@plainconceptsplatform/workflows 0.4.20 → 0.4.28

package/dist/catalog-installation.js

@@ -277,7 +277,7 @@ function catalogTemplateMeta(template) {
     const entry = catalogTemplates.find((item) => item.name === template);
     if (entry === undefined)
         throw new Error(`Unknown template: ${template}`);
-    const directory = template.startsWith("opencode") ? "opencode" : template.startsWith("app-ci-") ? "ci" : template === "github-release" ? "release" : "agentics";
+    const directory = template.startsWith("opencode") ? "opencode" : template.startsWith("app-ci-") ? "ci" : template === "github-release" ? "release" : template === "visual-evidence" ? "visual-evidence" : "agentics";
     const isWorkflow = entry.file.endsWith(".yml");
     const target = template === "app-ci-dotnet-next"
         ? ".github/workflows/app-ci.yml"

package/dist/catalog-listing.test.js

@@ -16,7 +16,7 @@ describe("catalog listing", () => {
         const routeNames = entries.filter((entry) => entry.kind === "route").map((entry) => entry.name);
         const templateNames = entries.filter((entry) => entry.kind === "template").map((entry) => entry.name);
         expect(routeNames).toEqual(["refine", "implement", "direct", "apply-review", "merge-gate", "audit", "propose"]);
-        expect(templateNames).toEqual(["agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "github-release", "opencode.ci.json"]);
+        expect(templateNames).toEqual(["agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "github-release", "opencode.ci.json", "visual-evidence"]);
     });
     it("reports all entries as not installed in an empty repository", async () => {
         const repositoryPath = await createRepository({});

package/dist/index.js

@@ -2,7 +2,7 @@
 import { inspectRepository, parseVisibility, resolveVisibility } from "./repository-inspection.js";
 import { installCatalog, installTemplate, isTemplateName } from "./catalog-installation.js";
 import { formatCatalog, listCatalog, searchCatalog } from "./catalog-listing.js";
-import { routeNames } from "./workflow-catalog.js";
+import { routeNames, templateNames } from "./workflow-catalog.js";
 import { runInteractive } from "./tui.js";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -125,7 +125,7 @@ function readVisibilityOption(options) {
         return "invalid";
     return parseVisibility(options[1]) ?? "invalid";
 }
-const TEMPLATE_NAMES = "agentics-checks|agentics-maintenance|app-ci-dotnet-next|app-ci-node-monorepo|opencode.ci.json";
+const TEMPLATE_NAMES = templateNames.join("|");
 function parseAddOptions(options) {
     const routes = [];
     let template;

package/dist/index.test.js

@@ -34,7 +34,7 @@ describe("workflows CLI", () => {
     it("rejects an unsupported template name", async () => {
         const error = vi.spyOn(console, "error").mockImplementation(() => undefined);
         await expect(run(["add", "--template", "unknown"])).resolves.toBe(1);
-        expect(error).toHaveBeenCalledWith("--template must be one of: agentics-checks|agentics-maintenance|app-ci-dotnet-next|app-ci-node-monorepo|opencode.ci.json.");
+        expect(error).toHaveBeenCalledWith("--template must be one of: agentics-checks|agentics-maintenance|app-ci-dotnet-next|app-ci-node-monorepo|github-release|opencode.ci.json|visual-evidence.");
         error.mockRestore();
     });
     it("rejects an unknown route passed to add", async () => {
@@ -65,9 +65,9 @@ describe("workflows CLI", () => {
         // None installed: all [ ]
         const installedCount = (output.match(/\[x\]/g) ?? []).length;
         expect(installedCount).toBe(0);
-        // 7 routes + 6 templates = 13 entries
+        // 7 routes + 7 templates = 14 entries
         const uninstalledCount = (output.match(/\[ \]/g) ?? []).length;
-        expect(uninstalledCount).toBe(13);
+        expect(uninstalledCount).toBe(14);
         log.mockRestore();
     });
     it("marks installed workflows with [x]", async () => {

package/dist/workflow-catalog.d.ts

@@ -14,7 +14,7 @@ export interface MandatoryFile {
 }
 export declare const mandatoryFiles: readonly MandatoryFile[];
 export declare const generatedConsumerTargets: readonly [".github/workflows/agent-*.lock.yml", ".github/aw/actions-lock.json"];
-export declare const templateNames: readonly ["agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "github-release", "opencode.ci.json"];
+export declare const templateNames: readonly ["agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "github-release", "opencode.ci.json", "visual-evidence"];
 export type TemplateName = (typeof templateNames)[number];
 export interface CatalogTemplate {
     readonly name: TemplateName;

package/dist/workflow-catalog.js

@@ -40,6 +40,7 @@ export const templateNames = [
     "app-ci-node-monorepo",
     "github-release",
     "opencode.ci.json",
+    "visual-evidence",
 ];
 export const catalogTemplates = [
     { name: "agentics-checks", file: "agentics-checks.yml", description: "Agentics checks: verifies generated agent lockfiles, actionlint, and compile on PRs touching workflow files." },
@@ -48,4 +49,5 @@ export const catalogTemplates = [
     { name: "app-ci-node-monorepo", file: "app-ci-node-monorepo.yml", description: "App CI pipeline for a Node monorepo: build, test, and lint on PRs and schedule." },
     { name: "github-release", file: "github-release.yml", description: "Publishes or updates a GitHub Release with generated notes whenever a v* tag is pushed." },
     { name: "opencode.ci.json", file: "opencode.ci.json", description: "Standalone OpenCode CI config: plainconcepts provider, GLM model registration, ci-workflow-agent, and LSP defaults for consumer repositories." },
+    { name: "visual-evidence", file: "visual-evidence.yml", description: "Visual evidence: captures screenshots of UI changes on bot-authored PRs by reading the capturePlan left by the agent in evidence.json and executing it on a runner with Docker and Chrome access." },
 ];

package/dist/workflow-catalog.test.js

@@ -17,7 +17,7 @@ describe("workflow catalog", () => {
         }
     });
     it("lists supported optional templates", () => {
-        expect(templateNames).toEqual(["agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "github-release", "opencode.ci.json"]);
+        expect(templateNames).toEqual(["agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "github-release", "opencode.ci.json", "visual-evidence"]);
     });
     it("gives every catalog template a non-empty description and file", () => {
         expect(catalogTemplates.map((template) => template.name)).toEqual([...templateNames]);

package/loops/actions/agent-output.cjs

@@ -1,5 +1,5 @@
 // Managed by @plainconceptsplatform/workflows. Source: loops/actions/agent-output.cjs. Update with `workflows update --force`; consumer edits may be overwritten.
-const fs = require('fs');
+const fs = require('node:fs');
 
 // Every apply-agent-* action reads the same artifact the same way: a missing file means the
 // agent produced nothing, which is a normal outcome rather than a failure.

package/loops/actions/classify-route/classify-route.sh

@@ -37,7 +37,10 @@ classify_route() {
         case "${LABEL:-}" in
           bot-working)
             # Bot adds bot-working → route based on which work label is present
-            if has_label implement; then
+            # BUT: if review label is present, do NOT route (human review required)
+            if has_label review; then
+              error="issue has review label; bot-working does not re-trigger while human review is required"
+            elif has_label implement; then
               route="implement"
               issue_number="${EVENT_ISSUE_NUMBER:-}"
             elif has_label refine; then
@@ -63,6 +66,10 @@ classify_route() {
               elif [ "${LABEL:-}" = "direct" ]; then
                 direct_mode="first"
               fi
+            elif has_label bot-working; then
+              # Already has bot-working - the workflow is already running or queued.
+              # Don't re-trigger.
+              error="issue already has bot-working label; implement/refine/direct already in progress"
             else
               error="waiting for bot to add bot-working label"
             fi

package/loops/scripts/compile-agent-workflows.mjs

@@ -1,7 +1,7 @@
 // Managed by @plainconceptsplatform/workflows. Source: loops/scripts/compile-agent-workflows.mjs. Update with `workflows update --force`; consumer edits may be overwritten.
-import { spawnSync } from "node:child_process";
-import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { spawnSync } from "node:child_process";
+import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 
 const workflowDirectory = existsSync("loops/workflows") ? "loops/workflows" : ".github/workflows";
 
@@ -22,23 +22,26 @@ const compile = spawnSync(resolveGhPath(), ["aw", "compile", "--strict", "--dir"
   shell: false,
 });
 
-if (compile.error?.code === "ENOENT" || compile.status === null) {
+if (compile.error?.code === "ENOENT" || compile.status === null) {
   process.stderr.write("Could not run `gh aw compile`. Install githubnext/gh-aw first.\n");
   process.exit(1);
-}
-
-if (compile.status !== 0) process.exit(compile.status ?? 1);
-
-for (const file of readdirSync(workflowDirectory)) {
-  if (!file.endsWith(".lock.yml")) continue;
-
-  const path = join(workflowDirectory, file);
-  const content = readFileSync(path, "utf8");
-  const patched = content
-    .replaceAll("opencode run --print-logs --log-level DEBUG", "opencode run --log-level ERROR")
-    .replaceAll("opencode run --print-logs --log-level ERROR", "opencode run --log-level ERROR")
-    .replaceAll("--log-level DEBUG", "--log-level ERROR")
-    .replace(/GH_AW_INFO_MODEL_COSTS: '[^']*'/g, "GH_AW_INFO_MODEL_COSTS: '{\"providers\":{}}'");
-
-  if (patched !== content) writeFileSync(path, patched);
+}
+
+if (compile.status !== 0) process.exit(compile.status ?? 1);
+
+for (const file of readdirSync(workflowDirectory)) {
+  if (!file.endsWith(".lock.yml")) continue;
+
+  const path = join(workflowDirectory, file);
+  const content = readFileSync(path, "utf8");
+  const patched = content
+    .replaceAll("opencode run --print-logs --log-level DEBUG", "opencode run --port 4096 --log-level ERROR")
+    .replaceAll("opencode run --print-logs --log-level ERROR", "opencode run --port 4096 --log-level ERROR")
+    .replaceAll("opencode run --log-level ERROR", "opencode run --port 4096 --log-level ERROR")
+    .replaceAll("--log-level DEBUG", "--log-level ERROR")
+    .replace(/GH_AW_INFO_MODEL: "[^"]*"/g, 'GH_AW_INFO_MODEL: "per-agent"')
+    .replace(/OPENCODE_MODEL: [^\n]+/g, "OPENCODE_MODEL: ''")
+    .replace(/GH_AW_INFO_MODEL_COSTS: '[^']*'/g, 'GH_AW_INFO_MODEL_COSTS: \'{"providers":{}}\'');
+
+  if (patched !== content) writeFileSync(path, patched);
 }

package/loops/workflows/agent-implement.md

@@ -97,12 +97,6 @@ jobs:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ inputs.issue-number }}
           labels: ${{ env.REVIEW_LABEL }}
-      - name: Ensure implement label is present
-        uses: ./.github/actions/add-issue-labels
-        with:
-          token: ${{ steps.app-token.outputs.token }}
-          issue-number: ${{ inputs.issue-number }}
-          labels: ${{ env.IMPLEMENT_LABEL }}
   conclude:
     needs: [agent, safe_outputs]
     if: >
@@ -164,7 +158,7 @@ jobs:
         with:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ inputs.issue-number }}
-          labels: ${{ env.WORKING_LABEL }}
+          labels: ${{ env.WORKING_LABEL }},implement
       - name: Flag for human review
         uses: ./.github/actions/add-issue-labels
         with:
@@ -250,18 +244,29 @@ timeout-minutes: 90
       `ob-ops-evidence`) and owns its procedure. You must not skip a phase unless the
       pipeline's refined-issue detection says to.
 
-   d. The `apply` phase uses `ob-plan-apply` which delegates implementation to specialist
-      subagent waves. Let it own worker resolution, concurrency, and retry , do not
-      implement the tasks yourself unless `ob-plan-apply` instructs you to.
+    d. The `apply` phase uses `ob-plan-apply` which delegates implementation to specialist
+       subagent waves. Let it own worker resolution, concurrency, and retry , do not
+       implement the tasks yourself unless `ob-plan-apply` instructs you to.
+
+    e. **Evidence phase:** The agent sandbox cannot run Docker or headless Chromium.
+       `ob-ops-evidence` writes a `capturePlan` in `evidence.json` instead of capturing
+       screenshots. A separate "Visual evidence" CI workflow runs the capturePlan on a
+       runner with full access. Do not attempt workarounds — write the capturePlan and move on.
 
-   e. Implement only what the issue asks for: a vague sentence is not licence to redesign
-      a module. Never read outside this repository root. The issue context at
-      `${{ env.ISSUE_CONTEXT_PATH }}` defines acceptance criteria that the pipeline must
-      satisfy.
+    f. Implement only what the issue asks for: a vague sentence is not licence to redesign
+       a module. Never read outside this repository root. The issue context at
+       `${{ env.ISSUE_CONTEXT_PATH }}` defines acceptance criteria that the pipeline must
+       satisfy.
 
-   f. Follow repository documentation and established conventions. Keep changes focused,
-      protect secrets, do not bypass checks, and do not modify generated files unless the issue requires it.
-      Adhere to ${{ env.REPO_RULES }}.
+    g. Follow repository documentation and established conventions. Keep changes focused,
+       protect secrets, do not bypass checks, and do not modify generated files unless the issue requires it.
+       Adhere to ${{ env.REPO_RULES }}.
+
+    h. **DECISIVE IMPLEMENTATION.** When a design choice is ambiguous, pick the most
+      standard interpretation and implement it immediately. Do not deliberate between
+      options for more than one turn. Do not ask clarifying questions — the issue author
+      expects you to use good judgment. If two approaches are equally valid, pick one and
+      proceed. You can always iterate based on PR feedback.
 
 4. Verify before you conclude. From the repository root:
 
@@ -269,10 +274,19 @@ timeout-minutes: 90
      ${{ env.VERIFY_COMMANDS }}
      ```
 
-    If a check fails, fix the cause and rerun. Do not weaken a test, lower a threshold, or skip
-    a check to make it pass.
+     If a check fails, fix the cause and rerun. Do not weaken a test, lower a threshold, or skip
+     a check to make it pass.
+
+  5. Before creating the pull request, update `changelog.json` in the project's
+     `src/shared/data/` folder (create `src/shared/data/changelog.json` if it does not
+     exist; in a monorepo use `apps/web/src/shared/data/changelog.json`). The file
+     has shape `{"version":1,"changes":[...]}`. Use `jq` to prepend a new entry
+     with `"timestamp"` (ISO 8601), `"issue"` (number), `"title"` (issue title),
+     `"summary"` (1-2 sentences of what you changed), and `"commit"` (short SHA).
+     Keep at most 10 entries: if there are already 10, drop the oldest. Commit
+     this file as part of the same branch before creating the PR.
 
- 5. You **must** call exactly one safe-output tool before finishing, or the workflow
+  6. You **must** call exactly one safe-output tool before finishing, or the workflow
     reports a failure. All safe-output tools are on the `safeoutputs` MCP server. Call
     them using the `safeoutputs/<tool>` convention , for example:
 

package/loops/workflows/authorize-bot-work.yml

@@ -5,6 +5,8 @@
 # it adds bot-working itself, so authorize-bot-work must not fire again.
 name: "Authorize Bot Work"
 
+run-name: "Authorizing: ${{ github.event.issue.title }} (#${{ github.event.issue.number }})"
+
 on:
   issues:
     types: [labeled]

package/loops/workflows/shared/opencode-ci.md

@@ -11,7 +11,7 @@ description: |
 
   Consumer-specific steps (NuGet, .NET restore, OpenSpec, etc.) should be added after the
   shared baseline in the consumer copy. The merge step below is package-owned and required
-  for the agent to resolve the `plainconcepts` provider and its models.
+  for the agent to resolve its provider and its models.
 
 # Consumer repositories should add stack-specific steps (NuGet cache, dotnet restore,
 # OpenSpec, Playwright, etc.) after the shared baseline. The merge step at the end is
@@ -21,15 +21,51 @@ pre-agent-steps:
   - name: Create agent scratch directory
     run: mkdir -p .opencode/.tmp
 
+  - name: Start OpenCode server (persistent warm server for faster agent runs)
+    run: |
+      set -euo pipefail
+
+      OPENCODE_PORT=4096
+      mkdir -p /tmp/opencode-data /tmp/gh-aw
+
+      # Check if server is already running
+      if curl -sf "http://127.0.0.1:${OPENCODE_PORT}/health" >/dev/null 2>&1; then
+        echo "OpenCode server already running on port ${OPENCODE_PORT}"
+        exit 0
+      fi
+
+      echo "Starting OpenCode server on port ${OPENCODE_PORT}..."
+      export XDG_DATA_HOME=/tmp/opencode-data
+      nohup opencode serve --port "${OPENCODE_PORT}" --hostname 127.0.0.1 \
+        > /tmp/gh-aw/opencode-server.log 2>&1 &
+
+      SERVER_PID=$!
+      echo "Server PID: ${SERVER_PID}"
+
+      # Wait for server to be ready (max 30 seconds)
+      for i in $(seq 1 30); do
+        if curl -sf "http://127.0.0.1:${OPENCODE_PORT}/health" >/dev/null 2>&1; then
+          echo "OpenCode server is ready on port ${OPENCODE_PORT}"
+          exit 0
+        fi
+        sleep 1
+      done
+
+      # Server didn't start in time - continue without it (agent will cold-start)
+      echo "::warning::OpenCode server did not start in 30s, agent will run without warm server"
+      kill "${SERVER_PID}" 2>/dev/null || true
+
   - name: Install ripgrep
     run: |
       set -euo pipefail
 
-      if ! command -v rg > /dev/null; then
-        sudo apt-get update
-        sudo apt-get install --yes ripgrep
+      if command -v rg > /dev/null 2>&1; then
+        echo "ripgrep already installed: $(rg --version | head -1)"
+        exit 0
       fi
 
+      sudo apt-get update
+      sudo apt-get install --yes ripgrep
       rg --version
 
   - name: Activate the pnpm version package.json pins
@@ -50,6 +86,11 @@ pre-agent-steps:
     run: |
       set -euo pipefail
 
+      if command -v rtk > /dev/null 2>&1 && rtk --version 2>/dev/null | grep -q "${RTK_VERSION}"; then
+        echo "RTK ${RTK_VERSION} already installed"
+        exit 0
+      fi
+
       tarball="$RUNNER_TEMP/rtk.tar.gz"
       curl -fsSL -o "$tarball" \
         "https://github.com/rtk-ai/rtk/releases/download/v${RTK_VERSION}/rtk-x86_64-unknown-linux-musl.tar.gz"
@@ -64,6 +105,12 @@ pre-agent-steps:
   - name: Install agentmemory
     run: |
       set -euo pipefail
+
+      if command -v agentmemory > /dev/null 2>&1 && agentmemory --version 2>/dev/null | grep -q "${AGENTMEMORY_VERSION}"; then
+        echo "agentmemory ${AGENTMEMORY_VERSION} already installed"
+        exit 0
+      fi
+
       npm install -g "@agentmemory/agentmemory@${AGENTMEMORY_VERSION}"
       agentmemory --version
 
@@ -71,26 +118,42 @@ pre-agent-steps:
     continue-on-error: true
     run: |
       set -euo pipefail
-      npm install -g "@colbymchenry/codegraph@${CODEGRAPH_VERSION}"
+
+      if command -v codegraph > /dev/null 2>&1 && codegraph --version 2>/dev/null | grep -q "${CODEGRAPH_VERSION}"; then
+        echo "codegraph ${CODEGRAPH_VERSION} already installed"
+      else
+        npm install -g "@colbymchenry/codegraph@${CODEGRAPH_VERSION}"
+      fi
+
       codegraph init
 
-  - name: Install opencode plugin dependencies
+  - name: Install OpenSpec CLI
     run: |
       set -euo pipefail
 
-      if [ ! -f .opencode/package.json ]; then
-        echo "No .opencode/package.json, nothing to install"
+      if command -v openspec > /dev/null 2>&1 && openspec --version 2>/dev/null | grep -q "1.8.0"; then
+        echo "openspec 1.8.0 already installed"
         exit 0
       fi
 
-      # These plugins are optional tooling for the agent, not something the task
-      # depends on, so a transitive peer conflict between two of them must not
-      # take down every audit, propose and implement run. Strict first, so a real
-      # incompatibility is still visible in the log.
-      if ! npm install --prefix .opencode; then
-        echo "::warning::Strict npm install failed on a peer conflict. Retrying with --legacy-peer-deps; check .opencode/package.json."
-        npm install --prefix .opencode --legacy-peer-deps
-      fi
+      npm install -g "@fission-ai/openspec@1.8.0"
+      openspec --version
+
+  # NOTE: playwright-cli and SQL Server startup steps have been removed from the
+  # shared CI baseline. Visual evidence capture now runs in a separate "Visual
+  # evidence" workflow that executes on the raw runner (not inside the awf
+  # sandbox), where Docker and headless Chromium are available. The agent's
+  # /ops-evidence skill writes a capturePlan in evidence.json when blocked;
+  # the Visual Evidence workflow reads and executes it. If you need playwright-cli
+  # or SQL Server inside the agent sandbox for other reasons, add them as
+  # consumer-specific steps after the shared baseline.
+
+  - name: Cache NuGet packages
+    uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+    with:
+      path: ~/.nuget/packages
+      key: nuget-${{ runner.os }}-${{ hashFiles('**/*.slnx', '**/Directory.Packages.props') }}
+      restore-keys: nuget-${{ runner.os }}-
 
   - name: Install workspace dependencies
     run: pnpm install --frozen-lockfile

package/loops/workflows/work-router.yml

@@ -9,6 +9,21 @@ name: "All Work Router"
 # describe the trigger but not the route the classifier picks.
 run-name: >-
   ${{ github.event_name == 'issues'
+  && github.event.label.name == 'bot-working'
+  && contains(github.event.issue.labels.*.name, 'implement')
+  && format('Working (Implement): {0} (#{1})', github.event.issue.title, github.event.issue.number)
+  || github.event_name == 'issues'
+  && github.event.label.name == 'bot-working'
+  && contains(github.event.issue.labels.*.name, 'refine')
+  && format('Working (Refine): {0} (#{1})', github.event.issue.title, github.event.issue.number)
+  || github.event_name == 'issues'
+  && github.event.label.name == 'bot-working'
+  && contains(github.event.issue.labels.*.name, 'direct')
+  && format('Working (Direct): {0} (#{1})', github.event.issue.title, github.event.issue.number)
+  || github.event_name == 'issues'
+  && github.event.label.name == 'bot-working'
+  && format('Working: {0} (#{1})', github.event.issue.title, github.event.issue.number)
+  || github.event_name == 'issues'
   && format('{0} label on #{1} by {2}', github.event.label.name, github.event.issue.number, github.actor)
   || github.event_name == 'issue_comment'
   && format('comment on #{0} by {1}', github.event.issue.number, github.actor)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.4.20",
+  "version": "0.4.28",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",