@plainconceptsplatform/workflows 0.16.2 → 0.17.0

package/dist/catalog-installation.js

@@ -26,6 +26,12 @@ export function mandatoryFileSpecs(sourcePath) {
 export function catalogSourcePath(modulePath = fileURLToPath(import.meta.url)) {
     return resolve(dirname(modulePath), "..", "loops");
 }
+/**
+ * Where `gh aw` writes the pinned-action lock, and the only place it should be named.
+ * `generatedConsumerTargets` in the catalog declares the same path; two literals is how the
+ * pre-commit hook ended up guarding one that exists nowhere.
+ */
+const ACTIONS_LOCK = ".github/aw/actions-lock.json";
 const isWorker = (target) => target.startsWith(".github/workflows/agent-") && target.endsWith(".md");
 const isRouter = (target) => target === ".github/workflows/work-router.yml";
 const carriesHeader = (target) => /\.(ya?ml|md|sh|mjs|cjs)$/.test(target);
@@ -287,7 +293,13 @@ async function preCommitHookUpdate(repositoryPath) {
     const hookPath = join(repositoryPath, target);
     const compileLine = "node scripts/compile-agent-workflows.mjs";
     const stageLine = "git add -- .github/workflows/*.lock.yml";
-    const actionLockLine = "[ ! -f .github/actions/actions-lock.json ] || git add -- .github/actions/actions-lock.json";
+    // gh aw writes this at .github/aw/, which is what every consumer tracks and what
+    // `generatedConsumerTargets` in the catalog declares. The line used to name
+    // `.github/actions/actions-lock.json`, a path that exists nowhere, so `[ ! -f ... ]` was
+    // always true, the `||` short-circuited, and the real lock was never staged: a compile that
+    // bumped an action pin left the lock out of the commit and the tree dirty behind it. Nothing
+    // failed, which is why it survived. Found by the first audit run in the dogfood repository.
+    const actionLockLine = `[ ! -f ${ACTIONS_LOCK} ] || git add -- ${ACTIONS_LOCK}`;
     const managedLines = `if git diff --cached --name-only -- .github | grep -q .; then\n  ${compileLine}\n  ${stageLine}\n  ${actionLockLine}\nfi\n`;
     if (!await exists(hookPath)) {
         return { target, content: managedLines };
@@ -363,9 +375,9 @@ async function generatedFiles(repositoryPath) {
             updates.push({ target: `.github/workflows/${file.replaceAll("\\", "/")}`, content: await readFile(join(workflowPath, file), "utf8") });
         }
     }
-    const actionsLock = join(repositoryPath, ".github", "actions", "actions-lock.json");
+    const actionsLock = join(repositoryPath, ...ACTIONS_LOCK.split("/"));
     if (await exists(actionsLock)) {
-        updates.push({ target: ".github/actions/actions-lock.json", content: await readFile(actionsLock, "utf8") });
+        updates.push({ target: ACTIONS_LOCK, content: await readFile(actionsLock, "utf8") });
     }
     return updates.sort((left, right) => left.target.localeCompare(right.target));
 }

package/loops/actions/housekeeping/action.yml

@@ -75,6 +75,13 @@ runs:
           const names = (issue) => issue.labels.map((l) => (typeof l === 'string' ? l : l.name));
 
           const needsHuman = [];
+          // Stalled work still inside its retry window. Separate from needsHuman because nobody
+          // needs to act on it yet, and reported anyway because the alternative is silence: the
+          // window is 6 hours and the budget is 3 attempts, so an issue that keeps stalling was
+          // invisible for eighteen hours before it surfaced as retries-exhausted. Watched that
+          // happen to an audit report in the dogfood repository -- parked, and the digest said
+          // one item while three issues were sitting there.
+          const retrying = [];
           let retried = 0;
 
           // 1. Retry what the machine stalled on. `stalled` marks a park caused by a crash, a
@@ -96,7 +103,10 @@ runs:
               needsHuman.push({ kind: 'decided', issue, labels, waited });
               continue;
             }
-            if (waited < retryAfterMs) continue;
+            if (waited < retryAfterMs) {
+              retrying.push({ issue, waited, attempts, work, due: retryAfterMs - waited });
+              continue;
+            }
             if (attempts >= maxRetries || !work) {
               needsHuman.push({ kind: attempts >= maxRetries ? 'retries-exhausted' : 'no-work-label', issue, labels, waited, attempts });
               continue;
@@ -203,39 +213,64 @@ runs:
 
           // 6. One digest. Everything above either fixed itself or is listed here, so there is a
           // single place to look instead of four repositories and three label queries.
+          // Audit reports nobody actioned. audit-close labels these `stale-audit` once they are
+          // past their budget, which frees the audit's backpressure slot. Freeing the slot
+          // without listing the report anywhere would only move the silence, so they land here.
+          for (const issue of issues) {
+            if (issue.pull_request) continue;
+            if (!names(issue).includes('stale-audit')) continue;
+            needsHuman.push({ kind: 'stale-audit', issue, waited: age(issue.created_at) });
+          }
+
           const line = (entry) => {
             if (entry.kind === 'pr-parked') return `- PR #${entry.pull.number} · parked ${days(entry.waited)}d · gate verdict \`${entry.verdict}\` · ${entry.pull.title}`;
             if (entry.kind === 'pr-stale') return `- PR #${entry.pull.number} · ${days(entry.waited)}d old · no gate verdict yet · ${entry.pull.title}`;
             if (entry.kind === 'retries-exhausted') return `- #${entry.issue.number} · stalled ${days(entry.waited)}d · retried ${entry.attempts}× and still stalling · ${entry.issue.title}`;
             if (entry.kind === 'no-work-label') return `- #${entry.issue.number} · stalled ${days(entry.waited)}d · no work label to retry with · ${entry.issue.title}`;
+            if (entry.kind === 'stale-audit') return `- #${entry.issue.number} · open ${days(entry.waited)}d · audit report nobody actioned · ${entry.issue.title}`;
             return `- #${entry.issue.number} · waiting ${days(entry.waited)}d · ${entry.labels.filter((l) => l !== 'review').join(', ') || 'no other labels'} · ${entry.issue.title}`;
           };
           const section = (heading, kinds) => {
             const rows = needsHuman.filter((e) => kinds.includes(e.kind));
             return rows.length === 0 ? '' : `\n### ${heading} (${rows.length})\n\n${rows.map(line).join('\n')}\n`;
           };
+          // Listed, but not as something to act on: the machine is going to try again by itself.
+          // The heading says so, because a reader who acts on these duplicates the retry.
+          const retryingSection = () => {
+            if (retrying.length === 0) return '';
+            const hours = (ms) => Math.max(1, Math.round(ms / 3600000));
+            const rows = retrying.map((entry) =>
+              `- #${entry.issue.number} · stalled ${hours(entry.waited)}h ago · attempt ${entry.attempts + 1} of ${maxRetries} due in ~${hours(entry.due)}h · ${entry.issue.title}`);
+            return `\n### Retrying by itself, no action needed (${retrying.length})\n\n${rows.join('\n')}\n`;
+          };
           const body = [
             DIGEST_MARKER,
             `_Updated ${new Date().toISOString().slice(0, 16).replace('T', ' ')} UTC. This issue is rewritten by the housekeeping job; edits to it are lost._`,
             section('Waiting on a decision', ['decided']),
             section('Pull requests parked by the gate', ['pr-parked', 'pr-stale']),
             section('Stalled beyond the retry budget', ['retries-exhausted', 'no-work-label']),
+            section('Audit reports nobody actioned', ['stale-audit']),
+            retryingSection(),
             needsHuman.length === 0 ? '\nNothing is waiting on a person right now.\n' : '',
             `\n---\n\nThis run retried ${retried} stalled issue(s) and made ${planned.length} change(s) in total.`,
           ].filter(Boolean).join('\n');
 
           if (digestTitle) {
+            // The digest exists whenever there is anything to show, including work the machine is
+            // about to retry. Gating it on needsHuman alone is what left three parked issues
+            // with a digest that named one.
+            const anythingToShow = needsHuman.length + retrying.length;
             const existing = issues.find((i) => !i.pull_request && i.title === digestTitle && (i.body ?? '').includes(DIGEST_MARKER));
             if (existing) {
-              if (needsHuman.length === 0) {
+              if (anythingToShow === 0) {
                 await act(`closing the digest #${existing.number}: nothing is waiting`, () =>
                   github.rest.issues.update({ ...context.repo, issue_number: existing.number, body, state: 'closed', state_reason: 'completed' }));
               } else {
-                await act(`updating the digest #${existing.number}: ${needsHuman.length} item(s)`, () =>
+                await act(`updating the digest #${existing.number}: ${anythingToShow} item(s)`, () =>
                   github.rest.issues.update({ ...context.repo, issue_number: existing.number, body }));
               }
-            } else if (needsHuman.length > 0) {
-              await act(`opening the digest: ${needsHuman.length} item(s)`, () =>
+            } else if (anythingToShow > 0) {
+              await act(`opening the digest: ${anythingToShow} item(s)`, () =>
                 github.rest.issues.create({ ...context.repo, title: digestTitle, body }));
             }
           }
@@ -245,6 +280,7 @@ runs:
             .addList([
               `Retried: ${retried}`,
               `Waiting on a person: ${needsHuman.length}`,
+              `Stalled, retrying by itself: ${retrying.length}`,
               `Changes ${dryRun ? 'planned' : 'made'}: ${planned.length}`,
             ])
             .addRaw(planned.length ? `\n\n${planned.map((p) => `- ${p}`).join('\n')}` : '')

package/loops/actions/report-workflow-errors/action.yml

@@ -62,10 +62,17 @@ runs:
           const since = new Date(Date.now() - Number(process.env.LOOKBACK_HOURS) * 3600 * 1000);
 
           // Only workflows this package ships. A consumer's own workflow name is theirs and can
-          // describe a product, a customer or an environment -- Lyceum really does have
-          // `name: Deploy app to ${{ inputs.environment }}` -- so an allowlist by filename is the
-          // boundary, and it is the only thing keeping those names out. Anything not matching is
-          // counted and otherwise ignored.
+          // describe a product, a customer or an environment -- one consumer really does have a
+          // job named "Deploy app to" followed by an interpolated environment input -- so an
+          // allowlist by filename is the boundary, and it is the only thing keeping those names
+          // out. Anything not matching is counted and otherwise ignored.
+          //
+          // That example is described rather than quoted on purpose. An Actions expression is
+          // interpolated into this script by the runner BEFORE the JavaScript is parsed, comments
+          // included, so quoting one here made the comment a live substitution -- flagged by
+          // semgrep as github-script-injection, and invisible to a `node --check` pass because
+          // the checker has to mask the expression to parse the file at all. Everything this
+          // script needs arrives through `env:` above; nothing is interpolated into it.
           //
           // Exactly the filenames the package installs, and no pattern that admits a name it does
           // not. The previous version was written as a shape (`\.(yml|lock\.yml)$` over a group of

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -405,6 +405,83 @@ else
 fi
 if [ "$BELT_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 
+# The two guards in the stale-reservation sweep, executed rather than read.
+#
+# Both were dead in production for as long as they existed. They matched `#N` with a `\b` word
+# boundary written as `\\b` inside a double-quoted bash string -- and bash halves that to `\b`,
+# which jq's string parser reads as a BACKSPACE (0x08), not as a boundary. So the regex hunted
+# for a character no title or body contains, both guards returned 0 every time, and the sweep
+# cleared `bot-working` off every issue that carried it: live queued runs included. Watched it
+# happen in the dogfood repository twenty minutes after that repository existed.
+#
+# Implement carries the same filter to decide whether a pull request already closes its issue,
+# and it was dead the same way, which is the most likely source of the same-day duplicate pull
+# requests in the backlog.
+#
+# There is no backslash in the fix and no way to reintroduce one by accident: the subject gains a
+# trailing space, so a number at the end of a body is still followed by a non-digit, and the
+# pattern matches `[^0-9]`. Four quoting layers cannot eat a character class.
+SWEEP_OK=1
+if ! grep -qF 'test(\"#${issue}[^0-9]\")' "$ROUTER_YML"; then
+  SWEEP_OK=0
+  echo "FAIL: the stale-reservation sweep does not match a run title with a character class; a word boundary there is eaten by bash and jq" >&2
+else
+  sweep_runs='{"workflow_runs":[
+    {"status":"queued","display_title":"Working (Refine): a thing (#1)"},
+    {"status":"completed","display_title":"Working (Refine): another (#2)"},
+    {"status":"in_progress","display_title":"Working (Implement): more (#10)"}
+  ]}'
+  # The same program the router runs, with the same escaping, expanded the same way.
+  live_for() {
+    jq "[.workflow_runs[]
+      | select(.status == \"queued\" or .status == \"in_progress\" or .status == \"pending\" or .status == \"waiting\")
+      | select((.display_title + \" \") | test(\"#${1}[^0-9]\"))] | length" <<<"$sweep_runs"
+  }
+  for probe in "1:1" "2:0" "10:1" "3:0"; do
+    issue="${probe%%:*}"; want="${probe##*:}"
+    got=$(live_for "$issue" 2>&1)
+    if [ "$got" != "$want" ]; then
+      SWEEP_OK=0
+      echo "FAIL: the sweep's live-run check said ${got} live run(s) for #${issue}, expected ${want}" >&2
+    fi
+  done
+
+  sweep_pulls='[
+    {"number":11,"body":"Closes #1 and some detail."},
+    {"number":12,"body":"fixes #22"},
+    {"number":13,"body":"Mentions #9 but closes nothing."},
+    {"number":14,"body":"closes #5"}
+  ]'
+  has_pr_for() {
+    jq "[.[] | select(((.body // \"\") + \" \") | ascii_downcase | test(\"clos(e|es|ed) #${1}[^0-9]|fix(es|ed)? #${1}[^0-9]|resolves? #${1}[^0-9]\"))] | length" <<<"$sweep_pulls"
+  }
+  # The last cases are what the boundary is for: a bare mention is not a close, `#22` must not
+  # answer for `#2`, and the trailing space is what makes `closes #5` at the end of a body match.
+  for probe in "1:1" "22:1" "9:0" "2:0" "5:1" "999:0"; do
+    issue="${probe%%:*}"; want="${probe##*:}"
+    got=$(has_pr_for "$issue" 2>&1)
+    if [ "$got" != "$want" ]; then
+      SWEEP_OK=0
+      echo "FAIL: the open-pull-request guard found ${got} for #${issue}, expected ${want}" >&2
+    fi
+  done
+fi
+if [ "$SWEEP_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+
+# And nothing may go back to a word boundary in a double-quoted jq program anywhere, because the
+# failure is silent in both directions: the filter matches nothing and the job stays green.
+BOUNDARY_OK=1
+for candidate in "$ROUTER_YML" "${WORKFLOWS_DIR}"/agent-*.md; do
+  [ -f "$candidate" ] || continue
+  offenders=$(grep -n -- '--jq "' "$candidate" 2>/dev/null | grep -F '\b' || true)
+  if [ -n "$offenders" ]; then
+    BOUNDARY_OK=0
+    echo "FAIL: $(basename "$candidate") uses a word boundary inside a double-quoted jq program, which bash and jq turn into a backspace:" >&2
+    printf '  %s\n' "$offenders" | cut -c1-160 >&2
+  fi
+done
+if [ "$BOUNDARY_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+
 # `review` must not be a one-way door. It used to be: authorize-bot-work refused to fire on an
 # issue carrying it, and the classifier refuses to route while it is set, so a person adding
 # `refine` to a parked issue got nothing at all — no run, no comment, no error. Triage's own

package/loops/templates/ci/app-ci-node-monorepo.yml

@@ -42,9 +42,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
+        with: { version: "${{ env.PNPM_VERSION }}", run_install: false }
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
+        with: { node-version: "${{ env.NODE_VERSION }}", cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm exec biome check .
 
@@ -55,9 +55,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
+        with: { version: "${{ env.PNPM_VERSION }}", run_install: false }
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
+        with: { node-version: "${{ env.NODE_VERSION }}", cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm --filter "$WEB_PACKAGE" run typecheck
       - run: pnpm --filter "$WEB_PACKAGE" run test
@@ -80,9 +80,9 @@ jobs:
         with:
           fetch-depth: 0
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
+        with: { version: "${{ env.PNPM_VERSION }}", run_install: false }
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
+        with: { node-version: "${{ env.NODE_VERSION }}", cache: pnpm }
       - name: Detect web changes
         id: scope
         run: |
@@ -107,9 +107,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
+        with: { version: "${{ env.PNPM_VERSION }}", run_install: false }
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
+        with: { node-version: "${{ env.NODE_VERSION }}", cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
         with:
@@ -132,9 +132,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
+        with: { version: "${{ env.PNPM_VERSION }}", run_install: false }
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
+        with: { node-version: "${{ env.NODE_VERSION }}", cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm --filter "$DESKTOP_PACKAGE" run typecheck
       - run: pnpm --filter "$DESKTOP_PACKAGE" run build
@@ -156,9 +156,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
+        with: { version: "${{ env.PNPM_VERSION }}", run_install: false }
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
+        with: { node-version: "${{ env.NODE_VERSION }}", cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm --filter "$MOBILE_PACKAGE" run typecheck
       - run: |

package/loops/workflows/agent-implement.md

@@ -404,7 +404,7 @@ jobs:
             | grep -oE '<!-- implement-pr: [0-9]+ -->' | head -1 | grep -oE '[0-9]+' || true)
           if [ -z "$pr" ]; then
             pr=$(gh pr list --repo "$REPO" --state open --json number,body \
-              --jq "[.[] | select((.body // \"\") | ascii_downcase | test(\"clos(e|es|ed) #${ISSUE}\\b|fix(es|ed)? #${ISSUE}\\b|resolves? #${ISSUE}\\b\"))][0].number // empty")
+              --jq "[.[] | select(((.body // \"\") + \" \") | ascii_downcase | test(\"clos(e|es|ed) #${ISSUE}[^0-9]|fix(es|ed)? #${ISSUE}[^0-9]|resolves? #${ISSUE}[^0-9]\"))][0].number // empty")
           fi
           if [ -z "$pr" ]; then
             echo "::notice::No pull request found for #$ISSUE; nothing to wait for."

package/loops/workflows/work-router.yml

@@ -943,11 +943,11 @@ jobs:
               live=$(gh api "repos/$REPO/actions/runs?per_page=100" \
                 --jq "[.workflow_runs[]
                   | select(.status == \"queued\" or .status == \"in_progress\" or .status == \"pending\" or .status == \"waiting\")
-                  | select(.display_title | test(\"#${issue}\\b\"))] | length")
+                  | select((.display_title + \" \") | test(\"#${issue}[^0-9]\"))] | length")
               [ "${live:-0}" -eq 0 ] || continue
 
               has_pr=$(gh pr list --repo "$REPO" --state open --json body \
-                --jq "[.[] | select((.body // \"\") | ascii_downcase | test(\"clos(e|es|ed) #${issue}\\b|fix(es|ed)? #${issue}\\b|resolves? #${issue}\\b\"))] | length")
+                --jq "[.[] | select(((.body // \"\") + \" \") | ascii_downcase | test(\"clos(e|es|ed) #${issue}[^0-9]|fix(es|ed)? #${issue}[^0-9]|resolves? #${issue}[^0-9]\"))] | length")
               [ "${has_pr:-0}" -eq 0 ] || continue
 
               echo "Clearing a stale bot-working reservation on #$issue: no run, no pull request."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.16.2",
+  "version": "0.17.0",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",