@nanocollective/roster 0.1.0-alpha.18 → 0.1.0-alpha.19

package/dist/cli.js

@@ -1456,7 +1456,18 @@ function short2(e) {
 import { mkdtempSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
 import { tmpdir } from "os";
 import { join as join12 } from "path";
+var PLAN_LIMIT = /upgrade to github (pro|team)|make this repository public/i;
+function isPlanLimit(error) {
+  return PLAN_LIMIT.test(error ?? "");
+}
 function judgeGate(r) {
+  if (isPlanLimit(r.error)) {
+    return {
+      level: "warn",
+      title: `${r.repo} can't require reviews: GitHub only allows that on private repos with a paid plan`,
+      fix: "Make the repo public, or move the org to GitHub Team. Until then, staff can merge their own pull requests, so check what gets merged."
+    };
+  }
   if (r.error) {
     return {
       level: "warn",
@@ -2057,7 +2068,10 @@ async function ensureGate(repo, apps) {
     return `review gate on ${repo}: ${judgeGate(now).title}`;
   }
   const added = await addGate(repo);
-  return added.ok ? `added a review-before-merge ruleset to ${repo}` : `could not add a review gate to ${repo}: ${added.error}. See docs/security.md.`;
+  if (added.ok) return `added a review-before-merge ruleset to ${repo}`;
+  if (isPlanLimit(added.error))
+    return judgeGate({ repo, approvals: null, bypass: [], error: added.error }).title;
+  return `could not add a review gate to ${repo}: ${added.error}. See docs/security.md.`;
 }
 function wirePeers(ws, plan2, root) {
   const { staff } = plan2;

package/docs/doctor-codes.md

@@ -39,7 +39,7 @@ ran at all.
 | `workflows` | No workflow in the repo is failing run after run. Reported for the ops repo here, and for each brain repo under its staff member. |
 | `workflows.failing` | **fail.** A workflow that is not one of roster's callers has failed at least its last two runs, with the date it started. Skipped and cancelled runs are stepped over. This is the canary that goes red and stays red, because whatever would have said so broke with it. |
 | `budget` | Trailing 30-day spend against a `budget` in `org.yaml`, for the org here and for a staff member under their name. A warning when it is past, never a failure, and only read when a budget is set. Cost comes from each run's record, so it says how many runs it could price. See [cost](cost.md#budgets). |
-| `review-gate` | One per product repo. **fail** when nothing requires a pull request on its default branch, or a staff App can bypass the rule; a warning when a PR is required with no approving review, or the settings cannot be read. See [security](security.md#the-review-gate). |
+| `review-gate` | One per product repo. **fail** when nothing requires a pull request on its default branch, or a staff App can bypass the rule; a warning when a PR is required with no approving review, when the repo is private on GitHub Free (which can't enforce the rule), or when the settings cannot be read. See [security](security.md#the-review-gate). |
 | `upgrade` | The tenant is in sync with the framework. |
 | `upgrade.stale` | Generated files are behind. `roster upgrade --apply`. |
 | `upgrade.owned` | **fail.** A framework-owned file was edited in the tenant. Move the change upstream or the next upgrade reverts it. |

package/docs/prompts.md

@@ -99,6 +99,12 @@ than a hang.
 | `ops.dir` | ops repo directory in the checkout |
 | `staff` | the whole of this staff member's `staff.yaml` |
 | `staff.dir` | where their brain lands in the checkout |
+| `staff.handle`, `staff.name` | their handle (`cto`) and role name (`Chief Technology Officer`) |
+| `staff.brain` | their brain repo, `owner/name` |
+| `staff.bot` | the login they post as on private repos, e.g. `acme-cto[bot]` |
+| `staff.public_bot` | the login they post as on public repos |
+| `staff.public_token_env` | the environment variable holding the public repo token during a run |
+| `staff.status_issue` | the number of their pinned status issue |
 | `staff.product` | **first entry of `works_in`, or null** |
 | `staff.product.repo` | that repo's `owner/name` |
 | `peers` | list of the other staff members |

package/docs/security.md

@@ -66,6 +66,11 @@ that does not already require an approving review, and leaves anything stricter
 pull request, so your own merge is still the approval (GitHub will not let you approve your
 own PR) and an App, which is never an admin, cannot merge at all.
 
+**On GitHub Free, private repos can't have this rule.** GitHub only enforces rulesets and
+branch protection on private repos for paid plans, so `review-gate` warns instead. Make the
+product repo public or move the org to GitHub Team. Until then, staff can merge their own pull
+requests.
+
 To set it by hand: repo **Settings -> Rules -> Rulesets -> New branch ruleset**, target the
 default branch, tick **Require a pull request before merging** with one required approval, and
 keep the staff Apps off the bypass list.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanocollective/roster",
-  "version": "0.1.0-alpha.18",
+  "version": "0.1.0-alpha.19",
   "description": "An agent-run org, powered by GitHub. Scaffold AI staff members whose brain is a repo.",
   "type": "module",
   "bin": {

package/templates/portal/js/views/org.js

@@ -35,6 +35,7 @@ const KNOWN = {
   "prompts/mention.md": "The instructions when you @-mention someone.",
   "prompts/_identity.md": "Who staff post as.",
   "prompts/_paths.md": "Where files are during a run.",
+  "prompts/_inflight.md": "Pull requests people have open, so staff don't work on the same files.",
 };
 
 const GROUPS = [