agentplane 0.2.25 → 0.3.1

package/dist/shared/protected-paths.js

@@ -32,6 +32,7 @@ export function protectedPathKindForFile(opts) {
         return "tasks";
     // "Rules of the game": authoring/agent policies and registry.
     if (p === "AGENTS.md" ||
+        p === "CLAUDE.md" ||
         p === "packages/agentplane/assets/AGENTS.md" ||
         pathIsUnder(p, ".agentplane/agents")) {
         return "policy";

package/dist/shared/runtime-artifacts.d.ts

@@ -1,3 +1,3 @@
-export declare const RUNTIME_GITIGNORE_LINES: readonly ["# agentplane: ignore runtime/transient workspace artifacts", ".env", ".agentplane/worktrees", ".agentplane/cache", ".agentplane/recipes-cache", ".agentplane/.upgrade", ".agentplane/.release", ".agentplane/upgrade", ".agentplane/tasks.json", "AGENTS.md.bak-*", ".agentplane/agents/*.bak-*"];
-export declare const AGENT_PROMPT_GITIGNORE_LINES: readonly ["# agentplane: ignore local agent prompts/templates", "AGENTS.md", ".agentplane/agents/"];
+export declare const RUNTIME_GITIGNORE_LINES: readonly ["# agentplane: ignore runtime/transient workspace artifacts", ".env", ".agentplane/worktrees", ".agentplane/cache", ".agentplane/recipes-cache", ".agentplane/.upgrade", ".agentplane/.release", ".agentplane/upgrade", ".agentplane/tasks.json", "AGENTS.md.bak-*", "CLAUDE.md.bak-*", ".agentplane/agents/*.bak-*", ".agentplane/policy/**/*.bak-*"];
+export declare const AGENT_PROMPT_GITIGNORE_LINES: readonly ["# agentplane: ignore local agent prompts/templates", "AGENTS.md", "CLAUDE.md", ".agentplane/agents/", ".agentplane/policy/"];
 //# sourceMappingURL=runtime-artifacts.d.ts.map

package/dist/shared/runtime-artifacts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-artifacts.d.ts","sourceRoot":"","sources":["../../src/shared/runtime-artifacts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,uBAAuB,8SAY1B,CAAC;AAEX,eAAO,MAAM,4BAA4B,qGAI/B,CAAC"}
+{"version":3,"file":"runtime-artifacts.d.ts","sourceRoot":"","sources":["../../src/shared/runtime-artifacts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,uBAAuB,kWAc1B,CAAC;AAEX,eAAO,MAAM,4BAA4B,yIAM/B,CAAC"}

package/dist/shared/runtime-artifacts.js

@@ -9,10 +9,14 @@ export const RUNTIME_GITIGNORE_LINES = [
     ".agentplane/upgrade",
     ".agentplane/tasks.json",
     "AGENTS.md.bak-*",
+    "CLAUDE.md.bak-*",
     ".agentplane/agents/*.bak-*",
+    ".agentplane/policy/**/*.bak-*",
 ];
 export const AGENT_PROMPT_GITIGNORE_LINES = [
     "# agentplane: ignore local agent prompts/templates",
     "AGENTS.md",
+    "CLAUDE.md",
     ".agentplane/agents/",
+    ".agentplane/policy/",
 ];

package/dist/workflow-runtime/build.d.ts

@@ -0,0 +1,4 @@
+import type { WorkflowBuildInput, WorkflowBuildOutput } from "./types.js";
+export declare function buildWorkflowFromTemplates(input: WorkflowBuildInput): WorkflowBuildOutput;
+export declare const DEFAULT_WORKFLOW_TEMPLATE = "---\nversion: 1\nmode: direct\nowners:\n  orchestrator: ORCHESTRATOR\napprovals:\n  require_plan: true\n  require_verify: true\n  require_network: true\nretry_policy:\n  normal_exit_continuation: true\n  abnormal_backoff: exponential\n  max_attempts: 5\ntimeouts:\n  stall_seconds: 900\nin_scope_paths:\n  - packages/**\n---\n\n## Prompt Template\nRepository: {{ runtime.repo_name }}\nWorkflow mode: {{ workflow.mode }}\n\n## Checks\n- preflight\n- verify\n- finish\n\n## Fallback\nlast_known_good: .agentplane/workflows/last-known-good.md\n";
+//# sourceMappingURL=build.d.ts.map

package/dist/workflow-runtime/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/workflow-runtime/build.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAsB,MAAM,YAAY,CAAC;AAqC9F,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,kBAAkB,GAAG,mBAAmB,CA4EzF;AAED,eAAO,MAAM,yBAAyB,kiBA8BrC,CAAC"}

package/dist/workflow-runtime/build.js

@@ -0,0 +1,126 @@
+import { parseWorkflowMarkdown, serializeWorkflowMarkdown } from "./markdown.js";
+import { emitWorkflowEvent } from "./observability.js";
+import { renderTemplateStrict, validateTemplateStrict } from "./template.js";
+import { validateWorkflowDocument } from "./validate.js";
+function mergeRecord(baseValue, overrideValue) {
+    const out = { ...baseValue };
+    for (const [key, value] of Object.entries(overrideValue)) {
+        if (value &&
+            typeof value === "object" &&
+            !Array.isArray(value) &&
+            out[key] &&
+            typeof out[key] === "object" &&
+            !Array.isArray(out[key])) {
+            out[key] = mergeRecord(out[key], value);
+            continue;
+        }
+        out[key] = value;
+    }
+    return out;
+}
+function mergeSections(baseSections, overrideSections) {
+    const out = { ...baseSections };
+    for (const [key, value] of Object.entries(overrideSections)) {
+        if (value.trim().length === 0)
+            continue;
+        out[key] = value;
+    }
+    return out;
+}
+export function buildWorkflowFromTemplates(input) {
+    emitWorkflowEvent({ event: "workflow_build_started" });
+    const diagnostics = [];
+    const base = parseWorkflowMarkdown(input.baseTemplate);
+    diagnostics.push(...base.diagnostics);
+    const override = input.projectOverrideTemplate
+        ? parseWorkflowMarkdown(input.projectOverrideTemplate)
+        : null;
+    if (override)
+        diagnostics.push(...override.diagnostics);
+    const mergedFrontMatter = mergeRecord(base.document.frontMatterRaw, override?.document.frontMatterRaw ?? {});
+    const runtimeWorkflow = input.runtimeContext.workflow;
+    if (runtimeWorkflow && typeof runtimeWorkflow === "object" && !Array.isArray(runtimeWorkflow)) {
+        const runtimeWorkflowRecord = runtimeWorkflow;
+        const runtimeMode = runtimeWorkflowRecord.mode;
+        if (runtimeMode === "direct" || runtimeMode === "branch_pr") {
+            mergedFrontMatter.mode = runtimeMode;
+        }
+        const runtimeApprovals = runtimeWorkflowRecord.approvals;
+        if (runtimeApprovals &&
+            typeof runtimeApprovals === "object" &&
+            !Array.isArray(runtimeApprovals)) {
+            const approvalsRecord = runtimeApprovals;
+            mergedFrontMatter.approvals = {
+                require_plan: approvalsRecord.require_plan === true,
+                require_verify: approvalsRecord.require_verify === true,
+                require_network: approvalsRecord.require_network === true,
+            };
+        }
+    }
+    const mergedSections = mergeSections(base.document.sections, override?.document.sections ?? {});
+    const promptTemplate = mergedSections["Prompt Template"] ?? "";
+    const strict = validateTemplateStrict(promptTemplate, input.runtimeContext, {
+        strictVariables: true,
+        strictFilters: true,
+    });
+    diagnostics.push(...strict.diagnostics);
+    const renderedPrompt = renderTemplateStrict(promptTemplate, input.runtimeContext, {
+        strictVariables: true,
+        strictFilters: true,
+    });
+    diagnostics.push(...renderedPrompt.diagnostics);
+    mergedSections["Prompt Template"] = renderedPrompt.text;
+    const renderedText = serializeWorkflowMarkdown(mergedFrontMatter, mergedSections);
+    const parsedRendered = parseWorkflowMarkdown(renderedText);
+    diagnostics.push(...parsedRendered.diagnostics);
+    const schema = validateWorkflowDocument(parsedRendered.document);
+    diagnostics.push(...schema.diagnostics);
+    const hasError = diagnostics.some((d) => d.severity === "ERROR");
+    if (hasError) {
+        emitWorkflowEvent({
+            event: "workflow_build_failed",
+            details: { diagnostics: diagnostics.length },
+        });
+    }
+    else {
+        emitWorkflowEvent({
+            event: "workflow_build_completed",
+            details: { diagnostics: diagnostics.length },
+        });
+    }
+    return {
+        text: renderedText,
+        diagnostics,
+    };
+}
+export const DEFAULT_WORKFLOW_TEMPLATE = `---
+version: 1
+mode: direct
+owners:
+  orchestrator: ORCHESTRATOR
+approvals:
+  require_plan: true
+  require_verify: true
+  require_network: true
+retry_policy:
+  normal_exit_continuation: true
+  abnormal_backoff: exponential
+  max_attempts: 5
+timeouts:
+  stall_seconds: 900
+in_scope_paths:
+  - packages/**
+---
+
+## Prompt Template
+Repository: {{ runtime.repo_name }}
+Workflow mode: {{ workflow.mode }}
+
+## Checks
+- preflight
+- verify
+- finish
+
+## Fallback
+last_known_good: .agentplane/workflows/last-known-good.md
+`;

package/dist/workflow-runtime/enforcement.d.ts

@@ -0,0 +1,3 @@
+export declare function isWorkflowEnforcementDisabled(env?: NodeJS.ProcessEnv): boolean;
+export declare function workflowEnforcementEnvHint(): string;
+//# sourceMappingURL=enforcement.d.ts.map

package/dist/workflow-runtime/enforcement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement.d.ts","sourceRoot":"","sources":["../../src/workflow-runtime/enforcement.ts"],"names":[],"mappings":"AAEA,wBAAgB,6BAA6B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAI3F;AAED,wBAAgB,0BAA0B,IAAI,MAAM,CAEnD"}

package/dist/workflow-runtime/enforcement.js

@@ -0,0 +1,10 @@
+const DISABLED_VALUES = new Set(["0", "false", "off", "disabled"]);
+export function isWorkflowEnforcementDisabled(env = process.env) {
+    const raw = env.AGENTPLANE_WORKFLOW_ENFORCEMENT ?? env.AGENTPLANE_WORKFLOW_CONTRACT;
+    if (typeof raw !== "string")
+        return false;
+    return DISABLED_VALUES.has(raw.trim().toLowerCase());
+}
+export function workflowEnforcementEnvHint() {
+    return "AGENTPLANE_WORKFLOW_ENFORCEMENT";
+}

package/dist/workflow-runtime/file-ops.d.ts

@@ -0,0 +1,11 @@
+import type { WorkflowDiagnostic, WorkflowDocument, WorkflowValidationResult } from "./types.js";
+export declare function readWorkflowDocument(repoRoot: string, absPath?: string): Promise<{
+    document: WorkflowDocument | null;
+    diagnostics: WorkflowDiagnostic[];
+    path: string;
+}>;
+export declare function validateWorkflowAtPath(repoRoot: string, absPath?: string): Promise<WorkflowValidationResult>;
+export declare function validateWorkflowText(repoRoot: string, workflowText: string): Promise<WorkflowValidationResult>;
+export declare function publishWorkflowCandidate(repoRoot: string, candidateText: string): Promise<WorkflowValidationResult>;
+export declare function restoreWorkflowFromLastKnownGood(repoRoot: string): Promise<WorkflowValidationResult>;
+//# sourceMappingURL=file-ops.d.ts.map

package/dist/workflow-runtime/file-ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-ops.d.ts","sourceRoot":"","sources":["../../src/workflow-runtime/file-ops.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAiDjG,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAAC,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BjG;AAED,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,wBAAwB,CAAC,CAuBnC;AAED,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAanC;AAED,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,wBAAwB,CAAC,CA0DnC;AAED,wBAAsB,gCAAgC,CACpD,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,wBAAwB,CAAC,CA6EnC"}

package/dist/workflow-runtime/file-ops.js

@@ -0,0 +1,248 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { loadConfig } from "@agentplaneorg/core";
+import { parseWorkflowMarkdown } from "./markdown.js";
+import { emitWorkflowEvent } from "./observability.js";
+import { resolveWorkflowPaths } from "./paths.js";
+import { validateWorkflowDocument } from "./validate.js";
+async function pathExists(absPath) {
+    try {
+        await fs.access(absPath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function resolveWorkflowReadPath(paths) {
+    if (await pathExists(paths.workflowPath))
+        return paths.workflowPath;
+    if (await pathExists(paths.legacyWorkflowPath))
+        return paths.legacyWorkflowPath;
+    return paths.workflowPath;
+}
+async function removeLegacyWorkflowIfPresent(paths) {
+    if (paths.workflowPath === paths.legacyWorkflowPath)
+        return;
+    try {
+        await fs.rm(paths.legacyWorkflowPath, { force: true });
+    }
+    catch {
+        // best effort cleanup
+    }
+}
+async function listAgentIds(agentplaneDir) {
+    const ids = new Set();
+    const dir = path.join(agentplaneDir, "agents");
+    try {
+        const entries = await fs.readdir(dir, { withFileTypes: true });
+        for (const ent of entries) {
+            if (ent.isFile() && ent.name.endsWith(".json")) {
+                ids.add(ent.name.replace(/\.json$/i, ""));
+            }
+        }
+    }
+    catch {
+        // best effort
+    }
+    return ids;
+}
+export async function readWorkflowDocument(repoRoot, absPath) {
+    const paths = resolveWorkflowPaths(repoRoot);
+    const targetPath = absPath ?? (await resolveWorkflowReadPath(paths));
+    try {
+        const content = await fs.readFile(targetPath, "utf8");
+        const parsed = parseWorkflowMarkdown(content, targetPath);
+        return {
+            document: parsed.document,
+            diagnostics: parsed.diagnostics,
+            path: targetPath,
+        };
+    }
+    catch (error) {
+        return {
+            document: null,
+            diagnostics: [
+                {
+                    code: (await pathExists(targetPath)) ? "WF_READ_FAILED" : "WF_MISSING_FILE",
+                    severity: "ERROR",
+                    path: "file",
+                    message: `Cannot read workflow file ${targetPath}: ${error instanceof Error ? error.message : String(error)}`,
+                },
+            ],
+            path: targetPath,
+        };
+    }
+}
+export async function validateWorkflowAtPath(repoRoot, absPath) {
+    const read = await readWorkflowDocument(repoRoot, absPath);
+    const diagnostics = [...read.diagnostics];
+    if (!read.document) {
+        return {
+            ok: false,
+            diagnostics,
+        };
+    }
+    const loaded = await loadConfig(path.join(repoRoot, ".agentplane"));
+    const knownAgentIds = await listAgentIds(path.join(repoRoot, ".agentplane"));
+    const validated = validateWorkflowDocument(read.document, {
+        repoRoot,
+        knownAgentIds,
+        config: loaded.config,
+    });
+    diagnostics.push(...validated.diagnostics);
+    return {
+        ok: diagnostics.every((d) => d.severity !== "ERROR"),
+        diagnostics,
+    };
+}
+export async function validateWorkflowText(repoRoot, workflowText) {
+    const parsed = parseWorkflowMarkdown(workflowText);
+    const loaded = await loadConfig(path.join(repoRoot, ".agentplane"));
+    const knownAgentIds = await listAgentIds(path.join(repoRoot, ".agentplane"));
+    const validated = validateWorkflowDocument(parsed.document, {
+        repoRoot,
+        knownAgentIds,
+        config: loaded.config,
+    });
+    return {
+        ok: [...parsed.diagnostics, ...validated.diagnostics].every((d) => d.severity !== "ERROR"),
+        diagnostics: [...parsed.diagnostics, ...validated.diagnostics],
+    };
+}
+export async function publishWorkflowCandidate(repoRoot, candidateText) {
+    const paths = resolveWorkflowPaths(repoRoot);
+    const tempPath = `${paths.workflowPath}.tmp.${Date.now()}`;
+    const parsed = parseWorkflowMarkdown(candidateText, paths.workflowPath);
+    const configLoaded = await loadConfig(path.join(repoRoot, ".agentplane"));
+    const validation = validateWorkflowDocument(parsed.document, {
+        repoRoot,
+        knownAgentIds: await listAgentIds(path.join(repoRoot, ".agentplane")),
+        config: configLoaded.config,
+    });
+    const diagnostics = [...parsed.diagnostics, ...validation.diagnostics];
+    if (diagnostics.some((d) => d.severity === "ERROR")) {
+        emitWorkflowEvent({
+            event: "workflow_publish_failed",
+            code: "WF_PARSE_ERROR",
+            details: { reason: "validation failed before publish", diagnostics: diagnostics.length },
+        });
+        return { ok: false, diagnostics };
+    }
+    try {
+        await fs.mkdir(path.dirname(paths.workflowPath), { recursive: true });
+        await fs.mkdir(paths.workflowDir, { recursive: true });
+        await fs.writeFile(tempPath, candidateText, "utf8");
+        await fs.rename(tempPath, paths.workflowPath);
+        await removeLegacyWorkflowIfPresent(paths);
+        await fs.copyFile(paths.workflowPath, paths.lastKnownGoodPath);
+        emitWorkflowEvent({
+            event: "workflow_publish_completed",
+            details: { workflowPath: paths.workflowPath, lastKnownGoodPath: paths.lastKnownGoodPath },
+        });
+        return { ok: true, diagnostics };
+    }
+    catch (error) {
+        try {
+            await fs.rm(tempPath, { force: true });
+        }
+        catch {
+            // best effort cleanup
+        }
+        emitWorkflowEvent({
+            event: "workflow_publish_failed",
+            code: "WF_READ_FAILED",
+            details: { reason: error instanceof Error ? error.message : String(error) },
+        });
+        return {
+            ok: false,
+            diagnostics: [
+                ...diagnostics,
+                {
+                    code: "WF_READ_FAILED",
+                    severity: "ERROR",
+                    path: "file",
+                    message: `Failed to atomically publish workflow: ${error instanceof Error ? error.message : String(error)}`,
+                },
+            ],
+        };
+    }
+}
+export async function restoreWorkflowFromLastKnownGood(repoRoot) {
+    const paths = resolveWorkflowPaths(repoRoot);
+    const tempPath = `${paths.workflowPath}.restore.tmp.${Date.now()}`;
+    let lkgText = "";
+    try {
+        lkgText = await fs.readFile(paths.lastKnownGoodPath, "utf8");
+    }
+    catch (error) {
+        emitWorkflowEvent({
+            event: "workflow_restore_failed",
+            code: "WF_MISSING_FILE",
+            details: { reason: error instanceof Error ? error.message : String(error) },
+        });
+        return {
+            ok: false,
+            diagnostics: [
+                {
+                    code: "WF_MISSING_FILE",
+                    severity: "ERROR",
+                    path: "file",
+                    message: `Missing last-known-good workflow snapshot at ${paths.lastKnownGoodPath}`,
+                },
+            ],
+        };
+    }
+    const parsed = parseWorkflowMarkdown(lkgText, paths.lastKnownGoodPath);
+    const configLoaded = await loadConfig(path.join(repoRoot, ".agentplane"));
+    const validated = validateWorkflowDocument(parsed.document, {
+        repoRoot,
+        knownAgentIds: await listAgentIds(path.join(repoRoot, ".agentplane")),
+        config: configLoaded.config,
+    });
+    const diagnostics = [...parsed.diagnostics, ...validated.diagnostics];
+    if (diagnostics.some((d) => d.severity === "ERROR")) {
+        emitWorkflowEvent({
+            event: "workflow_restore_failed",
+            code: "WF_PARSE_ERROR",
+            details: { reason: "last-known-good validation failed" },
+        });
+        return { ok: false, diagnostics };
+    }
+    try {
+        await fs.mkdir(path.dirname(paths.workflowPath), { recursive: true });
+        await fs.writeFile(tempPath, lkgText, "utf8");
+        await fs.rename(tempPath, paths.workflowPath);
+        await removeLegacyWorkflowIfPresent(paths);
+        emitWorkflowEvent({
+            event: "workflow_restore_completed",
+            details: { workflowPath: paths.workflowPath, from: paths.lastKnownGoodPath },
+        });
+        return { ok: true, diagnostics };
+    }
+    catch (error) {
+        try {
+            await fs.rm(tempPath, { force: true });
+        }
+        catch {
+            // best effort cleanup
+        }
+        emitWorkflowEvent({
+            event: "workflow_restore_failed",
+            code: "WF_READ_FAILED",
+            details: { reason: error instanceof Error ? error.message : String(error) },
+        });
+        return {
+            ok: false,
+            diagnostics: [
+                ...diagnostics,
+                {
+                    code: "WF_READ_FAILED",
+                    severity: "ERROR",
+                    path: "file",
+                    message: `Failed to restore workflow from snapshot: ${error instanceof Error ? error.message : String(error)}`,
+                },
+            ],
+        };
+    }
+}

package/dist/workflow-runtime/fix.d.ts

@@ -0,0 +1,9 @@
+import type { WorkflowDiagnostic } from "./types.js";
+type WorkflowFixResult = {
+    changed: boolean;
+    text: string;
+    diagnostics: WorkflowDiagnostic[];
+};
+export declare function safeAutofixWorkflowText(text: string): WorkflowFixResult;
+export {};
+//# sourceMappingURL=fix.d.ts.map

package/dist/workflow-runtime/fix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fix.d.ts","sourceRoot":"","sources":["../../src/workflow-runtime/fix.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAuB,MAAM,YAAY,CAAC;AAE1E,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC,CAAC;AAoFF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CA6CvE"}

package/dist/workflow-runtime/fix.js

@@ -0,0 +1,107 @@
+import { parseWorkflowMarkdown, serializeWorkflowMarkdown } from "./markdown.js";
+const DEFAULT_FRONT_MATTER = {
+    version: 1,
+    mode: "direct",
+    owners: { orchestrator: "ORCHESTRATOR" },
+    approvals: {
+        require_plan: true,
+        require_verify: true,
+        require_network: true,
+    },
+    retry_policy: {
+        normal_exit_continuation: true,
+        abnormal_backoff: "exponential",
+        max_attempts: 5,
+    },
+    timeouts: {
+        stall_seconds: 900,
+    },
+    in_scope_paths: ["packages/**"],
+};
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function withDefaults(raw) {
+    const out = { ...raw };
+    if (typeof out.version !== "number" || !Number.isInteger(out.version) || out.version < 1) {
+        out.version = 1;
+    }
+    if (out.mode !== "direct" && out.mode !== "branch_pr") {
+        out.mode = DEFAULT_FRONT_MATTER.mode;
+    }
+    const owners = isRecord(out.owners) ? { ...out.owners } : {};
+    if (typeof owners.orchestrator !== "string" || owners.orchestrator.trim().length === 0) {
+        owners.orchestrator = DEFAULT_FRONT_MATTER.owners.orchestrator;
+    }
+    out.owners = owners;
+    const approvals = isRecord(out.approvals) ? { ...out.approvals } : {};
+    for (const key of ["require_plan", "require_verify", "require_network"]) {
+        if (typeof approvals[key] !== "boolean")
+            approvals[key] = DEFAULT_FRONT_MATTER.approvals[key];
+    }
+    out.approvals = approvals;
+    const retryPolicy = isRecord(out.retry_policy) ? { ...out.retry_policy } : {};
+    if (typeof retryPolicy.normal_exit_continuation !== "boolean") {
+        retryPolicy.normal_exit_continuation =
+            DEFAULT_FRONT_MATTER.retry_policy.normal_exit_continuation;
+    }
+    if (retryPolicy.abnormal_backoff !== "exponential") {
+        retryPolicy.abnormal_backoff = DEFAULT_FRONT_MATTER.retry_policy.abnormal_backoff;
+    }
+    if (typeof retryPolicy.max_attempts !== "number" ||
+        !Number.isInteger(retryPolicy.max_attempts) ||
+        retryPolicy.max_attempts < 1) {
+        retryPolicy.max_attempts = DEFAULT_FRONT_MATTER.retry_policy.max_attempts;
+    }
+    out.retry_policy = retryPolicy;
+    const timeouts = isRecord(out.timeouts) ? { ...out.timeouts } : {};
+    if (typeof timeouts.stall_seconds !== "number" ||
+        !Number.isInteger(timeouts.stall_seconds) ||
+        timeouts.stall_seconds < 1) {
+        timeouts.stall_seconds = DEFAULT_FRONT_MATTER.timeouts.stall_seconds;
+    }
+    out.timeouts = timeouts;
+    const inScope = Array.isArray(out.in_scope_paths)
+        ? out.in_scope_paths.filter((v) => typeof v === "string" && v.trim().length > 0)
+        : [];
+    out.in_scope_paths = inScope.length > 0 ? inScope : DEFAULT_FRONT_MATTER.in_scope_paths;
+    return out;
+}
+export function safeAutofixWorkflowText(text) {
+    const parsed = parseWorkflowMarkdown(text);
+    const diagnostics = [];
+    const unknownKeyDiagnostics = Object.keys(parsed.document.frontMatterRaw)
+        .filter((key) => ![
+        "version",
+        "mode",
+        "owners",
+        "approvals",
+        "retry_policy",
+        "timeouts",
+        "in_scope_paths",
+    ].includes(key))
+        .map((key) => ({
+        code: "WF_FIX_SKIPPED_UNSAFE",
+        severity: "WARN",
+        path: `front_matter.${key}`,
+        message: `Unsafe autofix skipped for unknown key: ${key}`,
+    }));
+    diagnostics.push(...unknownKeyDiagnostics);
+    if (unknownKeyDiagnostics.length > 0) {
+        return { changed: false, text, diagnostics };
+    }
+    const nextFrontMatter = withDefaults(parsed.document.frontMatterRaw);
+    const sections = {
+        ...parsed.document.sections,
+        "Prompt Template": parsed.document.sections["Prompt Template"] ?? "",
+        Checks: parsed.document.sections.Checks ?? "- preflight\n- verify\n- finish",
+        Fallback: parsed.document.sections.Fallback ??
+            "last_known_good: .agentplane/workflows/last-known-good.md",
+    };
+    const nextText = serializeWorkflowMarkdown(nextFrontMatter, sections);
+    return {
+        changed: nextText !== text,
+        text: nextText,
+        diagnostics,
+    };
+}

package/dist/workflow-runtime/index.d.ts

@@ -0,0 +1,11 @@
+export * from "./types.js";
+export * from "./paths.js";
+export * from "./observability.js";
+export * from "./enforcement.js";
+export * from "./markdown.js";
+export * from "./validate.js";
+export * from "./template.js";
+export * from "./build.js";
+export * from "./file-ops.js";
+export * from "./fix.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/workflow-runtime/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/workflow-runtime/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC"}

package/dist/workflow-runtime/index.js

@@ -0,0 +1,10 @@
+export * from "./types.js";
+export * from "./paths.js";
+export * from "./observability.js";
+export * from "./enforcement.js";
+export * from "./markdown.js";
+export * from "./validate.js";
+export * from "./template.js";
+export * from "./build.js";
+export * from "./file-ops.js";
+export * from "./fix.js";

package/dist/workflow-runtime/markdown.d.ts

@@ -0,0 +1,10 @@
+import type { WorkflowDiagnostic, WorkflowDocument, WorkflowFrontMatter, WorkflowSections, WorkflowValidationResult } from "./types.js";
+export declare function parseWorkflowMarkdown(text: string, sourcePath?: string): {
+    document: Omit<WorkflowDocument, "frontMatter"> & {
+        frontMatter: WorkflowFrontMatter;
+    };
+    diagnostics: WorkflowDiagnostic[];
+};
+export declare function serializeWorkflowMarkdown(frontMatter: Record<string, unknown>, sections: WorkflowSections): string;
+export declare function diagnosticsToValidationResult(diagnostics: WorkflowDiagnostic[]): WorkflowValidationResult;
+//# sourceMappingURL=markdown.d.ts.map

package/dist/workflow-runtime/markdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/workflow-runtime/markdown.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAmHpB,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,MAAM,GAClB;IACD,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,aAAa,CAAC,GAAG;QAAE,WAAW,EAAE,mBAAmB,CAAA;KAAE,CAAC;IACvF,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC,CAmBA;AAOD,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,QAAQ,EAAE,gBAAgB,GACzB,MAAM,CAkBR;AAED,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,kBAAkB,EAAE,GAChC,wBAAwB,CAM1B"}