@nanobpm/nano-workforce 0.32.2 → 0.33.1

package/CHANGELOG.md

@@ -1,3 +1,23 @@
+## [0.33.1](https://github.com/nanobpm/nano-workforce/compare/v0.33.0...v0.33.1) (2026-08-09)
+
+
+### Bug Fixes
+
+* adopt Urban's built-in reconcile-aware cancel primitive ([#100](https://github.com/nanobpm/nano-workforce/issues/100)) ([e1aed94](https://github.com/nanobpm/nano-workforce/commit/e1aed94c29fc1ebd8ec0f5ca15d73e6ee723d276)), closes [nanobpm/nano-ide#144](https://github.com/nanobpm/nano-ide/issues/144)
+
+# [0.33.0](https://github.com/nanobpm/nano-workforce/compare/v0.32.2...v0.33.0) (2026-08-09)
+
+
+### Bug Fixes
+
+* **pages:** move the epic submission form to the Epic tab ([#97](https://github.com/nanobpm/nano-workforce/issues/97)) ([da6db32](https://github.com/nanobpm/nano-workforce/commit/da6db32438d8b9fd9c04fea08ffe1f981728f314))
+
+
+### Features
+
+* **ops:** add GET /app/version endpoint for runtime identity ([#98](https://github.com/nanobpm/nano-workforce/issues/98)) ([538cf61](https://github.com/nanobpm/nano-workforce/commit/538cf615cf0f9b34cdb6417346e045fc6131423e))
+* **pages:** link status column to the process explorer ([#99](https://github.com/nanobpm/nano-workforce/issues/99)) ([7f19a29](https://github.com/nanobpm/nano-workforce/commit/7f19a298b4c8c427c593a9d71181192bcac4a896))
+
 ## [0.32.2](https://github.com/nanobpm/nano-workforce/compare/v0.32.1...v0.32.2) (2026-08-09)
 
 

package/SPEC.md

@@ -267,12 +267,15 @@ carry app-specific business logic:
 | method | route | purpose |
 |---|---|---|
 | `POST` | `/app/actions/start/convergence-loop` | parse the PR ref → create the aggregate + start the process |
-| `POST` | `/app/actions/cancel` | cancel the engine instance + mark the PR `abandoned` |
 | `POST` | `/app/actions/message` (`escalation-answered`) | answer an open escalation → publish `escalation-answered` |
 | `POST` | `/hooks/submit` | webhook submit (shared-secret auth) → start the process |
 
 Everything else (`GET /`, `GET /app/pages/*`, `GET /app/data/*`, the renderer) is
-served by the runtime. `deno task purge` wipes and re-migrates the app db (used
+served by the runtime — including `POST /app/actions/cancel`, which is Urban's
+built-in reconcile-aware cancel primitive (there is **no** local handler in this
+repo): it terminates the engine instance, verifies the termination, and flips the
+tracked row to `abandoned` via the `instanceTracking` `onTerminated.set` patch.
+`deno task purge` wipes and re-migrates the app db (used
 when the engine data is purged, to keep app state and engine state consistent).
 
 ## 9. Prompt delivery — model-authored template headers

package/actions/abandon.ts

@@ -7,7 +7,7 @@
 // unknown token is a 404 (never leaks which PRs exist).
 //
 //   GET → { prKey, status, abandoned }  — `abandoned` is derived from `pull_requests.status`,
-//          which `cancelRun` sets to 'abandoned' on cancel. `true` ⇒ the agent must stop.
+//          which Urban's cancel primitive sets to 'abandoned' on cancel. `true` ⇒ the agent must stop.
 import type { ActionHandler } from "@nanobpm/urban";
 import { abandonStatusForToken } from "../app/abandon.ts";
 

package/actions/status.ts

@@ -1,6 +1,6 @@
 // GET /app/status — list the PRs currently in flight (every tracked PR not converged/abandoned).
 // A read-only projection over the app datasource so an operator or an external automation
-// harness can see active work — and grab a prKey to cancel — without opening the DB or the UI.
+// harness can see active work — and grab a `processKey` to cancel — without opening the DB or the UI.
 //
 // Optional shared-secret guard, mirroring /hooks/submit: when NANO_PR_WEBHOOK_SECRET is set,
 // callers must present it via the x-hook-secret header. Unset → open (unchanged default). The

package/actions/version.test.ts

@@ -0,0 +1,85 @@
+// Tests for GET /app/version (version/identity endpoint).
+import { assert, assertEquals } from "jsr:@std/assert@1";
+import type { AppApi } from "@nanobpm/urban";
+import handler from "./version.ts";
+import { buildVersionInfo } from "../app/version.ts";
+
+// deno-lint-ignore no-explicit-any
+const app = {} as any as AppApi;
+
+function req(method: string, headers: Record<string, string> = {}) {
+  return {
+    method,
+    path: "/app/version",
+    query: new URLSearchParams(),
+    headers: new Headers(headers),
+    text: async () => "",
+  };
+}
+
+async function call(method: string, headers: Record<string, string> = {}) {
+  // deno-lint-ignore no-explicit-any
+  const res = await handler({ req: req(method, headers) as any, body: undefined }, app);
+  // deno-lint-ignore no-explicit-any
+  return res as any;
+}
+
+Deno.test("GET returns 200 with the app identity", async () => {
+  const res = await call("GET");
+  assertEquals(res.status, 200);
+  assertEquals(res.body.name, "nano-workforce");
+  // These are always present; their values are environment-dependent so we only assert shape.
+  assert("version" in res.body);
+  assert("urbanVersion" in res.body);
+  assert("gitSha" in res.body);
+  assert("gitBranch" in res.body);
+  assert(typeof res.body.runtime === "string" && res.body.runtime.length > 0);
+  assert(typeof res.body.startedAt === "string");
+  assert(typeof res.body.uptimeSeconds === "number");
+});
+
+Deno.test("non-GET is rejected with 405", async () => {
+  const res = await call("POST");
+  assertEquals(res.status, 405);
+});
+
+Deno.test("shared-secret guard rejects a missing/wrong secret when configured", async () => {
+  const prev = Deno.env.get("NANO_PR_WEBHOOK_SECRET");
+  Deno.env.set("NANO_PR_WEBHOOK_SECRET", "s3cr3t");
+  try {
+    // The handler binds SECRET at import time, so a freshly-imported module is needed to observe
+    // the guard. Import a cache-busted copy so this test is independent of import order.
+    const mod = await import(`./version.ts?guard=${Date.now()}`);
+    const guarded = mod.default as typeof handler;
+    // deno-lint-ignore no-explicit-any
+    const bad = (await guarded({ req: req("GET") as any, body: undefined }, app)) as any;
+    assertEquals(bad.status, 401);
+    // deno-lint-ignore no-explicit-any
+    const ok = (await guarded(
+      // deno-lint-ignore no-explicit-any
+      { req: req("GET", { "x-hook-secret": "s3cr3t" }) as any, body: undefined },
+      app,
+    )) as any;
+    assertEquals(ok.status, 200);
+  } finally {
+    if (prev === undefined) Deno.env.delete("NANO_PR_WEBHOOK_SECRET");
+    else Deno.env.set("NANO_PR_WEBHOOK_SECRET", prev);
+  }
+});
+
+Deno.test("buildVersionInfo is side-effect free and stable in shape", () => {
+  const a = buildVersionInfo();
+  const b = buildVersionInfo();
+  assertEquals(a.name, b.name);
+  assertEquals(Object.keys(a).sort(), [
+    "gitBranch",
+    "gitSha",
+    "name",
+    "pid",
+    "runtime",
+    "startedAt",
+    "uptimeSeconds",
+    "urbanVersion",
+    "version",
+  ]);
+});

package/actions/version.ts

@@ -0,0 +1,25 @@
+// GET /app/version — the running app's identity (ADR: version endpoint for debugging).
+//
+// Answers "which code is this process actually running?" — the app version, the resolved
+// `@nanobpm/urban` runtime version, the git commit/branch of the working tree, the JS runtime,
+// pid, and how long it has been up. Because the app runs its `.ts` sources directly from a
+// checkout with no build step, restarts alone don't tell you whether the fix you shipped is live;
+// this endpoint does.
+//
+// Read-only and unauthenticated by design (no secrets in the payload); it mirrors the open
+// posture of the pages surface. Optional shared-secret guard when NANO_PR_WEBHOOK_SECRET is set,
+// mirroring /app/status.
+import type { ActionHandler } from "@nanobpm/urban";
+import { buildVersionInfo } from "../app/version.ts";
+
+const SECRET = process.env.NANO_PR_WEBHOOK_SECRET ?? "";
+
+const handler: ActionHandler = ({ req }) => {
+  if (req.method !== "GET") return { status: 405, body: { error: "method not allowed (use GET)" } };
+  if (SECRET && req.headers.get("x-hook-secret") !== SECRET) {
+    return { status: 401, body: { error: "unauthorized" } };
+  }
+  return { status: 200, body: buildVersionInfo() };
+};
+
+export default handler;

package/app/abandon.ts

@@ -11,7 +11,8 @@
 //   - CAPABILITY URL. The per-PR token IS the credential; the agent curls the exact URL it was
 //     handed in its prompt. An unknown token is a 404 (never leaks which PRs exist).
 //   - DERIVED, not a separate marker. `abandoned` is read straight off `pull_requests.status`,
-//     which `cancelRun` (app/service.ts) already sets to 'abandoned' on cancel. No new state to
+//     which Urban's cancel primitive sets to 'abandoned' on cancel (via the `instanceTracking`
+//     `onTerminated.set` patch, applied the instant the instance terminates). No new state to
 //     keep in sync.
 //   - ADVISORY. Like the blackboard, this never hard-locks; it narrows an unavoidable
 //     check-then-push (TOCTOU) window to near-zero. Job fencing in the harness (issue #76 layer 2)

package/app/service.test.ts

@@ -6,7 +6,7 @@
 // loop already guards in `startPlan`). Drives `submitPr` against an in-memory data layer with the
 // GitHub transport forced off so it is hermetic.
 import { assertEquals } from "jsr:@std/assert@1";
-import { cancelRun, pollIncidentsImpl, submitPr } from "./service.ts";
+import { pollIncidentsImpl, submitPr } from "./service.ts";
 
 // deno-lint-ignore no-explicit-any
 function memTable(rows: any[], key: string) {
@@ -252,76 +252,3 @@ Deno.test("pollIncidents picks the oldest incident by creationTime, sorting a mi
   assertEquals(row.incident_message, "the first fault");
 });
 
-
-// Bug: the Epic cancel button (Nano Workforce UI) POSTs the plan row's `process_key` to
-// /app/actions/cancel → cancelRun. cancelRun only knows the `pull_requests` table, so for a plan
-// instance it terminated the engine instance but returned `not_found` (a 404 the UI surfaces as an
-// error), and never reconciled the `plans` row — so "cancel didn't cancel the epic". The instance
-// IS torn down; the declarative instanceTracking reconciler flips the plans row. cancelRun must
-// therefore report success for a raw instance key it terminated.
-Deno.test("cancelRun terminates a non-PR (Epic/plan) instance and reports success", async () => {
-  const stores: Record<string, { rows: unknown[]; key: string }> = {
-    pull_requests: { rows: [], key: "pr_key" }, // no PR tracks this key — it's a plan instance
-  };
-  const data = {
-    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
-    // deno-lint-ignore no-explicit-any
-  } as any;
-  const cancelled: string[] = [];
-  const engine = {
-    // deno-lint-ignore no-explicit-any
-    cancelInstance: (input: any) => {
-      cancelled.push(String(input.processInstanceKey));
-      return Promise.resolve();
-    },
-    // deno-lint-ignore no-explicit-any
-  } as any;
-
-  const r = await cancelRun(data, engine, { processInstanceKey: "PI-EPIC-1" });
-
-  assertEquals(cancelled, ["PI-EPIC-1"]); // the engine instance was terminated …
-  assertEquals(r.ok, true); // … and cancel is reported successful (no misleading 404).
-});
-
-// The tracked-PR path must still flip the row abandoned SYNCHRONOUSLY: app/abandon.ts derives the
-// agent-abort signal straight off pull_requests.status, so a deferred (reconciler-only) write would
-// widen the check-then-push window a side-effecting agent races against.
-Deno.test("cancelRun flips a tracked PR to abandoned immediately and clears the escalation pointer", async () => {
-  const PR_KEY = "owner/repo#7";
-  const stores: Record<string, { rows: unknown[]; key: string }> = {
-    pull_requests: {
-      rows: [{
-        pr_key: PR_KEY,
-        repo: "owner/repo",
-        number: 7,
-        status: "escalated",
-        process_key: "PI-PR-7",
-        open_escalation_id: 3,
-        open_escalation_question: "why?",
-      }],
-      key: "pr_key",
-    },
-  };
-  const data = {
-    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
-    // deno-lint-ignore no-explicit-any
-  } as any;
-  const cancelled: string[] = [];
-  const engine = {
-    // deno-lint-ignore no-explicit-any
-    cancelInstance: (input: any) => {
-      cancelled.push(String(input.processInstanceKey));
-      return Promise.resolve();
-    },
-    // deno-lint-ignore no-explicit-any
-  } as any;
-
-  const r = await cancelRun(data, engine, { prKey: PR_KEY });
-
-  assertEquals(r.ok, true);
-  assertEquals(cancelled, ["PI-PR-7"]);
-  const pr = stores.pull_requests.rows[0] as Record<string, unknown>;
-  assertEquals(pr.status, "abandoned");
-  assertEquals(pr.open_escalation_id, null);
-  assertEquals(pr.open_escalation_question, null);
-});

package/app/service.ts

@@ -438,70 +438,6 @@ export async function answerEscalation(
   return { ok: true, escalationId: open.id };
 }
 
-/** How a caller identifies the run to cancel: by its engine `processInstanceKey` or, more
- * ergonomically, by the `prKey` the status endpoint reports. The cancel action rejects a
- * request that supplies both, so exactly one selector reaches here. */
-export interface CancelSelector {
-  processInstanceKey?: string;
-  prKey?: string;
-}
-
-/** Cancel a run and mark its read-model row abandoned. Two paths converge here:
- *
- *  - **Tracked PR** (a `pull_requests` row): the engine instance is terminated (which emits no
- *    completion event — no worker runs) and this function flips the PR row to `abandoned`
- *    *synchronously*. The immediacy matters: the agent-abort capability (`app/abandon.ts`) derives
- *    `abandoned` straight off `pull_requests.status`, so a deferred write would widen the
- *    check-then-push window a side-effecting agent races against.
- *  - **Any other instance** (e.g. the cancel button on an Epic/plan row, which POSTs the row's
- *    `process_key`): the instance is terminated here, and the declarative `instanceTracking`
- *    reconciler (`nano.app.json`) flips the owning row (`plans`) to abandoned on its next poll.
- *    That same reconciler is also the safety net for terminations that never reach this function
- *    at all — an operator terminating the instance directly, or a crash.
- *
- * Accepts either selector; a PR already in a terminal state is left untouched so a stale cancel
- * can't overwrite a `converged` outcome with `abandoned`. */
-export async function cancelRun(data: DataLayer, engine: EngineClient, selector: CancelSelector) {
-  const { processInstanceKey, prKey } = selector;
-  const table = prs(data);
-  const pr = prKey
-    ? await table.get(prKey)
-    : processInstanceKey
-    ? (await table.find({ process_key: processInstanceKey }))[0]
-    : undefined;
-  if (pr && TERMINAL_STATUSES.includes(pr.status)) {
-    return { ok: false, kind: "terminal", reason: `PR already ${pr.status}`, prKey: pr.pr_key };
-  }
-  const instanceKey = pr?.process_key ?? processInstanceKey ?? null;
-  if (instanceKey) {
-    try {
-      await engine.cancelInstance({ processInstanceKey: instanceKey });
-    } catch (err) {
-      // The instance may already be gone (converged/cancelled) — still reconcile the app row so
-      // a stale "converging" PR can't linger in the UI.
-      console.warn(`[cancel] engine cancel for ${instanceKey}: ${err}`);
-    }
-  }
-  if (pr) {
-    await table.update(pr.pr_key, {
-      status: "abandoned",
-      updated_at: now(),
-      open_escalation_id: null,
-      open_escalation_question: null,
-    });
-    return { ok: true, prKey: pr.pr_key };
-  }
-  // No tracked PR for this key. If we were handed a raw instance key (e.g. the cancel button
-  // on an Epic/plan row, which POSTs the row's `process_key`), the instance has still been
-  // terminated above — the declarative `instanceTracking` reconciler (nano.app.json) flips the
-  // owning row (`plans`) to abandoned on its next poll. Report success so the UI does not
-  // surface a misleading 404 for a cancel that actually took effect.
-  if (instanceKey) {
-    return { ok: true, processInstanceKey: instanceKey };
-  }
-  return { ok: false, kind: "not_found", reason: "no PR for that selector" };
-}
-
 /** A PR currently in flight, as reported by the status endpoint. */
 export interface ActivePr {
   prKey: string;

package/app/version.ts

@@ -0,0 +1,205 @@
+// Runtime version/identity of the running nano-workforce app.
+//
+// The app runs its TypeScript sources DIRECTLY from a checkout (`node --experimental-strip-types
+// main.ts`) with no build/bundle step, so "which code is running" can only be answered by
+// inspecting the working tree at runtime. This module gathers that identity — the app's package
+// version, the resolved `@nanobpm/urban` version, the git commit (read from `.git`, handling both
+// an ordinary `.git` directory and the `gitdir:` file pointer used by worktrees/submodules, with
+// an env override for detached deploys), plus the Node/Deno runtime, pid and start time — so an operator
+// debugging a stuck instance can confirm the process is on the code they think it is.
+//
+// Every probe is best-effort: a missing file or unavailable `.git` yields `null` for that field
+// rather than throwing, so `/app/version` never fails just because one source is absent.
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join, resolve, isAbsolute } from "node:path";
+
+// Captured once, at module load — i.e. when the running process booted this code.
+const STARTED_AT = new Date();
+
+const REPO_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
+
+function readText(path: string): string | null {
+  try {
+    return readFileSync(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+
+function readJson(path: string): Record<string, unknown> | null {
+  const text = readText(path);
+  if (text == null) return null;
+  try {
+    return JSON.parse(text) as Record<string, unknown>;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Read an env var across runtimes: Node exposes `process.env`; Deno may not populate it, so fall
+ * back to `Deno.env.get` (guarded — reading env can throw without `--allow-env`).
+ */
+function envVar(name: string): string | null {
+  const fromProcess = globalThis.process?.env?.[name];
+  if (typeof fromProcess === "string" && fromProcess.trim()) return fromProcess.trim();
+  const deno = (globalThis as { Deno?: { env?: { get?(k: string): string | undefined } } }).Deno;
+  try {
+    const fromDeno = deno?.env?.get?.(name);
+    if (typeof fromDeno === "string" && fromDeno.trim()) return fromDeno.trim();
+  } catch {
+    // Env access denied — treat as unset.
+  }
+  return null;
+}
+
+/**
+ * Locate the repo's git directories. `.git` is usually a directory, but in a `git worktree` (this
+ * app is often run from one) or a submodule it is a FILE containing `gitdir: <path>`, so a naive
+ * `${REPO_ROOT}/.git/HEAD` read returns null even on a live checkout. Resolve both the (possibly
+ * per-worktree) git dir that holds `HEAD` and the COMMON dir that holds loose refs / `packed-refs`.
+ */
+function resolveGitDirs(): { gitDir: string; commonDir: string } | null {
+  const dotGit = join(REPO_ROOT, ".git");
+  // Ordinary checkout: `.git` is a directory and `HEAD` sits directly inside.
+  if (readText(join(dotGit, "HEAD")) != null) {
+    return { gitDir: dotGit, commonDir: dotGit };
+  }
+  // Linked worktree / submodule: `.git` is a file pointing at the real git dir.
+  const pointer = readText(dotGit);
+  const match = pointer ? /^gitdir:\s*(.+?)\s*$/m.exec(pointer) : null;
+  if (!match) return null;
+  const target = match[1].trim();
+  const gitDir = isAbsolute(target) ? target : resolve(REPO_ROOT, target);
+  // A linked worktree keeps its own HEAD in `gitDir` but shares refs via the common dir, named by
+  // the `commondir` file (e.g. "../..").
+  const common = readText(join(gitDir, "commondir"));
+  const commonDir = common?.trim()
+    ? (isAbsolute(common.trim()) ? common.trim() : resolve(gitDir, common.trim()))
+    : gitDir;
+  return { gitDir, commonDir };
+}
+
+/** The app's own `package.json` (read once, reused by name + version). */
+function appPackage(): Record<string, unknown> | null {
+  return readJson(join(REPO_ROOT, "package.json"));
+}
+
+/** The app's name from `package.json`, scope-stripped (e.g. "@foo/bar" → "bar"). */
+function appName(pkg: Record<string, unknown> | null): string {
+  const raw = typeof pkg?.name === "string" ? pkg.name.trim() : "";
+  if (!raw) return "nano-workforce";
+  const unscoped = raw.startsWith("@") ? raw.slice(raw.indexOf("/") + 1) : raw;
+  return unscoped || "nano-workforce";
+}
+
+/** The app's own version from its `package.json`. */
+function appVersion(pkg: Record<string, unknown> | null): string | null {
+  return typeof pkg?.version === "string" ? pkg.version : null;
+}
+
+/** The installed `@nanobpm/urban` version (the runtime that materializes the whole app). */
+function urbanVersion(): string | null {
+  const pkg = readJson(join(REPO_ROOT, "node_modules", "@nanobpm", "urban", "package.json"));
+  return typeof pkg?.version === "string" ? pkg.version : null;
+}
+
+/**
+ * The git commit the working tree is on, read straight from `.git` so it reflects the ACTUAL
+ * checked-out code — not a value baked at some earlier build. Resolves a symbolic `HEAD`
+ * (`ref: refs/heads/…`) via the loose ref file (checking both the per-worktree and common dirs),
+ * falling back to `packed-refs`. An explicit `NANO_WORKFORCE_GIT_SHA` env var wins (for deploys
+ * that ship without a `.git` directory).
+ */
+function gitSha(): string | null {
+  const env = envVar("NANO_WORKFORCE_GIT_SHA");
+  if (env) return env;
+
+  const dirs = resolveGitDirs();
+  if (dirs == null) return null;
+  const head = readText(join(dirs.gitDir, "HEAD"));
+  if (head == null) return null;
+
+  const ref = head.trim();
+  if (!ref.startsWith("ref:")) {
+    // Detached HEAD — the file already holds the commit sha.
+    return ref || null;
+  }
+  const refPath = ref.slice(4).trim(); // e.g. "refs/heads/main"
+  // A loose ref may live in the per-worktree dir or the common dir; check both.
+  const loose = readText(join(dirs.gitDir, refPath)) ?? readText(join(dirs.commonDir, refPath));
+  if (loose != null && loose.trim()) return loose.trim();
+
+  // Packed refs fallback (always in the common dir): lines of "<sha> <refname>".
+  const packed = readText(join(dirs.commonDir, "packed-refs"));
+  if (packed != null) {
+    for (const line of packed.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith("^")) continue;
+      const [sha, name] = trimmed.split(/\s+/, 2);
+      if (name === refPath) return sha;
+    }
+  }
+  return null;
+}
+
+/** The current branch name from `HEAD`, or `null` when detached / unavailable. */
+function gitBranch(): string | null {
+  const dirs = resolveGitDirs();
+  if (dirs == null) return null;
+  const head = readText(join(dirs.gitDir, "HEAD"));
+  if (head == null) return null;
+  const ref = head.trim();
+  if (!ref.startsWith("ref:")) return null;
+  const refPath = ref.slice(4).trim();
+  return refPath.startsWith("refs/heads/") ? refPath.slice("refs/heads/".length) : refPath;
+}
+
+function runtime(): string {
+  const proc = globalThis.process;
+  // Deno exposes `Deno.version.deno`; Node exposes `process.version` (e.g. "v24.15.0").
+  const deno = (globalThis as { Deno?: { version?: { deno?: string } } }).Deno;
+  if (deno?.version?.deno) return `deno ${deno.version.deno}`;
+  if (proc?.version) return `node ${proc.version}`;
+  return "unknown";
+}
+
+export interface VersionInfo {
+  name: string;
+  version: string | null;
+  urbanVersion: string | null;
+  gitSha: string | null;
+  gitBranch: string | null;
+  runtime: string;
+  pid: number | null;
+  startedAt: string;
+  uptimeSeconds: number;
+}
+
+/**
+ * Everything except `uptimeSeconds` is fixed for the life of the process, so probe the working
+ * tree ONCE at module load rather than re-reading files (`.git`, package.jsons) on every request.
+ */
+const STATIC: Omit<VersionInfo, "uptimeSeconds"> = (() => {
+  const proc = globalThis.process;
+  const pkg = appPackage();
+  return Object.freeze({
+    name: appName(pkg),
+    version: appVersion(pkg),
+    urbanVersion: urbanVersion(),
+    gitSha: gitSha(),
+    gitBranch: gitBranch(),
+    runtime: runtime(),
+    pid: typeof proc?.pid === "number" ? proc.pid : null,
+    startedAt: STARTED_AT.toISOString(),
+  });
+})();
+
+/** Gather the running app's identity. Cheap and side-effect-free — safe to call per request. */
+export function buildVersionInfo(): VersionInfo {
+  return {
+    ...STATIC,
+    uptimeSeconds: Math.round((Date.now() - STARTED_AT.getTime()) / 1000),
+  };
+}

package/deno.json

@@ -6,7 +6,7 @@
     ]
   },
   "imports": {
-    "@nanobpm/urban": "npm:@nanobpm/urban@^0.29.0"
+    "@nanobpm/urban": "npm:@nanobpm/urban@^0.30.0"
   },
   "tasks": {
     "start": "deno run --allow-net --allow-read --allow-write --allow-run=gh --allow-env main.ts",

package/deno.lock

@@ -3,7 +3,7 @@
   "specifiers": {
     "jsr:@std/assert@1": "1.0.19",
     "jsr:@std/internal@^1.0.12": "1.0.14",
-    "npm:@nanobpm/urban@0.29": "0.29.0",
+    "npm:@nanobpm/urban@0.30": "0.30.0",
     "npm:@semantic-release/changelog@^6.0.3": "6.0.3_semantic-release@24.2.9__typescript@5.9.3_typescript@5.9.3",
     "npm:@semantic-release/git@^10.0.1": "10.0.1_semantic-release@24.2.9__typescript@5.9.3_typescript@5.9.3",
     "npm:@semantic-release/npm@^13.1.5": "13.1.5_semantic-release@24.2.9__typescript@5.9.3",
@@ -82,8 +82,8 @@
         "ws"
       ]
     },
-    "@nanobpm/urban@0.29.0": {
-      "integrity": "sha512-79CMeYpfnPmKSF2x7zRJ6ZcmAimOknCxySFXvg2z0JtS/pTGlUvkzZy87xp5jHB88LZdKsUIuvVnN5hnZKdS+g==",
+    "@nanobpm/urban@0.30.0": {
+      "integrity": "sha512-jaxVFwmWk/dLyA/Owgyons7tc8Yx0iJfotY7mN63hCQS7jenak9d/h3wQmevphF+JDq7E8Ovo+9Wq2K1CGy+yw==",
       "dependencies": [
         "@nanobpm/nano-app-schema",
         "@nanobpm/nano-sdk",
@@ -1757,11 +1757,11 @@
   },
   "workspace": {
     "dependencies": [
-      "npm:@nanobpm/urban@0.29"
+      "npm:@nanobpm/urban@0.30"
     ],
     "packageJson": {
       "dependencies": [
-        "npm:@nanobpm/urban@0.29",
+        "npm:@nanobpm/urban@0.30",
         "npm:@semantic-release/changelog@^6.0.3",
         "npm:@semantic-release/git@^10.0.1",
         "npm:@semantic-release/npm@^13.1.5",

package/nano.app.json

@@ -50,7 +50,10 @@
       "table": "plans",
       "keyField": "process_key",
       "statusField": "status",
-      "activeStatuses": ["planning", "dispatched"],
+      "activeStatuses": [
+        "planning",
+        "dispatched"
+      ],
       "onTerminated": {
         "set": {
           "status": "abandoned"
@@ -145,15 +148,16 @@
       "path": "/app/actions/start/plan-fanout",
       "module": "actions/plan-start.ts"
     },
-    {
-      "path": "/app/actions/cancel",
-      "module": "actions/cancel.ts"
-    },
     {
       "path": "/app/status",
       "module": "actions/status.ts",
       "method": "GET"
     },
+    {
+      "path": "/app/version",
+      "module": "actions/version.ts",
+      "method": "GET"
+    },
     {
       "path": "/app/actions/message",
       "module": "actions/message.ts"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.32.2",
+  "version": "0.33.1",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",
@@ -40,7 +40,7 @@
     "test": "deno test -A"
   },
   "dependencies": {
-    "@nanobpm/urban": "^0.29.0"
+    "@nanobpm/urban": "^0.30.0"
   },
   "devDependencies": {
     "@semantic-release/changelog": "^6.0.3",

package/pages/epic.page.json

@@ -23,10 +23,22 @@
       "type": "text",
       "id": "subtitle",
       "props": {
-        "text": "Read-only observability over each plan's review trace, wave state, merge-exclusion graph, coordination notes, and trial-merge gate results.",
+        "text": "Hand an issue to the fleet to plan and implement it, then track each plan's review trace, wave state, merge-exclusion graph, coordination notes, and trial-merge gate results.",
         "variant": "sub"
       }
     },
+    {
+      "type": "actionForm",
+      "id": "plan-submit",
+      "props": {
+        "title": "Hand an issue to the fleet",
+        "submitLabel": "Plan & implement",
+        "action": { "kind": "startProcess", "process": "plan-fanout" },
+        "fields": [
+          { "key": "issue", "label": "owner/repo#123 or a GitHub issue URL", "type": "text" }
+        ]
+      }
+    },
     {
       "type": "dataGrid",
       "id": "epic-plans",
@@ -54,7 +66,7 @@
         ],
         "columns": [
           { "field": "plan_key", "header": "Issue", "linkField": "issue_url" },
-          { "field": "status", "header": "Status" },
+          { "field": "status", "header": "Status", "link": { "kind": "processExplorer", "keyField": "process_key" } },
           { "field": "task_count", "header": "Tasks" },
           { "field": "open_task_id", "header": "Open escalation" },
           { "field": "updated_at", "header": "Updated" }

package/pages/home.page.json

@@ -40,18 +40,6 @@
         ]
       }
     },
-    {
-      "type": "actionForm",
-      "id": "plan-submit",
-      "props": {
-        "title": "Hand an issue to the fleet",
-        "submitLabel": "Plan & implement",
-        "action": { "kind": "startProcess", "process": "plan-fanout" },
-        "fields": [
-          { "key": "issue", "label": "owner/repo#123 or a GitHub issue URL", "type": "text" }
-        ]
-      }
-    },
     {
       "type": "dataGrid",
       "id": "prs",
@@ -83,7 +71,7 @@
         ],
         "columns": [
           { "field": "pr_key", "header": "PR", "linkField": "url" },
-          { "field": "status", "header": "Status" },
+          { "field": "status", "header": "Status", "link": { "kind": "processExplorer", "keyField": "process_key" } },
           { "field": "incident_message", "header": "Incident" },
           { "field": "current_round", "header": "Round" },
           { "field": "active_worker", "header": "Agent" },
@@ -195,7 +183,7 @@
         ],
         "columns": [
           { "field": "plan_key", "header": "Issue" },
-          { "field": "status", "header": "Status" },
+          { "field": "status", "header": "Status", "link": { "kind": "processExplorer", "keyField": "process_key" } },
           { "field": "task_count", "header": "Tasks" },
           { "field": "updated_at", "header": "Updated" }
         ],

package/actions/cancel.ts

@@ -1,29 +0,0 @@
-// POST /app/actions/cancel — override the generic row-cancel action. Terminating the engine
-// instance emits no completion event, so reconcile the app row (status='abandoned', clear the
-// open escalation) here. Accepts either `processInstanceKey` or the `prKey` the status endpoint
-// reports, so a caller can cancel a run it discovered via GET /app/status.
-import type { ActionHandler } from "@nanobpm/urban";
-import { cancelRun } from "../app/service.ts";
-
-const str = (v: unknown): string | undefined => {
-  if (v == null) return undefined;
-  const s = String(v).trim();
-  return s === "" ? undefined : s;
-};
-
-const handler: ActionHandler = async ({ body }, app) => {
-  const b = (body ?? {}) as { processInstanceKey?: unknown; prKey?: unknown };
-  const processInstanceKey = str(b.processInstanceKey);
-  const prKey = str(b.prKey);
-  if (!processInstanceKey && !prKey) {
-    return { status: 400, body: { error: "processInstanceKey or prKey is required" } };
-  }
-  if (processInstanceKey && prKey) {
-    return { status: 400, body: { error: "provide exactly one of processInstanceKey or prKey" } };
-  }
-  const r = await cancelRun(app.data, app.engine, { processInstanceKey, prKey });
-  if (r.ok) return { status: 200, body: r };
-  return { status: r.kind === "terminal" ? 409 : 404, body: r };
-};
-
-export default handler;