@plainconceptsplatform/workflows 0.2.1 → 0.3.0

package/dist/catalog-installation.d.ts

@@ -1,4 +1,5 @@
-import { type TemplateName } from "./workflow-catalog.js";
+import { type RouteName, type TemplateName } from "./workflow-catalog.js";
+import type { RepositoryInspection } from "./repository-inspection.js";
 export interface CatalogInstallResult {
     readonly installed: readonly string[];
     readonly conflicts: readonly string[];
@@ -6,6 +7,8 @@ export interface CatalogInstallResult {
 export interface CatalogInstallOptions {
     readonly force?: boolean;
     readonly sourcePath?: string;
+    readonly selectedRoutes?: readonly RouteName[];
+    readonly inspection?: RepositoryInspection;
 }
 interface CatalogFile {
     readonly source: string;
@@ -18,4 +21,7 @@ export declare function installCatalog(repositoryPath: string, options?: Catalog
 export declare function installTemplate(repositoryPath: string, template: TemplateName, options?: CatalogInstallOptions): Promise<CatalogInstallResult>;
 export declare function installMandatoryFiles(repositoryPath: string, options?: CatalogInstallOptions): Promise<CatalogInstallResult>;
 export declare function isTemplateName(value: string): value is TemplateName;
+export declare function ensurePreCommitHook(repositoryPath: string): Promise<void>;
+export declare function runCompileIfAvailable(repositoryPath: string): Promise<void>;
+export declare function exists(path: string): Promise<boolean>;
 export {};

package/dist/catalog-installation.js

@@ -1,8 +1,13 @@
-import { access, copyFile, mkdir, readFile, readdir } from "node:fs/promises";
+import { execFile } from "node:child_process";
+import { access, copyFile, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import { constants } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { catalogTemplates, mandatoryFiles, templateNames } from "./workflow-catalog.js";
+import { promisify } from "node:util";
+import { catalogTemplates, mandatoryFiles, routeNames, templateNames } from "./workflow-catalog.js";
+import { processRoutes, excludedWorkerFiles } from "./route-processing.js";
+import { generateOpencodeCi, generateOpencodeConfig, generateStackDefaults, injectStackEnv } from "./stack-defaults.js";
+const execFileAsync = promisify(execFile);
 const sourceMappings = [
     ["actions", ".github/actions"],
     ["workflows", ".github/workflows"],
@@ -20,23 +25,68 @@ export function catalogSourcePath(modulePath = fileURLToPath(import.meta.url)) {
 }
 export async function installCatalog(repositoryPath, options = {}) {
     const sourcePath = options.sourcePath ?? catalogSourcePath();
-    const files = [...await catalogFiles(sourcePath), ...mandatoryFileSpecs(sourcePath)];
-    const deduplicated = files.filter((file, index) => files.findIndex((f) => f.target === file.target) === index).sort((left, right) => left.target.localeCompare(right.target));
-    const managedFiles = deduplicated.filter((file) => file.managed);
+    const selectedRoutes = options.selectedRoutes ?? routeNames;
+    const allFiles = [...await catalogFiles(sourcePath), ...mandatoryFileSpecs(sourcePath)];
+    const deduplicated = allFiles.filter((file, index) => allFiles.findIndex((f) => f.target === file.target) === index).sort((left, right) => left.target.localeCompare(right.target));
+    const excluded = excludedWorkerFiles(selectedRoutes);
+    const filtered = deduplicated.filter((file) => {
+        const fileName = file.target.split("/").pop() ?? "";
+        return !excluded.has(fileName);
+    });
+    const managedFiles = filtered.filter((file) => file.managed);
     const conflicts = (await Promise.all(managedFiles.map(async (file) => {
         const destination = join(repositoryPath, file.target);
         return await exists(destination) && !(await filesMatch(file.source, destination)) ? file.target : undefined;
     }))).filter((file) => file !== undefined);
     if (conflicts.length > 0 && !options.force)
         return { installed: [], conflicts };
-    await Promise.all(deduplicated.map(async (file) => {
-        const destination = join(repositoryPath, file.target);
-        if (!file.managed && await exists(destination))
+    const fileContents = new Map();
+    for (const file of filtered) {
+        fileContents.set(file.target, await readFile(file.source, "utf8"));
+    }
+    let processedContents = processRoutes(fileContents, selectedRoutes);
+    if (options.inspection !== undefined) {
+        const defaults = generateStackDefaults(options.inspection);
+        processedContents = injectStackIntoWorkers(processedContents, defaults);
+        processedContents = transformOpencodeFiles(processedContents, options.inspection);
+    }
+    await Promise.all([...processedContents.entries()].map(async ([target, content]) => {
+        const destination = join(repositoryPath, target);
+        const originalFile = filtered.find((f) => f.target === target);
+        if (originalFile !== undefined && !originalFile.managed && await exists(destination))
             return;
         await mkdir(dirname(destination), { recursive: true });
-        await copyFile(file.source, destination);
+        await writeFile(destination, content, "utf8");
     }));
-    return { installed: deduplicated.map((file) => file.target), conflicts };
+    await ensurePreCommitHook(repositoryPath);
+    try {
+        await runCompileIfAvailable(repositoryPath);
+    }
+    catch {
+        // compile failure is non-fatal
+    }
+    return { installed: [...processedContents.keys()].sort(), conflicts };
+}
+function injectStackIntoWorkers(files, defaults) {
+    const result = new Map(files);
+    for (const [key, content] of result) {
+        if (key.startsWith(".github/workflows/agent-") && key.endsWith(".md")) {
+            result.set(key, injectStackEnv(content, defaults));
+        }
+    }
+    return result;
+}
+function transformOpencodeFiles(files, inspection) {
+    const result = new Map(files);
+    for (const [key, content] of result) {
+        if (key.endsWith("opencode-ci.md")) {
+            result.set(key, generateOpencodeCi(content, inspection));
+        }
+        else if (key === "opencode.ci.json") {
+            result.set(key, generateOpencodeConfig(content, inspection));
+        }
+    }
+    return result;
 }
 export async function installTemplate(repositoryPath, template, options = {}) {
     const sourcePath = options.sourcePath ?? catalogSourcePath();
@@ -49,6 +99,17 @@ export async function installTemplate(repositoryPath, template, options = {}) {
         return { installed: [], conflicts };
     await mkdir(dirname(destination), { recursive: true });
     await copyFile(source, destination);
+    if (options.inspection !== undefined && template === "opencode.ci.json") {
+        const baseContent = await readFile(source, "utf8");
+        const transformed = generateOpencodeConfig(baseContent, options.inspection);
+        await writeFile(destination, transformed, "utf8");
+    }
+    try {
+        await runCompileIfAvailable(repositoryPath);
+    }
+    catch {
+        // compile failure is non-fatal
+    }
     return { installed: [target], conflicts };
 }
 export async function installMandatoryFiles(repositoryPath, options = {}) {
@@ -70,6 +131,25 @@ export async function installMandatoryFiles(repositoryPath, options = {}) {
 export function isTemplateName(value) {
     return templateNames.includes(value);
 }
+export async function ensurePreCommitHook(repositoryPath) {
+    const hookPath = join(repositoryPath, ".husky", "pre-commit");
+    if (!await exists(hookPath))
+        return;
+    const content = await readFile(hookPath, "utf8");
+    const compileLine = "node scripts/compile-agent-workflows.mjs";
+    if (content.includes("compile-agent-workflows"))
+        return;
+    const newContent = content.endsWith("\n") || content === ""
+        ? `${content}${compileLine}\n`
+        : `${content}\n${compileLine}\n`;
+    await writeFile(hookPath, newContent, "utf8");
+}
+export async function runCompileIfAvailable(repositoryPath) {
+    const script = join(repositoryPath, "scripts", "compile-agent-workflows.mjs");
+    if (await exists(script)) {
+        await execFileAsync("node", [script, "--force"], { cwd: repositoryPath });
+    }
+}
 function catalogTemplateMeta(template) {
     const entry = catalogTemplates.find((item) => item.name === template);
     if (entry === undefined)
@@ -113,7 +193,7 @@ async function filesMatch(source, destination) {
         return false;
     }
 }
-async function exists(path) {
+export async function exists(path) {
     try {
         await access(path, constants.F_OK);
         return true;

package/dist/index.js

@@ -78,9 +78,10 @@ export async function run(arguments_, repositoryPath = process.cwd()) {
         if (template === "invalid")
             return fail(`${command} accepts only --force or --template agentics-checks|agentics-maintenance|app-ci-dotnet-next|app-ci-node-monorepo|opencode.ci.json.`);
         const force = options.includes("--force");
+        const inspection = await inspectRepository(repositoryPath);
         const result = template === undefined
-            ? await installCatalog(repositoryPath, { force })
-            : await installTemplate(repositoryPath, template, { force });
+            ? await installCatalog(repositoryPath, { force, inspection })
+            : await installTemplate(repositoryPath, template, { force, inspection });
         if (result.conflicts.length > 0 && !force) {
             console.error(`Catalog conflicts found. Re-run with --force to overwrite package-managed files:\n${result.conflicts.join("\n")}`);
             return 1;

package/dist/route-processing.d.ts

@@ -0,0 +1,6 @@
+import { type RouteName } from "./workflow-catalog.js";
+export declare function stripRouteFromRouter(yaml: string, route: RouteName): string;
+export declare function stripRouteFromClassifier(shell: string, route: RouteName): string;
+export declare function addRouteExclusion(matrix: string, route: RouteName): string;
+export declare function processRoutes(files: Map<string, string>, selectedRoutes: readonly RouteName[]): Map<string, string>;
+export declare function excludedWorkerFiles(selectedRoutes: readonly RouteName[]): Set<string>;

package/dist/route-processing.js

@@ -0,0 +1,121 @@
+import { routeNames, workflowRoutes } from "./workflow-catalog.js";
+const routeCrons = {
+    audit: "17 1 * * 1",
+    propose: "29 7 * * *",
+};
+export function stripRouteFromRouter(yaml, route) {
+    let result = yaml;
+    const cron = routeCrons[route];
+    if (cron !== undefined) {
+        result = result.replace(new RegExp(`^    - cron: "${escapeRegex(cron)}"\\n`, "gm"), "");
+    }
+    result = removeJobBlock(result, `call-${route}`);
+    result = result.replace(new RegExp(`^          - ${escapeRegex(route)}\\n`, "gm"), "");
+    return result;
+}
+export function stripRouteFromClassifier(shell, route) {
+    const constName = route.replace(/-/g, "_").toUpperCase() + "_CRON";
+    let result = shell;
+    result = result.replace(new RegExp(`^readonly ${constName}="[^"]*"\\n`, "gm"), "");
+    const cron = routeCrons[route];
+    if (cron !== undefined) {
+        result = result.replace(new RegExp(`\\s*"\\$${constName}"\\) route="${escapeRegex(route)}" ;;\\n`, "g"), "");
+    }
+    result = result.replace(new RegExp(` \\| ${escapeRegex(route)}\\)`, "g"), ")");
+    result = result.replace(new RegExp(`^(\\s+)${escapeRegex(route)} \\| `, "gm"), "$1");
+    if (!result.includes(`| ${route}`) && !result.includes(`${route} |`)) {
+        result = removeAloneDispatchCase(result, route);
+    }
+    return result;
+}
+function removeAloneDispatchCase(shell, route) {
+    const lines = shell.split("\n");
+    const pattern = new RegExp(`^(\\s+)${escapeRegex(route)}\\)\\s*$`);
+    const result = [];
+    let i = 0;
+    while (i < lines.length) {
+        const match = lines[i].match(pattern);
+        if (match) {
+            const indent = match[1];
+            i++;
+            while (i < lines.length) {
+                if (new RegExp(`^${escapeRegex(indent)};;\\s*$`).test(lines[i])) {
+                    i++;
+                    break;
+                }
+                i++;
+            }
+        }
+        else {
+            result.push(lines[i]);
+            i++;
+        }
+    }
+    return result.join("\n");
+}
+export function addRouteExclusion(matrix, route) {
+    if (matrix.includes(`excluded route '${route}'`))
+        return matrix;
+    let result = matrix;
+    result = result.replace(new RegExp(` ${escapeRegex(route)} `, "g"), " ");
+    const exclusionBlock = `\necho "── Excluded routes ──────────────────────────────────────────────────────"\nif ! grep -q "route == '${route}'" "$ROUTER_YML"; then\n  PASS=$((PASS + 1))\n  echo "  ${route} correctly excluded from work-router.yml"\nelse\n  FAIL=$((FAIL + 1))\n  echo "FAIL: excluded route '${route}' is still in work-router.yml" >&2\nfi\n`;
+    result = result.replace(/(\necho\nif \[ "\$FAIL" -eq 0 \])/, `${exclusionBlock}$1`);
+    return result;
+}
+export function processRoutes(files, selectedRoutes) {
+    const excludedRoutes = routeNames.filter((r) => !selectedRoutes.includes(r));
+    if (excludedRoutes.length === 0)
+        return files;
+    const result = new Map(files);
+    for (const route of excludedRoutes) {
+        const routerKey = findFileKey(result, "work-router.yml");
+        if (routerKey !== undefined) {
+            result.set(routerKey, stripRouteFromRouter(result.get(routerKey), route));
+        }
+        const classifierKey = findFileKey(result, "classify-route.sh");
+        if (classifierKey !== undefined) {
+            result.set(classifierKey, stripRouteFromClassifier(result.get(classifierKey), route));
+        }
+        const matrixKey = findFileKey(result, "verify-route-matrix.sh");
+        if (matrixKey !== undefined) {
+            result.set(matrixKey, addRouteExclusion(result.get(matrixKey), route));
+        }
+    }
+    return result;
+}
+export function excludedWorkerFiles(selectedRoutes) {
+    return new Set(workflowRoutes
+        .filter((route) => !selectedRoutes.includes(route.name))
+        .map((route) => route.worker));
+}
+function removeJobBlock(yaml, jobName) {
+    const lines = yaml.split("\n");
+    const startPattern = new RegExp(`^  ${escapeRegex(jobName)}:`);
+    const result = [];
+    let skipping = false;
+    for (const line of lines) {
+        if (skipping) {
+            if (/^  \S/.test(line) || /^[^\s]/.test(line)) {
+                skipping = false;
+                result.push(line);
+            }
+        }
+        else if (startPattern.test(line)) {
+            skipping = true;
+        }
+        else {
+            result.push(line);
+        }
+    }
+    return result.join("\n");
+}
+function findFileKey(files, endsWith) {
+    for (const key of files.keys()) {
+        if (key.endsWith(endsWith))
+            return key;
+    }
+    return undefined;
+}
+function escapeRegex(str) {
+    return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}

package/dist/route-processing.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/route-processing.test.js

@@ -0,0 +1,310 @@
+import { describe, expect, it } from "vitest";
+import { addRouteExclusion, excludedWorkerFiles, processRoutes, stripRouteFromClassifier, stripRouteFromRouter, } from "./route-processing.js";
+import { routeNames } from "./workflow-catalog.js";
+const ROUTER_YAML = `# header
+name: "All Work Router"
+
+on:
+  schedule:
+    - cron: "17 1 * * 1"
+    - cron: "43 3 * * *"
+    - cron: "0 6 * * *"
+    - cron: "0 */2 * * *"
+    - cron: "29 7 * * *"
+
+  workflow_dispatch:
+    inputs:
+      operation:
+        description: "Operation to run"
+        required: true
+        type: choice
+        options:
+          - refine
+          - implement
+          - direct
+          - apply-review
+          - merge-gate
+          - audit
+          - propose
+          - audit-close
+          - cleanup-artifacts
+          - stale-recovery
+          - validate
+
+jobs:
+  call-refine:
+    needs: [classify, authorize]
+    if: needs.classify.outputs.route == 'refine' && needs.authorize.outputs.trusted == 'true'
+    uses: ./.github/workflows/agent-refine.lock.yml
+    secrets:
+      OPENAI_API_KEY: \${{ secrets.OPENAI_API_KEY }}
+
+  call-implement:
+    needs: [classify, authorize]
+    if: needs.classify.outputs.route == 'implement' && needs.authorize.outputs.trusted == 'true'
+    uses: ./.github/workflows/agent-implement.lock.yml
+    secrets:
+      OPENAI_API_KEY: \${{ secrets.OPENAI_API_KEY }}
+
+  call-audit:
+    needs: classify
+    if: needs.classify.outputs.route == 'audit'
+    uses: ./.github/workflows/agent-audit.lock.yml
+    secrets:
+      OPENAI_API_KEY: \${{ secrets.OPENAI_API_KEY }}
+
+  call-propose:
+    needs: classify
+    if: needs.classify.outputs.route == 'propose'
+    uses: ./.github/workflows/agent-propose.lock.yml
+    secrets:
+      OPENAI_API_KEY: \${{ secrets.OPENAI_API_KEY }}
+
+  audit-close:
+    needs: classify
+    if: needs.classify.outputs.route == 'audit-close'
+    runs-on: ubuntu-latest
+`;
+const CLASSIFIER_SH = `#!/usr/bin/env bash
+set -euo pipefail
+
+readonly AUDIT_CRON="17 1 * * 1"
+readonly AUDIT_CLOSE_CRON="43 3 * * *"
+readonly CLEANUP_ARTIFACTS_CRON="0 6 * * *"
+readonly STALE_RECOVERY_CRON="0 */2 * * *"
+readonly PROPOSE_CRON="29 7 * * *"
+
+classify_route() {
+  local route="none" error=""
+
+  case "\${EVENT:-}" in
+    schedule)
+      trigger_kind="scheduled"
+      case "\${SCHEDULE:-}" in
+        "\$AUDIT_CRON") route="audit" ;;
+        "\$AUDIT_CLOSE_CRON") route="audit-close" ;;
+        "\$CLEANUP_ARTIFACTS_CRON") route="cleanup-artifacts" ;;
+        "\$STALE_RECOVERY_CRON") route="stale-recovery" ;;
+        "\$PROPOSE_CRON") route="propose" ;;
+        *) error="no route for cron '\${SCHEDULE:-}'" ;;
+      esac
+      ;;
+
+    workflow_dispatch)
+      trigger_kind="manual"
+      case "\${OPERATION:-}" in
+        refine | implement | direct)
+          route="\${OPERATION}"
+          ;;
+        apply-review)
+          route="apply-review"
+          ;;
+        merge-gate)
+          route="merge-gate"
+          ;;
+        audit | propose)
+          route="\${OPERATION}"
+          trigger_kind="\${INPUT_TRIGGER_KIND:-manual}"
+          ;;
+        audit-close | cleanup-artifacts | stale-recovery | validate)
+          route="\${OPERATION}"
+          ;;
+        *)
+          error="unknown operation '\${OPERATION:-}'"
+          ;;
+      esac
+      ;;
+  esac
+
+  cat <<EOF
+route=\${route}
+error=\${error}
+EOF
+}
+
+if [ "\${BASH_SOURCE[0]}" = "\$0" ]; then
+  classify_route
+fi
+`;
+const MATRIX_SH = `#!/usr/bin/env bash
+set -euo pipefail
+
+echo "── Router wiring ─────────────────────────────────────────────────────────"
+for route in refine implement direct apply-review merge-gate audit propose bot-approve \\
+  audit-close cleanup-artifacts stale-recovery validate; do
+  if grep -q "route == '\${route}'" "\$ROUTER_YML"; then
+    PASS=\$((PASS + 1))
+  else
+    FAIL=\$((FAIL + 1))
+    echo "FAIL: work-router.yml has no job for route '\${route}'" >&2
+  fi
+done
+
+while read -r operation; do
+  if grep -q "route == '\${operation}'" "\$ROUTER_YML"; then
+    PASS=\$((PASS + 1))
+  else
+    FAIL=\$((FAIL + 1))
+    echo "FAIL: dispatch operation '\${operation}' has no job in work-router.yml" >&2
+  fi
+done < <(sed -n '/^      operation:/,/^      issue-number:/p' "\$ROUTER_YML" | sed -n 's/^          - //p')
+
+echo
+if [ "\$FAIL" -eq 0 ]; then
+  echo "Route matrix: \${PASS} passed"
+else
+  echo "Route matrix: \${PASS} passed, \${FAIL} FAILED" >&2
+fi
+
+exit \$((FAIL > 0))
+`;
+describe("stripRouteFromRouter", () => {
+    it("removes the propose cron entry", () => {
+        const result = stripRouteFromRouter(ROUTER_YAML, "propose");
+        expect(result).not.toContain('cron: "29 7 * * *"');
+        expect(result).toContain('cron: "17 1 * * 1"');
+    });
+    it("removes the call-propose job block", () => {
+        const result = stripRouteFromRouter(ROUTER_YAML, "propose");
+        expect(result).not.toContain("call-propose");
+        expect(result).toContain("call-refine");
+        expect(result).toContain("call-audit");
+    });
+    it("removes propose from the dispatch options", () => {
+        const result = stripRouteFromRouter(ROUTER_YAML, "propose");
+        expect(result).not.toMatch(/^\s+- propose$/m);
+        expect(result).toMatch(/^\s+- refine$/m);
+        expect(result).toMatch(/^\s+- audit$/m);
+    });
+    it("removes the audit cron entry", () => {
+        const result = stripRouteFromRouter(ROUTER_YAML, "audit");
+        expect(result).not.toContain('cron: "17 1 * * 1"');
+        expect(result).toContain('cron: "29 7 * * *"');
+    });
+    it("removes the call-audit job block", () => {
+        const result = stripRouteFromRouter(ROUTER_YAML, "audit");
+        expect(result).not.toContain("call-audit");
+        expect(result).toContain("call-refine");
+    });
+    it("preserves the audit-close job when removing audit", () => {
+        const result = stripRouteFromRouter(ROUTER_YAML, "audit");
+        expect(result).toContain("audit-close");
+    });
+    it("does not modify the yaml when stripping a route that has no cron", () => {
+        const yamlWithoutCron = ROUTER_YAML.replace(/    - cron: "17 1 \* \* 1"\n/, "");
+        const result = stripRouteFromRouter(yamlWithoutCron, "audit");
+        expect(result).not.toContain("call-audit");
+    });
+});
+describe("stripRouteFromClassifier", () => {
+    it("removes the PROPOSE_CRON constant", () => {
+        const result = stripRouteFromClassifier(CLASSIFIER_SH, "propose");
+        expect(result).not.toContain('readonly PROPOSE_CRON');
+        expect(result).toContain('readonly AUDIT_CRON');
+    });
+    it("removes the propose schedule case", () => {
+        const result = stripRouteFromClassifier(CLASSIFIER_SH, "propose");
+        expect(result).not.toContain('"$PROPOSE_CRON") route="propose"');
+        expect(result).toContain('"$AUDIT_CRON") route="audit"');
+    });
+    it("removes the AUDIT_CRON constant", () => {
+        const result = stripRouteFromClassifier(CLASSIFIER_SH, "audit");
+        expect(result).not.toContain('readonly AUDIT_CRON');
+        expect(result).toContain('readonly PROPOSE_CRON');
+    });
+    it("removes the audit schedule case", () => {
+        const result = stripRouteFromClassifier(CLASSIFIER_SH, "audit");
+        expect(result).not.toContain('"$AUDIT_CRON") route="audit"');
+        expect(result).toContain('"$PROPOSE_CRON") route="propose"');
+    });
+    it("removes propose from the dispatch case union", () => {
+        const result = stripRouteFromClassifier(CLASSIFIER_SH, "propose");
+        expect(result).not.toContain("audit | propose)");
+        expect(result).toContain("audit)");
+    });
+});
+describe("addRouteExclusion", () => {
+    it("adds an exclusion assertion for the route", () => {
+        const result = addRouteExclusion(MATRIX_SH, "propose");
+        expect(result).toContain("excluded route 'propose'");
+        expect(result).toContain("propose correctly excluded from work-router.yml");
+    });
+    it("does not add the exclusion twice", () => {
+        const once = addRouteExclusion(MATRIX_SH, "propose");
+        const twice = addRouteExclusion(once, "propose");
+        const matchCount = (twice.match(/excluded route 'propose'/g) ?? []).length;
+        expect(matchCount).toBe(1);
+    });
+});
+describe("processRoutes", () => {
+    it("returns the same map when all routes are selected", () => {
+        const files = new Map([
+            ["work-router.yml", ROUTER_YAML],
+            ["classify-route.sh", CLASSIFIER_SH],
+            ["verify-route-matrix.sh", MATRIX_SH],
+        ]);
+        const result = processRoutes(files, [...routeNames]);
+        expect(result).toBe(files);
+    });
+    it("strips propose from all three files when unselected", () => {
+        const files = new Map([
+            [".github/workflows/work-router.yml", ROUTER_YAML],
+            [".github/actions/classify-route/classify-route.sh", CLASSIFIER_SH],
+            [".github/actions/verify-route-matrix/verify-route-matrix.sh", MATRIX_SH],
+        ]);
+        const selectedRoutes = routeNames.filter((r) => r !== "propose");
+        const result = processRoutes(files, selectedRoutes);
+        const router = result.get(".github/workflows/work-router.yml");
+        expect(router).not.toContain("call-propose");
+        expect(router).not.toContain('cron: "29 7 * * *"');
+        expect(router).not.toMatch(/^\s+- propose$/m);
+        const classifier = result.get(".github/actions/classify-route/classify-route.sh");
+        expect(classifier).not.toContain("readonly PROPOSE_CRON");
+        expect(classifier).not.toContain('"$PROPOSE_CRON")');
+        const matrix = result.get(".github/actions/verify-route-matrix/verify-route-matrix.sh");
+        expect(matrix).toContain("excluded route 'propose'");
+    });
+    it("strips audit from all three files when unselected", () => {
+        const files = new Map([
+            ["work-router.yml", ROUTER_YAML],
+            ["classify-route.sh", CLASSIFIER_SH],
+            ["verify-route-matrix.sh", MATRIX_SH],
+        ]);
+        const selectedRoutes = routeNames.filter((r) => r !== "audit");
+        const result = processRoutes(files, selectedRoutes);
+        const router = result.get("work-router.yml");
+        expect(router).not.toContain("call-audit");
+        expect(router).not.toContain('cron: "17 1 * * 1"');
+        const classifier = result.get("classify-route.sh");
+        expect(classifier).not.toContain("readonly AUDIT_CRON");
+        expect(classifier).not.toContain('"$AUDIT_CRON")');
+    });
+    it("processes multiple excluded routes at once", () => {
+        const files = new Map([
+            ["work-router.yml", ROUTER_YAML],
+            ["classify-route.sh", CLASSIFIER_SH],
+            ["verify-route-matrix.sh", MATRIX_SH],
+        ]);
+        const selectedRoutes = ["refine", "implement"];
+        const result = processRoutes(files, selectedRoutes);
+        const router = result.get("work-router.yml");
+        expect(router).toContain("call-refine");
+        expect(router).toContain("call-implement");
+        expect(router).not.toContain("call-audit");
+        expect(router).not.toContain("call-propose");
+    });
+});
+describe("excludedWorkerFiles", () => {
+    it("returns worker files for unselected routes", () => {
+        const selectedRoutes = ["refine", "implement"];
+        const excluded = excludedWorkerFiles(selectedRoutes);
+        expect(excluded.has("agent-refine.md")).toBe(false);
+        expect(excluded.has("agent-implement.md")).toBe(false);
+        expect(excluded.has("agent-audit.md")).toBe(true);
+        expect(excluded.has("agent-propose.md")).toBe(true);
+    });
+    it("returns an empty set when all routes are selected", () => {
+        const excluded = excludedWorkerFiles([...routeNames]);
+        expect(excluded.size).toBe(0);
+    });
+});

package/dist/stack-defaults.d.ts

@@ -0,0 +1,11 @@
+import type { RepositoryInspection } from "./repository-inspection.js";
+export interface StackDefaults {
+    readonly verifyCommands: string;
+    readonly repoRulesBase: string;
+    readonly hasDotnet: boolean;
+    readonly hasNodeOnly: boolean;
+}
+export declare function generateStackDefaults(inspection: RepositoryInspection): StackDefaults;
+export declare function injectStackEnv(content: string, defaults: StackDefaults): string;
+export declare function generateOpencodeCi(baseContent: string, inspection: RepositoryInspection): string;
+export declare function generateOpencodeConfig(baseContent: string, inspection: RepositoryInspection): string;

package/dist/stack-defaults.js

@@ -0,0 +1,105 @@
+export function generateStackDefaults(inspection) {
+    const hasDotnet = inspection.stackHints.solutionFiles.length > 0;
+    const hasNode = inspection.stackHints.pnpmLockfile;
+    const hasNodeOnly = hasNode && !hasDotnet;
+    let verifyCommands;
+    let repoRulesBase;
+    if (hasDotnet && hasNode) {
+        verifyCommands = ".NET: dotnet restore && dotnet build -c Release && dotnet test | Web: pnpm lint && pnpm test && pnpm build";
+        repoRulesBase = "Full-stack .NET + React/Next.js repository. Follow Clean Architecture layering: API → Application → Domain. Infrastructure implements Application ports. Do not reference EF Core or ASP.NET from Application. Frontend communicates exclusively via HTTP endpoints. Run both .NET and frontend verification.";
+    }
+    else if (hasDotnet) {
+        verifyCommands = "dotnet restore && dotnet build -c Release --no-restore && dotnet test";
+        repoRulesBase = ".NET repository using Clean Architecture. Follow layering: API → Application → Domain. Infrastructure implements Application ports. Do not reference EF Core or ASP.NET from Application.";
+    }
+    else {
+        verifyCommands = "pnpm verify";
+        repoRulesBase = "Node.js repository. Follow existing project conventions and import boundaries.";
+    }
+    return { verifyCommands, repoRulesBase, hasDotnet, hasNodeOnly };
+}
+export function injectStackEnv(content, defaults) {
+    let result = content;
+    if (defaults.verifyCommands === "pnpm verify")
+        return result;
+    if (result.includes("VERIFY_COMMANDS:")) {
+        result = result.replace(/  VERIFY_COMMANDS: ".*"/, `  VERIFY_COMMANDS: "${defaults.verifyCommands}"`);
+    }
+    else if (/^env:\n/m.test(result)) {
+        result = result.replace(/^env:\n/m, `env:\n  VERIFY_COMMANDS: "${defaults.verifyCommands}"\n`);
+    }
+    return result;
+}
+export function generateOpencodeCi(baseContent, inspection) {
+    let result = baseContent;
+    if (inspection.stackHints.solutionFiles.length > 0) {
+        const nugetSteps = `  - name: Cache NuGet packages
+    uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+    with:
+      path: ~/.nuget/packages
+      key: nuget-\${{ runner.os }}-\${{ hashFiles('**/*.slnx', '**/Directory.Packages.props') }}
+      restore-keys: nuget-\${{ runner.os }}-
+
+  - name: Restore .NET dependencies
+    run: dotnet restore
+`;
+        result = insertBeforeMarker(result, nugetSteps, "  - name: Install workspace dependencies");
+    }
+    if (inspection.stackHints.openSpec) {
+        const openspecStep = `  - name: Install OpenSpec CLI
+    run: |
+      set -euo pipefail
+      npm install -g @openspec/cli@latest
+      openspec --version
+`;
+        result = insertBeforeMarker(result, openspecStep, "  - name: Install workspace dependencies");
+    }
+    if (inspection.stackHints.packageJson && !result.includes("--legacy-peer-deps")) {
+        result = result.replace(`      if ! npm install --prefix .opencode; then\n        echo "No plugin deps, skipping."\n        exit 0\n      fi`, `      if ! npm install --prefix .opencode; then\n        echo "::warning::Strict npm install failed on a peer conflict. Retrying with --legacy-peer-deps; check .opencode/package.json."\n        npm install --prefix .opencode --legacy-peer-deps\n      fi`);
+    }
+    return result;
+}
+function insertBeforeMarker(content, steps, marker) {
+    if (content.includes(marker)) {
+        return content.replace(marker, steps + marker);
+    }
+    return content + "\n" + steps;
+}
+export function generateOpencodeConfig(baseContent, inspection) {
+    try {
+        const config = JSON.parse(baseContent);
+        const hasDotnet = inspection.stackHints.solutionFiles.length > 0;
+        if (!hasDotnet && config.lsp !== undefined) {
+            delete config.lsp;
+        }
+        else if (hasDotnet && config.lsp === undefined) {
+            config.lsp = {
+                csharp: { disabled: true },
+                fsharp: { disabled: true },
+                razor: { disabled: true },
+            };
+        }
+        const agent = config.agent;
+        if (agent !== undefined) {
+            const agentEntry = agent["ci-workflow-agent"];
+            if (agentEntry !== undefined) {
+                let prompt = agentEntry.prompt ?? "";
+                if (hasDotnet) {
+                    if (!prompt.includes(".NET guardrails")) {
+                        prompt += "\n\n# .NET guardrails\nFollow Clean Architecture layering: API → Application → Domain. Infrastructure implements Application ports. Application must not reference EF Core or ASP.NET. Use Central Package Management (Directory.Packages.props). Build in Release mode for CI.";
+                    }
+                }
+                else {
+                    if (!prompt.includes("Node/React rules")) {
+                        prompt += "\n\n# Node/React rules\nFollow Feature-Sliced Design import boundaries. Use pnpm, never npm or yarn. All user-facing text must be i18n messages. TypeScript strict mode.";
+                    }
+                }
+                agentEntry.prompt = prompt;
+            }
+        }
+        return JSON.stringify(config, null, 2) + "\n";
+    }
+    catch {
+        return baseContent;
+    }
+}

package/dist/stack-defaults.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/stack-defaults.test.js

@@ -0,0 +1,257 @@
+import { describe, expect, it } from "vitest";
+import { generateOpencodeCi, generateOpencodeConfig, generateStackDefaults, injectStackEnv, } from "./stack-defaults.js";
+function makeInspection(overrides = {}) {
+    return {
+        repositoryPath: "/repo",
+        existingAgentWorkflows: [],
+        stackHints: {
+            packageJson: false,
+            pnpmLockfile: false,
+            solutionFiles: [],
+            openSpec: false,
+            ...overrides,
+        },
+    };
+}
+describe("generateStackDefaults", () => {
+    it("returns .NET verify commands when .slnx is found", () => {
+        const defaults = generateStackDefaults(makeInspection({
+            solutionFiles: ["app.slnx"],
+        }));
+        expect(defaults.verifyCommands).toBe("dotnet restore && dotnet build -c Release --no-restore && dotnet test");
+        expect(defaults.hasDotnet).toBe(true);
+        expect(defaults.hasNodeOnly).toBe(false);
+    });
+    it("returns pnpm verify when pnpm-lock.yaml is found without .slnx", () => {
+        const defaults = generateStackDefaults(makeInspection({
+            pnpmLockfile: true,
+        }));
+        expect(defaults.verifyCommands).toBe("pnpm verify");
+        expect(defaults.hasDotnet).toBe(false);
+        expect(defaults.hasNodeOnly).toBe(true);
+    });
+    it("returns both .NET and Web verify commands for a full-stack repo", () => {
+        const defaults = generateStackDefaults(makeInspection({
+            solutionFiles: ["app.slnx"],
+            pnpmLockfile: true,
+        }));
+        expect(defaults.verifyCommands).toContain(".NET");
+        expect(defaults.verifyCommands).toContain("dotnet restore");
+        expect(defaults.verifyCommands).toContain("dotnet build -c Release");
+        expect(defaults.verifyCommands).toContain("dotnet test");
+        expect(defaults.verifyCommands).toContain("Web");
+        expect(defaults.verifyCommands).toContain("pnpm lint");
+        expect(defaults.verifyCommands).toContain("pnpm test");
+        expect(defaults.verifyCommands).toContain("pnpm build");
+        expect(defaults.hasDotnet).toBe(true);
+        expect(defaults.hasNodeOnly).toBe(false);
+    });
+    it("returns pnpm verify when neither .slnx nor pnpm-lock.yaml is present", () => {
+        const defaults = generateStackDefaults(makeInspection());
+        expect(defaults.verifyCommands).toBe("pnpm verify");
+        expect(defaults.hasDotnet).toBe(false);
+        expect(defaults.hasNodeOnly).toBe(false);
+    });
+    it("includes a repo rules base string with architecture context", () => {
+        const dotnetDefaults = generateStackDefaults(makeInspection({
+            solutionFiles: ["app.slnx"],
+        }));
+        expect(dotnetDefaults.repoRulesBase).toContain("Clean Architecture");
+        const nodeDefaults = generateStackDefaults(makeInspection({
+            pnpmLockfile: true,
+        }));
+        expect(nodeDefaults.repoRulesBase).toContain("Node.js");
+    });
+});
+describe("injectStackEnv", () => {
+    it("injects VERIFY_COMMANDS into a worker that has an env block", () => {
+        const content = `---
+env:
+  REPO_RULES: "some rules"
+description: test
+---`;
+        const defaults = generateStackDefaults(makeInspection({
+            solutionFiles: ["app.slnx"],
+        }));
+        const result = injectStackEnv(content, defaults);
+        expect(result).toContain('VERIFY_COMMANDS: "dotnet restore && dotnet build -c Release --no-restore && dotnet test"');
+    });
+    it("does not inject when verifyCommands is pnpm verify (the default)", () => {
+        const content = `---
+env:
+  REPO_RULES: "some rules"
+---`;
+        const defaults = generateStackDefaults(makeInspection({
+            pnpmLockfile: true,
+        }));
+        const result = injectStackEnv(content, defaults);
+        expect(result).not.toContain("VERIFY_COMMANDS");
+    });
+});
+const OPENCODE_CI_MD = `---
+env:
+  AGENTMEMORY_VERSION: "0.9.28"
+  CODEGRAPH_VERSION: "1.5.0"
+description: Shared CI setup.
+
+pre-agent-steps:
+  - name: Install RTK
+    run: |
+      rtk --version
+      rtk init -g --opencode --auto-patch
+  - name: Install opencode plugin dependencies
+    run: |
+      set -euo pipefail
+      if [ ! -f .opencode/package.json ]; then
+        echo "No .opencode/package.json, nothing to install"
+        exit 0
+      fi
+  - name: Install workspace dependencies
+    run: pnpm install --frozen-lockfile
+  - name: Merge the CI-only OpenCode provider into opencode.jsonc
+    run: |
+      jq -e . "$FRAGMENT" > /dev/null
+---`;
+describe("generateOpencodeCi", () => {
+    it("adds NuGet cache and dotnet restore steps when .slnx is found", () => {
+        const result = generateOpencodeCi(OPENCODE_CI_MD, makeInspection({
+            solutionFiles: ["app.slnx"],
+        }));
+        expect(result).toContain("Cache NuGet packages");
+        expect(result).toContain("Restore .NET dependencies");
+        expect(result).toContain("dotnet restore");
+    });
+    it("adds OpenSpec CLI install step when openspec/ directory exists", () => {
+        const result = generateOpencodeCi(OPENCODE_CI_MD, makeInspection({
+            openSpec: true,
+        }));
+        expect(result).toContain("Install OpenSpec CLI");
+        expect(result).toContain("@openspec/cli");
+    });
+    it("adds both NuGet and OpenSpec steps when both are detected", () => {
+        const result = generateOpencodeCi(OPENCODE_CI_MD, makeInspection({
+            solutionFiles: ["app.slnx"],
+            openSpec: true,
+        }));
+        expect(result).toContain("Cache NuGet packages");
+        expect(result).toContain("Install OpenSpec CLI");
+    });
+    it("does not add NuGet steps when no .slnx is present", () => {
+        const result = generateOpencodeCi(OPENCODE_CI_MD, makeInspection({
+            pnpmLockfile: true,
+        }));
+        expect(result).not.toContain("Cache NuGet packages");
+        expect(result).not.toContain("Restore .NET dependencies");
+    });
+    it("preserves the original merge step", () => {
+        const result = generateOpencodeCi(OPENCODE_CI_MD, makeInspection({
+            solutionFiles: ["app.slnx"],
+            openSpec: true,
+        }));
+        expect(result).toContain("Merge the CI-only OpenCode provider");
+    });
+});
+const OPENCODE_CI_JSON = `{
+  "$schema": "https://opencode.ai/config.json",
+  "model": "plainconcepts/glm-5-2",
+  "plugin": [],
+  "default_agent": "ci-workflow-agent",
+  "agent": {
+    "ci-workflow-agent": {
+      "description": "Executes GitHub Agentic Workflow tasks in CI.",
+      "mode": "primary",
+      "prompt": "You execute the GitHub Agentic Workflow task in the user prompt."
+    }
+  },
+  "permission": {
+    "read": "allow"
+  },
+  "lsp": {
+    "csharp": {
+      "disabled": true
+    },
+    "fsharp": {
+      "disabled": true
+    },
+    "razor": {
+      "disabled": true
+    }
+  },
+  "provider": {
+    "plainconcepts": {
+      "api": "http://172.30.0.30:10000",
+      "options": {
+        "apiKey": "awf-openai-proxy"
+      },
+      "models": {
+        "glm-5-2": {
+          "name": "GLM 5.2"
+        },
+        "glm-5-1": {
+          "name": "GLM 5.1"
+        }
+      }
+    }
+  }
+}
+`;
+describe("generateOpencodeConfig", () => {
+    it("keeps LSP section when .slnx is present", () => {
+        const result = generateOpencodeConfig(OPENCODE_CI_JSON, makeInspection({
+            solutionFiles: ["app.slnx"],
+        }));
+        const parsed = JSON.parse(result);
+        expect(parsed.lsp).toBeDefined();
+        expect(parsed.lsp.csharp.disabled).toBe(true);
+        expect(parsed.lsp.fsharp.disabled).toBe(true);
+        expect(parsed.lsp.razor.disabled).toBe(true);
+    });
+    it("removes LSP section when no .slnx is present", () => {
+        const result = generateOpencodeConfig(OPENCODE_CI_JSON, makeInspection({
+            pnpmLockfile: true,
+        }));
+        const parsed = JSON.parse(result);
+        expect(parsed.lsp).toBeUndefined();
+    });
+    it("adds .NET guardrails to agent prompt when .slnx is present and prompt lacks them", () => {
+        const result = generateOpencodeConfig(OPENCODE_CI_JSON, makeInspection({
+            solutionFiles: ["app.slnx"],
+        }));
+        const parsed = JSON.parse(result);
+        expect(parsed.agent["ci-workflow-agent"].prompt).toContain(".NET guardrails");
+        expect(parsed.agent["ci-workflow-agent"].prompt).toContain("Clean Architecture");
+    });
+    it("adds Node/React rules to agent prompt when no .slnx", () => {
+        const result = generateOpencodeConfig(OPENCODE_CI_JSON, makeInspection({
+            pnpmLockfile: true,
+        }));
+        const parsed = JSON.parse(result);
+        expect(parsed.agent["ci-workflow-agent"].prompt).toContain("Node/React rules");
+        expect(parsed.agent["ci-workflow-agent"].prompt).toContain("Feature-Sliced Design");
+    });
+    it("preserves both models in the provider", () => {
+        const result = generateOpencodeConfig(OPENCODE_CI_JSON, makeInspection({
+            solutionFiles: ["app.slnx"],
+        }));
+        const parsed = JSON.parse(result);
+        expect(parsed.provider.plainconcepts.models["glm-5-2"]).toBeDefined();
+        expect(parsed.provider.plainconcepts.models["glm-5-1"]).toBeDefined();
+    });
+    it("preserves the plainconcepts provider and its API URL", () => {
+        const result = generateOpencodeConfig(OPENCODE_CI_JSON, makeInspection({
+            solutionFiles: ["app.slnx"],
+        }));
+        const parsed = JSON.parse(result);
+        expect(parsed.provider.plainconcepts.api).toBe("http://172.30.0.30:10000");
+        expect(parsed.provider.plainconcepts.options.apiKey).toBe("awf-openai-proxy");
+    });
+    it("does not add .NET guardrails twice when already present", () => {
+        const withGuardrails = OPENCODE_CI_JSON.replace('"You execute the GitHub Agentic Workflow task in the user prompt."', '"You execute the GitHub Agentic Workflow task in the user prompt.\\n\\n# .NET guardrails\\nFollow Clean Architecture."');
+        const result = generateOpencodeConfig(withGuardrails, makeInspection({
+            solutionFiles: ["app.slnx"],
+        }));
+        const parsed = JSON.parse(result);
+        const guardrailsCount = (parsed.agent["ci-workflow-agent"].prompt.match(/\.NET guardrails/g) ?? []).length;
+        expect(guardrailsCount).toBe(1);
+    });
+});

package/dist/tui.js

@@ -1,6 +1,8 @@
 import * as readline from "node:readline";
 import { formatCatalog, listCatalog } from "./catalog-listing.js";
 import { installCatalog, installMandatoryFiles, installTemplate, isTemplateName } from "./catalog-installation.js";
+import { inspectRepository } from "./repository-inspection.js";
+import { routeNames } from "./workflow-catalog.js";
 const ANSI = {
     clear: "\x1b[2J",
     home: "\x1b[H",
@@ -220,8 +222,16 @@ async function installSelected(state, repositoryPath, force) {
     const templates = items.filter((entry) => entry.kind === "template");
     const allConflicts = [];
     const allInstalled = [];
+    const selectedRouteNames = routes.length > 0
+        ? routes.map((entry) => entry.name).filter((name) => routeNames.includes(name))
+        : [...routeNames];
+    const inspection = await inspectRepository(repositoryPath);
     if (routes.length > 0) {
-        const result = await installCatalog(repositoryPath, { force });
+        const result = await installCatalog(repositoryPath, {
+            force,
+            selectedRoutes: selectedRouteNames,
+            inspection,
+        });
         allConflicts.push(...result.conflicts);
         allInstalled.push(...result.installed);
     }
@@ -233,7 +243,7 @@ async function installSelected(state, repositoryPath, force) {
     for (const template of templates) {
         if (!isTemplateName(template.name))
             continue;
-        const result = await installTemplate(repositoryPath, template.name, { force });
+        const result = await installTemplate(repositoryPath, template.name, { force, inspection });
         allConflicts.push(...result.conflicts);
         allInstalled.push(...result.installed);
     }

package/loops/workflows/shared/platform-defaults.md

@@ -1,7 +1,5 @@
 ---
 # Managed by @plainconceptsplatform/workflows. Source: loops/workflows/shared/platform-defaults.md. Update with `workflows update --force`; consumer edits may be overwritten.
-env:
-  VERIFY_COMMANDS: "pnpm verify"
 description: Shared network and safe-output defaults for catalog agent workflows.
 
 network:

package/loops/workflows/work-router.yml

@@ -312,6 +312,39 @@ jobs:
       BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
       BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
 
+  bot-approve:
+    needs: classify
+    if: >
+      needs.classify.outputs.route == 'bot-approve' &&
+        (github.actor == 'app/github-actions' || github.actor == 'platform-devbox[bot]')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      actions: write
+    steps:
+      - name: Approve pending workflow runs
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          BRANCH: ${{ github.head_ref }}
+        run: |
+          set -euo pipefail
+
+          mapfile -t run_ids < <(
+            gh api "repos/$REPO/actions/runs?status=action_required&branch=$BRANCH" \
+              --jq '.workflow_runs[].id'
+          )
+
+          if [ "${#run_ids[@]}" -eq 0 ]; then
+            echo "No runs awaiting approval on branch $BRANCH"
+            exit 0
+          fi
+
+          for run_id in "${run_ids[@]}"; do
+            echo "Approving run $run_id"
+            gh api "repos/$REPO/actions/runs/$run_id/approve" --method POST
+          done
+
   audit-close:
     needs: classify
     if: needs.classify.outputs.route == 'audit-close'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",