@coreplane/switchboard 1.264.0 → 1.265.0

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.264.0",
+  "version": "1.265.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.264.0",
+      "version": "1.265.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -21060,7 +21060,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.264.0",
+      "version": "1.265.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.264.0",
+  "version": "1.265.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.264.0",
-  "commit": "3f965ac7812604e62bd3e7df613ccf72ee665615",
-  "builtAt": "2026-09-26T02:38:42.181Z"
+  "version": "1.265.0",
+  "commit": "39607a27b4b5751330311c08f9068a6bc007ca80",
+  "builtAt": "2026-09-26T04:13:47.389Z"
 }

package/dist/assets/src/core/ship/coordinator.ts

@@ -1998,10 +1998,12 @@ function settleCoding(
   // final observed head. Only then may a fresh remote read decide readiness.
   if (round.kind === "findings" && facts.status === "completed") {
     const issued = next.findingsByRound[round.index] ?? [];
-    const matched = matchDispositions(issued, facts.dispositions ?? []).matched;
+    const { matched, dropped } = matchDispositions(issued, facts.dispositions ?? []);
     const missingOutputs = issued
       .filter((finding) => !matched.some((disposition) => disposition.findingId === finding.id))
       .map((finding) => `missing disposition for ${finding.id}`);
+    if (missingOutputs.length > 0 && dropped.length > 0)
+      missingOutputs.push(`submitted IDs with no matching finding: ${dropped.join(", ")}`);
     if (facts.description !== true) missingOutputs.push("missing updated pull request description");
     const observedHead = fullHead(facts.headSha);
     if (observedHead === undefined) missingOutputs.push("missing final observed commit");

package/dist/cli.js

@@ -36722,13 +36722,16 @@ async function resolveRepoContext(msg, history = [], probe, residentSlugs, recor
     rejected = void 0;
     unverified = void 0;
   }
+  const bareNumberText = !s.pr && repo === records?.pr?.repo ? /\b(?:PR|pull request)\s*#(\d+)\b/i.exec(unwrapSlack(msg.text).replace(CODE_SPAN, " "))?.[1] : void 0;
+  const bareNumber = bareNumberText === void 0 ? void 0 : Number(bareNumberText);
+  const namedPr = s.pr ?? (repo && bareNumber !== void 0 && Number.isSafeInteger(bareNumber) && bareNumber > 0 ? { repo, number: bareNumber } : void 0);
   let headSha;
   let baseRef;
   let prSize;
   let facts2;
   let closedPr;
-  if (s.pr && repo === s.pr.repo) {
-    const head = await prHead(s.pr).catch(() => void 0);
+  if (namedPr && repo === namedPr.repo) {
+    const head = await prHead(namedPr).catch(() => void 0);
     if (head?.ref && head.state === "open") {
       ref = head.ref;
       refFromPr = true;
@@ -36739,7 +36742,7 @@ async function resolveRepoContext(msg, history = [], probe, residentSlugs, recor
     facts2 = head?.facts;
     if (head?.state === "closed")
       closedPr = {
-        number: s.pr.number,
+        number: namedPr.number,
         merged: head.merged,
         ...head.mergedAt !== void 0 ? { mergedAt: head.mergedAt } : {}
       };
@@ -36750,16 +36753,16 @@ async function resolveRepoContext(msg, history = [], probe, residentSlugs, recor
   else if (rejected) out.rejectedRepo = rejected;
   if (ref) out.ref = ref;
   if (refFromPr) out.refFromPr = true;
-  if (repo && s.pr && repo === s.pr.repo) {
-    out.pr = s.pr.number;
+  if (repo && namedPr && repo === namedPr.repo) {
+    out.pr = namedPr.number;
     out.prFromMessage = true;
-    if (isThreadOwnPr(records, repo, s.pr.number)) out.prIsThreadOwn = true;
+    if (isThreadOwnPr(records, repo, namedPr.number)) out.prIsThreadOwn = true;
     if (headSha) out.headSha = headSha;
     if (baseRef) out.baseRef = baseRef;
     if (prSize) out.prSize = prSize;
     if (facts2) out.prDescription = facts2;
     if (closedPr) out.closedPr = closedPr;
-  } else if (repo && !s.pr) {
+  } else if (repo && !namedPr) {
     const inherited = inheritedPr(thread, records, repo);
     if (inherited) {
       const head = await openPrHeadSha(inherited);
@@ -40793,6 +40796,7 @@ async function ownerOf2(runs, unitsOf, threadKey) {
   if (live !== void 0) return { kind: "live", run: live };
   const hosted = runs.find((r) => !r.finished && r.hosted === true);
   const instanceId = instanceOf(runs);
+  let releasedPr;
   if (instanceId !== void 0) {
     const units = await unitsOf(instanceId).catch(() => []);
     const unit = units.find((u) => u.threadKey === threadKey && u.ending === void 0);
@@ -40807,11 +40811,19 @@ async function ownerOf2(runs, unitsOf, threadKey) {
     if (ended.length === 1 && ship !== void 0) return { kind: "pipeline", instanceId, run: ship, unit: ended[0] };
     if (ended.length > 1 && ship !== void 0)
       return { kind: "pipeline_ambiguous", instanceId, run: ship, units: ended };
+    const released = units.filter((u) => {
+      const binding = u.publication;
+      return u.threadKey === threadKey && u.instanceId === instanceId && u.ending?.kind === "merge_ready" && binding !== void 0 && u.pr?.number === binding.pr && u.branch === binding.headRef && u.branch === binding.publicationRef && binding.owner.instanceId === instanceId && binding.owner.unit === u.unit && (u.lastPush === void 0 || u.lastPush === binding.expectedHeadSha);
+    });
+    if (released.length === 1) {
+      const unit2 = released[0];
+      releasedPr = { repo: unit2.publication.repo, number: unit2.publication.pr, at: unit2.ending.at };
+    }
   }
   if (hosted !== void 0) return { kind: "live", run: hosted };
   const agent = stickyAgentOf(runs);
-  if (agent !== void 0) return { kind: "session", agent };
-  return { kind: "none" };
+  if (agent !== void 0) return { kind: "session", agent, ...releasedPr ? { releasedPr } : {} };
+  return { kind: "none", ...releasedPr ? { releasedPr } : {} };
 }
 async function shipRequestOf(service, runId3) {
   const result = await service.getRun(runId3, { include: "messages" }).catch(() => void 0);
@@ -46062,7 +46074,7 @@ var init_submit = __esm({
     submitDispositionsTool = {
       name: "submit_dispositions",
       failsInText: true,
-      description: "Record one disposition per review finding after addressing them: `fixed` (the finding is addressed in your pushed code) or `declined` (deliberately not doing it \u2014 the note says why). `findingId` is the finding's stable id from the review (F1, F2, \u2026) \u2014 use exactly those ids; an id the review never issued answers nothing and is dropped when the plan runner reads your record. Every finding gets exactly one entry, every severity included (nits too). Call it once with the complete set after your last push; a later call replaces the earlier one. The set rides this run's record, where the plan runner reads it for the re-review.",
+      description: "Record one disposition per review finding after addressing them: `fixed` (the finding is addressed in your pushed code) or `declined` (deliberately not doing it \u2014 the note says why). `findingId` is the finding's stable id printed in the findings. Copy it exactly, including check ids such as `check:CI / checks (test)`; do not replace a check id with `F1`. An id the review never issued answers nothing and is dropped when the plan runner reads your record. Every finding gets exactly one entry, every severity included (nits too). Call it once with the complete set after your last push; a later call replaces the earlier one. The set rides this run's record, where the plan runner reads it for the re-review.",
       inputSchema: {
         type: "object",
         properties: {
@@ -46072,7 +46084,10 @@ var init_submit = __esm({
             items: {
               type: "object",
               properties: {
-                findingId: { type: "string", description: `The finding's stable id from the review (e.g. "F1")` },
+                findingId: {
+                  type: "string",
+                  description: 'Copy the exact id in the findings (e.g. "F1" or "check:CI / checks (test)")'
+                },
                 disposition: { type: "string", enum: ["fixed", "declined"], description: "fixed | declined" },
                 note: { type: "string", description: "One line: what was done, or why it was declined" }
               },
@@ -46088,7 +46103,7 @@ var init_submit = __esm({
         if (!ctx.onDispositions) return "no run is recording dispositions here";
         ctx.onDispositions(parsed.dispositions);
         const drops = parsed.dropped.length ? ` (dropped: ${parsed.dropped.join("; ")})` : "";
-        return `dispositions recorded: ${parsed.dispositions.length}${drops}; a later call replaces this one`;
+        return `dispositions recorded: ${parsed.dispositions.length}${drops}; IDs are checked against the findings by the plan runner; a later call replaces this one`;
       }
     };
     submitPrDescriptionTool = {
@@ -50278,19 +50293,36 @@ function judgeBashCommand(command2, ctx) {
   if (MERGE_OR_APPROVE.test(command2)) {
     return refused4("merge/approve \u2014 a coding run never merges or approves a pull request");
   }
+  const pushCommand = withoutShellContinuations(command2);
   if (ctx.identity !== "write") {
-    if (ANY_PUSH.test(command2)) return refused4("read-only \u2014 a read-identity run never pushes");
+    if (ANY_PUSH.test(pushCommand)) return refused4("read-only \u2014 a read-identity run never pushes");
     if (GH_WRITE_VERB.test(command2) || GH_API_WRITE.test(command2) || CURL_GITHUB_WRITE.test(command2)) {
       return refused4("read-only \u2014 a read-identity run never writes to GitHub");
     }
     return allowed;
   }
-  for (const match of command2.matchAll(GIT_PUSH)) {
+  for (const match of pushCommand.matchAll(GIT_PUSH)) {
     const verdict = judgePush(match[1], ctx);
     if (verdict.verdict !== "allowed") return verdict;
   }
   return allowed;
 }
+function withoutShellContinuations(command2) {
+  let result = "";
+  let quote3;
+  for (let i = 0; i < command2.length; i++) {
+    const char = command2[i];
+    if (char === "\\" && quote3 !== "'" && i + 1 < command2.length) {
+      const next = command2[++i];
+      if (next !== "\n") result += char + next;
+      continue;
+    }
+    if (char === quote3) quote3 = void 0;
+    else if (quote3 === void 0 && (char === "'" || char === '"')) quote3 = char;
+    result += char;
+  }
+  return result;
+}
 function judgeBashTimeout(timeout, ctx) {
   if (!ctx.loopEndsIn || typeof timeout !== "number" || !Number.isFinite(timeout) || timeout <= 0) return allowed;
   const leftMs = ctx.loopEndsIn();
@@ -50401,8 +50433,11 @@ var init_toolRules = __esm({
     ENV_DUMP = /(^|[;&|(]\s*)((printenv|env)(\s+-[A-Za-z0-9-]+)*|export\s+-p|declare\s+-[a-zA-Z]*[px][a-zA-Z]*|set)\s*($|[|;&>)])|\/proc\/(self|\d+)\/environ|process\.env(?![.[\w])/;
     CREDENTIAL_VAR = /\$\{?[A-Z][A-Z0-9_]*(_API_KEY|_TOKEN|_SECRET|_BEARER|_PASSWORD)\b|printenv\s+[A-Z][A-Z0-9_]*(_API_KEY|_TOKEN|_SECRET|_BEARER|_PASSWORD)\b/;
     MERGE_OR_APPROVE = /\bgh\s+pr\s+(merge|review)\b|\/pulls\/\d+\/(merge|reviews)\b/;
-    GIT_THEN_PUSH = String.raw`\bgit(?:\s+(?:-C\s+\S+|--git-dir=\S+|--work-tree=\S+|-c\s+\S+|--no-pager))*\s+push\b`;
-    GIT_PUSH = new RegExp(`${GIT_THEN_PUSH}((?:[^;&|]|(?<=[<>])&|&(?=>))*)`, "g");
+    GIT_THEN_PUSH = String.raw`\bgit(?:[ \t]+(?:-C[ \t]+\S+|--git-dir=\S+|--work-tree=\S+|-c[ \t]+\S+|--no-pager))*[ \t]+push\b`;
+    GIT_PUSH = new RegExp(
+      GIT_THEN_PUSH + String.raw`((?:"(?:\\[\s\S]|[^"\\])*"|'[^']*'|\\[^\n]|[^\n;&|'"\\]|(?<=[<>])&|&(?=>))*)`,
+      "g"
+    );
     ANY_PUSH = new RegExp(GIT_THEN_PUSH);
     GH_WRITE_VERB = /\bgh\s+(pr|issue)\s+(comment|create|edit|close|reopen|ready|lock|unlock|review|merge|delete|transfer|pin|unpin)\b/;
     WRITE_METHOD = "(POST|post|PATCH|patch|PUT|put|DELETE|delete)";
@@ -56782,7 +56817,8 @@ async function dispatch(deps, msg, io, opts = {}) {
       );
     };
     const stickyAgent = thread ? stickyAgentOf(thread) : void 0;
-    const threadPr = thread ? threadPrOf(thread) : void 0;
+    const laterPr = (runPr, releasedPr) => releasedPr !== void 0 && (runPr === void 0 || releasedPr.at > runPr.at) ? releasedPr : runPr;
+    let threadPr = laterPr(thread ? threadPrOf(thread) : void 0, pageOwner?.releasedPr);
     const inheritedRepo = operatorRepo ?? (thread ? newestFinishedRunOf(thread)?.repo : void 0) ?? deps.config.scopes(msg.channelId, msg.userId).channel.repo;
     const historicalRoutePreset = restart?.row.meta.route?.preset;
     const resolveCurrent = () => resolveRun(deps, {
@@ -56803,6 +56839,7 @@ async function dispatch(deps, msg, io, opts = {}) {
     const threadLive = admission.get(msg.threadKey) !== void 0 || !resume && !restart && deps.threadsElsewhere.get(msg.threadKey) !== void 0;
     if (thread && !threadLive && deps.coordinatorInstances !== void 0) {
       const owner = pageOwner ?? await ownerOf2(thread, (id) => deps.coordinatorInstances.listUnits(id), msg.threadKey);
+      threadPr = laterPr(threadPr, owner.releasedPr);
       if (owner.kind === "live" && owner.run.hosted === true) {
         const units = owner.run.instanceId === void 0 ? [] : await deps.coordinatorInstances.listUnits(owner.run.instanceId).catch(() => []);
         const open2 = units.filter((u) => u.ending === void 0);
@@ -72943,7 +72980,7 @@ function findingsRequest(input) {
 
 A person answered the human-gated finding. Treat the finding and this answer together as the fix brief:
 ${input.answers.join("\n\n")}` : "";
-  return `The review of ${input.where} requested changes. Load the \`address-review-findings\` skill and address every finding below, nits included: record one disposition per finding with submit_dispositions (fixed or declined, with a note), squash to coherent commits, resubmit the pull request description with submit_pr_description, and push the branch. Never merge and never approve.
+  return `The review of ${input.where} requested changes. Load the \`address-review-findings\` skill and address every finding below, nits included: record one disposition per finding with submit_dispositions (fixed or declined, with a note). Copy each finding ID exactly, including any \`check:\u2026\` ID; never substitute an \`F1\` ID for a check. Squash to coherent commits, resubmit the pull request description with submit_pr_description, and push the branch. Never merge and never approve.
 
 Findings:
 ${findings}${answers}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreplane/switchboard",
-  "version": "1.264.0",
+  "version": "1.265.0",
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",
   "homepage": "https://openswitchboard.dev",