@salesforce/afv-skills 1.42.0 → 1.44.0

package/skills/service-itsm-agentic-setup-fulfiller-agent-configure/scripts/classify-action-availability.mjs

@@ -12,16 +12,39 @@
 // after the fact is expensive; this classifier flags the mismatch BEFORE the
 // activate call.
 //
-// Two fixed rules (A9 — no prose interpretation):
-//   1. Enumerate every `svc_*__<ActionName>` token that appears inside a
-//      `source:` or `target:` line of the decoded Agent Script.
+// Availability model (A9 — no prose interpretation):
+//   Each action block in the Agent Script is a `source:` / `target:` pair:
+//     source: "svc_..._<AgentActionName>"           # the planner-facing alias
+//     target: "<scheme>://<InvocationTargetName>"    # the real invocation target
+//   The `source:` value is the agent-action alias; the `target:` URI names the
+//   thing actually invoked. These two names routinely DIFFER for the SAME action
+//   — e.g. source `CreateIncidentResolutionSummary` →
+//   target `generatePromptResponse://...IncidentResolutionSummarizationPrompt`,
+//   or source `CreateIncidentRootCauseSummary` → target `flow://...CreaIncRootCse`
+//   (an abbreviated flow API name). Treating the alias and the target as two
+//   separate required actions (the old behaviour) false-flagged the alias as
+//   "missing" and blocked a valid activation.
+//
+//   Only `generatePromptResponse://` targets are surfaced by
+//   `/actions/custom/generatePromptResponse`; `flow://`, `apex://`, and
+//   `standardInvocableAction://` targets live in other action buckets the
+//   endpoint never lists (their names are often not even namespace-prefixed,
+//   e.g. `associateSvcMgmntRecords`). So this gate can only verify the
+//   `generatePromptResponse://` targets, keyed on the TARGET name — never the
+//   source alias, never a non-prompt target. Rules:
+//   1. Parse every `target:` URI; split by scheme. The checkable set is the
+//      `generatePromptResponse://` target names. Non-gPR targets are recorded
+//      and SKIPPED (this endpoint has no jurisdiction over them).
 //   2. Enumerate every action name exposed by
 //      `/actions/custom/generatePromptResponse` — accepts both response shapes:
 //        (a) legacy `{ actions: [ { name, ... }, ... ] }`
 //        (b) newer  `{ actions: { <fullyQualifiedName>: {...}, ... } }`
-//   Emit `missing = referenced - present`. If missing.length > 0 ⇒ verdict
-//   NOT-READY. On non-parseable inputs, verdict is CANNOT-CONFIRM (never block
-//   on unreadable state — surface it and let the workflow decide).
+//   Emit `missing = <generatePromptResponse targets> - present`. missing.length
+//   > 0 ⇒ NOT-READY (the ITSM Intelligence permset that surfaces these
+//   prompt-response actions is not assigned for the running user). Zero gPR
+//   targets referenced but other targets present ⇒ READY (nothing this gate
+//   governs). No target: lines at all / non-parseable inputs ⇒ CANNOT-CONFIRM
+//   (never block on unreadable state — surface it and let the workflow decide).
 //
 // Usage:
 //   node classify-action-availability.mjs \
@@ -30,7 +53,8 @@
 // <agent-templates.json>          — Phase-1 `agent-templates` capture; the matched
 //                                    template's `agentScript` is decoded exactly
 //                                    like build-create-body.mjs decodes it, then
-//                                    scanned for source:/target: action tokens.
+//                                    its `target:` invocation URIs are parsed and
+//                                    split by scheme.
 // <masterLabel>                   — the display label of the target template
 //                                    (e.g. "IT Service Fulfiller").
 // <generate-prompt-response.json> — GET
@@ -38,9 +62,10 @@
 //                                    response body.
 //
 // Emits a single JSON object to stdout:
-//   { referenced: [...],
-//     present:    [...],
-//     missing:    [...],
+//   { referenced: [...],   // generatePromptResponse:// target names this gate verifies
+//     present:    [...],   // action names surfaced by generatePromptResponse
+//     missing:    [...],   // referenced - present
+//     skippedNonPromptTargets: [ { scheme, name }, ... ], // flow/apex/standard — not gate-checkable
 //     verdict: "READY" | "NOT-READY" | "CANNOT-CONFIRM",
 //     reasons: [...] }
 // Exit is always 0 on parseable inputs; the verdict is carried in the payload.
@@ -49,6 +74,7 @@
 // READY.
 
 import { readFileSync } from 'node:fs';
+import { stripReleaseManagement, decodeAgentScriptEntities } from './strip-release-management.mjs';
 
 function readJson(path) {
   try {
@@ -60,52 +86,46 @@ function readJson(path) {
   }
 }
 
-// Multi-pass HTML entity decode — matches build-create-body.mjs so both see the
-// same script content. Connect API bodies can be double-encoded.
-const NAMED = { amp: '&', quot: '"', apos: "'", lt: '<', gt: '>', '#39': "'", nbsp: ' ' };
-function decodeEntitiesOnce(s) {
-  return s.replace(/&(#?\w+);/g, (m, ref) => {
-    if (ref.startsWith('#')) {
-      const n = ref[1] === 'x' || ref[1] === 'X' ? parseInt(ref.slice(2), 16) : parseInt(ref.slice(1), 10);
-      return Number.isFinite(n) ? String.fromCodePoint(n) : m;
-    }
-    return Object.prototype.hasOwnProperty.call(NAMED, ref) ? NAMED[ref] : m;
-  });
-}
-function decodeEntities(s) {
-  let prev = s, next = decodeEntitiesOnce(s);
-  while (next !== prev) { prev = next; next = decodeEntitiesOnce(next); }
-  return next;
-}
-
-function extractReferencedActions(scriptText) {
-  // Only lines whose YAML key is `source` or `target` are load-bearing — a
-  // namespace-prefixed action name mentioned inside a description, instruction,
-  // or comment is documentation, not a required invocation. Scanning globally
-  // would mis-flag such a mention as NOT-READY and block a valid activation.
+function extractTargets(scriptText) {
+  // Each action block pairs a `source:` alias with a `target:` invocation URI:
+  //   source: "svc_itsm_intelligence__CreateIncidentResolutionSummary"
+  //   target: "generatePromptResponse://svc_itsm_intelligence__IncidentResolutionSummarizationPrompt"
   //
-  // Agent Script YAML forms observed:
-  //   source: "svc_itsm_intelligence__SummarizeIncident"
-  //   source: svc_itsm_intelligence__SummarizeIncident
-  //   target: "generatePromptResponse://svc_itsm_intelligence__SummarizeIncident"
-  //   - source: "..."
+  // Only the `target:` names the thing actually invoked, and only a
+  // `generatePromptResponse://` target is surfaced (or withheld, per the ITSM
+  // Intelligence permset) by /actions/custom/generatePromptResponse. `flow://`,
+  // `apex://`, and `standardInvocableAction://` targets are surfaced through
+  // other mechanisms and never appear in that endpoint, so they are recorded and
+  // skipped rather than mis-flagged as missing. The `source:` alias is never
+  // itself a generatePromptResponse entry — it is not part of the checkable set;
+  // scanning it (the old behaviour) false-flagged aliases whose real target IS
+  // present, blocking a valid activation.
   //
-  // The key line regex tolerates leading whitespace, an optional YAML list dash,
-  // and both quoted and unquoted scalar values (single line). Block scalars
-  // (`source: |`) are extraordinarily rare for these fields and safely fall
-  // through to CANNOT-CONFIRM when nothing is extracted.
-  const referenced = new Set();
-  const tokenRe = /\bsvc_[a-z0-9_]+__[A-Za-z][A-Za-z0-9_]*\b/g;
-  const keyLineRe = /^[ \t]*-?[ \t]*(?:source|target)[ \t]*:[ \t]*(.*)$/;
+  // The regex tolerates leading whitespace, an optional YAML list dash, and the
+  // scalar value in ANY of its YAML quote forms — unquoted, single-quoted, or
+  // double-quoted. The opening quote (if any) is captured in group 1 and the same
+  // character is re-checked as the optional closing quote via a backreference, so
+  // `target: 'generatePromptResponse://Name'` parses exactly like the double-quoted
+  // and unquoted forms (accepting only `"?` before was a regression: a
+  // single-quoted target silently fell through to CANNOT-CONFIRM, and the workflow
+  // then proceeded to create an agent whose activation fails). The name after `://`
+  // is captured up to the next quote (either style) or whitespace. A target with no
+  // `scheme://` shape simply does not match and contributes nothing.
+  const gpr = new Set();
+  const other = [];
+  const targetLineRe = /^[ \t]*-?[ \t]*target[ \t]*:[ \t]*(['"]?)([A-Za-z][A-Za-z0-9]*):\/\/([^'"\s]+)\1?/;
   for (const rawLine of scriptText.split(/\r?\n/)) {
-    const km = keyLineRe.exec(rawLine);
-    if (!km) continue;
-    const value = km[1];
-    for (const m of value.matchAll(tokenRe)) {
-      referenced.add(m[0]);
+    const m = targetLineRe.exec(rawLine);
+    if (!m) continue;
+    const scheme = m[2];
+    const name = m[3];
+    if (scheme === 'generatePromptResponse') {
+      gpr.add(name);
+    } else {
+      other.push({ scheme, name });
     }
   }
-  return [...referenced].sort();
+  return { gprTargets: [...gpr].sort(), otherTargets: other };
 }
 
 function extractPresentActions(actionsData) {
@@ -136,7 +156,12 @@ function findTemplateScript(agentTemplatesData, masterLabel) {
   const wanted = String(masterLabel).trim().toLowerCase();
   const match = items.find((it) => String(it?.masterLabel ?? '').trim().toLowerCase() === wanted);
   if (!match || typeof match.agentScript !== 'string' || !match.agentScript.trim()) return null;
-  return decodeEntities(match.agentScript);
+  // Scan the SAME script the create actually ships — with the Release
+  // Management subagent stripped. build-create-body.mjs removes it, so
+  // `svc_itsm_intelligence__SummarizeRelease` is never referenced by the created
+  // agent; leaving it in the scanned text here would false-flag it as "missing"
+  // and block the very flow the strip unblocks on an org without ReleaseManagementPref.
+  return stripReleaseManagement(decodeAgentScriptEntities(match.agentScript)).text;
 }
 
 const [templatesPath, rawLabel, actionsPath] = process.argv.slice(2);
@@ -175,27 +200,42 @@ if (!scriptText) {
   process.exit(0);
 }
 
-const referenced = extractReferencedActions(scriptText);
+const { gprTargets: referenced, otherTargets } = extractTargets(scriptText);
 const present = extractPresentActions(actionsRead.data);
 const presentSet = new Set(present);
 const missing = referenced.filter((r) => !presentSet.has(r));
+const skippedNonPromptTargets = otherTargets;
 
 let verdict, reasons;
 if (referenced.length === 0) {
-  verdict = 'CANNOT-CONFIRM';
-  reasons = ['No svc_*__ action tokens were found in the decoded Agent Script — either the script does not use namespace-prefixed invocables or decoding failed. Surface and continue with caution.'];
+  if (otherTargets.length > 0) {
+    // The template references only flow/apex/standard-invocable targets — none of
+    // which /actions/custom/generatePromptResponse governs. There is nothing for
+    // this permset gate to verify, so it must not block.
+    verdict = 'READY';
+    reasons = [
+      `No generatePromptResponse-backed actions are referenced by the template; the ${otherTargets.length} non-prompt target(s) (flow/apex/standard-invocable) are surfaced through other mechanisms and are outside this gate.`,
+    ];
+  } else {
+    verdict = 'CANNOT-CONFIRM';
+    reasons = ['No target: invocation URIs were found in the decoded Agent Script — either the script shape is unexpected or decoding failed. Surface and continue with caution.'];
+  }
 } else if (missing.length === 0) {
   verdict = 'READY';
-  reasons = [`All ${referenced.length} template-referenced invocable action(s) are surfaced by /actions/custom/generatePromptResponse for the running user.`];
+  reasons = [
+    `All ${referenced.length} generatePromptResponse-backed action(s) referenced by the template are surfaced by /actions/custom/generatePromptResponse for the running user${
+      otherTargets.length ? ` (${otherTargets.length} non-prompt flow/standard-invocable target(s) are outside this gate and were not checked)` : ''
+    }.`,
+  ];
 } else {
   verdict = 'NOT-READY';
   reasons = [
-    `${missing.length} of ${referenced.length} template-referenced invocable action(s) are NOT surfaced by /actions/custom/generatePromptResponse for the running user.`,
+    `${missing.length} of ${referenced.length} generatePromptResponse-backed action(s) referenced by the template are NOT surfaced by /actions/custom/generatePromptResponse for the running user.`,
     `Missing: ${missing.join(', ')}`,
     'Activate will succeed at the HTTP level but return {success:false, messages:[...]} — the agent will not be usable. Offer to hand off to service-itsm-agentic-setup-itsm-agentforce-permset-assign, which handles both the permset-not-assigned case and the package-not-installed case.',
   ];
 }
 
 process.stdout.write(JSON.stringify({
-  referenced, present, missing, verdict, reasons,
+  referenced, present, missing, skippedNonPromptTargets, verdict, reasons,
 }, null, 2) + '\n');

package/skills/service-itsm-agentic-setup-fulfiller-agent-configure/scripts/render-report.mjs

@@ -161,6 +161,15 @@ const NEXT_STEPS = {
       : 'Review the observed error and remediate. Enablement of missing prerequisites is a Setup-UI/admin action outside this skill\'s scope — use `service-itsm-agentic-setup-agentforce-studio-validate` or `service-itsm-agentic-setup-agentforce-studio-configure` to check/enable readiness first. Re-run this skill once the blocker is resolved.',
 };
 
+// Escape a value for a Markdown table cell — a literal pipe or newline would
+// break the row. The stage-detail values are enumerated/controlled, so this is
+// belt-and-braces, but it keeps the table well-formed against any future field.
+const cell = (v) => String(v).replace(/\|/g, '\\|').replace(/\r?\n/g, ' ');
+const confirmDetail =
+  confirm === 'true' && (devName !== '<pending>' || label !== '<pending>')
+    ? `; confirmed developerName=${devName}, label="${label}"`
+    : '';
+
 const report = `# Fulfiller Agent — Create & Activate
 
 IT Service Fulfiller Agent Creation (via service-itsm-agentic-setup-fulfiller-agent-configure)
@@ -168,13 +177,17 @@ IT Service Fulfiller Agent Creation (via service-itsm-agentic-setup-fulfiller-ag
 Org:      ${org} (API v67.0)
 Agent:    ${devName} ("${label}") — NGA-native bundle
 
-  Preflight  ......................... Studio hasAccess=${preStudio}; template agentScript present=${preTmpl}; verdict=${preVerdict}
-  Enumerate  ......................... target agent exists before write=${enumExists}; latest version status=${enumVer}; verdict=${enumVerdict}
-  Confirm-to-write ................... user-confirmed=${confirm}${(confirm === 'true' && (devName !== '<pending>' || label !== '<pending>')) ? `; confirmed developerName=${devName}, label="${label}"` : ''}
-  Create bundle ...................... ${createBundle}
-  Publish ............................ ${publish}
-  Activate ........................... ${activate}
-  Verify ............................. ${verify}
+Stage 2 — install & activate the agent from its template:
+
+| Stage | Status |
+| --- | --- |
+| Preflight | ${cell(`Studio hasAccess=${preStudio}; template agentScript present=${preTmpl}; verdict=${preVerdict}`)} |
+| Enumerate | ${cell(`target agent exists before write=${enumExists}; latest version status=${enumVer}; verdict=${enumVerdict}`)} |
+| Confirm-to-write | ${cell(`user-confirmed=${confirm}${confirmDetail}`)} |
+| Create bundle | ${cell(createBundle)} |
+| Publish | ${cell(publish)} |
+| Activate | ${cell(activate)} |
+| Verify | ${cell(verify)} |
 
 Verdict: ${verdict}
 Reason:  ${reason}

package/skills/service-itsm-agentic-setup-fulfiller-agent-configure/scripts/strip-release-management.mjs

@@ -0,0 +1,176 @@
+#!/usr/bin/env node
+// Strip the Release Management subagent from the decoded Fulfiller Agent Script.
+//
+// WHY: the shipped ITSM Fulfiller template ships a `topic
+// ReleaseManagement:` subagent whose only action, `SummarizeRelease`, is sourced
+// from the `svc_itsm_intelligence__SummarizeRelease` invocable. That invocable is
+// gated behind Release Management (the `ReleaseManagementPref` org preference /
+// `ReleaseManagerPermSet`) and is NOT surfaced by
+// `/actions/custom/generatePromptResponse` on an org that has not enabled it. When
+// the Agent Script references an unsurfaced action, `activate` returns HTTP 200
+// with a `{success:false, "... does not exist"}` silent-failure body and the agent
+// never comes up. Rather than force every Fulfiller install to also flip on
+// Release Management, the approved workaround is to remove the Release Management
+// subagent entirely from the script we create the agent from — the Fulfiller agent
+// then activates cleanly on any Agentforce-for-IT-Service org without the pref.
+//
+// The removal is deliberately COMPLETE — leaving the `go_to_ReleaseManagement`
+// transition behind would dangle a `@topic.ReleaseManagement` reference to a topic
+// that no longer exists. Three surfaces are removed:
+//   1. the top-level `topic ReleaseManagement:` block (carries the SummarizeRelease
+//      action's `source:`/`target:` — the actual dependency);
+//   2. the `go_to_ReleaseManagement:` transition + its description inside
+//      `start_agent topic_selector:` (would otherwise dangle);
+//   3. the "- Route to ReleaseManagement ..." routing bullet in the selector's
+//      reasoning instructions (cosmetic, but part of a complete removal).
+//
+// The function operates on the ALREADY-DECODED Agent Script text (post
+// HTML-entity decode). It is a no-op — returns the input unchanged with
+// `removed.topic === 0` — if no `topic ReleaseManagement:` block is present, so it
+// is safe to call unconditionally and against future template revisions.
+//
+// This module is imported by both `build-create-body.mjs` (the create body must
+// not reference the gated action) and `classify-action-availability.mjs` (the
+// Phase-2c gate must scan the SAME post-strip script, otherwise it would still
+// flag SummarizeRelease as "missing" and block the very flow this strip
+// unblocks). The two callers MUST stay in lock-step; both the entity decode
+// (`decodeAgentScriptEntities`) and the strip (`stripReleaseManagement`) live
+// here and are imported by both callers, so the shipped script and the scanned
+// script are byte-identical up to and including the transform.
+
+// ── Shared HTML-entity decoder ──────────────────────────────────────────────
+// The `agentScript` arrives HTML-entity-encoded (sometimes double-encoded).
+// BOTH callers — build-create-body.mjs (ships the bundle) and
+// classify-action-availability.mjs (scans it) — MUST decode it identically
+// before the strip runs, or the scanned script and the shipped script can
+// diverge on an entity one decoder handles and the other doesn't (e.g. hex
+// `'`, `'`, ` `), reintroducing exactly the alias/target
+// divergence the shared strip exists to prevent. Keeping ONE decoder here,
+// alongside the strip, makes both callers byte-identical up to AND including
+// the transform — not just for the strip step.
+const NAMED_ENTITIES = { amp: '&', quot: '"', apos: "'", lt: '<', gt: '>', '#39': "'", nbsp: ' ' };
+function decodeEntitiesOnce(s) {
+  return s.replace(/&(#?\w+);/g, (m, ref) => {
+    if (ref.startsWith('#')) {
+      const n = ref[1] === 'x' || ref[1] === 'X' ? parseInt(ref.slice(2), 16) : parseInt(ref.slice(1), 10);
+      return Number.isFinite(n) ? String.fromCodePoint(n) : m;
+    }
+    return Object.prototype.hasOwnProperty.call(NAMED_ENTITIES, ref) ? NAMED_ENTITIES[ref] : m;
+  });
+}
+
+/**
+ * Fully decode HTML entities in a template `agentScript`, unwinding multi-level
+ * encoding by re-running until the text stabilises. Shared by
+ * build-create-body.mjs and classify-action-availability.mjs so the shipped and
+ * scanned scripts are decoded identically.
+ * @param {string} text encoded agentScript
+ * @returns {string} decoded text
+ */
+export function decodeAgentScriptEntities(text) {
+  let prev = String(text);
+  let next = decodeEntitiesOnce(prev);
+  while (next !== prev) { prev = next; next = decodeEntitiesOnce(next); }
+  return next;
+}
+
+// The `topic ReleaseManagement:` block ends at the next TOP-LEVEL section — a
+// non-blank line beginning in column 0. Top-level Agent Script keys are never
+// indented; a topic block's contents always are. Detecting the boundary by
+// column-0 position rather than by enumerating known section keywords
+// (`topic `/`start_agent `/`system:`/…) means a template revision that adds or
+// reorders a top-level key — a global `actions:` manifest, a trailing
+// `description:`, any new DSL key — still bounds the block correctly instead of
+// letting the scan run to EOF and swallow that trailing content. Blank lines
+// never bound the block (they read as block-internal).
+const isTopLevelBoundary = (l) => /^\S/.test(l);
+
+/**
+ * Remove the Release Management subagent from a decoded Fulfiller Agent Script.
+ * @param {string} scriptText decoded (post-HTML-entity) Agent Script YAML text
+ * @returns {{ text: string, removed: { topic: number, goto: number, bullet: number, residual: number } }}
+ *   `removed.residual` is the count of ReleaseManagement/SummarizeRelease tokens
+ *   that survive in the stripped text — a non-zero value means the template
+ *   references the gated action outside the three stripped surfaces and the
+ *   caller should warn (see completeness guard below).
+ */
+export function stripReleaseManagement(scriptText) {
+  const lines = String(scriptText).split(/\r?\n/);
+  const out = [];
+  const removed = { topic: 0, goto: 0, bullet: 0 };
+
+  for (let i = 0; i < lines.length; i += 1) {
+    const line = lines[i];
+
+    // 1) Top-level `topic ReleaseManagement:` block — runs until the next
+    //    top-level section or EOF.
+    if (/^topic\s+ReleaseManagement\s*:/.test(line)) {
+      let j = i + 1;
+      while (j < lines.length && !isTopLevelBoundary(lines[j])) j += 1;
+      removed.topic += j - i;
+      i = j - 1; // resume at the next top-level section (or EOF)
+      continue;
+    }
+
+    // 2) Indented `go_to_ReleaseManagement:` transition block inside the topic
+    //    selector — the header line plus every following line more-indented than
+    //    it (its `description:` child). Stops at the first non-blank sibling
+    //    (indent <= the header's indent).
+    const gotoMatch = /^(\s*)go_to_ReleaseManagement\s*:/.exec(line);
+    if (gotoMatch) {
+      const baseIndent = gotoMatch[1].length;
+      let j = i + 1;
+      while (j < lines.length) {
+        if (lines[j].trim() === '') {
+          // Blank line: only part of the block if the next non-blank line is
+          // deeper than the header; otherwise the block has ended.
+          let k = j;
+          while (k < lines.length && lines[k].trim() === '') k += 1;
+          if (k >= lines.length) { j = k; break; }
+          if (lines[k].match(/^\s*/)[0].length <= baseIndent) break;
+          j = k;
+          continue;
+        }
+        if (lines[j].match(/^\s*/)[0].length <= baseIndent) break;
+        j += 1;
+      }
+      removed.goto += j - i;
+      i = j - 1;
+      continue;
+    }
+
+    // 3) Routing bullet naming ReleaseManagement in the selector's reasoning
+    //    instructions block scalar.
+    if (/^\s*-\s*Route to ReleaseManagement\b/.test(line)) {
+      removed.bullet += 1;
+      continue;
+    }
+
+    out.push(line);
+  }
+
+  const text = out.join('\n');
+  // Completeness guard: the strip removes three KNOWN
+  // surfaces (topic block, go_to transition, routing bullet). If a future
+  // template references ReleaseManagement / SummarizeRelease from somewhere else
+  // — a global action registry, a variable, a start_agent action list — that
+  // reference dangles and reintroduces the {success:false} activate body the
+  // strip exists to prevent. Count any survivor so callers can warn rather than
+  // silently ship (or scan) a half-stripped script.
+  removed.residual = (text.match(/ReleaseManagement|SummarizeRelease/g) || []).length;
+  return { text, removed };
+}
+
+// CLI shim for debugging: `node strip-release-management.mjs <decoded-script.yaml>`
+// prints the stripped script to stdout and the removal counts to stderr.
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const { readFileSync } = await import('node:fs');
+  const path = process.argv[2];
+  if (!path) {
+    process.stderr.write('usage: node strip-release-management.mjs <decoded-script.yaml>\n');
+    process.exit(2);
+  }
+  const { text, removed } = stripReleaseManagement(readFileSync(path, 'utf8'));
+  process.stderr.write(`removed ${JSON.stringify(removed)}\n`);
+  process.stdout.write(text);
+}

package/skills/service-itsm-agentic-setup-itsm-agentforce-permset-assign/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: service-itsm-agentic-setup-itsm-agentforce-permset-assign
-description: "Resolve missing ITSM Intelligence invocable actions so a Fulfiller NGA agent can activate. Reads which of the four Core Fulfiller persona permsets (IncidentFulfiller, ProblemFulfillerPermSet, ChangeRequestFulfillerPermSet, ReleaseManagerPermSet) are provisioned, then assigns the running user the selected persona (plus backing PSL when license-gated) so svc_itsm_intelligence__* actions surface; hands off to service-itsm-agentic-setup-agentforce-studio-validate if none are provisioned. Use when the Fulfiller agent-configure skill reports missing actions on activate, when 'Invocable action svc_itsm_intelligence__X does not exist' surfaces, or when a user asks to grant themselves Fulfiller prompt-template access. DO NOT TRIGGER for Employee-agent access, Agentforce for IT Service toggles, agent creation, CMDB access, or generic permset assignment."
+description: "Resolve missing ITSM Intelligence invocable actions so a Fulfiller NGA agent can activate. Reads which of the three Core Fulfiller persona permsets (IncidentFulfiller, ProblemFulfillerPermSet, ChangeRequestFulfillerPermSet) are provisioned, then assigns the running user the selected persona (plus backing PSL when license-gated) so svc_itsm_intelligence__* actions surface; hands off to service-itsm-agentic-setup-agentforce-studio-validate if none are provisioned. Use when the Fulfiller agent-configure skill reports missing actions on activate, when 'Invocable action svc_itsm_intelligence__X does not exist' surfaces, when a user asks to grant themselves Fulfiller prompt-template access, when asked to assign the Incident, Problem, or Change Fulfiller persona permission set, or when resolving missing ITSM Intelligence action access for the Fulfiller agent. DO NOT TRIGGER for Employee-agent access, Agentforce for IT Service toggles, agent creation, CMDB access, or generic permset assignment."
 metadata:
-  version: "1.0"
+  version: "1.1"
   domains: ["Service", "Agentforce"]
   minApiVersion: "67.0"
   relatedSkills:
@@ -28,9 +28,9 @@ allowed-tools: |
 
 Grants the **running user** one of the Core-shipped **Fulfiller persona permission sets** that expose the `svc_itsm_intelligence__*` prompt-template **invocable actions** on the target org — the actions the Fulfiller NGA agent scripts reference via `source:` / `target: generatePromptResponse://...`. When those invocables are not surfaced by `/services/data/v67.0/actions/custom/generatePromptResponse` for the running user, the Fulfiller agent-configure skill's Phase 6 `activate` call returns **HTTP 200** with a silent `{success:false, messages:[{... "does not exist"}]}` body and the agent never becomes usable. This skill fixes that gap by assigning the correct Fulfiller persona permset (and its backing license when one exists) — **or**, when no Fulfiller persona permset is provisioned on the org at all, hands off to the Agentforce Studio configure/validate skill so the ITSM AddOn(s) can be enabled first.
 
-The four Fulfiller persona permsets, their AddOns, PSLs, and the userPerms they grant are documented in `references/permset-topology.md`. All are Core-shipped in namespace `force` — there is no managed-package namespaced permset for this feature.
+The three Fulfiller persona permsets, their AddOns, PSLs, and the userPerms they grant are documented in `references/permset-topology.md`. All are Core-shipped in namespace `force` — there is no managed-package namespaced permset for this feature.
 
-**Employee agent is out of scope.** The Employee NGA agent's access model is separate (org-preferences + a different persona layer) and does not map onto these four persona permsets.
+**Employee agent is out of scope.** The Employee NGA agent's access model is separate (org-preferences + a different persona layer) and does not map onto these three persona permsets.
 
 Every call runs through the **Salesforce CLI (`sf`)**:
 - `sf api request rest` — authenticated Connect API GET (identity, verify read).
@@ -40,7 +40,7 @@ Every call runs through the **Salesforce CLI (`sf`)**:
 
 ## Scope
 
-- **In scope**: detecting which of the four Fulfiller persona permsets (`IncidentFulfiller`, `ProblemFulfillerPermSet`, `ChangeRequestFulfillerPermSet`, `ReleaseManagerPermSet`) are provisioned on the org, letting the user pick which persona to assign, checking existing assignments, assigning the permission-set license (when the persona is license-gated) and permission set to the running user (or a named user), verifying the target `svc_itsm_intelligence__*` invocable actions surface via a follow-up `/actions/custom/generatePromptResponse` read.
+- **In scope**: detecting which of the three Fulfiller persona permsets (`IncidentFulfiller`, `ProblemFulfillerPermSet`, `ChangeRequestFulfillerPermSet`) are provisioned on the org, letting the user pick which persona to assign, checking existing assignments, assigning the permission-set license (when the persona is license-gated) and permission set to the running user (or a named user), verifying the target `svc_itsm_intelligence__*` invocable actions surface via a follow-up `/actions/custom/generatePromptResponse` read.
 - **Out of scope**: Employee-agent access (different access model, different skill), installing/enabling the ITSM AddOn(s) or content bundle (hand off to `service-itsm-agentic-setup-agentforce-studio-validate`), enabling org-level Agentforce feature toggles, creating a permission set, creating or activating the Fulfiller agent (that's `service-itsm-agentic-setup-fulfiller-agent-configure`), CMDB access (`service-itsm-agentic-setup-cmdb-access-assign`), generic non-ITSM permission-set assignment (`dx-org-permission-set-assign`).
 
 ## Mechanism
@@ -48,9 +48,9 @@ Every call runs through the **Salesforce CLI (`sf`)**:
 Two branches, decided by a read-only detection step first:
 
 - **Branch A — one or more Fulfiller persona permsets exist on the org.** Ask the user which persona to assign (do not auto-select — a Fulfiller commonly needs only one). Idempotent assign: PSL first when the persona is license-gated, then permission set, verified by read-back and by a follow-up `/actions/custom/generatePromptResponse` read.
-- **Branch B — none of the four Fulfiller persona permsets exist on the org.** The ITSM AddOn(s) are not provisioned; permset-assign is a no-op. STOP and hand off to `service-itsm-agentic-setup-agentforce-studio-validate` so the AddOn(s) can be enabled first.
+- **Branch B — none of the three Fulfiller persona permsets exist on the org.** The ITSM AddOn(s) are not provisioned; permset-assign is a no-op. STOP and hand off to `service-itsm-agentic-setup-agentforce-studio-validate` so the AddOn(s) can be enabled first.
 
-The two-branch shape is deliberate — the failure signature ("`svc_itsm_intelligence__X` does not exist" on activate) looks identical whether a persona is present-and-unassigned or the AddOn is absent entirely, and there is no way to tell from the activate response alone. The pre-check on the four persona `PermissionSet` names is what disambiguates them.
+The two-branch shape is deliberate — the failure signature ("`svc_itsm_intelligence__X` does not exist" on activate) looks identical whether a persona is present-and-unassigned or the AddOn is absent entirely, and there is no way to tell from the activate response alone. The pre-check on the three persona `PermissionSet` names is what disambiguates them.
 
 ## Four helper scripts (all invoked via `Bash`) hold every deterministic decision (A9). Full I/O contracts in `references/helper-contracts.md`; workflow-level usage summarized below:
 
@@ -77,7 +77,7 @@ Ask only what cannot be inferred from conversation:
 
 - **Target org** — the `sf` alias. Default to `sf config get target-org` if unset.
 - **Target user** — default to the **running user** (resolved via `scripts/resolve-target-user.mjs`). If the user asks to assign on behalf of a named user, resolve them by `Username` first.
-- **Which Fulfiller persona?** Incident / Problem / Change / Release. Only ask about personas that are actually provisioned on the org (from `candidates[]`). Do not auto-select — a Fulfiller commonly needs only one persona (e.g. Incident) even when others are provisioned.
+- **Which Fulfiller persona?** Incident / Problem / Change. Only ask about personas that are actually provisioned on the org (from `candidates[]`). Do not auto-select — a Fulfiller commonly needs only one persona (e.g. Incident) even when others are provisioned.
 - **Confirm the write** — assigning a permission-set license consumes a seat and takes effect for a live user session. Present the target user + org + persona permset name, and require an explicit "yes" via `AskUserQuestion` before writing.
 
 ---
@@ -88,15 +88,15 @@ All calls go through `sf`; substitute `<alias>` with the target org.
 
 ### Phase 1 — Read: which Fulfiller persona permsets are provisioned on this org?
 
-1. Query `PermissionSet` for the four known Fulfiller persona DeveloperNames:
+1. Query `PermissionSet` for the three known Fulfiller persona DeveloperNames:
 
    ```bash
    sf data query \
-     -q "SELECT Id, Name, Label, LicenseId FROM PermissionSet WHERE Name IN ('IncidentFulfiller','ProblemFulfillerPermSet','ChangeRequestFulfillerPermSet','ReleaseManagerPermSet')" \
+     -q "SELECT Id, Name, Label, LicenseId FROM PermissionSet WHERE Name IN ('IncidentFulfiller','ProblemFulfillerPermSet','ChangeRequestFulfillerPermSet')" \
      --target-org <alias> --json > /tmp/itsm-personas.json 2>/tmp/itsm-personas.err || true
    ```
 
-   (The `PermissionSet` namespace on all four is `force` — do NOT filter by `NamespacePrefix`.)
+   (The `PermissionSet` namespace on all three is `force` — do NOT filter by `NamespacePrefix`.)
 
 2. Classify:
 
@@ -106,7 +106,7 @@ All calls go through `sf`; substitute `<alias>` with the target org.
 
    The classifier prints `{ personasFound, personasMissing, candidates, verdict, reasons }`, where each `candidates[]` row is `{Id, Name, Label, LicenseId, needsPsl}`:
    - `verdict:"ASSIGN"` (≥1 persona present) ⇒ continue to Phase 2. Present the `personasFound` list to the user via `AskUserQuestion` and get the selected persona; record its `Id`, `LicenseId`, and `needsPsl` — they drive whether Phase 2b/2d touch the PSL at all.
-   - `verdict:"HAND-OFF"` (none of the four personas present) ⇒ Phase 2 is impossible on this org; go to Phase 3 (Branch B hand-off).
+   - `verdict:"HAND-OFF"` (none of the three personas present) ⇒ Phase 2 is impossible on this org; go to Phase 3 (Branch B hand-off).
    - `verdict:"CANNOT-CONFIRM"` (query failed) ⇒ surface the raw CLI error verbatim; stop.
 
 ### Phase 2 — Assign path (Branch A)
@@ -149,7 +149,7 @@ All calls go through `sf`; substitute `<alias>` with the target org.
 2d. **Assign** — order depends on the selected persona's `needsPsl`:
 
    - **`needsPsl:true`** — POST the PSL to `/sobjects/PermissionSetLicenseAssign` FIRST, then run `sf org assign permset --name <permsetName> --on-behalf-of <userId>`. Assigning the permission set without the PSL sticks the assignment but the license backing it never activates. Exact call shapes: `references/cli-invocation.md`.
-   - **`needsPsl:false`** — SKIP the PSL POST entirely; run `sf org assign permset` only. (This is normal for `ReleaseManagerPermSet` — its Fulfiller gating is on the org-preference layer, not on a PSL. Assigning the permset is still the correct write.)
+   - **`needsPsl:false`** — SKIP the PSL POST entirely; run `sf org assign permset` only. (A persona whose `PermissionSet` has no backing `LicenseId` is not license-gated — there is no PSL seat to hold, so assigning the permset alone is the correct and complete write.) _Retained defensively:_ every shipped persona is now PSL-backed (`needsPsl` is derived per-row from `LicenseId`), so this `false` branch and its `NO-PSL` wiring are currently unexercised by shipped data — kept for correctness against a future persona whose `PermissionSet` carries no backing `LicenseId`.
 
    Response handling:
    - `201` on POST / `success:true` on `sf org assign permset` ⇒ assigned.
@@ -158,9 +158,9 @@ All calls go through `sf`; substitute `<alias>` with the target org.
 
 ### Phase 3 — Hand-off path (Branch B: no Fulfiller persona provisioned)
 
-3. When Phase 1 returns `verdict:"HAND-OFF"`, none of the four Fulfiller persona permsets exist on this org — the ITSM AddOn(s) are not provisioned. Permset-assign is a no-op in this state. Present the discovery via `AskUserQuestion`:
+3. When Phase 1 returns `verdict:"HAND-OFF"`, none of the three Fulfiller persona permsets exist on this org — the ITSM AddOn(s) are not provisioned. Permset-assign is a no-op in this state. Present the discovery via `AskUserQuestion`:
 
-   _"None of the Fulfiller persona permission sets (Incident, Problem, Change, Release) is provisioned on this org — no permset can grant access to actions that don't exist yet. Run `service-itsm-agentic-setup-agentforce-studio-validate` to diagnose which AddOn needs enabling?"_ (options: **Yes, run the readiness check** / **No, stop here**).
+   _"None of the Fulfiller persona permission sets (Incident, Problem, Change) is provisioned on this org — no permset can grant access to actions that don't exist yet. Run `service-itsm-agentic-setup-agentforce-studio-validate` to diagnose which AddOn needs enabling?"_ (options: **Yes, run the readiness check** / **No, stop here**).
 
    - On **Yes**: delegate to `service-itsm-agentic-setup-agentforce-studio-validate` and let it recommend the configure/bundle-deploy skill.
    - On **No**: stop and report the current state (no persona provisioned, cannot assign) — no writes.
@@ -192,7 +192,7 @@ All calls go through `sf`; substitute `<alias>` with the target org.
 
 | Constraint | Rationale |
 |-----------|-----------|
-| Detect Fulfiller persona presence via the four fixed `PermissionSet.Name` values BEFORE any permset write | The failure signature ("action does not exist" on activate) is identical for AddOn-absent and permset-not-assigned; only the pre-check disambiguates them. The four personas are Core-shipped in namespace `force` — a `NamespacePrefix` filter never returns them |
+| Detect Fulfiller persona presence via the three fixed `PermissionSet.Name` values BEFORE any permset write | The failure signature ("action does not exist" on activate) is identical for AddOn-absent and permset-not-assigned; only the pre-check disambiguates them. The three personas are Core-shipped in namespace `force` — a `NamespacePrefix` filter never returns them |
 | Ask the user which persona to assign — never auto-select | A Fulfiller commonly needs only one persona (e.g. Incident). Auto-assigning the first row returned would over-grant |
 | All decisions are made by helper scripts, never by prose | Assignment/idempotency logic is deterministic; prose interpretation is not (A9) |
 | Assign the PSL before the permission set — ONLY when the selected persona's `needsPsl:true` | The permission set is license-backed; the license seat must be held before the assignment sticks. When the selected persona has no `LicenseId`, `needsPsl:false` and the PSL POST is skipped entirely |
@@ -211,7 +211,7 @@ All calls go through `sf`; substitute `<alias>` with the target org.
 
 ## Verification Checklist
 
-- [ ] Persona availability classified by `scripts/classify-permset-availability.mjs` against the four fixed persona Names — never by prose scanning the query output.
+- [ ] Persona availability classified by `scripts/classify-permset-availability.mjs` against the three fixed persona Names — never by prose scanning the query output.
 - [ ] User was asked to pick a persona from `personasFound[]` — no auto-selection.
 - [ ] Target user Id resolved by `scripts/resolve-target-user.mjs` — never by prose splitting the identity URL.
 - [ ] The SELECTED persona's `needsPsl` drove Phase 2b/2d: PSL SOQL + POST were performed when `true` and skipped when `false`.
@@ -233,7 +233,7 @@ ITSM Fulfiller Persona Permset Assignment (via service-itsm-agentic-setup-itsm-a
 
 Org:            <org-alias> (API v67.0)
 Target user:    <username> (<userId>)
-Persona:        <Incident | Problem | Change | Release>
+Persona:        <Incident | Problem | Change>
 PermSet:        <DeveloperName>
 
   Personas provisioned on org ...... <comma-separated list | none>
@@ -261,6 +261,6 @@ Keep internal jargon (record Ids, HTTP status codes, `FUNCTIONALITY_NOT_ENABLED`
 
 | File | When to read |
 |------|--------------|
-| `references/permset-topology.md` | Any change to the persona list — the four Core-shipped Fulfiller permsets, their AddOns/PSLs/userPerms, and the fixed-lookup discovery query |
+| `references/permset-topology.md` | Any change to the persona list — the three Core-shipped Fulfiller permsets, their AddOns/PSLs/userPerms, and the fixed-lookup discovery query |
 | `references/cli-invocation.md` | Every phase — exact `sf api request rest` / `sf data query` / `sf org assign permset` call shapes, the never-extract-token rule, response envelopes |
 | `references/helper-contracts.md` | The input/output shapes of all four helper scripts (`classify-permset-availability.mjs`, `resolve-target-user.mjs`, `classify-assignment-state.mjs`, `classify-action-surface.mjs`) and how to interpret each verdict |

package/skills/service-itsm-agentic-setup-itsm-agentforce-permset-assign/references/cli-invocation.md

@@ -10,7 +10,7 @@ Every read and write in this skill uses the **Salesforce CLI (`sf`)** against th
 
 ## Discovery read (Phase 1)
 
-Fixed-lookup query over the four Core-shipped Fulfiller persona `PermissionSet.Name` values (see `permset-topology.md`). The namespace on all four is `force` — do NOT filter by `NamespacePrefix`.
+Fixed-lookup query over the three Core-shipped Fulfiller persona `PermissionSet.Name` values (see `permset-topology.md`). The namespace on all three is `force` — do NOT filter by `NamespacePrefix`.
 
 ```bash
 sf data query \
@@ -19,8 +19,7 @@ sf data query \
       WHERE Name IN ( \
         'IncidentFulfiller', \
         'ProblemFulfillerPermSet', \
-        'ChangeRequestFulfillerPermSet', \
-        'ReleaseManagerPermSet' \
+        'ChangeRequestFulfillerPermSet' \
       )" \
   --target-org <alias> --json
 ```
@@ -60,7 +59,7 @@ sf data query -q "SELECT Id FROM PermissionSetLicenseAssign WHERE AssigneeId = '
   --target-org <alias> --json > /tmp/psla-existing.json
 ```
 
-When the selected persona's `needsPsl:false` (e.g. `ReleaseManagerPermSet`), SKIP the PSLA query — pass the sentinel `NO-PSL` to `classify-assignment-state.mjs`.
+When the selected persona's `needsPsl:false` (its `PermissionSet` has no backing `LicenseId`), SKIP the PSLA query — pass the sentinel `NO-PSL` to `classify-assignment-state.mjs`.
 
 ## Writes (Phase 2d)