@plainconceptsplatform/workflows 0.5.1 → 0.6.1

package/dist/repository-inspection.d.ts

@@ -0,0 +1,23 @@
+export type RepositoryVisibility = "public" | "private";
+export type VisibilitySource = "argument" | "environment" | "github" | "fallback";
+export interface StackHints {
+    readonly packageJson: boolean;
+    readonly pnpmLockfile: boolean;
+    readonly solutionFiles: readonly string[];
+    readonly openSpec: boolean;
+}
+export interface RepositoryInspection {
+    readonly repositoryPath: string;
+    readonly existingAgentWorkflows: readonly string[];
+    readonly stackHints: StackHints;
+}
+export interface VisibilityResolution {
+    readonly value: RepositoryVisibility;
+    readonly source: VisibilitySource;
+}
+export interface CommandRunner {
+    readonly run: (command: string, arguments_: readonly string[], cwd: string) => Promise<string>;
+}
+export declare function inspectRepository(repositoryPath: string): Promise<RepositoryInspection>;
+export declare function resolveVisibility(repositoryPath: string, override: RepositoryVisibility | undefined, environment?: NodeJS.ProcessEnv, commandRunner?: CommandRunner): Promise<VisibilityResolution>;
+export declare function parseVisibility(value: string | undefined): RepositoryVisibility | undefined;

package/dist/repository-inspection.js

@@ -0,0 +1,113 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { access, readdir, stat } from "node:fs/promises";
+import { constants } from "node:fs";
+import { join } from "node:path";
+const execFileAsync = promisify(execFile);
+const defaultCommandRunner = {
+    async run(command, arguments_, cwd) {
+        const { stdout } = await execFileAsync(command, arguments_, { cwd, windowsHide: true });
+        return stdout;
+    },
+};
+export async function inspectRepository(repositoryPath) {
+    const workflowsPath = join(repositoryPath, ".github", "workflows");
+    const workflowEntries = await readDirectoryNames(workflowsPath);
+    const solutionFiles = await findSolutionFiles(repositoryPath);
+    return {
+        repositoryPath,
+        existingAgentWorkflows: workflowEntries.filter((entry) => /^agent-.*\.md$/i.test(entry)).sort(),
+        stackHints: {
+            packageJson: await pathExists(join(repositoryPath, "package.json")),
+            pnpmLockfile: await pathExists(join(repositoryPath, "pnpm-lock.yaml")),
+            solutionFiles,
+            openSpec: await isDirectory(join(repositoryPath, "openspec")),
+        },
+    };
+}
+export async function resolveVisibility(repositoryPath, override, environment = process.env, commandRunner = defaultCommandRunner) {
+    if (override !== undefined)
+        return { value: override, source: "argument" };
+    const environmentOverride = parseVisibility(environment.PLATFORM_WORKFLOWS_VISIBILITY);
+    if (environmentOverride !== undefined)
+        return { value: environmentOverride, source: "environment" };
+    try {
+        const output = await commandRunner.run("gh", ["repo", "view", "--json", "visibility"], repositoryPath);
+        const visibility = parseVisibilityFromGitHub(output);
+        if (visibility !== undefined)
+            return { value: visibility, source: "github" };
+    }
+    catch {
+        // GitHub CLI is optional. Initializing a local repository must still work offline.
+    }
+    return { value: "private", source: "fallback" };
+}
+export function parseVisibility(value) {
+    return value === "public" || value === "private" ? value : undefined;
+}
+async function findSolutionFiles(repositoryPath) {
+    const results = [];
+    await scanForSlnx(repositoryPath, "", results, 0);
+    return results.sort();
+}
+const MAX_DEPTH = 5;
+const SKIP_DIRS = new Set(["node_modules", ".git", ".next", "dist", "out", "build", ".turbo", ".cache"]);
+async function scanForSlnx(root, relativePath, results, depth) {
+    if (depth >= MAX_DEPTH)
+        return;
+    const currentPath = join(root, relativePath);
+    let entries;
+    try {
+        entries = await readdir(currentPath, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (entry.isDirectory()) {
+            if (SKIP_DIRS.has(entry.name))
+                continue;
+            await scanForSlnx(root, join(relativePath, entry.name), results, depth + 1);
+        }
+        else if (entry.isFile() && entry.name.endsWith(".slnx")) {
+            results.push(relativePath === "" ? entry.name : join(relativePath, entry.name));
+        }
+    }
+}
+async function pathExists(path) {
+    try {
+        await access(path, constants.F_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function isDirectory(path) {
+    try {
+        return (await stat(path)).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+async function readDirectoryNames(path) {
+    try {
+        return await readdir(path);
+    }
+    catch {
+        return [];
+    }
+}
+function parseVisibilityFromGitHub(output) {
+    try {
+        const parsed = JSON.parse(output);
+        if (typeof parsed !== "object" || parsed === null || !("visibility" in parsed))
+            return undefined;
+        const { visibility } = parsed;
+        return typeof visibility === "string" ? parseVisibility(visibility.toLowerCase()) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/repository-inspection.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/repository-inspection.test.js

@@ -0,0 +1,77 @@
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { inspectRepository, resolveVisibility } from "./repository-inspection.js";
+import { run } from "./index.js";
+const temporaryDirectories = [];
+afterEach(async () => {
+    await Promise.all(temporaryDirectories.splice(0).map((directory) => rm(directory, { force: true, recursive: true })));
+});
+describe("repository inspection", () => {
+    it("finds agent workflows and supported stack markers", async () => {
+        const repositoryPath = await createRepository({
+            ".github/workflows/agent-refine.md": "# Refine",
+            ".github/workflows/agent-custom.md": "# Custom",
+            ".github/workflows/other.md": "# Other",
+            "package.json": "{}",
+            "pnpm-lock.yaml": "lockfileVersion: '9.0'",
+            "apps/api/Contoso.slnx": "<Solution />",
+            "openspec/changes/.gitkeep": "",
+        });
+        await expect(inspectRepository(repositoryPath)).resolves.toMatchObject({
+            existingAgentWorkflows: ["agent-custom.md", "agent-refine.md"],
+            stackHints: {
+                packageJson: true,
+                pnpmLockfile: true,
+                solutionFiles: [join("apps", "api", "Contoso.slnx")],
+                openSpec: true,
+            },
+        });
+    });
+    it("uses an explicit visibility before environment or GitHub", async () => {
+        const runner = { run: async () => '{"visibility":"public"}' };
+        await expect(resolveVisibility("repo", "private", { PLATFORM_WORKFLOWS_VISIBILITY: "public" }, runner)).resolves.toEqual({
+            value: "private",
+            source: "argument",
+        });
+    });
+    it("falls back to private when GitHub CLI is unavailable", async () => {
+        const runner = { run: async () => Promise.reject(new Error("missing gh")) };
+        await expect(resolveVisibility("repo", undefined, {}, runner)).resolves.toEqual({ value: "private", source: "fallback" });
+    });
+});
+describe("CLI commands", () => {
+    it("keeps init available without writing configuration", async () => {
+        const repositoryPath = await createRepository({ "package.json": "{}" });
+        const output = captureConsole("log");
+        await expect(run(["init", "--visibility", "public"], repositoryPath)).resolves.toBe(0);
+        expect(output.calls).toHaveLength(1);
+        await expect(import("node:fs/promises").then(({ access }) => access(join(repositoryPath, ".github/workflows/shared/repo-config.md")))).rejects.toThrow();
+        output.restore();
+    });
+    it("accepts update as an add alias", async () => {
+        const repositoryPath = await createRepository({});
+        const error = captureConsole("error");
+        await expect(run(["update", "--invalid"], repositoryPath)).resolves.toBe(1);
+        expect(error.calls).toEqual(["Unknown option: --invalid"]);
+        error.restore();
+    });
+});
+function captureConsole(method) {
+    const original = console[method];
+    const calls = [];
+    console[method] = (message) => calls.push(message);
+    return { calls, restore: () => { console[method] = original; } };
+}
+async function createRepository(files) {
+    const repositoryPath = await mkdtemp(join(tmpdir(), "workflows-"));
+    temporaryDirectories.push(repositoryPath);
+    await Promise.all(Object.entries(files).map(async ([relativePath, content]) => {
+        const path = join(repositoryPath, relativePath);
+        const { mkdir } = await import("node:fs/promises");
+        await mkdir(join(path, ".."), { recursive: true });
+        await writeFile(path, content, "utf8");
+    }));
+    return repositoryPath;
+}

package/dist/route-processing.d.ts

@@ -0,0 +1,6 @@
+import { type RouteName } from "./workflow-catalog.js";
+export declare function stripRouteFromRouter(yaml: string, route: RouteName): string;
+export declare function stripRouteFromClassifier(shell: string, route: RouteName): string;
+export declare function addRouteExclusion(matrix: string, route: RouteName): string;
+export declare function processRoutes(files: Map<string, string>, selectedRoutes: readonly RouteName[]): Map<string, string>;
+export declare function excludedWorkerFiles(selectedRoutes: readonly RouteName[]): Set<string>;

package/dist/route-processing.js

@@ -0,0 +1,149 @@
+import { routeNames, workflowRoutes } from "./workflow-catalog.js";
+const routeCrons = {
+    audit: "17 1 * * 1",
+};
+export function stripRouteFromRouter(yaml, route) {
+    let result = yaml;
+    const cron = routeCrons[route];
+    if (cron !== undefined) {
+        result = result.replace(new RegExp(`^    - cron: "${escapeRegex(cron)}"\\n`, "gm"), "");
+    }
+    result = removeJobBlock(result, `call-${route}`);
+    result = result.replace(new RegExp(`^          - ${escapeRegex(route)}\\n`, "gm"), "");
+    return result;
+}
+export function stripRouteFromClassifier(shell, route) {
+    const constName = route.replace(/-/g, "_").toUpperCase() + "_CRON";
+    let result = shell;
+    result = result.replace(new RegExp(`^readonly ${constName}="[^"]*"\\n`, "gm"), "");
+    const cron = routeCrons[route];
+    if (cron !== undefined) {
+        result = result.replace(new RegExp(`\\s*"\\$${constName}"\\) route="${escapeRegex(route)}" ;;\\n`, "g"), "");
+    }
+    result = result.replace(new RegExp(` \\| ${escapeRegex(route)}\\)`, "g"), ")");
+    result = result.replace(new RegExp(`^(\\s+)${escapeRegex(route)} \\| `, "gm"), "$1");
+    if (!result.includes(`| ${route}`) && !result.includes(`${route} |`)) {
+        result = removeAloneDispatchCase(result, route);
+    }
+    return result;
+}
+function removeAloneDispatchCase(shell, route) {
+    const lines = shell.split("\n");
+    const pattern = new RegExp(`^(\\s+)${escapeRegex(route)}\\)\\s*$`);
+    const result = [];
+    let i = 0;
+    while (i < lines.length) {
+        const match = lines[i].match(pattern);
+        if (match) {
+            const indent = match[1];
+            i++;
+            while (i < lines.length) {
+                if (new RegExp(`^${escapeRegex(indent)};;\\s*$`).test(lines[i])) {
+                    i++;
+                    break;
+                }
+                i++;
+            }
+        }
+        else {
+            result.push(lines[i]);
+            i++;
+        }
+    }
+    return result.join("\n");
+}
+export function addRouteExclusion(matrix, route) {
+    if (matrix.includes(`excluded route '${route}'`))
+        return matrix;
+    let result = matrix;
+    result = result.replace(new RegExp(` ${escapeRegex(route)} `, "g"), " ");
+    const exclusionBlock = `\necho "── Excluded routes ──────────────────────────────────────────────────────"\nif ! grep -q "route == '${route}'" "$ROUTER_YML"; then\n  PASS=$((PASS + 1))\n  echo "  ${route} correctly excluded from work-router.yml"\nelse\n  FAIL=$((FAIL + 1))\n  echo "FAIL: excluded route '${route}' is still in work-router.yml" >&2\nfi\n`;
+    result = result.replace(/(\necho\nif \[ "\$FAIL" -eq 0 \])/, `${exclusionBlock}$1`);
+    return result;
+}
+export function processRoutes(files, selectedRoutes) {
+    const excludedRoutes = routeNames.filter((r) => !selectedRoutes.includes(r));
+    if (excludedRoutes.length === 0)
+        return files;
+    const result = new Map(files);
+    for (const route of excludedRoutes) {
+        const routerKey = findFileKey(result, "work-router.yml");
+        if (routerKey !== undefined) {
+            result.set(routerKey, stripRouteFromRouter(result.get(routerKey), route));
+        }
+        const matrixKey = findFileKey(result, "verify-route-matrix.sh");
+        if (matrixKey !== undefined) {
+            result.set(matrixKey, addRouteExclusion(result.get(matrixKey), route));
+        }
+    }
+    const matrixKey = findFileKey(result, "verify-route-matrix.sh");
+    if (matrixKey !== undefined) {
+        result.set(matrixKey, createRouteMatrix(selectedRoutes));
+    }
+    return result;
+}
+function createRouteMatrix(selectedRoutes) {
+    const selected = selectedRoutes.join(" ");
+    const excluded = routeNames.filter((route) => !selectedRoutes.includes(route)).join(" ");
+    return `#!/usr/bin/env bash
+set -euo pipefail
+
+HERE="$(cd "$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
+ROUTER_YML="\${HERE}/../../workflows/work-router.yml"
+CLASSIFIER="\${HERE}/../classify-route/classify-route.sh"
+
+bash -n "$CLASSIFIER"
+
+for route in ${selected}; do
+  grep -q "route == '$route'" "$ROUTER_YML" || {
+    echo "FAIL: selected route '$route' has no router job" >&2
+    exit 1
+  }
+done
+
+for route in ${excluded}; do
+  if grep -q "route == '$route'" "$ROUTER_YML"; then
+    echo "FAIL: excluded route '$route' remains in router" >&2
+    exit 1
+  fi
+done
+
+echo "Route matrix: selected routes valid"
+`;
+}
+export function excludedWorkerFiles(selectedRoutes) {
+    return new Set(workflowRoutes
+        .filter((route) => !selectedRoutes.includes(route.name))
+        .map((route) => route.worker));
+}
+function removeJobBlock(yaml, jobName) {
+    const lines = yaml.split("\n");
+    const startPattern = new RegExp(`^  ${escapeRegex(jobName)}:`);
+    const result = [];
+    let skipping = false;
+    for (const line of lines) {
+        if (skipping) {
+            if (/^  \S/.test(line) || /^[^\s]/.test(line)) {
+                skipping = false;
+                result.push(line);
+            }
+        }
+        else if (startPattern.test(line)) {
+            skipping = true;
+        }
+        else {
+            result.push(line);
+        }
+    }
+    return result.join("\n");
+}
+function findFileKey(files, endsWith) {
+    for (const key of files.keys()) {
+        if (key.endsWith(endsWith))
+            return key;
+    }
+    return undefined;
+}
+function escapeRegex(str) {
+    return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}

package/dist/route-processing.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/route-processing.test.js

@@ -0,0 +1,283 @@
+import { describe, expect, it } from "vitest";
+import { addRouteExclusion, excludedWorkerFiles, processRoutes, stripRouteFromClassifier, stripRouteFromRouter, } from "./route-processing.js";
+import { routeNames } from "./workflow-catalog.js";
+const ROUTER_YAML = `# header
+name: "All Work Router"
+
+on:
+  schedule:
+    - cron: "17 1 * * 1"
+    - cron: "43 3 * * *"
+    - cron: "0 6 * * *"
+    - cron: "*/5 * * * *"
+    - cron: "0 */2 * * *"
+
+  workflow_dispatch:
+    inputs:
+      operation:
+        description: "Operation to run"
+        required: true
+        type: choice
+        options:
+          - refine
+          - implement
+          - triage
+          - apply-review
+          - merge-gate
+          - audit
+          - audit-close
+          - cleanup-artifacts
+          - reconcile-bot-pr-runs
+          - stale-recovery
+          - validate
+
+jobs:
+  call-refine:
+    needs: [classify, authorize]
+    if: needs.classify.outputs.route == 'refine' && needs.authorize.outputs.trusted == 'true'
+    uses: ./.github/workflows/agent-refine.lock.yml
+    secrets:
+      OPENAI_API_KEY: \${{ secrets.OPENAI_API_KEY }}
+
+  call-implement:
+    needs: [classify, authorize]
+    if: needs.classify.outputs.route == 'implement' && needs.authorize.outputs.trusted == 'true'
+    uses: ./.github/workflows/agent-implement.lock.yml
+    secrets:
+      OPENAI_API_KEY: \${{ secrets.OPENAI_API_KEY }}
+
+  call-triage:
+    needs: [classify, authorize]
+    if: needs.classify.outputs.route == 'triage' && needs.authorize.outputs.is_outside_collaborator == 'true'
+    uses: ./.github/workflows/agent-triage.lock.yml
+    secrets:
+      OPENAI_API_KEY: \${{ secrets.OPENAI_API_KEY }}
+
+  call-audit:
+    needs: classify
+    if: needs.classify.outputs.route == 'audit'
+    uses: ./.github/workflows/agent-audit.lock.yml
+    secrets:
+      OPENAI_API_KEY: \${{ secrets.OPENAI_API_KEY }}
+
+  audit-close:
+    needs: classify
+    if: needs.classify.outputs.route == 'audit-close'
+    runs-on: ubuntu-latest
+`;
+const CLASSIFIER_SH = `#!/usr/bin/env bash
+set -euo pipefail
+
+readonly AUDIT_CRON="17 1 * * 1"
+readonly AUDIT_CLOSE_CRON="43 3 * * *"
+readonly CLEANUP_ARTIFACTS_CRON="0 6 * * *"
+readonly RECONCILE_BOT_PR_RUNS_CRON="*/5 * * * *"
+readonly STALE_RECOVERY_CRON="0 */2 * * *"
+
+classify_route() {
+  local route="none" error=""
+
+  case "\${EVENT:-}" in
+    schedule)
+      trigger_kind="scheduled"
+      case "\${SCHEDULE:-}" in
+        "\$AUDIT_CRON") route="audit" ;;
+        "\$AUDIT_CLOSE_CRON") route="audit-close" ;;
+        "\$CLEANUP_ARTIFACTS_CRON") route="cleanup-artifacts" ;;
+        "\$RECONCILE_BOT_PR_RUNS_CRON") route="reconcile-bot-pr-runs" ;;
+        "\$STALE_RECOVERY_CRON") route="stale-recovery" ;;
+        *) error="no route for cron '\${SCHEDULE:-}'" ;;
+      esac
+      ;;
+
+    workflow_dispatch)
+      trigger_kind="manual"
+      case "\${OPERATION:-}" in
+        refine | implement)
+          route="\${OPERATION}"
+          ;;
+        apply-review)
+          route="apply-review"
+          ;;
+        merge-gate)
+          route="merge-gate"
+          ;;
+        audit)
+          route="\${OPERATION}"
+          trigger_kind="\${INPUT_TRIGGER_KIND:-manual}"
+          ;;
+        audit-close | cleanup-artifacts | reconcile-bot-pr-runs | stale-recovery | validate)
+          route="\${OPERATION}"
+          ;;
+        *)
+          error="unknown operation '\${OPERATION:-}'"
+          ;;
+      esac
+      ;;
+  esac
+
+  cat <<EOF
+route=\${route}
+error=\${error}
+EOF
+}
+
+if [ "\${BASH_SOURCE[0]}" = "\$0" ]; then
+  classify_route
+fi
+`;
+const MATRIX_SH = `#!/usr/bin/env bash
+set -euo pipefail
+
+echo "── Router wiring ─────────────────────────────────────────────────────────"
+for route in refine implement triage apply-review merge-gate audit bot-approve \\
+  audit-close cleanup-artifacts reconcile-bot-pr-runs stale-recovery validate; do
+  if grep -q "route == '\${route}'" "\$ROUTER_YML"; then
+    PASS=\$((PASS + 1))
+  else
+    FAIL=\$((FAIL + 1))
+    echo "FAIL: work-router.yml has no job for route '\${route}'" >&2
+  fi
+done
+
+while read -r operation; do
+  if grep -q "route == '\${operation}'" "\$ROUTER_YML"; then
+    PASS=\$((PASS + 1))
+  else
+    FAIL=\$((FAIL + 1))
+    echo "FAIL: dispatch operation '\${operation}' has no job in work-router.yml" >&2
+  fi
+done < <(sed -n '/^      operation:/,/^      issue-number:/p' "\$ROUTER_YML" | sed -n 's/^          - //p')
+
+echo
+if [ "\$FAIL" -eq 0 ]; then
+  echo "Route matrix: \${PASS} passed"
+else
+  echo "Route matrix: \${PASS} passed, \${FAIL} FAILED" >&2
+fi
+
+exit \$((FAIL > 0))
+`;
+describe("stripRouteFromRouter", () => {
+    it("removes the audit cron entry", () => {
+        const result = stripRouteFromRouter(ROUTER_YAML, "audit");
+        expect(result).not.toContain('cron: "17 1 * * 1"');
+        expect(result).toContain('cron: "43 3 * * *"');
+    });
+    it("removes the call-audit job block", () => {
+        const result = stripRouteFromRouter(ROUTER_YAML, "audit");
+        expect(result).not.toContain("call-audit");
+        expect(result).toContain("call-refine");
+    });
+    it("preserves the audit-close job when removing audit", () => {
+        const result = stripRouteFromRouter(ROUTER_YAML, "audit");
+        expect(result).toContain("audit-close");
+    });
+    it("does not modify the yaml when stripping a route that has no cron", () => {
+        const yamlWithoutCron = ROUTER_YAML.replace(/    - cron: "17 1 \* \* 1"\n/, "");
+        const result = stripRouteFromRouter(yamlWithoutCron, "audit");
+        expect(result).not.toContain("call-audit");
+    });
+});
+describe("stripRouteFromClassifier", () => {
+    it("removes the AUDIT_CRON constant", () => {
+        const result = stripRouteFromClassifier(CLASSIFIER_SH, "audit");
+        expect(result).not.toContain('readonly AUDIT_CRON');
+        expect(result).toContain('readonly AUDIT_CLOSE_CRON');
+    });
+    it("removes the audit schedule case", () => {
+        const result = stripRouteFromClassifier(CLASSIFIER_SH, "audit");
+        expect(result).not.toContain('"$AUDIT_CRON") route="audit"');
+        expect(result).toContain('"$AUDIT_CLOSE_CRON") route="audit-close"');
+    });
+});
+describe("addRouteExclusion", () => {
+    it("adds an exclusion assertion for the route", () => {
+        const result = addRouteExclusion(MATRIX_SH, "audit");
+        expect(result).toContain("excluded route 'audit'");
+        expect(result).toContain("audit correctly excluded from work-router.yml");
+    });
+    it("does not add the exclusion twice", () => {
+        const once = addRouteExclusion(MATRIX_SH, "audit");
+        const twice = addRouteExclusion(once, "audit");
+        const matchCount = (twice.match(/excluded route 'audit'/g) ?? []).length;
+        expect(matchCount).toBe(1);
+    });
+});
+describe("processRoutes", () => {
+    it("returns the same map when all routes are selected", () => {
+        const files = new Map([
+            ["work-router.yml", ROUTER_YAML],
+            ["classify-route.sh", CLASSIFIER_SH],
+            ["verify-route-matrix.sh", MATRIX_SH],
+        ]);
+        const result = processRoutes(files, [...routeNames]);
+        expect(result).toBe(files);
+    });
+    it("strips every worker route when no routes are selected", () => {
+        const files = new Map([
+            [".github/workflows/work-router.yml", ROUTER_YAML],
+            [".github/actions/classify-route/classify-route.sh", CLASSIFIER_SH],
+            [".github/actions/verify-route-matrix/verify-route-matrix.sh", MATRIX_SH],
+        ]);
+        const result = processRoutes(files, []);
+        const router = result.get(".github/workflows/work-router.yml");
+        expect(router).not.toContain("call-audit");
+        expect(router).not.toContain("- refine");
+        const classifier = result.get(".github/actions/classify-route/classify-route.sh");
+        expect(classifier).toBe(CLASSIFIER_SH);
+        const matrix = result.get(".github/actions/verify-route-matrix/verify-route-matrix.sh");
+        expect(matrix).toContain("Route matrix: selected routes valid");
+        expect(matrix).toContain("for route in refine implement triage apply-review merge-gate audit");
+    });
+    it("strips audit from all three files when unselected", () => {
+        const files = new Map([
+            ["work-router.yml", ROUTER_YAML],
+            ["classify-route.sh", CLASSIFIER_SH],
+            ["verify-route-matrix.sh", MATRIX_SH],
+        ]);
+        const selectedRoutes = routeNames.filter((r) => r !== "audit");
+        const result = processRoutes(files, selectedRoutes);
+        const router = result.get("work-router.yml");
+        expect(router).not.toContain("call-audit");
+        expect(router).not.toContain('cron: "17 1 * * 1"');
+        const classifier = result.get("classify-route.sh");
+        expect(classifier).toBe(CLASSIFIER_SH);
+    });
+    it("processes multiple excluded routes at once", () => {
+        const files = new Map([
+            ["work-router.yml", ROUTER_YAML],
+            ["classify-route.sh", CLASSIFIER_SH],
+            ["verify-route-matrix.sh", MATRIX_SH],
+        ]);
+        const selectedRoutes = ["refine", "implement"];
+        const result = processRoutes(files, selectedRoutes);
+        const router = result.get("work-router.yml");
+        expect(router).toContain("call-refine");
+        expect(router).toContain("call-implement");
+        expect(router).not.toContain("call-audit");
+    });
+});
+describe("excludedWorkerFiles", () => {
+    it("returns worker files for unselected routes", () => {
+        const selectedRoutes = ["refine", "implement"];
+        const excluded = excludedWorkerFiles(selectedRoutes);
+        expect(excluded.has("agent-refine.md")).toBe(false);
+        expect(excluded.has("agent-implement.md")).toBe(false);
+        expect(excluded.has("agent-audit.md")).toBe(true);
+    });
+    it("returns an empty set when all routes are selected", () => {
+        const excluded = excludedWorkerFiles([...routeNames]);
+        expect(excluded.size).toBe(0);
+    });
+    it("returns all worker files when no routes are selected", () => {
+        const excluded = excludedWorkerFiles([]);
+        expect(excluded.size).toBe(6);
+        expect(excluded.has("agent-refine.md")).toBe(true);
+        expect(excluded.has("agent-implement.md")).toBe(true);
+        expect(excluded.has("agent-triage.md")).toBe(true);
+        expect(excluded.has("agent-apply-review.md")).toBe(true);
+        expect(excluded.has("agent-merge-gate.md")).toBe(true);
+        expect(excluded.has("agent-audit.md")).toBe(true);
+    });
+});

package/dist/stack-defaults.d.ts

@@ -0,0 +1,11 @@
+import type { RepositoryInspection } from "./repository-inspection.js";
+export interface StackDefaults {
+    readonly verifyCommands: string;
+    readonly repoRulesBase: string;
+    readonly hasDotnet: boolean;
+    readonly hasNodeOnly: boolean;
+}
+export declare function generateStackDefaults(inspection: RepositoryInspection): StackDefaults;
+export declare function injectStackEnv(content: string, defaults: StackDefaults): string;
+export declare function generateOpencodeCi(baseContent: string, inspection: RepositoryInspection): string;
+export declare function generateOpencodeConfig(baseContent: string, inspection: RepositoryInspection): string;