fix(flows): recover orphaned runs and add Stop button

.github/workflows/pr-checks.yml

@@ -23,7 +23,13 @@ jobs:
       - name: Check changed paths
         id: changes
         run: |
-          changed=$(git diff --name-only origin/main...HEAD 2>/dev/null || echo "")
+          if [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then
+            echo "web=true" >> "$GITHUB_OUTPUT"
+            echo "desktop=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          changed=$(git diff --name-only origin/main...HEAD)
           echo "web=$(echo "$changed" | grep -qE '^(apps/web/|scripts/)' && echo true || echo false)" >> "$GITHUB_OUTPUT"
           echo "desktop=$(echo "$changed" | grep -qE '^apps/desktop/' && echo true || echo false)" >> "$GITHUB_OUTPUT"
 

.github/workflows/pr-governance.yml

@@ -69,11 +69,6 @@ jobs:
           check_package() {
             local pkg="$1"
 
-            if ! jq empty "$pkg" 2>/dev/null; then
-              echo "::warning file=${pkg}::Malformed package.json — skipped"
-              return 1
-            fi
-
             local unpinned
             unpinned=$(jq -r '
               [(.dependencies // {}), (.devDependencies // {})]
@@ -103,6 +98,11 @@ jobs:
             -not -path '*/.pnpm/*' \
             | sort); do
 
+            if ! jq empty "$pkg" 2>/dev/null; then
+              echo "::warning file=${pkg}::Malformed package.json — skipped"
+              continue
+            fi
+
             deps=$(jq -r '(.dependencies // {} | length) + (.devDependencies // {} | length)' "$pkg" 2>/dev/null)
             if [[ "$deps" == "0" ]] || [[ -z "$deps" ]]; then
               continue
@@ -136,8 +136,8 @@ jobs:
       - name: Get changed files
         id: changes
         run: |
-          changed=$(git diff --name-only --diff-filter=ACR origin/main...HEAD 2>/dev/null \
-            || git diff --name-only --diff-filter=ACR HEAD~1 2>/dev/null \
+          changed=$(git diff --name-only --diff-filter=ACMR origin/main...HEAD 2>/dev/null \
+            || git diff --name-only --diff-filter=ACMR HEAD~1 2>/dev/null \
             || echo "")
           EOF_MARKER=$(dd if=/dev/urandom bs=15 count=1 2>/dev/null | base64)
           echo "files<<${EOF_MARKER}" >> "$GITHUB_OUTPUT"
@@ -146,6 +146,8 @@ jobs:
 
       - name: Check for sensitive files
         if: steps.changes.outputs.files != ''
+        env:
+          CHANGED_FILES: ${{ steps.changes.outputs.files }}
         run: |
           sensitive_patterns=(
             '\.env$'
@@ -170,7 +172,7 @@ jobs:
           )
 
           found=0
-          changed_files="${{ steps.changes.outputs.files }}"
+          changed_files="$CHANGED_FILES"
 
           for pattern in "${sensitive_patterns[@]}"; do
             matches=$(echo "$changed_files" | grep -iE "$pattern" || true)
@@ -192,8 +194,10 @@ jobs:
 
       - name: Scan for hardcoded secrets
         if: steps.changes.outputs.files != ''
+        env:
+          CHANGED_FILES: ${{ steps.changes.outputs.files }}
         run: |
-          changed_files="${{ steps.changes.outputs.files }}"
+          changed_files="$CHANGED_FILES"
 
           # Only scan text files
           scannable=$(echo "$changed_files" | grep -vE '\.(png|jpg|jpeg|gif|ico|svg|woff2?|ttf|eot|mp[34]|webm|webp|zip|tar|gz|lock)$' || true)
@@ -226,10 +230,10 @@ jobs:
             'glpat-[a-zA-Z0-9_-]{20,}'
             'xox[bsapr]-[a-zA-Z0-9-]+'
             'BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY'
-            'password\s*[:=]\s*["\x27][^"\x27]{8,}'
-            'secret\s*[:=]\s*["\x27][^"\x27]{8,}'
-            'api[_-]?key\s*[:=]\s*["\x27][^"\x27]{8,}'
-            'access[_-]?token\s*[:=]\s*["\x27][^"\x27]{8,}'
+            "password\\s*[:=]\\s*[\"'][^\"']{8,}"
+            "secret\\s*[:=]\\s*[\"'][^\"']{8,}"
+            "api[_-]?key\\s*[:=]\\s*[\"'][^\"']{8,}"
+            "access[_-]?token\\s*[:=]\\s*[\"'][^\"']{8,}"
           )
 
           for pattern in "${secret_patterns[@]}"; do

.github/workflows/pr-workflows.test.mjs

@@ -0,0 +1,75 @@
+import assert from 'node:assert/strict'
+import { spawnSync } from 'node:child_process'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { readFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import test from 'node:test'
+
+const governance = await readFile(new URL('./pr-governance.yml', import.meta.url), 'utf8')
+const checks = await readFile(new URL('./pr-checks.yml', import.meta.url), 'utf8')
+
+test('SC-2: security scanning matches single-quoted secret assignments', () => {
+  const start = governance.indexOf('          secret_patterns=(')
+  const end = governance.indexOf('          )', start) + '          )'.length
+  const secretPatterns = governance.slice(start, end)
+  const script = `${secretPatterns}
+for pattern in "\${secret_patterns[@]}"; do
+  if printf '%s\\n' "$1" | grep -iE "$pattern" >/dev/null; then
+    exit 0
+  fi
+done
+exit 1`
+
+  // Assemble the sample at runtime: the literal assignment would itself match
+  // the secret patterns this scan is checking for.
+  const fakeValue = 'hunter2secret'
+  for (const quote of ["'", '"']) {
+    const assignment = `password = ${quote}${fakeValue}${quote}`
+    const result = spawnSync('bash', ['-c', script, '--', assignment])
+    assert.equal(result.status, 0, `secret scanner must match ${assignment}`)
+  }
+})
+
+test('SC-2: sensitive-file scanning includes modified paths', () => {
+  assert.match(governance, /--diff-filter=ACMR/)
+})
+
+test('SC-4: PR-controlled filenames are passed to security scan steps through the environment', () => {
+  assert.doesNotMatch(governance, /changed_files="\$\{\{ steps\.changes\.outputs\.files \}\}"/)
+  assert.equal(
+    governance.match(/CHANGED_FILES: \$\{\{ steps\.changes\.outputs\.files \}\}/g)?.length,
+    2,
+  )
+  assert.match(governance, /"\$CHANGED_FILES"/)
+})
+
+test('SC-6: manual PR-check runs enable both application suites and do not hide diff failures', () => {
+  assert.match(checks, /\$GITHUB_EVENT_NAME" == "workflow_dispatch"/)
+  assert.doesNotMatch(checks, /git diff --name-only origin\/main\.\.\.HEAD 2>\/dev\/null \|\| echo ""/)
+})
+
+test('SC-10: malformed manifests warn without failing the pinned-version check', () => {
+  const marker = '      - name: Check dependency version pinning\n        run: |\n'
+  const start = governance.indexOf(marker) + marker.length
+  const end = governance.indexOf('\n\n  security-scan:', start)
+  const script = governance.slice(start, end).replace(/^          /gm, '')
+  const fixtureDirectory = mkdtempSync(join(process.cwd(), '.pr-workflows-test-'))
+
+  try {
+    writeFileSync(join(fixtureDirectory, 'package.json'), '{"dependencies":')
+
+    const result = spawnSync('bash', ['-e', '-o', 'pipefail', '-c', script], {
+      cwd: fixtureDirectory,
+      encoding: 'utf8',
+    })
+
+    assert.equal(
+      result.status,
+      0,
+      `expected malformed manifests to be non-fatal; stdout: ${result.stdout || '<empty>'}; stderr: ${result.stderr || '<empty>'}`,
+    )
+    assert.match(result.stdout, /::warning file=\.\/package\.json::Malformed package\.json — skipped/)
+  } finally {
+    rmSync(fixtureDirectory, { force: true, recursive: true })
+  }
+})

apps/web/src/components/flows/__tests__/flow-run-history.test.tsx

@@ -1,10 +1,18 @@
 /** @vitest-environment jsdom */
-import { cleanup, render, screen } from '@testing-library/react'
-import { afterEach, describe, expect, it } from 'vitest'
+import { cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 import { FlowRunHistory } from '@/components/flows/flow-run-history'
 import type { FlowDetail } from '@/lib/flows/types'
 
+const clientMocks = vi.hoisted(() => ({
+  cancelFlowRunRequest: vi.fn(),
+}))
+
+vi.mock('@/lib/flows/client', () => ({
+  cancelFlowRunRequest: clientMocks.cancelFlowRunRequest,
+}))
+
 const flow: FlowDetail = {
   createdAt: '2026-05-12T10:00:00.000Z',
   cronExpression: null,
@@ -59,6 +67,10 @@ const flow: FlowDetail = {
 }
 
 describe('FlowRunHistory', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
   afterEach(() => cleanup())
 
   it('renders run history and session link', () => {
@@ -90,4 +102,38 @@ describe('FlowRunHistory', () => {
 
     expect(screen.getByText('No runs recorded yet.')).toBeTruthy()
   })
+
+  it('surfaces a rejected card Stop request', async () => {
+    clientMocks.cancelFlowRunRequest.mockResolvedValue({ ok: false, error: 'forbidden' })
+    render(<FlowRunHistory flow={{
+      ...flow,
+      runs: [{
+        ...flow.runs[0]!,
+        executionUser: { slug: 'alice' },
+        finishedAt: null,
+        status: 'running',
+      }],
+    }} slug="alice" />)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Stop' }))
+
+    expect(await screen.findByText('forbidden')).toBeTruthy()
+  })
+
+  it('surfaces a card Stop network failure', async () => {
+    clientMocks.cancelFlowRunRequest.mockRejectedValue(new Error('offline'))
+    render(<FlowRunHistory flow={{
+      ...flow,
+      runs: [{
+        ...flow.runs[0]!,
+        executionUser: { slug: 'alice' },
+        finishedAt: null,
+        status: 'running',
+      }],
+    }} slug="alice" />)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Stop' }))
+
+    expect(await screen.findByText('Network error. Try again.')).toBeTruthy()
+  })
 })