@mestreyoda/fabrica 0.2.17 → 0.2.18

package/README.md

@@ -120,6 +120,8 @@ The plugin should load immediately after install, without manual remediation.
 openclaw plugins inspect fabrica
 ```
 
+If OpenClaw warns that `plugins.allow` is empty and non-bundled plugins may auto-load, that is a host trust-policy warning, not a Fabrica install failure. Fabrica can be installed and loadable while the OpenClaw operator still has to decide whether to keep open discovery or set an explicit trusted plugin list in `plugins.allow`.
+
 **4. Configure Fabrica for a workspace**:
 
 ```bash

package/defaults/fabrica/prompts/developer.md

@@ -24,20 +24,25 @@ Read the comments carefully — they often contain clarifications, decisions, or
 
 ### 1. Use the assigned worktree
 
-**NEVER work in the main checkout.** Use the assigned git worktree for this task. If it does not already exist, create it as a sibling to the repo:
+**NEVER work in the main checkout.** The task message includes a `Repo:` / `Execution path:` line with the canonical repository path for this project. Start there first. If that path is missing, inaccessible, or points somewhere unexpected, stop and return `Work result: BLOCKED` instead of creating the project under another workspace.
 
 ```bash
-# Example: repo is at ~/git/myproject
-# Worktree goes to ~/git/myproject.worktrees/feature/123-add-auth
-REPO_ROOT="$(git rev-parse --show-toplevel)"
+# Example: task message says Repo: /home/ubuntu/git/acme/myproject
+REPO_ROOT="/absolute/path/from-task-message"
+cd "$REPO_ROOT"
 BRANCH="feature/<issue-id>-<slug>"
 WORKTREE="${REPO_ROOT}.worktrees/${BRANCH}"
-git worktree add "$WORKTREE" -b "$BRANCH"
-cd "$WORKTREE"
+if git worktree list --porcelain | grep -Fq "worktree ${WORKTREE}"; then
+  cd "$WORKTREE"
+else
+  git worktree add "$WORKTREE" -b "$BRANCH"
+  cd "$WORKTREE"
+fi
 ```
 
 The `.worktrees/` directory sits NEXT TO the repo folder (not inside it). This keeps the main checkout clean for the orchestrator and other workers. If the assigned worktree already exists from a previous task on the same branch, verify it's clean and reuse it.
-Once you are in the assigned worktree, stay there for the rest of the task and do not switch back to the main checkout.
+
+Never create or implement the project under `~/.openclaw/workspace/<slug>` unless the task message explicitly says that directory is the canonical repo path. Once you are in the assigned worktree, stay there for the rest of the task and do not switch back to the main checkout.
 
 ### 2. Implement the changes
 
@@ -133,9 +138,11 @@ PR_NUM=$(gh pr list --head "$BRANCH" --json number -q '.[0].number')
 QA_RAW=$(bash scripts/qa.sh 2>&1); QA_EXIT=$?
 # MANDATORY: sanitize before embedding in PR — strip lines with tokens/keys/env vars/host paths
 QA_OUTPUT=$(printf '%s' "$QA_RAW" | grep -v -iE '(TOKEN|SECRET|_KEY|PASSWORD|CREDENTIAL|PRIVATE|AUTH)=' | grep -v -E '(ghp_|gho_|github_pat_|sk-|xox[bprs]-|AIza|AKIA|glpat-)' | grep -v -E '^declare -x ' | grep -v -E '(/home/|~/.openclaw/)' | head -200)
-CURRENT_BODY=$(gh pr view "$PR_NUM" --json body -q '.body')
+REPO_SLUG=$(gh repo view --json nameWithOwner -q '.nameWithOwner')
+CURRENT_BODY=$(gh api "repos/$REPO_SLUG/pulls/$PR_NUM" --jq '.body')
 BODY_NO_QA=$(printf '%s' "$CURRENT_BODY" | perl -0pe 's/\n## QA Evidence\b[\s\S]*?(?=\n##\s|\z)//g')
-gh pr edit "$PR_NUM" --body "$(printf '%s\n\n## QA Evidence\n\n```\n%s\n```\n\nExit code: %d\n' "$BODY_NO_QA" "$QA_OUTPUT" "$QA_EXIT")"
+NEW_BODY=$(printf '%s\n\n## QA Evidence\n\n```\n%s\n```\n\nExit code: %d\n' "$BODY_NO_QA" "$QA_OUTPUT" "$QA_EXIT")
+gh api --method PATCH "repos/$REPO_SLUG/pulls/$PR_NUM" -f body="$NEW_BODY" >/dev/null
 ```
 
 **NEVER bypass the sanitization step.** Never embed raw, unfiltered command output in PR descriptions.

package/dist/index.js

@@ -113905,8 +113905,8 @@ import fsSync from "node:fs";
 import path5 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function getCurrentVersion() {
-  if ("0.2.17") {
-    return "0.2.17";
+  if ("0.2.18") {
+    return "0.2.18";
   }
   try {
     const pkgPath = path5.join(THIS_DIR, "..", "..", "package.json");
@@ -126233,6 +126233,13 @@ async function getCurrentBranch(repoPath, runCommand) {
   });
   return result.stdout.trim();
 }
+function isCurrentProjectBaseBranch(branchName, baseBranch) {
+  const normalizedBranch = branchName.trim().toLowerCase();
+  if (!normalizedBranch) return true;
+  const normalizedBaseBranch = baseBranch?.trim().toLowerCase();
+  if (normalizedBaseBranch) return normalizedBranch === normalizedBaseBranch;
+  return ["main", "master", "develop", "development", "trunk"].includes(normalizedBranch);
+}
 function throwInvalidQaEvidence(qaEvidence, actor) {
   throw new Error(formatQaEvidenceValidationFailure(qaEvidence, actor));
 }
@@ -126264,12 +126271,16 @@ async function isConflictResolutionCycle(workspaceDir, issueId, issueRuntime) {
   }
   return false;
 }
-async function validatePrExistsForDeveloper(issueId, repoPath, provider, runCommand, workspaceDir, projectSlug, issueRuntime) {
+async function validatePrExistsForDeveloper(issueId, repoPath, provider, runCommand, workspaceDir, projectSlug, issueRuntime, baseBranch) {
   const logger6 = getRootLogger().child({ issueId, phase: "work-finish" });
   const branchName = await getCurrentBranch(repoPath, runCommand).catch(() => "");
   try {
-    const branchPr = branchName ? await provider.findOpenPrForBranch(branchName) : null;
-    const prStatus = branchPr ?? await provider.getPrStatus(issueId);
+    const preferIssuePr = isCurrentProjectBaseBranch(branchName, baseBranch);
+    const branchPr = !preferIssuePr ? await provider.findOpenPrForBranch(branchName) : null;
+    const issuePr = await provider.getPrStatus(issueId);
+    const issuePrIsReviewable = !!issuePr.url && issuePr.state !== PrState.MERGED && issuePr.state !== PrState.CLOSED;
+    const branchPrIsReviewable = !!branchPr?.url && branchPr.state !== PrState.MERGED && branchPr.state !== PrState.CLOSED;
+    const prStatus = preferIssuePr ? issuePrIsReviewable ? issuePr : branchPr ?? issuePr : branchPrIsReviewable ? branchPr : issuePr;
     if (!prStatus.url || prStatus.state === PrState.MERGED || prStatus.state === PrState.CLOSED) {
       const currentBranch = branchName || "current-branch";
       const reason = !prStatus.url ? `\u2717 No PR found for branch: ${currentBranch}` : prStatus.state === PrState.MERGED ? `\u2717 Last linked PR is already merged: ${prStatus.url}` : `\u2717 Last linked PR is closed and not reviewable: ${prStatus.url}`;
@@ -126553,7 +126564,16 @@ function createWorkFinishTool(ctx) {
       const pluginConfig = ctx.pluginConfig;
       let developerPrStatus;
       if (role === "developer" && result === "done") {
-        developerPrStatus = await validatePrExistsForDeveloper(issueId, repoPath, provider, ctx.runCommand, workspaceDir, project.slug, project.issueRuntime?.[String(issueId)]);
+        developerPrStatus = await validatePrExistsForDeveloper(
+          issueId,
+          repoPath,
+          provider,
+          ctx.runCommand,
+          workspaceDir,
+          project.slug,
+          project.issueRuntime?.[String(issueId)],
+          project.baseBranch
+        );
         await updateIssueRuntime(workspaceDir, project.slug, issueId, {
           currentPrNodeId: developerPrStatus.nodeId ?? null,
           currentPrNumber: developerPrStatus.number ?? null,
@@ -128021,7 +128041,6 @@ async function resolveEffectiveModelForGateway(requested, runCommand) {
 // lib/dispatch/message-builder.ts
 init_roles();
 function buildTaskMessage(opts) {
-  const sanitizeRepoContext = (value) => value.startsWith("/") || value.startsWith("~/") ? "[repository workspace hidden]" : value;
   const {
     projectName,
     channelId,
@@ -128033,7 +128052,7 @@ function buildTaskMessage(opts) {
     repo,
     baseBranch
   } = opts;
-  const repoDisplay = sanitizeRepoContext(repo);
+  const repoDisplay = repo;
   const isFeedbackCycle = !!opts.prFeedback;
   const parts = [
     `${role.toUpperCase()} task for project "${projectName}" \u2014 Issue #${issueId}`,
@@ -128097,13 +128116,14 @@ ${issueDescription}` : ""
   parts.push(
     ``,
     `Repo: ${repoDisplay} | Branch: ${baseBranch} | ${issueUrl}`,
-    `Project: ${projectName} | Channel: ${channelId}`
+    `Project: ${projectName} | Channel: ${channelId}`,
+    `Execution path: ${repoDisplay}`,
+    `Start by changing into the canonical repo path above before creating or reusing a worktree. Do not create or implement the project under ~/.openclaw/workspace unless the repo path itself points there.`
   );
   parts.push(...buildCompletionContract(role));
   return parts.join("\n");
 }
 function buildConflictFixMessage(opts) {
-  const sanitizeRepoContext = (value) => value.startsWith("/") || value.startsWith("~/") ? "[repository workspace hidden]" : value;
   const {
     projectName,
     channelId,
@@ -128115,7 +128135,7 @@ function buildConflictFixMessage(opts) {
     baseBranch,
     prFeedback
   } = opts;
-  const repoDisplay = sanitizeRepoContext(repo);
+  const repoDisplay = repo;
   const parts = [
     `${role.toUpperCase()} task for project "${projectName}" \u2014 Issue #${issueId}`,
     ``,
@@ -128127,7 +128147,9 @@ function buildConflictFixMessage(opts) {
   parts.push(
     ``,
     `Repo: ${repoDisplay} | Branch: ${baseBranch} | ${issueUrl}`,
-    `Project: ${projectName} | Channel: ${channelId}`
+    `Project: ${projectName} | Channel: ${channelId}`,
+    `Execution path: ${repoDisplay}`,
+    `Start by changing into the canonical repo path above before reusing the PR branch or creating its worktree. Do not resolve the issue inside ~/.openclaw/workspace unless the repo path itself points there.`
   );
   parts.push(...buildCompletionContract(role));
   return parts.join("\n");
@@ -128717,7 +128739,7 @@ async function dispatchTask(opts) {
   const securityChecklist = await loadSecurityChecklist(workspaceDir, project.name).catch(() => "");
   const primaryChannelId = project.slug;
   const isConflictFix = prFeedback?.reason === "merge_conflict";
-  const repoContext = project.repoRemote?.replace(/\.git$/, "") ?? project.slug;
+  const repoContext = project.repo ? resolveRepoPath(project.repo) : project.repoRemote?.replace(/\.git$/, "") || project.slug;
   const taskMessage = isConflictFix && prFeedback ? buildConflictFixMessage({
     projectName: project.name,
     channelId: primaryChannelId,
@@ -130417,6 +130439,7 @@ init_labels();
 // lib/services/worker-completion.ts
 init_audit();
 import fs24 from "node:fs/promises";
+init_workflow();
 
 // lib/services/worker-result.ts
 var ROLE_PREFIX = {
@@ -130823,7 +130846,8 @@ async function defaultValidateDeveloperDone(opts) {
       opts.runCommand,
       opts.workspaceDir,
       opts.projectSlug,
-      opts.issueRuntime
+      opts.issueRuntime,
+      opts.baseBranch
     );
     return { ok: true, prStatus };
   } catch (error48) {
@@ -130915,19 +130939,68 @@ async function applyWorkerResult(opts) {
       runCommand: opts.runCommand,
       workspaceDir: opts.workspaceDir,
       projectSlug: context2.projectSlug,
-      issueRuntime: context2.issueRuntime
+      issueRuntime: context2.issueRuntime,
+      baseBranch: context2.project.baseBranch
     });
     if (!validation.ok) {
+      const validationReason = validation.reason ?? "developer_validation_failed";
+      const feedbackQueueLabel = getQueueLabels(workflow, "developer").find((label) => isFeedbackState(workflow, label)) ?? "To Improve";
       await log(opts.workspaceDir, "worker_completion_skipped", {
         sessionKey: context2.project.workers[context2.parsed.role]?.levels?.[context2.slotLevel]?.[context2.slotIndex]?.sessionKey ?? null,
         projectSlug: context2.projectSlug,
         issueId: context2.issueId,
         role: context2.parsed.role,
         result: opts.result.value,
-        reason: validation.reason ?? "developer_validation_failed"
+        reason: validationReason
+      }).catch(() => {
+      });
+      await updateIssueRuntime(opts.workspaceDir, context2.projectSlug, context2.issueId, {
+        inconclusiveCompletionAt: (/* @__PURE__ */ new Date()).toISOString(),
+        inconclusiveCompletionReason: validationReason
+      }).catch(() => {
+      });
+      await executeCompletion({
+        workspaceDir: opts.workspaceDir,
+        projectSlug: context2.projectSlug,
+        role: context2.parsed.role,
+        result: "blocked",
+        issueId: context2.issueId,
+        summary: `Automatic recovery: developer reported DONE but completion validation failed.
+
+${validationReason}`,
+        provider,
+        repoPath,
+        projectName: context2.project.name,
+        channels: context2.project.channels,
+        runtime: opts.runtime,
+        workflow,
+        level: context2.slotLevel,
+        slotIndex: context2.slotIndex,
+        overrideToLabel: feedbackQueueLabel,
+        overrideReason: validationReason,
+        runCommand: opts.runCommand
+      });
+      await recordIssueLifecycle({
+        workspaceDir: opts.workspaceDir,
+        slug: context2.projectSlug,
+        issueId: context2.issueId,
+        stage: "session_completed",
+        sessionKey: context2.sessionKey,
+        details: { role: context2.parsed.role, result: "blocked", source: "agent_end_recovery", reason: validationReason }
+      }).catch(() => {
+      });
+      await log(opts.workspaceDir, "worker_completion_applied", {
+        sessionKey: context2.sessionKey,
+        projectSlug: context2.projectSlug,
+        issueId: context2.issueId,
+        role: context2.parsed.role,
+        result: "BLOCKED",
+        source: "agent_end_recovery",
+        recoveredTo: "To Improve",
+        reason: validationReason
       }).catch(() => {
       });
-      return { applied: false, reason: validation.reason ?? "developer_validation_failed" };
+      return { applied: true };
     }
     validatedPrStatus = validation.prStatus;
     await persistDeveloperPrBinding({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mestreyoda/fabrica",
-  "version": "0.2.17",
+  "version": "0.2.18",
   "description": "Autonomous software engineering pipeline for OpenClaw. Turns ideas into deployed code via intake, dispatch, review, test, and merge.",
   "type": "module",
   "main": "./dist/index.js",