // recap workflow files are reviewed content, not instructions loaded\\n            // by the runner.\\n            // Keep this guard for forks AND all public-repo PRs: a fork or a\\n            // public same-repo author could rewrite loaded instruction files\\n            // (AGENTS.md/CLAUDE.md/.claude/.mcp.json) and exfiltrate the\\n            // secret-backed agent run. Skip it ONLY for private-repo same-repo\\n            // PRs, where the author is a trusted org member — a deliberate owner\\n            // risk acceptance so legit instruction edits don\\'t false-skip recaps.\\n            if (pr && (isFork || !isPrivate)) {\\n              try {\\n                const files = await github.paginate(github.rest.pulls.listFiles, {\\n                  owner: context.repo.owner,\\n                  repo: context.repo.repo,\\n                  pull_number: pr.number,\\n                  per_page: 100,\\n                });\\n                const isSensitive = (p) =>\\n                  (usesRepoSkill && /(^|\\\\/)skills\\\\/visual-(recap|plan|plans)\\\\//.test(p)) ||\\n                  /(^|\\\\/)\\\\.claude\\\\//.test(p) ||\\n                  /(^|\\\\/)CLAUDE\\\\.md$/.test(p) ||\\n                  /(^|\\\\/)AGENTS\\\\.md$/.test(p) ||\\n                  /(^|\\\\/)\\\\.mcp\\\\.json$/.test(p);\\n                const hits = files.map((f) => f.filename).filter(isSensitive);\\n                if (hits.length) {\\n                  reasons.push(`PR modifies recap-control files (${hits.slice(0, 3).join(\\', \\')}${hits.length > 3 ? \\', …\\' : \\'\\'}) — skipping so untrusted PR code never runs with secrets`);\\n                }\\n              } catch (e) {\\n                // Fail closed: if the file list can\\'t be read, skip.\\n                reasons.push(`could not list PR files for the self-modifying guard (${e.message}); skipping to be safe`);\\n              }\\n            }\\n\\n            const run = reasons.length === 0;\\n            core.setOutput(\\'run\\', run ? \\'true\\' : \\'false\\');\\n            core.setOutput(\\'agent\\', agent);\\n            if (run) {\\n              core.info(`Visual recap will run (${agent}).`);\\n            } else {\\n              // Surface the skip reason as a run-summary annotation, not just a\\n              // buried info log, so it\\'s clear in the Actions UI why we skipped.\\n              core.notice(`Visual recap skipped: ${reasons.join(\\'; \\')}`);\\n            }\\n\\n            // When skipping, upsert a sticky recap comment with a short skip\\n            // line so the PR always explains why the recap job did not run.\\n            if (!run && pr) {\\n              try {\\n                const MARKER = \\'<!-- pr-visual-recap -->\\';\\n                const { data: comments } = await github.rest.issues.listComments({\\n                  owner: context.repo.owner,\\n                  repo: context.repo.repo,\\n                  issue_number: pr.number,\\n                  per_page: 100,\\n                });\\n                const existing = comments.find(\\n                  (c) => c.user && c.user.type === \\'Bot\\' && c.body && c.body.includes(MARKER)\\n                );\\n                const headShort = (process.env.HEAD_SHA || \\'\\').slice(0, 7);\\n                const shaRef = headShort ? `\\\\`${headShort}\\\\`` : \\'latest push\\';\\n                const primaryReason = reasons.filter(\\n                  (r) => !r.startsWith(\\'could not list PR files for the self-modifying guard\\')\\n                )[0] || reasons[0] || \\'skipped\\';\\n                const skipLine = `_Recap skipped for ${shaRef}: ${primaryReason}._`;\\n                const baseBody = `${MARKER}\\\\n### Visual recap — skipped\\\\n\\\\nThe visual recap job did not run for this pull request. This is informational only and does **not** block the PR.`;\\n                const withoutPrev = (existing && existing.body ? existing.body : baseBody)\\n                  .split(\\'\\\\n\\')\\n                  .filter((l) => !/_Recap skipped for .+_$/.test(l.trim()))\\n                  .join(\\'\\\\n\\')\\n                  .trimEnd();\\n                const updatedBody = `${withoutPrev}\\\\n\\\\n${skipLine}`;\\n                if (existing) {\\n                  await github.rest.issues.updateComment({\\n                    owner: context.repo.owner,\\n                    repo: context.repo.repo,\\n                    comment_id: existing.id,\\n                    body: updatedBody,\\n                  });\\n                } else {\\n                  await github.rest.issues.createComment({\\n                    owner: context.repo.owner,\\n                    repo: context.repo.repo,\\n                    issue_number: pr.number,\\n                    body: updatedBody,\\n                  });\\n                }\\n              } catch (e) {\\n                core.warning(`Could not update recap skip comment: ${e.message}`);\\n              }\\n            }\\n\\n  recap:\\n    name: Generate visual recap\\n    needs: gate\\n    if: needs.gate.outputs.run == \\'true\\'\\n    runs-on: ubuntu-latest\\n    timeout-minutes: 30\\n    permissions:\\n      actions: write\\n      checks: write\\n      contents: read\\n      issues: write\\n      pull-requests: write\\n    env:\\n      PLAN_RECAP_APP_URL: ${{ secrets.PLAN_RECAP_APP_URL || \\'https://plan.agent-native.com\\' }}\\n      PLAN_RECAP_TOKEN: ${{ secrets.PLAN_RECAP_TOKEN }}\\n      GH_TOKEN: ${{ github.token }}\\n      PR_NUMBER: ${{ github.event.pull_request.number }}\\n      HEAD_SHA: ${{ github.event.pull_request.head.sha }}\\n      VISUAL_RECAP_MODEL: ${{ vars.VISUAL_RECAP_MODEL }}\\n      VISUAL_RECAP_REASONING: ${{ vars.VISUAL_RECAP_REASONING }}\\n      VISUAL_RECAP_SKILL_SOURCE: ${{ vars.VISUAL_RECAP_SKILL_SOURCE || \\'auto\\' }}\\n      VISUAL_RECAP_SECRET_SCAN: ${{ vars.VISUAL_RECAP_SECRET_SCAN || \\'high-confidence\\' }}\\n    steps:\\n      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\\n        with:\\n          fetch-depth: 0\\n          # This job runs an agent over untrusted PR diff; don\\'t leave the token\\n          # in .git/config (it uses GH_TOKEN for gh API calls, never git push).\\n          persist-credentials: false\\n\\n      # Dogfood trusted base-branch source inside this monorepo, else install the\\n      # published package once. Never execute PR-head recap CLI code.\\n      - name: Resolve recap CLI\\n        id: cli\\n        env:\\n          # Optional: pin the consumer CLI version (e.g. \"1.2.3\"). Defaults to\\n          # \"latest\" when unset. Set via repository variable RECAP_CLI_VERSION.\\n          RECAP_CLI_VERSION: ${{ vars.RECAP_CLI_VERSION || \\'latest\\' }}\\n        run: |\\n          if [ \"$GITHUB_REPOSITORY\" = \"BuilderIO/agent-native\" ] && [ -f packages/core/src/cli/index.ts ]; then\\n            echo \"local=true\" >> \"$GITHUB_OUTPUT\"\\n          else\\n            echo \"local=false\" >> \"$GITHUB_OUTPUT\"\\n          fi\\n\\n      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\\n        if: steps.cli.outputs.local == \\'true\\'\\n        with:\\n          ref: ${{ github.event.pull_request.base.sha }}\\n          path: .recap-cli-source\\n          fetch-depth: 1\\n          persist-credentials: false\\n\\n      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8\\n        if: steps.cli.outputs.local == \\'true\\'\\n\\n      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\\n        with:\\n          node-version: \"22\"\\n          cache: ${{ steps.cli.outputs.local == \\'true\\' && \\'pnpm\\' || \\'\\' }}\\n\\n      - name: Install trusted workspace recap CLI\\n        if: steps.cli.outputs.local == \\'true\\'\\n        working-directory: .recap-cli-source\\n        run: |\\n          set -euo pipefail\\n          pnpm install --frozen-lockfile --ignore-scripts\\n          echo \"RECAP_CLI=$PWD/node_modules/.bin/tsx $PWD/packages/core/src/cli/index.ts\" >> \"$GITHUB_ENV\"\\n          echo \"RECAP_PLAYWRIGHT=$PWD/node_modules/.bin/playwright\" >> \"$GITHUB_ENV\"\\n\\n      - name: Install published recap CLI\\n        if: steps.cli.outputs.local != \\'true\\'\\n        env:\\n          RECAP_CLI_VERSION: ${{ vars.RECAP_CLI_VERSION || \\'latest\\' }}\\n        run: |\\n          set -euo pipefail\\n          VERSION=\"$RECAP_CLI_VERSION\"\\n          if [ \"$VERSION\" = \"latest\" ]; then\\n            VERSION=\"$(npm view @agent-native/core@latest version)\"\\n          fi\\n          for attempt in 1 2 3; do\\n            if npm install --prefix \"$RUNNER_TEMP/recap-cli\" --no-audit --no-fund \"@agent-native/core@$VERSION\"; then\\n              break\\n            fi\\n            if [ \"$attempt\" = \"3\" ]; then exit 1; fi\\n            sleep $((attempt * 10))\\n          done\\n          echo \"RECAP_CLI=$RUNNER_TEMP/recap-cli/node_modules/.bin/agent-native\" >> \"$GITHUB_ENV\"\\n          echo \"RECAP_PLAYWRIGHT=$RUNNER_TEMP/recap-cli/node_modules/.bin/playwright\" >> \"$GITHUB_ENV\"\\n\\n      - name: Start visual recap check\\n        id: recap_check\\n        continue-on-error: true\\n        run: |\\n          set -uo pipefail\\n          $RECAP_CLI recap check start --sha \"$HEAD_SHA\" --workflow-url \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID\"\\n\\n      - name: Collect bounded diff\\n        id: diff\\n        env:\\n          BASE_SHA: ${{ github.event.pull_request.base.sha }}\\n        run: |\\n          set -euo pipefail\\n          $RECAP_CLI recap collect-diff --base \"$BASE_SHA\" --head \"$HEAD_SHA\" --out recap.diff --stat recap.stat\\n\\n      - name: Probe plan-app auth\\n        id: auth_probe\\n        if: steps.diff.outputs.tiny != \\'true\\'\\n        continue-on-error: true\\n        run: |\\n          set -uo pipefail\\n          # Hit the plan app\\'s action surface with the publish token. A 401 means\\n          # the token is expired/revoked; surface it in the sticky comment so the\\n          # repo owner knows to re-mint it instead of seeing a generic failure.\\n          HTTP_STATUS=$(node -e \\'\\n            const https = require(\"https\");\\n            const url = new URL(\"/_agent-native/actions/record-recap-usage\", process.env.PLAN_RECAP_APP_URL || \"https://plan.agent-native.com\");\\n            const req = https.request(url, { method: \"POST\", headers: { \"authorization\": \"Bearer \" + process.env.PLAN_RECAP_TOKEN, \"content-type\": \"application/json\" }, timeout: 8000 }, (res) => { process.stdout.write(String(res.statusCode)); req.destroy(); });\\n            req.on(\"error\", () => process.stdout.write(\"0\"));\\n            req.end(JSON.stringify({ planId: \"__probe__\" }));\\n          \\' 2>/dev/null || echo \"0\")\\n          if [ \"$HTTP_STATUS\" = \"401\" ]; then\\n            echo \"auth_failed=true\" >> \"$GITHUB_OUTPUT\"\\n          else\\n            echo \"auth_failed=false\" >> \"$GITHUB_OUTPUT\"\\n          fi\\n\\n      - name: Probe plan-app route health\\n        id: route_health\\n        if: steps.diff.outputs.tiny != \\'true\\'\\n        continue-on-error: true\\n        run: |\\n          set -uo pipefail\\n          # Pre-publish health gate: confirm the plan app\\'s recap action routes\\n          # are actually deployed BEFORE the agent runs. A 404 from\\n          # create-visual-recap (POST) or get-plan-blocks (GET) means the\\n          # plan-app deploy has not propagated yet (the client is ahead of the\\n          # deployed server). Say that plainly here instead of letting the agent\\n          # run and then fail confusingly at publish time. A 401 or 200 is\\n          # healthy — the route exists, it just rejected/accepted the probe.\\n          probe_status() {\\n            ROUTE=\"$1\" METHOD=\"$2\" node -e \\'\\n              const https = require(\"https\");\\n              const base = process.env.PLAN_RECAP_APP_URL || \"https://plan.agent-native.com\";\\n              const url = new URL(process.env.ROUTE, base);\\n              if (process.env.METHOD === \"GET\") url.searchParams.set(\"format\", \"reference\");\\n              const req = https.request(url, { method: process.env.METHOD, headers: { \"authorization\": \"Bearer \" + (process.env.PLAN_RECAP_TOKEN || \"\"), \"content-type\": \"application/json\" }, timeout: 8000 }, (res) => { process.stdout.write(String(res.statusCode)); req.destroy(); });\\n              req.on(\"error\", () => process.stdout.write(\"0\"));\\n              req.on(\"timeout\", () => { process.stdout.write(\"0\"); req.destroy(); });\\n              if (process.env.METHOD === \"POST\") { req.end(JSON.stringify({ __probe__: true })); } else { req.end(); }\\n            \\' 2>/dev/null || echo \"0\"\\n          }\\n          CREATE_STATUS=\"$(probe_status /_agent-native/actions/create-visual-recap POST)\"\\n          BLOCKS_STATUS=\"$(probe_status /_agent-native/actions/get-plan-blocks GET)\"\\n          REASON=\"\"\\n          if [ \"$CREATE_STATUS\" = \"404\" ] || [ \"$BLOCKS_STATUS\" = \"404\" ]; then\\n            REASON=\"Plan app routes return 404 — deploy not yet propagated (create-visual-recap: $CREATE_STATUS, get-plan-blocks: $BLOCKS_STATUS). The plan-app client is ahead of the deployed server; re-run once the deploy finishes propagating.\"\\n            echo \"::error::$REASON\"\\n            echo \"unhealthy=true\" >> \"$GITHUB_OUTPUT\"\\n          else\\n            echo \"unhealthy=false\" >> \"$GITHUB_OUTPUT\"\\n          fi\\n          {\\n            echo \\'reason<<__RECAP_ROUTE_HEALTH_EOF__\\'\\n            echo \"$REASON\"\\n            echo \\'__RECAP_ROUTE_HEALTH_EOF__\\'\\n          } >> \"$GITHUB_OUTPUT\"\\n\\n      - name: Secret scan\\n        id: scan\\n        if: steps.diff.outputs.tiny != \\'true\\'\\n        run: |\\n          set -uo pipefail\\n          # Fail CLOSED: a scanner error or invalid JSON suppresses the diff so a\\n          # credential-bearing diff is never handed to the agent / plan service.\\n          if ! SCAN_JSON=\"$($RECAP_CLI recap scan --diff recap.diff --mode \"$VISUAL_RECAP_SECRET_SCAN\")\"; then\\n            SCAN_JSON=\\'{\"suppressed\":true,\"reason\":\"secret scan failed to run; failing closed\"}\\'\\n          fi\\n          {\\n            echo \\'json<<__RECAP_SCAN_EOF__\\'\\n            echo \"$SCAN_JSON\"\\n            echo \\'__RECAP_SCAN_EOF__\\'\\n          } >> \"$GITHUB_OUTPUT\"\\n          SUPPRESSED=$(node -e \\'try{process.stdout.write(JSON.parse(process.argv[1]).suppressed?\"true\":\"false\")}catch{process.stdout.write(\"true\")}\\' \"$SCAN_JSON\")\\n          echo \"suppressed=$SUPPRESSED\" >> \"$GITHUB_OUTPUT\"\\n\\n      - name: Read previous plan id\\n        id: prev\\n        continue-on-error: true\\n        run: |\\n          set -euo pipefail\\n          PLAN_ID=\"$($RECAP_CLI recap comment find-plan-id --repo \"$GITHUB_REPOSITORY\" --issue \"$PR_NUMBER\" --token \"$GH_TOKEN\")\"\\n          echo \"plan_id=$PLAN_ID\" >> \"$GITHUB_OUTPUT\"\\n\\n      - name: Fetch plan block reference\\n        id: block_reference\\n        if: steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        continue-on-error: true\\n        run: |\\n          set -uo pipefail\\n          if $RECAP_CLI recap block-reference --app-url \"$PLAN_RECAP_APP_URL\" --out recap-blocks.md; then\\n            echo \"ok=true\" >> \"$GITHUB_OUTPUT\"\\n          else\\n            echo \"ok=false\" >> \"$GITHUB_OUTPUT\"\\n            {\\n              echo \\'summary<<__RECAP_BLOCK_REFERENCE_EOF__\\'\\n              echo \"Could not fetch the live plan block reference; the agent will fall back to bundled visual-recap instructions and the publisher will validate the final MDX.\"\\n              echo \\'__RECAP_BLOCK_REFERENCE_EOF__\\'\\n            } >> \"$GITHUB_OUTPUT\"\\n            cat > recap-blocks.md <<\\'EOF\\'\\n          Live plan block reference unavailable. Follow the bundled visual-recap skill and author conservative MDX; the deterministic publisher will validate the source before posting.\\n          EOF\\n          fi\\n\\n      - name: Build recap prompt\\n        id: prompt\\n        if: steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        env:\\n          # Pass step outputs via env, NOT ${{ }} interpolation into the run body:\\n          # the prev plan id is parsed from a PR comment and could inject shell.\\n          PREV_PLAN_ID: ${{ steps.prev.outputs.plan_id }}\\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\\n          IS_FORK: ${{ github.event.pull_request.head.repo.full_name != github.repository }}\\n        run: |\\n          set -euo pipefail\\n          ARGS=(--diff recap.diff --stat recap.stat --block-reference recap-blocks.md --pr \"$PR_NUMBER\" --repo \"$GITHUB_REPOSITORY\" --head \"$HEAD_SHA\" --app-url \"$PLAN_RECAP_APP_URL\" --skill-source \"$VISUAL_RECAP_SKILL_SOURCE\" --out recap-prompt.md)\\n          if [ \"${DIFF_HUGE:-}\" = \"true\" ]; then ARGS+=(--huge); fi\\n          if [ \"${IS_FORK:-}\" = \"true\" ]; then ARGS+=(--fork-pr true); fi\\n          if [ -n \"${PREV_PLAN_ID:-}\" ]; then ARGS+=(--prev-plan-id \"$PREV_PLAN_ID\"); fi\\n          $RECAP_CLI recap build-prompt \"${ARGS[@]}\"\\n\\n      - name: Run agent (Claude Code)\\n        id: claude\\n        if: needs.gate.outputs.agent == \\'claude\\' && steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        continue-on-error: true\\n        env:\\n          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}\\n        run: |\\n          set -uo pipefail\\n          CLAUDE_ALLOWED_TOOLS=\"Read,Write,Bash(git diff:*)\"\\n          CLAUDE_ARGS=(-p \"$(cat recap-prompt.md)\" --allowedTools \"$CLAUDE_ALLOWED_TOOLS\" --permission-mode dontAsk --output-format json)\\n          if [ -n \"${VISUAL_RECAP_MODEL:-}\" ]; then CLAUDE_ARGS+=(--model \"$VISUAL_RECAP_MODEL\"); fi\\n          rm -f recap-source.json recap-url.txt recap-url-reason.txt claude-result.json claude-stderr.log\\n          run_claude() {\\n            set +e\\n            npx -y @anthropic-ai/claude-code@2 \"${CLAUDE_ARGS[@]}\" > claude-result.json 2> claude-stderr.log\\n            CLAUDE_STATUS=\"$?\"\\n            set -e\\n            echo \"$CLAUDE_STATUS\" > claude-exit-code.txt\\n          }\\n          run_claude\\n          # A clean agent exit WITHOUT recap-source.json is the strongest\\n          # \"retry me\" signal — the deterministic publisher needs that file, and\\n          # the agent occasionally finishes a turn without writing it. Retry once.\\n          if [ ! -s recap-source.json ]; then\\n            echo \"::warning::recap-source.json missing after the agent run; retrying the agent once.\"\\n            sleep 5\\n            run_claude\\n          fi\\n\\n      - name: Run agent (Codex)\\n        id: codex\\n        if: needs.gate.outputs.agent == \\'codex\\' && steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        continue-on-error: true\\n        env:\\n          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\\n        run: |\\n          set -uo pipefail\\n          # `codex login` writes ~/.codex/auth.json (the bare env var is dropped on\\n          # the gpt-5.5 wss transport); stdin keeps the key out of process args.\\n          printenv OPENAI_API_KEY | npx -y @openai/codex@0 login --with-api-key || true\\n          # The runner is itself an ephemeral sandbox; bypass Codex\\'s own sandbox\\n          # (bubblewrap can\\'t init here) and approval gate (cancels the MCP write).\\n          CODEX_ARGS=(exec --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check)\\n          if [ -n \"${VISUAL_RECAP_MODEL:-}\" ]; then CODEX_ARGS+=(--model \"$VISUAL_RECAP_MODEL\"); fi\\n          # Validate reasoning against the enum before embedding it in the TOML override.\\n          case \"${VISUAL_RECAP_REASONING:-}\" in\\n            none|minimal|low|medium|high|xhigh)\\n              CODEX_ARGS+=(-c \"model_reasoning_effort=\\\\\"$VISUAL_RECAP_REASONING\\\\\"\") ;;\\n            \"\") ;;\\n            *) echo \"Ignoring invalid VISUAL_RECAP_REASONING: $VISUAL_RECAP_REASONING\" ;;\\n          esac\\n          rm -f recap-source.json recap-url.txt recap-url-reason.txt codex-events.jsonl codex-stderr.log\\n          run_codex() {\\n            set +e\\n            npx -y @openai/codex@0 \"${CODEX_ARGS[@]}\" --json \"$(cat recap-prompt.md)\" 2> codex-stderr.log | tee codex-events.jsonl\\n            CODEX_STATUS=\"${PIPESTATUS[0]}\"\\n            set -e\\n            echo \"$CODEX_STATUS\" > codex-exit-code.txt\\n          }\\n          run_codex\\n          # Retry once if the agent exited without writing recap-source.json\\n          # (see the Claude step) — the publisher needs that file.\\n          if [ ! -s recap-source.json ]; then\\n            echo \"::warning::recap-source.json missing after the agent run; retrying the agent once.\"\\n            sleep 5\\n            run_codex\\n          fi\\n\\n      - name: Publish recap source\\n        id: publish\\n        if: steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        continue-on-error: true\\n        env:\\n          PREV_PLAN_ID: ${{ steps.prev.outputs.plan_id }}\\n        run: |\\n          set -uo pipefail\\n          ARGS=(--source recap-source.json --out recap-url.txt --repo \"$GITHUB_REPOSITORY\" --pr \"$PR_NUMBER\" --app-url \"$PLAN_RECAP_APP_URL\" --token \"$PLAN_RECAP_TOKEN\")\\n          if [ -n \"${PREV_PLAN_ID:-}\" ]; then ARGS+=(--prev-plan-id \"$PREV_PLAN_ID\"); fi\\n          $RECAP_CLI recap publish \"${ARGS[@]}\"\\n\\n      - name: Read plan URL\\n        id: url\\n        if: steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        run: |\\n          set -uo pipefail\\n          PLAN_URL=\"\"\\n          URL_REASON=\"\"\\n          if [ -f recap-url.txt ]; then\\n            PLAN_URL=\"$(tr -d \\'\\\\r\\\\n\\' < recap-url.txt | tr -d \\' \\')\"\\n          elif [ -f recap-url-reason.txt ]; then\\n            URL_REASON=\"$(cat recap-url-reason.txt)\"\\n          else\\n            URL_REASON=\"recap-url.txt was not created.\"\\n          fi\\n          # recap-url.txt is agent-written -> untrusted. Rebuild a canonical\\n          # recap URL from the trusted app base and a strictly validated plan id,\\n          # preserving path-prefixed self-hosted mounts.\\n          if [ -z \"$URL_REASON\" ]; then\\n            URL_RESULT=$(PLAN_URL=\"$PLAN_URL\" node <<\\'NODE\\'\\n          const emit = (value) => process.stdout.write(JSON.stringify(value));\\n          try {\\n            const raw = process.env.PLAN_URL || \"\";\\n            if (!raw) {\\n              emit({ url: \"\", reason: \"recap-url.txt was empty\" });\\n              process.exit(0);\\n            }\\n            const trusted = new URL(process.env.PLAN_RECAP_APP_URL || \"https://plan.agent-native.com\");\\n            const parsed = /^https?:\\\\/\\\\//i.test(raw)\\n              ? new URL(raw)\\n              : new URL(raw, trusted);\\n            if (parsed.origin !== trusted.origin) {\\n              emit({ url: \"\", reason: `recap-url.txt points at ${parsed.origin}, expected ${trusted.origin}` });\\n              process.exit(0);\\n            }\\n\\n            const base = trusted.pathname.replace(/\\\\/$/, \"\");\\n            const paths = [parsed.pathname];\\n            if (base && parsed.pathname.startsWith(`${base}/`)) {\\n              paths.push(parsed.pathname.slice(base.length) || \"/\");\\n            }\\n\\n            for (const path of paths) {\\n              const match = path.match(/^\\\\/(?:plans|recaps)\\\\/([A-Za-z0-9_-]+)\\\\/?$/);\\n              if (match) {\\n                emit({ url: `${trusted.origin}${base}/recaps/${match[1]}`, reason: \"\" });\\n                process.exit(0);\\n              }\\n            }\\n            emit({ url: \"\", reason: \"recap-url.txt did not contain a valid /plans/<id> or /recaps/<id> URL for the configured plan app\" });\\n          } catch {\\n            emit({ url: \"\", reason: \"recap-url.txt was not a valid URL or recap path\" });\\n          }\\n          NODE\\n            )\\n            CANONICAL_URL=$(node -e \\'try{process.stdout.write(JSON.parse(process.argv[1]).url||\"\")}catch{process.stdout.write(\"\")}\\' \"$URL_RESULT\")\\n            URL_REASON=$(node -e \\'try{process.stdout.write(JSON.parse(process.argv[1]).reason||\"\")}catch{process.stdout.write(\"recap-url.txt URL validation failed\")}\\' \"$URL_RESULT\")\\n          else\\n            CANONICAL_URL=\"\"\\n          fi\\n          if [ -n \"$CANONICAL_URL\" ]; then\\n            echo \"plan_url=$CANONICAL_URL\" >> \"$GITHUB_OUTPUT\"; echo \"ok=true\" >> \"$GITHUB_OUTPUT\"\\n          else\\n            echo \"plan_url=\" >> \"$GITHUB_OUTPUT\"; echo \"ok=false\" >> \"$GITHUB_OUTPUT\"\\n          fi\\n          {\\n            echo \\'reason<<__RECAP_URL_REASON_EOF__\\'\\n            echo \"$URL_REASON\"\\n            echo \\'__RECAP_URL_REASON_EOF__\\'\\n          } >> \"$GITHUB_OUTPUT\"\\n\\n      - name: Summarize agent failure\\n        id: agent_summary\\n        if: steps.url.outputs.ok != \\'true\\' && steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        continue-on-error: true\\n        env:\\n          RECAP_AGENT: ${{ needs.gate.outputs.agent }}\\n          RECAP_BLOCK_REFERENCE_SUMMARY: ${{ steps.block_reference.outputs.summary }}\\n          RECAP_PUBLISH_REASON: ${{ steps.publish.outputs.reason }}\\n        run: |\\n          set -uo pipefail\\n          if [ -n \"${RECAP_BLOCK_REFERENCE_SUMMARY:-}\" ]; then\\n            {\\n              echo \\'summary<<__RECAP_BLOCK_REFERENCE_SUMMARY_EOF__\\'\\n              echo \"$RECAP_BLOCK_REFERENCE_SUMMARY\"\\n              echo \\'__RECAP_BLOCK_REFERENCE_SUMMARY_EOF__\\'\\n            } >> \"$GITHUB_OUTPUT\"\\n            node -e \\'process.stdout.write(JSON.stringify({ ok: true, summary: process.env.RECAP_BLOCK_REFERENCE_SUMMARY || \"\" }) + \"\\\\n\")\\'\\n            exit 0\\n          fi\\n          if [ -n \"${RECAP_PUBLISH_REASON:-}\" ]; then\\n            {\\n              echo \\'summary<<__RECAP_PUBLISH_SUMMARY_EOF__\\'\\n              echo \"$RECAP_PUBLISH_REASON\"\\n              echo \\'__RECAP_PUBLISH_SUMMARY_EOF__\\'\\n            } >> \"$GITHUB_OUTPUT\"\\n            node -e \\'process.stdout.write(JSON.stringify({ ok: true, summary: process.env.RECAP_PUBLISH_REASON || \"\" }) + \"\\\\n\")\\'\\n            exit 0\\n          fi\\n          RESULT=claude-result.json\\n          STDERR=claude-stderr.log\\n          EXIT_CODE=claude-exit-code.txt\\n          if [ \"$RECAP_AGENT\" = \"codex\" ]; then\\n            RESULT=codex-events.jsonl\\n            STDERR=codex-stderr.log\\n            EXIT_CODE=codex-exit-code.txt\\n          fi\\n          $RECAP_CLI recap agent-summary --agent \"$RECAP_AGENT\" --result-file \"$RESULT\" --stderr-file \"$STDERR\" --exit-code-file \"$EXIT_CODE\" || true\\n\\n      - name: Attach usage\\n        if: steps.url.outputs.ok == \\'true\\'\\n        continue-on-error: true\\n        env:\\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\\n          # Use the gate-normalized agent so \"Codex\" still selects the right file.\\n          RECAP_AGENT: ${{ needs.gate.outputs.agent }}\\n        run: |\\n          set -uo pipefail\\n          RESULT=claude-result.json\\n          if [ \"$RECAP_AGENT\" = \"codex\" ]; then RESULT=codex-events.jsonl; fi\\n          if [ -f \"$RESULT\" ]; then $RECAP_CLI recap usage --plan-url \"$PLAN_URL\" --agent \"$RECAP_AGENT\" --result-file \"$RESULT\" --model \"${VISUAL_RECAP_MODEL:-}\" --app-url \"$PLAN_RECAP_APP_URL\" --token \"$PLAN_RECAP_TOKEN\" || true; fi\\n\\n      - name: Cache Playwright browsers\\n        if: steps.url.outputs.ok == \\'true\\'\\n        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3\\n        with:\\n          path: ~/.cache/ms-playwright\\n          key: playwright-1-${{ runner.os }}\\n\\n      - name: Screenshot + upload\\n        id: shot\\n        if: steps.url.outputs.ok == \\'true\\'\\n        continue-on-error: true\\n        env:\\n          # recap-url.txt is untrusted agent output; pass via env, never ${{ }}.\\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\\n        run: |\\n          set -uo pipefail\\n          if [ -n \"${RECAP_PLAYWRIGHT:-}\" ] && [ -x \"$RECAP_PLAYWRIGHT\" ]; then\\n            \"$RECAP_PLAYWRIGHT\" install --with-deps chromium || true\\n          elif command -v pnpm >/dev/null 2>&1; then\\n            pnpm exec playwright install --with-deps chromium 2>/dev/null || npx -y playwright@1 install --with-deps chromium || true\\n          else\\n            npx -y playwright@1 install --with-deps chromium || true\\n          fi\\n          LIGHT_SHOT_JSON=\"$($RECAP_CLI recap shot --url \"$PLAN_URL\" --token \"$PLAN_RECAP_TOKEN\" --app-url \"$PLAN_RECAP_APP_URL\" --out recap.png --theme light || echo \\'{}\\')\"\\n          DARK_SHOT_JSON=\"$($RECAP_CLI recap shot --url \"$PLAN_URL\" --token \"$PLAN_RECAP_TOKEN\" --app-url \"$PLAN_RECAP_APP_URL\" --out recap-dark.png --theme dark || echo \\'{}\\')\"\\n          for SHOT_LABEL in light dark; do\\n            if [ \"$SHOT_LABEL\" = \"light\" ]; then SHOT_JSON=\"$LIGHT_SHOT_JSON\"; else SHOT_JSON=\"$DARK_SHOT_JSON\"; fi\\n            SHOT_LABEL=\"$SHOT_LABEL\" SHOT_JSON=\"$SHOT_JSON\" node -e \\'const label = process.env.SHOT_LABEL || \"shot\"; let parsed = {}; try { parsed = JSON.parse(process.env.SHOT_JSON || \"{}\"); } catch { parsed = { ok: false, reason: \"invalid shot JSON\" }; } const summary = { ok: parsed.ok === true, imageUrl: parsed.imageUrl ? \"[present]\" : \"\", out: typeof parsed.out === \"string\" ? parsed.out : \"\", reason: typeof parsed.reason === \"string\" ? parsed.reason.slice(0, 500) : \"\" }; console.log(`[recap shot] ${label}: ${JSON.stringify(summary)}`);\\'\\n          done\\n          IMAGE_URL=$(node -e \\'try{process.stdout.write(JSON.parse(process.argv[1]).imageUrl||\"\")}catch{process.stdout.write(\"\")}\\' \"$LIGHT_SHOT_JSON\")\\n          DARK_IMAGE_URL=$(node -e \\'try{process.stdout.write(JSON.parse(process.argv[1]).imageUrl||\"\")}catch{process.stdout.write(\"\")}\\' \"$DARK_SHOT_JSON\")\\n          if [ -z \"$IMAGE_URL\" ] && [ -z \"$DARK_IMAGE_URL\" ]; then\\n            echo \"::warning::Visual recap screenshot unavailable; posting link-only recap comment.\"\\n          fi\\n          echo \"image_url=$IMAGE_URL\" >> \"$GITHUB_OUTPUT\"\\n          echo \"light_image_url=$IMAGE_URL\" >> \"$GITHUB_OUTPUT\"\\n          echo \"dark_image_url=$DARK_IMAGE_URL\" >> \"$GITHUB_OUTPUT\"\\n          if [ -f recap.png ] || [ -f recap-dark.png ]; then echo \"captured=true\" >> \"$GITHUB_OUTPUT\"; else echo \"captured=false\" >> \"$GITHUB_OUTPUT\"; fi\\n\\n      - name: Upload recap screenshot artifact\\n        if: steps.shot.outputs.captured == \\'true\\'\\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\\n        with:\\n          name: pr-visual-recap-${{ github.event.pull_request.number }}\\n          path: |\\n            recap.png\\n            recap-dark.png\\n          if-no-files-found: ignore\\n          retention-days: 14\\n\\n      - name: Upload recap source artifact\\n        if: always() && !cancelled()\\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\\n        with:\\n          # recap-source.json + the agent transcript (claude-result.json /\\n          # codex-events.jsonl + stderr) are the only window into WHAT the agent\\n          # did when a publish fails (no plan URL) — INCLUDING the case where it\\n          # finished without writing recap-source.json at all. The sticky comment\\n          # only shows the screenshot, so without these a failed recap is\\n          # undebuggable. Uploaded on success + failure; tolerant when absent.\\n          name: pr-visual-recap-source-${{ github.event.pull_request.number }}\\n          path: |\\n            recap-source.json\\n            claude-result.json\\n            claude-stderr.log\\n            codex-events.jsonl\\n            codex-stderr.log\\n          if-no-files-found: ignore\\n          retention-days: 14\\n\\n      - name: Upsert sticky comment\\n        if: always() && !cancelled()\\n        continue-on-error: true\\n        env:\\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\\n          RECAP_IMAGE_URL: ${{ steps.shot.outputs.image_url }}\\n          RECAP_LIGHT_IMAGE_URL: ${{ steps.shot.outputs.light_image_url }}\\n          RECAP_DARK_IMAGE_URL: ${{ steps.shot.outputs.dark_image_url }}\\n          SUPPRESSED: ${{ steps.scan.outputs.suppressed }}\\n          SUPPRESSED_JSON: ${{ steps.scan.outputs.json }}\\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\\n          DIFF_TINY: ${{ steps.diff.outputs.tiny }}\\n          PREV_PLAN_ID: ${{ steps.prev.outputs.plan_id }}\\n          RECAP_AUTH_FAILED: ${{ steps.auth_probe.outputs.auth_failed }}\\n          RECAP_AGENT_SUMMARY: ${{ steps.agent_summary.outputs.summary }}\\n          # Prefer the route-health diagnostic when the plan app routes are not\\n          # yet deployed so the comment explains the 404 instead of a generic\\n          # \"recap-url.txt was not created\" message.\\n          RECAP_URL_REASON: ${{ steps.route_health.outputs.reason || steps.url.outputs.reason }}\\n        run: |\\n          set -euo pipefail\\n          $RECAP_CLI recap comment upsert --repo \"$GITHUB_REPOSITORY\" --issue \"$PR_NUMBER\" --token \"$GH_TOKEN\" --head-sha \"$HEAD_SHA\"\\n\\n      - name: Complete visual recap check\\n        if: always() && !cancelled() && steps.recap_check.outputs.check_run_id != \\'\\'\\n        continue-on-error: true\\n        env:\\n          # Untrusted/step values via env (NOT ${{ }}-interpolated into the run\\n          # body): the agent-written plan URL and the scan JSON could inject shell.\\n          CHECK_RUN_ID: ${{ steps.recap_check.outputs.check_run_id }}\\n          PLAN_OK: ${{ steps.url.outputs.ok }}\\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\\n          SUPPRESSED: ${{ steps.scan.outputs.suppressed }}\\n          SUPPRESSED_JSON: ${{ steps.scan.outputs.json }}\\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\\n          DIFF_TINY: ${{ steps.diff.outputs.tiny }}\\n          RECAP_AGENT_SUMMARY: ${{ steps.agent_summary.outputs.summary }}\\n          RECAP_URL_REASON: ${{ steps.route_health.outputs.reason || steps.url.outputs.reason }}\\n        run: |\\n          set -uo pipefail\\n          $RECAP_CLI recap check complete \\\\\\n            --check-run-id \"$CHECK_RUN_ID\" \\\\\\n            --plan-ok \"$PLAN_OK\" \\\\\\n            --plan-url \"$PLAN_URL\" \\\\\\n            --suppressed \"$SUPPRESSED\" \\\\\\n            --suppressed-json \"$SUPPRESSED_JSON\" \\\\\\n            --huge \"$DIFF_HUGE\" \\\\\\n            --tiny \"$DIFF_TINY\" \\\\\\n            --failure-summary \"$RECAP_AGENT_SUMMARY\" \\\\\\n            --url-reason \"$RECAP_URL_REASON\" \\\\\\n            --workflow-url \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID\"\\n';\n"]}
+{"version":3,"file":"pr-visual-recap-workflow.js","sourceRoot":"","sources":["../../src/cli/pr-visual-recap-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GACvC,onuCAAonuC,CAAC","sourcesContent":["/**\n * Bundled copy of .github/workflows/pr-visual-recap.yml used by\n * `agent-native recap setup`. Keep byte-identical to the source workflow.\n *\n * This file is generated from the workflow source; tests assert the exported\n * string stays in sync.\n */\n\nexport const PR_VISUAL_RECAP_WORKFLOW_YML =\n  'name: PR Visual Recap\\n\\n# Visual code review: a coding agent runs the repo\\'s visual-recap skill over the\\n# PR diff, publishes a plan, and upserts one sticky comment with a screenshot.\\n# Plain `pull_request` (NOT `pull_request_target`) so fork code never sees secrets.\\n\\non:\\n  pull_request:\\n    types: [opened, synchronize, reopened, ready_for_review, closed]\\n\\npermissions:\\n  contents: read\\n\\nconcurrency:\\n  group: pr-visual-recap-${{ github.event.pull_request.number }}\\n  cancel-in-progress: true\\n\\nenv:\\n  VISUAL_RECAP_AGENT: ${{ vars.VISUAL_RECAP_AGENT || \\'claude\\' }}\\n  VISUAL_RECAP_SKILL_SOURCE: ${{ vars.VISUAL_RECAP_SKILL_SOURCE || \\'auto\\' }}\\n  VISUAL_RECAP_SECRET_SCAN: ${{ vars.VISUAL_RECAP_SECRET_SCAN || \\'high-confidence\\' }}\\n\\njobs:\\n  gate:\\n    name: Gate\\n    runs-on: ubuntu-latest\\n    timeout-minutes: 10\\n    permissions:\\n      contents: read\\n      issues: write\\n      pull-requests: write\\n    outputs:\\n      run: ${{ steps.decide.outputs.run }}\\n      agent: ${{ steps.decide.outputs.agent }}\\n    steps:\\n      - id: decide\\n        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\\n        env:\\n          # Presence-only signals — never expose secret VALUES to the gate.\\n          HAS_PLAN: ${{ secrets.PLAN_RECAP_TOKEN != \\'\\' }}\\n          HAS_ANTHROPIC: ${{ secrets.ANTHROPIC_API_KEY != \\'\\' }}\\n          HAS_OPENAI: ${{ secrets.OPENAI_API_KEY != \\'\\' }}\\n          AGENT: ${{ env.VISUAL_RECAP_AGENT }}\\n          VISUAL_RECAP_MODEL: ${{ vars.VISUAL_RECAP_MODEL }}\\n          VISUAL_RECAP_SKILL_SOURCE: ${{ env.VISUAL_RECAP_SKILL_SOURCE }}\\n          HEAD_SHA: ${{ github.event.pull_request.head.sha }}\\n        with:\\n          script: |\\n            const pr = context.payload.pull_request;\\n            const reasons = [];\\n\\n            if (!pr) reasons.push(\\'no pull_request payload\\');\\n            if (pr && pr.draft) reasons.push(\\'draft PR\\');\\n            if (pr && context.payload.action === \\'closed\\' && !pr.merged) {\\n              reasons.push(\\'closed without merge\\');\\n            }\\n\\n            // Fork PRs only receive repo secrets when the org/repo opts into\\n            // GitHub\\'s \"Send secrets to workflows from pull requests\" setting\\n            // (common in private orgs that use forks heavily). Gate on secret\\n            // availability, not fork-ness: run on forks that have the token,\\n            // and skip — with an actionable hint — those that don\\'t.\\n            const headRepo = pr && pr.head && pr.head.repo && pr.head.repo.full_name;\\n            const isFork = !!(pr && headRepo && headRepo !== process.env.GITHUB_REPOSITORY);\\n            const isPrivate = !!(context.payload.repository && context.payload.repository.private);\\n            if (isFork && process.env.HAS_PLAN !== \\'true\\') {\\n              reasons.push(`fork PR (${headRepo}) without secret access — enable \"Send secrets to workflows from pull requests\" (and write tokens) in the repo/org Actions settings to run recaps on forks`);\\n            }\\n\\n            const login = (pr && pr.user && pr.user.login || \\'\\').toLowerCase();\\n            const botAuthors = [\\'dependabot[bot]\\', \\'dependabot\\', \\'renovate[bot]\\', \\'renovate\\'];\\n            if (botAuthors.includes(login)) reasons.push(`bot author (${login})`);\\n            if (pr && pr.user && pr.user.type === \\'Bot\\') reasons.push(\\'bot author (type=Bot)\\');\\n\\n            if (!isFork && process.env.HAS_PLAN !== \\'true\\') reasons.push(\\'PLAN_RECAP_TOKEN not configured\\');\\n\\n            // Normalize + validate the agent so a mis-cased value can\\'t pass the\\n            // gate and then match neither agent step below.\\n            const agent = (process.env.AGENT || \\'claude\\').toLowerCase();\\n            if (agent !== \\'claude\\' && agent !== \\'codex\\') {\\n              reasons.push(`unsupported VISUAL_RECAP_AGENT \"${process.env.AGENT}\" (expected \"claude\" or \"codex\")`);\\n            } else if (agent === \\'codex\\') {\\n              if (process.env.HAS_OPENAI !== \\'true\\') reasons.push(\\'OPENAI_API_KEY not configured (codex backend)\\');\\n            } else {\\n              if (process.env.HAS_ANTHROPIC !== \\'true\\') reasons.push(\\'ANTHROPIC_API_KEY not configured (claude backend)\\');\\n            }\\n\\n            // Validate the model before it reaches the agent CLI.\\n            const model = process.env.VISUAL_RECAP_MODEL || \\'\\';\\n            if (model && !/^[a-zA-Z0-9._-]{1,80}$/.test(model)) {\\n              reasons.push(`invalid VISUAL_RECAP_MODEL value (must match [a-zA-Z0-9._-]{1,80})`);\\n            }\\n\\n            const skillSource = (process.env.VISUAL_RECAP_SKILL_SOURCE || \\'auto\\').toLowerCase();\\n            if (![\\'auto\\', \\'latest\\', \\'repo\\'].includes(skillSource)) {\\n              reasons.push(\\'invalid VISUAL_RECAP_SKILL_SOURCE value (expected \"auto\", \"latest\", or \"repo\")\\');\\n            }\\n            const usesRepoSkill = skillSource === \\'repo\\';\\n\\n            // Self-modifying guard, evaluated in the trusted gate (runs NO\\n            // PR-checked-out code): skip the ENTIRE job if the PR touches the\\n            // repo-pinned skill instructions or any agent config the runner\\n            // loads, so a PR can\\'t rewrite what the agent loads and exfiltrate\\n            // secrets. With the default bundled skill source, visual skill and\\n            // recap workflow files are reviewed content, not instructions loaded\\n            // by the runner.\\n            // Keep this guard for forks AND all public-repo PRs: a fork or a\\n            // public same-repo author could rewrite loaded instruction files\\n            // (AGENTS.md/CLAUDE.md/.claude/.mcp.json) and exfiltrate the\\n            // secret-backed agent run. Skip it ONLY for private-repo same-repo\\n            // PRs, where the author is a trusted org member — a deliberate owner\\n            // risk acceptance so legit instruction edits don\\'t false-skip recaps.\\n            if (pr && (isFork || !isPrivate)) {\\n              try {\\n                const files = await github.paginate(github.rest.pulls.listFiles, {\\n                  owner: context.repo.owner,\\n                  repo: context.repo.repo,\\n                  pull_number: pr.number,\\n                  per_page: 100,\\n                });\\n                const isSensitive = (p) =>\\n                  (usesRepoSkill && /(^|\\\\/)skills\\\\/visual-(recap|plan|plans)\\\\//.test(p)) ||\\n                  /(^|\\\\/)\\\\.claude\\\\//.test(p) ||\\n                  /(^|\\\\/)CLAUDE\\\\.md$/.test(p) ||\\n                  /(^|\\\\/)AGENTS\\\\.md$/.test(p) ||\\n                  /(^|\\\\/)\\\\.mcp\\\\.json$/.test(p);\\n                const hits = files.map((f) => f.filename).filter(isSensitive);\\n                if (hits.length) {\\n                  reasons.push(`PR modifies recap-control files (${hits.slice(0, 3).join(\\', \\')}${hits.length > 3 ? \\', …\\' : \\'\\'}) — skipping so untrusted PR code never runs with secrets`);\\n                }\\n              } catch (e) {\\n                // Fail closed: if the file list can\\'t be read, skip.\\n                reasons.push(`could not list PR files for the self-modifying guard (${e.message}); skipping to be safe`);\\n              }\\n            }\\n\\n            const run = reasons.length === 0;\\n            core.setOutput(\\'run\\', run ? \\'true\\' : \\'false\\');\\n            core.setOutput(\\'agent\\', agent);\\n            if (run) {\\n              core.info(`Visual recap will run (${agent}).`);\\n            } else {\\n              // Surface the skip reason as a run-summary annotation, not just a\\n              // buried info log, so it\\'s clear in the Actions UI why we skipped.\\n              core.notice(`Visual recap skipped: ${reasons.join(\\'; \\')}`);\\n            }\\n\\n            // When skipping, upsert a sticky recap comment with a short skip\\n            // line so the PR always explains why the recap job did not run.\\n            if (!run && pr) {\\n              try {\\n                const MARKER = \\'<!-- pr-visual-recap -->\\';\\n                const { data: comments } = await github.rest.issues.listComments({\\n                  owner: context.repo.owner,\\n                  repo: context.repo.repo,\\n                  issue_number: pr.number,\\n                  per_page: 100,\\n                });\\n                const existing = comments.find(\\n                  (c) => c.user && c.user.type === \\'Bot\\' && c.body && c.body.includes(MARKER)\\n                );\\n                const headShort = (process.env.HEAD_SHA || \\'\\').slice(0, 7);\\n                const shaRef = headShort ? `\\\\`${headShort}\\\\`` : \\'latest push\\';\\n                const primaryReason = reasons.filter(\\n                  (r) => !r.startsWith(\\'could not list PR files for the self-modifying guard\\')\\n                )[0] || reasons[0] || \\'skipped\\';\\n                const skipLine = `_Recap skipped for ${shaRef}: ${primaryReason}._`;\\n                const baseBody = `${MARKER}\\\\n### Visual recap — skipped\\\\n\\\\nThe visual recap job did not run for this pull request. This is informational only and does **not** block the PR.`;\\n                const withoutPrev = (existing && existing.body ? existing.body : baseBody)\\n                  .split(\\'\\\\n\\')\\n                  .filter((l) => !/_Recap skipped for .+_$/.test(l.trim()))\\n                  .join(\\'\\\\n\\')\\n                  .trimEnd();\\n                const updatedBody = `${withoutPrev}\\\\n\\\\n${skipLine}`;\\n                if (existing) {\\n                  await github.rest.issues.updateComment({\\n                    owner: context.repo.owner,\\n                    repo: context.repo.repo,\\n                    comment_id: existing.id,\\n                    body: updatedBody,\\n                  });\\n                } else {\\n                  await github.rest.issues.createComment({\\n                    owner: context.repo.owner,\\n                    repo: context.repo.repo,\\n                    issue_number: pr.number,\\n                    body: updatedBody,\\n                  });\\n                }\\n              } catch (e) {\\n                core.warning(`Could not update recap skip comment: ${e.message}`);\\n              }\\n            }\\n\\n  recap:\\n    name: Generate visual recap\\n    needs: gate\\n    if: needs.gate.outputs.run == \\'true\\'\\n    runs-on: ubuntu-latest\\n    timeout-minutes: 30\\n    permissions:\\n      actions: write\\n      checks: write\\n      contents: read\\n      issues: write\\n      pull-requests: write\\n    env:\\n      PLAN_RECAP_APP_URL: ${{ secrets.PLAN_RECAP_APP_URL || \\'https://plan.agent-native.com\\' }}\\n      PLAN_RECAP_TOKEN: ${{ secrets.PLAN_RECAP_TOKEN }}\\n      GH_TOKEN: ${{ github.token }}\\n      PR_NUMBER: ${{ github.event.pull_request.number }}\\n      PR_STATE: ${{ github.event.pull_request.state }}\\n      PR_MERGED: ${{ github.event.pull_request.merged }}\\n      PR_MERGED_AT: ${{ github.event.pull_request.merged_at }}\\n      HEAD_SHA: ${{ github.event.pull_request.head.sha }}\\n      VISUAL_RECAP_MODEL: ${{ vars.VISUAL_RECAP_MODEL }}\\n      VISUAL_RECAP_REASONING: ${{ vars.VISUAL_RECAP_REASONING }}\\n      VISUAL_RECAP_SKILL_SOURCE: ${{ vars.VISUAL_RECAP_SKILL_SOURCE || \\'auto\\' }}\\n      VISUAL_RECAP_SECRET_SCAN: ${{ vars.VISUAL_RECAP_SECRET_SCAN || \\'high-confidence\\' }}\\n    steps:\\n      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\\n        with:\\n          fetch-depth: 0\\n          # This job runs an agent over untrusted PR diff; don\\'t leave the token\\n          # in .git/config (it uses GH_TOKEN for gh API calls, never git push).\\n          persist-credentials: false\\n\\n      # Dogfood trusted base-branch source inside this monorepo, else install the\\n      # published package once. Never execute PR-head recap CLI code.\\n      - name: Resolve recap CLI\\n        id: cli\\n        env:\\n          # Optional: pin the consumer CLI version (e.g. \"1.2.3\"). Defaults to\\n          # \"latest\" when unset. Set via repository variable RECAP_CLI_VERSION.\\n          RECAP_CLI_VERSION: ${{ vars.RECAP_CLI_VERSION || \\'latest\\' }}\\n        run: |\\n          if [ \"$GITHUB_REPOSITORY\" = \"BuilderIO/agent-native\" ] && [ -f packages/core/src/cli/index.ts ]; then\\n            echo \"local=true\" >> \"$GITHUB_OUTPUT\"\\n          else\\n            echo \"local=false\" >> \"$GITHUB_OUTPUT\"\\n          fi\\n\\n      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\\n        if: steps.cli.outputs.local == \\'true\\'\\n        with:\\n          ref: ${{ github.event.pull_request.base.sha }}\\n          path: .recap-cli-source\\n          fetch-depth: 1\\n          persist-credentials: false\\n\\n      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8\\n        if: steps.cli.outputs.local == \\'true\\'\\n\\n      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\\n        with:\\n          node-version: \"22\"\\n          cache: ${{ steps.cli.outputs.local == \\'true\\' && \\'pnpm\\' || \\'\\' }}\\n\\n      - name: Install trusted workspace recap CLI\\n        if: steps.cli.outputs.local == \\'true\\'\\n        working-directory: .recap-cli-source\\n        run: |\\n          set -euo pipefail\\n          pnpm install --frozen-lockfile --ignore-scripts\\n          echo \"RECAP_CLI=$PWD/node_modules/.bin/tsx $PWD/packages/core/src/cli/index.ts\" >> \"$GITHUB_ENV\"\\n          echo \"RECAP_PLAYWRIGHT=$PWD/node_modules/.bin/playwright\" >> \"$GITHUB_ENV\"\\n\\n      - name: Install published recap CLI\\n        if: steps.cli.outputs.local != \\'true\\'\\n        env:\\n          RECAP_CLI_VERSION: ${{ vars.RECAP_CLI_VERSION || \\'latest\\' }}\\n        run: |\\n          set -euo pipefail\\n          VERSION=\"$RECAP_CLI_VERSION\"\\n          if [ \"$VERSION\" = \"latest\" ]; then\\n            VERSION=\"$(npm view @agent-native/core@latest version)\"\\n          fi\\n          for attempt in 1 2 3; do\\n            if npm install --prefix \"$RUNNER_TEMP/recap-cli\" --no-audit --no-fund \"@agent-native/core@$VERSION\"; then\\n              break\\n            fi\\n            if [ \"$attempt\" = \"3\" ]; then exit 1; fi\\n            sleep $((attempt * 10))\\n          done\\n          echo \"RECAP_CLI=$RUNNER_TEMP/recap-cli/node_modules/.bin/agent-native\" >> \"$GITHUB_ENV\"\\n          echo \"RECAP_PLAYWRIGHT=$RUNNER_TEMP/recap-cli/node_modules/.bin/playwright\" >> \"$GITHUB_ENV\"\\n\\n      - name: Start visual recap check\\n        id: recap_check\\n        continue-on-error: true\\n        run: |\\n          set -uo pipefail\\n          $RECAP_CLI recap check start --sha \"$HEAD_SHA\" --workflow-url \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID\"\\n\\n      - name: Collect bounded diff\\n        id: diff\\n        env:\\n          BASE_SHA: ${{ github.event.pull_request.base.sha }}\\n        run: |\\n          set -euo pipefail\\n          $RECAP_CLI recap collect-diff --base \"$BASE_SHA\" --head \"$HEAD_SHA\" --out recap.diff --stat recap.stat\\n\\n      - name: Probe plan-app auth\\n        id: auth_probe\\n        if: steps.diff.outputs.tiny != \\'true\\'\\n        continue-on-error: true\\n        run: |\\n          set -uo pipefail\\n          # Hit the plan app\\'s action surface with the publish token. A 401 means\\n          # the token is expired/revoked; surface it in the sticky comment so the\\n          # repo owner knows to re-mint it instead of seeing a generic failure.\\n          HTTP_STATUS=$(node -e \\'\\n            const https = require(\"https\");\\n            const url = new URL(\"/_agent-native/actions/record-recap-usage\", process.env.PLAN_RECAP_APP_URL || \"https://plan.agent-native.com\");\\n            const req = https.request(url, { method: \"POST\", headers: { \"authorization\": \"Bearer \" + process.env.PLAN_RECAP_TOKEN, \"content-type\": \"application/json\" }, timeout: 8000 }, (res) => { process.stdout.write(String(res.statusCode)); req.destroy(); });\\n            req.on(\"error\", () => process.stdout.write(\"0\"));\\n            req.end(JSON.stringify({ planId: \"__probe__\" }));\\n          \\' 2>/dev/null || echo \"0\")\\n          if [ \"$HTTP_STATUS\" = \"401\" ]; then\\n            echo \"auth_failed=true\" >> \"$GITHUB_OUTPUT\"\\n          else\\n            echo \"auth_failed=false\" >> \"$GITHUB_OUTPUT\"\\n          fi\\n\\n      - name: Probe plan-app route health\\n        id: route_health\\n        if: steps.diff.outputs.tiny != \\'true\\'\\n        continue-on-error: true\\n        run: |\\n          set -uo pipefail\\n          # Pre-publish health gate: confirm the plan app\\'s recap action routes\\n          # are actually deployed BEFORE the agent runs. A 404 from\\n          # create-visual-recap (POST) or get-plan-blocks (GET) means the\\n          # plan-app deploy has not propagated yet (the client is ahead of the\\n          # deployed server). Say that plainly here instead of letting the agent\\n          # run and then fail confusingly at publish time. A 401 or 200 is\\n          # healthy — the route exists, it just rejected/accepted the probe.\\n          probe_status() {\\n            ROUTE=\"$1\" METHOD=\"$2\" node -e \\'\\n              const https = require(\"https\");\\n              const base = process.env.PLAN_RECAP_APP_URL || \"https://plan.agent-native.com\";\\n              const url = new URL(process.env.ROUTE, base);\\n              if (process.env.METHOD === \"GET\") url.searchParams.set(\"format\", \"reference\");\\n              const req = https.request(url, { method: process.env.METHOD, headers: { \"authorization\": \"Bearer \" + (process.env.PLAN_RECAP_TOKEN || \"\"), \"content-type\": \"application/json\" }, timeout: 8000 }, (res) => { process.stdout.write(String(res.statusCode)); req.destroy(); });\\n              req.on(\"error\", () => process.stdout.write(\"0\"));\\n              req.on(\"timeout\", () => { process.stdout.write(\"0\"); req.destroy(); });\\n              if (process.env.METHOD === \"POST\") { req.end(JSON.stringify({ __probe__: true })); } else { req.end(); }\\n            \\' 2>/dev/null || echo \"0\"\\n          }\\n          CREATE_STATUS=\"$(probe_status /_agent-native/actions/create-visual-recap POST)\"\\n          BLOCKS_STATUS=\"$(probe_status /_agent-native/actions/get-plan-blocks GET)\"\\n          REASON=\"\"\\n          if [ \"$CREATE_STATUS\" = \"404\" ] || [ \"$BLOCKS_STATUS\" = \"404\" ]; then\\n            REASON=\"Plan app routes return 404 — deploy not yet propagated (create-visual-recap: $CREATE_STATUS, get-plan-blocks: $BLOCKS_STATUS). The plan-app client is ahead of the deployed server; re-run once the deploy finishes propagating.\"\\n            echo \"::error::$REASON\"\\n            echo \"unhealthy=true\" >> \"$GITHUB_OUTPUT\"\\n          else\\n            echo \"unhealthy=false\" >> \"$GITHUB_OUTPUT\"\\n          fi\\n          {\\n            echo \\'reason<<__RECAP_ROUTE_HEALTH_EOF__\\'\\n            echo \"$REASON\"\\n            echo \\'__RECAP_ROUTE_HEALTH_EOF__\\'\\n          } >> \"$GITHUB_OUTPUT\"\\n\\n      - name: Secret scan\\n        id: scan\\n        if: steps.diff.outputs.tiny != \\'true\\'\\n        run: |\\n          set -uo pipefail\\n          # Fail CLOSED: a scanner error or invalid JSON suppresses the diff so a\\n          # credential-bearing diff is never handed to the agent / plan service.\\n          if ! SCAN_JSON=\"$($RECAP_CLI recap scan --diff recap.diff --mode \"$VISUAL_RECAP_SECRET_SCAN\")\"; then\\n            SCAN_JSON=\\'{\"suppressed\":true,\"reason\":\"secret scan failed to run; failing closed\"}\\'\\n          fi\\n          {\\n            echo \\'json<<__RECAP_SCAN_EOF__\\'\\n            echo \"$SCAN_JSON\"\\n            echo \\'__RECAP_SCAN_EOF__\\'\\n          } >> \"$GITHUB_OUTPUT\"\\n          SUPPRESSED=$(node -e \\'try{process.stdout.write(JSON.parse(process.argv[1]).suppressed?\"true\":\"false\")}catch{process.stdout.write(\"true\")}\\' \"$SCAN_JSON\")\\n          echo \"suppressed=$SUPPRESSED\" >> \"$GITHUB_OUTPUT\"\\n\\n      - name: Read previous plan id\\n        id: prev\\n        continue-on-error: true\\n        run: |\\n          set -euo pipefail\\n          PLAN_ID=\"$($RECAP_CLI recap comment find-plan-id --repo \"$GITHUB_REPOSITORY\" --issue \"$PR_NUMBER\" --token \"$GH_TOKEN\")\"\\n          echo \"plan_id=$PLAN_ID\" >> \"$GITHUB_OUTPUT\"\\n\\n      - name: Fetch plan block reference\\n        id: block_reference\\n        if: steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        continue-on-error: true\\n        run: |\\n          set -uo pipefail\\n          if $RECAP_CLI recap block-reference --app-url \"$PLAN_RECAP_APP_URL\" --out recap-blocks.md; then\\n            echo \"ok=true\" >> \"$GITHUB_OUTPUT\"\\n          else\\n            echo \"ok=false\" >> \"$GITHUB_OUTPUT\"\\n            {\\n              echo \\'summary<<__RECAP_BLOCK_REFERENCE_EOF__\\'\\n              echo \"Could not fetch the live plan block reference; the agent will fall back to bundled visual-recap instructions and the publisher will validate the final MDX.\"\\n              echo \\'__RECAP_BLOCK_REFERENCE_EOF__\\'\\n            } >> \"$GITHUB_OUTPUT\"\\n            cat > recap-blocks.md <<\\'EOF\\'\\n          Live plan block reference unavailable. Follow the bundled visual-recap skill and author conservative MDX; the deterministic publisher will validate the source before posting.\\n          EOF\\n          fi\\n\\n      - name: Build recap prompt\\n        id: prompt\\n        if: steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        env:\\n          # Pass step outputs via env, NOT ${{ }} interpolation into the run body:\\n          # the prev plan id is parsed from a PR comment and could inject shell.\\n          PREV_PLAN_ID: ${{ steps.prev.outputs.plan_id }}\\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\\n          IS_FORK: ${{ github.event.pull_request.head.repo.full_name != github.repository }}\\n        run: |\\n          set -euo pipefail\\n          ARGS=(--diff recap.diff --stat recap.stat --block-reference recap-blocks.md --pr \"$PR_NUMBER\" --repo \"$GITHUB_REPOSITORY\" --head \"$HEAD_SHA\" --app-url \"$PLAN_RECAP_APP_URL\" --skill-source \"$VISUAL_RECAP_SKILL_SOURCE\" --out recap-prompt.md)\\n          if [ \"${DIFF_HUGE:-}\" = \"true\" ]; then ARGS+=(--huge); fi\\n          if [ \"${IS_FORK:-}\" = \"true\" ]; then ARGS+=(--fork-pr true); fi\\n          if [ -n \"${PREV_PLAN_ID:-}\" ]; then ARGS+=(--prev-plan-id \"$PREV_PLAN_ID\"); fi\\n          $RECAP_CLI recap build-prompt \"${ARGS[@]}\"\\n\\n      - name: Run agent (Claude Code)\\n        id: claude\\n        if: needs.gate.outputs.agent == \\'claude\\' && steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        continue-on-error: true\\n        env:\\n          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}\\n        run: |\\n          set -uo pipefail\\n          CLAUDE_ALLOWED_TOOLS=\"Read,Write,Bash(git diff:*)\"\\n          CLAUDE_ARGS=(-p \"$(cat recap-prompt.md)\" --allowedTools \"$CLAUDE_ALLOWED_TOOLS\" --permission-mode dontAsk --output-format json)\\n          if [ -n \"${VISUAL_RECAP_MODEL:-}\" ]; then CLAUDE_ARGS+=(--model \"$VISUAL_RECAP_MODEL\"); fi\\n          rm -f recap-source.json recap-url.txt recap-url-reason.txt claude-result.json claude-stderr.log\\n          run_claude() {\\n            set +e\\n            npx -y @anthropic-ai/claude-code@2 \"${CLAUDE_ARGS[@]}\" > claude-result.json 2> claude-stderr.log\\n            CLAUDE_STATUS=\"$?\"\\n            set -e\\n            echo \"$CLAUDE_STATUS\" > claude-exit-code.txt\\n          }\\n          run_claude\\n          # A clean agent exit WITHOUT recap-source.json is the strongest\\n          # \"retry me\" signal — the deterministic publisher needs that file, and\\n          # the agent occasionally finishes a turn without writing it. Retry once.\\n          if [ ! -s recap-source.json ]; then\\n            echo \"::warning::recap-source.json missing after the agent run; retrying the agent once.\"\\n            sleep 5\\n            run_claude\\n          fi\\n\\n      - name: Run agent (Codex)\\n        id: codex\\n        if: needs.gate.outputs.agent == \\'codex\\' && steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        continue-on-error: true\\n        env:\\n          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\\n        run: |\\n          set -uo pipefail\\n          # `codex login` writes ~/.codex/auth.json (the bare env var is dropped on\\n          # the gpt-5.5 wss transport); stdin keeps the key out of process args.\\n          printenv OPENAI_API_KEY | npx -y @openai/codex@0 login --with-api-key || true\\n          # The runner is itself an ephemeral sandbox; bypass Codex\\'s own sandbox\\n          # (bubblewrap can\\'t init here) and approval gate (cancels the MCP write).\\n          CODEX_ARGS=(exec --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check)\\n          if [ -n \"${VISUAL_RECAP_MODEL:-}\" ]; then CODEX_ARGS+=(--model \"$VISUAL_RECAP_MODEL\"); fi\\n          # Validate reasoning against the enum before embedding it in the TOML override.\\n          case \"${VISUAL_RECAP_REASONING:-}\" in\\n            none|minimal|low|medium|high|xhigh)\\n              CODEX_ARGS+=(-c \"model_reasoning_effort=\\\\\"$VISUAL_RECAP_REASONING\\\\\"\") ;;\\n            \"\") ;;\\n            *) echo \"Ignoring invalid VISUAL_RECAP_REASONING: $VISUAL_RECAP_REASONING\" ;;\\n          esac\\n          rm -f recap-source.json recap-url.txt recap-url-reason.txt codex-events.jsonl codex-stderr.log\\n          run_codex() {\\n            set +e\\n            npx -y @openai/codex@0 \"${CODEX_ARGS[@]}\" --json \"$(cat recap-prompt.md)\" 2> codex-stderr.log | tee codex-events.jsonl\\n            CODEX_STATUS=\"${PIPESTATUS[0]}\"\\n            set -e\\n            echo \"$CODEX_STATUS\" > codex-exit-code.txt\\n          }\\n          run_codex\\n          # Retry once if the agent exited without writing recap-source.json\\n          # (see the Claude step) — the publisher needs that file.\\n          if [ ! -s recap-source.json ]; then\\n            echo \"::warning::recap-source.json missing after the agent run; retrying the agent once.\"\\n            sleep 5\\n            run_codex\\n          fi\\n\\n      - name: Publish recap source\\n        id: publish\\n        if: steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        continue-on-error: true\\n        env:\\n          PREV_PLAN_ID: ${{ steps.prev.outputs.plan_id }}\\n        run: |\\n          set -uo pipefail\\n          ARGS=(--source recap-source.json --out recap-url.txt --repo \"$GITHUB_REPOSITORY\" --pr \"$PR_NUMBER\" --app-url \"$PLAN_RECAP_APP_URL\" --token \"$PLAN_RECAP_TOKEN\")\\n          if [ -n \"${PREV_PLAN_ID:-}\" ]; then ARGS+=(--prev-plan-id \"$PREV_PLAN_ID\"); fi\\n          ARGS+=(--source-type pull-request --source-repo \"$GITHUB_REPOSITORY\" --source-pr-number \"$PR_NUMBER\")\\n          if [ \"${PR_MERGED:-false}\" = \"true\" ] || [ -n \"${PR_MERGED_AT:-}\" ]; then\\n            ARGS+=(--source-pr-state merged)\\n          elif [ -n \"${PR_STATE:-}\" ]; then\\n            ARGS+=(--source-pr-state \"$PR_STATE\")\\n          fi\\n          if [ -n \"${PR_MERGED_AT:-}\" ]; then ARGS+=(--source-pr-merged-at \"$PR_MERGED_AT\"); fi\\n          $RECAP_CLI recap publish \"${ARGS[@]}\"\\n\\n      - name: Read plan URL\\n        id: url\\n        if: steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        run: |\\n          set -uo pipefail\\n          PLAN_URL=\"\"\\n          URL_REASON=\"\"\\n          if [ -f recap-url.txt ]; then\\n            PLAN_URL=\"$(tr -d \\'\\\\r\\\\n\\' < recap-url.txt | tr -d \\' \\')\"\\n          elif [ -f recap-url-reason.txt ]; then\\n            URL_REASON=\"$(cat recap-url-reason.txt)\"\\n          else\\n            URL_REASON=\"recap-url.txt was not created.\"\\n          fi\\n          # recap-url.txt is agent-written -> untrusted. Rebuild a canonical\\n          # recap URL from the trusted app base and a strictly validated plan id,\\n          # preserving path-prefixed self-hosted mounts.\\n          if [ -z \"$URL_REASON\" ]; then\\n            URL_RESULT=$(PLAN_URL=\"$PLAN_URL\" node <<\\'NODE\\'\\n          const emit = (value) => process.stdout.write(JSON.stringify(value));\\n          try {\\n            const raw = process.env.PLAN_URL || \"\";\\n            if (!raw) {\\n              emit({ url: \"\", reason: \"recap-url.txt was empty\" });\\n              process.exit(0);\\n            }\\n            const trusted = new URL(process.env.PLAN_RECAP_APP_URL || \"https://plan.agent-native.com\");\\n            const parsed = /^https?:\\\\/\\\\//i.test(raw)\\n              ? new URL(raw)\\n              : new URL(raw, trusted);\\n            if (parsed.origin !== trusted.origin) {\\n              emit({ url: \"\", reason: `recap-url.txt points at ${parsed.origin}, expected ${trusted.origin}` });\\n              process.exit(0);\\n            }\\n\\n            const base = trusted.pathname.replace(/\\\\/$/, \"\");\\n            const paths = [parsed.pathname];\\n            if (base && parsed.pathname.startsWith(`${base}/`)) {\\n              paths.push(parsed.pathname.slice(base.length) || \"/\");\\n            }\\n\\n            for (const path of paths) {\\n              const match = path.match(/^\\\\/(?:plans|recaps)\\\\/([A-Za-z0-9_-]+)\\\\/?$/);\\n              if (match) {\\n                emit({ url: `${trusted.origin}${base}/recaps/${match[1]}`, reason: \"\" });\\n                process.exit(0);\\n              }\\n            }\\n            emit({ url: \"\", reason: \"recap-url.txt did not contain a valid /plans/<id> or /recaps/<id> URL for the configured plan app\" });\\n          } catch {\\n            emit({ url: \"\", reason: \"recap-url.txt was not a valid URL or recap path\" });\\n          }\\n          NODE\\n            )\\n            CANONICAL_URL=$(node -e \\'try{process.stdout.write(JSON.parse(process.argv[1]).url||\"\")}catch{process.stdout.write(\"\")}\\' \"$URL_RESULT\")\\n            URL_REASON=$(node -e \\'try{process.stdout.write(JSON.parse(process.argv[1]).reason||\"\")}catch{process.stdout.write(\"recap-url.txt URL validation failed\")}\\' \"$URL_RESULT\")\\n          else\\n            CANONICAL_URL=\"\"\\n          fi\\n          if [ -n \"$CANONICAL_URL\" ]; then\\n            echo \"plan_url=$CANONICAL_URL\" >> \"$GITHUB_OUTPUT\"; echo \"ok=true\" >> \"$GITHUB_OUTPUT\"\\n          else\\n            echo \"plan_url=\" >> \"$GITHUB_OUTPUT\"; echo \"ok=false\" >> \"$GITHUB_OUTPUT\"\\n          fi\\n          {\\n            echo \\'reason<<__RECAP_URL_REASON_EOF__\\'\\n            echo \"$URL_REASON\"\\n            echo \\'__RECAP_URL_REASON_EOF__\\'\\n          } >> \"$GITHUB_OUTPUT\"\\n\\n      - name: Summarize agent failure\\n        id: agent_summary\\n        if: steps.url.outputs.ok != \\'true\\' && steps.diff.outputs.tiny != \\'true\\' && steps.scan.outputs.suppressed != \\'true\\'\\n        continue-on-error: true\\n        env:\\n          RECAP_AGENT: ${{ needs.gate.outputs.agent }}\\n          RECAP_BLOCK_REFERENCE_SUMMARY: ${{ steps.block_reference.outputs.summary }}\\n          RECAP_PUBLISH_REASON: ${{ steps.publish.outputs.reason }}\\n        run: |\\n          set -uo pipefail\\n          if [ -n \"${RECAP_BLOCK_REFERENCE_SUMMARY:-}\" ]; then\\n            {\\n              echo \\'summary<<__RECAP_BLOCK_REFERENCE_SUMMARY_EOF__\\'\\n              echo \"$RECAP_BLOCK_REFERENCE_SUMMARY\"\\n              echo \\'__RECAP_BLOCK_REFERENCE_SUMMARY_EOF__\\'\\n            } >> \"$GITHUB_OUTPUT\"\\n            node -e \\'process.stdout.write(JSON.stringify({ ok: true, summary: process.env.RECAP_BLOCK_REFERENCE_SUMMARY || \"\" }) + \"\\\\n\")\\'\\n            exit 0\\n          fi\\n          if [ -n \"${RECAP_PUBLISH_REASON:-}\" ]; then\\n            {\\n              echo \\'summary<<__RECAP_PUBLISH_SUMMARY_EOF__\\'\\n              echo \"$RECAP_PUBLISH_REASON\"\\n              echo \\'__RECAP_PUBLISH_SUMMARY_EOF__\\'\\n            } >> \"$GITHUB_OUTPUT\"\\n            node -e \\'process.stdout.write(JSON.stringify({ ok: true, summary: process.env.RECAP_PUBLISH_REASON || \"\" }) + \"\\\\n\")\\'\\n            exit 0\\n          fi\\n          RESULT=claude-result.json\\n          STDERR=claude-stderr.log\\n          EXIT_CODE=claude-exit-code.txt\\n          if [ \"$RECAP_AGENT\" = \"codex\" ]; then\\n            RESULT=codex-events.jsonl\\n            STDERR=codex-stderr.log\\n            EXIT_CODE=codex-exit-code.txt\\n          fi\\n          $RECAP_CLI recap agent-summary --agent \"$RECAP_AGENT\" --result-file \"$RESULT\" --stderr-file \"$STDERR\" --exit-code-file \"$EXIT_CODE\" || true\\n\\n      - name: Attach usage\\n        if: steps.url.outputs.ok == \\'true\\'\\n        continue-on-error: true\\n        env:\\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\\n          # Use the gate-normalized agent so \"Codex\" still selects the right file.\\n          RECAP_AGENT: ${{ needs.gate.outputs.agent }}\\n        run: |\\n          set -uo pipefail\\n          RESULT=claude-result.json\\n          if [ \"$RECAP_AGENT\" = \"codex\" ]; then RESULT=codex-events.jsonl; fi\\n          if [ -f \"$RESULT\" ]; then $RECAP_CLI recap usage --plan-url \"$PLAN_URL\" --agent \"$RECAP_AGENT\" --result-file \"$RESULT\" --model \"${VISUAL_RECAP_MODEL:-}\" --app-url \"$PLAN_RECAP_APP_URL\" --token \"$PLAN_RECAP_TOKEN\" || true; fi\\n\\n      - name: Cache Playwright browsers\\n        if: steps.url.outputs.ok == \\'true\\'\\n        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3\\n        with:\\n          path: ~/.cache/ms-playwright\\n          key: playwright-1-${{ runner.os }}\\n\\n      - name: Screenshot + upload\\n        id: shot\\n        if: steps.url.outputs.ok == \\'true\\'\\n        continue-on-error: true\\n        env:\\n          # recap-url.txt is untrusted agent output; pass via env, never ${{ }}.\\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\\n        run: |\\n          set -uo pipefail\\n          if [ -n \"${RECAP_PLAYWRIGHT:-}\" ] && [ -x \"$RECAP_PLAYWRIGHT\" ]; then\\n            \"$RECAP_PLAYWRIGHT\" install --with-deps chromium || true\\n          elif command -v pnpm >/dev/null 2>&1; then\\n            pnpm exec playwright install --with-deps chromium 2>/dev/null || npx -y playwright@1 install --with-deps chromium || true\\n          else\\n            npx -y playwright@1 install --with-deps chromium || true\\n          fi\\n          LIGHT_SHOT_JSON=\"$($RECAP_CLI recap shot --url \"$PLAN_URL\" --token \"$PLAN_RECAP_TOKEN\" --app-url \"$PLAN_RECAP_APP_URL\" --out recap.png --theme light || echo \\'{}\\')\"\\n          DARK_SHOT_JSON=\"$($RECAP_CLI recap shot --url \"$PLAN_URL\" --token \"$PLAN_RECAP_TOKEN\" --app-url \"$PLAN_RECAP_APP_URL\" --out recap-dark.png --theme dark || echo \\'{}\\')\"\\n          for SHOT_LABEL in light dark; do\\n            if [ \"$SHOT_LABEL\" = \"light\" ]; then SHOT_JSON=\"$LIGHT_SHOT_JSON\"; else SHOT_JSON=\"$DARK_SHOT_JSON\"; fi\\n            SHOT_LABEL=\"$SHOT_LABEL\" SHOT_JSON=\"$SHOT_JSON\" node -e \\'const label = process.env.SHOT_LABEL || \"shot\"; let parsed = {}; try { parsed = JSON.parse(process.env.SHOT_JSON || \"{}\"); } catch { parsed = { ok: false, reason: \"invalid shot JSON\" }; } const summary = { ok: parsed.ok === true, imageUrl: parsed.imageUrl ? \"[present]\" : \"\", out: typeof parsed.out === \"string\" ? parsed.out : \"\", reason: typeof parsed.reason === \"string\" ? parsed.reason.slice(0, 500) : \"\" }; console.log(`[recap shot] ${label}: ${JSON.stringify(summary)}`);\\'\\n          done\\n          IMAGE_URL=$(node -e \\'try{process.stdout.write(JSON.parse(process.argv[1]).imageUrl||\"\")}catch{process.stdout.write(\"\")}\\' \"$LIGHT_SHOT_JSON\")\\n          DARK_IMAGE_URL=$(node -e \\'try{process.stdout.write(JSON.parse(process.argv[1]).imageUrl||\"\")}catch{process.stdout.write(\"\")}\\' \"$DARK_SHOT_JSON\")\\n          if [ -z \"$IMAGE_URL\" ] && [ -z \"$DARK_IMAGE_URL\" ]; then\\n            echo \"::warning::Visual recap screenshot unavailable; posting link-only recap comment.\"\\n          fi\\n          echo \"image_url=$IMAGE_URL\" >> \"$GITHUB_OUTPUT\"\\n          echo \"light_image_url=$IMAGE_URL\" >> \"$GITHUB_OUTPUT\"\\n          echo \"dark_image_url=$DARK_IMAGE_URL\" >> \"$GITHUB_OUTPUT\"\\n          if [ -f recap.png ] || [ -f recap-dark.png ]; then echo \"captured=true\" >> \"$GITHUB_OUTPUT\"; else echo \"captured=false\" >> \"$GITHUB_OUTPUT\"; fi\\n\\n      - name: Upload recap screenshot artifact\\n        if: steps.shot.outputs.captured == \\'true\\'\\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\\n        with:\\n          name: pr-visual-recap-${{ github.event.pull_request.number }}\\n          path: |\\n            recap.png\\n            recap-dark.png\\n          if-no-files-found: ignore\\n          retention-days: 14\\n\\n      - name: Upload recap source artifact\\n        if: always() && !cancelled()\\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\\n        with:\\n          # recap-source.json + the agent transcript (claude-result.json /\\n          # codex-events.jsonl + stderr) are the only window into WHAT the agent\\n          # did when a publish fails (no plan URL) — INCLUDING the case where it\\n          # finished without writing recap-source.json at all. The sticky comment\\n          # only shows the screenshot, so without these a failed recap is\\n          # undebuggable. Uploaded on success + failure; tolerant when absent.\\n          name: pr-visual-recap-source-${{ github.event.pull_request.number }}\\n          path: |\\n            recap-source.json\\n            claude-result.json\\n            claude-stderr.log\\n            codex-events.jsonl\\n            codex-stderr.log\\n          if-no-files-found: ignore\\n          retention-days: 14\\n\\n      - name: Upsert sticky comment\\n        if: always() && !cancelled()\\n        continue-on-error: true\\n        env:\\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\\n          RECAP_IMAGE_URL: ${{ steps.shot.outputs.image_url }}\\n          RECAP_LIGHT_IMAGE_URL: ${{ steps.shot.outputs.light_image_url }}\\n          RECAP_DARK_IMAGE_URL: ${{ steps.shot.outputs.dark_image_url }}\\n          SUPPRESSED: ${{ steps.scan.outputs.suppressed }}\\n          SUPPRESSED_JSON: ${{ steps.scan.outputs.json }}\\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\\n          DIFF_TINY: ${{ steps.diff.outputs.tiny }}\\n          PREV_PLAN_ID: ${{ steps.prev.outputs.plan_id }}\\n          RECAP_AUTH_FAILED: ${{ steps.auth_probe.outputs.auth_failed }}\\n          RECAP_AGENT_SUMMARY: ${{ steps.agent_summary.outputs.summary }}\\n          # Prefer the route-health diagnostic when the plan app routes are not\\n          # yet deployed so the comment explains the 404 instead of a generic\\n          # \"recap-url.txt was not created\" message.\\n          RECAP_URL_REASON: ${{ steps.route_health.outputs.reason || steps.url.outputs.reason }}\\n        run: |\\n          set -euo pipefail\\n          $RECAP_CLI recap comment upsert --repo \"$GITHUB_REPOSITORY\" --issue \"$PR_NUMBER\" --token \"$GH_TOKEN\" --head-sha \"$HEAD_SHA\"\\n\\n      - name: Complete visual recap check\\n        if: always() && !cancelled() && steps.recap_check.outputs.check_run_id != \\'\\'\\n        continue-on-error: true\\n        env:\\n          # Untrusted/step values via env (NOT ${{ }}-interpolated into the run\\n          # body): the agent-written plan URL and the scan JSON could inject shell.\\n          CHECK_RUN_ID: ${{ steps.recap_check.outputs.check_run_id }}\\n          PLAN_OK: ${{ steps.url.outputs.ok }}\\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\\n          SUPPRESSED: ${{ steps.scan.outputs.suppressed }}\\n          SUPPRESSED_JSON: ${{ steps.scan.outputs.json }}\\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\\n          DIFF_TINY: ${{ steps.diff.outputs.tiny }}\\n          RECAP_AGENT_SUMMARY: ${{ steps.agent_summary.outputs.summary }}\\n          RECAP_URL_REASON: ${{ steps.route_health.outputs.reason || steps.url.outputs.reason }}\\n        run: |\\n          set -uo pipefail\\n          $RECAP_CLI recap check complete \\\\\\n            --check-run-id \"$CHECK_RUN_ID\" \\\\\\n            --plan-ok \"$PLAN_OK\" \\\\\\n            --plan-url \"$PLAN_URL\" \\\\\\n            --suppressed \"$SUPPRESSED\" \\\\\\n            --suppressed-json \"$SUPPRESSED_JSON\" \\\\\\n            --huge \"$DIFF_HUGE\" \\\\\\n            --tiny \"$DIFF_TINY\" \\\\\\n            --failure-summary \"$RECAP_AGENT_SUMMARY\" \\\\\\n            --url-reason \"$RECAP_URL_REASON\" \\\\\\n            --workflow-url \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID\"\\n';\n"]}

package/dist/cli/recap.d.ts

@@ -298,6 +298,11 @@ export declare function publishRecapSource(input: {
     repo?: string;
     pr?: string;
     sourceUrl?: string;
+    sourceType?: string;
+    sourceRepo?: string;
+    sourcePrNumber?: string;
+    sourcePrState?: string;
+    sourcePrMergedAt?: string;
     fetchFn?: typeof fetch;
     cwd?: string;
 }): Promise<{

package/dist/cli/recap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recap.d.ts","sourceRoot":"","sources":["../../src/cli/recap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AA4DH,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,EAAE,MAAM,EAUzC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,+DAA+D;AAC/D,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAChC,mBAAmB,CAsBrB;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CACX,GACL,MAAM,CAwCR;AAKD,4EAA4E;AAC5E,wBAAgB,wCAAwC,CACtD,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IACP,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CACX,GACL,mBAAmB,CA2BrB;AAID,KAAK,eAAe,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE1C,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAC;AAI5C,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,CAOzE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE,CAKhE;AAuJD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAClD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,cAAc,CAsCjB;AAkQD,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAEvE,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,mBAAmB,CAKrB;AAQD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,mBAAuC,GAC5C,OAAO,CAET;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,MAAM,GACpB,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CA0BxB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,GAChC,OAAO,CAST;AAED,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAM,EACtC,IAAI,GAAE,mBAAuC,GAC5C,OAAO,CAeT;AAUD,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,MAAgC,GACzC,MAAM,CAyBR;AA2CD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GACjB,MAAM,CA8DR;AASD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CAoBT;AAoCD,wBAAgB,0BAA0B,CACxC,KAAK,GAAE;IACL,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CACX,GACL,MAAM,CAqBR;AAMD,8DAA8D;AAC9D,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C,oEAAoE;AACpE,eAAO,MAAM,2BAA2B,wDACe,CAAC;AAyBxD;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAKnC;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA2CxD;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAU/D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOvD;AA4HD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAsB,GAAG;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAgBA;AAED,KAAK,oBAAoB,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAkEvD,wBAAgB,0BAA0B,CACxC,GAAG,GAAE,MAAsB,EAC3B,IAAI,GAAE,oBAA6B,GAClC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAKlC;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;gFAC4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CA6HT;AAcD,KAAK,oBAAoB,GAAG,OAAO,GAAG,MAAM,CAAC;AAE7C,KAAK,aAAa,GAAG;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CACxC,CAAC;AAqCF,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAkB1B;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAoBhC;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qDAAqD;IACrD,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC,CAuCD;AAoCD,qEAAqE;AACrE,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAkI7E;AA0FD,KAAK,sBAAsB,GAAG;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B,CAAC;AAkEF,wBAAgB,sBAAsB,CACpC,QAAQ,GAAE,MAA8B,GACvC,sBAAsB,CAqBxB;AAaD,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAQrD;AAwED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAmGlD;AA8ED;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,GAAG,OAAO,CAAC,OAAO,CAAC,CA0BnB;AAED,iFAAiF;AACjF,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,uBAAuB,CAAC;CACzC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA+CzB;AAYD,KAAK,gBAAgB,GAAG;IAAE,QAAQ,EAAE,OAAO,YAAY,EAAE,WAAW,CAAA;CAAE,CAAC;AAwBvE,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,OAAO,YAAY,EAAE,WAAW,GACzC,OAAO,CAAC,OAAO,YAAY,EAAE,OAAO,CAAC,CAqCvC;AAgBD,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,oBAAoB,CAAA;CAAO,GAC7C,MAAM,CAcR;AAED,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;AACtC,kEAAkE;AAClE,gBAAgB,GAAE,MAAM,OAAO,CAAC,gBAAgB,CAA2B,GAC1E,OAAO,CAAC,IAAI,CAAC,CA8Nf;AA8FD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9D,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CAC/D;AAED,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,EAAE,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAChC,wCAAwC;IACxC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,gCAAgC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,iCAAiC;IACjC,YAAY,EAAE,OAAO,CAAC;IACtB,8BAA8B;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,uDAAuD;IACvD,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,gFAAgF;IAChF,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,kEAAkE;IAClE,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAiBD,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,MAAM,EACT,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACrC,OAAO,CAiBT;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG;IACxD,GAAG,EAAE,OAAO,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CA4FA;AAgLD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAG3E;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CAMjD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,MAAM,CAQR;AAOD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAiBxE;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,GAAE;IACL,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACZ,GACL,MAAM,CAoCR;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAUT;AAED,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC,gFAAgF;IAChF,MAAM,EAAE,OAAO,CAAC;IAChB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,IAAI,EAAE,OAAO,CAAC;IACd,iEAAiE;IACjE,IAAI,EAAE,OAAO,CAAC;IACd,6EAA6E;IAC7E,UAAU,EAAE,OAAO,CAAC;IACpB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,kEAAkE;AAClE,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,sBAAsB,GAC5B,iBAAiB,CAqDnB;AAgLD,UAAU,WAAW;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAwBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAmBnE;AA2BD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAajE;AA4LD,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAqD5D"}
+{"version":3,"file":"recap.d.ts","sourceRoot":"","sources":["../../src/cli/recap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AA4DH,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,EAAE,MAAM,EAUzC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,+DAA+D;AAC/D,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAChC,mBAAmB,CAsBrB;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CACX,GACL,MAAM,CAwCR;AAKD,4EAA4E;AAC5E,wBAAgB,wCAAwC,CACtD,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IACP,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CACX,GACL,mBAAmB,CA2BrB;AAID,KAAK,eAAe,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE1C,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAC;AAI5C,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,CAOzE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE,CAKhE;AAuJD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAClD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,cAAc,CAsCjB;AAkQD,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAEvE,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,mBAAmB,CAKrB;AAQD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,mBAAuC,GAC5C,OAAO,CAET;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,MAAM,GACpB,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CA0BxB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,GAChC,OAAO,CAST;AAED,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAM,EACtC,IAAI,GAAE,mBAAuC,GAC5C,OAAO,CAeT;AAUD,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,MAAgC,GACzC,MAAM,CAyBR;AA2CD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GACjB,MAAM,CA8DR;AASD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CAoBT;AAoCD,wBAAgB,0BAA0B,CACxC,KAAK,GAAE;IACL,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CACX,GACL,MAAM,CAqBR;AAMD,8DAA8D;AAC9D,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C,oEAAoE;AACpE,eAAO,MAAM,2BAA2B,wDACe,CAAC;AAyBxD;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAKnC;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA2CxD;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAU/D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOvD;AA4HD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAsB,GAAG;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAgBA;AAED,KAAK,oBAAoB,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAkEvD,wBAAgB,0BAA0B,CACxC,GAAG,GAAE,MAAsB,EAC3B,IAAI,GAAE,oBAA6B,GAClC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAKlC;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;gFAC4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CA6HT;AAcD,KAAK,oBAAoB,GAAG,OAAO,GAAG,MAAM,CAAC;AAE7C,KAAK,aAAa,GAAG;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CACxC,CAAC;AAqCF,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAkB1B;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAoBhC;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qDAAqD;IACrD,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC,CAuCD;AAoCD,qEAAqE;AACrE,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAkI7E;AA0FD,KAAK,sBAAsB,GAAG;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B,CAAC;AAkEF,wBAAgB,sBAAsB,CACpC,QAAQ,GAAE,MAA8B,GACvC,sBAAsB,CAqBxB;AAaD,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAQrD;AAwED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAiHlD;AAmFD;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,GAAG,OAAO,CAAC,OAAO,CAAC,CA0BnB;AAED,iFAAiF;AACjF,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,uBAAuB,CAAC;CACzC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA+CzB;AAYD,KAAK,gBAAgB,GAAG;IAAE,QAAQ,EAAE,OAAO,YAAY,EAAE,WAAW,CAAA;CAAE,CAAC;AAwBvE,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,OAAO,YAAY,EAAE,WAAW,GACzC,OAAO,CAAC,OAAO,YAAY,EAAE,OAAO,CAAC,CAqCvC;AAgBD,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,oBAAoB,CAAA;CAAO,GAC7C,MAAM,CAcR;AAED,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;AACtC,kEAAkE;AAClE,gBAAgB,GAAE,MAAM,OAAO,CAAC,gBAAgB,CAA2B,GAC1E,OAAO,CAAC,IAAI,CAAC,CA8Nf;AA8FD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9D,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CAC/D;AAED,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,EAAE,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAChC,wCAAwC;IACxC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,gCAAgC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,iCAAiC;IACjC,YAAY,EAAE,OAAO,CAAC;IACtB,8BAA8B;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,uDAAuD;IACvD,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,gFAAgF;IAChF,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,kEAAkE;IAClE,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAiBD,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,MAAM,EACT,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACrC,OAAO,CAiBT;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG;IACxD,GAAG,EAAE,OAAO,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CA4FA;AAgLD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAG3E;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CAMjD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,MAAM,CAQR;AAOD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAiBxE;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,GAAE;IACL,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACZ,GACL,MAAM,CAoCR;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAUT;AAED,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC,gFAAgF;IAChF,MAAM,EAAE,OAAO,CAAC;IAChB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,IAAI,EAAE,OAAO,CAAC;IACd,iEAAiE;IACjE,IAAI,EAAE,OAAO,CAAC;IACd,6EAA6E;IAC7E,UAAU,EAAE,OAAO,CAAC;IACpB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,kEAAkE;AAClE,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,sBAAsB,GAC5B,iBAAiB,CAqDnB;AAgLD,UAAU,WAAW;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAwBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAmBnE;AA2BD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAajE;AA4LD,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAqD5D"}

package/dist/cli/recap.js

@@ -139,7 +139,7 @@ export function buildReusableCallerWorkflow(options = {}) {
         `\n` +
         `on:\n` +
         `  pull_request:\n` +
-        `    types: [opened, synchronize, reopened, ready_for_review]\n` +
+        `    types: [opened, synchronize, reopened, ready_for_review, closed]\n` +
         `\n` +
         `jobs:\n` +
         `  visual-recap:\n` +
@@ -1723,6 +1723,11 @@ export async function publishRecapSource(input) {
         (input.repo && input.pr
             ? `https://github.com/${input.repo}/pull/${input.pr}`
             : undefined);
+    const sourceRepo = input.sourceRepo ?? input.repo;
+    const sourcePrNumber = input.sourcePrNumber ?? input.pr;
+    const sourceType = input.sourceType ??
+        (sourceRepo && sourcePrNumber ? "pull-request" : undefined);
+    const sourcePrState = input.sourcePrState ?? (input.sourcePrMergedAt ? "merged" : undefined);
     const idempotencyKey = recapPublishIdempotencyKey({
         prevPlanId: input.prevPlanId,
         repo: input.repo,
@@ -1739,6 +1744,13 @@ export async function publishRecapSource(input) {
         source: "imported",
         ...(input.repo ? { repoPath: input.repo } : {}),
         ...(sourceUrl ? { sourceUrl } : {}),
+        ...(sourceType ? { sourceType } : {}),
+        ...(sourceRepo ? { sourceRepo } : {}),
+        ...(sourcePrNumber ? { sourcePrNumber } : {}),
+        ...(sourcePrState ? { sourcePrState } : {}),
+        ...(input.sourcePrMergedAt
+            ? { sourcePrMergedAt: input.sourcePrMergedAt }
+            : {}),
         currentFocus: "visual recap review",
         status: "review",
         mdx: source.mdx,
@@ -1841,6 +1853,11 @@ async function runPublish(args) {
             repo: optionalArg(args, "repo") ?? process.env.GITHUB_REPOSITORY,
             pr: optionalArg(args, "pr") ?? process.env.PR_NUMBER,
             sourceUrl: optionalArg(args, "source-url"),
+            sourceType: optionalArg(args, "source-type"),
+            sourceRepo: optionalArg(args, "source-repo"),
+            sourcePrNumber: optionalArg(args, "source-pr-number"),
+            sourcePrState: optionalArg(args, "source-pr-state"),
+            sourcePrMergedAt: optionalArg(args, "source-pr-merged-at"),
         });
         writeGitHubOutput("ok", "true");
         writeGitHubOutput("plan_url", result.url);
@@ -3090,7 +3107,7 @@ Usage:
   npx @agent-native/core@latest recap block-reference [--app-url <url>] [--out recap-blocks.md]
   npx @agent-native/core@latest recap scan --diff <path> [--mode off|high-confidence|strict]
   npx @agent-native/core@latest recap build-prompt --pr <n> [--repo owner/name] [--head <sha>] [--app-url <url>] [--diff <path>] [--stat <path>] [--block-reference recap-blocks.md] [--prev-plan-id <id>] [--huge] [--local-files] [--local-dir <folder>] [--skill-source auto|latest|repo] [--out <path>]
-  npx @agent-native/core@latest recap publish [--source recap-source.json] [--out recap-url.txt] [--repo owner/name] [--pr <n>] [--prev-plan-id <id>] [--app-url <url>] [--token <planToken>]
+  npx @agent-native/core@latest recap publish [--source recap-source.json] [--out recap-url.txt] [--repo owner/name] [--pr <n>] [--prev-plan-id <id>] [--source-pr-state open|closed|merged] [--source-pr-merged-at <iso>] [--app-url <url>] [--token <planToken>]
   npx @agent-native/core@latest recap shot --url <planUrl> [--token <planToken>] [--app-url <url>] [--out recap.png] [--theme light|dark]
   npx @agent-native/core@latest recap usage --plan-url <planUrl> --result-file <path> --app-url <url> --token <planToken> [--agent claude|codex] [--model <id>]
   npx @agent-native/core@latest recap agent-summary --result-file <path> [--stderr-file <path>] [--exit-code-file <path>] [--agent claude|codex]