@nanobpm/nano-workforce 0.185.0 → 0.185.1

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.185.1](https://github.com/nanobpm/nano-workforce/compare/v0.185.0...v0.185.1) (2026-09-08)
+
+### Bug Fixes
+
+* **agentic:** capability probe recognises single-package v-prefixed release tags ([#765](https://github.com/nanobpm/nano-workforce/issues/765)) ([79faa67](https://github.com/nanobpm/nano-workforce/commit/79faa676f46882d4e10f3ce0bb70080f40e3e757)), closes [#764](https://github.com/nanobpm/nano-workforce/issues/764)
+
 ## [0.185.0](https://github.com/nanobpm/nano-workforce/compare/v0.184.1...v0.185.0) (2026-09-08)
 
 ### Features

package/app/readiness.test.ts

@@ -220,6 +220,57 @@ test("matchCapability: the bare '#274' ref form resolves identically to 'nano-id
   assertEquals(res.bind?.resolvedArtifact, "@nanobpm/urban@1.2.3");
 });
 
+// ── #764: single-package repos tag releases `v<version>` / bare `<version>` (semantic-release default) ──
+
+const c8Match = { capabilityRef: "c8ctl-plugin-nano#206", package: "c8ctl-plugin-nano" };
+
+test("#764 matchCapability: a `v<version>` release (body refs the cap) resolves in a single-package repo", () => {
+  // Red before the fix: `v1.58.0` never matched versionForPackage(tag, 'c8ctl-plugin-nano'),
+  // so the gate reported 'not published yet' though the npm package WAS published.
+  const res = matchCapability(c8Match, [rel("v1.58.0", [206])]);
+  assert(res.ready);
+  assertEquals(res.bind?.resolvedArtifact, "c8ctl-plugin-nano@1.58.0");
+});
+
+test("#764 matchCapability: a bare `<version>` release resolves the same way in a single-package repo", () => {
+  const res = matchCapability(c8Match, [rel("1.58.0", [206])]);
+  assert(res.ready);
+  assertEquals(res.bind?.resolvedArtifact, "c8ctl-plugin-nano@1.58.0");
+});
+
+test("#764 monorepo guard: a stray `v2.0.0` alongside package-scoped tags is NOT attributed to another package", () => {
+  // The repo emits package-scoped tags → it is a monorepo → bare `v` tags are ignored, so the stray
+  // v2.0.0 can never leak into @nanobpm/other's resolution.
+  const releases = [rel("@nanobpm/other@1.0.0", [200]), rel("v2.0.0", [274])];
+  const res = matchCapability({ capabilityRef: "nano-ide#274", package: "@nanobpm/other" }, releases);
+  assert(!res.ready, "the stray v2.0.0 must not resolve #274 for @nanobpm/other");
+});
+
+test("#764 summariseCapabilityCandidates: shows the extended `v`-tag candidate in a single-package repo", () => {
+  const summary = summariseCapabilityCandidates(c8Match, [rel("v1.58.0", [206]), rel("v1.57.0", [200])]);
+  assertStringIncludes(summary, "2 c8ctl-plugin-nano release(s) observed");
+  assertStringIncludes(summary, "c8ctl-plugin-nano@1.58.0 refs #206");
+  assertStringIncludes(summary, "c8ctl-plugin-nano@1.57.0 no #206");
+});
+
+test("#764 summariseCapabilityCandidates: in a monorepo a stray `v` tag is not summarised as another package's candidate", () => {
+  const summary = summariseCapabilityCandidates({ capabilityRef: "nano-ide#274", package: "@nanobpm/other" }, [
+    rel("@nanobpm/other@1.0.0", [200]),
+    rel("v2.0.0", [274]),
+  ]);
+  assertStringIncludes(summary, "1 @nanobpm/other release(s) observed");
+  assert(!summary.includes("2.0.0"), "the stray monorepo v2.0.0 is not a candidate for @nanobpm/other");
+});
+
+test("#764 newestPublishedVersion: resolves from `v`-tags under the single-package condition", () => {
+  assertEquals(newestPublishedVersion("c8ctl-plugin-nano", [rel("v1.57.0", []), rel("v1.58.0", [])]), "1.58.0");
+});
+
+test("#764 newestPublishedVersion: a stray `v` tag in a monorepo is ignored for a scoped package", () => {
+  const releases = [rel("@nanobpm/urban@0.9.0", []), rel("v9.9.9", [])];
+  assertEquals(newestPublishedVersion("@nanobpm/urban", releases), "0.9.0");
+});
+
 // ── #514 Defect A: the capability gate is self-diagnosing on escalation ──────────────────────────
 
 test("#514 Defect A summariseCapabilityCandidates: lists candidate releases (newest first) and whether each references the ref", () => {

package/app/readiness.ts

@@ -527,18 +527,58 @@ function bodyReferences(body: string, num: string): boolean {
   return new RegExp(`#${num}(?!\\d)`).test(body);
 }
 
-/** The `<version>` of a release tagged exactly `<package>@<version>` (numeric-dotted), or undefined
- * when the tag belongs to another package or is not a version tag. Per-package scoping is enforced
- * here: a sibling package's provenance can never leak into this package's resolution. */
-function versionForPackage(tag: string, pkg: string): string | undefined {
+/** A numeric-dotted SemVer-ish core, e.g. `1.58.0`. */
+const VERSION_CORE = /^\d+(\.\d+)*$/;
+
+/** Is `tag` a **package-scoped** version tag — `<anything>@<version>` (numeric-dotted), the monorepo
+ * convention (e.g. `@nanobpm/urban@0.54.0`, `c8ctl-plugin-nano@1.58.0`)? Used to decide whether a
+ * repo follows the single-package (`v1.58.0` / bare) convention: a repo is "single-package" only when
+ * it emits NO package-scoped tags at all. Anchored on the LAST `@` so scoped npm names (`@org/name@1.0.0`)
+ * are recognised. */
+function isPackageScopedVersionTag(tag: string): boolean {
+  const at = tag.lastIndexOf("@");
+  if (at <= 0) return false; // no `@`, or a leading `@` (scoped-name start) with nothing before it
+  return VERSION_CORE.test(tag.slice(at + 1).trim());
+}
+
+/** True when the repo's observed release set contains NO `<anything>@<version>`-prefixed package-scoped
+ * tags at all — i.e. it follows the single-package `v<version>` / bare `<version>` convention
+ * (semantic-release default), so a bare `v1.58.0` tag may be attributed to the sole package (#764).
+ * A repo using package-scoped tags is a monorepo: bare `v` tags are ignored there, keeping
+ * per-package provenance scoping airtight (a sibling package's provenance can never leak). */
+function repoIsSinglePackage(releases: readonly GithubRelease[]): boolean {
+  for (const rel of releases) {
+    if (rel && typeof rel.tag === "string" && isPackageScopedVersionTag(rel.tag)) return false;
+  }
+  return true;
+}
+
+/** The `<version>` a release tag carries for `pkg`, or undefined when it belongs to another package /
+ * is not a version tag. A tag is a candidate for `pkg` when **either**:
+ *
+ * 1. it is `<pkg>@<version>` (numeric-dotted) — the monorepo convention, per-package scoped so a
+ *    sibling package's provenance can never leak; **or**
+ * 2. `singlePackage` is true (the repo emits no package-scoped tags — see {@link repoIsSinglePackage})
+ *    AND the tag is `v<version>` or a bare `<version>` — the single-package / semantic-release-default
+ *    convention (#764). In a monorepo (`singlePackage` false) bare `v` tags are ignored, so scoping
+ *    stays airtight. */
+function versionForPackage(tag: string, pkg: string, singlePackage: boolean): string | undefined {
   const prefix = `${pkg}@`;
-  if (!tag.startsWith(prefix)) return undefined;
-  const v = tag.slice(prefix.length).trim();
-  return /^\d+(\.\d+)*$/.test(v) ? v : undefined;
+  if (tag.startsWith(prefix)) {
+    const v = tag.slice(prefix.length).trim();
+    return VERSION_CORE.test(v) ? v : undefined;
+  }
+  if (singlePackage) {
+    const v = (tag.startsWith("v") ? tag.slice(1) : tag).trim();
+    if (VERSION_CORE.test(v)) return v;
+  }
+  return undefined;
 }
 
 /** A compact, deterministic, BOUNDED summary of the capability candidate releases a probe observed
- * (issue #514 Defect A). Lists the releases tagged `<match.package>@<version>` (newest first) and,
+ * (issue #514 Defect A). Lists the releases carrying a resolvable `<match.package>` version — tagged
+ * `<match.package>@<version>`, or (for a single-package repo) a `v<version>`/bare `<version>` tag —
+ * newest first, and,
  * for each, whether its body referenced `match.capabilityRef` — so an escalated capability gate can
  * show a human/agent EXACTLY what the probe saw (a genuine "not published yet" vs. a transient
  * false-negative where a matching release was live but its provenance body was momentarily empty).
@@ -548,6 +588,7 @@ function versionForPackage(tag: string, pkg: string): string | undefined {
 export function summariseCapabilityCandidates(
   match: ProbeMatch | undefined,
   releases: readonly GithubRelease[],
+  singlePackage: boolean = repoIsSinglePackage(releases),
 ): string {
   const pkg = match?.package;
   const ref = match?.capabilityRef;
@@ -556,7 +597,7 @@ export function summariseCapabilityCandidates(
   const candidates: { version: string; refs: boolean }[] = [];
   for (const rel of releases) {
     if (!rel || typeof rel.tag !== "string" || typeof rel.body !== "string") continue;
-    const version = versionForPackage(rel.tag, pkg);
+    const version = versionForPackage(rel.tag, pkg, singlePackage);
     if (!version) continue;
     candidates.push({ version, refs: num !== undefined && bodyReferences(rel.body, num) });
   }
@@ -591,7 +632,8 @@ const CAPABILITY_SUMMARY_LIMIT = 8;
 export function matchCapability(match: ProbeMatch | undefined, releases: readonly GithubRelease[]): ProbeResult {
   const pkg = match?.package;
   const ref = match?.capabilityRef;
-  const observed = summariseCapabilityCandidates(match, releases);
+  const singlePackage = repoIsSinglePackage(releases);
+  const observed = summariseCapabilityCandidates(match, releases, singlePackage);
   if (!pkg || !ref) return { ready: false, detail: "capability: missing package/capabilityRef", observed };
   const num = capabilityNumber(ref);
   if (!num) return { ready: false, detail: "capability: unparseable capabilityRef (no #NNN)", observed };
@@ -599,7 +641,7 @@ export function matchCapability(match: ProbeMatch | undefined, releases: readonl
   let firstVersion: string | undefined;
   for (const rel of releases) {
     if (!rel || typeof rel.tag !== "string" || typeof rel.body !== "string") continue;
-    const version = versionForPackage(rel.tag, pkg);
+    const version = versionForPackage(rel.tag, pkg, singlePackage);
     if (!version) continue;
     if (!bodyReferences(rel.body, num)) continue;
     if (firstVersion === undefined || cmpVersion(version, firstVersion) < 0) firstVersion = version;
@@ -615,9 +657,10 @@ export function matchCapability(match: ProbeMatch | undefined, releases: readonl
 export function newestPublishedVersion(pkg: string | undefined, releases: readonly GithubRelease[]): string | undefined {
   if (!pkg) return undefined;
   let newest: string | undefined;
+  const singlePackage = repoIsSinglePackage(releases);
   for (const rel of releases) {
     if (!rel || typeof rel.tag !== "string") continue;
-    const version = versionForPackage(rel.tag, pkg);
+    const version = versionForPackage(rel.tag, pkg, singlePackage);
     if (!version) continue;
     if (newest === undefined || cmpVersion(version, newest) > 0) newest = version;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.185.0",
+  "version": "0.185.1",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",