@plainconceptsplatform/workflows 0.28.6 → 0.28.9

package/loops/actions/collect-app-errors/group-and-redact.mjs

@@ -32,6 +32,9 @@ export const FINDING_FIELDS = [
   "firstSeen",
   "lastSeen",
   "frames",
+  "topFrames",
+  "message",
+  "category",
   "fingerprint",
 ];
 
@@ -112,6 +115,16 @@ export function ownFrames(details, prefix) {
     .slice(0, MAX_FRAMES);
 }
 
+export function topFrames(details) {
+  const stacks = (Array.isArray(details) ? details : []).flatMap((detail) =>
+    Array.isArray(detail?.parsedStack) ? detail.parsedStack : []);
+
+  return stacks
+    .filter((frame) => typeof frame?.method === "string")
+    .map((frame) => clip(frame.method))
+    .slice(0, MAX_FRAMES);
+}
+
 /** Masks everything in SCRUBS. Applied to every string before it is rendered or scanned. */
 export function scrub(value) {
   return SCRUBS.reduce((text, [pattern, replacement]) => text.replace(pattern, replacement), value);
@@ -162,6 +175,9 @@ export function toFindings(rows, { environment, ownCodePrefix = "", minOccurrenc
       firstSeen: clip(row.FirstSeen),
       lastSeen: clip(row.LastSeen),
       frames: ownFrames(row.AnyDetails, ownCodePrefix),
+      topFrames: topFrames(row.AnyDetails),
+      message: clip(row.AnyMessage),
+      category: clip(row.AnyCategory),
       fingerprint: fingerprint(clip(row.ProblemId), clip(row.OperationName), environment),
     }))
     .filter((finding) => finding.occurrences >= minOccurrences && finding.operations >= minOperations)
@@ -177,34 +193,41 @@ export function toFindings(rows, { environment, ownCodePrefix = "", minOccurrenc
  */
 export function render(finding, { environment, lookbackHours, ownCodePrefix = "" }) {
   const marker = `<!-- pcp-app-error: ${finding.fingerprint} -->`;
-  const title = `${finding.exceptionType} in ${finding.operationName || finding.roleName || environment}`;
+  const title = `${finding.exceptionType} in ${finding.operationName || finding.category || finding.roleName || environment}`;
 
   const body = [
     marker,
     `**${finding.occurrences} occurrence(s)** in the last ${lookbackHours}h in \`${environment}\`, across ${finding.operations} operation(s).`,
     "",
     `- Exception: \`${finding.exceptionType}\``,
+    finding.message ? `- Message: \`${finding.message}\`` : null,
     `- Operation: \`${finding.operationName || "(none recorded)"}\``,
+    finding.category ? `- Source: \`${finding.category}\`` : null,
     `- Role: \`${finding.roleName || "(none recorded)"}\``,
     `- First seen: ${finding.firstSeen}`,
     `- Last seen: ${finding.lastSeen}`,
     finding.frames.length > 0
       ? `\n**Our own frames, outermost first**\n\n\`\`\`\n${finding.frames.join("\n")}\n\`\`\``
-      : ownCodePrefix
-        // The prefix is set and nothing matched: every frame belongs to the framework or to a
-        // dependency. Routine for an exception raised inside framework code -- a cancelled task
-        // is the common one -- and nothing for the reader to go and configure.
-        ? `\n_No frame in this exception belongs to \`${clip(ownCodePrefix)}\`: all of them are the framework's or a dependency's. That is usual for an exception thrown inside framework code, such as a cancelled task._`
-        // No prefix, so no frame can be recognised as this repository's own and the
-        // stack is dropped rather than publishing somebody else's file paths.
-        : "\n_No stack frames are shown: this repository has not said which assemblies are its own. Set `OWN_CODE_PREFIX` in the workflow to name them._",
+      : finding.topFrames.length > 0
+        ? ownCodePrefix
+          // The prefix is set and nothing matched: every frame belongs to the framework or to a
+          // dependency. Show the top frames anyway, because a framework stack is still better
+          // than nothing when the exception is something like a cancelled task raised inside
+          // framework code.
+          ? `\n_No frame in this exception belongs to \`${clip(ownCodePrefix)}\`: all of them are the framework's or a dependency's._\n\n**Top stack frames, outermost first**\n\n\`\`\`\n${finding.topFrames.join("\n")}\n\`\`\``
+          : `\n**Top stack frames, outermost first**\n\n\`\`\`\n${finding.topFrames.join("\n")}\n\`\`\``
+        : ownCodePrefix
+          ? `\n_No frame in this exception belongs to \`${clip(ownCodePrefix)}\`: all of them are the framework's or a dependency's. That is usual for an exception thrown inside framework code, such as a cancelled task._`
+          // No prefix, so no frame can be recognised as this repository's own and the
+          // stack is dropped rather than publishing somebody else's file paths.
+          : "\n_No stack frames are shown: this repository has not said which assemblies are its own. Set `OWN_CODE_PREFIX` in the workflow to name them._",
     "",
     "---",
     "",
     "Filed automatically from Application Insights. Nothing here was read by a model, and no",
     "identifier that joins back to a person is included, so the reproduction is still somebody's",
     "to work out. Close this with the `error-accepted` label to stop it being filed again.",
-  ].join("\n");
+  ].filter(Boolean).join("\n");
 
   return { title, body, marker };
 }

package/loops/actions/collect-app-errors/query-app-errors.sh

@@ -47,20 +47,25 @@ let window = ago(${LOOKBACK_HOURS}h);
 let thrown =
     AppExceptions
     | where TimeGenerated > window
-    | extend Problem = ProblemId, Kind = ExceptionType, Stack = Details;
+    | extend Problem = ProblemId, Kind = ExceptionType, Stack = Details,
+             Msg = outerMessage, Category = "";
 let logged =
     AppTraces
     | where TimeGenerated > window
     | where SeverityLevel >= 3
     | extend Problem = tostring(coalesce(Properties["OriginalFormat"], Message)),
              Kind    = tostring(coalesce(Properties["ExceptionType"], "LoggedError")),
-             Stack   = dynamic([]);
+             Stack   = dynamic([]),
+             Msg     = Message,
+             Category = tostring(coalesce(Properties["SourceContext"], Properties["Category"], ""));
 union thrown, logged
 | summarize Occurrences = sum(ItemCount),
             Operations  = dcount(OperationName),
             FirstSeen   = min(TimeGenerated),
             LastSeen    = max(TimeGenerated),
-            AnyDetails  = any(Stack)
+            AnyDetails  = any(Stack),
+            AnyMessage  = any(Msg),
+            AnyCategory = any(Category)
     by ProblemId = Problem, ExceptionType = Kind, OperationName, AppRoleName
 | where Occurrences >= ${MIN_OCCURRENCES}
 | order by Occurrences desc

package/loops/actions/verify-app-errors/verify-app-errors.mjs

@@ -14,6 +14,7 @@ import {
   fingerprint,
   leaks,
   ownFrames,
+  topFrames,
   prepare,
   render,
   scrub,
@@ -49,6 +50,8 @@ function row(overrides = {}) {
     Operations: 3,
     FirstSeen: "2026-09-13T01:10:00Z",
     LastSeen: "2026-09-13T06:40:00Z",
+    AnyMessage: "Sequence contains no elements",
+    AnyCategory: "Pliny.Application.Agents.RunExecutor",
     AnyOperationId: "6f1c1b0e9a2f4d55",
     AnyDetails: [
       {
@@ -113,6 +116,16 @@ check(
 
 check("a row with no details does not throw", ownFrames(undefined, "Pliny").length === 0);
 
+check(
+  "topFrames returns frames without prefix filter",
+  topFrames(row().AnyDetails).length >= 1);
+
+check(
+  "topFrames includes framework methods",
+  topFrames(row().AnyDetails).includes("Microsoft.AspNetCore.Routing.EndpointMiddleware.Invoke"));
+
+check("topFrames empty when no details", topFrames(undefined).length === 0);
+
 section("Fingerprints");
 
 check(
@@ -158,6 +171,16 @@ check(
   "run_id is not a reportable field",
   !FINDING_FIELDS.includes("runId") && !FINDING_FIELDS.includes("run_id"));
 
+check(
+  "new fields are in the allowlist",
+  FINDING_FIELDS.includes("message") && FINDING_FIELDS.includes("category") && FINDING_FIELDS.includes("topFrames"));
+
+check(
+  "toFindings maps the new fields",
+  toFindings([row()], options)[0].message === "Sequence contains no elements" &&
+  toFindings([row()], options)[0].category === "Pliny.Application.Agents.RunExecutor" &&
+  toFindings([row()], options)[0].topFrames.length >= 1);
+
 section("Rendering and the scanner");
 
 const rendered = render(toFindings([row()], options)[0], options);
@@ -175,13 +198,18 @@ check(
   "no build-machine path reaches the body",
   !rendered.body.includes("/home/vsts"));
 
-// Two ways to have no frames, and they ask the reader for different things. Pliny-Bot #191 was
+// Two ways to have no own frames, and they ask the reader for different things. Pliny-Bot #191 was
 // filed with OWN_CODE_PREFIX set to "Pliny" and still said the repository had not said which
 // assemblies were its own -- it sent a reader to configure a knob that had been set the day
 // before. Only the unconfigured case was covered here, which is why the wording survived.
 check(
-  "no prefix configured says which knob to set",
+  "no prefix configured but top frames exist shows top frames",
   render(toFindings([row()], { ...options, ownCodePrefix: "" })[0], { ...options, ownCodePrefix: "" })
+    .body.includes("Top stack frames"));
+
+check(
+  "no prefix configured and no frames at all says which knob to set",
+  render(toFindings([row({ AnyDetails: [] })], { ...options, ownCodePrefix: "" })[0], { ...options, ownCodePrefix: "" })
     .body.includes("has not said which assemblies are its own"));
 
 check(
@@ -194,6 +222,28 @@ check(
   render(toFindings([row()], { ...options, ownCodePrefix: "NoSuchAssembly" })[0], { ...options, ownCodePrefix: "NoSuchAssembly" })
     .body.includes("No frame in this exception belongs to `NoSuchAssembly`"));
 
+check("body includes the message", rendered.body.includes("Message: `Sequence contains no elements`"));
+
+check("body includes the source", rendered.body.includes("Source: `Pliny.Application.Agents.RunExecutor`"));
+
+check(
+  "title uses category as fallback",
+  render(toFindings([row({ OperationName: "" })], options)[0], options).title ===
+    "System.InvalidOperationException in Pliny.Application.Agents.RunExecutor");
+
+check("body shows own frames when available", rendered.body.includes("Our own frames"));
+
+check(
+  "body shows top frames when no own frames",
+  render(toFindings([row({
+    ProblemId: "System.Threading.Tasks.TaskCanceledException",
+    ExceptionType: "System.Threading.Tasks.TaskCanceledException",
+    AnyDetails: [{ parsedStack: [{ method: "System.Net.Http.HttpClient.SendAsync" }] }],
+    AnyMessage: "A task was canceled.",
+  })], { ...options, ownCodePrefix: "Pliny" })[0],
+  { ...options, ownCodePrefix: "Pliny" })
+  .body.includes("Top stack frames"));
+
 section("Fail-closed, but not fail-dead");
 
 const mixed = prepare(

package/loops/workflows/agent-visual-verify.md

@@ -152,6 +152,17 @@ post-steps:
       npm install -g "agent-browser@${{ env.AGENT_BROWSER_VERSION }}"
       # The npm package alone cannot drive a browser: the Chromium binary is a separate
       # download, and a self-hosted Linux runner needs the system dependencies too.
+      # --with-deps is agent-browser's best effort but misses libraries on ubuntu-24.04.
+      chrome_dir=$(agent-browser path 2>/dev/null | grep -oE '/[^ ]+chrome[^ ]*' | head -1 || true)
+      if [ -n "$chrome_dir" ] && [ -d "$(dirname "$chrome_dir")/.." ]; then
+        ldd "$chrome_dir" 2>/dev/null | grep "not found" || true
+      fi
+      # Install the known missing Chromium dependencies on Debian/ubuntu runners.
+      # agent-browser install --with-deps may leave these out depending on the runner image.
+      sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends \
+        libnss3 libatk1.0-0 libatk-bridge2.0-0 libdrm2 libgbm1 \
+        libasound2t64 libxkbcommon0 libcairo2 libpango-1.0-0 libxcomposite1 \
+        libxdamage1 libxfixes3 libxrandr2 2>/dev/null || true
       agent-browser install --with-deps
       agent-browser --version
 
@@ -205,6 +216,9 @@ post-steps:
       echo "Found $waypoint_count waypoints"
       captured=0
       i=0
+      # agent-browser uses Chromium which needs --no-sandbox on CI runners where
+      # there is no SYS_ADMIN capability. Set it once via the config file.
+      export AGENT_BROWSER_ARGS="${AGENT_BROWSER_ARGS:-} --no-sandbox"
       while [ "$i" -lt "$waypoint_count" ]; do
         i=$((i + 1))
         url=$(jq -r ".waypoints[$((i - 1))].url" "$PLAN_FILE")
@@ -224,6 +238,10 @@ post-steps:
           captured=$((captured + 1))
         else
           echo "::warning::waypoint $i: screenshot failed"
+          # Diagnostic: show what's in the output dir and any browser errors
+          ls -la "$OUTPUT_DIR/" 2>/dev/null || true
+          echo "--- agent-browser debug ---"
+          agent-browser screenshot "$OUTPUT_DIR/debug-$i.png" --full 2>&1 || true
         fi
       done
       echo "captured=$([ "$captured" -gt 0 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
@@ -233,7 +251,7 @@ post-steps:
   # instead (app never started, no plan, or every waypoint failed). `always()` because it
   # must run even when the capture step above warned its way to the end.
   - name: Attach screenshots to the issue
-    if: always() && needs.subject.outputs.found == 'true' && needs.subject.outputs.enabled == 'true'
+    if: always() && env.VISUAL_VERIFY_ENABLED == 'true' && env.VISUAL_VERIFY_START_COMMAND != ''
     uses: ./.github/actions/attach-screenshots
     with:
       token: ${{ github.token }}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.28.6",
+  "version": "0.28.9",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",