@nanocollective/roster 0.1.0-alpha.2 → 0.1.0-alpha.4

package/templates/portal/js/yaml.js

@@ -0,0 +1,134 @@
+/* Colour for YAML.
+ *
+ * `org.yaml` and `staff.yaml` are the two files here a person actually reads closely, and they
+ * were served as one flat grey wall: the comments, the keys and the values all the same weight,
+ * so finding `mention_timeout_minutes` meant reading every line. Structure is the thing YAML has
+ * and prose does not, and showing it costs about eighty lines.
+ *
+ * Deliberately not a parser. It is a per-line tokeniser that knows comments, keys, quoted
+ * strings, numbers and the three keywords — enough to read by, and it cannot fail on a file it
+ * does not understand, because anything it does not recognise is left as plain text.
+ */
+
+import { el, esc } from "./dom.js";
+
+/** A `<pre>` holding the highlighted source. */
+export function yamlPre(text, className = "code yaml") {
+  const pre = el("pre", { className });
+  pre.innerHTML = yamlHTML(text);
+  return pre;
+}
+
+/** Escaped, highlighted HTML. Takes raw text: it does its own escaping. */
+export function yamlHTML(text) {
+  return String(text ?? "")
+    .split("\n")
+    .map(colourLine)
+    .join("\n");
+}
+
+/**
+ * The same, for text that is already HTML-escaped.
+ *
+ * The markdown renderer escapes a fenced block before it knows what language it is, and
+ * un-escaping four entities to escape them again is exact and cheaper than restructuring
+ * the renderer around one case.
+ */
+export function yamlHTMLFromEscaped(escaped) {
+  return yamlHTML(
+    String(escaped ?? "")
+      .replace(/&lt;/g, "<")
+      .replace(/&gt;/g, ">")
+      .replace(/&quot;/g, '"')
+      .replace(/&amp;/g, "&"),
+  );
+}
+
+const span = (cls, text) => '<span class="' + cls + '">' + esc(text) + "</span>";
+
+function colourLine(raw) {
+  const [code, comment] = splitComment(raw);
+  return (code ? colourCode(code) : "") + (comment ? span("yc", comment) : "");
+}
+
+/**
+ * Split a trailing comment off, without cutting a `#` that is inside a string.
+ *
+ * `marker: will   # the provenance tag` is a comment; `name: "a # b"` is not. YAML also only
+ * starts a comment at the beginning of a line or after whitespace, which is what keeps a
+ * `#hashtag` in a value intact.
+ */
+function splitComment(raw) {
+  let quote = null;
+  for (let i = 0; i < raw.length; i++) {
+    const c = raw[i];
+    if (quote) {
+      if (c === quote && raw[i - 1] !== "\\") quote = null;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      quote = c;
+      continue;
+    }
+    if (c === "#" && (i === 0 || /\s/.test(raw[i - 1]))) return [raw.slice(0, i), raw.slice(i)];
+  }
+  return [raw, ""];
+}
+
+const DOC = /^\s*(---|\.\.\.)\s*$/;
+/** Indent, then any run of list dashes: `  - - name: x` is two levels of list. */
+const LEAD = /^(\s*)((?:-\s+)*)/;
+/** A key is everything up to the first colon that is followed by a space or the end of line. */
+const KEY = /^([^\s"'#][^:]*?)(:)(\s|$)/;
+
+function colourCode(code) {
+  if (DOC.test(code)) return span("yp", code);
+
+  const lead = LEAD.exec(code);
+  const indent = lead[1];
+  const dashes = lead[2];
+  let rest = code.slice(indent.length + dashes.length);
+  let out = indent + (dashes ? span("yd", dashes) : "");
+
+  /* A line that opens a flow collection has no key of its own: `- { handle: cto }` is a list
+     item whose keys are all inside the braces, and taking "{ handle" for a key marked the
+     brace as part of the name. */
+  const key = /^[{[]/.test(rest) ? null : KEY.exec(rest);
+  if (key) {
+    out += span("yk", key[1]) + span("yp", key[2]) + key[3];
+    rest = rest.slice(key[1].length + 1 + key[3].length);
+  }
+  return out + colourValue(rest);
+}
+
+/* Strings, inline-map keys, the three keywords, numbers, and the punctuation that holds a flow
+   collection together. Ordered: a quoted string wins over everything inside it. */
+const TOKEN = new RegExp(
+  [
+    /("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*')/, // 1 quoted string
+    /([A-Za-z_][\w.-]*)(\s*:)(?=\s|$)/, // 2,3 a key inside an inline map
+    /(\b(?:true|false|null|yes|no|on|off)\b|~)/, // 4 keywords
+    /(-?\d+(?:\.\d+)?\b)/, // 5 numbers
+    /([{}[\],])/, // 6 flow punctuation
+  ]
+    .map((r) => r.source)
+    .join("|"),
+  "g",
+);
+
+function colourValue(value) {
+  if (!value) return "";
+  let out = "";
+  let at = 0;
+  TOKEN.lastIndex = 0;
+  for (let m = TOKEN.exec(value); m; m = TOKEN.exec(value)) {
+    out += esc(value.slice(at, m.index));
+    if (m[1]) out += span("ys", m[1]);
+    else if (m[2]) out += span("yk", m[2]) + span("yp", m[3]);
+    else if (m[4]) out += span("yb", m[4]);
+    else if (m[5]) out += span("yn", m[5]);
+    else out += span("yp", m[6]);
+    at = m.index + m[0].length;
+  }
+  return out + esc(value.slice(at));
+}

package/templates/brain/.github/workflows/%%STAFF%%-pr-mention.yaml

@@ -1,50 +0,0 @@
-name: %%STAFF_UPPER%% on a product PR
-
-# Generated by roster. The body lives in %%OPS_REPO%%/.github/workflows/session.yaml.
-#
-# Amends an open PR on the product repo in response to a review comment, so the human can ask for
-# changes where they are already reading the diff instead of opening a ticket and cross-referencing.
-#
-# Not triggered directly. A forwarder in the PUBLIC product repo catches the mention and dispatches
-# here. The split exists because that repo is public: its Actions logs are world readable, so the
-# run that prints a charter and a chain of reasoning has to happen in a repo only we can see.
-#
-# NOTE: %%TOKENS%% are filled by `roster hire`. GitHub's own ${{ }} expressions are left alone.
-
-on:
-  repository_dispatch:
-    types: [pr-mention]
-
-  # Manual handle, for testing without leaving a comment on a public PR, and for re-running a
-  # request the dispatcher already consumed.
-  workflow_dispatch:
-    inputs:
-      pr:
-        description: "PR number on the product repo"
-        required: true
-      comment_id:
-        description: "id of the comment that triggered this"
-        required: true
-
-# Per PR. Several review comments in a row are the normal case; different PRs never contend.
-concurrency:
-  group: %%STAFF%%-pr-${{ github.event.inputs.pr || github.event.client_payload.pr }}
-  cancel-in-progress: false
-
-jobs:
-  amend:
-    uses: %%OPS_REPO%%/.github/workflows/session.yaml@main
-    with:
-      staff: %%STAFF%%
-      kind: pr-mention
-      ops_repo: %%OPS_REPO%%
-      model: %%MODEL%%
-      timeout_minutes: %%PR_MENTION_TIMEOUT%%
-      pr_number: ${{ github.event.inputs.pr || github.event.client_payload.pr }}
-      comment_id: ${{ github.event.inputs.comment_id || github.event.client_payload.comment_id }}
-    secrets:
-      APP_ID: ${{ secrets.%%SECRET_PREFIX%%_APP_ID }}
-      APP_PRIVATE_KEY: ${{ secrets.%%SECRET_PREFIX%%_APP_PRIVATE_KEY }}
-      PUBLIC_APP_ID: ${{ secrets.%%PUBLIC_SECRET_PREFIX%%_APP_ID }}
-      PUBLIC_APP_PRIVATE_KEY: ${{ secrets.%%PUBLIC_SECRET_PREFIX%%_APP_PRIVATE_KEY }}
-      AGENT_TOKEN: ${{ secrets.%%AGENT_SECRET%% }}

package/templates/ops/prompts/pr-mention.md

@@ -1,57 +0,0 @@
-You are **{{staff.name}}** at {{org.name}}. {{human.name}} has asked for a change to an open pull
-request, in a comment on the PR itself. They are not watching a terminal; **your reply on that PR is
-the only thing they will see.**
-
-**This is not a session.** No boot ritual, no handoff, no rewriting #{{staff.status_issue}}. Make the
-change asked for, push it, reply, stop.
-
-{{#if staff.public_bot}}
-## You are anonymous over there
-
-The PR is on a **public** repo. You post as `{{staff.public_bot}}`, an ordinary automation account.
-**Never sign as {{staff.name}}, never mention a charter, a tracker, a scheduled run, or that there is
-a role behind the account.** Write like a maintainer's bot: short, factual, no personality.
-
-Every `gh` call against that repo must carry the public identity: `GH_TOKEN=$PUBLIC_TOKEN gh ...`.
-The bare `GH_TOKEN` is your private-tracker identity and using it there would sign your name to a
-public repo.
-{{/if}}
-
-{{> prompts/_paths.md}}
-
-## The request
-
-**PR #{{event.pr_number}}, comment `{{event.comment_id}}`.** Read it before touching anything: an
-inline review comment carries `path`, `line` and `diff_hunk`, which say exactly which code is meant.
-Do not guess from the prose.
-
-## Do the work
-
-1. **You are already on the PR branch** - the runner checked it out. Do not start a new one.
-2. **If the PR is from a fork you cannot push to**, do not try. Reply with the exact diff to apply,
-   and say why you could not push it.
-3. **Make only the change asked for.** A review comment is a narrow request. Fixing something else
-   makes the diff unreviewable and costs a second review. If you spot something real and separate,
-   mention it in the reply and leave the code alone.
-4. **Run the full gate before pushing.** If it goes red on the requested change, push nothing and
-   reply with what broke.
-5. **Pull with rebase before pushing** - there may be several comments, and another run may be on
-   the same branch. If the push is still rejected, pull and retry rather than forcing: a force push
-   on a branch being reviewed throws away their place in the diff.
-6. **You cannot verify anything UI-shaped** - there is no browser and no device here. Say so plainly
-   rather than implying a green gate covered it.
-
-**Do not merge, and do not push to the default branch.**
-
-{{> org/guardrails.md}}
-
-## Reply where they asked
-
-Answer in the same place the request came from. **Do not @-mention them** - they are subscribed to
-their own PR.
-
-{{> org/voice.md}}
-
-**For this reply specifically:** what changed, the SHA, gate status, what it did not cover.
-**Nothing else.** No preamble, no restating the request, no headers, no sign-off, no narration of
-the steps you took. If nothing changed, one line saying so and why.