@plainconceptsplatform/workflows 1.2.0 → 1.2.1

package/dist/catalog-installation.js

@@ -326,7 +326,11 @@ async function preCommitHookUpdate(repositoryPath) {
     if (!await exists(hookPath)) {
         return { target, content: managedLines };
     }
+    // A Windows clone with core.autocrlf checks the hook out with CRLF, which the LF patterns below
+    // never match: every update from Windows appended one more block (one consumer had ten). The
+    // hook is written back with LF, as every managed file is.
     const content = (await readFile(hookPath, "utf8"))
+        .replace(/\r\n/g, "\n")
         .replace("pnpm exec if git diff --cached --name-only -- .github | grep -q .; then", "if git diff --cached --name-only -- .github | grep -q .; then");
     // Replace whatever managed block is there, never append beside it. The previous version
     // recognised only two exact shapes -- the current block and the pre-`if` legacy lines -- and

package/loops/actions/capture-evidence/action.yml

@@ -21,6 +21,13 @@ inputs:
     description: Where capture and unreached write the screenshots, manifest.json and comment.md.
     required: false
     default: ''
+  sign-in:
+    description: >
+      The repository's own sign-in steps for plans that start signed in (`login:`), relative to the
+      workspace, which is the default branch's checkout. The repository owns the file; without it
+      such a plan replays signed out and its comment says why.
+    required: false
+    default: '.github/evidence/sign-in.yml'
   playwright-version:
     description: playwright-core version. Must match the mcr.microsoft.com/playwright image tag the capture runs in.
     required: false
@@ -75,6 +82,7 @@ runs:
         ROOT: ${{ inputs.root }}
         PLANS: ${{ inputs.plans }}
         OUT_DIR: ${{ inputs.out-dir }}
+        EVIDENCE_SIGN_IN: ${{ inputs.sign-in }}
         PLAYWRIGHT_VERSION: ${{ inputs.playwright-version }}
         # Chromium's own stderr. A browser that dies on launch says why only here.
         DEBUG: pw:browser
@@ -102,7 +110,7 @@ runs:
             if command -v docker > /dev/null 2>&1; then
               # The host network, so the browser reaches the app on localhost where it started;
               # the runner's own user, so what it writes the publish job can read.
-              docker run --rm --network host --ipc host                 --user "$(id -u):$(id -g)" -e HOME=/tmp -e DEBUG                 -e EVIDENCE_SHA -e EVIDENCE_RUN_URL -e EVIDENCE_STEP_TIMEOUT_MS -e EVIDENCE_NAVIGATION_TIMEOUT_MS                 -v "$runner:$runner:ro" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE:ro" -v "$OUT_DIR:$OUT_DIR"                 -w "$GITHUB_WORKSPACE"                 "mcr.microsoft.com/playwright:v${PLAYWRIGHT_VERSION}-noble"                 node "$runner/capture.mjs" capture "$ROOT" "$OUT_DIR" "${plans[@]}"
+              docker run --rm --network host --ipc host                 --user "$(id -u):$(id -g)" -e HOME=/tmp -e DEBUG                 -e EVIDENCE_SHA -e EVIDENCE_RUN_URL -e EVIDENCE_SIGN_IN -e EVIDENCE_STEP_TIMEOUT_MS -e EVIDENCE_NAVIGATION_TIMEOUT_MS                 -v "$runner:$runner:ro" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE:ro" -v "$OUT_DIR:$OUT_DIR"                 -w "$GITHUB_WORKSPACE"                 "mcr.microsoft.com/playwright:v${PLAYWRIGHT_VERSION}-noble"                 node "$runner/capture.mjs" capture "$ROOT" "$OUT_DIR" "${plans[@]}"
             else
               node "$runner/capture.mjs" capture "$ROOT" "$OUT_DIR" "${plans[@]}"
             fi

package/loops/actions/capture-evidence/capture.mjs

@@ -37,6 +37,10 @@ export const EMBED_MARKER = "agentic-evidence-manifest";
 export const EVIDENCE_DIR = "evidence";
 // Stays well under GitHub's 65,536 character comment limit with the markdown above it.
 const EMBED_LIMIT = 30000;
+// The repository's own steps for signing in locally, read from the default branch so a replay of
+// an older pull request finds them too. The repository owns the file: an update never writes it.
+export const SIGN_IN_FILE = ".github/evidence/sign-in.yml";
+const ACCOUNT_PLACEHOLDER = "{account}";
 
 const ACTIONS = new Set(["open", "click", "dblclick", "fill", "press", "select", "check", "uncheck", "hover", "wait"]);
 const LOCATOR_KEYS = ["role", "text", "label", "placeholder", "testid", "alt", "title", "css"];
@@ -129,15 +133,83 @@ export function normalizePlan(doc) {
     return { n: index + 1, capture, expect: String(raw.expect ?? "").trim(), steps, ignored };
   });
 
+  const login = parseLogin(doc.login ?? environment.login, environment);
   return {
     status: "runnable",
     url: String(doc.url ?? environment.url ?? DEFAULT_URL).trim() || DEFAULT_URL,
     start: String(doc.start ?? environment.start ?? "").trim(),
     viewport: parseViewport(doc.viewport ?? environment.viewport),
+    ...(login ? { login } : {}),
     waypoints,
   };
 }
 
+// A plan that starts signed in says so with `login`, rather than signing in in its first
+// waypoint. The plans written before that waypoint signed in name a mechanism (`login: mock-sso`)
+// and say whom in prose ("Sign in as Bob Builder"), so the prose travels along as a hint. A plan
+// can also name the account (`login: { account: Bob Builder }`) or spell out its own steps.
+export function parseLogin(value, environment = {}) {
+  if (value === undefined || value === null || value === false) return undefined;
+  if (Array.isArray(value)) return { steps: value };
+  if (isObject(value) && Array.isArray(value.steps)) return { steps: value.steps };
+  if (isObject(value) && value.account !== undefined) return { account: String(value.account) };
+  const hint = Object.values(environment).filter((text) => typeof text === "string").join("\n");
+  return { hint };
+}
+
+// The account a plan's prose asks for: one of the repository's accounts right after "sign in as",
+// the earliest when the prose names several. Only an account the repository lists can match.
+export function accountNamed(text, accounts) {
+  let best;
+  for (const account of accounts) {
+    const escaped = account.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const at = String(text ?? "").search(new RegExp(`sign(?:ed)?[\\s-]*in\\s+as\\s+(?:the\\s+)?${escaped}\\b`, "i"));
+    if (at >= 0 && (best === undefined || at < best.at)) best = { account, at };
+  }
+  return best?.account;
+}
+
+// Reads the repository's sign-in: the steps, in the journey's own step syntax, with `{account}`
+// where the account goes, and the accounts a plan can ask for, the first being the default.
+export function parseSignIn(text, parseYaml) {
+  const doc = parseYaml(String(text));
+  if (!isObject(doc) || !Array.isArray(doc.steps) || doc.steps.length === 0) {
+    throw new Error("the sign-in needs a steps list");
+  }
+  return { accounts: asArray(doc.accounts).map((account) => String(account)), steps: doc.steps };
+}
+
+const fillAccount = (value, account) =>
+  typeof value === "string"
+    ? value.split(ACCOUNT_PLACEHOLDER).join(account)
+    : Array.isArray(value)
+      ? value.map((item) => fillAccount(item, account))
+      : isObject(value)
+        ? Object.fromEntries(Object.entries(value).map(([key, item]) => [key, fillAccount(item, account)]))
+        : value;
+
+// A first waypoint that clicks one of the repository's accounts signs the plan in itself, as some
+// plans that also say `login:` do. Signing in before it would leave that click nothing to find.
+function signsItselfIn(plan, accounts) {
+  const names = new Set(accounts.map((account) => account.toLowerCase()));
+  return (plan.waypoints[0]?.steps ?? []).some((step) =>
+    step.action === "click" && [step.locator?.text, step.locator?.name].some((name) => name !== undefined && names.has(name.toLowerCase())),
+  );
+}
+
+// The steps that sign a plan in before its first waypoint, or why there are none to run.
+export function signInFor(plan, signIn) {
+  const login = plan.login;
+  if (!login) return undefined;
+  const parsed = (raw) => raw.map(parseStep).filter((step) => step.ignored === undefined);
+  if (login.steps) return { steps: parsed(login.steps) };
+  if (!signIn) return { steps: [], error: `the plan starts signed in, but the repository has no ${SIGN_IN_FILE}` };
+  if (signIn.error) return { steps: [], error: signIn.error };
+  if (signsItselfIn(plan, signIn.accounts)) return undefined;
+  const account = login.account ?? accountNamed(login.hint, signIn.accounts) ?? signIn.accounts[0] ?? "";
+  return { ...(account ? { account } : {}), steps: parsed(fillAccount(signIn.steps, account)) };
+}
+
 function locatorOf(value) {
   if (typeof value === "string") return { text: value };
   if (!isObject(value)) return undefined;
@@ -450,7 +522,23 @@ async function replay(browser, plan, outDir, dir) {
   page.setDefaultNavigationTimeout(NAVIGATION_TIMEOUT_MS);
 
   const results = [];
+  let signedIn;
   try {
+    if (plan.signIn) {
+      // Signing in is not a waypoint: nothing is captured, and a failure is recorded while the
+      // journey still runs, so its screenshots show where a missing sign-in left it.
+      const errors = plan.signIn.error ? [plan.signIn.error] : [];
+      for (const step of plan.signIn.steps) {
+        try {
+          await runStep(page, step, plan.url);
+        } catch (error) {
+          errors.push(`${describeStep(step)}: ${firstLine(error)}`);
+          break;
+        }
+      }
+      signedIn = { ...(plan.signIn.account ? { account: plan.signIn.account } : {}), reached: errors.length === 0, errors };
+      console.log(`${dir} sign-in${plan.signIn.account ? ` as ${plan.signIn.account}` : ""}: ${errors.length === 0 ? "ok" : errors.join("; ")}`);
+    }
     for (const waypoint of plan.waypoints) {
       const errors = [];
       for (const step of waypoint.steps) {
@@ -486,7 +574,7 @@ async function replay(browser, plan, outDir, dir) {
   } finally {
     await context.close();
   }
-  return results;
+  return { waypoints: results, signedIn };
 }
 
 // ── Report ──────────────────────────────────────────────────────────────────────────────────
@@ -560,6 +648,10 @@ export function renderComment(manifest) {
       lines.push(`Not replayed: ${escapeMarkdown(plan.reason || plan.status)}.`, "");
       continue;
     }
+    if (plan.signIn) {
+      const as = plan.signIn.account ? ` as ${escapeMarkdown(plan.signIn.account)}` : "";
+      lines.push(plan.signIn.reached ? `Signed in${as} first.` : `> Could not sign in${as} first: ${escapeMarkdown(plan.signIn.errors.join("; "))}`, "");
+    }
     const missed = plan.waypoints.filter((waypoint) => !waypoint.reached).length;
     const summary = `${plan.waypoints.length} waypoint${plan.waypoints.length === 1 ? "" : "s"}${missed > 0 ? `, ${missed} did not reach their state` : ""}`;
     lines.push("<details>", `<summary>${summary}</summary>`, "");
@@ -606,6 +698,19 @@ async function inspect(root, paths) {
   };
 }
 
+// The repository's sign-in, or null when it has none. The path is relative to the working
+// directory, which is the default branch's checkout, not the pull request head.
+async function loadSignIn(path, parseYaml) {
+  let text;
+  try {
+    text = await readFile(path, "utf8");
+  } catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throw error;
+  }
+  return parseSignIn(text, parseYaml);
+}
+
 async function capture(root, outDir, paths) {
   const { parse } = await import("yaml");
   const { chromium } = await import("playwright-core");
@@ -613,6 +718,11 @@ async function capture(root, outDir, paths) {
   const plans = await loadPlans(root, paths, parse);
   const runnable = plans.filter((plan) => plan.status === "runnable");
   const manifest = { version: 2, plans: [] };
+  let signIn = null;
+  if (runnable.some((plan) => plan.login)) {
+    const path = process.env.EVIDENCE_SIGN_IN || SIGN_IN_FILE;
+    signIn = await loadSignIn(path, parse).catch((error) => ({ error: `${path}: ${firstLine(error)}` }));
+  }
 
   const browser = runnable.length > 0 ? await chromium.launch({ headless: true }) : undefined;
   try {
@@ -623,8 +733,8 @@ async function capture(root, outDir, paths) {
       }
       const dir = planDir(plan.path);
       await mkdir(join(outDir, "files", dir, EVIDENCE_DIR), { recursive: true });
-      const waypoints = await replay(browser, plan, outDir, dir);
-      manifest.plans.push({ path: plan.path, change: plan.change, status: "captured", url: plan.url, waypoints });
+      const { waypoints, signedIn } = await replay(browser, { ...plan, signIn: signInFor(plan, signIn) }, outDir, dir);
+      manifest.plans.push({ path: plan.path, change: plan.change, status: "captured", url: plan.url, ...(signedIn ? { signIn: signedIn } : {}), waypoints });
     }
   } finally {
     await browser?.close();

package/loops/workflows/evidence.yml

@@ -11,8 +11,9 @@ name: "Agentics: Evidence"
 # Two jobs, because one runs the pull request's code and the other writes. `capture` checks out
 # the head, starts the app and drives Chromium with a read-only token and no secret. `publish`
 # checks nothing out: it takes the images as an artifact, commits them into an `evidence/` folder
-# beside each plan on the default branch and writes one comment. Both use GITHUB_TOKEN, so a
-# repository configures nothing, and nothing either job writes raises another workflow event.
+# beside each plan on the default branch and writes one comment. Both use GITHUB_TOKEN, and nothing
+# either job writes raises another workflow event. The one thing a repository may add is its own
+# .github/evidence/sign-in.yml, for plans that start signed in rather than signing in themselves.
 #
 # This replaced agent-visual-verify, which never produced a screenshot: it ran only on pull
 # requests nobody would review, raced the merge it was dispatched before, re-planned with a model

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",