@coreplane/switchboard 1.235.0 → 1.237.0

package/dist/assets/src/core/authz/types.ts

@@ -47,6 +47,16 @@ export interface Actor {
   readonly onBehalfOf?: Actor;
   /** Where a chat actor is speaking from — context, never authority. */
   readonly origin?: { readonly channelId: string; readonly threadKey: string };
+  /**
+   * The ids that mean "me" for this actor (record 0042): its own `id` first,
+   * then the person it is linked to — a dashboard session whose Access email
+   * names one Slack user carries that `slack:U…` id here. Read by `is-self`,
+   * `acts-as-person`, the `me` tier and the "mine" filters; NEVER by a grant
+   * check — the link is identity, not authority. Absent → `[id]`.
+   */
+  readonly self?: readonly string[];
+  /** The linked person, for display and the audit line (`asUser`); absent when unlinked. */
+  readonly asUser?: { readonly id: string; readonly name?: string };
 }
 
 /** `<group>:<read|write|exec>` plus the non-command actions. A plain
@@ -103,8 +113,12 @@ export type Condition =
    *  resource's channel is `public` (a run's stamped `channelVisibility`;
    *  `unknown` is never public). One definition for both evaluators. */
   | { readonly kind: "member-of" }
-  /** resource.userId === actor.id (or the on-behalf-of principal's id). */
+  /** resource.userId is one of the principal's `self` ids (its own id, or the person it is linked to). */
   | { readonly kind: "is-self" }
+  /** The principal's `self` names a chat identity (`slack:U…`): every chat
+   *  actor, and a dashboard session linked to its person (record 0042) — never
+   *  an unlinked browser session or a credential. */
+  | { readonly kind: "acts-as-person" }
   /** actor.grants.repos contains the resource's repo (or is "all"). */
   | { readonly kind: "owner-of" }
   /** actor.grants.channels === "all". */

package/dist/assets/src/core/coordinator/contract.ts

@@ -55,6 +55,18 @@ export function parseUnitKey(key: string): { instanceId: string; unit: string }
   return { instanceId: key.slice(0, at), unit: key.slice(at + 1) };
 }
 
+/** The unit an idempotency key names — the head of its step
+ *  (`<instance>:<unit>/<round>/<kind>` for the plan runner), or undefined for
+ *  a key whose step carries no unit prefix the unit pattern accepts. What the
+ *  `coordinator_tag` run event stamps as `unit`, so a run's stream names the
+ *  unit it ran for without parsing the key back. */
+export function unitOfIdempotencyKey(key: string): string | undefined {
+  if (!IDEMPOTENCY_KEY_PATTERN.test(key)) return undefined;
+  const step = key.slice(key.indexOf(":") + 1);
+  const head = step.split("/")[0];
+  return UNIT_PATTERN.test(head) ? head : undefined;
+}
+
 /** The event a child's terminal record sends its parent: the type carries the
  *  run id, so each `waitForEvent` matches its own child and a duplicate is
  *  buffered harmlessly. An event type is the platform's alphabet — letters,
@@ -85,10 +97,12 @@ export interface CoordinatorTag {
    *  (`CoordinatorInstance.base`), set by the spawn when the instance knows it.
    *  A coordinator's child is dispatched AT its unit branch so the resident
    *  attaches there, which makes the binding ref the branch itself — no base
-   *  the post-step could resolve from the thread — so the spawn says it. An
-   *  instruction to the run like `DispatchOptions.contract`, not a fact about
-   *  it: the fact the record keeps is the `pr_opened` it leads to, and
-   *  `coordinatorFields` leaves it off the rows. */
+   *  the post-step could resolve from the thread — so the spawn says it.
+   *  Published as the run's own `coordinator_tag` event at dispatch
+   *  (run-history item 48a), so a run re-attached after a bot roll — whose
+   *  dispatch options are gone with the process that spawned it — reads it
+   *  back off its ledger events; `coordinatorFields` still leaves it off the
+   *  rows, so rows and records keep the shape written before it existed. */
   base?: string;
 }
 
@@ -182,6 +196,11 @@ export interface CoordinatorUnit {
    *  — no pre-check, no branch, no round 0. A task string's row only; written by
    *  the hand-off, read by the driver into the machine's input. */
   resume?: { pr: number; headSha?: string; url?: string };
+  /** The head the unit's own coding child last pushed, recorded when the unit
+   *  ended `review_pending` (the wall clock capped after the pull request was
+   *  opened or updated): the next attempt's pre-check starts at the review
+   *  round when the open pull request still heads exactly here. */
+  lastPush?: string;
   /** The round boundaries the coordinator reported, oldest first (the `ship_round` vocabulary). */
   rounds: Array<{ index: number; agent: string; outcome: string; at: number }>;
   /** How the unit ended: the ending's kind and the thread's report, when it has. */
@@ -244,6 +263,7 @@ export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
   if (r.issue !== undefined && !isFinite(r.issue)) return false;
   if (r.pr !== undefined && !isPr(r.pr)) return false;
   if (r.resume !== undefined && !isResume(r.resume)) return false;
+  if (r.lastPush !== undefined && !isText(r.lastPush)) return false;
   if (
     !Array.isArray(r.rounds) ||
     r.rounds.length > MAX_ROUNDS ||

package/dist/assets/src/core/coordinator/driver.ts

@@ -274,7 +274,18 @@ function readRecordReturn(step: string, a: BotAnswer): StepReturn {
 
 function prCheckReturn(step: string, a: BotAnswer): StepReturn {
   const { ok, state, prNumber, url, headSha, sha, mergedAt, at } = a.body;
-  if (ok === true && state === "none") return { type: "pr-check", step, pr: { state: "none" }, at };
+  if (ok === true && state === "none") {
+    const { unrecovered } = a.body;
+    return {
+      type: "pr-check",
+      step,
+      pr: {
+        state: "none",
+        ...(unrecovered === "no_commits" || unrecovered === "no_base" ? { unrecovered } : {}),
+      },
+      at,
+    };
+  }
   if (ok === true && state === "open" && typeof prNumber === "number" && typeof url === "string")
     return {
       type: "pr-check",
@@ -303,7 +314,11 @@ function prCheckReturn(step: string, a: BotAnswer): StepReturn {
 }
 
 function mergeReturn(step: string, a: BotAnswer): StepReturn {
-  const { ok, outcome, sha, reason, at } = a.body;
+  const { ok, outcome, by, sha, mergedAt, reason, at } = a.body;
+  // The door found the pull request already merged after the approval: the
+  // merge commit and the time ride the answer, and the unit ends `by: other`.
+  if (ok === true && outcome === "merged" && by === "other" && typeof sha === "string" && typeof mergedAt === "string")
+    return { type: "merge", step, outcome: "merged", by: "other", sha, mergedAt, at };
   if (ok === true && outcome === "merged" && typeof sha === "string")
     return { type: "merge", step, outcome: "merged", sha, at };
   if (ok === true && (outcome === "pending" || outcome === "refused") && typeof reason === "string")
@@ -389,9 +404,16 @@ async function perform(
         ),
       );
     case "pr-check":
+      // `recover` rides only after a dead coding child: the bot opens the pull
+      // request from the pushed branch itself instead of answering `none`.
       return prCheckReturn(
         action.step,
-        answerOf("pr-check", await step.do(action.step, STEP_CONFIG, () => call(bot, "pr-check", tag))),
+        answerOf(
+          "pr-check",
+          await step.do(action.step, STEP_CONFIG, () =>
+            call(bot, "pr-check", { ...tag, ...(action.recover !== undefined ? { recover: action.recover } : {}) }),
+          ),
+        ),
       );
     case "sleep":
       await step.sleep(action.step, action.ms);
@@ -426,7 +448,11 @@ async function runUnit(
   // A resume at review (agent-ship item 10) rides the unit's row: the pull
   // request of ship's own the requester named opens the pipeline at its first
   // review round, with no pre-check, no branch and no round 0.
-  const resume = plan.units.find((u) => u.unit === unit)?.resume;
+  const row = plan.units.find((u) => u.unit === unit);
+  const resume = row?.resume;
+  // A previous attempt's `review_pending` head: the machine's pre-check starts
+  // at the review round when the open pull request still heads exactly there.
+  const lastPush = row?.lastPush;
   let state: UnitPipelineState = openUnitPipeline(
     {
       unit: { id: unit, branch: node.branch },
@@ -441,6 +467,7 @@ async function runUnit(
       merge: plan.merge,
       generated: plan.generated,
       ...(resume !== undefined ? { resume } : {}),
+      ...(lastPush !== undefined ? { lastPush } : {}),
     },
     start.at,
   );
@@ -486,6 +513,11 @@ async function runUnit(
           ...tag,
           ending: { kind: note.ending.kind, report: renderUnitReport(state, endFacts) },
           ...(state.pr !== undefined ? { pr: state.pr } : {}),
+          // A review_pending ending names the child's own last push so the next
+          // attempt's pre-check can start at the review round (the row's lastPush).
+          ...(note.ending.kind === "review_pending" && note.ending.headSha !== undefined
+            ? { headSha: note.ending.headSha }
+            : {}),
           ...(state.lastCodingRunId !== undefined ? { codingRunId: state.lastCodingRunId } : {}),
         };
         await step.do(`${unit}/end`, STEP_CONFIG, () => call(bot, "unit-end", body));

package/dist/assets/src/core/runEvents.ts

@@ -76,13 +76,17 @@ export type RunNoteKind =
    *  wait had refused; on pi the container is provisioned before pi starts, so
    *  the note is a record fact from before the loop's deletion. */
   | "fleet_busy"
-  /** The container the run's pi ran in was replaced under the live run
+  /** The container the run's process ran in was replaced under the live run
    *  (docs/reference/specs/harness-pi.md item 16; the resident's roll,
-   *  resident-repos.md item 65): the harness settled the call in flight with
-   *  the restart note, the summary names both containers, and the run ends
-   *  `interrupted` for a restart from its request. On a record from before the
-   *  native loop's deletion the note says that loop's settlement instead: the
-   *  executor waited for the wake and the run went on. */
+   *  resident-repos.md item 65). The harness's note is the verdict: the call
+   *  in flight settled with the restart note, the summary naming both
+   *  containers. The run loop then decides between two outcomes (harness.md
+   *  item 6): a relaunch in the replacement, said in a `resumed` note, or —
+   *  the relaunch refused by name, the ceiling among them — a second note of
+   *  this kind saying why and that the run closes `interrupted` for a restart
+   *  from its request. On a record from before the native loop's deletion the
+   *  note says that loop's settlement instead: the executor waited for the
+   *  wake and the run went on. */
   | "sandbox_restarted"
   | "stop_requested"
   | "stopped"
@@ -356,6 +360,21 @@ export interface SpanEndEvent {
   at?: number;
 }
 
+/** A value a `route` event may carry in a bound command input: JSON, nested
+ *  at most three objects deep under `options`, and nothing else. The record
+ *  crosses the run store's RPC boundary, whose typing walks every field: a
+ *  field of `unknown` types the whole record `never`, and a recursive alias is
+ *  "excessively deep" to it, so the nesting is spelled out level by level. The
+ *  model's tool call is JSON to begin with; the registry's option schemas nest
+ *  one object deep (`models.coding`); a deeper value is stored as its JSON
+ *  text, still redacted and capped. */
+export type RouteInputLeaf = string | number | boolean | null;
+export type RouteInputLeafOrList = RouteInputLeaf | ReadonlyArray<RouteInputLeaf>;
+export type RouteInputObject1 = { readonly [key: string]: RouteInputLeafOrList };
+export type RouteInputObject2 = { readonly [key: string]: RouteInputLeafOrList | RouteInputObject1 };
+export type RouteInputObject3 = { readonly [key: string]: RouteInputLeafOrList | RouteInputObject2 };
+export type RouteInputValue = RouteInputLeafOrList | RouteInputObject3;
+
 export type RunEvent =
   /** `callId` is the provider's tool_use id — the explicit pair key between a
    *  call and its result (live-view item 13); the runner stamps it on both. */
@@ -635,6 +654,16 @@ export type RunEvent =
       seq?: number;
       at?: number;
     }
+  /** The coordinator tag as a fact of the run (docs/reference/specs/run-history.md
+   *  item 48a): the instance the run is a child of, the unit its idempotency
+   *  key named, and the base branch its pull request targets — published by
+   *  the dispatcher once at dispatch, from `DispatchOptions.coordinator`, so
+   *  a run re-attached or restarted after a bot roll (whose spawn options are
+   *  gone with the process) reads the plan's base back off its own events
+   *  instead of letting the binding ref — the unit branch itself — stand in.
+   *  `base` is absent when the spawn knew none; the post-step then falls to
+   *  the coordinator store's `instance.base`. Additive: unknown → ignored. */
+  | { type: "coordinator_tag"; parentInstanceId: string; unit?: string; base?: string; seq?: number; at?: number }
   /** The review post-step's outcome when the verdict landed
    *  (docs/reference/specs/agent-review.md item 18): the pull request it was
    *  posted to, the head it was pinned to (the carried head after a rebase,
@@ -679,7 +708,14 @@ export type RunEvent =
    *  `run_meta.agentSource` stays `default`). Published by the dispatcher
    *  straight to the registry right after `run_meta`, once per run the router
    *  answered; absent on every run a directive, a sticky preset or a scope
-   *  chose. Head material, like `run_meta`. Additive: unknown → ignored. */
+   *  chose. Head material, like `run_meta`. Additive: unknown → ignored.
+   *  A command the router bound from prose (record 0036: the door offers every
+   *  chat command as a tool beside `route`) rides the command run's record
+   *  instead, right after its `run_meta`: `preset` is the command run's agent
+   *  (`command`), `command` the id the model called, `input` the bound input
+   *  (redacted, each value capped) and `receipt` the chat form the reply led
+   *  with (`routed: <chat form>`, redacted and capped at `ROUTE_RECEIPT_CAP`);
+   *  how the invoke ended is the run's own status and `answer`. */
   | {
       type: "route";
       preset: string;
@@ -687,6 +723,9 @@ export type RunEvent =
       model: string;
       parts?: ReadonlyArray<{ preset: string; text: string }>;
       collapsed?: { presets: ReadonlyArray<string> };
+      command?: string;
+      input?: { readonly [key: string]: RouteInputValue };
+      receipt?: string;
       seq?: number;
       at?: number;
     }

package/dist/assets/src/core/runFriction.ts

@@ -421,6 +421,7 @@ export function analyzeRunFriction(events: readonly RunEvent[], opts: FrictionOp
       ev.type === "review_artifact" ||
       ev.type === "pr_description" ||
       ev.type === "pr_opened" ||
+      ev.type === "coordinator_tag" ||
       ev.type === "review_posted" ||
       ev.type === "ship_round" ||
       ev.type === "route" ||

package/dist/assets/src/core/ship/contract.ts

@@ -427,7 +427,9 @@ function renderFirstInstruction(rebase: ChildContract["rebase"]): string {
   const onto = rebase.onto ? `\`${rebase.onto}\`` : "the merged parent";
   return (
     `Rebase ${branch} onto ${onto} before any other work — the parent unit has merged and the base has moved; ` +
-    `the only writes are your own on that branch. A conflict ends the unit: report it as the handoff and stop.`
+    `the only writes are your own on that branch. A conflict ends the unit: report it as the handoff and stop. ` +
+    `Right before the push, fetch ${onto} again and rebase once more if it moved during verify, ` +
+    `so the pull request is not born conflicting.`
   );
 }