Release: merge beta into main

.github/dependabot.yml

@@ -24,6 +24,16 @@ updates:
         update-types: ["version-update:semver-major"]
       - dependency-name: "typescript"
         update-types: ["version-update:semver-major"]
+      # vue-router 5 peers `vite: ^7.3.0 || ^8.0.0` and expects a Vite
+      # toolchain. Measured, not assumed, and the result is SPLIT: integriq and
+      # zaakafhandelapp fail their build on `Can't resolve 'vue-router'`, while
+      # openregister and learniq build clean on 5.3.0. Held because a bump that
+      # breaks some apps and not others cannot be merged unattended, and the
+      # difference is not yet understood. Adopting it fleet-wide is a
+      # Vite migration, not a bump. versioniq is already on Vite and is the
+      # natural pilot.
+      - dependency-name: "vue-router"
+        update-types: ["version-update:semver-major"]
     cooldown:
       default-days: 1
       include:

.github/workflows/code-quality.yml

@@ -156,6 +156,7 @@ permissions:
 
 jobs:
   quality:
+    if: (github.event_name != 'pull_request' || github.head_ref != 'development')
     uses: ConductionNL/.github/.github/workflows/quality.yml@main
     with:
       app-name: hermiq

appinfo/info.xml

@@ -12,7 +12,7 @@
     <description lang="nl"><![CDATA[Hermiq brengt autonome AI-agents naar Nextcloud. Definieer een agent, geef deze tools, en laat hem volgens een schema draaien — dagelijkse rapportages, inbox-triage, monitoring, ochtendbriefings — allemaal binnen je eigen Nextcloud, afgeleverd in Nextcloud Talk. Agents, hun geheugen en hun zelflerende skills worden opgeslagen als OpenRegister-objecten, zodat elke run beheerd, controleerbaar en multi-tenant is.
 
 **Vereist:** [OpenRegister](https://apps.nextcloud.com/apps/openregister) 0.2.17-unstable.14 of hoger (installeer/upgrade via de [Nextcloud App Store](https://apps.nextcloud.com/apps/openregister)) — Hermiq's agent-engine (chat, geplande runs, flow-getriggerde agent-acties) roept OpenRegister's `ToolRegistryFacade` aan en luistert naar diens `AgentRunRequestedEvent`, die beide pas vanaf die OpenRegister-versie bestaan; de sectie "Agent-credentials" in Instellingen en de persoonlijke/organisatie-credentialresolutie hebben daarnaast OpenRegister's organisatiebrede credential broker nodig, die sinds diezelfde versie wordt geleverd.]]></description>
-    <version>0.1.40-unstable.20260830174612</version>
+    <version>0.1.47-unstable.20260905095638</version>
     <licence>EUPL-1.2</licence>
     <author mail="info@conduction.nl" homepage="https://www.conduction.nl/">Conduction</author>
     <namespace>Hermiq</namespace>
@@ -132,6 +132,32 @@
                 silently reading null.
             -->
             <step>OCA\Hermiq\Repair\RenameDutchColumns</step>
+            <!-- @spec openspec/specs/flow-authoring/spec.md#requirement-a-flow-is-stored-once-by-openregister-req-fa-002 -->
+            <!-- Runs AFTER InitializeSettings: the v0.30.0 descriptor no longer
+                 declares agentflow/agentflowrun, but the import unions schema ids
+                 and never removes one, so this step deletes the retired schemas,
+                 their rows and their tables. Idempotent: once pruned it finds
+                 nothing and reports so. -->
+            <step>OCA\Hermiq\Repair\PruneRetiredAgentFlowSchemas</step>
+            <!-- @spec openspec/changes/approval-task-convergence/specs/approval-task-convergence/spec.md#requirement-in-flight-approvals-migrate-and-roll-back -->
+            <!-- Mirrors every already-pending Approval as an OpenRegister task
+                 (approval-task convergence, phase 1). Post-migration only: a
+                 fresh install has no approvals, and new ones are mirrored at
+                 creation time by ApprovalService itself. Idempotent, guarded
+                 on the stored taskUuid backlink; rollback is
+                 `occ hermiq:approvals:rollback-task-mirror`. Runs after the
+                 register sync so the schema's new taskUuid property exists. -->
+            <step>OCA\Hermiq\Repair\MirrorPendingApprovalsToTasks</step>
+            <!-- @spec openspec/changes/schedules-onto-engine-triggers/specs/schedule-engine-delegation/spec.md#requirement-in-flight-schedules-migrate-and-roll-back -->
+            <!-- Delegates every already-eligible schedule's clock to
+                 OpenRegister's schedule trigger (schedules-onto-engine-triggers).
+                 Post-migration only: new and edited schedules are armed by the
+                 dispatch tick's own sync pass. Idempotent, guarded on the
+                 stored engineFlowId marker; rollback is
+                 `occ hermiq:schedules:rollback-flow-mirror`. Runs after the
+                 register sync so the schema's new engineFlowId property
+                 exists. -->
+            <step>OCA\Hermiq\Repair\MirrorSchedulesToEngineFlows</step>
         </post-migration>
         <install>
             <step>OCA\Hermiq\Repair\CheckOpenRegisterCompatibility</step>
@@ -161,6 +187,13 @@
         </install>
     </repair-steps>
 
+    <commands>
+        <!-- @spec openspec/changes/approval-task-convergence/specs/approval-task-convergence/spec.md#requirement-in-flight-approvals-migrate-and-roll-back -->
+        <command>OCA\Hermiq\Command\RollbackApprovalTaskMirror</command>
+        <!-- @spec openspec/changes/schedules-onto-engine-triggers/specs/schedule-engine-delegation/spec.md#requirement-in-flight-schedules-migrate-and-roll-back -->
+        <command>OCA\Hermiq\Command\RollbackScheduleFlowMirror</command>
+    </commands>
+
     <settings>
         <admin>OCA\Hermiq\Settings\AdminSettings</admin>
         <admin-section>OCA\Hermiq\Sections\SettingsSection</admin-section>

composer.json

@@ -90,7 +90,8 @@
         "optimize-autoloader": true,
         "sort-packages": true,
         "platform": {
-            "php": "8.3"
+            "php": "8.3",
+            "ext-xsl": "1"
         }
     },
     "extra": {

eslint.config.mjs

@@ -144,11 +144,32 @@ export default [
 			'no-console': 'off',
 			'n/no-process-exit': 'off',
 			'n/hashbang': 'off',
-			// `_` / `__` as a deliberate throwaway binding — `catch (_)`, a
-			// discarded destructuring slot. Narrow on purpose: the pattern matches
-			// UNDERSCORES ONLY, so a real name that happens to start with `_` is
-			// still reported. v9 drives plain `.js` through the CORE rule (the
-			// `@typescript-eslint` swap is per-file-type), so it is set here.
+			// Tests import devDependencies by definition; this rule is about what
+			// ships in the published package, which tests/ never does.
+			'n/no-unpublished-import': 'off',
+		},
+	},
+
+	{
+		// `_` / `__` as a deliberate throwaway binding — `catch (_)`, a discarded
+		// destructuring slot. Narrow on purpose: the pattern matches UNDERSCORES
+		// ONLY, so a real name that happens to start with `_` is still reported.
+		//
+		// 🔴 `.js` / `.mjs` ONLY, NOT `.ts`. The CORE rule is not TypeScript-aware:
+		// applied to a `.ts` file it reads the parameter NAMES inside a function
+		// TYPE as bindings and reports them unused. Measured on humaniq —
+		//
+		//   t?: (app: string, key: string) => string
+		//
+		// produced four `no-unused-vars` errors for `app` and `key`, which are
+		// documentation, not variables. The same mis-scoping made every unused
+		// `catch (e)` in a `.ts` spec report TWICE, once per rule.
+		//
+		// v9 already turns the core rule off for `.ts` and drives
+		// `@typescript-eslint/no-unused-vars` instead; naming `.ts` here switched
+		// it back on. TypeScript files are handled by the block below.
+		files: ['tests/**/*.js', 'tests/**/*.mjs'],
+		rules: {
 			'no-unused-vars': [
 				'error',
 				{
@@ -165,12 +186,117 @@ export default [
 					ignoreRestSiblings: true,
 				},
 			],
-			// Tests import devDependencies by definition; this rule is about what
-			// ships in the published package, which tests/ never does.
-			'n/no-unpublished-import': 'off',
 		},
 	},
 
+	{
+		// The TypeScript half of the block above. Same intent, same patterns, on
+		// the rule that actually understands the language: it knows a name inside
+		// a function type is not a binding, so type annotations stay quiet while a
+		// genuinely dead local is still reported.
+		files: ['tests/**/*.ts', 'tests/**/*.tsx'],
+		rules: {
+			'@typescript-eslint/no-unused-vars': [
+				'error',
+				{
+					varsIgnorePattern: '^_+$',
+					caughtErrors: 'all',
+					caughtErrorsIgnorePattern: '^_+$',
+					argsIgnorePattern: '^_',
+					ignoreRestSiblings: true,
+				},
+			],
+		},
+	},
+
+	{
+		// 🔴 Node-side CLI tooling under `scripts/`, which is COMMONJS. Flat
+		// config defaults every `.js` to ESM with browser-ish globals, so without
+		// this block eslint reports the CommonJS wrapper itself as undefined
+		// identifiers. Measured on this app: 52 of the 233 errors under
+		// `tests/` + `scripts/` were `no-undef`, ALL of them in `scripts/`, and
+		// all five names were the environment rather than a typo — `process` 23,
+		// `require` 20, `__dirname` 6, `__filename` 2, `module` 1.
+		//
+		// This is describing the environment, not relaxing a rule, and it is the
+		// same argument the test-globals block below makes: declaring them keeps
+		// `no-undef` able to do its real job, which is catching a genuinely
+		// misspelled identifier. Suppressing the rule instead would bury that.
+		//
+		// `no-console` is off because printing its report is what a CLI checker
+		// is FOR.
+		//
+		// 🔴 NO `n/*` ENTRIES HERE, DELIBERATELY. `eslint-plugin-n` is NOT
+		// registered for these files under eslint 10 + @nextcloud/eslint-config
+		// 9, so `'n/no-process-exit': 'off'` would be dead config that reads as
+		// if it were doing something. Measured both ways on this app: 0 `n/`
+		// findings with the entries and 0 without.
+		//
+		// What DID report was the opposite — four `scripts/*.js` carried
+		// `/* eslint-disable n/no-process-exit */` and `/* eslint-disable
+		// n/shebang */` left over from the eslintrc era, and an inline disable
+		// naming an unregistered plugin is itself an error ("Definition for rule
+		// 'n/shebang' was not found"). Those 8 comments are removed; do not add
+		// `n/*` rules back to replace them.
+		//
+		// ⚠️ `.js` and `.cjs` ONLY. A `scripts/*.mjs` is genuinely ESM and must
+		// keep the default `sourceType`, or `import` stops parsing there.
+		files: ['scripts/**/*.js', 'scripts/**/*.cjs'],
+		languageOptions: {
+			sourceType: 'commonjs',
+			globals: {
+				require: 'readonly',
+				module: 'writable',
+				exports: 'writable',
+				process: 'readonly',
+				__dirname: 'readonly',
+				__filename: 'readonly',
+				console: 'readonly',
+				Buffer: 'readonly',
+				global: 'readonly',
+				URL: 'readonly',
+				TextEncoder: 'readonly',
+				TextDecoder: 'readonly',
+			},
+		},
+		rules: {
+			'no-console': 'off',
+		},
+	},
+
+	{
+		// The ESM half of the block above. A `scripts/*.mjs` is genuinely a module
+		// and must keep the default `sourceType`, so it gets Node's globals but
+		// none of the CommonJS wrapper. Measured: `process` reported undefined 2x
+		// in hermiq's generate-opengemeenten-icons.mjs and 4x in openregister's
+		// l10n/runtime-check.mjs, which the `.js`/`.cjs` block deliberately does
+		// not match.
+		files: ['scripts/**/*.mjs', 'tests/**/*.mjs'],
+		languageOptions: {
+			globals: {
+				process: 'readonly',
+				console: 'readonly',
+				Buffer: 'readonly',
+				global: 'readonly',
+				URL: 'readonly',
+				TextEncoder: 'readonly',
+				TextDecoder: 'readonly',
+			},
+		},
+		rules: {
+			'no-console': 'off',
+		},
+	},
+
+	{
+		// eslint must not try to PARSE a shell script. `tests/e2e/seed.test.sh`
+		// matches the `**/*.test.*` glob some presets use, and eslint then reads
+		// it as JavaScript and reports "Parsing error: Unexpected character" —
+		// a finding about a file it should never have opened.
+		ignores: ['**/*.sh', '**/*.bash'],
+	},
+
+
 	{
 		// Test globals. Several apps keep their spec files INSIDE `src/`, which the
 		// lint script scans, and neither `@nextcloud/eslint-config` nor the runner

l10n/en.js

@@ -1,6 +1,14 @@
 OC.L10N.register(
     "hermiq",
     {
+        "Load example data?": "Load example data?",
+        "Example data fills the lists, detail pages and dashboards so you can see the app working straight away. Pick \"None\" on a production install.": "Example data fills the lists, detail pages and dashboards so you can see the app working straight away. Pick \"None\" on a production install.",
+        "Load the example data": "Load the example data",
+        "Loads what you picked. The data is obviously sample data, it is safe to run more than once, and you can delete it afterwards.": "Loads what you picked. The data is obviously sample data, it is safe to run more than once, and you can delete it afterwards.",
+        "None, I will set this up myself": "None, I will set this up myself",
+        "Nothing is imported. You start with an empty app and add your own data.": "Nothing is imported. You start with an empty app and add your own data.",
+        "Example data": "Example data",
+        "Sample values for every schema this app supplies, generated from the schemas themselves. It shows the lists, detail pages and dashboards working rather than telling a story. Safe to run more than once, and you can delete it afterwards.": "Sample values for every schema this app supplies, generated from the schemas themselves. It shows the lists, detail pages and dashboards working rather than telling a story. Safe to run more than once, and you can delete it afterwards.",
         "\"Satisfied\" means Hermiq can evidence this control from its own governance data — it is not a certification of compliance by a qualified auditor.": "\"Satisfied\" means Hermiq can evidence this control from its own governance data — it is not a certification of compliance by a qualified auditor.",
         "%n case": "%n case",
         "%n cases": "%n cases",
@@ -1307,7 +1315,10 @@ OC.L10N.register(
         "Where this agent’s dictated audio is transcribed. “On this instance” never leaves the server and is slower; “browser” is instant and, in most browsers, sends the audio to the browser vendor.": "Where this agent’s dictated audio is transcribed. “On this instance” never leaves the server and is slower; “browser” is instant and, in most browsers, sends the audio to the browser vendor.",
         "Where the automation lives": "Where the automation lives",
         "Flows are what happens without anyone clicking: an agent that runs on a schedule, a hand-off that fires when a task completes. This is where you read and edit them. Nothing to build now.": "Flows are what happens without anyone clicking: an agent that runs on a schedule, a hand-off that fires when a task completes. This is where you read and edit them. Nothing to build now.",
-        "Open Flows in the menu": "Open Flows in the menu"
+        "Open Flows in the menu": "Open Flows in the menu",
+        "Reports": "Reports",
+        "Pick a report to open it.": "Pick a report to open it.",
+        "What the agents did, and what a human still has to answer for.": "What the agents did, and what a human still has to answer for."
     },
     "nplurals=2; plural=(n != 1);"
 )