@plainconceptsplatform/workflows 0.28.4 → 0.28.6

package/loops/actions/attach-screenshots/action.yml

@@ -66,19 +66,14 @@ runs:
           done
 
           if [ ${#attaches[@]} -gt 0 ]; then
-            gh issue comment "$ISSUE" --repo "$REPO" \
-              --body "attach" \
-              "${attaches[@]/#/--attach=}" \
-              --body-file - <<< "$body" 2>/dev/null || \
-            {
-              # Fallback: gh CLI does not support --body-file with --attach in all versions.
-              # Post the body as the comment and attach each screenshot individually.
-              gh issue comment "$ISSUE" --repo "$REPO" --body "$body"
-              for png in "${attaches[@]}"; do
-                gh issue comment "$ISSUE" --repo "$REPO" --attach "$png" --body ""
-              done
-            }
-            echo "Attached ${#attaches[@]} screenshots to issue #$ISSUE"
+            # --body-file with --attach is not supported by every gh version; --body with a
+            # here-string is, and one comment per screenshot loses the narrative. Post the
+            # body first, then attach each file to that same comment so the story stays whole.
+            comment_url=$(gh issue comment "$ISSUE" --repo "$REPO" --body "$body" --json url --jq '.url')
+            for png in "${attaches[@]}"; do
+              gh issue comment "$ISSUE" --repo "$REPO" --attach "$png" --body "" 2>/dev/null || true
+            done
+            echo "Attached ${#attaches[@]} screenshots to issue #$ISSUE ($comment_url)"
           else
             gh issue comment "$ISSUE" --repo "$REPO" --body "$body"
             echo "No screenshots found; posted plan summary only"

package/loops/workflows/agent-apply-review.md

@@ -408,6 +408,12 @@ max-ai-credits: 5000
 
 permissions: read-all
 
+# push-to-pull-request-branch with target "*" cannot reach a branch the shallow clone
+# does not have. Fetch full history so the agent can merge on conflict without rewriting.
+checkout:
+  fetch: ["*"]
+  fetch-depth: 0
+
 # Rung 3. A reviewer often makes one point across several comments, so the agent needs the
 # whole conversation, not just the one that triggered it. Fetching all of it is deterministic.
 steps:
@@ -459,6 +465,7 @@ safe-outputs:
   # with "requires pull request context", so the agent's fix is computed and discarded.
   push-to-pull-request-branch:
     target: "*"
+    max-patch-size: 10240
   add-comment:
     target: "*"
 
@@ -481,6 +488,12 @@ timeout-minutes: 90
    It has already been confirmed that this pull request is open, that we authored it, and that
    the reviewer has write access. Do not re-check any of that.
 
+   You are on the pull request branch. Never rebase, reset, amend or otherwise rewrite
+   history: the workflow applies your commits as a bundle with a fast-forward-only push and
+   discards anything that is not a descendant of the branch tip. The
+   `push_to_pull_request_branch` tool's own description recommends rebasing; in this
+   repository that advice is wrong. Merge, commit, and let the workflow push.
+
 2. Read `${{ env.ISSUE_CONTEXT_PATH }}`. It contains the issue body and discussion this pull
    request closes. The acceptance criteria there define what the implementation must still
    satisfy after the feedback is applied.

package/loops/workflows/agent-merge-gate.md

@@ -807,6 +807,7 @@ safe-outputs:
   push-to-pull-request-branch:
     target: "*"
     required-title-prefix: "[bot] "
+    max-patch-size: 10240
     # A failed bot PR may already contain protected files. Permit a verified repair push,
     # but protected_changes still prevents the later green-CI cycle from auto-merging it.
     protected-files: allowed

package/loops/workflows/agent-refine.md

@@ -310,7 +310,13 @@ jobs:
           issue-number: ${{ inputs.issue-number }}
   conclude:
     needs: [activation, agent, safe_outputs, validate_output]
+    # `always()` is load-bearing: without it GitHub prepends `success()`, which returns false
+    # if any needed job was skipped. If activation was skipped (Pliny-Bot #321: refuse_big_issue
+    # skip-poisoned activation in v0.28.0), both conclude AND incomplete skipped and the refine
+    # label never transitioned. The explicit conditions below are still the guard; `always()`
+    # just prevents a skipped need from short-circuiting the whole expression.
     if: >
+      always() &&
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success' &&
       needs.validate_output.outputs.valid == 'true'

package/loops/workflows/agent-visual-verify.md

@@ -132,7 +132,8 @@ steps:
       output-path: ${{ env.ISSUE_CONTEXT_PATH }}
 
 safe-outputs:
-  staged: true
+  # Never staged: staged mode only previews writes ("Would add comment"), so the run goes
+  # green and the issue never hears anything. The audit worker learned this the same way.
   report-failure-as-issue: false
   threat-detection: false
   add-comment:
@@ -149,6 +150,9 @@ post-steps:
       # @anthropic-ai/agent-browser does not exist on npm and 404s the install, which
       # took down the agent job on the first run that ever reached this step.
       npm install -g "agent-browser@${{ env.AGENT_BROWSER_VERSION }}"
+      # The npm package alone cannot drive a browser: the Chromium binary is a separate
+      # download, and a self-hosted Linux runner needs the system dependencies too.
+      agent-browser install --with-deps
       agent-browser --version
 
   - name: Build and start the app
@@ -199,11 +203,37 @@ post-steps:
       fi
       waypoint_count=$(jq -r '.waypoints | length' "$PLAN_FILE")
       echo "Found $waypoint_count waypoints"
-      echo "captured=true" >> "$GITHUB_OUTPUT"
-      echo "screenshot_count=$waypoint_count" >> "$GITHUB_OUTPUT"
+      captured=0
+      i=0
+      while [ "$i" -lt "$waypoint_count" ]; do
+        i=$((i + 1))
+        url=$(jq -r ".waypoints[$((i - 1))].url" "$PLAN_FILE")
+        selector=$(jq -r ".waypoints[$((i - 1))].selector // empty" "$PLAN_FILE")
+        echo "Waypoint $i/$waypoint_count: $url (waiting for: ${selector:-nothing})"
+        # A failing waypoint must not lose the screenshots already taken: the count is
+        # reported and the run stays green, because evidence is what this worker produces.
+        if ! agent-browser open "http://localhost:$PORT$url"; then
+          echo "::warning::waypoint $i: could not open $url; skipping"
+          continue
+        fi
+        if [ -n "$selector" ]; then
+          agent-browser wait "$selector" || echo "::warning::waypoint $i: selector $selector did not appear; screenshotting anyway"
+        fi
+        agent-browser wait --load networkidle || true
+        if agent-browser screenshot "$OUTPUT_DIR/waypoint-$i.png" --full; then
+          captured=$((captured + 1))
+        else
+          echo "::warning::waypoint $i: screenshot failed"
+        fi
+      done
+      echo "captured=$([ "$captured" -gt 0 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+      echo "screenshot_count=$captured" >> "$GITHUB_OUTPUT"
 
+  # The attach action reads the screenshots directory; on no capture it explains that
+  # instead (app never started, no plan, or every waypoint failed). `always()` because it
+  # must run even when the capture step above warned its way to the end.
   - name: Attach screenshots to the issue
-    if: always() && steps.subject.outputs.found == 'true'
+    if: always() && needs.subject.outputs.found == 'true' && needs.subject.outputs.enabled == 'true'
     uses: ./.github/actions/attach-screenshots
     with:
       token: ${{ github.token }}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.28.4",
+  "version": "0.28.6",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",
@@ -25,13 +25,6 @@
     "loops",
     "README.md"
   ],
-  "scripts": {
-    "build": "tsc --project tsconfig.build.json && node ./scripts/copy-loops.mjs",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit --project tsconfig.json",
-    "release": "pnpm build && pnpm test && npm publish --access public",
-    "prepack": "node ./scripts/copy-loops.mjs"
-  },
   "engines": {
     "node": ">=20.19"
   },
@@ -42,5 +35,11 @@
     "@types/node": "^22.0.0",
     "typescript": "^5.8.0",
     "vitest": "^3.0.0"
+  },
+  "scripts": {
+    "build": "tsc --project tsconfig.build.json && node ./scripts/copy-loops.mjs",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit --project tsconfig.json",
+    "release": "pnpm build && pnpm test && npm publish --access public"
   }
-}
+}