@nanocollective/roster 0.1.0-alpha.53 → 0.1.0-alpha.54

package/dist/cli.js

@@ -5728,6 +5728,17 @@ async function act(req) {
     await run3("gh", ["issue", "reopen", n, "--repo", repo], { encoding: "utf8" });
     return { ok: true, action };
   }
+  if (action === "approve") {
+    const args = ["pr", "review", n, "--repo", repo, "--approve"];
+    if (req.body?.trim()) args.push("--body", req.body.trim());
+    try {
+      await run3("gh", args, { encoding: "utf8" });
+    } catch (err) {
+      const line = errText(err).split("\n").map((l) => l.trim()).find((l) => l && !l.startsWith("Command failed"));
+      throw new Error(`Not approved: ${line ?? "GitHub refused it without saying why."}`);
+    }
+    return { ok: true, action };
+  }
   if (action === "merge") {
     const how = req.mergeMethod ?? await mergeMethodFor(repo);
     const flag = MERGE_FLAG[how];
@@ -5787,6 +5798,10 @@ function whyNotMerged(ghError, pr) {
     return `Not merged: checks failed (${list(failing)}).`;
   if (pr?.mergeStateStatus === "BLOCKED" && running.length)
     return `Not merged: checks are still running (${list(running)}). Merge again once they pass.`;
+  if (pr?.mergeStateStatus === "BLOCKED" && pr.reviewDecision === "REVIEW_REQUIRED")
+    return "Not merged: the branch rules need an approving review first. Press Approve, then Merge.";
+  if (pr?.mergeStateStatus === "BLOCKED" && pr.reviewDecision === "CHANGES_REQUESTED")
+    return "Not merged: a reviewer has asked for changes. Open it to see what.";
   if (pr?.mergeStateStatus === "BLOCKED")
     return "Not merged: the branch rules require something first, such as a review. Open it in GitHub to see what.";
   if (pr?.mergeStateStatus === "BEHIND")
@@ -5804,7 +5819,15 @@ async function prState(repo, n) {
   try {
     const { stdout } = await run3(
       "gh",
-      ["pr", "view", n, "--repo", repo, "--json", "mergeStateStatus,statusCheckRollup"],
+      [
+        "pr",
+        "view",
+        n,
+        "--repo",
+        repo,
+        "--json",
+        "mergeStateStatus,statusCheckRollup,reviewDecision"
+      ],
       { encoding: "utf8" }
     );
     return JSON.parse(stdout);
@@ -6020,7 +6043,7 @@ var LIGHT = `number title url state createdAt updatedAt closedAt body
         closer: timelineItems(last:1, itemTypes:[CLOSED_EVENT]) {
           nodes { ... on ClosedEvent { actor { login } } }
         }`;
-var LIGHT_PR = `${LIGHT} isDraft mergeable
+var LIGHT_PR = `${LIGHT} isDraft mergeable reviewDecision
         commits(last:1) { nodes { commit { statusCheckRollup { state } } } }`;
 var QUERY = `
 query($owner:String!, $name:String!) {
@@ -6053,7 +6076,7 @@ query($owner:String!, $name:String!, $number:Int!) {
         timelineItems(last:100, itemTypes:${ISSUE_TYPES}) { nodes { ${TIMELINE_COMMON} } }
       }
       ... on PullRequest {
-        number title body url state createdAt updatedAt isDraft mergeable ${ROW_EXTRAS}
+        number title body url state createdAt updatedAt isDraft mergeable reviewDecision ${ROW_EXTRAS}
         author { login }
         ${REACTIONS}
         labels(first:12) { nodes { name } }
@@ -6079,6 +6102,7 @@ async function fetchInbox(repos) {
           item.draft = n.isDraft;
           item.checks = rollup(n.commits?.nodes?.[0]?.commit?.statusCheckRollup?.state);
           item.mergeable = n.mergeable;
+          if (n.reviewDecision) item.reviewDecision = n.reviewDecision;
           items.push(item);
         }
         const cutoff = Date.now() - CLOSED_DAYS * 864e5;
@@ -6293,6 +6317,7 @@ async function fetchThread(repo, number, kind) {
     item.draft = n.isDraft;
     item.checks = rollup(n.commits?.nodes?.[0]?.commit?.statusCheckRollup?.state);
     item.mergeable = n.mergeable;
+    if (n.reviewDecision) item.reviewDecision = n.reviewDecision;
   }
   return item;
 }

package/docs/portal.md

@@ -96,6 +96,9 @@ Where the portal opens. An Ask box at the top, then these, in order.
   - a `review` has **Approve**.
   - a `chore` has **Done**, which closes it.
   - a pull request has **Merge**, unless its checks fail, are still running, or it conflicts.
+    Where the branch rules require an approving review, it also has **Approve**, and Merge waits
+    until you have pressed it. Approving is your review, given on purpose; Merge never gives it
+    for you.
 
   Answers go out as you, with the staff member's `@handle`, so they act on them straight away.
   Once you have had the last word, the card leaves Needs you for Your requests, since it is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanocollective/roster",
-  "version": "0.1.0-alpha.53",
+  "version": "0.1.0-alpha.54",
   "description": "An agent-run org, powered by GitHub. Scaffold AI staff members whose brain is a repo.",
   "type": "module",
   "bin": {

package/templates/ops/.github/workflows/session.yaml

@@ -357,6 +357,11 @@ jobs:
           PUBLIC_TOKEN: ${{ steps.public.outputs.token }}
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN || secrets.AGENT_TOKEN }}
+          # The action refuses to run for a bot unless it is named here. A peer's ask is opened
+          # by that peer's App, so on a peer run, and only then, the one bot that opened it is
+          # allowed. The caller has already checked it is an App, not this staff member's own,
+          # and that the issue carries a from- label. Every other run allows no bots.
+          allowed_bots: ${{ inputs.trigger == 'peer' && github.actor || '' }}
           # These repos are private and single-user, so the usual reason to hide a run's output does
           # not apply, and hiding it turns any failure into "is_error: true" with no message.
           # Registered secrets are still masked by the runner.

package/templates/portal/js/views/home.js

@@ -209,8 +209,31 @@ function needCard(e) {
     actions.append(button("Done", true, () => done(e, note, actions)));
   } else if (kind === "merge") {
     const blocked = item.checks === "failing" || item.mergeable === "CONFLICTING";
-    const merge = button("Merge", true, () => merge_(e, note, actions));
-    merge.disabled = blocked || item.checks === "pending";
+    const needsReview = item.reviewDecision === "REVIEW_REQUIRED";
+    const merge = button("Merge", !needsReview, () => merge_(e, note, actions));
+    merge.disabled = blocked || item.checks === "pending" || needsReview;
+    /* The branch rules want an approving review. Approve is the person's review, given on
+       purpose; Merge waits for it rather than approving on their behalf. */
+    if (needsReview) {
+      const approve = button("Approve", true, async () => {
+        approve.disabled = true;
+        note.className = "meta";
+        note.textContent = "Approving…";
+        try {
+          await post({ action: "approve", repo: item.repo, number: item.number });
+          item.reviewDecision = "APPROVED";
+          note.textContent = "Approved.";
+          approve.remove();
+          merge.className = "ghbtn primary";
+          merge.disabled = blocked || item.checks === "pending";
+        } catch (err) {
+          note.textContent = String(err.message || err);
+          note.className = "meta err";
+          approve.disabled = false;
+        }
+      });
+      actions.append(approve);
+    }
     actions.append(merge);
   }
   card.append(actions);
@@ -234,7 +257,9 @@ function checksLine(item) {
     pending: "Checks are running.",
     none: "No checks.",
   };
-  const conflict = item.mergeable === "CONFLICTING" ? " Conflicts with its base." : "";
+  const conflict =
+    (item.mergeable === "CONFLICTING" ? " Conflicts with its base." : "") +
+    (item.reviewDecision === "REVIEW_REQUIRED" ? " Needs your approval to merge." : "");
   return el("p", {
     className: "homedue" + (item.checks === "failing" || conflict ? " late" : ""),
     textContent: (words[item.checks] ?? "") + conflict,

package/templates/portal/js/views/inbox.js

@@ -800,6 +800,23 @@ function inboxScreen(m, opts) {
           openThread({ repo: item.repo, number: item.number, kind: item.kind });
         } catch (e) { failed(e); }
       };
+      /* The branch rules want an approving review before a merge. Approve is your review,
+         given on purpose; Merge never gives it for you, so it waits until there is one. */
+      if (item.reviewDecision === "REVIEW_REQUIRED" && item.mergeable !== "CONFLICTING") {
+        merge.disabled = true;
+        merge.title = "Approve it first: the branch rules need an approving review";
+        const approve = el("button", { className: "ghbtn primary", textContent: "Approve" });
+        approve.onclick = async () => {
+          busy(true, "approving…");
+          try {
+            await post({ action: "approve", repo: item.repo, number: item.number });
+            item.reviewDecision = "APPROVED";
+            openThread({ repo: item.repo, number: item.number, kind: item.kind });
+          } catch (e) { failed(e); }
+        };
+        buttons.push(approve);
+        row.append(approve);
+      }
       buttons.push(merge);
       row.append(merge);
     }