@valescoagency/runway 0.11.0 → 0.12.0

package/README.md

@@ -541,7 +541,7 @@ These are tractable, just not v1.
 
 ## Status
 
-0.11.0 — production-shaped and dogfooded against live Linear queues.
+0.12.0 — production-shaped and dogfooded against live Linear queues.
 The end-to-end pipeline (init → run → review → PR) is stable; surface
 may still shift as the orchestrator's policy and iteration mechanics
 mature. See [CHANGELOG.md](./CHANGELOG.md) for per-release detail.

package/dist/dashboard/linear-sync.js

@@ -15,12 +15,18 @@ export function createLinearAdapter(opts) {
     const teamKey = opts.team ?? "VA";
     const readyLabel = opts.readyLabel ?? "ready-for-agent";
     async function snapshotFromIssue(raw) {
-        const [state, labels] = await Promise.all([raw.state, raw.labels()]);
+        const [state, labels, project] = await Promise.all([
+            raw.state,
+            raw.labels(),
+            raw.project,
+        ]);
         return {
             identifier: raw.identifier,
             title: raw.title,
             status: state?.name ?? "",
             labels: labels.nodes.map((l) => l.name),
+            projectId: project?.id ?? null,
+            projectName: project?.name ?? null,
         };
     }
     return {
@@ -113,6 +119,8 @@ export function startLinearSync(opts) {
                     title: q.title,
                     labels: q.labels,
                     queuePosition: i,
+                    projectId: q.projectId,
+                    projectName: q.projectName,
                 });
             });
             log("info", `[runway dashboard] linear sync: refreshed ready queue (${queue.length} issue${queue.length === 1 ? "" : "s"})`);
@@ -139,6 +147,8 @@ export function startLinearSync(opts) {
                         title: r.title,
                         labels: r.labels,
                         queuePosition: null,
+                        projectId: r.projectId,
+                        projectName: r.projectName,
                     });
                 }
                 log("info", `[runway dashboard] linear sync: refreshed status for ${refreshed.length} of ${recent.length} recent issue${recent.length === 1 ? "" : "s"}`);

package/dist/dashboard/storage.js

@@ -99,7 +99,9 @@ const SCHEMA = `
     status TEXT NOT NULL,
     title TEXT NOT NULL,
     labels_json TEXT,
-    queue_position INTEGER
+    queue_position INTEGER,
+    project_id TEXT,
+    project_name TEXT
   );
 
   CREATE INDEX IF NOT EXISTS idx_linear_snapshots_queue_position
@@ -289,6 +291,9 @@ export function createStorage(path, opts = {}) {
         `ALTER TABLE issue_processes ADD COLUMN issue_labels TEXT`,
         `ALTER TABLE issue_processes ADD COLUMN pr_url TEXT`,
         `ALTER TABLE issue_processes ADD COLUMN hitl_reason TEXT`,
+        // VA-450: project Name + UUID for the Todo queue Project column.
+        `ALTER TABLE linear_snapshots ADD COLUMN project_id TEXT`,
+        `ALTER TABLE linear_snapshots ADD COLUMN project_name TEXT`,
     ]) {
         try {
             db.exec(sql);
@@ -403,24 +408,29 @@ export function createStorage(path, opts = {}) {
     const selectAggregates = db.prepare(`SELECT * FROM evaluator_aggregates_v1`);
     const upsertLinearSnapshot = db.prepare(`
     INSERT INTO linear_snapshots (
-      issue_identifier, snapshot_at, status, title, labels_json, queue_position
-    ) VALUES (?, ?, ?, ?, ?, ?)
+      issue_identifier, snapshot_at, status, title, labels_json, queue_position,
+      project_id, project_name
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
     ON CONFLICT (issue_identifier) DO UPDATE SET
       snapshot_at = excluded.snapshot_at,
       status = excluded.status,
       title = excluded.title,
       labels_json = excluded.labels_json,
-      queue_position = excluded.queue_position
+      queue_position = excluded.queue_position,
+      project_id = excluded.project_id,
+      project_name = excluded.project_name
   `);
     const clearQueuePositionsStmt = db.prepare(`UPDATE linear_snapshots SET queue_position = NULL`);
     const listTodoQueueStmt = db.prepare(`
-    SELECT issue_identifier, snapshot_at, status, title, labels_json, queue_position
+    SELECT issue_identifier, snapshot_at, status, title, labels_json, queue_position,
+           project_id, project_name
     FROM linear_snapshots
     WHERE queue_position IS NOT NULL
     ORDER BY queue_position ASC
   `);
     const listAllSnapshotsStmt = db.prepare(`
-    SELECT issue_identifier, snapshot_at, status, title, labels_json, queue_position
+    SELECT issue_identifier, snapshot_at, status, title, labels_json, queue_position,
+           project_id, project_name
     FROM linear_snapshots
   `);
     // VA-391: "active drain" = a trace_id with one or more
@@ -616,7 +626,7 @@ export function createStorage(path, opts = {}) {
     };
     const listAggregates = () => selectAggregates.all().map(rowToAggregate);
     const saveLinearSnapshot = (s) => {
-        upsertLinearSnapshot.run(s.issueIdentifier, s.snapshotAt, s.status, s.title, s.labels.length === 0 ? null : JSON.stringify(s.labels), s.queuePosition);
+        upsertLinearSnapshot.run(s.issueIdentifier, s.snapshotAt, s.status, s.title, s.labels.length === 0 ? null : JSON.stringify(s.labels), s.queuePosition, s.projectId, s.projectName);
     };
     const clearLinearQueuePositions = () => {
         clearQueuePositionsStmt.run();
@@ -860,6 +870,8 @@ function rowToLinearSnapshot(row) {
         title: String(r.title ?? ""),
         labels: parseLabels(r.labels_json),
         queuePosition: nullableNum(r.queue_position),
+        projectId: r.project_id == null ? null : String(r.project_id),
+        projectName: r.project_name == null ? null : String(r.project_name),
     };
 }
 /**

package/dist/dashboard/views.js

@@ -33,6 +33,7 @@ const SHARED_STYLE = `
     .id { color: #93c5fd; }
     .detail { color: #d4d4d8; }
     .muted { color: #9ca3af; }
+    .project-uuid { color: #9ca3af; font-size: 11px; display: block; }
     code { background: #1f2937; padding: 1px 6px; border-radius: 3px; }
     .status-badge { display: inline-block; margin-left: 8px;
                     padding: 1px 6px; border-radius: 3px; font-size: 11px;
@@ -316,7 +317,7 @@ export function filterStateToQueryString(state) {
  */
 function renderTodoQueue(queue) {
     const body = queue.length === 0
-        ? `<tr><td colspan="3" class="empty">Linear Todo queue is empty.</td></tr>`
+        ? `<tr><td colspan="4" class="empty">Linear Todo queue is empty.</td></tr>`
         : queue.map(renderQueueRow).join("");
     return `<h2>Todo queue (next up)</h2>
   <table>
@@ -325,6 +326,7 @@ function renderTodoQueue(queue) {
         <th>Issue</th>
         <th>Title</th>
         <th>Labels</th>
+        <th>Project</th>
       </tr>
     </thead>
     <tbody>${body}</tbody>
@@ -332,10 +334,20 @@ function renderTodoQueue(queue) {
 }
 function renderQueueRow(s) {
     const labels = s.labels.length === 0 ? "" : s.labels.join(", ");
+    // VA-450: project cell shows the name on top with the UUID muted
+    // underneath in the same column. Unprojected issues degrade to an
+    // em-dash so the row still renders (the drain WILL pick them up).
+    const project = s.projectName == null && s.projectId == null
+        ? `<span class="muted">—</span>`
+        : `<span>${escapeHtml(s.projectName ?? "")}</span>` +
+            (s.projectId == null
+                ? ""
+                : `<span class="project-uuid">${escapeHtml(s.projectId)}</span>`);
     return `<tr>
     <td class="id">${escapeHtml(s.issueIdentifier)}</td>
     <td class="detail">${escapeHtml(s.title)}</td>
     <td class="muted">${escapeHtml(labels)}</td>
+    <td class="detail">${project}</td>
   </tr>`;
 }
 function renderRow(r, snapshots) {

package/dist/repo-upgrade.js

@@ -3,6 +3,7 @@ import { join } from "node:path";
 import { AUTH_MODE_ENV_VAR, TEMPLATES_DIR, } from "./scaffolder.js";
 import { buildAgentImage } from "./scaffolder-image.js";
 import { preflight } from "./scaffolder-preflight.js";
+import { writeShim } from "./scaffolder-varlock.js";
 import { verify } from "./scaffolder-verify.js";
 // ---------------------------------------------------------------------------
 // Tier detection
@@ -118,6 +119,22 @@ function renderDockerfile(cwd, tier, opts, enforceManualEditGuard) {
     return diffStat(dockerfilePath, ".sandcastle/Dockerfile", before, after);
 }
 // ---------------------------------------------------------------------------
+// Render: .sandcastle/runway-claude-shim (tier 2, VA-426)
+// ---------------------------------------------------------------------------
+// VA-426: the Dockerfile rendered above references
+// `COPY runway-claude-shim …`, so tier-2 upgrades must materialise the
+// shim file alongside the Dockerfile/.env.schema re-render — otherwise
+// the post-render `docker build` verification step fails. `init` writes
+// the shim via `applyVarlockLayer`; `upgrade-repo` historically skipped
+// that step entirely. Reuse the same `writeShim` helper here so the two
+// paths can't drift again.
+function renderShim(cwd) {
+    const shimPath = join(cwd, ".sandcastle", "runway-claude-shim");
+    const before = existsSync(shimPath) ? readFileSync(shimPath, "utf8") : "";
+    const after = readFileSync(join(TEMPLATES_DIR, "claude-shim.sh"), "utf8");
+    return diffStat(shimPath, ".sandcastle/runway-claude-shim", before, after);
+}
+// ---------------------------------------------------------------------------
 // Render: .env.schema (tier 2)
 // ---------------------------------------------------------------------------
 function renderEnvSchema(cwd, resolved) {
@@ -191,47 +208,37 @@ function diffStat(path, relPath, before, after) {
 // Orchestrator
 // ---------------------------------------------------------------------------
 /**
- * Re-render `.sandcastle/Dockerfile` (and tier-2 `.env.schema`) from
- * the current vendored templates, preserving user-set values like
- * the op:// vault and item names. Composes the scaffolder's
- * preflight/build/verify phases around the template re-render.
+ * The composition core of `upgradeRepo` — render every scaffold file
+ * from the current vendored templates, exit early on `--check` drift,
+ * and write the resulting changes to disk. Excludes `preflight`,
+ * `buildAgentImage`, and `verify` so tests can drive this against a
+ * tmpDir without needing a real git repo / docker daemon / `op` /
+ * `gh` (VA-426 regression coverage). Production callers go through
+ * `upgradeRepo`, which sandwiches this between those phases.
  *
- * Exits the process with code 1 if `--check` is set and drift was
- * detected (so CI can gate on it); exits 0 on a clean no-op.
+ * Returns the resolved op:// refs on tier 2 (consumed by the outer
+ * verify step), or null on tier 1. May call `process.exit(0|1)` —
+ * mirrors the existing CLI behaviour.
  */
-export async function upgradeRepo(cwd, opts) {
-    const tier = detectTier(cwd);
-    console.log(`[runway upgrade-repo] detected tier ${tier}`);
-    // --check shouldn't refuse on a dirty tree — drift detection is read-only.
-    const allowDirty = opts.check ? true : opts.allowDirty;
-    // Preflight uses the scaffolder's helper; satisfy its ScaffolderOptions shape.
-    const preflightOpts = {
-        tier,
-        allowDirty,
-        force: opts.force,
-        skipBuild: opts.skipBuild,
-        opVault: "placeholder",
-        anthropicItem: "placeholder",
-        ghTokenItem: "placeholder",
-        authMode: "api-key",
-    };
-    await preflight(cwd, preflightOpts);
+export async function composeAndApplyScaffoldChanges(cwd, tier, opts) {
     // Render new file contents in memory.
     // In --check we suppress the manual-edit refusal; drift detection is
     // read-only and the user wants the diff signal, not an exception.
     const dockerfileChange = renderDockerfile(cwd, tier, opts, !opts.check);
     let schemaChange = null;
+    let shimChange = null;
     let resolved = null;
     if (tier === 2) {
         resolved = resolveOpRefs(cwd, opts);
         schemaChange = renderEnvSchema(cwd, resolved);
+        shimChange = renderShim(cwd);
     }
     // Sandcastle .env warn-once (tier-1 leftover).
     const sandcastleEnv = join(cwd, ".sandcastle", ".env");
     if (existsSync(sandcastleEnv)) {
         console.log("  ⚠  .sandcastle/.env present — runway upgrade-repo leaves it alone (delete manually if you've moved to tier 2)");
     }
-    const changes = [dockerfileChange, schemaChange].filter((c) => c !== null && c.before !== c.after);
+    const changes = [dockerfileChange, schemaChange, shimChange].filter((c) => c !== null && c.before !== c.after);
     if (changes.length === 0) {
         console.log("[runway upgrade-repo] already up to date");
         process.exit(0);
@@ -244,11 +251,48 @@ export async function upgradeRepo(cwd, opts) {
         console.log("[runway upgrade-repo] drift detected (--check); not writing");
         process.exit(1);
     }
-    // Write files.
+    // Write files. The shim needs mode 0755 so the docker COPY preserves
+    // the execute bit — route it through `writeShim` (the same helper
+    // `init` uses) instead of the plain `writeFileSync` path.
     for (const c of changes) {
-        writeFileSync(c.path, c.after);
-        console.log(`  ✓ wrote ${c.relPath}`);
+        if (c.relPath === ".sandcastle/runway-claude-shim") {
+            writeShim(cwd);
+        }
+        else {
+            writeFileSync(c.path, c.after);
+            console.log(`  ✓ wrote ${c.relPath}`);
+        }
     }
+    return resolved;
+}
+/**
+ * Re-render `.sandcastle/Dockerfile` (and tier-2 `.env.schema` +
+ * `.sandcastle/runway-claude-shim`) from the current vendored
+ * templates, preserving user-set values like the op:// vault and
+ * item names. Composes the scaffolder's preflight/build/verify
+ * phases around the template re-render.
+ *
+ * Exits the process with code 1 if `--check` is set and drift was
+ * detected (so CI can gate on it); exits 0 on a clean no-op.
+ */
+export async function upgradeRepo(cwd, opts) {
+    const tier = detectTier(cwd);
+    console.log(`[runway upgrade-repo] detected tier ${tier}`);
+    // --check shouldn't refuse on a dirty tree — drift detection is read-only.
+    const allowDirty = opts.check ? true : opts.allowDirty;
+    // Preflight uses the scaffolder's helper; satisfy its ScaffolderOptions shape.
+    const preflightOpts = {
+        tier,
+        allowDirty,
+        force: opts.force,
+        skipBuild: opts.skipBuild,
+        opVault: "placeholder",
+        anthropicItem: "placeholder",
+        ghTokenItem: "placeholder",
+        authMode: "api-key",
+    };
+    await preflight(cwd, preflightOpts);
+    const resolved = await composeAndApplyScaffoldChanges(cwd, tier, opts);
     if (!opts.skipBuild) {
         await buildAgentImage(cwd);
     }

package/dist/scaffolder-varlock.js

@@ -1,6 +1,31 @@
-import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
 import { join } from "node:path";
 import { AUTH_MODE_ENV_VAR, TEMPLATES_DIR, } from "./scaffolder.js";
+/**
+ * Vendor the claude shim into `.sandcastle/runway-claude-shim`.
+ *
+ * Both `runway init --tier=2` (via `applyVarlockLayer`) and
+ * `runway upgrade-repo` (VA-426) must write this file because the
+ * rendered Dockerfile contains `COPY runway-claude-shim …` and the
+ * `docker build` verification step will otherwise fail to find the
+ * source. The shim wraps every `claude` invocation in `varlock run`,
+ * and — when the four `RUNWAY_SIGNING_*` env vars are populated —
+ * bootstraps SSH-signed agent commits (VA-413).
+ *
+ * Idempotent: same template content, same on-disk content. Always
+ * sets mode 0755 so the docker COPY preserves the execute bit.
+ */
+export function writeShim(cwd) {
+    const shimSrc = readFileSync(join(TEMPLATES_DIR, "claude-shim.sh"), "utf8");
+    const shimDest = join(cwd, ".sandcastle", "runway-claude-shim");
+    writeFileSync(shimDest, shimSrc, { mode: 0o755 });
+    // `writeFileSync({mode})` only applies on file creation; on overwrite
+    // the existing inode keeps its prior mode (so a stale 0644 shim from
+    // a manual `cp` would silently survive). Chmod explicitly to make the
+    // execute bit a post-condition.
+    chmodSync(shimDest, 0o755);
+    console.log("  ✓ wrote .sandcastle/runway-claude-shim (claude wrapper + signing bootstrap)");
+}
 /**
  * Phase 3 (tier 2 only): layer varlock + 1Password CLI on top of
  * the base Dockerfile so the container can resolve `op://` references
@@ -47,13 +72,8 @@ export async function applyVarlockLayer(cwd, opts) {
     }
     // 2b. VA-413: vendor the claude shim into .sandcastle/ so the
     // Dockerfile's `COPY .sandcastle/runway-claude-shim …` resolves
-    // during the docker build. The shim wraps each `claude` invocation
-    // in `varlock run`, and — when the four RUNWAY_SIGNING_* env vars
-    // are populated — bootstraps SSH-signed agent commits.
-    const shimSrc = readFileSync(join(TEMPLATES_DIR, "claude-shim.sh"), "utf8");
-    const shimDest = join(cwd, ".sandcastle", "runway-claude-shim");
-    writeFileSync(shimDest, shimSrc, { mode: 0o755 });
-    console.log(`  ✓ wrote .sandcastle/runway-claude-shim (claude wrapper + signing bootstrap)`);
+    // during the docker build.
+    writeShim(cwd);
     // 3. Drop .sandcastle/.env and .env.example.
     for (const f of [".sandcastle/.env", ".sandcastle/.env.example"]) {
         const p = join(cwd, f);

package/dist/scaffolder-verify.js

@@ -52,11 +52,29 @@ export async function verify(cwd, opts) {
     }
     ok(".env.schema contains no inline secrets");
     const dockerfile = readFileSync(join(cwd, ".sandcastle", "Dockerfile"), "utf8");
-    if (!dockerfile.includes("varlock run --env-file"))
-        fail("Dockerfile not patched with varlock shim");
+    // Post-VA-413 the Dockerfile no longer inlines the shim (`varlock
+    // run …` lives inside the vendored `.sandcastle/runway-claude-shim`
+    // file). It does still rename the binary and COPY the vendored shim
+    // over it, so those are the two on-Dockerfile signals.
+    if (!dockerfile.includes("COPY runway-claude-shim"))
+        fail("Dockerfile not patched with claude-shim COPY (run `runway upgrade-repo --force`)");
     if (!dockerfile.includes("/home/agent/.local/bin/claude.real"))
         fail("Dockerfile shim not in expected layout");
-    ok("Dockerfile patched with varlock + claude shim");
+    ok("Dockerfile patched with claude-shim COPY");
+    // VA-426 (sibling): the COPY above points at
+    // `.sandcastle/runway-claude-shim`, which `runway init` and
+    // `runway upgrade-repo` both materialise. Confirm it landed on disk
+    // and carries the wrapper's signal lines so a truncated/empty file
+    // doesn't slip past verify and trip on `docker build` instead.
+    const shimPath = join(cwd, ".sandcastle", "runway-claude-shim");
+    if (!existsSync(shimPath))
+        fail(".sandcastle/runway-claude-shim missing (run `runway upgrade-repo --force`)");
+    const shim = readFileSync(shimPath, "utf8");
+    if (!shim.includes("varlock run --env-file"))
+        fail(".sandcastle/runway-claude-shim doesn't invoke varlock — stale file?");
+    if (!shim.includes("claude.real"))
+        fail(".sandcastle/runway-claude-shim doesn't exec claude.real — stale file?");
+    ok(".sandcastle/runway-claude-shim present and wraps claude.real via varlock");
     if (existsSync(join(cwd, ".sandcastle", ".env"))) {
         fail(".sandcastle/.env still on disk — tier 2 deletes it");
     }

package/dist/telemetry.js

@@ -1,9 +1,8 @@
-import { Logger as OtelLogger, NodeSdk } from "@effect/opentelemetry";
+import { NodeSdk } from "@effect/opentelemetry";
 import { OTLPLogExporter } from "@opentelemetry/exporter-logs-otlp-http";
 import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
 import { BatchLogRecordProcessor } from "@opentelemetry/sdk-logs";
 import { BatchSpanProcessor } from "@opentelemetry/sdk-trace-base";
-import { Layer } from "effect";
 /**
  * VA-358 + VA-388: OpenTelemetry telemetry layer for the orchestrator.
  *
@@ -45,11 +44,14 @@ const liveLayer = NodeSdk.layer(() => ({
     // paths.
     logRecordProcessor: new BatchLogRecordProcessor(new OTLPLogExporter()),
 }));
-// VA-388: replace Effect's default logger with one that fans out to
-// the OtelLoggerProvider built by `NodeSdk.layer`. Provided ON TOP of
-// `liveLayer` so the OtelLoggerProvider context is satisfied; without
-// the SDK behind it, this layer would fail to construct.
-const loggerLayer = Layer.provide(OtelLogger.layerLoggerReplace, liveLayer);
+// VA-388: when `logRecordProcessor` is set above, `NodeSdk.layer`
+// internally composes `Logger.layerLoggerAdd` against an internal
+// `OtelLoggerProvider`, so `Effect.log` calls fan out to OTLP in
+// addition to the default stderr logger. An earlier revision wrapped
+// `Logger.layerLoggerReplace` around `liveLayer` to silence stderr,
+// but `NodeSdk.layer` consumes `OtelLoggerProvider` via `Layer.provide`
+// internally and does not re-export it — that composition raised
+// "Service not found: OtelLoggerProvider" at startup.
 export const TelemetryLive = isTelemetryEnabled()
-    ? Layer.merge(liveLayer, loggerLayer)
+    ? liveLayer
     : NodeSdk.layerEmpty;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@valescoagency/runway",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Linear-driven orchestrator + scaffolder for coding agents on Sandcastle. `runway init` scaffolds a target repo (sandcastle + varlock + 1Password); `runway run` drains a Linear queue against it; `runway doctor`, `runway upgrade`, `runway upgrade-repo` round out the lifecycle.",
   "license": "MIT",
   "author": {