@nanocollective/roster 0.1.0-alpha.52 → 0.1.0-alpha.54

package/dist/cli.js

@@ -2892,30 +2892,36 @@ function overBudget(doc, dir, budgets) {
 }
 
 // src/lib/runs.ts
-import { existsSync as existsSync15, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14, rmSync as rmSync2 } from "fs";
-import { tmpdir as tmpdir2 } from "os";
+import { existsSync as existsSync15, mkdirSync as mkdirSync3, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { homedir, tmpdir as tmpdir2 } from "os";
 import { join as join16 } from "path";
 var KINDS2 = ["daily", "mention"];
 var records = /* @__PURE__ */ new Map();
-async function staffRuns(brain, handle, days = 30) {
+var fetching = /* @__PURE__ */ new Set();
+function cacheDir() {
+  return process.env.ROSTER_CACHE_DIR ?? join16(homedir(), ".cache", "roster", "runs");
+}
+function cacheFile(brain, id) {
+  return join16(cacheDir(), brain.replace("/", "__"), `${id}.json`);
+}
+function knownRecord(brain, id) {
+  const key = `${brain}#${id}`;
+  if (records.has(key)) return records.get(key);
+  const file = cacheFile(brain, id);
+  if (!existsSync15(file)) return void 0;
+  try {
+    const record = JSON.parse(readFileSync14(file, "utf8")).record;
+    records.set(key, record);
+    return record;
+  } catch {
+    return void 0;
+  }
+}
+async function staffRuns(brain, handle, days = 30, opts = {}) {
   const since = new Date(Date.now() - days * 864e5).toISOString().slice(0, 10);
   const lists = await Promise.all(
     KINDS2.map(
-      (kind) => ghJson([
-        "run",
-        "list",
-        "--repo",
-        brain,
-        "--workflow",
-        `${handle}-${kind}.yaml`,
-        "--created",
-        `>=${since}`,
-        "--limit",
-        // Skipped mentions (the gate saying no) count towards the limit, and there are hundreds.
-        kind === "mention" ? "500" : "100",
-        "--json",
-        "databaseId,conclusion,status,createdAt,updatedAt,url"
-      ]).then((res) => ({ kind, res }))
+      (kind) => realRuns(brain, `${handle}-${kind}.yaml`, since).then((res) => ({ kind, res }))
     )
   );
   const errors = [];
@@ -2943,14 +2949,71 @@ async function staffRuns(brain, handle, days = 30) {
     }
   }
   rows.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
-  await pool(
-    rows.filter((r) => r.status === "completed"),
-    6,
-    async (row) => {
-      row.record = await recordFor(brain, row.id);
+  const missing = [];
+  for (const row of rows.filter((r) => r.status === "completed")) {
+    const known = knownRecord(brain, row.id);
+    if (known === void 0) missing.push(row);
+    else row.record = known;
+  }
+  if (opts.wait === false) {
+    const todo = missing.filter((r) => !fetching.has(`${brain}#${r.id}`));
+    for (const r of todo) fetching.add(`${brain}#${r.id}`);
+    void pool(todo, 6, async (row) => {
+      await recordFor(brain, row.id);
+      fetching.delete(`${brain}#${row.id}`);
+    });
+    return { runs: rows, errors, pending: missing.length };
+  }
+  await pool(missing, 6, async (row) => {
+    row.record = await recordFor(brain, row.id);
+  });
+  return { runs: rows, errors, pending: 0 };
+}
+var OUTCOMES = [
+  "success",
+  "failure",
+  "cancelled",
+  "timed_out",
+  "action_required",
+  "startup_failure",
+  "in_progress",
+  "queued"
+];
+async function realRuns(brain, workflow, since) {
+  const one = async (status) => {
+    const out = [];
+    for (let page2 = 1; page2 <= 10; page2++) {
+      const res = await ghJson([
+        "api",
+        `repos/${brain}/actions/workflows/${workflow}/runs?created=>=${since}&status=${status}&per_page=100&page=${page2}`
+      ]);
+      if (!res.ok) return { ok: false, error: res.error };
+      const runs = res.data?.workflow_runs ?? [];
+      out.push(...runs);
+      if (runs.length < 100) break;
     }
-  );
-  return { runs: rows, errors };
+    return { ok: true, runs: out };
+  };
+  const answers = await Promise.all(OUTCOMES.map(one));
+  const failed = answers.find((a) => !a.ok);
+  if (failed && !failed.ok) return { ok: false, error: failed.error };
+  const seen = /* @__PURE__ */ new Set();
+  const data = [];
+  for (const a of answers) {
+    for (const r of a.ok ? a.runs : []) {
+      if (seen.has(r.id)) continue;
+      seen.add(r.id);
+      data.push({
+        databaseId: r.id,
+        conclusion: r.conclusion,
+        status: r.status,
+        createdAt: r.created_at,
+        updatedAt: r.updated_at,
+        url: r.html_url
+      });
+    }
+  }
+  return { ok: true, data };
 }
 async function recordFor(brain, id) {
   const key = `${brain}#${id}`;
@@ -2971,6 +3034,13 @@ async function recordFor(brain, id) {
     const file = join16(dir, "run.json");
     const record = res.ok && existsSync15(file) ? JSON.parse(readFileSync14(file, "utf8")) : null;
     records.set(key, record);
+    if (res.ok || /no valid artifacts|not found|no artifact/i.test(res.error ?? "")) {
+      try {
+        mkdirSync3(join16(cacheDir(), brain.replace("/", "__")), { recursive: true });
+        writeFileSync4(cacheFile(brain, id), JSON.stringify({ record }));
+      } catch {
+      }
+    }
     return record;
   } catch {
     records.set(key, null);
@@ -3005,19 +3075,19 @@ function budgetOf(value) {
 import { execFileSync as execFileSync5 } from "child_process";
 import {
   existsSync as existsSync16,
-  mkdirSync as mkdirSync3,
+  mkdirSync as mkdirSync4,
   mkdtempSync as mkdtempSync4,
   readdirSync as readdirSync5,
   readFileSync as readFileSync15,
   rmSync as rmSync4,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync6
 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
 import { dirname as dirname6, join as join18 } from "path";
 
 // src/lib/merge.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import { mkdtempSync as mkdtempSync3, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
+import { mkdtempSync as mkdtempSync3, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
 import { join as join17 } from "path";
 function merge3(current, base2, incoming) {
@@ -3026,9 +3096,9 @@ function merge3(current, base2, incoming) {
     const c = join17(dir, "current");
     const b = join17(dir, "base");
     const i = join17(dir, "incoming");
-    writeFileSync4(c, current);
-    writeFileSync4(b, base2);
-    writeFileSync4(i, incoming);
+    writeFileSync5(c, current);
+    writeFileSync5(b, base2);
+    writeFileSync5(i, incoming);
     try {
       const text = execFileSync4(
         "git",
@@ -3237,8 +3307,8 @@ function apply(opsDir, seedDir, tplDir, plans) {
     if (p.verdict === "edited-managed") edited++;
     if (p.verdict === "conflict") {
       const out = join18(opsDir, p.rel + ".roster-merge");
-      mkdirSync3(dirname6(out), { recursive: true });
-      writeFileSync5(out, p.rejected);
+      mkdirSync4(dirname6(out), { recursive: true });
+      writeFileSync6(out, p.rejected);
       process.stdout.write(`    wrote ${p.rel}.roster-merge \u2014 resolve it, then re-run
 `);
       left++;
@@ -3253,8 +3323,8 @@ function apply(opsDir, seedDir, tplDir, plans) {
       continue;
     }
     const dest = join18(opsDir, p.rel);
-    mkdirSync3(dirname6(dest), { recursive: true });
-    writeFileSync5(dest, p.next);
+    mkdirSync4(dirname6(dest), { recursive: true });
+    writeFileSync6(dest, p.next);
     seed(seedDir, tplDir, p.rel);
     wrote++;
   }
@@ -3263,7 +3333,7 @@ function apply(opsDir, seedDir, tplDir, plans) {
   process.stdout.write(left ? `, ${left} left for you
 
 ` : "\n\n");
-  if (!left) writeFileSync5(join18(opsDir, ".roster-version"), stamp() + "\n");
+  if (!left) writeFileSync6(join18(opsDir, ".roster-version"), stamp() + "\n");
   if (edited) {
     process.stdout.write(
       `  ${edited} framework file${edited === 1 ? "" : "s"} still carr${edited === 1 ? "ies" : "y"} a local edit. Move it into the framework, or doctor keeps failing.
@@ -3275,8 +3345,8 @@ function apply(opsDir, seedDir, tplDir, plans) {
 }
 function seed(seedDir, tplDir, rel) {
   const dest = join18(seedDir, rel);
-  mkdirSync3(dirname6(dest), { recursive: true });
-  writeFileSync5(dest, readFileSync15(join18(tplDir, rel), "utf8"));
+  mkdirSync4(dirname6(dest), { recursive: true });
+  writeFileSync6(dest, readFileSync15(join18(tplDir, rel), "utf8"));
 }
 function writeBaseline(opsDir, seedDir, tplDir, ref) {
   const framework = join18(tplDir, "..", "..");
@@ -3301,10 +3371,10 @@ function writeBaseline(opsDir, seedDir, tplDir, ref) {
       maxBuffer: 16 * 1024 * 1024
     });
     const dest = join18(seedDir, rel);
-    mkdirSync3(dirname6(dest), { recursive: true });
-    writeFileSync5(dest, text);
+    mkdirSync4(dirname6(dest), { recursive: true });
+    writeFileSync6(dest, text);
   }
-  writeFileSync5(join18(opsDir, ".roster-version"), `${ref}
+  writeFileSync6(join18(opsDir, ".roster-version"), `${ref}
 `);
   process.stdout.write(
     `
@@ -3408,8 +3478,8 @@ function planBrains(ws, parseYaml) {
 function unified(before, after) {
   const dir = mkdtempSync4(join18(tmpdir4(), "roster-diff-"));
   try {
-    writeFileSync5(join18(dir, "a"), before);
-    writeFileSync5(join18(dir, "b"), after);
+    writeFileSync6(join18(dir, "a"), before);
+    writeFileSync6(join18(dir, "b"), after);
     try {
       execFileSync5(
         "diff",
@@ -3481,8 +3551,8 @@ function applyBrains(brains) {
       }
       if (f.next === void 0) continue;
       const dest = join18(b.root, f.rel);
-      mkdirSync3(dirname6(dest), { recursive: true });
-      writeFileSync5(dest, f.next);
+      mkdirSync4(dirname6(dest), { recursive: true });
+      writeFileSync6(dest, f.next);
       wrote++;
     }
   }
@@ -4516,7 +4586,7 @@ function unkindedAsks(scope, repo, issues, humans) {
 }
 
 // src/commands/export.ts
-import { writeFileSync as writeFileSync6 } from "fs";
+import { writeFileSync as writeFileSync7 } from "fs";
 
 // src/lib/export.ts
 import { execFileSync as execFileSync6 } from "child_process";
@@ -4707,7 +4777,7 @@ async function exportCommand(argv) {
   const data = buildExport(ws, readOrg(ws.opsDir, parseYaml), parseYaml);
   const json2 = JSON.stringify(data, null, 2);
   if (out) {
-    writeFileSync6(out, json2 + "\n");
+    writeFileSync7(out, json2 + "\n");
     const facts = data.staff.reduce((n, s) => n + s.facts.length, 0);
     process.stdout.write(
       `  ${out}  ${data.staff.length} staff, ${facts} facts, ${Math.round(json2.length / 1024)}kb
@@ -5062,7 +5132,7 @@ function parseFlags7(argv) {
 
 // src/commands/init.ts
 import { execFileSync as execFileSync7 } from "child_process";
-import { existsSync as existsSync20, mkdirSync as mkdirSync4, readFileSync as readFileSync19, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync5, readFileSync as readFileSync19, writeFileSync as writeFileSync8 } from "fs";
 import { dirname as dirname7, join as join22, resolve as resolve3 } from "path";
 var initHelp = `
 roster init --org <github-org> [--name "Acme"] [--human <login>] [--apply]
@@ -5155,16 +5225,16 @@ async function initCommand(argv) {
     process.stdout.write("  Nothing was created. Re-run with --apply.\n\n");
     return 0;
   }
-  mkdirSync4(opsDir, { recursive: true });
+  mkdirSync5(opsDir, { recursive: true });
   for (const [rel, text] of files) {
     const dest = join22(opsDir, rel);
-    mkdirSync4(dirname7(dest), { recursive: true });
-    writeFileSync7(dest, text);
+    mkdirSync5(dirname7(dest), { recursive: true });
+    writeFileSync8(dest, text);
   }
   for (const rel of templateFiles(opsTemplateDir())) {
     const dest = join22(opsDir, ".roster", "seed", rel);
-    mkdirSync4(dirname7(dest), { recursive: true });
-    writeFileSync7(dest, readFileSync19(join22(opsTemplateDir(), rel), "utf8"));
+    mkdirSync5(dirname7(dest), { recursive: true });
+    writeFileSync8(dest, readFileSync19(join22(opsTemplateDir(), rel), "utf8"));
   }
   process.stdout.write(`  wrote ${files.size} files and the recorded base
 `);
@@ -5658,6 +5728,17 @@ async function act(req) {
     await run3("gh", ["issue", "reopen", n, "--repo", repo], { encoding: "utf8" });
     return { ok: true, action };
   }
+  if (action === "approve") {
+    const args = ["pr", "review", n, "--repo", repo, "--approve"];
+    if (req.body?.trim()) args.push("--body", req.body.trim());
+    try {
+      await run3("gh", args, { encoding: "utf8" });
+    } catch (err) {
+      const line = errText(err).split("\n").map((l) => l.trim()).find((l) => l && !l.startsWith("Command failed"));
+      throw new Error(`Not approved: ${line ?? "GitHub refused it without saying why."}`);
+    }
+    return { ok: true, action };
+  }
   if (action === "merge") {
     const how = req.mergeMethod ?? await mergeMethodFor(repo);
     const flag = MERGE_FLAG[how];
@@ -5717,6 +5798,10 @@ function whyNotMerged(ghError, pr) {
     return `Not merged: checks failed (${list(failing)}).`;
   if (pr?.mergeStateStatus === "BLOCKED" && running.length)
     return `Not merged: checks are still running (${list(running)}). Merge again once they pass.`;
+  if (pr?.mergeStateStatus === "BLOCKED" && pr.reviewDecision === "REVIEW_REQUIRED")
+    return "Not merged: the branch rules need an approving review first. Press Approve, then Merge.";
+  if (pr?.mergeStateStatus === "BLOCKED" && pr.reviewDecision === "CHANGES_REQUESTED")
+    return "Not merged: a reviewer has asked for changes. Open it to see what.";
   if (pr?.mergeStateStatus === "BLOCKED")
     return "Not merged: the branch rules require something first, such as a review. Open it in GitHub to see what.";
   if (pr?.mergeStateStatus === "BEHIND")
@@ -5734,7 +5819,15 @@ async function prState(repo, n) {
   try {
     const { stdout } = await run3(
       "gh",
-      ["pr", "view", n, "--repo", repo, "--json", "mergeStateStatus,statusCheckRollup"],
+      [
+        "pr",
+        "view",
+        n,
+        "--repo",
+        repo,
+        "--json",
+        "mergeStateStatus,statusCheckRollup,reviewDecision"
+      ],
       { encoding: "utf8" }
     );
     return JSON.parse(stdout);
@@ -5776,7 +5869,7 @@ function execWithStdin(args, input) {
 
 // src/lib/attach.ts
 import { execFileSync as execFileSync8 } from "child_process";
-import { existsSync as existsSync21, mkdirSync as mkdirSync5, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync6, writeFileSync as writeFileSync9 } from "fs";
 import { basename, extname, join as join24 } from "path";
 var MAX_UPLOAD = 25 * 1024 * 1024;
 var ATTACH_DIR = "attachments";
@@ -5791,8 +5884,8 @@ function attach(opts) {
   }
   const rel = free(repoDir, `${ATTACH_DIR}/${today}-${safeName(opts.name)}`);
   const full = join24(repoDir, rel);
-  mkdirSync5(join24(repoDir, ATTACH_DIR), { recursive: true });
-  writeFileSync8(full, data);
+  mkdirSync6(join24(repoDir, ATTACH_DIR), { recursive: true });
+  writeFileSync9(full, data);
   const git4 = (args) => execFileSync8("git", ["-C", repoDir, ...args], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
@@ -5950,7 +6043,7 @@ var LIGHT = `number title url state createdAt updatedAt closedAt body
         closer: timelineItems(last:1, itemTypes:[CLOSED_EVENT]) {
           nodes { ... on ClosedEvent { actor { login } } }
         }`;
-var LIGHT_PR = `${LIGHT} isDraft mergeable
+var LIGHT_PR = `${LIGHT} isDraft mergeable reviewDecision
         commits(last:1) { nodes { commit { statusCheckRollup { state } } } }`;
 var QUERY = `
 query($owner:String!, $name:String!) {
@@ -5983,7 +6076,7 @@ query($owner:String!, $name:String!, $number:Int!) {
         timelineItems(last:100, itemTypes:${ISSUE_TYPES}) { nodes { ${TIMELINE_COMMON} } }
       }
       ... on PullRequest {
-        number title body url state createdAt updatedAt isDraft mergeable ${ROW_EXTRAS}
+        number title body url state createdAt updatedAt isDraft mergeable reviewDecision ${ROW_EXTRAS}
         author { login }
         ${REACTIONS}
         labels(first:12) { nodes { name } }
@@ -6009,6 +6102,7 @@ async function fetchInbox(repos) {
           item.draft = n.isDraft;
           item.checks = rollup(n.commits?.nodes?.[0]?.commit?.statusCheckRollup?.state);
           item.mergeable = n.mergeable;
+          if (n.reviewDecision) item.reviewDecision = n.reviewDecision;
           items.push(item);
         }
         const cutoff = Date.now() - CLOSED_DAYS * 864e5;
@@ -6223,6 +6317,7 @@ async function fetchThread(repo, number, kind) {
     item.draft = n.isDraft;
     item.checks = rollup(n.commits?.nodes?.[0]?.commit?.statusCheckRollup?.state);
     item.mergeable = n.mergeable;
+    if (n.reviewDecision) item.reviewDecision = n.reviewDecision;
   }
   return item;
 }
@@ -6501,7 +6596,7 @@ function portalAsset(rel) {
 }
 
 // src/commands/retire.ts
-import { existsSync as existsSync24, readdirSync as readdirSync8, readFileSync as readFileSync21, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync24, readdirSync as readdirSync8, readFileSync as readFileSync21, writeFileSync as writeFileSync10 } from "fs";
 import { join as join27 } from "path";
 var retireHelp = `
 roster retire <handle>
@@ -6637,7 +6732,7 @@ async function applyRetirePlan(ws, plan2) {
   for (const p of plan2.peers) {
     const path = join27(ws.root, p.dir, "staff.yaml");
     const text = readFileSync21(path, "utf8");
-    writeFileSync9(path, removePeerLine(text, plan2.handle));
+    writeFileSync10(path, removePeerLine(text, plan2.handle));
     process.stdout.write(`  removed from ${p.dir}/staff.yaml
 `);
     if (!p.brain) continue;
@@ -6665,7 +6760,7 @@ async function applyRetirePlan(ws, plan2) {
 function removeFromOrgYaml(ws, plan2) {
   const path = join27(ws.opsDir, "org.yaml");
   const text = readFileSync21(path, "utf8");
-  writeFileSync9(path, removeOrgLines(text, plan2.handle, plan2.dir));
+  writeFileSync10(path, removeOrgLines(text, plan2.handle, plan2.dir));
 }
 function removeOrgLines(text, handle, dir) {
   return text.split("\n").filter((line) => {
@@ -7777,7 +7872,9 @@ async function portalCommand(argv) {
           const staff = await Promise.all(
             (org.staff ?? []).map(async (s) => {
               const brain = `${org.org}/${s.dir ?? s.handle}`;
-              const { runs, errors } = await staffRuns(brain, s.handle);
+              const { runs, errors, pending: pending2 } = await staffRuns(brain, s.handle, 30, {
+                wait: false
+              });
               return {
                 handle: s.handle,
                 name: s.name ?? s.handle,
@@ -7785,7 +7882,8 @@ async function portalCommand(argv) {
                 budget: budgetOf(s.budget),
                 spend: spend(runs),
                 runs,
-                errors
+                errors,
+                pending: pending2
               };
             })
           );
@@ -7795,14 +7893,17 @@ async function portalCommand(argv) {
             total.known += s.spend.known;
             total.runs += s.spend.runs;
           }
+          const pending = staff.reduce((n, s) => n + s.pending, 0);
           const body2 = {
             online: true,
             fetchedAt: (/* @__PURE__ */ new Date()).toISOString(),
             budget: budgetOf(org.budget),
             spend: total,
-            staff
+            staff,
+            // Costs still being read. The screen asks again until this is 0.
+            pending
           };
-          runsCache = { at: Date.now(), body: body2 };
+          if (!pending) runsCache = { at: Date.now(), body: body2 };
           return body2;
         })().then((body2) => json(res, body2)).catch(
           (err) => json(res, { online: false, error: String(err?.message ?? err), staff: [] })
@@ -8149,7 +8250,7 @@ function parseFlags11(argv) {
 
 // src/commands/prompt.ts
 import { execFileSync as execFileSync10 } from "child_process";
-import { existsSync as existsSync26, mkdtempSync as mkdtempSync5, readFileSync as readFileSync24, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync26, mkdtempSync as mkdtempSync5, readFileSync as readFileSync24, writeFileSync as writeFileSync11 } from "fs";
 import { tmpdir as tmpdir5 } from "os";
 import { join as join29 } from "path";
 
@@ -8220,8 +8321,8 @@ async function promptCommand(argv) {
   const dir = mkdtempSync5(join29(tmpdir5(), "roster-diff-"));
   const a = join29(dir, "live.md");
   const b = join29(dir, "composed.md");
-  writeFileSync10(a, normalise(live));
-  writeFileSync10(b, normalise(composed));
+  writeFileSync11(a, normalise(live));
+  writeFileSync11(b, normalise(composed));
   const entry = org.staff?.find((s) => s.handle === handle);
   process.stdout.write(`
   ${entry?.name ?? handle} \xB7 ${kind}
@@ -8257,7 +8358,7 @@ async function gatherInflight(opsDir, root, handle) {
   const manifest = existsSync26(manifestPath) ? parseYaml(readFileSync24(manifestPath, "utf8"), "staff.yaml") : {};
   const gh = (args) => execFileSync10("gh", args, { encoding: "utf8", maxBuffer: 16 * 1024 * 1024 });
   const dir = mkdtempSync5(join29(tmpdir5(), "roster-inflight-"));
-  writeFileSync10(join29(dir, "inflight.md"), describe2(gather2({ org, manifest, gh })));
+  writeFileSync11(join29(dir, "inflight.md"), describe2(gather2({ org, manifest, gh })));
   return dir;
 }
 function normalise(text) {

package/docs/portal.md

@@ -87,7 +87,8 @@ Where the portal opens. An Ask box at the top, then these, in order.
 - **Ask.** Pick a staff member, type what you want, **Send**. It opens an issue on their
   tracker with their `@handle` in front, which wakes them in about a minute.
 - **Latest reports.** Each staff member's run report from the last day: the three lines they
-  post on their status issue at the end of a daily run. Nothing shows until there is one.
+  post on their status issue at the end of a daily run, with the issues and pull requests it
+  names as links. Click a report to open their status issue. Nothing shows until there is one.
 - **Needs you.** Every ask a staff member has put on you, and every pull request ready to
   merge, oldest first. Each card has one action on its right:
   - a `decision` has **Reply**, and **Go with the default** when it carries one. The default
@@ -95,6 +96,9 @@ Where the portal opens. An Ask box at the top, then these, in order.
   - a `review` has **Approve**.
   - a `chore` has **Done**, which closes it.
   - a pull request has **Merge**, unless its checks fail, are still running, or it conflicts.
+    Where the branch rules require an approving review, it also has **Approve**, and Merge waits
+    until you have pressed it. Approving is your review, given on purpose; Merge never gives it
+    for you.
 
   Answers go out as you, with the staff member's `@handle`, so they act on them straight away.
   Once you have had the last word, the card leaves Needs you for Your requests, since it is
@@ -262,8 +266,14 @@ than drawing an empty table that reads as "nothing ran".
 
 Cost comes from the record each run leaves behind (see [cost](cost.md#what-each-run-cost)). A
 run from before records existed, or from an agent that does not report cost, shows a dash, and
-a total says how many runs it could price. Each record is downloaded once and kept for as long
-as the portal runs, so the first visit is the slow one.
+a total says how many runs it could price. Each record is downloaded once, ever, and kept in
+`~/.cache/roster/runs` (or `ROSTER_CACHE_DIR`), since a finished run's record never changes.
+The table shows at once with the costs already known; any not yet read are fetched in the
+background, and the screen says how many and fills them in as they arrive.
+
+The run list asks GitHub for each outcome separately (succeeded, failed, cancelled and so on)
+rather than paging through every run, because most of a mention caller's runs are comments that
+woke nobody and were skipped.
 
 A skipped mention is not a run and is not listed. A `setup-failure` is a run that failed before
 the agent started, usually a token or a checkout. Past a [`budget`](org-yaml.md#budget), the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanocollective/roster",
-  "version": "0.1.0-alpha.52",
+  "version": "0.1.0-alpha.54",
   "description": "An agent-run org, powered by GitHub. Scaffold AI staff members whose brain is a repo.",
   "type": "module",
   "bin": {

package/templates/ops/.github/workflows/session.yaml

@@ -357,6 +357,11 @@ jobs:
           PUBLIC_TOKEN: ${{ steps.public.outputs.token }}
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN || secrets.AGENT_TOKEN }}
+          # The action refuses to run for a bot unless it is named here. A peer's ask is opened
+          # by that peer's App, so on a peer run, and only then, the one bot that opened it is
+          # allowed. The caller has already checked it is an App, not this staff member's own,
+          # and that the issue carries a from- label. Every other run allows no bots.
+          allowed_bots: ${{ inputs.trigger == 'peer' && github.actor || '' }}
           # These repos are private and single-user, so the usual reason to hide a run's output does
           # not apply, and hiding it turns any failure into "is_error: true" with no message.
           # Registered secrets are still masked by the runner.

package/templates/portal/css/home.css

@@ -76,10 +76,15 @@
          background:var(--blue);margin:0 7px 1px 0;vertical-align:middle}
 
 .homereports{display:flex;flex-direction:column;gap:14px;padding:14px 16px}
-.homereport{display:grid;grid-template-columns:190px 1fr;gap:12px;font-size:13px;line-height:1.5}
-.homereport p{margin:0 0 3px;color:var(--ink-dim)}
-.homereport p:first-child{color:var(--ink)}
-.homereport .homewho2{align-items:baseline;flex-wrap:wrap;min-width:0}
+.homereport{display:grid;grid-template-columns:190px 1fr;gap:12px;font-size:13px;line-height:1.5;
+         cursor:pointer;border-radius:8px;padding:6px 8px;margin:-6px -8px}
+.homereport:hover{background:var(--hover)}
+.homereport:focus-visible{outline:2px solid var(--accent);outline-offset:0}
+.homereportwho{display:flex;flex-direction:column;gap:2px;min-width:0}
+.homereportwho .meta{padding-left:21px}
+.homereportbody p{margin:0 0 4px;color:var(--ink-dim);font-size:13px;line-height:1.5}
+.homereportbody p:first-child{color:var(--ink)}
+.homereportbody a{color:var(--accent)}
 @media (max-width:640px){.homereport{grid-template-columns:1fr;gap:4px}}
 
 @media (max-width:640px){

package/templates/portal/js/views/home.js

@@ -8,6 +8,7 @@ import { getLive, post } from "../api.js";
 import { sheet } from "../dialog.js";
 import { ago, el, skeleton } from "../dom.js";
 import { daysUntil, sortHome } from "../homesort.js";
+import { mdlite } from "../md.js";
 import { icon, iconHTML, staffIcon } from "../icons.js";
 import { ensureInbox, stampCounts } from "../refresh.js";
 import { go, render } from "../router.js";
@@ -58,16 +59,29 @@ export function viewHome(m) {
     page.append(section("Latest reports"));
     const box = el("div", { className: "card homereports" });
     for (const r of h.reports) {
-      box.append(
-        el("div", { className: "homereport" }, [
-          el("div", { className: "homewho2" }, [
-            icon(staffIcon(r.staff), "ic"),
-            el("b", { textContent: r.staff.name }),
-            el("span", { className: "meta", textContent: ago(r.at) }),
-          ]),
-          el("div", {}, r.lines.map((l) => el("p", { textContent: l }))),
+      /* The report is markdown the staff member wrote, with links to the work it names. The
+         whole report opens their status issue, where it was posted; a link inside it goes
+         where it points. */
+      const row = el("div", { className: "homereport homeclick", tabIndex: 0, role: "button" }, [
+        el("div", { className: "homereportwho" }, [
+          el("span", { className: "homewho2" }, [icon(staffIcon(r.staff), "ic"), el("b", { textContent: r.staff.name })]),
+          el("span", { className: "meta", textContent: ago(r.at) }),
         ]),
-      );
+        el("div", {
+          className: "md homereportbody",
+          innerHTML: mdlite(r.lines.join("\n\n"), { repo: r.staff.brain }),
+        }),
+      ]);
+      row.onclick = (ev) => {
+        if (!ev.target.closest("a, button")) openThread(r.item);
+      };
+      row.onkeydown = (ev) => {
+        if (ev.target === row && (ev.key === "Enter" || ev.key === " ")) {
+          ev.preventDefault();
+          openThread(r.item);
+        }
+      };
+      box.append(row);
     }
     page.append(box);
   }
@@ -195,8 +209,31 @@ function needCard(e) {
     actions.append(button("Done", true, () => done(e, note, actions)));
   } else if (kind === "merge") {
     const blocked = item.checks === "failing" || item.mergeable === "CONFLICTING";
-    const merge = button("Merge", true, () => merge_(e, note, actions));
-    merge.disabled = blocked || item.checks === "pending";
+    const needsReview = item.reviewDecision === "REVIEW_REQUIRED";
+    const merge = button("Merge", !needsReview, () => merge_(e, note, actions));
+    merge.disabled = blocked || item.checks === "pending" || needsReview;
+    /* The branch rules want an approving review. Approve is the person's review, given on
+       purpose; Merge waits for it rather than approving on their behalf. */
+    if (needsReview) {
+      const approve = button("Approve", true, async () => {
+        approve.disabled = true;
+        note.className = "meta";
+        note.textContent = "Approving…";
+        try {
+          await post({ action: "approve", repo: item.repo, number: item.number });
+          item.reviewDecision = "APPROVED";
+          note.textContent = "Approved.";
+          approve.remove();
+          merge.className = "ghbtn primary";
+          merge.disabled = blocked || item.checks === "pending";
+        } catch (err) {
+          note.textContent = String(err.message || err);
+          note.className = "meta err";
+          approve.disabled = false;
+        }
+      });
+      actions.append(approve);
+    }
     actions.append(merge);
   }
   card.append(actions);
@@ -220,7 +257,9 @@ function checksLine(item) {
     pending: "Checks are running.",
     none: "No checks.",
   };
-  const conflict = item.mergeable === "CONFLICTING" ? " Conflicts with its base." : "";
+  const conflict =
+    (item.mergeable === "CONFLICTING" ? " Conflicts with its base." : "") +
+    (item.reviewDecision === "REVIEW_REQUIRED" ? " Needs your approval to merge." : "");
   return el("p", {
     className: "homedue" + (item.checks === "failing" || conflict ? " late" : ""),
     textContent: (words[item.checks] ?? "") + conflict,

package/templates/portal/js/views/inbox.js

@@ -800,6 +800,23 @@ function inboxScreen(m, opts) {
           openThread({ repo: item.repo, number: item.number, kind: item.kind });
         } catch (e) { failed(e); }
       };
+      /* The branch rules want an approving review before a merge. Approve is your review,
+         given on purpose; Merge never gives it for you, so it waits until there is one. */
+      if (item.reviewDecision === "REVIEW_REQUIRED" && item.mergeable !== "CONFLICTING") {
+        merge.disabled = true;
+        merge.title = "Approve it first: the branch rules need an approving review";
+        const approve = el("button", { className: "ghbtn primary", textContent: "Approve" });
+        approve.onclick = async () => {
+          busy(true, "approving…");
+          try {
+            await post({ action: "approve", repo: item.repo, number: item.number });
+            item.reviewDecision = "APPROVED";
+            openThread({ repo: item.repo, number: item.number, kind: item.kind });
+          } catch (e) { failed(e); }
+        };
+        buttons.push(approve);
+        row.append(approve);
+      }
       buttons.push(merge);
       row.append(merge);
     }

package/templates/portal/js/views/runs.js

@@ -77,6 +77,20 @@ function paint(m, data) {
   g.append(tile("Runs", String(data.spend?.runs ?? 0), "skipped mentions are not counted"));
   m.append(g);
 
+  /* The table shows at once with the costs already known; the rest are read from GitHub in the
+     background, and the screen asks again until they are all in. */
+  if (data.pending) {
+    m.append(
+      el("p", {
+        className: "hnote",
+        textContent: "Reading the cost of " + data.pending + " run" + (data.pending === 1 ? "" : "s") + " from GitHub…",
+      }),
+    );
+    setTimeout(() => {
+      if (S.view === "runs") load(true);
+    }, 3000);
+  }
+
   for (const s of data.staff ?? []) m.append(...staffSection(s));
 
   m.append(