@plot-pm/board 0.16.3 → 0.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plot-pm/board",
-  "version": "0.16.3",
+  "version": "0.18.0",
   "description": "Local Kanban board for Plot — a glanceable view of plan phases from docs/plans, with sprint and story filters",
   "type": "module",
   "license": "MIT",
@@ -24,7 +24,6 @@
     "dist/board-server.mjs",
     "plot-agent-monitor.sh",
     "plot-agent-manifest.sh",
-    "plot-build-monitor.sh",
     "plot-monitor-subject.sh",
     "plot-approve.sh",
     "plot-budget.sh",
@@ -41,7 +40,6 @@
     "plot-release-refs.sh",
     "plot-state-receipt.sh",
     "plot-tmp.sh",
-    "plot-transcript-quiet.sh",
     "plot-worker-state.sh"
   ],
   "scripts": {
@@ -63,6 +61,7 @@
     "@types/react": "^19.2.0",
     "@types/react-dom": "^19.2.0",
     "@vitejs/plugin-react": "^6.0.0",
+    "@vitest/coverage-v8": "4.1.11",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "esbuild": "^0.28.0",
@@ -75,7 +74,7 @@
     "typescript": "^5.9.0",
     "vite": "^8.1.0",
     "vite-plugin-singlefile": "^2.3.0",
-    "vitest": "^4.1.10",
+    "vitest": "4.1.11",
     "zod": "^4.4.0"
   },
   "engines": {

package/plot-agent-manifest.sh

@@ -43,47 +43,12 @@ manifest_string() { # $1=manifest $2=field → prints the value, or nothing
   printf '%s' "$value"
 }
 
-# A non-negative integer field, or `0`. The node call itself only ever prints
-# a clean digit string or "0", so a failed call is the one case needing a
-# shell-side fallback.
-manifest_count() { # $1=manifest $2=field → prints a count
-  local manifest="$1"
-  [ -n "$manifest" ] && [ -f "$manifest" ] || { printf '0'; return 0; }
-  node -e '
-    const fs = require("fs");
-    try {
-      const manifest = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
-      const n = manifest[process.argv[2]];
-      process.stdout.write(Number.isInteger(n) && n >= 0 ? String(n) : "0");
-    } catch { process.stdout.write("0"); }
-  ' "$manifest" "$2" 2>/dev/null || printf '0'
-}
-
-# Raise a non-negative integer field by one, leaving every other field verbatim.
-#
-# THROUGH A TEMP FILE AND A RENAME, the shape every writer here takes: a reader
-# never sees a partial manifest. A write that fails leaves the file alone and
-# reports it; an absent manifest is not a failure.
-raise_manifest_count() { # $1=manifest $2=field
-  local manifest="$1" tmp="$1.plot-count-tmp"
-  [ -n "$manifest" ] && [ -f "$manifest" ] || return 0
-  node -e '
-    const fs = require("fs");
-    const [file, field, tmp] = process.argv.slice(1);
-    const manifest = JSON.parse(fs.readFileSync(file, "utf8"));
-    const n = manifest[field];
-    manifest[field] = (Number.isInteger(n) && n >= 0 ? n : 0) + 1;
-    fs.writeFileSync(tmp, JSON.stringify(manifest, null, 2) + "\n");
-  ' "$manifest" "$2" "$tmp" 2>/dev/null || { rm -f "$tmp"; return 1; }
-  mv -f "$tmp" "$manifest" 2>/dev/null || { rm -f "$tmp"; return 1; }
-}
-
 # Clear `branch` when a slice finishes, so the window before the next one is
 # observable.
 #
 # WHY THIS EXISTS. `free = process alive AND manifest names no branch`, and the
 # second half was unreachable. `seal_declaration` runs the moment a branch is
-# done; `update_manifest_on_hop` runs after `--next` answers and a worktree is
+# done; the hop that follows runs after `--next` answers and a worktree is
 # built. Between those two points the agent genuinely holds no slice and the
 # manifest still named the last one, so `isFree`'s empty-branch arm — written,
 # exported and unit-tested since `a-dispatch-asks-for-a-free-agent` — had no
@@ -95,7 +60,7 @@ raise_manifest_count() { # $1=manifest $2=field
 # and the liveness check with it, since both are keyed on the worktree path.
 # `wavesCount` counts hops and no hop has happened yet. The node one-liner
 # round-trips the whole object, so every other field survives verbatim, the same
-# property `update_manifest_on_hop` records.
+# property the hop's own write records.
 #
 # ADDED, NOT SUBSTITUTED. The hop still rewrites `branch` and `worktree`
 # together; this writes the empty value that sits between two slices. A worker
@@ -104,7 +69,7 @@ raise_manifest_count() { # $1=manifest $2=field
 #
 # ABSENT IS NOT A FAILURE. No manifest — a hand-started loop, an older
 # dispatcher — means there is nothing to clear and nothing to report, so this
-# returns 0 like `update_manifest_on_hop` does.
+# returns 0 like the hop's own write does.
 clear_manifest_branch() { # $1=manifest
   local manifest="$1"
   [ -f "$manifest" ] || return 0
@@ -149,13 +114,13 @@ plot_session_id() {
 # into both, and they part at the first hop to a new branch: `session` names the
 # agent and its manifest file for the agent's whole life, while `resumeId` names
 # the current slice's conversation and is what the board joins the transcript
-# on. Reading this field rather than `$PLOT_SESSION_ID` is what makes the
-# hop's write (`update_manifest_on_hop` in `plot-worker-loop.sh`) mean anything:
-# a reader asks for the handle, and gets the one the hop last wrote.
+# on. Reading this field rather than `$PLOT_SESSION_ID` is what makes the hop's
+# write (`writeResumeId` in `manifest-stamp.ts`) mean anything: a reader asks
+# for the handle, and gets the one the hop last wrote.
 #
-# A PARSE FAILURE AND AN ABSENT MANIFEST ARE ONE ANSWER, the shape
-# `assigned_branch` in `plot-worker-loop.sh` already takes: no handle. A hand-started loop has no
-# manifest, and a manifest nobody can read is not a handle.
+# A PARSE FAILURE AND AN ABSENT MANIFEST ARE ONE ANSWER: no handle. A
+# hand-started loop has no manifest, and a manifest nobody can read is not a
+# handle.
 manifest_resume_id() { # $1=manifest → prints the handle, or nothing
   manifest_string "$1" resumeId
 }

package/plot-config.sh

@@ -144,6 +144,18 @@
 #                       it does today and names `no-brief-command` as the
 #                       reason, so a project that has never set the key behaves
 #                       exactly as before.
+#   Agent runner        command | sdk: how the JS loop runs a worker's prompt.
+#                       Absent = command.
+#   Agent models        `role = model` list (`worker = sonnet`); a charter wins.
+#   Agent max turns     turns one SDK run may take. Absent = 150.
+#   Slice max runs      SDK runs one slice may start. Absent = 12.
+#   Agent context window  an SDK run's `autoCompactWindow`. Absent = 200000.
+#   Agent max spend     dollars one SDK run may spend (`maxBudgetUsd`); the run
+#                       then ends `spend-limit`. `$` and `USD` read, e.g. `$20`.
+#   Slice max spend     dollars one slice's runs may total, read from the slice-
+#                       spend record before each run. Both: absent/blank = no
+#                       limit; present and unreadable (0, negative, text) refuses
+#                       the worker's start.
 # Plot 2 posture keys (repo-declared ceremony bounds; all optional):
 #   Plan PRs            required | never | optional   (never = hard gate)
 #   Implementation home this repo | <repo/path list> | none
@@ -202,10 +214,7 @@ cmd="${1:?Usage: plot-config.sh get <key> [default]}"
 key="${2:?Usage: plot-config.sh get <key> [default]}"
 default="${3:-}"
 
-if [ "$cmd" != "get" ]; then
-  echo "plot-config: unknown subcommand '$cmd' (only 'get' is supported)" >&2
-  exit 1
-fi
+[ "$cmd" = "get" ] || { echo "plot-config: unknown subcommand '$cmd' (only 'get' is supported)" >&2; exit 1; }
 
 # THE CALLER'S ROOT IS TAKEN WHERE IT OFFERS ONE. `git rev-parse` is ~5 ms and
 # this script runs once per config key, so a caller reading several keys pays
@@ -219,11 +228,8 @@ fi
 # exported stale path would otherwise make every config read answer from a
 # repository that is not this one, silently. Asking git is the safe answer and
 # stays the default for every caller that offers nothing.
-if [ -n "${PLOT_REPO_ROOT:-}" ] && [ -d "$PLOT_REPO_ROOT" ]; then
-  root="$PLOT_REPO_ROOT"
-else
-  root=$(git rev-parse --show-toplevel 2>/dev/null) || root="."
-fi
+root="${PLOT_REPO_ROOT:-}"
+[ -n "$root" ] && [ -d "$root" ] || root=$(git rev-parse --show-toplevel 2>/dev/null) || root="."
 
 # Find the first repo-root file that contains a ## Plot Config section.
 # CLAUDE.md wins for backwards compatibility; AGENTS.md is the modern fallback.
@@ -261,8 +267,4 @@ if [ -n "$config_file" ]; then
         s/^[[:space:]]+//; s/[[:space:]]+$//')  # trim ends
 fi
 
-if [ -n "$value" ]; then
-  printf '%s\n' "$value"
-else
-  printf '%s\n' "$default"
-fi
+printf '%s\n' "${value:-$default}"

package/plot-default-branch.sh

@@ -29,19 +29,12 @@
 # now points at, so a second occurrence is visible in a log rather than
 # invisible in a working system.
 #
-# IT DOES NOT REPAIR A SYMREF THAT RESOLVES. Only an unresolvable one is broken.
-# A clone whose `origin/HEAD` deliberately names a non-default branch is
-# somebody's choice, and `--auto` would silently overrule it.
-#
-# WHAT LEAVES THE PIN BEHIND IS NOT REPAIRED HERE, and the leave-alone rule is
-# what keeps this safe alongside it. `packages/domain/corpus/refs.corpus.test.ts`
-# repoints `origin/HEAD` at a `plot-corpus-pin` ref it creates in `beforeAll`
-# and restores in `afterAll` — deliberately, so two readings of the estate see
-# one world. While that suite runs the pin RESOLVES, so this repairs nothing and
-# the suite is unaffected. What was measured on 2026-09-04 is the state after a
-# run that never reached its `afterAll`: the symref left behind, the ref it
-# names gone. Fixing that belongs to the suite; this repairs the symptom and
-# reports it loudly enough that the cause stays findable.
+# IT REPAIRS A SYMREF THAT RESOLVES ONLY WHEN IT NAMES `plot-corpus-pin`. A
+# clone whose `origin/HEAD` deliberately names another non-default branch is
+# somebody's choice, and `--auto` would silently overrule it. No operator
+# chooses the pin: `packages/domain/corpus/refs.corpus.test.ts` pins its own
+# disposable clone, so a symref naming it in any other repository is the
+# leftover of an interrupted run.
 
 # Whether `refs/remotes/origin/HEAD` names a ref that exists.
 #
@@ -51,14 +44,17 @@
 # Usage: origin_head_resolves [<repo-dir>]
 # Returns: 0 when it resolves — including when there is no symref at all, which
 #          is a FRESH CLONE rather than a corruption and has nothing to repair.
+#          A symref naming `plot-corpus-pin` is corrupt even when it resolves:
+#          that name is left behind only by an interrupted corpus run, never by
+#          a live one, since the corpus pins its own clone.
 origin_head_resolves() {
   local dir="${1:-.}" target
   target=$(git -C "$dir" symbolic-ref --quiet refs/remotes/origin/HEAD 2>/dev/null) || return 0
-  [ -n "$target" ] || return 0
+  case "$target" in '') return 0 ;; refs/remotes/origin/plot-corpus-pin) return 1 ;; esac
   git -C "$dir" rev-parse --verify --quiet "${target}^{commit}" >/dev/null 2>&1
 }
 
-# Repairs an unresolvable `refs/remotes/origin/HEAD`, and says what it did.
+# Repairs a `refs/remotes/origin/HEAD` that `origin_head_resolves` refuses, and says what it did.
 #
 # The repair is `git remote set-head origin --auto`, which asks the remote. It
 # is cheap — measured under a second — and it is the same command that fixed
@@ -70,16 +66,16 @@ origin_head_resolves() {
 #          this is a self-heal on a path that has its own refusal downstream,
 #          so it must never become a second way to stop.
 repair_origin_head() {
-  local dir="${1:-.}" was now
+  local dir="${1:-.}" was why
   origin_head_resolves "$dir" && return 0
 
   was=$(git -C "$dir" symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null || true)
+  why="does not resolve"; [ "$was" != origin/plot-corpus-pin ] || why="is the corpus pin, left by an interrupted corpus run"
   if ! git -C "$dir" remote set-head origin --auto >/dev/null 2>&1; then
-    echo "plot: origin/HEAD points at '$was', which does not resolve, and 'git remote set-head origin --auto' failed — the remote could not be asked." >&2
+    echo "plot: origin/HEAD points at '$was', which $why, and 'git remote set-head origin --auto' failed — the remote could not be asked." >&2
     return 0
   fi
-  now=$(git -C "$dir" symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null || true)
-  echo "plot: repaired origin/HEAD — it pointed at '$was', which does not exist on the remote; it now points at '${now:-<unset>}'." >&2
+  echo "plot: repaired origin/HEAD — it pointed at '$was', which $why; it now points at '$(git -C "$dir" symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null || echo '<unset>')'." >&2
   return 0
 }
 

package/plot-dispatch.sh

@@ -1374,14 +1374,12 @@ start_worker() {
   #
   # EVERY WORKER IS BORN MONITORED, AND THAT IS ENFORCED HERE OR NOWHERE.
   #
-  # Two monitors start INSIDE the wrapper, as its children, immediately before
-  # the agent: one watches the desk (`plot-agent-monitor.sh`), one watches the
-  # run (`plot-build-monitor.sh`). Each has a subject the other does not and a
-  # cadence it cannot share — minutes on the host, seconds on a run but only
-  # while one is live. The PROCESS is no longer a third monitor's subject:
-  # since `bug/the-loop-reports-idle` the loop's own watcher judges `idle`
-  # (`plot-worker-state.sh`'s `plot_worker_idle_watch_pass`), and the wrapper
-  # itself reports `gone`/`clear` after `wait "$agent"` returns, below.
+  # The AgentMonitor starts INSIDE the wrapper, as its child, immediately
+  # before the agent, watching the desk. The PROCESS is no longer a monitor's
+  # subject: since `bug/the-loop-reports-idle` the loop's own watcher judges `idle`
+  # (`board/plot-worker-loop.mjs`'s `idleVerdict`, built from the domain's
+  # `idleNow`), and the wrapper itself reports `gone`/`clear` after
+  # `wait "$agent"` returns, below.
   #
   # WHY INSIDE THE WRAPPER RATHER THAN BESIDE IT. The wrapper already outlives
   # its agent by construction — it must, or there would be no exit code to
@@ -1481,14 +1479,8 @@ start_worker() {
     fi
   fi
 
-  local agent_monitor='' build_monitor=''
+  local agent_monitor=''
   [ -x "$script_dir/plot-agent-monitor.sh" ] && agent_monitor="$script_dir/plot-agent-monitor.sh"
-  # THE THIRD MONITOR, born the same way and for the same reason. It watches the
-  # RUN — a Build is its own entity in the spec, so a monitor per entity is the
-  # pattern rather than an exception to it. Its cadence is the WorkerMonitor's
-  # 30 s rather than the AgentMonitor's 300 s, and it can afford that against a
-  # HOST because it asks nothing while no run is live.
-  [ -x "$script_dir/plot-build-monitor.sh" ] && build_monitor="$script_dir/plot-build-monitor.sh"
   local stamp_now
   stamp_now=$(date -u +%Y-%m-%dT%H:%M:%SZ)
   # THE THREE NAMES THE CHARTER DECLARED, and they travel as env vars for the
@@ -1563,11 +1555,10 @@ start_worker() {
       PLOT_MANIFEST_FILE="$manifest_dir/$session.json" \
       PLOT_STAMP_STARTED="$stamp_now" \
       PLOT_AGENT_MONITOR="$agent_monitor" \
-      PLOT_BUILD_MONITOR="$build_monitor" \
       PLOT_EXIT_FILE="$wt/.plot-worker.exit" PLOT_PID_FILE="$wt/.plot-worker.pid" \
       PLOT_WRAPPER_PID_FILE="$wt/.plot-worker.wrapper.pid" \
       PLOT_SCRIPT_DIR="$script_dir" \
-      exec nohup sh -c 'printf "%s" "$$" > "$PLOT_WRAPPER_PID_FILE"; wmon=""; amon=""; bmon=""; if [ -n "$PLOT_AGENT_MONITOR" ]; then "$PLOT_AGENT_MONITOR" & amon=$!; fi; if [ -n "$PLOT_BUILD_MONITOR" ]; then "$PLOT_BUILD_MONITOR" & bmon=$!; fi; PATH="$PLOT_SCRIPT_DIR:$PATH"; export PATH; ( '"$cmd"' ) & agent=$!; trap "" TERM; printf "%s" "$agent" > "$PLOT_PID_FILE"; if [ -f "$PLOT_MANIFEST_FILE" ]; then awk -v pid="$agent" -v started="$PLOT_STAMP_STARTED" -v wrapper="$$" -v wmon="$wmon" -v amon="$amon" -v bmon="$bmon" '"'"'
+      exec nohup sh -c 'printf "%s" "$$" > "$PLOT_WRAPPER_PID_FILE"; wmon=""; amon=""; if [ -n "$PLOT_AGENT_MONITOR" ]; then "$PLOT_AGENT_MONITOR" & amon=$!; fi; PATH="$PLOT_SCRIPT_DIR:$PATH"; export PATH; ( '"$cmd"' ) & agent=$!; trap "" TERM; printf "%s" "$agent" > "$PLOT_PID_FILE"; if [ -f "$PLOT_MANIFEST_FILE" ]; then awk -v pid="$agent" -v started="$PLOT_STAMP_STARTED" -v wrapper="$$" -v wmon="$wmon" -v amon="$amon" '"'"'
         BEGIN { relaunch = 0; count = 1; stamped = 0 }
         FNR == NR {
           if ($0 ~ /^  "pid": "[^"]*",$/) {
@@ -1585,7 +1576,6 @@ start_worker() {
           print "  \"wrapperPid\": \"" wrapper "\","
           print "  \"workerMonitorPid\": \"" wmon "\","
           print "  \"agentMonitorPid\": \"" amon "\","
-          print "  \"buildMonitorPid\": \"" bmon "\","
           if (relaunch) {
             print "  \"previousPid\": \"" displaced "\","
             print "  \"relaunches\": " count ","
@@ -1595,7 +1585,6 @@ start_worker() {
         $0 ~ /^  "wrapperPid": "[^"]*",$/ { next }
         $0 ~ /^  "workerMonitorPid": "[^"]*",$/ { next }
         $0 ~ /^  "agentMonitorPid": "[^"]*",$/ { next }
-        $0 ~ /^  "buildMonitorPid": "[^"]*",$/ { next }
         relaunch && $0 ~ /^  "previousPid": "[^"]*",$/ { next }
         relaunch && $0 ~ /^  "relaunches": [0-9]+,$/ { next }
         relaunch && $0 ~ /^  "startedAt": "[^"]*"$/ { print "  \"startedAt\": \"" started "\""; next }
@@ -3043,7 +3032,9 @@ esac
 # merged PR outlives the branch it was cut from.
 #
 # `NONE` AND SILENCE ARE DIFFERENT ANSWERS. `NONE` means the host was asked and
-# has never seen a PR for that branch — a typo, which is `blocked`. A host that
+# has never seen a PR for that branch. For a name in `plot-fleet-scan.sh
+# --slice-names` — a slice of any live plan, not deferred — that is a slice
+# nobody started, which is `waiting`; for any other name it is `blocked`. A host that
 # could not be asked is neither permission nor proof of a typo, so it HOLDS the
 # branch at `waiting`. Both refuse; only one tells the operator to fix the plan.
 
@@ -3172,13 +3163,27 @@ declare -a waits_freed=()
 # already sets: a dry run that offers what a real run would refuse is worse than
 # no dry run — it is the same wrong answer with a reassurance attached.
 run_waits_preflight() { # → prints refusals; fills waits_held, adds to n_skipped
-  local br prereq answer held
+  local br prereq answer held slice_names=""
   while IFS=$'\t' read -r br prereq; do
     [ -n "$br" ] || continue
     answer=$(prereq_answer "$prereq")
     case "$answer" in
       merged) continue ;;
-      none)   held=blocked ;;
+      # A slice somebody may still start has no PR until its work starts: a
+      # wait, not a typo (#1305). The set is the scan's, of the whole estate,
+      # so a slice of ANOTHER plan reads as it does on the board. Asked once,
+      # and only when the host answered `none`.
+      # ABSENT IS NOT FALSE. A scan that failed or printed nothing leaves the
+      # set unread, and an unread set holds the branch at `waiting` exactly as
+      # an unaskable host does: telling an operator to fix a correct plan is its
+      # own defect. stderr stays visible, and the refusal names the failure.
+      none)   [ -n "$slice_names" ] || slice_names=$'\n'"$("$script_dir/plot-fleet-scan.sh" --slice-names)"$'\n' || slice_names=$'\n\n'
+              case "$slice_names" in
+                $'\n\n') held=waiting
+                          echo "plot-fleet-scan.sh --slice-names gave no answer: $prereq has no PR, held as waiting rather than called a typo" ;;
+                *$'\n'"$prereq"$'\n'*) held=waiting ;;
+                *) held=blocked ;;
+              esac ;;
       *)      held=waiting ;;
     esac
     # `--allow-waiting` SAYS SO ON THE LINE IT OVERRIDES, ONCE PER PREREQUISITE
@@ -3267,9 +3272,7 @@ worker_state_field() {
 #
 # `worker=` still travels in the footer. It says how this repo is configured,
 # which remains a fact about the repo even where it no longer explains a count.
-print_summary() { # $1=dispatched $2=reused $3=skipped $4=started
-  echo "summary: dispatched=$1 reused=$2 skipped=$3 started=$4 brief=missing worker=$(worker_state_field) brief_asked=${n_brief_asked:-0}"
-}
+# The line is printed once, at the end of the run.
 
 # ---------------------------------------------------------------------------
 # Parallel-agents cap: warn and raise when exceeded
@@ -4225,7 +4228,7 @@ book_started ${claimed_now[@]+"${claimed_now[@]}"} || true
 # appears before the footer.
 check_and_update_cap "$n_started"
 
-print_summary "$n_dispatched" "$n_reused" "$n_skipped" "$n_started"
+echo "summary: dispatched=$n_dispatched reused=$n_reused skipped=$n_skipped started=$n_started brief=missing worker=$(worker_state_field) brief_asked=${n_brief_asked:-0}"
 
 # THE RECEIPT IS SPENT HERE, on the fan-out COMPLETING — never at the gate.
 # `plot-controller-gate.sh` clears on a receipt and LEAVES it, so a run that