@elalfner/relevo 0.3.1 → 0.5.0

package/scripts/lib/toolchain-check.mjs

@@ -0,0 +1,12 @@
+// Which of the tools that a profile lists are not on the path. `probe(tool)` says whether one answers; it is injected
+// so that a test does not need the tools. An empty list checks nothing.
+
+/** The tools that are missing, in the order of the profile and without repeats. */
+export function missingTools(tools, probe) {
+  const seen = new Set();
+  return (tools ?? []).filter((tool) => {
+    if (seen.has(tool)) return false;
+    seen.add(tool);
+    return !probe(tool);
+  });
+}

package/scripts/toolchain-check.mjs

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+// Checks that the tools which the profile of a platform lists are on the path of this machine. Usage:
+//   node scripts/toolchain-check.mjs --platform <name> [--config relevo.yml] [--plugin-root <dir>]
+// It prints { platform, stack, tools, missing } as JSON. A tool is there when `<tool> --version` starts. The cloud build
+// runs it before the agent, so that a runner without the SDK stops in seconds and not after a full run.
+//   exit 0: every tool is there (or the profile lists none)   exit 1: a tool is missing, or the profile cannot be resolved
+//   exit 2: bad usage or an invalid relevo.yml
+
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { loadConfig } from './lib/config.mjs';
+import { resolveProfile } from './lib/stack-profile.mjs';
+import { missingTools } from './lib/toolchain-check.mjs';
+
+const arg = (name) => {
+  const i = process.argv.indexOf(`--${name}`);
+  return i === -1 ? undefined : process.argv[i + 1];
+};
+const fail = (message, code) => {
+  console.error(message);
+  process.exit(code);
+};
+
+const pluginRoot = resolve(arg('plugin-root') ?? resolve(dirname(fileURLToPath(import.meta.url)), '..'));
+const configPath = resolve(arg('config') ?? 'relevo.yml');
+if (!existsSync(configPath)) fail(`relevo.yml not found at ${configPath}. Run /relevo:init to create it.`, 2);
+const loaded = loadConfig(readFileSync(configPath, 'utf8'));
+if (!loaded.ok) fail(`relevo.yml is invalid:\n${loaded.errors.map((e) => `  ${e.message}`).join('\n')}`, 2);
+
+const names = Object.keys(loaded.config.platforms);
+const name = arg('platform') ?? (names.length === 1 ? names[0] : undefined);
+if (!name) fail(`usage: toolchain-check.mjs --platform <${names.join('|')}> [--config relevo.yml] [--plugin-root dir]`, 2);
+const platform = loaded.config.platforms[name];
+if (!platform) fail(`unknown platform "${name}"; the platforms of relevo.yml are: ${names.join(', ')}`, 2);
+
+const base = dirname(configPath);
+const read = (path) => {
+  const file = path.startsWith('/') ? path : resolve(base, path);
+  return existsSync(file) ? readFileSync(file, 'utf8') : null;
+};
+const resolved = resolveProfile({ platform, pluginRoot, read });
+if (!resolved.ok) fail(resolved.errors.join('\n'), 1);
+
+const probe = (tool) => spawnSync(tool, ['--version'], { stdio: 'ignore' }).error === undefined;
+const missing = missingTools(resolved.profile.tools, probe);
+console.log(JSON.stringify({ platform: name, stack: resolved.profile.stack, tools: resolved.profile.tools, missing }));
+process.exit(missing.length > 0 ? 1 : 0);

package/skills/init/SKILL.md

@@ -33,11 +33,12 @@ If `relevo.yml` already exists and is valid, skip this step. Otherwise ask, in s
 - who builds and reviews (GitHub usernames) and who writes the specs;
 - the review mode: `none` (a solo project), `peer` or `roles`;
 - the language of the hand-off messages (`en` or `es`);
-- the platforms: for each one a name, its stack (look at the project to propose one: the profiles in `${CLAUDE_PLUGIN_ROOT}/stacks/` are the stacks Relevo ships with: `flutter`, `vue` and `laravel`), the folder where it lives (`.` for a repository with one platform, `apps/web` in a monorepo) and, for a stack that has targets, which ones (for Flutter: `android`, `ios`, `web`; for Vue: `web`; Laravel has none). Several platforms in one repository are written down, but `go` builds only a repository with one for now;
+- the platforms: for each one a name, its stack (look at the project to propose one: the profiles in `${CLAUDE_PLUGIN_ROOT}/stacks/` are the stacks Relevo ships with: `flutter`, `vue`, `laravel` and `supabase`), the folder where it lives (`.` for a repository with one platform, `apps/web` in a monorepo) and, for a stack that has targets, which ones (for Flutter: `android`, `ios`, `web`; for Vue: `web`; Laravel and Supabase have none). Several platforms in one repository are written down, but `go` builds only a repository with one for now;
 - where `go` builds: in the cloud, on each person's machine, or both (the default), and, for the cloud, with an API key from the Anthropic Console (the default) or with a subscription token. A subscription's quota is shared by every run and by the interactive use of the account, so `init` sets `limits.concurrent_agents` to 1 for it. Nothing about this goes in `relevo.yml` apart from that number: the installed workflows, the secret that exists and the repository variable `RELEVO_CLOUD_GO` (`off` pauses the cloud at once, with no pull request) decide it;
 - the repositories this one depends on, if any (`owner/repo`, for example the back end of a front end): they are written to `links`, the closed list that `Depends-on: owner/repo#N` is checked against;
 - whether to create a commented `.relevo/stacks/<stack>.md` for each stack, where the project can add its own hygiene to the plugin's profile (optional; it is not committed);
-- the cost limit per unattended run in US dollars: the template's 5 is a placeholder the person must accept or change.
+- which agent builds in the cloud, only when the person says they use Antigravity: `claude` (the default) or `antigravity`. With `antigravity` the model key is `GEMINI_API_KEY`, a key made only for Relevo in its own Google Cloud project with a quota, and the limit asked below is a number of tokens (`limits.run_max_tokens`) because that agent has no cost limit; `docs/security.md` says what else it cannot enforce;
+- the cost limit per unattended run in US dollars: the template's 5 is a placeholder the person must accept or change (with `antigravity`, the token limit instead).
 
 Write the answers as JSON to a temporary file **outside the repository**, with the keys `members`, `specWriter`, `reviewMode`, `language`, `platforms` (a map of name to `{ stack, path, targets }`), `links` (a list of `owner/repo`, possibly none), `runs` (`cloud`, `local` or `both`), `credential` (`api_key` or `subscription`), `stackProfiles` (the stacks that get a profile file, possibly none) and, if given, `runMaxCost`. Never put a secret in it.
 
@@ -53,6 +54,8 @@ Show it as it is. Each line says whether it is already `ok`, will be done, `diff
 
 For each line in the plan that is an install, show its exact command and ask for a yes to that command alone. Run it only on a yes. If the person declines, continue, say that dependency is still missing, and that `go` and `ship` will not run until the OpenSpec tool is installed.
 
+One install is not a dependency: `install.plugin-project` declares the Relevo plugin in the project, so that a teammate who clones the repository is offered it, even when the plugin is already installed for the machine. Show its exact command (the two `claude plugin` commands at the project scope) and run it only on a yes. If it ran, `.claude/settings.json` is new or changed: say that it is left for the person to commit. If the person declines, nothing else changes, and `/relevo:doctor` keeps warning about it. When the plan says that file is not valid JSON, do not touch it: tell the person to fix it.
+
 ### 5. Apply
 
 ```bash

package/skills/review/SKILL.md

@@ -152,6 +152,16 @@ Only when `decide` exited 0.
 - `evidence.policy: local_only`: delete the `evidence/` folder now. Nothing is attached anywhere.
 - `evidence.policy: attach_to_pr`: GitHub has no API for attaching images, so you cannot upload them. List the files in `evidence/` and ask the person to drag them into the pull request description. Keep the folder until they say they did, then delete it.
 
+### 9. Return to base branch
+
+Restore the working tree to the base branch so the workspace remains clean on the base branch for other tasks or subsequent reviews, but only where that is possible: in the main checkout, and when no other worktree holds the base branch.
+
+```bash
+[ "$(git rev-parse --git-dir)" = "$(git rev-parse --git-common-dir)" ] && ! git worktree list --porcelain | grep -qx "branch refs/heads/<base>" && git switch <base>
+```
+
+If the condition does not hold (a separate worktree, or the base branch is checked out elsewhere), do not switch: say which branch the working tree stays on. If `git switch` fails, say so; it never changes the verdict or the state of the issue, because the pull request already exists.
+
 ## Report
 
 Finish with one short block: the issue, the review verdict, the checklist result, the pull request link (or why none was opened), and the issue's new state.

package/stacks/supabase.md

@@ -0,0 +1,63 @@
+---
+stack: supabase
+commands:
+  analyze: supabase db lint
+  test: supabase test db
+  format: npx prettier --write supabase/
+generated: []
+tools: [supabase, docker]
+requires_skills:
+  - supabase
+  - supabase-postgres-best-practices
+skills:
+  dev:
+    - supabase
+    - supabase-postgres-best-practices
+  qa:
+    - supabase
+    - supabase-postgres-best-practices
+  issue:
+    - supabase
+    - supabase-postgres-best-practices
+  review: []
+---
+
+# Supabase
+
+## Verification
+
+Run the verification commands from the platform directory: `analyze` (`supabase db lint`) and `test` (`supabase test db`). These commands require the Supabase CLI and a running Docker daemon.
+
+Do not claim the database schema is valid, clean, or passes tests unless you ran the commands and saw the results. All tests run hermetically against local Docker containers; never point tests at a remote Supabase project.
+
+## Questions for the issue writer
+
+- **Authorization & RLS**: Who is permitted to select, insert, update, and delete rows in these tables? Which Postgres roles (`anon`, `authenticated`) should have access?
+- **Relationships & Deletes**: If a parent row or user is deleted, what is the expected cascade behavior (`CASCADE`, `SET NULL`, or `RESTRICT`)?
+- **Storage & Files**: If files are uploaded, what are the allowed MIME types, max file sizes, and who can overwrite or delete objects?
+- **Query Performance & Filters**: Which columns will be filtered in `WHERE` clauses, sorted, or referenced in RLS policies (`auth.uid() = user_id`)?
+
+## Hygiene for the developer
+
+- Follow the official guidelines from `supabase` and `supabase-postgres-best-practices`.
+- Enable Row Level Security on every public table: `ALTER TABLE <table_name> ENABLE ROW LEVEL SECURITY;`.
+- Avoid using `auth.role()` in policies; use the `TO` clause instead (e.g. `TO authenticated` or `TO anon`).
+- Combine `TO authenticated` with an explicit ownership predicate (e.g. `(select auth.uid()) = user_id`) to prevent broken object-level authorization (BOLA / IDOR).
+- Always include both `USING` and `WITH CHECK` clauses on `UPDATE` policies so users cannot reassign ownership columns.
+- Ensure all views on tables with RLS specify `WITH (security_invoker = true)` (Postgres 15+).
+- Avoid `SECURITY DEFINER` functions in the `public` schema; if required, keep them in a private schema and validate caller identity explicitly.
+- Create an index on every foreign key column and on every column evaluated in RLS policies.
+- Structure all schema changes as versioned, timestamped migrations in `supabase/migrations/`.
+- Maintain test and sample data in `supabase/seed.sql` using idempotent statements (`INSERT ... ON CONFLICT DO NOTHING;`).
+- Write pgTAP test suites in `supabase/tests/` verifying that unauthorized or anonymous callers cannot read or modify protected rows.
+
+## What the auditor looks for in the diff
+
+- **Missing RLS**: Any table created in an exposed schema without `ENABLE ROW LEVEL SECURITY`.
+- **Incomplete Update Policies**: An `UPDATE` policy that defines `USING` but omits `WITH CHECK`.
+- **Permissive Policies**: Policies using `USING (true)` or checking only `TO authenticated` without row-ownership verification on private user data.
+- **Unprotected Views**: Views defined without `security_invoker = true`.
+- **Privilege Escalation**: `SECURITY DEFINER` functions placed in `public` or callable without `auth.uid()` checks.
+- **Missing Indexes**: Foreign key constraints or RLS filter columns without an index.
+- **Destructive Migrations**: `DROP TABLE`, `DROP COLUMN`, or `TRUNCATE` operations without explicit migration plans or rollback safety.
+- **Exposed Secrets**: Hardcoded `service_role` keys, API tokens, or service passwords in code, migrations, or seed files.

package/templates/agents/antigravity-step.yml

@@ -0,0 +1,70 @@
+# What `relevo-go.yml` and `relevo-queue.yml` run when `agent.build` in relevo.yml is `antigravity`. This file is not a
+# workflow: each block below replaces, in the shared workflow, the lines between the markers with the same name, and
+# nothing else of the workflow changes (a test checks it). Edit the shared workflow for anything that is not about the
+# agent. Written for ubuntu-latest (x86-64).
+#
+# What Antigravity CLI cannot do on its own, and what stands in for it (docs/security.md):
+#   turn and token limits  the run guard (scripts/agent-guard.mjs) reads the event stream and stops the agent; the numbers
+#                          are those of relevo.yml (limits.run_max_turns, limits.run_max_tokens)
+#   cost limit             none: the quota and the budget of the Google Cloud project that owns the key are the ceiling.
+#                          Use a key made for Relevo, in its own project, with a quota
+#   refused tools          the agent exits 0 when a tool is refused; the guard reads the refusal and fails the run
+#   closed tool list       the settings file written below: the web is denied and only listed commands are allowed. It is
+#                          a prefix list, not an operating-system boundary: `node` can run any script, as Bash can for Claude
+#   the key                GEMINI_API_KEY is an environment variable of the agent's own commands, so the agent can read it
+#   the binary             pinned by version and sha512 below; to update it, copy the url and the checksum from
+#                          https://antigravity-cli-auto-updater-974169037036.us-central1.run.app/manifests/linux_amd64.json
+
+# relevo:credential begin
+          # Without a model credential the cloud cannot build: the issue stays ready and a comment says to run it locally.
+          HAS_CREDENTIAL: ${{ secrets.GEMINI_API_KEY != '' }}
+# relevo:credential end
+
+# relevo:agent-step begin
+      # Antigravity CLI, at the version and with the checksum written here. The installer script of the vendor takes
+      # the latest version; this takes only the one that was tried.
+      - name: Install the Antigravity CLI
+        env:
+          AGY_VERSION: '1.4.4'
+          AGY_URL: https://storage.googleapis.com/antigravity-public/antigravity-cli/1.4.4-4783783166214144/linux-x64/cli_linux_x64.tar.gz
+          AGY_SHA512: 7ce149d350344c1046c7b59b6659bcc5d659f351bf3a07c6c085887d93427ceb89d927752e4ccd0844b53ffb91d33d6a49f72835ceb276c7cffdd13cfb8023b8
+        run: |
+          curl -fsSL -o "$RUNNER_TEMP/agy.tar.gz" "$AGY_URL"
+          echo "$AGY_SHA512  $RUNNER_TEMP/agy.tar.gz" | sha512sum --check --strict -
+          tar -xzf "$RUNNER_TEMP/agy.tar.gz" -C "$RUNNER_TEMP" antigravity
+          mkdir -p "$HOME/.local/bin"
+          install -m 0755 "$RUNNER_TEMP/antigravity" "$HOME/.local/bin/agy"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+          [ "$("$HOME/.local/bin/agy" --version)" = "$AGY_VERSION" ] || { echo "::error::agy is not version $AGY_VERSION"; exit 1; }
+
+      # The Relevo plugin is rendered from the package unpacked in the step "Check the toolchain" and installed for the
+      # machine, so nothing is added to the working tree (the agent needs it clean). The settings of the run go to the
+      # user-level file of the CLI, outside the repository: a pull request cannot loosen them.
+      - name: Set up the Antigravity run
+        env:
+          PLATFORM: ${{ needs.decide.outputs.platform }}
+        run: |
+          for f in scripts/cli.mjs scripts/agent-guard.mjs; do
+            [ -f "$RUNNER_TEMP/relevo/$f" ] || { echo "::error::The Relevo package $RELEVO_VERSION lacks $f"; exit 1; }
+          done
+          node "$RUNNER_TEMP/relevo/scripts/cli.mjs" init --tools antigravity --scope machine --yes
+          node "$RUNNER_TEMP/relevo/scripts/agent-guard.mjs" settings --platform "$PLATFORM" --plugin-root "$RUNNER_TEMP/relevo" --out "$HOME/.gemini/antigravity-cli/settings.json"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      # The issue text is data, never instructions: the skill tells the agent so. The decision the `decide` job already
+      # made travels with the prompt, encoded so that the issue title in it is never read as an instruction. Both
+      # values reach the shell as variables, never pasted into the script.
+      - id: agent
+        env:
+          OPENSPEC_TELEMETRY: '0'
+          GH_TOKEN: ${{ github.token }}
+          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          ISSUE: ${{ github.event.issue.number || inputs.issue }}
+          DECISION: ${{ needs.decide.outputs.decision_b64 }}
+        run: |
+          node "$RUNNER_TEMP/relevo/scripts/agent-guard.mjs" run \
+            --prompt "/relevo:go $ISSUE --decision $DECISION" \
+            --config relevo.yml --timeout-minutes 50 \
+            --summary "$RUNNER_TEMP/relevo-guard-summary.json" --github-output "$GITHUB_OUTPUT"
+# relevo:agent-step end

package/templates/deploy-supabase.yml

@@ -0,0 +1,75 @@
+name: Deploy Supabase Migrations
+
+# Automatically applies migrations to Supabase Cloud after Relevo pull requests are merged.
+# - Push to base branch ('dev'): deploys to Staging.
+# - Push to release branch ('main'): deploys to Production (under GitHub Environment protection).
+
+on:
+  push:
+    branches:
+      - dev   # Relevo base branch (Staging)
+      - main  # Relevo release branch (Production)
+    paths:
+      - 'supabase/migrations/**'
+      - 'supabase/functions/**'
+      - 'supabase/config.toml'
+  workflow_dispatch:
+
+jobs:
+  deploy-staging:
+    name: Deploy to Staging
+    if: github.ref_name == 'dev'
+    runs-on: ubuntu-latest
+    environment: staging
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Supabase CLI
+        uses: supabase/setup-cli@v1
+        with:
+          version: latest
+
+      - name: Link and Push Migrations to Staging
+        env:
+          SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
+        run: |
+          supabase link --project-ref ${{ secrets.SUPABASE_PROJECT_ID_STAGING }}
+          supabase db push
+
+      - name: Deploy Edge Functions (if present)
+        if: hashFiles('supabase/functions/**') != ''
+        env:
+          SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
+        run: |
+          supabase functions deploy
+
+  deploy-production:
+    name: Deploy to Production
+    if: github.ref_name == 'main'
+    runs-on: ubuntu-latest
+    # Configure the 'production' environment in GitHub Settings > Environments with required reviewers
+    # so human approval is mandatory before this job executes.
+    environment: production
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Supabase CLI
+        uses: supabase/setup-cli@v1
+        with:
+          version: latest
+
+      - name: Link and Push Migrations to Production
+        env:
+          SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
+        run: |
+          supabase link --project-ref ${{ secrets.SUPABASE_PROJECT_ID_PROD }}
+          supabase db push
+
+      - name: Deploy Edge Functions (if present)
+        if: hashFiles('supabase/functions/**') != ''
+        env:
+          SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
+        run: |
+          supabase functions deploy

package/templates/workflows/relevo-digest.yml

@@ -9,7 +9,7 @@ name: relevo-digest
 # The version of @elalfner/relevo whose scripts this workflow runs. The plugin's templates carry the version they
 # were released with, and `/relevo:init` reports this file as different when it is older; change it by hand to update.
 env:
-  RELEVO_VERSION: '0.3.1'
+  RELEVO_VERSION: '0.5.0'
 
 on:
   schedule:

package/templates/workflows/relevo-go.yml

@@ -15,7 +15,7 @@ name: relevo-go
 # The version of @elalfner/relevo whose scripts this workflow runs. The plugin's templates carry the version they
 # were released with, and `/relevo:init` reports this file as different when it is older; change it by hand to update.
 env:
-  RELEVO_VERSION: '0.3.1'
+  RELEVO_VERSION: '0.5.0'
 
 on:
   issues:
@@ -82,8 +82,10 @@ jobs:
           GH_LINKS_TOKEN: ${{ secrets.RELEVO_LINKS_TOKEN }}
           GITHUB_REPOSITORY: ${{ github.repository }}
           ISSUE: ${{ github.event.issue.number || inputs.issue }}
+          # relevo:credential begin
           # Without a model credential the cloud cannot build: the issue stays ready and a comment says to run it locally.
           HAS_CREDENTIAL: ${{ secrets.ANTHROPIC_API_KEY != '' || secrets.CLAUDE_CODE_OAUTH_TOKEN != '' }}
+          # relevo:credential end
         run: node .relevo-plugin/scripts/go-plan.mjs --repo "$GITHUB_REPOSITORY" --only "$ISSUE" --apply --claim --credential "$HAS_CREDENTIAL" --github-output "$GITHUB_OUTPUT"
 
       # See the same step in `build`. A failure before the issue is claimed (the plugin cannot be cloned, the
@@ -164,6 +166,37 @@ jobs:
         env:
           OPENSPEC_TELEMETRY: '0'
 
+      # Stops before the agent, without spending a model turn, when the runner lacks a tool that the profile of the
+      # platform lists (the Flutter SDK, PHP and Composer, ...): otherwise the developer writes the code and QA only
+      # finds out at the end, after a full run. The package is unpacked outside the workspace on purpose: the agent needs
+      # a clean working tree. If you renamed the labels in relevo.yml, change the names below too.
+      - name: Check the toolchain
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ISSUE: ${{ github.event.issue.number || inputs.issue }}
+          PLATFORM: ${{ needs.decide.outputs.platform }}
+        run: |
+          mkdir -p "$RUNNER_TEMP/relevo"
+          npm pack "@elalfner/relevo@$RELEVO_VERSION" --silent --pack-destination "$RUNNER_TEMP" > /dev/null
+          tar -xzf "$RUNNER_TEMP"/elalfner-relevo-*.tgz --strip-components=1 -C "$RUNNER_TEMP/relevo"
+          for f in scripts/toolchain-check.mjs scripts/render-message.mjs; do
+            [ -f "$RUNNER_TEMP/relevo/$f" ] || { echo "::error::The Relevo package $RELEVO_VERSION lacks $f"; exit 1; }
+          done
+          if result=$(node "$RUNNER_TEMP/relevo/scripts/toolchain-check.mjs" --platform "$PLATFORM" --plugin-root "$RUNNER_TEMP/relevo"); then
+            exit 0
+          fi
+          missing=$(printf '%s' "$result" | jq -r '.missing | join(", ")')
+          [ -n "$missing" ] || { echo "::error::The toolchain check failed: $result"; exit 1; }
+          title=$(gh issue view "$ISSUE" --json title --jq .title)
+          assignee=$(gh issue view "$ISSUE" --json assignees --jq '.assignees[0].login // empty')
+          body=$(jq -n --arg assignee "$assignee" --arg issue "$ISSUE" --arg title "$title" --arg tools "$missing" --arg platform "$PLATFORM" \
+            '{assignee: $assignee, issue: $issue, title: $title, tools: $tools, platform: $platform}' | node "$RUNNER_TEMP/relevo/scripts/render-message.mjs" toolchain_missing --config relevo.yml)
+          gh issue edit "$ISSUE" --remove-label relevo:ready --remove-label relevo:queued --remove-label relevo:building --add-label relevo:qa-failed
+          gh issue comment "$ISSUE" --body "$body"
+          echo "::error::The runner has no $missing, so nothing was built"
+          exit 1
+
+      # relevo:agent-step begin
       - id: agent
         uses: anthropics/claude-code-action@v1
         env:
@@ -203,6 +236,7 @@ jobs:
             --max-budget-usd 5
             --allowedTools "Bash,Read,Write,Edit,Glob,Grep,Task"
             --disallowedTools "WebFetch,WebSearch,Bash(curl:*),Bash(wget:*)"
+      # relevo:agent-step end
 
       # The scripts of the next two steps come from the plugin package. It is unpacked into the workspace only now, after the agent has
       # finished, because the agent's preflight needs a clean working tree and a checkout inside it would not be.

package/templates/workflows/relevo-queue.yml

@@ -10,7 +10,7 @@ name: relevo-queue
 # The version of @elalfner/relevo whose scripts this workflow runs. The plugin's templates carry the version they
 # were released with, and `/relevo:init` reports this file as different when it is older; change it by hand to update.
 env:
-  RELEVO_VERSION: '0.3.1'
+  RELEVO_VERSION: '0.5.0'
 
 on:
   issues:
@@ -62,8 +62,10 @@ jobs:
           # name, never to write, and an empty value is fine (public repositories are read without it).
           GH_LINKS_TOKEN: ${{ secrets.RELEVO_LINKS_TOKEN }}
           GITHUB_REPOSITORY: ${{ github.repository }}
+          # relevo:credential begin
           # Without a model credential nothing is dispatched.
           HAS_CREDENTIAL: ${{ secrets.ANTHROPIC_API_KEY != '' || secrets.CLAUDE_CODE_OAUTH_TOKEN != '' }}
+          # relevo:credential end
         run: |
           result=$(node .relevo-plugin/scripts/requeue.mjs --repo "$GITHUB_REPOSITORY" --credential "$HAS_CREDENTIAL")
           echo "$result"

package/templates/workflows/relevo-review.yml

@@ -10,7 +10,7 @@ name: relevo-review
 # The version of @elalfner/relevo whose scripts this workflow runs. The plugin's templates carry the version they
 # were released with, and `/relevo:init` reports this file as different when it is older; change it by hand to update.
 env:
-  RELEVO_VERSION: '0.3.1'
+  RELEVO_VERSION: '0.5.0'
 
 on:
   pull_request_review:

package/templates/workflows/relevo-sla.yml

@@ -8,7 +8,7 @@ name: relevo-sla
 # The version of @elalfner/relevo whose scripts this workflow runs. The plugin's templates carry the version they
 # were released with, and `/relevo:init` reports this file as different when it is older; change it by hand to update.
 env:
-  RELEVO_VERSION: '0.3.1'
+  RELEVO_VERSION: '0.5.0'
 
 on:
   schedule: