@app-vitals/agent-admin 0.2.0 → 0.3.0

package/prisma/client/models.ts

@@ -27,6 +27,8 @@ export type * from './models/AgentCronRunSkillUsage.ts'
 export type * from './models/AgentCronRunModelBreakdown.ts'
 export type * from './models/AgentChatTokenUsageDailyByModel.ts'
 export type * from './models/AgentAsk.ts'
+export type * from './models/AgentCronRunTranscript.ts'
+export type * from './models/AgentTranscriptRead.ts'
 export type * from './models/AgentGitHubInstallationsSnapshot.ts'
 export type * from './models/PushSubscription.ts'
 export type * from './models/ChatThreadWatch.ts'

package/prisma/migrations/20261027000000_add_cron_run_transcripts/migration.sql

@@ -0,0 +1,37 @@
+-- COS-43.1: redacted cron-run transcripts + per-read audit rows (additive only).
+-- CreateTable
+CREATE TABLE "AgentCronRunTranscript" (
+    "id" TEXT NOT NULL,
+    "runId" TEXT NOT NULL,
+    "agentId" TEXT NOT NULL,
+    "cronId" TEXT NOT NULL,
+    "sessionId" TEXT,
+    "bytes" INTEGER NOT NULL,
+    "truncated" BOOLEAN NOT NULL,
+    "redactions" INTEGER NOT NULL,
+    "body" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "AgentCronRunTranscript_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "AgentTranscriptRead" (
+    "id" TEXT NOT NULL,
+    "runId" TEXT NOT NULL,
+    "agentId" TEXT NOT NULL,
+    "reader" TEXT NOT NULL,
+    "scopeKind" TEXT NOT NULL,
+    "at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "AgentTranscriptRead_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "AgentCronRunTranscript_runId_key" ON "AgentCronRunTranscript"("runId");
+
+-- CreateIndex
+CREATE INDEX "AgentCronRunTranscript_agentId_createdAt_idx" ON "AgentCronRunTranscript"("agentId", "createdAt");
+
+-- CreateIndex
+CREATE INDEX "AgentTranscriptRead_agentId_at_idx" ON "AgentTranscriptRead"("agentId", "at");

package/prisma/schema/schema.prisma

@@ -426,6 +426,40 @@ model AgentAsk {
   @@index([fromAgentId, createdAt])
 }
 
+// ─── Cron-run transcripts (COS-43.1) ────────────────────────────────────────
+// One redacted session transcript per cron run, uploaded by the agent runtime
+// (already redacted + tail-truncated to 1 MiB) and served only to admin /
+// platform callers behind SHIPWRIGHT_TRANSCRIPT_API_ENABLED. No FK on runId:
+// the retention sweep (newest 200 per agent) is the only lifecycle. The body
+// is never logged. AgentTranscriptRead is the audit row written before every
+// transcript read.
+
+model AgentCronRunTranscript {
+  id         String   @id @default(cuid())
+  runId      String   @unique
+  agentId    String
+  cronId     String
+  sessionId  String?
+  bytes      Int
+  truncated  Boolean
+  redactions Int
+  body       String   @db.Text
+  createdAt  DateTime @default(now())
+
+  @@index([agentId, createdAt])
+}
+
+model AgentTranscriptRead {
+  id        String   @id @default(cuid())
+  runId     String
+  agentId   String
+  reader    String
+  scopeKind String
+  at        DateTime @default(now())
+
+  @@index([agentId, at])
+}
+
 // ─── Agent GitHub Installations Snapshot ────────────────────────────────────
 // One row per agent holding the agent's most recently reported GitHub App
 // installations (owner, installation id, state, sanitized lastError). PUT

package/src/admin-boot.ts

@@ -92,6 +92,7 @@ import {
 } from "./caller-scope.ts";
 import { parseChatCredentialConfig } from "./chat-credential-config.ts";
 import { HttpChatServiceProvisioningClient } from "./chat-service-provisioning-client.ts";
+import { CronRunTranscriptService } from "./cron-run-transcripts.ts";
 import { isDevAuthAllowed } from "./dev-auth-guard.ts";
 import { HttpGithubAppProvisioningClient } from "./github-app-provisioning-client.ts";
 import { HttpGoogleAuthClient } from "./google-auth-client.ts";
@@ -106,6 +107,7 @@ import { HttpSlackProvisioningClient } from "./slack-provisioning-client.ts";
 import { SpecialtyRegistry } from "./specialty-manifest-loader.ts";
 import { runStartupPolicyReconcile } from "./startup-policy-reconcile.ts";
 import { makeTokenCrypto } from "./token-crypto.ts";
+import { parseTranscriptConfig } from "./transcript-config.ts";
 import {
   resolveTrialExpirySweepIntervalMs,
   TrialExpirySweeper,
@@ -291,6 +293,9 @@ export async function startAdmin(
   // Agent-to-agent ask (COS-31.1). Throws at boot on a malformed allowlist.
   const agentAskConfig = parseAgentAskConfig(process.env);
 
+  // Cron-run transcript API (COS-43.1): flag off by default.
+  const transcriptConfig = parseTranscriptConfig(process.env);
+
   // Web Push (CFB-4.2). Enabled ONLY when public + private + subject are all
   // set — a partial config must not half-enable the feature. When disabled,
   // pushService is undefined, the push routes 503, and the toggle renders "".
@@ -415,6 +420,7 @@ export async function startAdmin(
     adminApiKeys,
     agentTokenService,
     anthropicFederationEnabled,
+    transcriptUploadEnabled: transcriptConfig.enabled,
   });
 
   root.route("/agents", runtimeApp);
@@ -457,6 +463,10 @@ export async function startAdmin(
       store: new AgentAskService(prisma),
     },
     ...(chatClient ? { chatClient } : {}),
+    transcripts: {
+      config: transcriptConfig,
+      store: new CronRunTranscriptService(prisma),
+    },
     ...resolvedExtensions.apiDeps,
   });
   root.route("/", adminApiApp);

package/src/agents-api.ts

@@ -83,6 +83,10 @@ import {
   memberOnlyCallerScopeResolver,
 } from "./caller-scope.ts";
 import type { ChatServiceProvisioningClient } from "./chat-service-provisioning-client.ts";
+import {
+  type CronRunTranscriptDeps,
+  registerCronRunTranscriptRoutes,
+} from "./cron-run-transcripts.ts";
 import {
   ApiError,
   BadRequestError,
@@ -291,6 +295,11 @@ export interface AdminDeps {
    * route 503s, even with the flag on.
    */
   chatClient?: AskChatClient;
+  /**
+   * Cron-run transcripts (COS-43.1): flag config + store. Absent or flag off
+   * -> the transcript routes 404. See cron-run-transcripts.ts.
+   */
+  transcripts?: CronRunTranscriptDeps;
 }
 
 export type { AdminApiKey };
@@ -2335,6 +2344,10 @@ export function createAdminApp(deps: AdminDeps): OpenAPIHono<AdminAuthEnv> {
     agentService,
   });
 
+  // ─── Cron-run transcripts (COS-43.1) ──────────────────────────────────────
+
+  registerCronRunTranscriptRoutes(app, { transcripts: deps.transcripts });
+
   // ─── Plugins ───────────────────────────────────────────────────────────────
 
   // POST /agents/:id/plugins — add a plugin

package/src/api.smoke.test.ts

@@ -236,6 +236,7 @@ function buildApp(opts?: {
   maxFindings?: number;
   cleanupMergedWorktrees?: boolean;
   cleanupAfterDays?: number;
+  transcriptUploadEnabled?: boolean;
 }) {
   const hasAgent = opts?.hasAgent ?? true;
   const bundle: AgentEnvBundle | null =
@@ -308,6 +309,7 @@ function buildApp(opts?: {
     agentTokenService: { validate: async () => null },
     sessionSecret: SESSION_SECRET,
     anthropicFederationEnabled: opts?.anthropicFederationEnabled,
+    transcriptUploadEnabled: opts?.transcriptUploadEnabled,
   });
 }
 
@@ -326,6 +328,31 @@ describe("GET /:id/config with no phase-methodology service (platform only)", ()
   });
 });
 
+describe("GET /:id/config features (COS-43.1)", () => {
+  const get = (app: ReturnType<typeof buildApp>) =>
+    app.request(`/${KNOWN_AGENT_ID}/config`, {
+      headers: { Authorization: `Bearer ${VALID_ADMIN_KEY}` },
+    });
+
+  test("features default to all off", async () => {
+    const body = await (await get(buildApp())).json();
+    expect(body.features).toEqual({
+      transcriptUpload: false,
+      repoAccessCheck: false,
+    });
+  });
+
+  test("features.transcriptUpload follows the transcript flag", async () => {
+    const body = await (
+      await get(buildApp({ transcriptUploadEnabled: true }))
+    ).json();
+    expect(body.features).toEqual({
+      transcriptUpload: true,
+      repoAccessCheck: false,
+    });
+  });
+});
+
 describe("GET /:id/config (mounted as GET /agents/:id/config from root)", () => {
   test("200 with full bundle when agent exists with env vars, tools, plugins", async () => {
     const app = buildApp();

package/src/api.ts

@@ -93,6 +93,11 @@ export interface AgentConfigResponse {
   maxFindings: number;
   cleanupMergedWorktrees: boolean;
   cleanupAfterDays: number;
+  /**
+   * COS-43.1: feature flags the runtime acts on. Optional so fixtures built
+   * before it keep compiling; the live handler always populates it.
+   */
+  features?: { transcriptUpload: boolean; repoAccessCheck: boolean };
 }
 
 interface AgentEnvServiceLike {
@@ -169,6 +174,11 @@ export interface AgentRuntimeDeps {
   agentTokenService: Pick<AgentTokenService, "validate">;
   /** WIF-2.1: Anthropic federation is enabled; defaults to false. */
   anthropicFederationEnabled?: boolean;
+  /**
+   * COS-43.1: SHIPWRIGHT_TRANSCRIPT_API_ENABLED is on — surfaced to the runtime
+   * as `features.transcriptUpload` in the config bundle. Defaults to false.
+   */
+  transcriptUploadEnabled?: boolean;
 }
 
 // ─── Route definitions ────────────────────────────────────────────────────────
@@ -342,6 +352,11 @@ export function createAgentRuntimeApp(deps: AgentRuntimeDeps): OpenAPIHono {
       maxFindings: agent.maxFindings,
       cleanupMergedWorktrees: agent.cleanupMergedWorktrees,
       cleanupAfterDays: agent.cleanupAfterDays,
+      // COS-43.1: repoAccessCheck is wired by COS-44.1; false until then.
+      features: {
+        transcriptUpload: deps.transcriptUploadEnabled === true,
+        repoAccessCheck: false,
+      },
     };
 
     // The route's Zod schema requires phaseMethodology; a platform-only admin

package/src/cron-run-transcripts.integration.test.ts

@@ -0,0 +1,220 @@
+/**
+ * admin/src/cron-run-transcripts.integration.test.ts
+ * Round-trip and retention sweep against a real Postgres (COS-43.1).
+ *
+ * Requires DATABASE_URL_ADMIN_TEST to be set; skips otherwise.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import type { PrismaClient } from "../prisma/client/client.ts";
+import { AgentService } from "./agents.ts";
+import {
+  type AdminDeps,
+  createAdminApp,
+  parseAdminApiKeys,
+} from "./agents-api.ts";
+import {
+  CronRunTranscriptService,
+  TRANSCRIPT_RETENTION_PER_AGENT,
+} from "./cron-run-transcripts.ts";
+import { createAdminPrismaClient } from "./prisma-client.ts";
+import { parseTranscriptConfig } from "./transcript-config.ts";
+
+const TEST_DB = process.env.DATABASE_URL_ADMIN_TEST;
+const describeOrSkip = TEST_DB ? describe : describe.skip;
+
+const ADMIN = "admin-key";
+
+describeOrSkip("cron-run transcripts (integration)", () => {
+  let prisma: PrismaClient;
+  let agentId: string;
+  let otherAgentId: string;
+  let cronId: string;
+  let otherCronId: string;
+
+  beforeEach(async () => {
+    prisma = createAdminPrismaClient(TEST_DB as string);
+    await prisma.agentTranscriptRead.deleteMany();
+    await prisma.agentCronRunTranscript.deleteMany();
+    agentId = (await prisma.agent.create({ data: { name: "TxA" } })).id;
+    otherAgentId = (await prisma.agent.create({ data: { name: "TxB" } })).id;
+    cronId = (
+      await prisma.agentCronJob.create({
+        data: { agentId, name: "c", schedule: "* * * * *", prompt: "p" },
+      })
+    ).id;
+    otherCronId = (
+      await prisma.agentCronJob.create({
+        data: {
+          agentId: otherAgentId,
+          name: "c",
+          schedule: "* * * * *",
+          prompt: "p",
+        },
+      })
+    ).id;
+  });
+
+  afterEach(async () => {
+    await prisma.agentTranscriptRead.deleteMany();
+    await prisma.agentCronRunTranscript.deleteMany();
+    await prisma.agent.deleteMany({
+      where: { id: { in: [agentId, otherAgentId] } },
+    });
+    await prisma.$disconnect();
+  });
+
+  function makeApp() {
+    const deps = {
+      agentService: new AgentService(prisma),
+      agentTokenService: { validate: async () => null },
+      adminApiKeys: parseAdminApiKeys(`root:${ADMIN}:*`),
+      sessionSecret: "s".repeat(32),
+      prisma,
+      transcripts: {
+        config: parseTranscriptConfig({
+          SHIPWRIGHT_TRANSCRIPT_API_ENABLED: "enabled",
+        }),
+        store: new CronRunTranscriptService(prisma),
+      },
+    } as unknown as AdminDeps;
+    return createAdminApp(deps);
+  }
+
+  const newRun = (agent: string, cron: string, startedAt = new Date()) =>
+    prisma.agentCronRun.create({
+      data: { agentId: agent, cronId: cron, startedAt },
+    });
+
+  const put = (
+    app: ReturnType<typeof createAdminApp>,
+    runId: string,
+    body: string,
+    cron = cronId,
+    agent = agentId,
+  ) =>
+    app.request(`/agents/${agent}/crons/${cron}/runs/${runId}/transcript`, {
+      method: "PUT",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${ADMIN}`,
+      },
+      body: JSON.stringify({
+        sessionId: "s",
+        body,
+        truncated: false,
+        redactions: 1,
+      }),
+    });
+
+  it("round-trips PUT then GET and writes an audit row", async () => {
+    const app = makeApp();
+    const run = await newRun(agentId, cronId);
+    expect((await put(app, run.id, "hello\n")).status).toBe(200);
+    const res = await app.request(
+      `/agents/${agentId}/crons/${cronId}/runs/${run.id}/transcript`,
+      { headers: { Authorization: `Bearer ${ADMIN}` } },
+    );
+    expect(res.status).toBe(200);
+    const json = (await res.json()) as Record<string, unknown>;
+    expect(json).toMatchObject({
+      runId: run.id,
+      cronId,
+      sessionId: "s",
+      bytes: 6,
+      truncated: false,
+      redactions: 1,
+      body: "hello\n",
+    });
+    const reads = await prisma.agentTranscriptRead.findMany();
+    expect(reads).toHaveLength(1);
+    expect(reads[0]).toMatchObject({
+      runId: run.id,
+      agentId,
+      scopeKind: "admin",
+    });
+  });
+
+  it("upserts: a second PUT replaces the body, one row per run", async () => {
+    const app = makeApp();
+    const run = await newRun(agentId, cronId);
+    await put(app, run.id, "one");
+    await put(app, run.id, "two-two");
+    const rows = await prisma.agentCronRunTranscript.findMany();
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.body).toBe("two-two");
+    expect(rows[0]?.bytes).toBe(7);
+  });
+
+  it("404s a run owned by a different agent or cron", async () => {
+    const app = makeApp();
+    const run = await newRun(otherAgentId, otherCronId);
+    expect((await put(app, run.id, "x")).status).toBe(404);
+    const mine = await newRun(agentId, cronId);
+    expect((await put(app, mine.id, "x", otherCronId)).status).toBe(404);
+    expect(await prisma.agentCronRunTranscript.count()).toBe(0);
+  });
+
+  it(`keeps only the newest ${TRANSCRIPT_RETENTION_PER_AGENT} per agent`, async () => {
+    const service = new CronRunTranscriptService(prisma);
+    const total = TRANSCRIPT_RETENTION_PER_AGENT + 5;
+    const base = Date.now() - total * 1000;
+    const runs: Array<{ id: string }> = [];
+    for (let i = 0; i < total; i++) {
+      runs.push(await newRun(agentId, cronId, new Date(base + i)));
+    }
+    for (const [i, run] of runs.entries()) {
+      await prisma.agentCronRunTranscript.create({
+        data: {
+          runId: run.id,
+          agentId,
+          cronId,
+          bytes: 1,
+          truncated: false,
+          redactions: 0,
+          body: "x",
+          createdAt: new Date(base + i * 10),
+        },
+      });
+    }
+    const otherRun = await newRun(otherAgentId, otherCronId);
+    await prisma.agentCronRunTranscript.create({
+      data: {
+        runId: otherRun.id,
+        agentId: otherAgentId,
+        cronId: otherCronId,
+        bytes: 1,
+        truncated: false,
+        redactions: 0,
+        body: "x",
+        createdAt: new Date(base),
+      },
+    });
+
+    const fresh = await newRun(agentId, cronId);
+    await service.upsert({
+      runId: fresh.id,
+      agentId,
+      cronId,
+      sessionId: null,
+      bytes: 1,
+      truncated: false,
+      redactions: 0,
+      body: "new",
+    });
+
+    const mine = await prisma.agentCronRunTranscript.findMany({
+      where: { agentId },
+      orderBy: { createdAt: "desc" },
+    });
+    expect(mine).toHaveLength(TRANSCRIPT_RETENTION_PER_AGENT);
+    expect(mine[0]?.runId).toBe(fresh.id);
+    // The oldest were dropped; the other agent's row is untouched.
+    expect(mine.some((r) => r.runId === runs[0]?.id)).toBe(false);
+    expect(
+      await prisma.agentCronRunTranscript.count({
+        where: { agentId: otherAgentId },
+      }),
+    ).toBe(1);
+  });
+});