@nickysagan/issue-orchestrator 0.1.1 → 0.1.2

package/README.md

@@ -108,7 +108,9 @@ tmux attach -t orchestrator   # watch the workers directly
   restarted automatically, because its draft PR or worktree may still exist.
 - **Worker logs** — every launch `tee`s the window's combined output to
   `<git-common-dir>/issue-orchestrator/logs/<issue|review>-<n>.<attempt>.log`,
-  keeping the latest three attempts. Surfaced tails are scrubbed of secrets.
+  keeping the latest three attempts. Surfaced tails are scrubbed of secrets. A
+  run that reaches its end stamps a final `[orchestrator <ISO>] ... finished ...`
+  line into its log, so a tail can be placed in time without the file's mtime.
 - **Active-container lease** — at startup the supervisor resolves its own exact
   64-character Docker container ID (from `/proc/self/mountinfo`; the short
   `hostname` form is not accepted) and registers it with
@@ -279,19 +281,23 @@ Both are sourced from [`Sadotu/agent-skills`](https://github.com/Sadotu/agent-sk
 
 ## Releasing
 
-`package.json` holds the version; the tag only confirms it. Bump it in a normal
-pull request, then tag the merge commit:
+`package.json` holds the version, and merging the bump is the whole release.
+Bump it in a normal pull request; when that lands on `main`,
+`.github/workflows/publish.yml` sees a version the registry does not carry,
+runs the tests, publishes, and pushes the matching `v<version>` tag. A merge
+that does not bump the version finds its version already published and exits
+without releasing anything.
 
-```bash
-git tag v0.2.0 && git push origin v0.2.0
-```
-
-`.github/workflows/publish.yml` publishes to npmjs via
+Publishing goes to npmjs via
 [trusted publishing](https://docs.npmjs.com/trusted-publishers), so no npm
 token is stored anywhere: npm exchanges the workflow's OIDC identity for a
-short-lived credential. It refuses to publish unless the tag equals
-`v<version>` and the tests pass. A published version cannot be republished;
-bump and tag again.
+short-lived credential. Tagging is a second job, so the job holding an npm
+credential cannot write to this repository and the job that can push a tag
+holds no npm credential. A published version cannot be republished; bump and
+merge again.
+
+Pushing a `v*` tag by hand still works and takes the same path, with one extra
+guard: the tag must equal `v<version>` or the run fails.
 
 Trusted publishing can only be configured on a package that already exists, so
 `0.1.0` was published by hand (`npm login && npm publish`) to bootstrap it.

package/bin/supervisor.mjs

@@ -239,9 +239,20 @@ export function createTmux({ exec, session = SESSION, logs = NO_WORKER_LOGS }) {
   // still throws synchronously rather than rejecting a returned promise.
   // `tee` sees the pane's combined output, which is the whole point of the
   // log; an unreserved log leaves the command byte-identical to a plain launch.
-  async function newWindow(role, number, name, command) {
+  //
+  // Once the pipeline ends, the same shell stamps `completion` into the log, so
+  // a reader can place the run in time without the file's mtime. It is written
+  // here rather than by the supervisor because only this shell knows the actual
+  // finish instant — the supervisor learns of it up to a poll later, while
+  // `tee` may still hold the file open. `date` matches `formatLogLine`'s ISO
+  // 8601 UTC shape, so both kinds of orchestrator line read alike.
+  async function newWindow(role, number, name, command, completion) {
     const path = await logs.prepare(role, number);
-    const cmd = `bash -ic ${shellQuote(command)}${path ? ` 2>&1 | tee ${shellQuote(path)}` : ""}`;
+    const cmd = `bash -ic ${shellQuote(command)}${path
+      ? ` 2>&1 | tee ${shellQuote(path)}`
+        + `; printf '[orchestrator %s] %s\\n' "$(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)"`
+        + ` ${shellQuote(completion)} >> ${shellQuote(path)}`
+      : ""}`;
     return exec("tmux", ["new-window", "-t", session, "-n", name, cmd]);
   }
 
@@ -252,7 +263,8 @@ export function createTmux({ exec, session = SESSION, logs = NO_WORKER_LOGS }) {
     // so the alias would silently fail to resolve without `bash -ic`, which
     // forces alias expansion regardless of login/interactive invocation.
     const command = `ccode --print --permission-mode auto --model claude-opus-4-8 "/github-issue ${n}"`;
-    return newWindow("issue", n, `issue-${n}`, command);
+    // No PR to name: the worker opens one mid-run, long after this launch.
+    return newWindow("issue", n, `issue-${n}`, command, `Worker finished for #${n}`);
   }
 
   // The reviewer is a read-only pass over an existing PR; the window is named
@@ -261,7 +273,7 @@ export function createTmux({ exec, session = SESSION, logs = NO_WORKER_LOGS }) {
     const i = issueNumber(number);
     const p = issueNumber(prNumber);
     const command = `ccode --print --permission-mode auto --model claude-opus-4-8 "/review-pr ${p}"`;
-    return newWindow("review", i, `review-${i}`, command);
+    return newWindow("review", i, `review-${i}`, command, `Reviewer finished for #${i} (PR #${p})`);
   }
 
   // Suppress ONLY a confirmed "window absent" failure (idempotent close). Any

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nickysagan/issue-orchestrator",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "A small, supervised GitHub issue queue that keeps autonomous coding workers alive.",
   "license": "MIT",
   "repository": {