@nanobpm/nano-workforce 0.190.0 → 0.191.1

package/app/deliveryHuman.ts

@@ -83,6 +83,98 @@ export function deliveryHumanContextQuestion(
   return label || "A scheduled delivery-graph step is waiting to be completed.";
 }
 
+/** The clickable link for a parked delivery-graph `human` node's Tasks-inbox row (issue #813): the
+ *  first `http(s)` URL embedded in the node's stored instruction, or `null` when it names none. The
+ *  Tasks page renders the "Decision context" as PLAIN, non-clickable text (a `detail.fields` entry),
+ *  and links only through the http(s)-gated `subject_url` `linkField` — so an author who wants the
+ *  operator to have a clickable link (e.g. the PR to review) writes the URL into the node prompt and
+ *  this lifts it onto `subject_url`. Uses the SAME exact-then-`__esc`-stripped lookup as the context
+ *  question so the twin escalation task resolves to its real node's instruction. Returns `null` (not a
+ *  fabricated link) when no URL is present, preserving today's linkless behaviour. */
+export function deliveryHumanContextUrl(
+  humanLabels: Record<string, string> | undefined,
+  elementId: string,
+): string | null {
+  const labels = humanLabels ?? {};
+  const base = elementId.replace(/__esc$/, "");
+  const instruction = labels[elementId] ?? labels[base] ?? "";
+  const url = firstHttpUrl(instruction);
+  // The stored `human_labels` are display-REDACTED (`redactFreeText` in `buildHumanLabels`): a URL that
+  // carried a credential — `//user:pass@` userinfo, or a `?query`/`#fragment` (which can hide a signed/
+  // authenticating token) — has that component collapsed to the `***` sentinel (`//***@`, `?***`, `#***`).
+  // Lifting such an altered URL onto `subject_url` would publish a DIFFERENT, broken link (a truncated
+  // query changes the referenced resource; a signed URL becomes unusable). We cannot recover the real URL
+  // here — the raw prompt is deliberately NOT stored (issue #778) — so decline to link rather than silently
+  // publishing a redaction-mangled one. A URL with no credential component is untouched by redaction and
+  // links faithfully (issue #813 review). Callers wanting a clickable link should embed a credential-free
+  // URL in the prompt.
+  return url !== null && urlBearsRedactionMarker(url) ? null : url;
+}
+
+/** The `***` sentinel {@link redactFreeText}/`redactString` leaves where it collapsed a URL's credential
+ *  span — `//***@` (userinfo), `?***` (query), `#***` (fragment). Its presence in an extracted URL means
+ *  redaction ALTERED the link, so it must not be published as a `subject_url` (issue #813 review). */
+const URL_REDACTION_MARKER = /\/\/\*\*\*@|[?#]\*\*\*/;
+
+function urlBearsRedactionMarker(url: string): boolean {
+  return URL_REDACTION_MARKER.test(url);
+}
+
+const URL_TRAILING_CLOSERS: Readonly<Record<string, string>> = { ")": "(", "]": "[", "}": "{" };
+
+const URL_TRAILING_PUNCTUATION = ".,;:!?'\"";
+
+/** Trim trailing prose punctuation a URL commonly picks up when embedded in a sentence (`.,;:!?'"` and
+ *  a wrapping `)`/`]`/`}`), WITHOUT corrupting a URL that legitimately ends in a closing bracket. A
+ *  closing bracket is only stripped when it is UNBALANCED within the URL (a prose wrapper, e.g. the `)`
+ *  in "see (https://x/y)"); a balanced pair — e.g. Wikipedia `…/Foo_(disambiguation)` — is part of the
+ *  URL and preserved, so the persisted link isn't truncated into a broken one. Bracket balance is
+ *  tracked in running per-pair counts (seeded by one linear scan, then decremented as trailing closers
+ *  are stripped) so the whole trim is a single O(n) pass — NOT the prior re-`split()`-the-prefix-each-
+ *  step quadratic (issue #813 review). */
+function trimUrlTrailingPunctuation(url: string): string {
+  const opens: Record<string, number> = { "(": 0, "[": 0, "{": 0 };
+  const closes: Record<string, number> = { ")": 0, "]": 0, "}": 0 };
+  for (const ch of url) {
+    if (ch in opens) opens[ch] += 1;
+    else if (ch in closes) closes[ch] += 1;
+  }
+  let end = url.length;
+  while (end > 0) {
+    const ch = url[end - 1];
+    const opener = URL_TRAILING_CLOSERS[ch];
+    if (opener !== undefined) {
+      // `opens`/`closes` reflect url[0:end]; only trailing closers are ever removed below, so they stay
+      // accurate. Balanced (opener count ≥ closer count) → the bracket belongs to the URL; stop.
+      if (opens[opener] >= closes[ch]) break;
+      closes[ch] -= 1;
+      end -= 1;
+      continue;
+    }
+    if (URL_TRAILING_PUNCTUATION.includes(ch)) {
+      end -= 1;
+      continue;
+    }
+    break;
+  }
+  return url.slice(0, end);
+}
+
+/** Extract the first `http(s)` URL from free text, trimming trailing sentence punctuation/brackets a
+ *  prose author commonly appends (`).,;` etc.) so the link resolves — but preserving a bracket that is
+ *  BALANCED within the URL (e.g. Wikipedia `…_(technology)`), so a valid URL is never truncated into a
+ *  broken task link. An apostrophe is a valid URL sub-delimiter (RFC 3986 §2.2), so it is allowed WITHIN
+ *  the URL and only stripped when trailing (a prose quote closer) by `trimUrlTrailingPunctuation` — the
+ *  same way a wrapping `)` is handled — so a link such as `…/It's_a_Wonderful_Life` is not truncated at
+ *  the apostrophe (issue #813 review). The scheme match is case-insensitive (RFC 3986 schemes are
+ *  case-insensitive). Returns `null` when none. */
+export function firstHttpUrl(text: string | undefined | null): string | null {
+  if (typeof text !== "string") return null;
+  const match = text.match(/https?:\/\/[^\s<>"`]+/i);
+  if (!match) return null;
+  return trimUrlTrailingPunctuation(match[0]) || null;
+}
+
 /** The GENERIC fallback form (Decision 4, step 3): captures ONE typed value into the node's single
  *  declared emitted fact, so a human node with no explicit/category form can STILL emit downstream. */
 export const GENERIC_HUMAN_FORM = "delivery-human-generic";

package/app/deliveryRunner.test.ts

@@ -128,6 +128,27 @@ test("the human node seeds prompt/nodeId/emits; a click-done (no-emit, no-prompt
   assertEquals(ack?.nodeId, "ack");
 });
 
+test("the human node's seeded prompt REDACTS an embedded credential (issue #778 review): the read-only user-task form field never renders a `//user:pass@host` secret", async () => {
+  // The compiler already redacts the human prompt for the operator-facing PREVIEW (buildHumanNodes),
+  // but the runtime user-task seeds `nodeInputs.<el>.prompt` — rendered read-only in the delivery-human
+  // form (`delivery-human-{ack,publish}.form`, key "prompt", `readonly:true`). That display path must be
+  // redacted too, or a credential-bearing instruction leaks its secret to whoever opens the task. The
+  // prompt is DISPLAY-ONLY (the functional outputs are the emit/resolvedArtifact fields), so redacting it
+  // is safe. `redactFreeText` is a no-op for a credential-free prompt, so the plain-prompt tests above
+  // stay green.
+  const graph: DeliveryGraph = {
+    nodes: [
+      { id: "publish", kind: "human", human: { prompt: "clone https://user:s3cr3t@github.com/o/r then run the manual OTP publish" }, emits: [{ name: "resolvedArtifact", type: "artifact" }] },
+    ],
+    edges: [],
+  };
+  const p = await prepareOk(graph);
+  const human = Object.values(p.nodeInputs).find((v) => "escalationSlaTimeout" in (v as Record<string, unknown>)) as Record<string, unknown>;
+  const prompt = String(human.prompt);
+  assert(!prompt.includes("s3cr3t"), `the human-task form prompt must not expose the URL credential, got: ${prompt}`);
+  assert(prompt.includes("***@github.com"), `the credential userinfo is redacted in place, got: ${prompt}`);
+});
+
 test("agent node classifier-emit contract (#506): a declared `emits` threads the emit instruction into appendPrompt; a no-emit node leaves it untouched", async () => {
   // #506: a guarded split (S7) routes on a producer's emitted scalar, published from the engine
   // variable named exactly after the fact. A real `senior:*` agent completes with the Output-contract

package/app/deliveryRunner.ts

@@ -19,7 +19,7 @@ import type { EngineClient } from "@nanobpm/urban";
 import type { DeliveryFact, DeliveryGraph, DeliveryNode } from "../nano-generated/api-io.d.ts";
 import { TRANSCRIPT_URL_BASE_VAR, transcriptUrlBaseFor } from "./agentic/transcript-url.ts";
 import { isPlausibleBranchName } from "./baseBranch.ts";
-import { AGENT_REPO_SPEC_HEADER, AGENT_TERMINAL_SUCCESS_STATUSES, assertNever, compileDeliveryGraph, DELIVERY_GRAPH_PROCESS_ID } from "./deliveryGraphCompiler.ts";
+import { AGENT_REPO_SPEC_HEADER, AGENT_TERMINAL_SUCCESS_STATUSES, assertNever, compileDeliveryGraph, DELIVERY_GRAPH_PROCESS_ID, redactFreeText } from "./deliveryGraphCompiler.ts";
 import { DEFAULT_EVERY_MS, msToIsoDuration, parseProbe, readinessPollEvery, readinessTimeout } from "./readiness.ts";
 import { agentNodeRepoEnvelope, flattenAgentTaskEnvelope, isResolvableRepo, RepoEnvelopeConflictError, RepoEnvelopeUnresolvedError } from "./repoEnvelope.ts";
 import { isoDuration } from "./reviewWait.ts";
@@ -585,7 +585,14 @@ function buildNodeInput(
         // form can render its "now do X" prompt, name the parked node, and label/hide its emit field
         // (issue #499 — the generic form otherwise renders contextless). `emits` stays the single
         // source of truth: the compiled ioMapping derives the emit label/mode from it in FEEL.
-        prompt: node.human?.prompt ?? "",
+        // REDACT the prompt: this seeds `nodeInputs.<el>.prompt`, rendered in the delivery-human form's
+        // read-only `prompt` textarea (`delivery-human-{ack,publish}.form`) to whoever opens the task —
+        // a DISPLAY surface, not a functional value (the functional outputs are the emit/resolvedArtifact
+        // fields). So it gets the SAME embedded-credential redaction the operator-facing compile PREVIEW
+        // already applies (buildHumanNodes), closing the runtime leak where a credential-bearing
+        // instruction would expose its secret in the parked task's form (issue #778 review — thread
+        // deliveryGraphCompiler.ts:826). `redactFreeText` is a no-op for a credential-free prompt.
+        prompt: redactFreeText(node.human?.prompt ?? ""),
         nodeId: node.id ?? ctx.element,
         emits: Array.isArray(node.emits) ? node.emits.map((f) => ({ ...f })) : [],
       };

package/app/mergeProtocol.ts

@@ -2,7 +2,7 @@
 //
 // Merlin's merge stage was repo-blind: it ran a plain `gh pr merge` and, on refusal, escalated to
 // a human. That breaks on any repo with a frugal-CI + on-demand-queue posture — e.g.
-// `Magikcraft/nano-bpm`, where auto-merge is OFF, CI runs only on `opened` (review-fix pushes do
+// `nanobpm/nano-bpm`, where auto-merge is OFF, CI runs only on `opened` (review-fix pushes do
 // NOT re-run it), and the documented way to land is: produce a fresh head run (`gh pr ready` /
 // close+reopen) → wait for it to go green → `@mergifyio queue`. See that repo's
 // `AGENTS.md → ## Merging PRs`.

package/app/pollUserTasks.test.ts

@@ -695,6 +695,45 @@ test("pollUserTasks: a parked delivery-human node carries its instruction as `qu
   assertEquals(byKey["20412"].question, "Run the manual OTP publish for @nanobpm/urban");
 });
 
+test("pollUserTasks: a delivery-human node lifts an embedded prompt URL onto subject_url (issue #813)", async () => {
+  // A delivery run carries no other subject URL, so the ONLY clickable link a delivery human task can
+  // offer is a URL the author embedded in the node instruction — `deliveryHumanContextUrl` lifts it
+  // onto `subject_url`. Assert the wiring end-to-end (pure-helper tests alone would miss a projection
+  // regression): the base node AND its bounded-timeout `…__esc` twin both resolve the same stored
+  // label to the same link, while a URL-less instruction leaves `subject_url` null.
+  const { data, stores } = memData({
+    delivery_graph_runs: [
+      {
+        run_key: "delivery-graph-403eb22e",
+        process_key: "dg-1",
+        status: "running",
+        title: "release runbook",
+        human_labels: JSON.stringify({
+          "delivery-human-task__n7": "Review the release PR at https://github.com/nanobpm/nano-workforce/pull/814 before publishing.",
+          "delivery-human-task__n8": "Run the manual OTP publish for @nanobpm/urban",
+        }),
+      },
+    ],
+  });
+  const restore = stubUserTaskSearch([
+    { userTaskKey: "20411", elementId: "delivery-human-task__n7", processInstanceKey: "dg-1", state: "CREATED" },
+    // the bounded-timeout escalation twin parks on the `…__esc` id but resolves the same base link
+    { userTaskKey: "20412", elementId: "delivery-human-task__n7__esc", processInstanceKey: "dg-1", state: "CREATED" },
+    // a URL-less instruction leaves the link null (no fabricated link)
+    { userTaskKey: "20413", elementId: "delivery-human-task__n8", processInstanceKey: "dg-1", state: "CREATED" },
+  ]);
+  try {
+    await pollUserTasks(data, fakeEngine({}), REST);
+  } finally {
+    restore();
+  }
+
+  const byKey = Object.fromEntries((stores.user_tasks ?? []).map((r) => [r.user_task_key, r]));
+  assertEquals(byKey["20411"].subject_url, "https://github.com/nanobpm/nano-workforce/pull/814");
+  assertEquals(byKey["20412"].subject_url, "https://github.com/nanobpm/nano-workforce/pull/814");
+  assertEquals(byKey["20413"].subject_url, null);
+});
+
 test("pollUserTasks: a delivery-human node with no stored label still gets a non-blank Decision context (issue #772)", async () => {
   // An untracked run (or a run whose label wasn't stamped) must not leave the panel blank — a static,
   // node-NEUTRAL fallback still tells the operator a delivery-graph step is waiting. It must read true

package/app/readiness.test.ts

@@ -48,6 +48,7 @@ import {
   readinessTimeoutMs,
   redactString,
   redactTarget,
+  isUrlShaped,
 } from "./readiness.ts";
 
 // A ProbeExec stub: canned http/command responses, capturing the last command it was asked to run.
@@ -862,6 +863,20 @@ test("probeBudgetMs: prefers the seeded probeTimeout (the gate timer's bound), f
 });
 
 // ── repo/ref parse + redaction ──────────────────────────────────────────────────────────────
+test("isUrlShaped: tolerates XML-attribute whitespace (TAB/LF/CR/space) between the scheme and `//` — `https:\\t//host` still classifies as a URL so its credential is redacted, not passed through as a non-URL (#778 review — thread readiness.ts:1191)", () => {
+  assert(isUrlShaped("https://host"), "a plain URL");
+  assert(isUrlShaped("//host"), "scheme-relative");
+  assert(isUrlShaped("  https://host"), "leading whitespace (trimmed first)");
+  // The XML-valid whitespace `stripXmlInvalidChars` keeps must not break the scheme→authority match:
+  assert(isUrlShaped("https:\t//user:pass@host"), "TAB between scheme and //");
+  assert(isUrlShaped("https:\n//host"), "LF between scheme and //");
+  assert(isUrlShaped("https:\r//host"), "CR between scheme and //");
+  assert(isUrlShaped("https:  //host"), "spaces between scheme and //");
+  // A plain routing token / non-URL is still NOT url-shaped.
+  assert(!isUrlShaped("senior:feature"), "a plain job-type token is not url-shaped");
+  assert(!isUrlShaped("owner/repo#1"), "a PR ref is not url-shaped");
+});
+
 test("parseRepoRef: splits owner/repo@ref and defaults the ref to HEAD", () => {
   assertEquals(parseRepoRef("o/r@abc123"), { repo: "o/r", ref: "abc123" });
   assertEquals(parseRepoRef("o/r"), { repo: "o/r", ref: "HEAD" });
@@ -874,6 +889,63 @@ test("redactString/redactTarget: strip userinfo and query (a token often rides e
   assert(!t.includes("s3cr3t"), "the secret must not survive redaction");
 });
 
+test("redactString: a `//user:pass@` userinfo that embeds a raw line break is still stripped (newline-safe)", () => {
+  // The userinfo class is `[^/@]` (NOT `[^/@\s]`): a CR/LF smuggled inside the userinfo must not
+  // break the `//…@` match and leave the credential tail visible.
+  const r = redactString("https://user:pa\nss@host/path");
+  assert(!r.includes("ss@host") && !r.includes("user:pa"), "the newline-split userinfo is redacted");
+  assertStringIncludes(r, "//***@");
+});
+
+test("redactString: a `//user:pass@` userinfo that embeds a raw TAB is still stripped (tab-safe)", () => {
+  // A TAB is a VALID XML character `stripXmlInvalidChars` does not remove, so an earlier `[^/@ \t]`
+  // userinfo class (excluding TAB) let `https://user:pa\tss@host` split before the `@` — leaving
+  // `ss@host` visible in the display artifact. The class is now `[^/@]` (issue #778 review).
+  const r = redactString("https://user:pa\tss@host/path?token=s3cr3t");
+  assert(!r.includes("ss@host") && !r.includes("user:pa"), "the tab-split userinfo is redacted");
+  assert(!r.includes("s3cr3t"), "the query token is redacted");
+  assertStringIncludes(r, "//***@");
+});
+
+test("redactString: a `//user:secret pass@` userinfo that embeds a literal SPACE is still stripped (space-safe)", () => {
+  // An earlier `[^/@ ]` class bounded the userinfo at a SPACE to avoid over-matching prose, but that let
+  // a malformed but operator-authored `https://user:secret pass@host` leave `user:secret` visible in the
+  // display artifact. The class is now `[^/@]` (space-tolerant), so the whole userinfo through the `@`
+  // collapses; the RAW value still reaches runtime unmodified (issue #778 review — thread readiness.ts:1177).
+  const r = redactString("https://user:secret pass@host/path?token=s3cr3t");
+  assert(!r.includes("secret") && !r.includes("user:"), `the space-split userinfo is redacted: ${r}`);
+  assert(!r.includes("s3cr3t"), "the query token is redacted");
+  assertStringIncludes(r, "//***@");
+});
+
+test("redactString: userinfo carrying MULTIPLE raw `@` collapses the WHOLE authority credential, not just the prefix (multi-@ suffix-leak, #778 review — thread readiness.ts:1175)", () => {
+  // Per RFC 3986 the userinfo runs to the LAST `@` before the authority's path. An earlier `[^/@]*@`
+  // span stopped at the FIRST `@`, so `https://user:pass@ss@host` rendered as `https://***@ss@host` —
+  // leaking `ss@host`, the userinfo suffix, into the display artifact. The class is now `[^/]` so the
+  // span reaches the final `@` and the entire credential authority collapses to `//***@` (leaving the
+  // real host `host`).
+  const r = redactString("https://user:pass@ss@host/path?token=s3cr3t");
+  assert(!r.includes("ss@host"), `the multi-@ userinfo suffix must not leak: ${r}`);
+  assert(!r.includes("user:pass"), "the userinfo prefix is redacted");
+  assert(!r.includes("s3cr3t"), "the query token is redacted");
+  assertStringIncludes(r, "//***@host");
+});
+
+test("redactString: a `?query`/`#fragment` value containing a literal `@` does NOT let the userinfo span cross the delimiter and leak the tail (#778 review — thread readiness.ts:1199)", () => {
+  // `//host?token=secret@tail` has NO userinfo — the `@` sits INSIDE the query. An unbounded `[^/]*@`
+  // userinfo class consumed the `?` marker (`//host?token=secret@` → `//***@`), so the follow-on
+  // query strip found no `?` and left `tail` visible. Bounding the userinfo class before `?`/`#`
+  // (`[^/?#]*@`) keeps the `?` in place so the whole `?query` (incl. the `@tail`) is redacted.
+  const r = redactString("https://host?token=secret@tail");
+  assert(!r.includes("tail"), `the query tail past the @ must not leak: ${r}`);
+  assert(!r.includes("secret"), "the query token is redacted");
+  assertEquals(r, "https://host?***");
+  // A GENUINE userinfo credential still collapses AND its query is still stripped.
+  const c = redactString("https://user:pass@host?token=s3cr3t@x");
+  assert(!c.includes("user:pass") && !c.includes("s3cr3t"), `userinfo + query both redacted: ${c}`);
+  assertEquals(c, "https://***@host?***");
+});
+
 test("redactTarget: a command target is never logged — only the kind + a fixed placeholder", () => {
   const ct = redactTarget(parseProbe({ kind: "command", target: "curl -H 'Authorization: Bearer s3cr3t' https://h/p" }));
   assertEquals(ct, "command:<redacted>");

package/app/readiness.ts

@@ -63,6 +63,11 @@ export type Backoff = "fixed" | "exponential";
 // is added here without a matching vocabulary entry (AGENTS.md: no drift surfaces).
 export const PROBE_KINDS: readonly ProbeKind[] = ["http", "command", "npm", "github-check", "capability", "pr", "epic"];
 export const ON_TIMEOUTS: readonly OnTimeout[] = ["escalate", "fail", "continue"];
+// The DEFAULT `onTimeout` an omitted value takes — the single source of truth `parseProbe` fills in and
+// the compiler's display drops as an effective default (writing it explicitly is behaviourally identical
+// to omitting it, so surfacing it would fork `semanticBpmn`/the digest from the omitted-equivalent
+// graph; issue #778 review — thread deliveryGraphCompiler.ts:1398).
+export const DEFAULT_ON_TIMEOUT: OnTimeout = "escalate";
 export const BACKOFFS: readonly Backoff[] = ["fixed", "exponential"];
 export const PR_CONDITIONS: readonly PrCondition[] = ["ready", "merged", "mergeable", "checks-green"];
 export const EPIC_CONDITIONS: readonly EpicCondition[] = ["merged", "done"];
@@ -237,7 +242,7 @@ export function parseProbe(raw: unknown, opts?: { allowLateBoundTarget?: boolean
   if (onTimeoutRaw !== "" && !isOnTimeout(onTimeoutRaw)) {
     throw new Error(`readiness probe: invalid onTimeout '${onTimeoutRaw}' (expected ${ON_TIMEOUTS.join(", ")})`);
   }
-  const onTimeout: OnTimeout = onTimeoutRaw === "" ? "escalate" : onTimeoutRaw;
+  const onTimeout: OnTimeout = onTimeoutRaw === "" ? DEFAULT_ON_TIMEOUT : onTimeoutRaw;
 
   const match = isRecord(raw.match) ? parseMatch(raw.match) : undefined;
   // A capability edge whose ref or package is blank can never resolve — fail loudly here rather than
@@ -307,7 +312,7 @@ export function parseProbe(raw: unknown, opts?: { allowLateBoundTarget?: boolean
 
 // Membership guards that narrow a validated string to its union without a type assertion (the
 // `no-unsafe-type-assertion` gate bans `as`).
-function isProbeKind(v: string): v is ProbeKind {
+export function isProbeKind(v: string): v is ProbeKind {
   for (const k of PROBE_KINDS) if (k === v) return true;
   return false;
 }
@@ -318,7 +323,7 @@ function isOnTimeout(v: string): v is OnTimeout {
 
 // `isBackoff` narrows a validated string to its union without a type assertion (the
 // `no-unsafe-type-assertion` gate bans `as`).
-function isBackoff(v: string): v is Backoff {
+export function isBackoff(v: string): v is Backoff {
   for (const b of BACKOFFS) if (b === v) return true;
   return false;
 }
@@ -414,7 +419,17 @@ export function normalizePoll(poll: ProbePoll | undefined): Required<ProbePoll>
   const everyMs = typeof everyRaw === "number" && everyRaw >= 1 ? Math.trunc(everyRaw) : DEFAULT_EVERY_MS;
   const timeoutMs =
     typeof timeoutRaw === "number" && timeoutRaw >= 1 ? Math.trunc(timeoutRaw) : DEFAULT_TIMEOUT_MS;
-  return { everyMs: Math.min(everyMs, MAX_EVERY_MS), timeoutMs, backoff: poll?.backoff ?? DEFAULT_BACKOFF };
+  // TRIM `backoff` to match `parseProbe` (`parsePoll` does `str(raw.backoff).trim()`): a padded
+  // `" exponential "` runs as the SAME `exponential` policy, so leaving the whitespace here would make
+  // the compiler's display path (`normalizePoll(p.poll)`) emit a spurious non-default `Poll:` line for a
+  // runtime-default poll — forking `semanticBpmn`/the digest from the omitted-equivalent graph and
+  // letting a re-stage bypass the idempotency fence to duplicate the run (issue #778 review — thread
+  // deliveryGraphCompiler.ts:1414). A whitespace-only / unrecognised value falls back to the default
+  // (the compiler display path takes raw JSON; a genuinely invalid backoff fails loudly later in
+  // `parseProbe`, so defaulting the DISPLAY is safe and keeps the effective-policy render honest).
+  const backoffTrimmed = typeof poll?.backoff === "string" ? poll.backoff.trim() : undefined;
+  const backoff = backoffTrimmed && isBackoff(backoffTrimmed) ? backoffTrimmed : DEFAULT_BACKOFF;
+  return { everyMs: Math.min(everyMs, MAX_EVERY_MS), timeoutMs, backoff };
 }
 
 /** The delay (ms) before the `attempt`-th retry (1-based). Fixed backoff returns `everyMs`;
@@ -1157,10 +1172,221 @@ export function redactTarget(probe: ReadinessProbe): string {
   return `${probe.kind}:${redactString(probe.target)}`;
 }
 
+/** The ONE canonical embedded-`//<userinfo>@` credential-userinfo span, shared by the redactor
+ * ({@link redactString}, which REWRITES the span to `//***@`) and the semantic reject path
+ * ({@link hasEmbeddedCredential}, used by `validateDeliveryGraph` to REJECT a credential-bearing
+ * `agent.jobType`). Keeping ONE source string means the "what counts as an embedded credential" rule
+ * can never drift between the two — the redactor must strip exactly what the validator rejects, or a
+ * credential the validator misses would be echoed un-redacted. The userinfo class is `[^/?#]` (NOT
+ * `[^/@\s]`, and NOT the earlier `[^/@]`/`[^/]`): it deliberately spans WHITESPACE up to the `@`, so a
+ * malformed-but-operator-authored `//user:secret pass@host` (a literal space in the userinfo) is
+ * caught, not left to leak verbatim into the executable `<zeebe:taskDefinition type=…>` / compiled BPMN
+ * (issue #778 review — thread deliveryGraph.ts:570). The userinfo colon is DELIBERATELY OPTIONAL
+ * (`[^/?#]*@`, not `[^/?#]*:[^/?#]*@`):
+ * a passwordless, username-only `//token@host` is a bearer/OAuth token riding the userinfo and MUST be
+ * caught too — a plain worker-routing job type never contains a `//…@` span at all (with or without a
+ * colon), so requiring a colon would only re-open a real leak for no legitimate gain (issue #778 review
+ * — thread readiness.ts:1170). `[^/?#]*@` is a single-quantifier match — linear, no catastrophic
+ * backtracking.
+ *
+ * The userinfo class is `[^/?#]` (NOT `[^/@]`): per RFC 3986 the userinfo runs to the LAST `@` before the
+ * authority's path, so a malformed-but-accepted multi-`@` value (`//user:pass@ss@host`) must collapse
+ * through EVERY `@` up to the path — an earlier `[^/@]*@` stopped at the FIRST `@`, rewriting only
+ * `//user:pass@` and leaking the `ss@host` suffix into the display artifact (issue #778 review — thread
+ * readiness.ts:1175).
+ *
+ * The class also EXCLUDES `?` and `#` (NOT the earlier `[^/]`): per RFC 3986 a raw `?`/`#` starts the
+ * query/fragment and so ENDS the authority — a `//host?token=secret@tail` carries its `@` INSIDE the
+ * query, with no userinfo at all. An unbounded `[^/]*@` greedily consumed the `?` marker
+ * (`//host?token=secret@` → `//***@`), so the follow-on `?query`/`#fragment` strip in {@link redactString}
+ * found no marker and left `tail` visible. Bounding the userinfo before `?`/`#` keeps the marker in
+ * place so the whole query/fragment (incl. any `@tail`) is redacted, while a genuine `//user:pass@host?…`
+ * still collapses its userinfo AND has its query stripped (issue #778 review — thread readiness.ts:1199).
+ * `[^/?#]` still excludes `/` (so it never crosses into the path), and the trailing `@` is anchored
+ * greedily to the last one before a `/`/`?`/`#`; `[^/?#]*@` remains a single-quantifier match, so it is
+ * linear with no catastrophic backtracking. */
+export const EMBEDDED_CREDENTIAL_SRC = "\\/\\/[^/?#]*@";
+
 /** Strip credential-bearing pieces from a free-form target string for logging: any `user:pass@`
- * userinfo and any `?query`/`#fragment` (a token often rides the query). */
+ * userinfo and any `?query`/`#fragment` (a token often rides the query). The query/fragment strip uses
+ * `[\s\S]*` (NOT `.*$`, which cannot cross a line break) so an embedded CR/LF after the `?`/`#` — e.g.
+ * `https://host/?token=secret\nnext` — cannot leave the token un-redacted; everything from the first
+ * `?`/`#` to end-of-string is consumed regardless of intervening newlines. The userinfo class is
+ * `[^/?#]` (NOT `[^/@\s]`, NOT the earlier `[^/@ ]`/`[^/@ \t]`/`[^/@]`, and NOT the later `[^/]`): ANY character smuggled
+ * INSIDE the
+ * userinfo up to the `@` — a raw CR/LF (`https://user:pa\nss@host`), an embedded TAB
+ * (`https://user:pa\tss@host`), a literal SPACE (`https://user:secret pass@host`, a malformed but
+ * operator-authored value), OR an extra raw `@` (`https://user:pass@ss@host`, whose userinfo per RFC
+ * 3986 runs to the LAST `@`) — must not break the `//…@` match and leave the credential tail visible.
+ * An earlier `[^/@ ]` bounded the userinfo at a SPACE to avoid over-matching prose, and `[^/@]` stopped
+ * at the FIRST `@` (leaking a multi-`@` suffix), but both let a credential escape into an
+ * operator-visible display artifact; since the RAW value
+ * still reaches runtime unmodified and only the DISPLAY doc is affected, redacting more (through the
+ * last `@` before the path) is the safe direction (issue #778 review). The `?`/`#` exclusion is the
+ * INVERSE correction: a `[^/]` userinfo crossed a raw query/fragment delimiter — a `?token=…@tail` query
+ * (no userinfo; the `@` rides the query) collapsed to `//***@tail`, consuming the `?` marker so the
+ * follow-on `?query`/`#fragment` strip below found nothing and LEAKED `tail`. Bounding the userinfo at
+ * `?`/`#` keeps the marker so the query strip redacts the whole tail (issue #778 review — thread
+ * readiness.ts:1199). `[^/?#]*@` remains a
+ * single-quantifier match, so it is
+ * linear with no catastrophic backtracking. Callers that surface the result in a display artifact must
+ * first pass it through `stripXmlInvalidChars` so an XML-forbidden control (e.g. U+000B) inside the
+ * userinfo cannot split the `//…@` match and be re-joined at render. */
 export function redactString(s: string): string {
-  return s
-    .replace(/\/\/[^/@\s]*@/g, "//***@")
-    .replace(/[?#].*$/, (m) => `${m[0]}***`);
+  return redactEmbeddedCredential(s).replace(/[?#][\s\S]*$/, (m) => `${m[0]}***`);
+}
+
+/** Strip ONLY the embedded `//<userinfo>@` credential span(s) from a string, collapsing each to
+ * `//***@` and leaving everything else (including any `?query`/`#fragment`, which may be a MEANINGFUL
+ * opaque-token character rather than URL syntax) untouched. Shares the ONE canonical
+ * {@link EMBEDDED_CREDENTIAL_SRC} span so "what counts as an embedded credential" can never drift from
+ * the redactor ({@link redactString}) or the validator ({@link hasEmbeddedCredential}). A `//<userinfo>@`
+ * span is UNAMBIGUOUSLY a credential wherever it sits — a plain opaque identifier
+ * (`slack:#releases`, `owner/repo#42`, `pkg@version`) never contains one — so it is safe to strip
+ * regardless of the value's URL-shape or the span's position, which is why {@link redactConnectorValue}
+ * runs it on a NON-URL-shaped free-form value (a probe target / PR ref) whose credential rides AFTER a
+ * prefix (`prefix //user:pass@host#42`) that the anchored {@link isUrlShaped} check would miss (issue
+ * #778 review — thread deliveryGraph.ts:162/566). `[^/]*@` is a single-quantifier match — linear, no
+ * catastrophic backtracking. */
+export function redactEmbeddedCredential(s: string): string {
+  return s.replace(new RegExp(EMBEDDED_CREDENTIAL_SRC, "g"), "//***@");
+}
+
+/** The ONE canonical embedded SCHEME-RELATIVE credential-URL token: a `//<userinfo>@authority…` run
+ * (bounded by the next literal space) whose `//` carries userinfo. The `@` UNAMBIGUOUSLY marks the run a
+ * URL — an opaque ref (`//host#42`, `slack:#releases`, `owner/repo#42`) never carries `//user@` — so its
+ * `?query`/`#fragment` IS URL syntax and may hide a token, exactly like an explicit-scheme
+ * {@link EMBEDDED_SCHEME_URL_SRC}. Distinct from the userinfo-ONLY {@link EMBEDDED_CREDENTIAL_SRC}, which
+ * strips just the `//user:pass@` span and (correctly, for an opaque `//host#42`) LEAVES the tail: a
+ * userinfo-bearing `//user:pass@host?token=secret` embedded after a non-URL prefix is scheme-relative,
+ * so the anchored whole-value {@link isUrlShaped} check misses it (non-URL prefix) and the userinfo-only
+ * strip leaks the `?token=secret` tail (issue #778 review — thread deliveryGraph.ts:188). Requiring the
+ * `@` keeps genuine opaque `//host#42` refs (no userinfo) untouched. The token runs to the next literal
+ * SPACE (`[^ ]*`), NOT the wider `\s` class, so it CROSSES an XML-valid internal TAB/LF/CR and still
+ * redacts a `?query` secret sitting past it. The userinfo class is `[^/?#]` (NOT the earlier `[^/]`):
+ * bounding it before a raw `?`/`#` stops the userinfo span crossing the query/fragment delimiter — a
+ * `//host?token=secret@tail` (no userinfo; the `@` rides the query) no longer collapses to `//***@tail`
+ * (leaking `tail`); it instead falls through to {@link redactEmbeddedSchemeRelativeUrl}, which strips the
+ * whole `?query` (issue #778 review — thread readiness.ts:1199, mirroring the {@link EMBEDDED_CREDENTIAL_SRC}
+ * fix). `[^/?#]*@` and `[^ ]*` are separated by the literal `@`
+ * anchor, so the match stays linear with no catastrophic backtracking. */
+const EMBEDDED_CREDENTIAL_URL_SRC = "\\/\\/[^/?#]*@[^ ]*";
+
+/** Redact each embedded SCHEME-RELATIVE credential-URL (`//<userinfo>@authority…`) token IN PLACE via
+ * {@link redactString} — stripping its `//user:pass@` userinfo AND any `?query`/`#fragment` — while
+ * leaving opaque `//host#42` refs (no userinfo) untouched. Lets {@link redactConnectorValue} catch a
+ * query/fragment secret riding a credential-bearing scheme-relative URL after a non-URL prefix
+ * (`prefix //user:pass@host?token=secret`) that the anchored {@link isUrlShaped} whole-value check AND
+ * the userinfo-only {@link redactEmbeddedCredential} both miss (issue #778 review — thread
+ * deliveryGraph.ts:188). Deterministic and total. */
+export function redactEmbeddedCredentialUrl(s: string): string {
+  return s.replace(new RegExp(EMBEDDED_CREDENTIAL_URL_SRC, "g"), (m) => redactString(m));
+}
+
+/** The ONE canonical embedded ABSOLUTE-URL token: an EXPLICIT-scheme `scheme://authority…` run bounded
+ * by whitespace. Deliberately requires an explicit `scheme:` before the `//` (NOT the scheme-relative
+ * `//authority` {@link isUrlShaped} also accepts): an absolute URL's `?query`/`#fragment` are
+ * UNAMBIGUOUSLY URL syntax and may hide a token, so they are safe to strip; a scheme-relative
+ * `//host#42` (or an opaque `slack:#releases`, `owner/repo#42`) instead carries a MEANINGFUL opaque
+ * `#`/`?` (a `parsePrTarget` PR ref) that must survive, so it is left to the userinfo-only
+ * {@link redactEmbeddedCredential}. The scheme may be followed by XML-attribute whitespace
+ * (`\s*` — TAB/LF/CR/space) BEFORE the `//` authority, exactly like {@link isUrlShaped}: those are valid
+ * XML `Char`s that `stripXmlInvalidChars` does NOT remove, so an embedded `scheme<whitespace>//authority`
+ * after a non-URL prefix (`prefix https:\t//user:pass@host?token=secret`) is not whole-value URL-shaped,
+ * escapes the anchored {@link isUrlShaped} check, and — without this `\s*` — was missed here too, leaving
+ * the fallback {@link redactEmbeddedCredential} to strip only the `//…@` userinfo and LEAK the
+ * `?token=secret` tail. Keeping this token's `scheme:` + `\s*` + `//` shape aligned with `isUrlShaped`
+ * closes that gap (issue #778 review — thread readiness.ts:1239). The token then runs to the next literal
+ * (`[^ ]+`), NOT the wider `\s` class, so it CROSSES an XML-valid internal TAB/LF/CR (0x09/0x0A/0x0D —
+ * the only whitespace `stripXmlInvalidChars` keeps) and still redacts a `?query`/`#fragment` secret
+ * sitting past it (`https://host/pa\tth?token=secret`); a `\s`-bounded token stopped at that internal
+ * whitespace and leaked the tail (#778 review — thread deliveryGraph.ts:188). Over-redacting across an
+ * internal newline is the safe direction. `\s*` and `[^ ]+` are separated by the literal `:`/`//`
+ * anchors, so the match stays linear with no catastrophic backtracking. */
+const EMBEDDED_SCHEME_URL_SRC = "[a-z][a-z0-9+.-]*:\\s*\\/\\/[^ ]+";
+
+/** Redact each embedded ABSOLUTE-URL (explicit `scheme://…`) token in a free-form value IN PLACE via
+ * {@link redactString} — stripping that token's `user:pass@` userinfo AND `?query`/`#fragment` — while
+ * leaving surrounding prose and any scheme-relative/opaque `//…`/`#`/`?` run untouched (those are
+ * handled, credential-only, by {@link redactEmbeddedCredential}). Lets {@link redactConnectorValue}
+ * catch a query/fragment secret riding an embedded absolute URL after a non-URL prefix
+ * (`prefix https://host/path?token=secret`) that the anchored {@link isUrlShaped} whole-value check
+ * misses (issue #778 review — thread deliveryGraph.ts:181). Deterministic and total. */
+export function redactEmbeddedUrl(s: string): string {
+  return s.replace(new RegExp(EMBEDDED_SCHEME_URL_SRC, "gi"), (m) => redactString(m));
+}
+
+/** The ONE canonical embedded SCHEME-RELATIVE URL token that carries a `?query`: a userinfo-LESS
+ * `//authority…?query…` run (bounded by the next literal space). Distinct from the userinfo-bearing
+ * {@link EMBEDDED_CREDENTIAL_URL_SRC} (which the `@` marks a URL) and the explicit-scheme
+ * {@link EMBEDDED_SCHEME_URL_SRC}: a `senior:feature //host?token=secret` embedded after a non-URL prefix
+ * has NO userinfo `@` and NO explicit `scheme:`, so the anchored {@link isUrlShaped} whole-value check,
+ * {@link redactEmbeddedCredentialUrl}, and {@link redactEmbeddedUrl} ALL miss it — leaking the
+ * `?token=secret` tail (issue #778 review — thread deliveryGraph.ts:633). A scheme-relative `//authority`
+ * whose `?` is present is UNAMBIGUOUSLY URL syntax — an opaque ref (`owner/repo#42`, `//host#42`) uses a
+ * `#<digits>` fragment (`parsePrTarget`), never a `//…?…` query — so its query is safe to strip while a
+ * userinfo-less opaque `//host#42` (no `?`) is left to keep its meaningful `#42`. The token runs to the
+ * next literal SPACE (`[^ ]*`), NOT the wider `\s` class, so it CROSSES an XML-valid internal TAB/LF/CR
+ * and still redacts a `?query` secret sitting past it. `[^ ]*` before/after the literal `?` anchor keeps
+ * the match linear with no catastrophic backtracking. */
+const EMBEDDED_SCHEME_RELATIVE_URL_SRC = "\\/\\/[^ ]*\\?[^ ]*";
+
+/** Redact each embedded SCHEME-RELATIVE URL (`//authority…?query…`, no userinfo, no explicit scheme)
+ * token IN PLACE via {@link redactString} — stripping its `?query`/`#fragment` — while leaving a
+ * userinfo-less opaque `//host#42` PR ref (no `?`) untouched. Lets {@link redactConnectorValue} catch a
+ * query secret riding a scheme-relative URL after a non-URL prefix (`prefix //host?token=secret`) that
+ * the anchored {@link isUrlShaped} check, {@link redactEmbeddedCredentialUrl}, and {@link redactEmbeddedUrl}
+ * all miss (issue #778 review — thread deliveryGraph.ts:633). Deterministic and total. */
+export function redactEmbeddedSchemeRelativeUrl(s: string): string {
+  return s.replace(new RegExp(EMBEDDED_SCHEME_RELATIVE_URL_SRC, "g"), (m) => redactString(m));
+}
+
+/** The canonical scheme-relative `//` authority marker — the `//` that opens an authority in ANY URL
+ * form (absolute `scheme://`, scheme-relative `//`, credential `//user@`). A worker-routing job type
+ * never legitimately contains it. */
+const SCHEME_RELATIVE_AUTHORITY_SRC = "\\/\\/";
+
+/** True when `value` embeds a scheme-relative `//authority` token (see {@link SCHEME_RELATIVE_AUTHORITY_SRC}).
+ * A plain worker-routing job type / opaque id NEVER contains `//` — so a match (whether it carries
+ * userinfo, an explicit scheme, a `?query`, a `#fragment`, or nothing) is illegitimate in an
+ * `agent.jobType` and must be rejected, closing the userinfo-less scheme-relative gap
+ * (`senior:feature //host?token=secret`) that {@link hasEmbeddedCredential} (needs `@`),
+ * {@link hasEmbeddedUrl} (needs an explicit scheme), and the anchored {@link isUrlShaped} (whole-value
+ * only) all miss (issue #778 review — thread deliveryGraph.ts:633). */
+export function hasSchemeRelativeAuthority(value: string): boolean {
+  return new RegExp(SCHEME_RELATIVE_AUTHORITY_SRC).test(value);
+}
+
+/** True when `value` embeds a `//<userinfo>@host` credential token (see {@link EMBEDDED_CREDENTIAL_SRC};
+ * the userinfo colon is optional, so a passwordless `//token@host` bearer token also matches).
+ * A plain worker-routing job type / opaque id never contains one, so a match is a credential leak to reject. */
+export function hasEmbeddedCredential(value: string): boolean {
+  return new RegExp(EMBEDDED_CREDENTIAL_SRC).test(value);
+}
+
+/** True when `value` embeds an absolute-URL token (`scheme://authority…`; see
+ * {@link EMBEDDED_SCHEME_URL_SRC}). A plain worker-routing job type / opaque id never contains one, so a
+ * match is a URL whose `?query`/`#fragment` can hide a token and which — since the executable
+ * `<zeebe:taskDefinition type=…>` carries the job type VERBATIM — would leak into the compiled BPMN.
+ * Distinct from {@link hasEmbeddedCredential}: that catches only a `//<userinfo>@` credential span and
+ * misses a userinfo-less `senior:feature https://host?token=secret` (issue #778 review — thread
+ * deliveryGraph.ts:602). */
+export function hasEmbeddedUrl(value: string): boolean {
+  return new RegExp(EMBEDDED_SCHEME_URL_SRC, "i").test(value);
+}
+
+/** The ONE canonical "is this value a URL?" classifier — a `scheme://authority` OR scheme-relative
+ * `//authority` form, either of which can hide a credential in userinfo/query/fragment. It is the single
+ * source of truth for URL-shape detection shared by the connector/jobType display redactor
+ * ({@link redactString} callers in the compiler) AND the semantic validation boundary
+ * (`validateDeliveryGraph`), so the "what counts as credential-bearing/URL-shaped" rule can never drift
+ * between the redact path and the reject path (issue #778 review — thread deliveryGraphCompiler.ts:1606).
+ * Classify on the TRIMMED value so leading whitespace (` //user:pass@host` — the OpenAPI edge caps
+ * length but does not trim) cannot bypass the anchored check. The scheme may be followed by
+ * XML-attribute whitespace (TAB/LF/CR/space) before the `//` authority: those characters are valid XML
+ * `Char`s that `stripXmlInvalidChars` does NOT remove, so `https:\t//user:pass@host` must still classify
+ * as URL-shaped or its credential escapes redaction as "not a URL" (issue #778 review — thread
+ * readiness.ts:1191). Deterministic and total. */
+export function isUrlShaped(value: string): boolean {
+  return /^([a-z][a-z0-9+.-]*:\s*)?\/\//i.test(value.trim());
 }

package/app/service.ts

@@ -32,7 +32,7 @@ import { isUniqueConstraintFence } from "./dbFence.ts";
 import { deriveDelivery, EPIC_LIVE_STATUSES, TERMINAL_STATUSES } from "./delivery.ts";
 import { sweepExpiredProposals } from "./deliveryGraphProposals.ts";
 import { deliveryGraphRuns, deriveDeliveryPhase, parseHumanLabels } from "./deliveryGraphRun.ts";
-import { deliveryHumanContextQuestion, isDeliveryHumanElement } from "./deliveryHuman.ts";
+import { deliveryHumanContextQuestion, deliveryHumanContextUrl, isDeliveryHumanElement } from "./deliveryHuman.ts";
 import { fleetSupportsDurableResume } from "./durableResume.ts";
 import { deriveEpicPhaseLive, deriveTerminalEpicPhase } from "./epicPhase.ts";
 import { deriveFeatureCompletion, deriveFeatureDelivery, FEATURE_BLOCKED_ELEMENT, FEATURE_ESCALATION_ELEMENT, FEATURE_RUN_STATUSES, type FeatureRunStatus, featureEscalations, featureRuns, featureRunsTracking, foldCompletedFeatureRun } from "./feature.ts";
@@ -3041,11 +3041,16 @@ export async function pollUserTasks(
     // A delivery-graph `human` node's user-task id is inlined per node (`delivery-human-task__<node>`
     // and its `…__esc` twin), so it can't be a static `case` above (issue #772). Fill its "Decision
     // context" from the run's stamped `human_labels` — otherwise the panel is blank and, because this
-    // surface seeds no form variables, the operator has no idea what the run is waiting on.
+    // surface seeds no form variables, the operator has no idea what the run is waiting on. A URL the
+    // author embedded in the node instruction is lifted onto `subject_url` so the row's "Link" column /
+    // detail link is clickable (issue #813); a delivery run carries no other subject URL (`subj.url` is
+    // null), so this is the only link a delivery human task can offer.
+    let deliverySubjectUrl: string | null = null;
     if (question === null && isDeliveryHumanElement(elementId)) {
       question = deliveryHumanContextQuestion(subj?.humanLabels, elementId);
+      deliverySubjectUrl = deliveryHumanContextUrl(subj?.humanLabels, elementId);
     }
-    return { userTaskKey, elementId, subjectType, subjectKey, subjectTitle: subj?.title ?? null, subjectUrl: subj?.url ?? null, question, processKey: processInstanceKey, formKey: resolvedFormKey };
+    return { userTaskKey, elementId, subjectType, subjectKey, subjectTitle: subj?.title ?? null, subjectUrl: subj?.url ?? deliverySubjectUrl, question, processKey: processInstanceKey, formKey: resolvedFormKey };
   };
 
   // Desired set, deduped by completable key (a task is open at most once; guard a page overlap / a