@gh-symphony/cli 0.2.0 → 0.2.3

package/README.md

@@ -37,6 +37,7 @@ gh-symphony doctor
 gh-symphony doctor --fix
 gh-symphony doctor --json
 gh-symphony doctor --smoke
+gh-symphony doctor --bundle
 GITHUB_GRAPHQL_TOKEN=ghp_your_classic_token gh-symphony doctor --json
 ```
 
@@ -107,6 +108,56 @@ You can further customize the agent's behavior by editing `WORKFLOW.md` — this
 
 > Currently supported runtimes: **Codex**, **Claude Code**
 
+### Explicit Priority Mapping
+
+GitHub Project V2 does not have a native issue priority. For GitHub Project workflows, dispatch priority is controlled only by the explicit `tracker.priority` policy in `WORKFLOW.md`; there is no fallback from Project fields to labels and no guessed label naming convention. Unmapped values resolve to `priority = null`, so dispatch falls back to created time and identifier.
+
+Project field source:
+
+```yaml
+tracker:
+  kind: github-project
+  project_id: PVT_kwDOxxxxxx
+  state_field: Status
+  priority:
+    source: project-field
+    field: Priority
+    values:
+      Urgent: 0
+      High: 1
+      Medium: 2
+      Low: 3
+```
+
+Label source:
+
+```yaml
+tracker:
+  kind: github-project
+  project_id: PVT_kwDOxxxxxx
+  state_field: Status
+  priority:
+    source: labels
+    labels:
+      P0: 0
+      P1: 1
+      P2: 2
+      P3: 3
+```
+
+Disabled:
+
+```yaml
+tracker:
+  kind: github-project
+  priority:
+    source: disabled
+```
+
+Legacy `tracker.priority_field: Priority` still works, but it is deprecated because it derives numeric priority from the live Project option order. Migrate by copying the field name into `tracker.priority.field` and writing each option display name under `values` with the intended number. If both keys are present, `tracker.priority` wins and `gh-symphony doctor` reports a warning.
+
+Run `gh-symphony workflow validate` for local schema errors and `gh-symphony doctor` for live drift warnings such as missing Project fields, missing labels, unmapped live options, stale mappings, and active issues whose priority-like value resolves to `priority = null`.
+
 ### Linear Tracker Repositories
 
 For Linear, configure the tracker in `WORKFLOW.md` and initialize the repository runtime from the target GitHub repository:
@@ -303,6 +354,22 @@ Without `--issue`, doctor auto-selects one active live issue from the managed pr
 - launches `gh-symphony setup` when repository runtime setup or GitHub Project binding must be repaired
 - prints concrete runtime install guidance when the configured command is missing on `PATH`
 
+`gh-symphony doctor --bundle` creates a redacted support bundle for bug reports:
+
+```bash
+gh-symphony doctor --bundle
+gh-symphony doctor --bundle ./tmp/support-bundle
+gh-symphony doctor --bundle --project-id your-project-id
+gh-symphony doctor --bundle --json
+```
+
+The bundle writes a deterministic directory containing `manifest.json`,
+`doctor.json`, redacted CLI/project config, `WORKFLOW.md`, runtime
+`status.json`/`issues.json` when available, and bounded recent run
+`events.ndjson`, `worker.log`, and `orchestrator.log` tails. Missing optional
+artifacts are listed in `manifest.missing`; redaction and truncation counts are
+reported in the command summary.
+
 The diagnostic checks cover:
 
 - the active GitHub auth source (`GITHUB_GRAPHQL_TOKEN` first, otherwise `gh`) and required scopes
@@ -321,6 +388,7 @@ Use JSON output for scripts and CI smoke checks. `--fix --json` includes a remed
 gh-symphony doctor --json
 gh-symphony doctor --fix --json
 gh-symphony doctor --smoke --json
+gh-symphony doctor --bundle --json
 gh-symphony repo start --once
 ```
 

package/dist/{chunk-Q3UEPUE3.js → chunk-3SKN5L3I.js}

@@ -53,6 +53,7 @@ var DEFAULT_WORKFLOW_TRACKER = {
   terminalStates: DEFAULT_WORKFLOW_LIFECYCLE.terminalStates,
   projectId: null,
   stateFieldName: DEFAULT_WORKFLOW_LIFECYCLE.stateFieldName,
+  priority: null,
   priorityFieldName: null,
   blockerCheckStates: DEFAULT_WORKFLOW_LIFECYCLE.blockerCheckStates
 };
@@ -169,6 +170,7 @@ function parseWorkflowMarkdown(markdown, env = process.env, options = {}) {
       terminalStates,
       projectId: readOptionalString(tracker, "project_id", env),
       stateFieldName: readOptionalString(tracker, "state_field", env) ?? DEFAULT_WORKFLOW_TRACKER.stateFieldName,
+      priority: readPriorityConfig(tracker, env),
       priorityFieldName: readOptionalString(tracker, "priority_field", env),
       blockerCheckStates
     },
@@ -235,6 +237,52 @@ function validateTrackerConfig(tracker, trackerKind, env) {
     }
   }
 }
+function readPriorityConfig(tracker, env) {
+  if (tracker.priority === void 0 || tracker.priority === null) {
+    return null;
+  }
+  const priority = readObject(tracker, "priority", "tracker.priority");
+  const source = readRequiredString(priority, "source", env);
+  const keys = new Set(Object.keys(priority));
+  if (source === "project-field") {
+    rejectPriorityKeys(keys, ["source", "field", "values"], source);
+    const field = readRequiredString(priority, "field", env);
+    const values = readNumberMap(priority, "values", "tracker.priority.values");
+    if (Object.keys(values).length === 0) {
+      throw new Error(
+        'Workflow front matter field "tracker.priority.values" must be a non-empty object for tracker.priority.source "project-field".'
+      );
+    }
+    return { source, field, values };
+  }
+  if (source === "labels") {
+    rejectPriorityKeys(keys, ["source", "labels"], source);
+    const labels = readNumberMap(priority, "labels", "tracker.priority.labels");
+    if (Object.keys(labels).length === 0) {
+      throw new Error(
+        'Workflow front matter field "tracker.priority.labels" must be a non-empty object for tracker.priority.source "labels".'
+      );
+    }
+    return { source, labels };
+  }
+  if (source === "disabled") {
+    rejectPriorityKeys(keys, ["source"], source);
+    return { source };
+  }
+  throw new Error(
+    `Unsupported workflow tracker.priority.source "${source}". Supported values: project-field, labels, disabled.`
+  );
+}
+function rejectPriorityKeys(keys, allowedKeys, source) {
+  const allowed = new Set(allowedKeys);
+  for (const key of keys) {
+    if (!allowed.has(key)) {
+      throw new Error(
+        `Workflow front matter field "tracker.priority.${key}" is not supported for tracker.priority.source "${source}".`
+      );
+    }
+  }
+}
 function parseLegacyWorkflowMarkdown(markdown) {
   const promptGuidelines = matchOptionalSection(markdown, "Prompt Guidelines") ?? "";
   return {
@@ -262,6 +310,10 @@ function parseBlock(lines, startIndex, indent) {
       index += 1;
       continue;
     }
+    if (line.trim().startsWith("#")) {
+      index += 1;
+      continue;
+    }
     const lineIndent = countIndent(line);
     if (lineIndent < indent) {
       break;
@@ -306,11 +358,16 @@ function parseBlock(lines, startIndex, indent) {
       );
     }
     collectionType = "object";
-    const separatorIndex = trimmed.indexOf(":");
+    const separatorIndex = findMappingSeparator(trimmed);
     if (separatorIndex < 0) {
       throw new Error(`Invalid workflow front matter line "${trimmed}".`);
     }
-    const key = trimmed.slice(0, separatorIndex).trim();
+    const rawKey = trimmed.slice(0, separatorIndex).trim();
+    const parsedKey = parseScalar(rawKey);
+    if (typeof parsedKey !== "string") {
+      throw new Error(`Invalid workflow front matter key "${rawKey}".`);
+    }
+    const key = parsedKey;
     const remainder = trimmed.slice(separatorIndex + 1).trim();
     if (remainder === "|" || remainder === "|-") {
       const [multiline, nextIndex2] = parseMultilineScalar(
@@ -355,6 +412,30 @@ function parseMultilineScalar(lines, startIndex, indent) {
 function countIndent(line) {
   return line.match(/^ */)?.[0].length ?? 0;
 }
+function findMappingSeparator(value) {
+  let quote = null;
+  for (let index = 0; index < value.length; index += 1) {
+    const char = value[index];
+    if (quote) {
+      if (char === "\\") {
+        index += 1;
+        continue;
+      }
+      if (char === quote) {
+        quote = null;
+      }
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      continue;
+    }
+    if (char === ":") {
+      return index;
+    }
+  }
+  return -1;
+}
 function parseScalar(value) {
   if (value === "null") return null;
   if (value === "true") return true;
@@ -363,8 +444,18 @@ function parseScalar(value) {
     return parseInlineArray(value);
   }
   if (/^-?\d+$/.test(value)) return Number.parseInt(value, 10);
-  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
-    return value.slice(1, -1);
+  if (value.startsWith('"') && value.endsWith('"')) {
+    try {
+      const parsed = JSON.parse(value);
+      if (typeof parsed === "string") {
+        return parsed;
+      }
+    } catch {
+      throw new Error(`Invalid quoted workflow front matter scalar "${value}".`);
+    }
+  }
+  if (value.startsWith("'") && value.endsWith("'")) {
+    return value.slice(1, -1).replace(/''/g, "'");
   }
   return value;
 }
@@ -559,13 +650,13 @@ function readOptionalIntegerLike(input, key) {
   }
   throw new Error(`Workflow front matter field "${key}" must be an integer.`);
 }
-function readNumberMap(input, key) {
+function readNumberMap(input, key, path = key) {
   const value = input[key];
   if (value === void 0 || value === null) {
     return {};
   }
   if (typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`Workflow front matter field "${key}" must be an object.`);
+    throw new Error(`Workflow front matter field "${path}" must be an object.`);
   }
   const result = {};
   for (const [entryKey, entryValue] of Object.entries(value)) {
@@ -573,12 +664,12 @@ function readNumberMap(input, key) {
       result[entryKey] = entryValue;
       continue;
     }
-    if (typeof entryValue === "string" && /^\d+$/.test(entryValue)) {
+    if (typeof entryValue === "string" && /^-?\d+$/.test(entryValue)) {
       result[entryKey] = Number.parseInt(entryValue, 10);
       continue;
     }
     throw new Error(
-      `Workflow front matter field "${key}.${entryKey}" must be an integer.`
+      `Workflow front matter field "${path}.${entryKey}" must be an integer.`
     );
   }
   return result;
@@ -1542,31 +1633,176 @@ var SENSITIVE_KEY_SUBSTRINGS = [
   "api_key"
 ];
 function redactObservabilitySecrets(value) {
-  return redactValue(value);
+  return redactObservabilitySecretsWithStats(value).value;
+}
+function redactObservabilitySecretsWithStats(value) {
+  const counts = createRedactionCounts();
+  const redacted = redactValue(value, counts, {
+    redactStringValues: false
+  });
+  return { value: redacted, redactions: summarizeRedactionCounts(counts) };
+}
+function redactObservabilityDiagnosticsWithStats(value) {
+  const counts = createRedactionCounts();
+  const redacted = redactValue(value, counts, {
+    redactStringValues: true
+  });
+  return { value: redacted, redactions: summarizeRedactionCounts(counts) };
 }
-function redactValue(value) {
+function redactObservabilityTextWithStats(text) {
+  const counts = createRedactionCounts();
+  return {
+    value: redactTextValue(text, counts),
+    redactions: summarizeRedactionCounts(counts)
+  };
+}
+function redactValue(value, counts, options) {
   if (Array.isArray(value)) {
-    return value.map((item) => redactValue(item));
+    return value.map((item) => redactValue(item, counts, options));
+  }
+  if (typeof value === "string" && options.redactStringValues) {
+    return redactTextValue(value, counts);
   }
   if (!isRecord3(value)) {
     return value;
   }
   return Object.fromEntries(
-    Object.entries(value).map(([key, nested]) => [
-      key,
-      shouldRedactKey(key) ? REDACTED : redactValue(nested)
-    ])
+    Object.entries(value).map(([key, nested]) => {
+      const redactionClass = redactionClassForKey(key);
+      if (redactionClass) {
+        incrementRedaction(counts, redactionClass);
+        return [key, REDACTED];
+      }
+      return [key, redactValue(nested, counts, options)];
+    })
   );
 }
-function shouldRedactKey(key) {
+function redactionClassForKey(key) {
   const normalizedKey = key.toLowerCase();
-  return normalizedKey === "token" || normalizedKey.endsWith("token") || SENSITIVE_KEY_SUBSTRINGS.some(
+  if (normalizedKey.includes("authorization")) {
+    return "authorization_header";
+  }
+  if (normalizedKey.includes("apikey") || normalizedKey.includes("api-key") || normalizedKey.includes("api_key")) {
+    return "api_key";
+  }
+  if (normalizedKey.includes("secret")) {
+    return "secret_key";
+  }
+  if (normalizedKey === "token" || normalizedKey.endsWith("token")) {
+    return "env_token";
+  }
+  if (SENSITIVE_KEY_SUBSTRINGS.some(
     (pattern) => normalizedKey.includes(pattern.toLowerCase())
-  );
+  )) {
+    return "secret_key";
+  }
+  return null;
 }
 function isRecord3(value) {
   return value != null && typeof value === "object";
 }
+function redactTextValue(text, counts) {
+  let redacted = replaceAndCount(
+    text,
+    /\b(Authorization\s*:\s*Bearer\s+)([^\s]+)/gi,
+    "authorization_header",
+    counts,
+    "$1[REDACTED]"
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /\b(X-API-Key\s*:\s*)([^\s]+)/gi,
+    "api_key",
+    counts,
+    "$1[REDACTED]"
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /^([A-Z0-9_]*(?:TOKEN)\w*\s*=\s*)([^\s]+)/gim,
+    "env_token",
+    counts,
+    "$1[REDACTED]"
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /^([A-Z0-9_]*(?:API_KEY)\w*\s*=\s*)([^\s]+)/gim,
+    "api_key",
+    counts,
+    "$1[REDACTED]"
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /^([A-Z0-9_]*(?:SECRET)\w*\s*=\s*)([^\s]+)/gim,
+    "secret_key",
+    counts,
+    "$1[REDACTED]"
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /((?:"token"|'token'|token)\s*:\s*)(?:"([^"]*)"|'([^']*)'|([^\s,}\]]+))/gi,
+    "env_token",
+    counts,
+    '$1"[REDACTED]"'
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /((?:"secret"|'secret'|secret)\s*:\s*)(?:"([^"]*)"|'([^']*)'|([^\s,}\]]+))/gi,
+    "secret_key",
+    counts,
+    '$1"[REDACTED]"'
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /((?:"apiKey"|'apiKey'|apiKey)\s*:\s*)(?:"([^"]*)"|'([^']*)'|([^\s,}\]]+))/g,
+    "api_key",
+    counts,
+    '$1"[REDACTED]"'
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /\bghp_[A-Za-z0-9_]+/g,
+    "env_token",
+    counts,
+    "[REDACTED]"
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /\blin_[A-Za-z0-9_]+/g,
+    "api_key",
+    counts,
+    "[REDACTED]"
+  );
+  redacted = replaceAndCount(
+    redacted,
+    /\bsk-[A-Za-z0-9_-]+/g,
+    "api_key",
+    counts,
+    "[REDACTED]"
+  );
+  return redacted;
+}
+function replaceAndCount(text, pattern, redactionClass, counts, replacement) {
+  return text.replace(pattern, (...args) => {
+    const matched = typeof args[0] === "string" ? args[0] : "";
+    if (matched.includes(REDACTED)) {
+      return matched;
+    }
+    incrementRedaction(counts, redactionClass);
+    return replacement.replace(/\$(\d+)/g, (_placeholder, index) => {
+      const group = args[Number.parseInt(index, 10)];
+      return typeof group === "string" ? group : "";
+    });
+  });
+}
+function createRedactionCounts() {
+  return /* @__PURE__ */ new Map();
+}
+function incrementRedaction(counts, redactionClass) {
+  counts.set(redactionClass, (counts.get(redactionClass) ?? 0) + 1);
+}
+function summarizeRedactionCounts(counts) {
+  return Array.from(counts.entries()).filter(([, count]) => count > 0).map(([redactionClass, count]) => ({ class: redactionClass, count })).sort((left, right) => left.class.localeCompare(right.class));
+}
 
 // ../core/src/observability/status-assembler.ts
 function isMatchingIssueRun(run, issueId, issueIdentifier) {
@@ -6308,6 +6544,8 @@ export {
   isFileMissing,
   parseRecentEvents,
   redactObservabilitySecrets,
+  redactObservabilityDiagnosticsWithStats,
+  redactObservabilityTextWithStats,
   isMatchingIssueRun,
   mapIssueOrchestrationStateToStatus,
   resolveGitHubGraphQLToken,

package/dist/{chunk-WOVNN5NW.js → chunk-4ICDSQCJ.js}

@@ -106,6 +106,7 @@ export {
   REPO_RUNTIME_DIR,
   resolveConfigDir,
   configFilePath,
+  projectConfigPath,
   daemonPidPath,
   orchestratorLogPath,
   httpStatusPath,