@plainconceptsplatform/workflows 0.28.5 → 0.28.7

package/loops/actions/collect-app-errors/group-and-redact.mjs

@@ -32,6 +32,9 @@ export const FINDING_FIELDS = [
   "firstSeen",
   "lastSeen",
   "frames",
+  "topFrames",
+  "message",
+  "category",
   "fingerprint",
 ];
 
@@ -112,6 +115,16 @@ export function ownFrames(details, prefix) {
     .slice(0, MAX_FRAMES);
 }
 
+export function topFrames(details) {
+  const stacks = (Array.isArray(details) ? details : []).flatMap((detail) =>
+    Array.isArray(detail?.parsedStack) ? detail.parsedStack : []);
+
+  return stacks
+    .filter((frame) => typeof frame?.method === "string")
+    .map((frame) => clip(frame.method))
+    .slice(0, MAX_FRAMES);
+}
+
 /** Masks everything in SCRUBS. Applied to every string before it is rendered or scanned. */
 export function scrub(value) {
   return SCRUBS.reduce((text, [pattern, replacement]) => text.replace(pattern, replacement), value);
@@ -162,6 +175,9 @@ export function toFindings(rows, { environment, ownCodePrefix = "", minOccurrenc
       firstSeen: clip(row.FirstSeen),
       lastSeen: clip(row.LastSeen),
       frames: ownFrames(row.AnyDetails, ownCodePrefix),
+      topFrames: topFrames(row.AnyDetails),
+      message: clip(row.AnyMessage),
+      category: clip(row.AnyCategory),
       fingerprint: fingerprint(clip(row.ProblemId), clip(row.OperationName), environment),
     }))
     .filter((finding) => finding.occurrences >= minOccurrences && finding.operations >= minOperations)
@@ -177,34 +193,41 @@ export function toFindings(rows, { environment, ownCodePrefix = "", minOccurrenc
  */
 export function render(finding, { environment, lookbackHours, ownCodePrefix = "" }) {
   const marker = `<!-- pcp-app-error: ${finding.fingerprint} -->`;
-  const title = `${finding.exceptionType} in ${finding.operationName || finding.roleName || environment}`;
+  const title = `${finding.exceptionType} in ${finding.operationName || finding.category || finding.roleName || environment}`;
 
   const body = [
     marker,
     `**${finding.occurrences} occurrence(s)** in the last ${lookbackHours}h in \`${environment}\`, across ${finding.operations} operation(s).`,
     "",
     `- Exception: \`${finding.exceptionType}\``,
+    finding.message ? `- Message: \`${finding.message}\`` : null,
     `- Operation: \`${finding.operationName || "(none recorded)"}\``,
+    finding.category ? `- Source: \`${finding.category}\`` : null,
     `- Role: \`${finding.roleName || "(none recorded)"}\``,
     `- First seen: ${finding.firstSeen}`,
     `- Last seen: ${finding.lastSeen}`,
     finding.frames.length > 0
       ? `\n**Our own frames, outermost first**\n\n\`\`\`\n${finding.frames.join("\n")}\n\`\`\``
-      : ownCodePrefix
-        // The prefix is set and nothing matched: every frame belongs to the framework or to a
-        // dependency. Routine for an exception raised inside framework code -- a cancelled task
-        // is the common one -- and nothing for the reader to go and configure.
-        ? `\n_No frame in this exception belongs to \`${clip(ownCodePrefix)}\`: all of them are the framework's or a dependency's. That is usual for an exception thrown inside framework code, such as a cancelled task._`
-        // No prefix, so no frame can be recognised as this repository's own and the
-        // stack is dropped rather than publishing somebody else's file paths.
-        : "\n_No stack frames are shown: this repository has not said which assemblies are its own. Set `OWN_CODE_PREFIX` in the workflow to name them._",
+      : finding.topFrames.length > 0
+        ? ownCodePrefix
+          // The prefix is set and nothing matched: every frame belongs to the framework or to a
+          // dependency. Show the top frames anyway, because a framework stack is still better
+          // than nothing when the exception is something like a cancelled task raised inside
+          // framework code.
+          ? `\n_No frame in this exception belongs to \`${clip(ownCodePrefix)}\`: all of them are the framework's or a dependency's._\n\n**Top stack frames, outermost first**\n\n\`\`\`\n${finding.topFrames.join("\n")}\n\`\`\``
+          : `\n**Top stack frames, outermost first**\n\n\`\`\`\n${finding.topFrames.join("\n")}\n\`\`\``
+        : ownCodePrefix
+          ? `\n_No frame in this exception belongs to \`${clip(ownCodePrefix)}\`: all of them are the framework's or a dependency's. That is usual for an exception thrown inside framework code, such as a cancelled task._`
+          // No prefix, so no frame can be recognised as this repository's own and the
+          // stack is dropped rather than publishing somebody else's file paths.
+          : "\n_No stack frames are shown: this repository has not said which assemblies are its own. Set `OWN_CODE_PREFIX` in the workflow to name them._",
     "",
     "---",
     "",
     "Filed automatically from Application Insights. Nothing here was read by a model, and no",
     "identifier that joins back to a person is included, so the reproduction is still somebody's",
     "to work out. Close this with the `error-accepted` label to stop it being filed again.",
-  ].join("\n");
+  ].filter(Boolean).join("\n");
 
   return { title, body, marker };
 }

package/loops/actions/collect-app-errors/query-app-errors.sh

@@ -47,20 +47,25 @@ let window = ago(${LOOKBACK_HOURS}h);
 let thrown =
     AppExceptions
     | where TimeGenerated > window
-    | extend Problem = ProblemId, Kind = ExceptionType, Stack = Details;
+    | extend Problem = ProblemId, Kind = ExceptionType, Stack = Details,
+             Msg = outerMessage, Category = "";
 let logged =
     AppTraces
     | where TimeGenerated > window
     | where SeverityLevel >= 3
     | extend Problem = tostring(coalesce(Properties["OriginalFormat"], Message)),
              Kind    = tostring(coalesce(Properties["ExceptionType"], "LoggedError")),
-             Stack   = dynamic([]);
+             Stack   = dynamic([]),
+             Msg     = Message,
+             Category = tostring(coalesce(Properties["SourceContext"], Properties["Category"], ""));
 union thrown, logged
 | summarize Occurrences = sum(ItemCount),
             Operations  = dcount(OperationName),
             FirstSeen   = min(TimeGenerated),
             LastSeen    = max(TimeGenerated),
-            AnyDetails  = any(Stack)
+            AnyDetails  = any(Stack),
+            AnyMessage  = any(Msg),
+            AnyCategory = any(Category)
     by ProblemId = Problem, ExceptionType = Kind, OperationName, AppRoleName
 | where Occurrences >= ${MIN_OCCURRENCES}
 | order by Occurrences desc

package/loops/actions/verify-app-errors/verify-app-errors.mjs

@@ -14,6 +14,7 @@ import {
   fingerprint,
   leaks,
   ownFrames,
+  topFrames,
   prepare,
   render,
   scrub,
@@ -49,6 +50,8 @@ function row(overrides = {}) {
     Operations: 3,
     FirstSeen: "2026-09-13T01:10:00Z",
     LastSeen: "2026-09-13T06:40:00Z",
+    AnyMessage: "Sequence contains no elements",
+    AnyCategory: "Pliny.Application.Agents.RunExecutor",
     AnyOperationId: "6f1c1b0e9a2f4d55",
     AnyDetails: [
       {
@@ -113,6 +116,16 @@ check(
 
 check("a row with no details does not throw", ownFrames(undefined, "Pliny").length === 0);
 
+check(
+  "topFrames returns frames without prefix filter",
+  topFrames(row().AnyDetails).length >= 1);
+
+check(
+  "topFrames includes framework methods",
+  topFrames(row().AnyDetails).includes("Microsoft.AspNetCore.Routing.EndpointMiddleware.Invoke"));
+
+check("topFrames empty when no details", topFrames(undefined).length === 0);
+
 section("Fingerprints");
 
 check(
@@ -158,6 +171,16 @@ check(
   "run_id is not a reportable field",
   !FINDING_FIELDS.includes("runId") && !FINDING_FIELDS.includes("run_id"));
 
+check(
+  "new fields are in the allowlist",
+  FINDING_FIELDS.includes("message") && FINDING_FIELDS.includes("category") && FINDING_FIELDS.includes("topFrames"));
+
+check(
+  "toFindings maps the new fields",
+  toFindings([row()], options)[0].message === "Sequence contains no elements" &&
+  toFindings([row()], options)[0].category === "Pliny.Application.Agents.RunExecutor" &&
+  toFindings([row()], options)[0].topFrames.length >= 1);
+
 section("Rendering and the scanner");
 
 const rendered = render(toFindings([row()], options)[0], options);
@@ -175,13 +198,18 @@ check(
   "no build-machine path reaches the body",
   !rendered.body.includes("/home/vsts"));
 
-// Two ways to have no frames, and they ask the reader for different things. Pliny-Bot #191 was
+// Two ways to have no own frames, and they ask the reader for different things. Pliny-Bot #191 was
 // filed with OWN_CODE_PREFIX set to "Pliny" and still said the repository had not said which
 // assemblies were its own -- it sent a reader to configure a knob that had been set the day
 // before. Only the unconfigured case was covered here, which is why the wording survived.
 check(
-  "no prefix configured says which knob to set",
+  "no prefix configured but top frames exist shows top frames",
   render(toFindings([row()], { ...options, ownCodePrefix: "" })[0], { ...options, ownCodePrefix: "" })
+    .body.includes("Top stack frames"));
+
+check(
+  "no prefix configured and no frames at all says which knob to set",
+  render(toFindings([row({ AnyDetails: [] })], { ...options, ownCodePrefix: "" })[0], { ...options, ownCodePrefix: "" })
     .body.includes("has not said which assemblies are its own"));
 
 check(
@@ -194,6 +222,28 @@ check(
   render(toFindings([row()], { ...options, ownCodePrefix: "NoSuchAssembly" })[0], { ...options, ownCodePrefix: "NoSuchAssembly" })
     .body.includes("No frame in this exception belongs to `NoSuchAssembly`"));
 
+check("body includes the message", rendered.body.includes("Message: `Sequence contains no elements`"));
+
+check("body includes the source", rendered.body.includes("Source: `Pliny.Application.Agents.RunExecutor`"));
+
+check(
+  "title uses category as fallback",
+  render(toFindings([row({ OperationName: "" })], options)[0], options).title ===
+    "System.InvalidOperationException in Pliny.Application.Agents.RunExecutor");
+
+check("body shows own frames when available", rendered.body.includes("Our own frames"));
+
+check(
+  "body shows top frames when no own frames",
+  render(toFindings([row({
+    ProblemId: "System.Threading.Tasks.TaskCanceledException",
+    ExceptionType: "System.Threading.Tasks.TaskCanceledException",
+    AnyDetails: [{ parsedStack: [{ method: "System.Net.Http.HttpClient.SendAsync" }] }],
+    AnyMessage: "A task was canceled.",
+  })], { ...options, ownCodePrefix: "Pliny" })[0],
+  { ...options, ownCodePrefix: "Pliny" })
+  .body.includes("Top stack frames"));
+
 section("Fail-closed, but not fail-dead");
 
 const mixed = prepare(

package/loops/workflows/agent-apply-review.md

@@ -408,6 +408,12 @@ max-ai-credits: 5000
 
 permissions: read-all
 
+# push-to-pull-request-branch with target "*" cannot reach a branch the shallow clone
+# does not have. Fetch full history so the agent can merge on conflict without rewriting.
+checkout:
+  fetch: ["*"]
+  fetch-depth: 0
+
 # Rung 3. A reviewer often makes one point across several comments, so the agent needs the
 # whole conversation, not just the one that triggered it. Fetching all of it is deterministic.
 steps:
@@ -459,6 +465,7 @@ safe-outputs:
   # with "requires pull request context", so the agent's fix is computed and discarded.
   push-to-pull-request-branch:
     target: "*"
+    max-patch-size: 10240
   add-comment:
     target: "*"
 
@@ -481,6 +488,12 @@ timeout-minutes: 90
    It has already been confirmed that this pull request is open, that we authored it, and that
    the reviewer has write access. Do not re-check any of that.
 
+   You are on the pull request branch. Never rebase, reset, amend or otherwise rewrite
+   history: the workflow applies your commits as a bundle with a fast-forward-only push and
+   discards anything that is not a descendant of the branch tip. The
+   `push_to_pull_request_branch` tool's own description recommends rebasing; in this
+   repository that advice is wrong. Merge, commit, and let the workflow push.
+
 2. Read `${{ env.ISSUE_CONTEXT_PATH }}`. It contains the issue body and discussion this pull
    request closes. The acceptance criteria there define what the implementation must still
    satisfy after the feedback is applied.

package/loops/workflows/agent-merge-gate.md

@@ -807,6 +807,7 @@ safe-outputs:
   push-to-pull-request-branch:
     target: "*"
     required-title-prefix: "[bot] "
+    max-patch-size: 10240
     # A failed bot PR may already contain protected files. Permit a verified repair push,
     # but protected_changes still prevents the later green-CI cycle from auto-merging it.
     protected-files: allowed

package/loops/workflows/agent-refine.md

@@ -310,7 +310,13 @@ jobs:
           issue-number: ${{ inputs.issue-number }}
   conclude:
     needs: [activation, agent, safe_outputs, validate_output]
+    # `always()` is load-bearing: without it GitHub prepends `success()`, which returns false
+    # if any needed job was skipped. If activation was skipped (Pliny-Bot #321: refuse_big_issue
+    # skip-poisoned activation in v0.28.0), both conclude AND incomplete skipped and the refine
+    # label never transitioned. The explicit conditions below are still the guard; `always()`
+    # just prevents a skipped need from short-circuiting the whole expression.
     if: >
+      always() &&
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success' &&
       needs.validate_output.outputs.valid == 'true'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.28.5",
+  "version": "0.28.7",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",
@@ -25,13 +25,6 @@
     "loops",
     "README.md"
   ],
-  "scripts": {
-    "build": "tsc --project tsconfig.build.json && node ./scripts/copy-loops.mjs",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit --project tsconfig.json",
-    "release": "pnpm build && pnpm test && npm publish --access public",
-    "prepack": "node ./scripts/copy-loops.mjs"
-  },
   "engines": {
     "node": ">=20.19"
   },
@@ -42,5 +35,11 @@
     "@types/node": "^22.0.0",
     "typescript": "^5.8.0",
     "vitest": "^3.0.0"
+  },
+  "scripts": {
+    "build": "tsc --project tsconfig.build.json && node ./scripts/copy-loops.mjs",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit --project tsconfig.json",
+    "release": "pnpm build && pnpm test && npm publish --access public"
   }
-}
+}