@plainconceptsplatform/workflows 1.21.2 → 1.21.4

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -1934,15 +1934,23 @@ fi
 if worker_installed implement && ! grep -qF 'subagent_type: planner-sub' "$IMPLEMENT_WORKER_MD"; then
   LEAD_OK=0; echo "FAIL: the implement prompt must run propose and archive in the planner-sub agent" >&2
 fi
-# agent-harness before 3.11.3 writes `resource: *`, a YAML alias that does not parse: opencode drops the agent's
+# agent-harness before 3.12.1 writes `resource: *`, a YAML alias that does not parse: opencode drops the agent's
 # mode and refuses to spawn planner and planner-sub ("cannot run as a subagent"). The CI setup repairs the
 # generated files before opencode reads them, and the implement prompt stops at the first spawn error.
+if ! grep -qF 'resource: ${JSON.stringify(p.resource)}' "${WORKFLOWS_DIR}/shared/opencode-ci.md"; then
+  LEAD_OK=0; echo "FAIL: the CI setup must quote the permission resource in the harness generator, which rewrites the agents at startup" >&2
+fi
 if ! grep -qF 'resource: "*"' "${WORKFLOWS_DIR}/shared/opencode-ci.md"; then
   LEAD_OK=0; echo "FAIL: the CI setup must quote the generated agents' permission resource (a bare * is a YAML alias)" >&2
 fi
 if worker_installed implement && ! grep -qF 'cannot run as a subagent' "$IMPLEMENT_WORKER_MD"; then
   LEAD_OK=0; echo "FAIL: the implement prompt must stop at a planner-sub spawn error instead of retrying other agents" >&2
 fi
+# gh-aw strips HTML comments from safe-output comments, so the refine marker never reaches GitHub: the
+# router's auto-accept found no questions anywhere until it matched refine's visible prefix as well.
+if ! grep -qF 'contains($prefix)' "$ROUTER_YML" || ! grep -qF 'REFINE_PREFIX: "Refinement update"' "$ROUTER_YML"; then
+  LEAD_OK=0; echo "FAIL: the refine auto-accept must find the questions by refine's visible prefix, not only the stripped marker" >&2
+fi
 if [ "$LEAD_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 # The harness plugins only load with .opencode/node_modules installed; without it every CI run
 # spawned untiered workers on the session's model. And the tier model a worker pins has to be one

package/loops/workflows/shared/opencode-ci.md

@@ -251,10 +251,21 @@ pre-agent-steps:
     # variants visible from the first turn; the doctor is the audit line.
     run: |
       set -euo pipefail
-      if [ -f .opencode/scripts/sync-agents.mjs ] && [ -f .opencode/plugins/pc-subagent-tiers-core.js ]; then
+      # agent-harness before 3.12.1 generates `resource: *` (see below). Quoting the generated files alone is not
+      # enough: the plugin rewrites them when opencode starts, so the generator itself is patched first. A no-op
+      # once the harness quotes the value.
+      tiers_core=.opencode/plugins/pc-subagent-tiers-core.js
+      if [ -f "$tiers_core" ]; then
+        sed -i 's/resource: ${p\.resource}`/resource: ${JSON.stringify(p.resource)}`/' "$tiers_core"
+        if grep -qF 'resource: ${p.resource}`' "$tiers_core"; then
+          echo "::error::Could not quote the permission resource in $tiers_core; opencode would refuse to spawn planner-sub." >&2
+          exit 1
+        fi
+      fi
+      if [ -f .opencode/scripts/sync-agents.mjs ] && [ -f "$tiers_core" ]; then
         node .opencode/scripts/sync-agents.mjs --strict
       fi
-      # agent-harness before 3.11.3 writes `resource: *` into plan.md, planner.md and planner-sub.md. A bare `*` is
+      # agent-harness before 3.12.1 writes `resource: *` into plan.md, planner.md and planner-sub.md. A bare `*` is
       # a YAML alias, so the frontmatter does not parse, opencode drops the agents' `mode`, treats them as primary
       # and refuses to spawn them ("Agent planner-sub cannot run as a subagent"). These files are generated here on
       # every run and never committed, so quote the value before opencode reads them; a no-op once the harness does.

package/loops/workflows/work-router.yml

@@ -1718,6 +1718,10 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           REPO: ${{ github.repository }}
           REFINE_MARKER: "<!-- agent-refine -->"
+          # gh-aw strips HTML comments from safe-output comments, so the marker above never reaches
+          # GitHub and this step found no questions in any repository. The visible prefix refine
+          # puts first (agent-refine's SAFE_OUTPUT_COMMENT_PREFIX) identifies them instead.
+          REFINE_PREFIX: "Refinement update"
           QUESTIONS_LINE: "I have some questions about this issue"
           PROPOSED_TAG: "**Proposed:**"
           DECISION_TAG: "**Your decision needed:**"
@@ -1744,8 +1748,10 @@ jobs:
             while IFS=$'\t' read -r issue people; do
               [ -n "$issue" ] || continue
               comments=$(gh api --paginate "repos/$REPO/issues/$issue/comments?per_page=100" | jq -s 'add // []')
-              asked=$(jq -c --arg marker "$REFINE_MARKER" --arg line "$QUESTIONS_LINE" '
-                [.[] | select(.user.type == "Bot" and (.body | contains($marker)) and (.body | contains($line)))]
+              asked=$(jq -c --arg marker "$REFINE_MARKER" --arg prefix "$REFINE_PREFIX" --arg line "$QUESTIONS_LINE" '
+                [.[] | select(.user.type == "Bot"
+                  and ((.body | contains($marker)) or (.body | contains($prefix)))
+                  and (.body | contains($line)))]
                 | last // empty | {id, created_at, body}' <<<"$comments")
               [ -n "$asked" ] || continue
               asked_at=$(jq -r '.created_at' <<<"$asked")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.21.2",
+  "version": "1.21.4",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",