@nanobpm/nano-workforce 0.33.0 → 0.33.1

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## [0.33.1](https://github.com/nanobpm/nano-workforce/compare/v0.33.0...v0.33.1) (2026-08-09)
+
+
+### Bug Fixes
+
+* adopt Urban's built-in reconcile-aware cancel primitive ([#100](https://github.com/nanobpm/nano-workforce/issues/100)) ([e1aed94](https://github.com/nanobpm/nano-workforce/commit/e1aed94c29fc1ebd8ec0f5ca15d73e6ee723d276)), closes [nanobpm/nano-ide#144](https://github.com/nanobpm/nano-ide/issues/144)
+
 # [0.33.0](https://github.com/nanobpm/nano-workforce/compare/v0.32.2...v0.33.0) (2026-08-09)
 
 

package/SPEC.md

@@ -267,12 +267,15 @@ carry app-specific business logic:
 | method | route | purpose |
 |---|---|---|
 | `POST` | `/app/actions/start/convergence-loop` | parse the PR ref → create the aggregate + start the process |
-| `POST` | `/app/actions/cancel` | cancel the engine instance + mark the PR `abandoned` |
 | `POST` | `/app/actions/message` (`escalation-answered`) | answer an open escalation → publish `escalation-answered` |
 | `POST` | `/hooks/submit` | webhook submit (shared-secret auth) → start the process |
 
 Everything else (`GET /`, `GET /app/pages/*`, `GET /app/data/*`, the renderer) is
-served by the runtime. `deno task purge` wipes and re-migrates the app db (used
+served by the runtime — including `POST /app/actions/cancel`, which is Urban's
+built-in reconcile-aware cancel primitive (there is **no** local handler in this
+repo): it terminates the engine instance, verifies the termination, and flips the
+tracked row to `abandoned` via the `instanceTracking` `onTerminated.set` patch.
+`deno task purge` wipes and re-migrates the app db (used
 when the engine data is purged, to keep app state and engine state consistent).
 
 ## 9. Prompt delivery — model-authored template headers

package/actions/abandon.ts

@@ -7,7 +7,7 @@
 // unknown token is a 404 (never leaks which PRs exist).
 //
 //   GET → { prKey, status, abandoned }  — `abandoned` is derived from `pull_requests.status`,
-//          which `cancelRun` sets to 'abandoned' on cancel. `true` ⇒ the agent must stop.
+//          which Urban's cancel primitive sets to 'abandoned' on cancel. `true` ⇒ the agent must stop.
 import type { ActionHandler } from "@nanobpm/urban";
 import { abandonStatusForToken } from "../app/abandon.ts";
 

package/actions/status.ts

@@ -1,6 +1,6 @@
 // GET /app/status — list the PRs currently in flight (every tracked PR not converged/abandoned).
 // A read-only projection over the app datasource so an operator or an external automation
-// harness can see active work — and grab a prKey to cancel — without opening the DB or the UI.
+// harness can see active work — and grab a `processKey` to cancel — without opening the DB or the UI.
 //
 // Optional shared-secret guard, mirroring /hooks/submit: when NANO_PR_WEBHOOK_SECRET is set,
 // callers must present it via the x-hook-secret header. Unset → open (unchanged default). The

package/app/abandon.ts

@@ -11,7 +11,8 @@
 //   - CAPABILITY URL. The per-PR token IS the credential; the agent curls the exact URL it was
 //     handed in its prompt. An unknown token is a 404 (never leaks which PRs exist).
 //   - DERIVED, not a separate marker. `abandoned` is read straight off `pull_requests.status`,
-//     which `cancelRun` (app/service.ts) already sets to 'abandoned' on cancel. No new state to
+//     which Urban's cancel primitive sets to 'abandoned' on cancel (via the `instanceTracking`
+//     `onTerminated.set` patch, applied the instant the instance terminates). No new state to
 //     keep in sync.
 //   - ADVISORY. Like the blackboard, this never hard-locks; it narrows an unavoidable
 //     check-then-push (TOCTOU) window to near-zero. Job fencing in the harness (issue #76 layer 2)

package/app/service.test.ts

@@ -6,7 +6,7 @@
 // loop already guards in `startPlan`). Drives `submitPr` against an in-memory data layer with the
 // GitHub transport forced off so it is hermetic.
 import { assertEquals } from "jsr:@std/assert@1";
-import { cancelRun, pollIncidentsImpl, submitPr } from "./service.ts";
+import { pollIncidentsImpl, submitPr } from "./service.ts";
 
 // deno-lint-ignore no-explicit-any
 function memTable(rows: any[], key: string) {
@@ -252,76 +252,3 @@ Deno.test("pollIncidents picks the oldest incident by creationTime, sorting a mi
   assertEquals(row.incident_message, "the first fault");
 });
 
-
-// Bug: the Epic cancel button (Nano Workforce UI) POSTs the plan row's `process_key` to
-// /app/actions/cancel → cancelRun. cancelRun only knows the `pull_requests` table, so for a plan
-// instance it terminated the engine instance but returned `not_found` (a 404 the UI surfaces as an
-// error), and never reconciled the `plans` row — so "cancel didn't cancel the epic". The instance
-// IS torn down; the declarative instanceTracking reconciler flips the plans row. cancelRun must
-// therefore report success for a raw instance key it terminated.
-Deno.test("cancelRun terminates a non-PR (Epic/plan) instance and reports success", async () => {
-  const stores: Record<string, { rows: unknown[]; key: string }> = {
-    pull_requests: { rows: [], key: "pr_key" }, // no PR tracks this key — it's a plan instance
-  };
-  const data = {
-    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
-    // deno-lint-ignore no-explicit-any
-  } as any;
-  const cancelled: string[] = [];
-  const engine = {
-    // deno-lint-ignore no-explicit-any
-    cancelInstance: (input: any) => {
-      cancelled.push(String(input.processInstanceKey));
-      return Promise.resolve();
-    },
-    // deno-lint-ignore no-explicit-any
-  } as any;
-
-  const r = await cancelRun(data, engine, { processInstanceKey: "PI-EPIC-1" });
-
-  assertEquals(cancelled, ["PI-EPIC-1"]); // the engine instance was terminated …
-  assertEquals(r.ok, true); // … and cancel is reported successful (no misleading 404).
-});
-
-// The tracked-PR path must still flip the row abandoned SYNCHRONOUSLY: app/abandon.ts derives the
-// agent-abort signal straight off pull_requests.status, so a deferred (reconciler-only) write would
-// widen the check-then-push window a side-effecting agent races against.
-Deno.test("cancelRun flips a tracked PR to abandoned immediately and clears the escalation pointer", async () => {
-  const PR_KEY = "owner/repo#7";
-  const stores: Record<string, { rows: unknown[]; key: string }> = {
-    pull_requests: {
-      rows: [{
-        pr_key: PR_KEY,
-        repo: "owner/repo",
-        number: 7,
-        status: "escalated",
-        process_key: "PI-PR-7",
-        open_escalation_id: 3,
-        open_escalation_question: "why?",
-      }],
-      key: "pr_key",
-    },
-  };
-  const data = {
-    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
-    // deno-lint-ignore no-explicit-any
-  } as any;
-  const cancelled: string[] = [];
-  const engine = {
-    // deno-lint-ignore no-explicit-any
-    cancelInstance: (input: any) => {
-      cancelled.push(String(input.processInstanceKey));
-      return Promise.resolve();
-    },
-    // deno-lint-ignore no-explicit-any
-  } as any;
-
-  const r = await cancelRun(data, engine, { prKey: PR_KEY });
-
-  assertEquals(r.ok, true);
-  assertEquals(cancelled, ["PI-PR-7"]);
-  const pr = stores.pull_requests.rows[0] as Record<string, unknown>;
-  assertEquals(pr.status, "abandoned");
-  assertEquals(pr.open_escalation_id, null);
-  assertEquals(pr.open_escalation_question, null);
-});

package/app/service.ts

@@ -438,70 +438,6 @@ export async function answerEscalation(
   return { ok: true, escalationId: open.id };
 }
 
-/** How a caller identifies the run to cancel: by its engine `processInstanceKey` or, more
- * ergonomically, by the `prKey` the status endpoint reports. The cancel action rejects a
- * request that supplies both, so exactly one selector reaches here. */
-export interface CancelSelector {
-  processInstanceKey?: string;
-  prKey?: string;
-}
-
-/** Cancel a run and mark its read-model row abandoned. Two paths converge here:
- *
- *  - **Tracked PR** (a `pull_requests` row): the engine instance is terminated (which emits no
- *    completion event — no worker runs) and this function flips the PR row to `abandoned`
- *    *synchronously*. The immediacy matters: the agent-abort capability (`app/abandon.ts`) derives
- *    `abandoned` straight off `pull_requests.status`, so a deferred write would widen the
- *    check-then-push window a side-effecting agent races against.
- *  - **Any other instance** (e.g. the cancel button on an Epic/plan row, which POSTs the row's
- *    `process_key`): the instance is terminated here, and the declarative `instanceTracking`
- *    reconciler (`nano.app.json`) flips the owning row (`plans`) to abandoned on its next poll.
- *    That same reconciler is also the safety net for terminations that never reach this function
- *    at all — an operator terminating the instance directly, or a crash.
- *
- * Accepts either selector; a PR already in a terminal state is left untouched so a stale cancel
- * can't overwrite a `converged` outcome with `abandoned`. */
-export async function cancelRun(data: DataLayer, engine: EngineClient, selector: CancelSelector) {
-  const { processInstanceKey, prKey } = selector;
-  const table = prs(data);
-  const pr = prKey
-    ? await table.get(prKey)
-    : processInstanceKey
-    ? (await table.find({ process_key: processInstanceKey }))[0]
-    : undefined;
-  if (pr && TERMINAL_STATUSES.includes(pr.status)) {
-    return { ok: false, kind: "terminal", reason: `PR already ${pr.status}`, prKey: pr.pr_key };
-  }
-  const instanceKey = pr?.process_key ?? processInstanceKey ?? null;
-  if (instanceKey) {
-    try {
-      await engine.cancelInstance({ processInstanceKey: instanceKey });
-    } catch (err) {
-      // The instance may already be gone (converged/cancelled) — still reconcile the app row so
-      // a stale "converging" PR can't linger in the UI.
-      console.warn(`[cancel] engine cancel for ${instanceKey}: ${err}`);
-    }
-  }
-  if (pr) {
-    await table.update(pr.pr_key, {
-      status: "abandoned",
-      updated_at: now(),
-      open_escalation_id: null,
-      open_escalation_question: null,
-    });
-    return { ok: true, prKey: pr.pr_key };
-  }
-  // No tracked PR for this key. If we were handed a raw instance key (e.g. the cancel button
-  // on an Epic/plan row, which POSTs the row's `process_key`), the instance has still been
-  // terminated above — the declarative `instanceTracking` reconciler (nano.app.json) flips the
-  // owning row (`plans`) to abandoned on its next poll. Report success so the UI does not
-  // surface a misleading 404 for a cancel that actually took effect.
-  if (instanceKey) {
-    return { ok: true, processInstanceKey: instanceKey };
-  }
-  return { ok: false, kind: "not_found", reason: "no PR for that selector" };
-}
-
 /** A PR currently in flight, as reported by the status endpoint. */
 export interface ActivePr {
   prKey: string;

package/deno.json

@@ -6,7 +6,7 @@
     ]
   },
   "imports": {
-    "@nanobpm/urban": "npm:@nanobpm/urban@^0.29.0"
+    "@nanobpm/urban": "npm:@nanobpm/urban@^0.30.0"
   },
   "tasks": {
     "start": "deno run --allow-net --allow-read --allow-write --allow-run=gh --allow-env main.ts",

package/deno.lock

@@ -3,7 +3,7 @@
   "specifiers": {
     "jsr:@std/assert@1": "1.0.19",
     "jsr:@std/internal@^1.0.12": "1.0.14",
-    "npm:@nanobpm/urban@0.29": "0.29.0",
+    "npm:@nanobpm/urban@0.30": "0.30.0",
     "npm:@semantic-release/changelog@^6.0.3": "6.0.3_semantic-release@24.2.9__typescript@5.9.3_typescript@5.9.3",
     "npm:@semantic-release/git@^10.0.1": "10.0.1_semantic-release@24.2.9__typescript@5.9.3_typescript@5.9.3",
     "npm:@semantic-release/npm@^13.1.5": "13.1.5_semantic-release@24.2.9__typescript@5.9.3",
@@ -82,8 +82,8 @@
         "ws"
       ]
     },
-    "@nanobpm/urban@0.29.0": {
-      "integrity": "sha512-79CMeYpfnPmKSF2x7zRJ6ZcmAimOknCxySFXvg2z0JtS/pTGlUvkzZy87xp5jHB88LZdKsUIuvVnN5hnZKdS+g==",
+    "@nanobpm/urban@0.30.0": {
+      "integrity": "sha512-jaxVFwmWk/dLyA/Owgyons7tc8Yx0iJfotY7mN63hCQS7jenak9d/h3wQmevphF+JDq7E8Ovo+9Wq2K1CGy+yw==",
       "dependencies": [
         "@nanobpm/nano-app-schema",
         "@nanobpm/nano-sdk",
@@ -1757,11 +1757,11 @@
   },
   "workspace": {
     "dependencies": [
-      "npm:@nanobpm/urban@0.29"
+      "npm:@nanobpm/urban@0.30"
     ],
     "packageJson": {
       "dependencies": [
-        "npm:@nanobpm/urban@0.29",
+        "npm:@nanobpm/urban@0.30",
         "npm:@semantic-release/changelog@^6.0.3",
         "npm:@semantic-release/git@^10.0.1",
         "npm:@semantic-release/npm@^13.1.5",

package/nano.app.json

@@ -50,7 +50,10 @@
       "table": "plans",
       "keyField": "process_key",
       "statusField": "status",
-      "activeStatuses": ["planning", "dispatched"],
+      "activeStatuses": [
+        "planning",
+        "dispatched"
+      ],
       "onTerminated": {
         "set": {
           "status": "abandoned"
@@ -145,10 +148,6 @@
       "path": "/app/actions/start/plan-fanout",
       "module": "actions/plan-start.ts"
     },
-    {
-      "path": "/app/actions/cancel",
-      "module": "actions/cancel.ts"
-    },
     {
       "path": "/app/status",
       "module": "actions/status.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.33.0",
+  "version": "0.33.1",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",
@@ -40,7 +40,7 @@
     "test": "deno test -A"
   },
   "dependencies": {
-    "@nanobpm/urban": "^0.29.0"
+    "@nanobpm/urban": "^0.30.0"
   },
   "devDependencies": {
     "@semantic-release/changelog": "^6.0.3",

package/actions/cancel.ts

@@ -1,29 +0,0 @@
-// POST /app/actions/cancel — override the generic row-cancel action. Terminating the engine
-// instance emits no completion event, so reconcile the app row (status='abandoned', clear the
-// open escalation) here. Accepts either `processInstanceKey` or the `prKey` the status endpoint
-// reports, so a caller can cancel a run it discovered via GET /app/status.
-import type { ActionHandler } from "@nanobpm/urban";
-import { cancelRun } from "../app/service.ts";
-
-const str = (v: unknown): string | undefined => {
-  if (v == null) return undefined;
-  const s = String(v).trim();
-  return s === "" ? undefined : s;
-};
-
-const handler: ActionHandler = async ({ body }, app) => {
-  const b = (body ?? {}) as { processInstanceKey?: unknown; prKey?: unknown };
-  const processInstanceKey = str(b.processInstanceKey);
-  const prKey = str(b.prKey);
-  if (!processInstanceKey && !prKey) {
-    return { status: 400, body: { error: "processInstanceKey or prKey is required" } };
-  }
-  if (processInstanceKey && prKey) {
-    return { status: 400, body: { error: "provide exactly one of processInstanceKey or prKey" } };
-  }
-  const r = await cancelRun(app.data, app.engine, { processInstanceKey, prKey });
-  if (r.ok) return { status: 200, body: r };
-  return { status: r.kind === "terminal" ? 409 : 404, body: r };
-};
-
-export default handler;