@plot-pm/board 0.17.0 → 0.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plot-pm/board",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Local Kanban board for Plot — a glanceable view of plan phases from docs/plans, with sprint and story filters",
   "type": "module",
   "license": "MIT",

package/plot-agent-manifest.sh

@@ -48,7 +48,7 @@ manifest_string() { # $1=manifest $2=field → prints the value, or nothing
 #
 # WHY THIS EXISTS. `free = process alive AND manifest names no branch`, and the
 # second half was unreachable. `seal_declaration` runs the moment a branch is
-# done; `update_manifest_on_hop` runs after `--next` answers and a worktree is
+# done; the hop that follows runs after `--next` answers and a worktree is
 # built. Between those two points the agent genuinely holds no slice and the
 # manifest still named the last one, so `isFree`'s empty-branch arm — written,
 # exported and unit-tested since `a-dispatch-asks-for-a-free-agent` — had no
@@ -60,7 +60,7 @@ manifest_string() { # $1=manifest $2=field → prints the value, or nothing
 # and the liveness check with it, since both are keyed on the worktree path.
 # `wavesCount` counts hops and no hop has happened yet. The node one-liner
 # round-trips the whole object, so every other field survives verbatim, the same
-# property `update_manifest_on_hop` records.
+# property the hop's own write records.
 #
 # ADDED, NOT SUBSTITUTED. The hop still rewrites `branch` and `worktree`
 # together; this writes the empty value that sits between two slices. A worker
@@ -69,7 +69,7 @@ manifest_string() { # $1=manifest $2=field → prints the value, or nothing
 #
 # ABSENT IS NOT A FAILURE. No manifest — a hand-started loop, an older
 # dispatcher — means there is nothing to clear and nothing to report, so this
-# returns 0 like `update_manifest_on_hop` does.
+# returns 0 like the hop's own write does.
 clear_manifest_branch() { # $1=manifest
   local manifest="$1"
   [ -f "$manifest" ] || return 0
@@ -114,13 +114,13 @@ plot_session_id() {
 # into both, and they part at the first hop to a new branch: `session` names the
 # agent and its manifest file for the agent's whole life, while `resumeId` names
 # the current slice's conversation and is what the board joins the transcript
-# on. Reading this field rather than `$PLOT_SESSION_ID` is what makes the
-# hop's write (`update_manifest_on_hop` in `plot-worker-loop.sh`) mean anything:
-# a reader asks for the handle, and gets the one the hop last wrote.
+# on. Reading this field rather than `$PLOT_SESSION_ID` is what makes the hop's
+# write (`writeResumeId` in `manifest-stamp.ts`) mean anything: a reader asks
+# for the handle, and gets the one the hop last wrote.
 #
-# A PARSE FAILURE AND AN ABSENT MANIFEST ARE ONE ANSWER, the shape
-# `assigned_branch` in `plot-worker-loop.sh` already takes: no handle. A hand-started loop has no
-# manifest, and a manifest nobody can read is not a handle.
+# A PARSE FAILURE AND AN ABSENT MANIFEST ARE ONE ANSWER: no handle. A
+# hand-started loop has no manifest, and a manifest nobody can read is not a
+# handle.
 manifest_resume_id() { # $1=manifest → prints the handle, or nothing
   manifest_string "$1" resumeId
 }

package/plot-config.sh

@@ -150,10 +150,12 @@
 #   Agent max turns     turns one SDK run may take. Absent = 150.
 #   Slice max runs      SDK runs one slice may start. Absent = 12.
 #   Agent context window  an SDK run's `autoCompactWindow`. Absent = 200000.
-#   Agent max spend     dollars one SDK run may spend (`maxBudgetUsd`); the
-#                       run then ends `spend-limit`. Absent = no limit, never 0.
-#   Slice max spend     dollars one slice's runs may total, read from the
-#                       slice-spend record before each run. Absent = no limit.
+#   Agent max spend     dollars one SDK run may spend (`maxBudgetUsd`); the run
+#                       then ends `spend-limit`. `$` and `USD` read, e.g. `$20`.
+#   Slice max spend     dollars one slice's runs may total, read from the slice-
+#                       spend record before each run. Both: absent/blank = no
+#                       limit; present and unreadable (0, negative, text) refuses
+#                       the worker's start.
 # Plot 2 posture keys (repo-declared ceremony bounds; all optional):
 #   Plan PRs            required | never | optional   (never = hard gate)
 #   Implementation home this repo | <repo/path list> | none

package/plot-default-branch.sh

@@ -29,19 +29,12 @@
 # now points at, so a second occurrence is visible in a log rather than
 # invisible in a working system.
 #
-# IT DOES NOT REPAIR A SYMREF THAT RESOLVES. Only an unresolvable one is broken.
-# A clone whose `origin/HEAD` deliberately names a non-default branch is
-# somebody's choice, and `--auto` would silently overrule it.
-#
-# WHAT LEAVES THE PIN BEHIND IS NOT REPAIRED HERE, and the leave-alone rule is
-# what keeps this safe alongside it. `packages/domain/corpus/refs.corpus.test.ts`
-# repoints `origin/HEAD` at a `plot-corpus-pin` ref it creates in `beforeAll`
-# and restores in `afterAll` — deliberately, so two readings of the estate see
-# one world. While that suite runs the pin RESOLVES, so this repairs nothing and
-# the suite is unaffected. What was measured on 2026-09-04 is the state after a
-# run that never reached its `afterAll`: the symref left behind, the ref it
-# names gone. Fixing that belongs to the suite; this repairs the symptom and
-# reports it loudly enough that the cause stays findable.
+# IT REPAIRS A SYMREF THAT RESOLVES ONLY WHEN IT NAMES `plot-corpus-pin`. A
+# clone whose `origin/HEAD` deliberately names another non-default branch is
+# somebody's choice, and `--auto` would silently overrule it. No operator
+# chooses the pin: `packages/domain/corpus/refs.corpus.test.ts` pins its own
+# disposable clone, so a symref naming it in any other repository is the
+# leftover of an interrupted run.
 
 # Whether `refs/remotes/origin/HEAD` names a ref that exists.
 #
@@ -51,14 +44,17 @@
 # Usage: origin_head_resolves [<repo-dir>]
 # Returns: 0 when it resolves — including when there is no symref at all, which
 #          is a FRESH CLONE rather than a corruption and has nothing to repair.
+#          A symref naming `plot-corpus-pin` is corrupt even when it resolves:
+#          that name is left behind only by an interrupted corpus run, never by
+#          a live one, since the corpus pins its own clone.
 origin_head_resolves() {
   local dir="${1:-.}" target
   target=$(git -C "$dir" symbolic-ref --quiet refs/remotes/origin/HEAD 2>/dev/null) || return 0
-  [ -n "$target" ] || return 0
+  case "$target" in '') return 0 ;; refs/remotes/origin/plot-corpus-pin) return 1 ;; esac
   git -C "$dir" rev-parse --verify --quiet "${target}^{commit}" >/dev/null 2>&1
 }
 
-# Repairs an unresolvable `refs/remotes/origin/HEAD`, and says what it did.
+# Repairs a `refs/remotes/origin/HEAD` that `origin_head_resolves` refuses, and says what it did.
 #
 # The repair is `git remote set-head origin --auto`, which asks the remote. It
 # is cheap — measured under a second — and it is the same command that fixed
@@ -70,16 +66,16 @@ origin_head_resolves() {
 #          this is a self-heal on a path that has its own refusal downstream,
 #          so it must never become a second way to stop.
 repair_origin_head() {
-  local dir="${1:-.}" was now
+  local dir="${1:-.}" was why
   origin_head_resolves "$dir" && return 0
 
   was=$(git -C "$dir" symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null || true)
+  why="does not resolve"; [ "$was" != origin/plot-corpus-pin ] || why="is the corpus pin, left by an interrupted corpus run"
   if ! git -C "$dir" remote set-head origin --auto >/dev/null 2>&1; then
-    echo "plot: origin/HEAD points at '$was', which does not resolve, and 'git remote set-head origin --auto' failed — the remote could not be asked." >&2
+    echo "plot: origin/HEAD points at '$was', which $why, and 'git remote set-head origin --auto' failed — the remote could not be asked." >&2
     return 0
   fi
-  now=$(git -C "$dir" symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null || true)
-  echo "plot: repaired origin/HEAD — it pointed at '$was', which does not exist on the remote; it now points at '${now:-<unset>}'." >&2
+  echo "plot: repaired origin/HEAD — it pointed at '$was', which $why; it now points at '$(git -C "$dir" symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null || echo '<unset>')'." >&2
   return 0
 }
 

package/plot-host.sh

@@ -3605,7 +3605,8 @@ case "$op" in
         *) die "pr-merged: unknown arg $1" ;;
       esac
     done
-    if [ "$be" = "github" ]; then
+    # NO REMOTE, NO PR: no repository holds one, so nothing merged, whatever gh's auth says.
+    if [ ${#repo_args[@]} -eq 0 ] && [ -z "$(git remote 2>/dev/null)" ]; then echo "not-merged"; elif [ "$be" = "github" ]; then
       # --state all, because a merged PR reports CLOSED and the default `open`
       # would hide every one of them. --limit 100 rather than 1: the newest PR
       # is not the merge, exactly as the state is not the merge.
@@ -4508,13 +4509,25 @@ case "$op" in
     # a network failure exits 4 here, the way the Jenkins arm does, so the
     # monitor reads *could not ask* and not *no run yet*.
     _gh_runs=$(gh run list --branch "$branch" --limit "$limit" \
-      --json headSha,conclusion,status,startedAt,url 2>/dev/null) \
+      --json headSha,conclusion,status,startedAt,url,databaseId 2>/dev/null) \
       || { echo "plot-host: run-for-sha — gh run list failed for '$branch'" >&2; exit 4; }
-    printf '%s' "$_gh_runs" | jq -c --arg sha "$sha" \
+    _gh_match=$(printf '%s' "$_gh_runs" | jq -c --arg sha "$sha" \
       '(map(select(.headSha == $sha)) | .[0]) | select(. != null)
        | {sha:.headSha, status:.status,
           conclusion:(if (.conclusion // "") == "" then null else .conclusion end),
-          url:.url, startedAt:.startedAt}' || exit 4
+          url:.url, startedAt:.startedAt, databaseId:.databaseId}') || exit 4
+    [ -n "$_gh_match" ] || exit 0
+    # ONE MORE CALL, ONLY FOR A CONCLUDED FAILURE (#1295): `gh run view --json
+    # jobs` is the only place a 0-step job (no runner ever picked up the run)
+    # shows up, apart from a real failure. A run still going or that
+    # succeeded costs no extra call.
+    _gh_db_id=$(printf '%s' "$_gh_match" | jq -r 'if (.conclusion == "failure" or .conclusion == "cancelled") then .databaseId else "" end')
+    _gh_match=$(printf '%s' "$_gh_match" | jq -c 'del(.databaseId)') || exit 4
+    [ -z "$_gh_db_id" ] && { printf '%s' "$_gh_match"; exit 0; }
+    # Slurped via stdin, never `--argjson`: that flag caps at 128 KB on Linux.
+    _gh_jobs=$(gh run view "$_gh_db_id" --json jobs 2>/dev/null) || { echo "plot-host: run-for-sha — gh run view failed" >&2; exit 4; }
+    jq -n -c --slurpfile match <(printf '%s' "$_gh_match") --slurpfile run <(printf '%s' "$_gh_jobs") \
+      '$match[0] + {jobs: [$run[0].jobs[] | {conclusion, steps: (.steps | length)}]}' || exit 4
     ;;
 
   issue-list)