@nanobpm/nano-workforce 0.184.0 → 0.184.1

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.184.1](https://github.com/nanobpm/nano-workforce/compare/v0.184.0...v0.184.1) (2026-09-08)
+
+### Bug Fixes
+
+* **delivery:** allow node repositories in staged dispatch form ([#759](https://github.com/nanobpm/nano-workforce/issues/759)) ([a9fb9f6](https://github.com/nanobpm/nano-workforce/commit/a9fb9f672a2b3cd365c191755847a303b906a343)), closes [#758](https://github.com/nanobpm/nano-workforce/issues/758)
+
 ## [0.184.0](https://github.com/nanobpm/nano-workforce/compare/v0.183.2...v0.184.0) (2026-09-07)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.184.0",
+  "version": "0.184.1",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/pages/delivery-graphs/staged.mount.js

@@ -4,8 +4,8 @@
 //   • Preview DI  — recompile the proposal's BPMN (with diagram interchange) and hand it UP to the host
 //     console's process explorer over the `nano-navigate` bridge, rendered read-only BEFORE dispatch;
 //   • Dispatch    — the operator's launch action (#460): POST the proposal's `digest` — plus the
-//     repository-isolation envelope (`repository` + `baseBranch`, or an explicit `repoless` opt-out,
-//     #729) the operator supplies inline — to the dispatch door. Clicking Dispatch IS the approval,
+//     optional run-level repository fallback or explicit `repoless` opt-out — to the dispatch door.
+//     By default the graph's nodes supply their own repositories (#739/#758). Clicking Dispatch IS the approval,
 //     content-addressed to exactly the graph previewed.
 //
 // It REPLACES the old declarative `dataGrid` (a grid row-action can POST but cannot take the recompiled
@@ -100,22 +100,23 @@ function isPending(pending, kind, digest) {
 // an in-DOM "Confirm dispatch / Cancel" pair (NOT a native window.confirm, suppressed in the sandboxed
 // App-View iframe — #569). Clicking "Confirm dispatch" IS the operator approval (#460).
 //
-// The dispatch door (issue #729) now REQUIRES a repository-isolation envelope: the operator must supply
-// BOTH `repository` (`owner/repo`) and `baseBranch`, OR explicitly opt out with `repoless` for a
-// checkout-less graph — dispatching with neither would silently share the worker's launch dir across
-// agents. A staged proposal carries no repository metadata, so the operator provides it HERE at
-// dispatch time via the inline fields below. Ticking "checkout-less" disables the repo/base inputs.
+// The list omits the graph's repository metadata. Default to node repositories and let the dispatch
+// door validate provisioning (#739/#758); don't duplicate its graph-resolution algorithm here.
+// Run-level fields are an explicit fallback, not an override of nodes' own declarations.
 function dispatchControl(p, pending) {
   if (isPending(pending, "dispatch", p.digest)) {
     const repository = typeof pending.repository === "string" ? pending.repository : "";
     const baseBranch = typeof pending.baseBranch === "string" ? pending.baseBranch : "";
-    const repoless = pending.repoless === true;
-    const provDisabled = repoless ? " disabled" : "";
+    const mode = pending.mode;
+    const provDisabled = mode === "fallback" ? "" : " disabled";
     return `<span class="confirm" data-confirm="dispatch">
       <span class="confirm-msg">${esc(DISPATCH_CONFIRM)}</span>
+      <label class="confirm-check"><input type="radio" name="dispatch-mode-${esc(p.digest)}" data-dispatch-mode="${esc(p.digest)}" value="nodes"${mode === "nodes" ? " checked" : ""} /> Use node repositories</label>
+      <label class="confirm-check"><input type="radio" name="dispatch-mode-${esc(p.digest)}" data-dispatch-mode="${esc(p.digest)}" value="fallback"${mode === "fallback" ? " checked" : ""} /> Supply run-level fallback</label>
+      <label class="confirm-check"><input type="radio" name="dispatch-mode-${esc(p.digest)}" data-dispatch-mode="${esc(p.digest)}" data-dispatch-repoless="${esc(p.digest)}" value="repoless"${mode === "repoless" ? " checked" : ""} /> Dispatch checkout-less (no repository)</label>
+      <span class="confirm-msg">Use node repositories sends no run-level repository settings; the server validates that every agent node is provisioned. A run-level repository is a fallback for nodes without their own repository, not an override of node declarations. Checkout-less explicitly opts out of repository provisioning.</span>
       <label class="confirm-field">Repository <input class="confirm-input" type="text" data-dispatch-repository="${esc(p.digest)}" value="${esc(repository)}" placeholder="owner/repo" aria-label="Repository (owner/repo)"${provDisabled} /></label>
       <label class="confirm-field">Base branch <input class="confirm-input" type="text" data-dispatch-base="${esc(p.digest)}" value="${esc(baseBranch)}" placeholder="main" aria-label="Base branch"${provDisabled} /></label>
-      <label class="confirm-check"><input type="checkbox" data-dispatch-repoless="${esc(p.digest)}"${repoless ? " checked" : ""} /> Dispatch checkout-less (no repository)</label>
       <button class="btn btn-primary" type="button" data-dispatch-confirm="${esc(p.digest)}">Confirm dispatch</button>
       <button class="btn btn-ghost" type="button" data-dispatch-cancel="${esc(p.digest)}">Cancel</button>
     </span>`;
@@ -245,10 +246,10 @@ export function mountStagedProposals(host, config = {}) {
   // click can re-render the SAME list synchronously (without waiting for the next poll).
   let currentProposals = [];
   // The single open in-DOM confirmation, or null. Shape: { kind: "dispatch"|"dismiss"|"save",
-  // digest: string, name?: string, repository?: string, baseBranch?: string, repoless?: boolean }. This
+  // digest: string, name?: string, repository?: string, baseBranch?: string, mode: "nodes"|"fallback"|"repoless" }. This
   // REPLACES the native window.confirm/window.prompt the console's sandboxed App-View iframe suppresses
   // (#569): the operator approval is an inline two-step control (Confirm/Cancel), an inline name input
-  // (Save), or — for Dispatch — the repository/baseBranch/repoless envelope fields (#729), all rendered
+  // (Save), or — for Dispatch — the provisioning mode and optional fallback fields, all rendered
   // by renderProposal from this state so a background poll re-render preserves what the operator typed.
   let pending = null;
   // A re-render (renderList → new buttons) resets every button to enabled, so the disabled state is
@@ -369,22 +370,7 @@ export function mountStagedProposals(host, config = {}) {
   // the click handler, #569) — by the time we're here the operator has clicked "Confirm dispatch", so we
   // POST the digest to the dispatch door; on success the proposal flips to `dispatched` and drops off
   // the list on the next poll — refresh immediately so the operator sees it leave.
-  async function doDispatch(digest, opts) {
-    const staged = typeof digest === "string" ? digest.trim() : "";
-    if (staged === "") return;
-    const options = opts && typeof opts === "object" ? opts : {};
-    const repoless = options.repoless === true;
-    const repository = typeof options.repository === "string" ? options.repository.trim() : "";
-    const baseBranch = typeof options.baseBranch === "string" ? options.baseBranch.trim() : "";
-    // The dispatch door (issue #729) requires an isolation envelope: BOTH `repository` + `baseBranch`,
-    // or an explicit `repoless: true` opt-out. Guard here so the operator gets an inline hint instead of
-    // a bare 400 from the door (the confirm has already been closed by the click handler on a valid one).
-    if (!repoless && (repository === "" || baseBranch === "")) {
-      setStatus("Provide both a repository (owner/repo) and a base branch, or tick “Dispatch checkout-less”.", "err");
-      return;
-    }
-    // Mirror the door's mutual-exclusivity contract: pass EITHER the repo envelope OR `repoless`, never both.
-    const payload = repoless ? { digest: staged, repoless: true } : { digest: staged, repository, baseBranch };
+  async function doDispatch(payload) {
     busy(true);
     setStatus("Dispatching…");
     try {
@@ -461,7 +447,7 @@ export function mountStagedProposals(host, config = {}) {
   function openConfirm(kind, digest, name) {
     const staged = typeof digest === "string" ? digest.trim() : "";
     if (staged === "") return;
-    pending = { kind, digest: staged, name: typeof name === "string" ? name : "", repository: "", baseBranch: "", repoless: false };
+    pending = { kind, digest: staged, name: typeof name === "string" ? name : "", repository: "", baseBranch: "", mode: "nodes" };
     rerender();
     // Move focus into the name input so the operator can type immediately (best-effort; not all hosts
     // implement focus()).
@@ -496,12 +482,6 @@ export function mountStagedProposals(host, config = {}) {
     return input && typeof input.value === "string" ? input.value : "";
   }
 
-  // Read the current state of the inline "Dispatch checkout-less" checkbox for `digest`.
-  function readRepoless(digest) {
-    const box = listEl.querySelector(`[data-dispatch-repoless="${cssAttr(digest)}"]`);
-    return !!(box && box.checked);
-  }
-
   // Keep pending in sync as the operator types, so a background poll re-render (or a later confirm)
   // preserves what they've entered — the library name (Save) and the repo/base envelope fields (Dispatch).
   listEl.addEventListener("input", (ev) => {
@@ -523,14 +503,15 @@ export function mountStagedProposals(host, config = {}) {
     }
   });
 
-  // The "Dispatch checkout-less" checkbox toggles the repo/base inputs (disabled when checkout-less), so
-  // re-render on change — first hoisting the live text values into pending so the toggle doesn't drop them.
+  // Preserve fallback text across mode changes, but only enable and submit it in fallback mode.
   listEl.addEventListener("change", (ev) => {
-    const box = ev.target && ev.target.closest ? ev.target.closest("[data-dispatch-repoless]") : null;
-    if (box && pending != null && pending.kind === "dispatch") {
+    const choice = ev.target && ev.target.closest ? ev.target.closest("[data-dispatch-mode]") : null;
+    if (choice && choice.checked && pending != null && pending.kind === "dispatch" &&
+        choice.getAttribute("data-dispatch-mode") === pending.digest &&
+        ["nodes", "fallback", "repoless"].includes(choice.value)) {
       pending.repository = readDispatchField(pending.digest, "repository");
       pending.baseBranch = readDispatchField(pending.digest, "base");
-      pending.repoless = !!box.checked;
+      pending.mode = choice.value;
       rerender();
     }
   });
@@ -556,21 +537,26 @@ export function mountStagedProposals(host, config = {}) {
     const dispatchConfirmBtn = closest("[data-dispatch-confirm]");
     if (dispatchConfirmBtn) {
       ev.preventDefault();
-      const digest = dispatchConfirmBtn.getAttribute("data-dispatch-confirm");
+      const rawDigest = dispatchConfirmBtn.getAttribute("data-dispatch-confirm");
+      const digest = typeof rawDigest === "string" ? rawDigest.trim() : "";
       const isThisPending = pending != null && pending.kind === "dispatch" && pending.digest === digest;
-      // `pending.repoless` is the durable source of truth (synced on the checkbox `change`); fall back to
-      // the live DOM checkbox so a confirm without a prior toggle still reads correctly.
-      const repoless = readRepoless(digest) || (isThisPending && pending.repoless === true);
+      if (!isThisPending) return;
+      const mode = pending.mode;
       const repository = readDispatchField(digest, "repository").trim();
       const baseBranch = readDispatchField(digest, "base").trim();
       // Keep the inline confirmation OPEN on an incomplete envelope so the operator can fix it in place
       // (issue #729) — closing it would drop the fields they'd started filling.
-      if (!repoless && (repository === "" || baseBranch === "")) {
-        setStatus("Provide both a repository (owner/repo) and a base branch, or tick “Dispatch checkout-less”.", "err");
+      if (mode === "fallback" && (repository === "" || baseBranch === "")) {
+        setStatus("Run-level fallback requires both a repository (owner/repo) and a base branch.", "err");
         return;
       }
+      // Construct only the selected mode's fields: disabled fallback text must never leak into node
+      // or checkout-less dispatches, and repoless must never be inferred from blank fields.
+      const payload = mode === "fallback"
+        ? { digest, repository, baseBranch }
+        : mode === "repoless" ? { digest, repoless: true } : { digest };
       closeConfirm();
-      doDispatch(digest, { repository, baseBranch, repoless });
+      doDispatch(payload);
       return;
     }
     const dispatchCancelBtn = closest("[data-dispatch-cancel]");

package/test/delivery-graphs-staged-confirm.test.ts

@@ -37,7 +37,7 @@ interface FetchCall {
 
 /** Boot the real mount over a linkedom DOM whose `window` mimics a sandboxed App-View iframe (native
  *  confirm/prompt SUPPRESSED → false/null), with a recording fetch double. */
-function harness() {
+function harness(dispatchError?: string) {
   const { window: domWindow, document } = parseHTML(
     "<!doctype html><html><body><div id='host'></div></body></html>",
   );
@@ -54,7 +54,11 @@ function harness() {
     if (method === "GET" && url === STAGED_URL) {
       return new Response(JSON.stringify({ proposals: [PROPOSAL] }), { status: 200 });
     }
-    if (url === DISPATCH_URL) return new Response(JSON.stringify({ ok: true }), { status: 202 });
+    if (url === DISPATCH_URL) {
+      return dispatchError
+        ? new Response(JSON.stringify({ ok: false, error: dispatchError }), { status: 400 })
+        : new Response(JSON.stringify({ ok: true }), { status: 202 });
+    }
     if (url === DISMISS_URL) return new Response(JSON.stringify({ ok: true }), { status: 200 });
     if (url === SAVE_URL) return new Response(JSON.stringify({ ok: true }), { status: 200 });
     return new Response(JSON.stringify({}), { status: 404 });
@@ -93,8 +97,14 @@ function harness() {
     el.dispatchEvent(new domWindow.Event("click", { bubbles: true, cancelable: true }));
   const fire = (el: { dispatchEvent: (ev: unknown) => boolean }, type: string) =>
     el.dispatchEvent(new domWindow.Event(type, { bubbles: true, cancelable: true }));
+  const mode = (value: string) => {
+    const input = host.querySelector(`[data-dispatch-mode][value="${value}"]`);
+    assert(input, `the mounted confirmation must offer ${value} mode`);
+    input.checked = true;
+    fire(input, "change");
+  };
 
-  return { host, calls, teardown, flush, click, fire };
+  return { host, calls, teardown, flush, click, fire, mode };
 }
 
 const posts = (calls: FetchCall[], url: string) => calls.filter((c) => c.method === "POST" && c.url === url);
@@ -112,12 +122,12 @@ test("#569/#729: Dispatch dispatches via the in-DOM confirmation with the repo e
     h.click(dispatchBtn);
     await h.flush();
     assertEquals(posts(h.calls, DISPATCH_URL).length, 0, "Dispatch must not POST before the operator confirms in-DOM");
+    h.mode("fallback");
     const confirmBtn = h.host.querySelector("[data-dispatch-confirm]");
     assert(confirmBtn, "clicking Dispatch must reveal an in-DOM Confirm-dispatch control (#569), not call window.confirm");
     assert(!h.host.querySelector("[data-dispatch]"), "the plain Dispatch button is replaced by the inline confirmation while it is open");
 
-    // The operator supplies the repository-isolation envelope the door now requires (#729): a staged
-    // proposal carries no repo metadata, so the cockpit collects it here.
+    // In fallback mode the operator explicitly supplies the run-level repository-isolation envelope.
     const repoInput = h.host.querySelector("[data-dispatch-repository]");
     const baseInput = h.host.querySelector("[data-dispatch-base]");
     assert(repoInput && baseInput, "the Dispatch confirmation must expose repository + base-branch fields (#729)");
@@ -165,23 +175,134 @@ test("#729: Dispatch checkout-less posts `repoless: true` (no repo envelope) ins
   }
 });
 
-test("#729: confirming a dispatch with neither the repo envelope nor checkout-less does NOT POST (keeps the confirmation open)", async () => {
+test("#729/#758: fallback mode requires both repository and base branch and keeps incomplete confirmation open", async () => {
   const h = harness();
   try {
     await h.flush();
     h.click(h.host.querySelector("[data-dispatch]"));
     await h.flush();
-    // Confirm with blank repository/baseBranch and checkout-less unticked — the door would 400, so the
-    // mount guards client-side: no POST, and the confirmation stays open so the operator can fix it.
+    h.mode("fallback");
+    // An explicitly selected fallback needs both fields; keep it editable rather than silently
+    // changing to node repositories or checkout-less when the fields are blank.
     h.click(h.host.querySelector("[data-dispatch-confirm]"));
     await h.flush();
     assertEquals(posts(h.calls, DISPATCH_URL).length, 0, "an incomplete envelope must not POST to the dispatch door (#729)");
     assert(h.host.querySelector("[data-dispatch-confirm]"), "the confirmation stays open so the operator can supply the envelope");
+    const repoInput = h.host.querySelector("[data-dispatch-repository]");
+    const baseInput = h.host.querySelector("[data-dispatch-base]");
+    for (const [repository, baseBranch] of [["acme/widgets", " "], [" ", "main"]]) {
+      repoInput.value = repository;
+      baseInput.value = baseBranch;
+      h.click(h.host.querySelector("[data-dispatch-confirm]"));
+      await h.flush();
+      assertEquals(posts(h.calls, DISPATCH_URL).length, 0, "each fallback field is required");
+      assert(h.host.querySelector("[data-dispatch-confirm]"), "invalid fallback remains editable");
+    }
   } finally {
     h.teardown();
   }
 });
 
+test("#758: node-provisioned graph confirms through the real mount with digest only", async () => {
+  const h = harness();
+  try {
+    await h.flush();
+    h.click(h.host.querySelector("[data-dispatch]"));
+    assertEquals(posts(h.calls, DISPATCH_URL).length, 0, "opening confirmation must not dispatch");
+    h.click(h.host.querySelector("[data-dispatch-confirm]"));
+    await h.flush();
+    const dispatched = posts(h.calls, DISPATCH_URL);
+    assertEquals(dispatched.length, 1, "node repositories must reach the authoritative dispatch door");
+    assertEquals(JSON.parse(dispatched[0].body), { digest: PROPOSAL.digest });
+    assert(h.host.querySelector("#dg-staged-status").textContent.includes("Dispatched"));
+  } finally {
+    h.teardown();
+  }
+});
+
+test("dispatch normalizes the attribute-sourced digest before POSTing (untrusted DOM value)", async () => {
+  // The confirm digest is read back from a DOM attribute (untrusted) at confirm time; like doDismiss/
+  // doSaveToLibrary/doPreviewDi, dispatch must trim it so accidental whitespace never reaches the door.
+  const h = harness();
+  try {
+    await h.flush();
+    h.click(h.host.querySelector("[data-dispatch]"));
+    const confirmBtn = h.host.querySelector("[data-dispatch-confirm]");
+    assert(confirmBtn, "the in-DOM Confirm dispatch affordance must appear");
+    // Simulate an untrusted DOM value: pad the attribute the confirm handler reads the digest from.
+    confirmBtn.setAttribute("data-dispatch-confirm", `  ${PROPOSAL.digest}  `);
+    h.click(confirmBtn);
+    await h.flush();
+    const dispatched = posts(h.calls, DISPATCH_URL);
+    assertEquals(dispatched.length, 1, "the confirmed dispatch must POST despite the padded attribute");
+    assertEquals(JSON.parse(dispatched[0].body), { digest: PROPOSAL.digest }, "the digest is trimmed before dispatch");
+  } finally {
+    h.teardown();
+  }
+});
+
+test("#758: node mode displays the server's missing-node provisioning error without inferring checkout-less", async () => {
+  const error = "1 agent node(s) resolve to no repository (implement-api): each must declare its own `repository`, or the dispatch must supply a run-level `repository` + `baseBranch` fallback";
+  const h = harness(error);
+  try {
+    await h.flush();
+    h.click(h.host.querySelector("[data-dispatch]"));
+    h.click(h.host.querySelector("[data-dispatch-confirm]"));
+    await h.flush();
+    assertEquals(h.host.querySelector("#dg-staged-status").textContent, error);
+    assertEquals(posts(h.calls, DISPATCH_URL).map((call) => JSON.parse(call.body)), [{ digest: PROPOSAL.digest }]);
+    assert(h.host.querySelector("[data-dispatch]"), "the rejected proposal remains available");
+  } finally {
+    h.teardown();
+  }
+});
+
+test("#758: repository choices explain server validation and run-level fallback semantics", async () => {
+  const h = harness();
+  try {
+    await h.flush();
+    h.click(h.host.querySelector("[data-dispatch]"));
+    const nodes = h.host.querySelector('[data-dispatch-mode][value="nodes"]');
+    assert(nodes?.hasAttribute("checked"), "node repositories is the explicit default, not checkout-less");
+    assert(h.host.querySelector("[data-dispatch-repository]").disabled);
+    assert(h.host.querySelector("[data-dispatch-base]").disabled);
+    const text = h.host.textContent;
+    assert(text.includes("Use node repositories"));
+    assert(text.includes("fallback for nodes without their own repository"));
+    assert(text.includes("server validates"));
+  } finally {
+    h.teardown();
+  }
+});
+
+for (const target of ["nodes", "repoless", "fallback"]) {
+  test(`#758: switching modes to ${target} submits only the selected provisioning choice`, async () => {
+    const h = harness();
+    try {
+      await h.flush();
+      h.click(h.host.querySelector("[data-dispatch]"));
+      h.mode("fallback");
+      h.host.querySelector("[data-dispatch-repository]").value = " acme/widgets ";
+      h.host.querySelector("[data-dispatch-base]").value = " main ";
+      h.mode("repoless");
+      assert(h.host.querySelector("[data-dispatch-repository]").disabled);
+      assert(h.host.querySelector("[data-dispatch-base]").disabled);
+      h.mode("nodes");
+      h.mode(target);
+      h.click(h.host.querySelector("[data-dispatch-confirm]"));
+      await h.flush();
+      const expected = target === "fallback"
+        ? { digest: PROPOSAL.digest, repository: "acme/widgets", baseBranch: "main" }
+        : target === "repoless"
+          ? { digest: PROPOSAL.digest, repoless: true }
+          : { digest: PROPOSAL.digest };
+      assertEquals(posts(h.calls, DISPATCH_URL).map((call) => JSON.parse(call.body)), [expected]);
+    } finally {
+      h.teardown();
+    }
+  });
+}
+
 test("#569: Cancel on the in-DOM Dispatch confirmation aborts without POSTing", async () => {
   const h = harness();
   try {