vinta-ai-workflows 0.7.0-alpha3 → 0.7.0-alpha5

package/CHANGELOG.md

@@ -7,6 +7,8 @@ the project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [0.7.0] — YYYY-MM-DD
 
+<!-- pre-release: 0.7.0-alpha5 on 2026-09-13 -->
+<!-- pre-release: 0.7.0-alpha4 on 2026-09-13 -->
 <!-- pre-release: 0.7.0-alpha3 on 2026-09-12 -->
 <!-- pre-release: 0.7.0-alpha2 on 2026-09-12 -->
 <!-- pre-release: 0.7.0-alpha1 on 2026-09-11 -->
@@ -218,6 +220,182 @@ the project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Fixed
 
+- **Four places the UI asked the operator to work around it.** The transcript
+  opened at the *oldest* row it held, so a live agent's newest line — the one
+  the panel was opened to read — sat below the fold and every arriving entry
+  pushed it further down; it now opens at the newest and stays there, but only
+  while the operator is already at the bottom, because scrolling up is reading.
+  The `git diff` command overflowed its panel, uncopyable without selecting
+  blind, and now wraps. The shell's bounded column went from 1280px to 1600px:
+  1280 is a reading measure, and the Nodes table's columns are ids, lane names
+  and branch names, none of which can be abbreviated without losing what
+  identifies them. And the notification interval said "Remind every 5 min"
+  without ever saying what it would remind anyone about — it repeats the
+  notification for a phase that stopped to ask the operator something, until
+  they answer, which is what the options say now.
+
+- **A killed terminal releases its directory on Windows.** Two PTY tests failed
+  teardown with `EBUSY: rmdir`: killing a process there is not synchronous with
+  releasing what it held, so the conpty and its background child are gone as far
+  as the test is concerned while the OS still has the working directory open.
+
+- **A failed phase can be retried instead of ending the run.** `run` takes
+  `--on-failure <stop|ask>`. `stop` is the default and is what every run has
+  always done — the phase fails, its dependents block, the run finishes. `ask`
+  parks the node on a question instead: retry, retry with another member of the
+  crew, or stop.
+
+  It exists because the failures worth retrying are overwhelmingly
+  environmental — a permission wall, a grant nobody made, a gate whose service
+  was not up — and the only recovery was to start the whole plan again, running
+  every phase that had already succeeded a second time. Only pass `ask` when
+  somebody is watching: the run waits, which is exactly why it is not the
+  default.
+
+  The alternatives offered are **members of the crew, not models**. A staffed
+  run has no free-floating models in it — a phase is taken by a member, and the
+  tier floor that decides who may take it is the assigned member's own — so a
+  model is something the plan cannot express and nobody could be found to hold.
+  A member below the phase's tier is never offered: an operator answering a
+  question is not a reason to hand a phase to somebody the plan judged too
+  junior for it.
+
+  The retry starts **cold**, and everything the node held goes back before it
+  waits (§6.1) — an operator at lunch must not be holding a lane another phase
+  could use.
+
+- **A refusal nobody was asked about is now said out loud.** The adapter knew
+  about `permission_request`, a question waiting for an answer, and nothing
+  else. The refusal an operator actually hits is not a question: a read outside
+  the working directory is decided by the CLI and announced as
+  `permission_denied`, with no request to reply to. That frame was dropped at
+  the first `switch` — no event, no journal row, no transcript line. The new
+  `permission_denied` event carries the decision token (`workingDir`, `mode`)
+  and never the vendor's prose, which names the file being read (§11).
+
+- **A turn that ended blocked is no longer a turn that succeeded.** The CLI
+  says `status_category: "blocked"` one frame before reporting
+  `is_error: false`, and both are true from its side: it was asked for
+  something it could not do and said so. Taking the second at its word is how a
+  phase passed having written no code and then failed two steps later under
+  another name. A session that reported an error no longer ends `ok` — which
+  also makes a reviewer fail closed, since its verdict is read back out of a
+  transcript whose session did not end cleanly.
+
+- **An agent still could not write in its own lane.** The entry below passed
+  claude-code `--permission-mode auto`, which matched our own vocabulary for
+  "works unattended" and is not what the vendor means by the word: `auto` still
+  routes a write to a permission prompt, and in `-p` there is nobody to answer
+  one. Run against the CLI, a `Write` to the agent's *own working directory*
+  comes back denied with no reason attached — the same dead end, wearing the
+  word that made it look closed. `acceptEdits` is the mode under which that
+  write succeeds, and is what `auto` now maps to. The test covering this
+  asserted the word rather than the behaviour, so it pinned the bug in place.
+
+- **A phase can read the operator's checkout.** A lane is a worktree cut from a
+  branch, so anything uncommitted — a plan written this morning, a spec that
+  never leaves the operator's machine — is present where they are and absent
+  from every lane. Reaching for it was refused before the model saw a byte, with
+  a message that reads like a prompt awaiting an answer ("Claude requested
+  permissions to read from …, but you haven't granted it yet") when in fact
+  nothing is asking: the CLI denies it outright, emits no permission request,
+  and the session then ends *successfully*, having written nothing.
+
+  The repository root is now granted to every claude-code agent for **reading**.
+  Granting a directory also grants writing in it, and the lane sits inside the
+  directory being granted, so the grant is paired with a deny list that keeps
+  the lane the only writable place under it — the operator's source and every
+  sibling lane stay refused. That list names the *siblings* at each level down
+  to the lane rather than the root itself, because the vendor resolves deny
+  before allow with no carve-out: `deny: <repo>/**` plus `allow: <lane>/**`
+  refuses the lane too. Each of those facts was established by running the CLI.
+
+  **This covers the file-editing tools and not `Bash`.** A shell redirection was
+  never confined to the working directory and is not confined now; that boundary
+  is the OS's, and the vendor's sandbox that enforces it also switches off the
+  network a phase needs to install anything.
+
+  codex needed nothing: under `--approve-for-me` it already reads anywhere on
+  disk, which was confirmed the same way.
+
+- **An agent can write in its own lane.** Every adapter declared
+  `permissionControl: true` and passed no policy at all: claude-code was spawned
+  as `-p --output-format stream-json …` with no `--permission-mode`, and codex as
+  `exec --json` with no sandbox and no approval flag, under a comment saying it
+  took both on the command line. So a headless run asked before its first write,
+  emitted a `permission_request`, rendered it in the transcript — and nothing
+  anywhere answered. The phase failed reporting a permission system it could not
+  see, having written nothing.
+
+  `run` and `serve` now take `--permission <ask|auto|full>`, defaulting to
+  `auto`. **The operator sets it, never the workflow document**: the document is
+  committed and shared, and a file in a repository should not be able to tell
+  someone else's machine to run agents without approvals.
+
+  Both CLIs refuse combinations that looked reasonable, and both were found by
+  running them rather than reading them: codex rejects `--sandbox` alongside
+  `--approve-for-me`, and `codex exec resume` accepts neither — passing the
+  fresh-spawn policy there turned a `stale_session` refusal, which the scheduler
+  retries cold, into a `fatal` one that fails the node.
+
+  This reverses a documented decision. The README said the daemon passed no
+  permission flags and that a committed `.claude/settings.json` was what made a
+  run able to write; that is now the narrowing layer on top of a mode, not the
+  only thing standing between an agent and a blocked lane.
+- **`purge --lanes --branches` clears what a failed run leaves behind.** A run's
+  lane worktrees are not under `runs/`, so no purge ever reached them: three
+  failed attempts at one plan left twelve worktrees, twelve summaries, and a set
+  of `plan/<id>/phase-*` branches still checked out — which is what makes the
+  *next* run of that plan impossible, since git refuses to check out a branch a
+  second worktree holds.
+
+  One rule decides both: **never delete the only copy of work.** A phase can
+  leave work committed on its branch or uncommitted in its worktree, and both
+  count — so a branch carrying commits no other branch has is kept, a lane with
+  a dirty tree is kept, and each is listed with the command to remove it by
+  hand. Untracked files count as work: a phase that wrote three new modules and
+  never committed them is exactly the case worth protecting.
+
+  Emptiness is measured as "carries no commit another branch does not already
+  have", not as "merged into HEAD". The latter is relative to wherever the
+  operator is standing, so on a feature branch — the checkout this is most often
+  run from — every empty phase branch looked unmerged and nothing was ever
+  cleaned up.
+
+  `--dry-run` and `--yes` work as they already did, and a worktree that will not
+  go is named rather than counted.
+
+- **`doctor` now catches, before a lane exists, the failures that used to take a
+  run each.** Four consecutive runs of one plan failed four different ways, and
+  every one of them was knowable at minute zero from the workflow and the repo.
+  - **Every `prompt_ref` and `plan_context_ref` is resolved against
+    `base_branch`**, with `git cat-file -e`, which reads the branch's tree and
+    so cannot be satisfied by a working-tree copy — the working tree being
+    exactly what a lane will not have. It distinguishes the three cases, because
+    they have three different fixes: never committed, **staged but never
+    committed** (`git add` alone does not put a file in a branch), and committed
+    on a different branch. The last offers both routes out — merge it, or point
+    `base_branch` at the branch that has it — since only the operator knows
+    which they want.
+  - **Phase branches held by another worktree** are reported with the directory
+    to remove. Lane directories are named per run and phase branches per
+    workflow, so a failed run leaves worktrees holding the branch names the next
+    run will try to cut, and git refuses to check out a branch twice. Nothing
+    cleans those up: `purge` deletes run state under `.vinta-ai-maestro/runs/`,
+    and lane worktrees are not there. `doctor` does not delete them either — a
+    failed lane's worktree is the only place its state survives — but it now
+    names each one and the exact command.
+
+- **A failed node records why.** `node_status` carried `{"status":"failed"}` and
+  nothing else, so two runs failing for two unrelated reasons produced identical
+  journal rows and the cause survived only in the operator's terminal. The
+  reason is now persisted — **sanitized**, not raw: errors the package builds
+  itself are identifiers by construction and are kept verbatim, and anything
+  else is reduced to its kind, the rule `recycleStage` already followed. The
+  journal is durable and API-served, and an exception message from a dependency
+  is exactly how repository content gets into one. Blocked dependents record
+  which node blocked them.
+
 - **Two diagnostics that named the symptom and hid the cause.** Both came out of
   one real run, and neither was a wrong answer — just an unusable one.
   - **A phase whose plan is not committed** failed with `prompt_ref "…" names no

package/package.json

@@ -1,16 +1,11 @@
 {
   "name": "vinta-ai-workflows",
-  "version": "0.7.0-alpha3",
+  "version": "0.7.0-alpha5",
   "description": "Bootstrap AI tooling (AGENTS.md, skills, sub-agents) across Claude Code, Codex, Cursor, and VS Code + GitHub Copilot.",
   "type": "module",
-  "packageManager": "pnpm@10.33.0",
   "bin": {
     "vinta-ai-workflows": "./vinta-ai-workflows.mjs"
   },
-  "scripts": {
-    "check-ai-models": "node scripts/check-ai-models.mjs",
-    "test": "node --test tests/*.test.mjs"
-  },
   "devDependencies": {
     "yaml": "^2.4.0"
   },
@@ -26,10 +21,14 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+ssh://git@github.com:vintasoftware/vinta-ai-workflows.git"
+    "url": "git+https://github.com/vintasoftware/vinta-ai-workflows.git"
   },
   "publishConfig": {
     "access": "public"
   },
-  "license": "MIT"
-}
+  "license": "MIT",
+  "scripts": {
+    "check-ai-models": "node scripts/check-ai-models.mjs",
+    "test": "node --test tests/*.test.mjs"
+  }
+}