@bugmole/cli 0.4.0 → 0.6.0

package/src/mcp/write-test-cases.test.ts

@@ -185,6 +185,42 @@ async function withCaseSet(cfg: any) {
   }, cfg);
 }
 
+test("names the scenario categories a case set still misses, and accepts reasoned exclusions", async () => {
+  const { directory, cfg } = await setup();
+  const write = (cases: object[], extra: object = {}) => callToolInternal("bugmole_write_test_cases", {
+    caseSet: { schemaVersion: 1, caseSetId: "flow-login", journeyId: "flow:login", journeyRevision: 2, cases, ...extra },
+  }, cfg);
+  try {
+    const first = await write([{ ...validCase, category: "happy_path" }, { ...validCase, caseId: "TC-legacy" }]);
+    assert.deepEqual(first.scenarios.missing, [
+      { category: "happy_path", nodeId: "screen:/" },
+      { category: "validation" },
+      { category: "error_state" },
+      { category: "permission" },
+      { category: "edge_case" },
+    ]);
+    assert.deepEqual(first.scenarios.uncategorized, ["TC-legacy"]);
+    assert.ok(first.nextSteps.some((step: string) => step.startsWith("Step screen:/ has no happy_path case")));
+    assert.ok(first.nextSteps.some((step: string) => step.includes("TC-legacy")));
+
+    const complete = await write([
+      { ...validCase, caseId: "TC-home", nodeId: "screen:/", edgeId: undefined, category: "happy_path" },
+      { ...validCase, category: "happy_path" },
+      { ...validCase, caseId: "TC-bad-password", category: "validation" },
+      { ...validCase, caseId: "TC-auth-down", category: "error_state" },
+      { ...validCase, caseId: "TC-double-submit", category: "edge_case" },
+    ], { scenarioExclusions: [{ category: "permission", reason: "Login is the one screen every visitor may open." }] });
+    assert.deepEqual(complete.scenarios.missing, []);
+    assert.match(complete.nextSteps[0], /^Plan the journey/);
+
+    await assert.rejects(write([{ ...validCase, category: "smoke" }]), /category must be one of happy_path/);
+    await assert.rejects(write([validCase], { scenarioExclusions: [{ category: "permission", reason: " " }] }), /reason is required/);
+    await assert.rejects(write([validCase], { scenarioExclusions: [{ category: "permission", nodeId: "screen:/nope", reason: "x" }] }), /is not a step of journey/);
+  } finally {
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
 test("records a run's verdict against a case set that exists", async () => {
   const { directory, cfg } = await setup();
   try {
@@ -210,6 +246,38 @@ test("records a run's verdict against a case set that exists", async () => {
   }
 });
 
+test("keeps every write's verdicts in history while the latest file is replaced", async () => {
+  const { directory, cfg } = await setup();
+  try {
+    await withCaseSet(cfg);
+    const write = (status: string, runId: string, recordedAt: string) => callToolInternal("bugmole_write_test_case_results", {
+      resultSet: {
+        schemaVersion: 1,
+        caseSetId: "flow-login",
+        runId,
+        recordedAt,
+        results: [{ caseId: "TC-001", status, detail: `${status} on ${runId}` }],
+      },
+    }, cfg);
+    const first = await write("passed", "run-1", "2026-09-01T10:00:00.000Z");
+    const second = await write("failed", "run-2", "2026-09-02T10:00:00.000Z");
+    assert.equal(first.historyKey, "projects/demo/test-case-history/flow-login/20260901T100000000Z-run-1.json");
+    assert.notEqual(first.historyKey, second.historyKey);
+
+    const latest = JSON.parse(await fs.readFile(path.join(directory, "projects", "demo", "test-case-results", "flow-login.json"), "utf8"));
+    assert.equal(latest.results[0].status, "failed");
+    const historyDir = path.join(directory, "projects", "demo", "test-case-history", "flow-login");
+    const files = (await fs.readdir(historyDir)).sort();
+    assert.equal(files.length, 2);
+    const statuses = await Promise.all(files.map(async (file) => JSON.parse(await fs.readFile(path.join(historyDir, file), "utf8")).results[0]));
+    assert.deepEqual(statuses.map((item) => [item.status, item.caseRevision]), [["passed", 1], ["failed", 1]]);
+    // History stays out of the latest-results prefix every reader lists.
+    assert.deepEqual(await fs.readdir(path.join(directory, "projects", "demo", "test-case-results")), ["flow-login.json"]);
+  } finally {
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
 test("refuses a verdict for a case nobody ever wrote", async () => {
   const { directory, cfg } = await setup();
   try {

package/src/registry/control-plane-client.ts

@@ -1,4 +1,5 @@
 import WebSocket from "ws";
+import { redactSecrets } from "../runtime/secret-redaction.js";
 
 export type RegistryRun = {
   id: string;
@@ -19,11 +20,33 @@ export type RegistryRun = {
   targetResults?: Array<Record<string, unknown>> | null;
   /** Re-run with the fix suggested by this earlier run/target. */
   fixFrom?: { runId: string; targetId: string; mode?: "suggested" | "ai" } | null;
+  /** A retest limited to these cases (a Jira ticket's case): only they are judged. */
+  caseScope?: { caseSetId: string; caseIds: string[]; jiraIssueKey?: string } | null;
   durationMs?: number | null;
   /** "cloud" runs belong to Bugmole's hosted runners; a customer's worker skips them. */
   executionMode?: "self" | "cloud";
 };
 
+export type RegistryProposal = {
+  id: string;
+  projectId: string;
+  kind: "test_case";
+  caseSetId: string;
+  caseId: string;
+  action: "add" | "change" | "retire";
+  baseRevision: number | null;
+  proposed: Record<string, unknown> | null;
+  summary: string;
+  source: string;
+  proposedBy: string;
+  status: "pending" | "accepted" | "rejected" | "outdated";
+  decidedBy: string | null;
+  decisionNote: string | null;
+  appliedAt: string | null;
+  appliedRevision: number | null;
+  createdAt: string;
+};
+
 export type RegistryTask = {
   id: string;
   projectId: string;
@@ -45,9 +68,27 @@ export type RegistryTask = {
   leaseExpiresAt?: string | null;
   /** "cloud" discovery belongs to Bugmole's hosted runners; a customer's worker skips it. */
   executionMode?: "self" | "cloud";
+  /** Null while the task waits for approval; see ApprovalMode. */
+  approvedAt?: string | null;
+  approvedBy?: string | null;
+  /** Set once a person accepted the task or sent it back from review. */
+  reviewedAt?: string | null;
+  reviewedBy?: string | null;
+  /** What the reviewer asked for when they sent the task back. */
+  reviewNote?: string | null;
 };
 
-export { MAX_TASK_ATTEMPTS, backoffUntil, isClaimableTask } from "./task-scheduling.js";
+export type RegistryRole = {
+  id: string;
+  name: string;
+  description: string;
+  status: "suggested" | "confirmed" | "rejected";
+  source: string;
+  evidence: string | null;
+  decidedBy?: string | null;
+};
+
+export { MAX_TASK_ATTEMPTS, approvalModeOf, backoffUntil, isClaimableTask, workerApprovalMode, type ApprovalMode } from "./task-scheduling.js";
 
 export type ControlPlaneClientOptions = {
   registryUrl: string;
@@ -56,14 +97,29 @@ export type ControlPlaneClientOptions = {
   workspaceId?: string;
 };
 
-/** Carries the HTTP status, so callers can tell a lost claim (409) from a real failure. */
+/**
+ * Carries the HTTP status, so callers can tell a lost claim (409) from a real
+ * failure, and the registry's code and message for refusals a person must act
+ * on (a paused project's activation link, for one).
+ */
 export class RegistryRequestError extends Error {
-  constructor(readonly status: number) {
-    super(`Registry request failed (${status})`);
+  constructor(readonly status: number, readonly code?: string, readonly detail?: string, readonly body?: Record<string, unknown>) {
+    super(detail ? `${detail} (${status}${code ? ` ${code}` : ""})` : `Registry request failed (${status})`);
     this.name = "RegistryRequestError";
   }
 }
 
+/** The project is paused for inactivity: nothing runs until a member activates it. */
+export function isProjectInactive(error: unknown): error is RegistryRequestError {
+  return error instanceof RegistryRequestError && error.code === "project_inactive";
+}
+
+/** What the CLI prints for a paused project, with the link to activate it. */
+export function projectInactiveMessage(projectId: string, activateUrl?: string | null): string {
+  return `Project ${projectId} is paused because nobody used it for a while, so it won't run tests or tasks. `
+    + `A project member can activate it${activateUrl ? `: ${activateUrl}` : " from its page in the Bugmole dashboard"}.`;
+}
+
 export class ControlPlaneClient {
   private readonly baseUrl: string;
 
@@ -74,17 +130,35 @@ export class ControlPlaneClient {
   private async request<T>(path: string, init: RequestInit = {}): Promise<T> {
     const response = await fetch(`${this.baseUrl}${path}`, {
       ...init,
+      // Progress and error messages can quote what a flow typed.
+      ...(typeof init.body === "string" ? { body: redactSecrets(init.body) } : {}),
       headers: {
         authorization: `Bearer ${this.options.apiKey}`,
         "content-type": "application/json",
         ...(init.headers ?? {}),
       },
     });
-    const body = await response.json().catch(() => ({}));
-    if (!response.ok) throw new RegistryRequestError(response.status);
+    const body = await response.json().catch(() => ({})) as Record<string, unknown>;
+    if (!response.ok) {
+      const code = typeof body.code === "string" ? body.code : undefined;
+      // Only refusals meant for a person carry the registry's message.
+      const detail = code && typeof body.error === "string" ? body.error : undefined;
+      throw new RegistryRequestError(response.status, code, detail, body);
+    }
     return body as T;
   }
 
+  /**
+   * Tells the registry which app this project is (a git remote plus the app's
+   * folder); set once, then it must match. The reply says if the project is paused.
+   */
+  async reportIdentity(identity: Record<string, unknown>): Promise<{ identity: unknown; inactiveAt?: string | null; activateUrl?: string }> {
+    return this.request(`/api/projects/${encodeURIComponent(this.options.projectId)}/identity`, {
+      method: "POST",
+      body: JSON.stringify({ identity }),
+    });
+  }
+
   async publishPlan(input: { planId: string; journeyId: string; objectKey: string }) {
     return this.request<{ plan: unknown }>(`/api/projects/${encodeURIComponent(this.options.projectId)}/plans`, {
       method: "POST",
@@ -162,6 +236,47 @@ export class ControlPlaneClient {
     });
   }
 
+  /** Proposes adding, changing or retiring one test case; see src/registry-worker/proposals/routes.ts. */
+  async proposeTestCaseChange(input: {
+    caseSetId: string;
+    caseId: string;
+    action: "add" | "change" | "retire";
+    baseRevision?: number;
+    case?: Record<string, unknown>;
+    summary: string;
+    source: "mcp" | "cli";
+  }): Promise<{ proposal: RegistryProposal }> {
+    return this.request(`/api/projects/${encodeURIComponent(this.options.projectId)}/proposals`, {
+      method: "POST",
+      body: JSON.stringify(input),
+    });
+  }
+
+  /** Accepted proposals nobody has written to this project's own storage yet. */
+  async listUnappliedProposals(): Promise<{ proposals: RegistryProposal[] }> {
+    return this.request(`/api/projects/${encodeURIComponent(this.options.projectId)}/proposals?unapplied=1`);
+  }
+
+  async reportProposalApplied(proposalId: string, outcome: { outcome: "applied"; revision: number } | { outcome: "outdated"; message: string }) {
+    return this.request<{ proposal: RegistryProposal }>(`/api/proposals/${encodeURIComponent(proposalId)}/applied`, {
+      method: "POST",
+      body: JSON.stringify(outcome),
+    });
+  }
+
+  /** The project's roles; only confirmed ones may be planned for. See src/registry/roles.ts. */
+  async listRoles(): Promise<{ roles: RegistryRole[] }> {
+    return this.request(`/api/projects/${encodeURIComponent(this.options.projectId)}/roles`);
+  }
+
+  /** Suggests a role for a person to confirm, rename or reject; see src/registry-worker/roles/routes.ts. */
+  async proposeRole(input: { name: string; description: string; source: string; evidence: string }): Promise<{ role: RegistryRole; alreadyDecided?: boolean }> {
+    return this.request(`/api/projects/${encodeURIComponent(this.options.projectId)}/roles`, {
+      method: "POST",
+      body: JSON.stringify(input),
+    });
+  }
+
   async listJourneyRevisions() {
     return this.request<{ revisions: Array<Record<string, unknown>> }>(
       `/api/projects/${encodeURIComponent(this.options.projectId)}/journeys`,

package/src/registry/migrations/0034_signup_attribution.sql

@@ -0,0 +1,19 @@
+-- Which affiliate code and campaign brought each new user. bugmole.com keeps
+-- the first visit's ref/utm_* tags in the bm_attr cookie; the dashboard sends
+-- them once after sign-in (POST /api/attribution). First touch wins: a row is
+-- written once and never overwritten. Scents reads this table.
+CREATE TABLE IF NOT EXISTS signup_attribution (
+  aegis_id      TEXT PRIMARY KEY REFERENCES aegis_users(id) ON DELETE CASCADE,
+  ref           TEXT,
+  utm_source    TEXT,
+  utm_medium    TEXT,
+  utm_campaign  TEXT,
+  utm_content   TEXT,
+  utm_term      TEXT,
+  landing_path  TEXT,
+  referrer_host TEXT,
+  first_seen_at TEXT,
+  created_at    TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_signup_attribution_ref ON signup_attribution(ref);
+CREATE INDEX IF NOT EXISTS idx_signup_attribution_campaign ON signup_attribution(utm_campaign);

package/src/registry/migrations/0035_domain_verify_file.sql

@@ -0,0 +1,6 @@
+-- How a domain was proven: 'dns' (a TXT record, which covers the domain and
+-- its subdomains) or 'file' (a file published on the site, which proves
+-- control of that one host only). Rows verified before this column existed
+-- were all DNS.
+ALTER TABLE workspace_domains ADD COLUMN verified_by TEXT;
+UPDATE workspace_domains SET verified_by = 'dns' WHERE status = 'verified';

package/src/registry/migrations/0036_task_approval.sql

@@ -0,0 +1,11 @@
+-- Agent tasks can wait for a person's approval before any worker takes them.
+-- A project's task_approval_mode decides which ones wait (see
+-- src/registry/task-scheduling.ts): manual (all), auto (code-changing tasks),
+-- extreme (none).
+ALTER TABLE agent_tasks ADD COLUMN approved_at TEXT;
+ALTER TABLE agent_tasks ADD COLUMN approved_by TEXT;
+ALTER TABLE projects ADD COLUMN task_approval_mode TEXT NOT NULL DEFAULT 'auto';
+
+-- Everything already queued was queued under "start straight away"; keep it
+-- moving rather than stalling it behind a step that didn't exist.
+UPDATE agent_tasks SET approved_at = COALESCE(requested_at, CURRENT_TIMESTAMP), approved_by = 'auto:existing';

package/src/registry/migrations/0037_spec_proposals.sql

@@ -0,0 +1,27 @@
+-- Proposed changes to a project's spec: today, test cases (add, change or
+-- retire one). A proposal is small control-plane data; the case set it
+-- changes lives in the project's storage. Accepting follows the project's
+-- task_approval_mode; applying writes a new revision and marks the old one
+-- obsolete (src/registry/test-case-revisions.ts).
+CREATE TABLE spec_proposals (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  case_set_id TEXT NOT NULL,
+  case_id TEXT NOT NULL,
+  action TEXT NOT NULL,
+  base_revision INTEGER,
+  proposed_json TEXT,
+  summary TEXT NOT NULL,
+  source TEXT NOT NULL,
+  proposed_by TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending',
+  decided_by TEXT,
+  decided_at TEXT,
+  decision_note TEXT,
+  applied_at TEXT,
+  applied_revision INTEGER,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX spec_proposals_project_status ON spec_proposals (project_id, status, created_at);

package/src/registry/migrations/0038_local_worker_seen.sql

@@ -0,0 +1,5 @@
+-- When a worker on someone's machine (`bugmole serve`, or a coding agent using
+-- the Bugmole MCP with an API key) last listed this project's tasks. Resume
+-- uses it to refuse queuing a machine-only task on a cloud project that has
+-- no machine connected (see src/registry/task-scheduling.ts).
+ALTER TABLE projects ADD COLUMN local_worker_seen_at TEXT;

package/src/registry/migrations/0039_project_secrets.sql

@@ -0,0 +1,37 @@
+-- Sign-in for cloud runs: per-project secrets a flow types as {{secret.NAME}},
+-- and a sign-in flow cloud exploration runs before it explores.
+--
+-- Values are AES-256-GCM ciphertext under a per-project key derived (HKDF-
+-- SHA256) from the registry secret PROJECT_SECRETS_KEY; the additional data
+-- binds each value to its project, environment and name. No route returns a
+-- value to a browser or an API key: only a cloud runner, for a run or
+-- exploration it holds, reads them (src/registry-worker/secrets/).
+CREATE TABLE IF NOT EXISTS project_secrets (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  -- NULL: every environment of the project. A value for one environment
+  -- overrides the project-wide one for runs in that environment.
+  environment_id TEXT,
+  name TEXT NOT NULL,
+  ciphertext TEXT NOT NULL,
+  iv TEXT NOT NULL,
+  key_version INTEGER NOT NULL DEFAULT 1,
+  created_by TEXT NOT NULL,
+  updated_by TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  last_used_at TEXT,
+  UNIQUE (project_id, environment_id, name)
+);
+-- SQLite treats NULLs as distinct in UNIQUE, so the project-wide value of a
+-- name needs its own guard.
+CREATE UNIQUE INDEX IF NOT EXISTS project_secrets_scope
+  ON project_secrets(project_id, COALESCE(environment_id, ''), name);
+
+CREATE TABLE IF NOT EXISTS project_sign_in_flows (
+  project_id TEXT PRIMARY KEY REFERENCES projects(id) ON DELETE CASCADE,
+  -- Flow YAML. It references secrets by name and never holds a value.
+  content TEXT NOT NULL,
+  updated_by TEXT NOT NULL,
+  updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+);

package/src/registry/migrations/0040_roles_and_task_review.sql

@@ -0,0 +1,31 @@
+-- Completion review: when an AI worker reports a task completed, the
+-- project's task_approval_mode decides whether a person reviews it first
+-- (src/registry/task-scheduling.ts completionStatus): manual reviews every
+-- task, auto reviews code and ui tasks, extreme none. A task waiting for
+-- review has status 'in_review'. Accepting records who and when; sending it
+-- back queues it again with the reviewer's note. Existing rows keep their
+-- status: nothing already completed is pulled back into review.
+ALTER TABLE agent_tasks ADD COLUMN reviewed_at TEXT;
+ALTER TABLE agent_tasks ADD COLUMN reviewed_by TEXT;
+ALTER TABLE agent_tasks ADD COLUMN review_note TEXT;
+
+-- Roles a journey is run as (guest, member, admin…). Bugmole suggests them
+-- from sign-in walls, role-gated routes and menus, spec/roles.yaml and
+-- discovered journeys; a person confirms, renames or rejects each one. Only
+-- confirmed roles are used for planning test cases and runs (src/registry/roles.ts).
+CREATE TABLE IF NOT EXISTS project_roles (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  name TEXT NOT NULL,
+  description TEXT NOT NULL DEFAULT '',
+  status TEXT NOT NULL DEFAULT 'suggested',
+  source TEXT NOT NULL DEFAULT 'agent',
+  evidence TEXT,
+  suggested_by TEXT NOT NULL,
+  decided_by TEXT,
+  decided_at TEXT,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  UNIQUE (project_id, name)
+);
+CREATE INDEX IF NOT EXISTS project_roles_project_status ON project_roles(project_id, status);

package/src/registry/migrations/0041_jira_integration.sql

@@ -0,0 +1,75 @@
+-- Jira Cloud: a Bugmole project links one Jira site and project key.
+-- Bugmole proposes its test plan as a Jira issue, creates one ticket per
+-- approved test case, moves tickets to Done or Blocked from run results, and
+-- retests one ticket's case when someone mentions Bugmole in a comment.
+--
+-- Credentials are AES-256-GCM ciphertext under a key derived (HKDF-SHA256,
+-- info "bugmole:jira:<projectId>") from the registry secret
+-- PROJECT_SECRETS_KEY, with additional data binding each value to its
+-- project and field. No route returns them (src/registry-worker/jira/).
+CREATE TABLE IF NOT EXISTS project_jira_connections (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL UNIQUE REFERENCES projects(id) ON DELETE CASCADE,
+  -- https://<site>.atlassian.net
+  site_url TEXT NOT NULL,
+  jira_project_key TEXT NOT NULL,
+  -- 'api_token' today; 'oauth' (3LO) needs an Atlassian developer app.
+  auth_type TEXT NOT NULL DEFAULT 'api_token',
+  account_email TEXT,
+  -- The Jira account Bugmole acts as: its own comments never trigger a retest.
+  account_id TEXT,
+  credential_ciphertext TEXT NOT NULL,
+  credential_iv TEXT NOT NULL,
+  credential_key_version INTEGER NOT NULL DEFAULT 1,
+  webhook_secret_ciphertext TEXT NOT NULL,
+  webhook_secret_iv TEXT NOT NULL,
+  webhook_key_version INTEGER NOT NULL DEFAULT 1,
+  -- Text in a comment that asks Bugmole to retest (case-insensitive).
+  mention_keyword TEXT NOT NULL DEFAULT '@Bugmole',
+  execution_mode TEXT NOT NULL DEFAULT 'self',
+  environment_id TEXT,
+  enabled INTEGER NOT NULL DEFAULT 1,
+  last_error TEXT,
+  created_by TEXT NOT NULL,
+  updated_by TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+-- One Jira ticket per test case (not per revision: a revised case keeps its
+-- ticket, which records the revision it now describes).
+CREATE TABLE IF NOT EXISTS jira_issue_links (
+  project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  case_set_id TEXT NOT NULL,
+  case_id TEXT NOT NULL,
+  case_revision INTEGER NOT NULL DEFAULT 1,
+  case_title TEXT,
+  journey_id TEXT,
+  jira_issue_key TEXT,
+  jira_issue_id TEXT,
+  -- passed | failed | blocked | needs_setup | retired, or NULL before any result.
+  last_result TEXT,
+  last_run_id TEXT,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  PRIMARY KEY (project_id, case_set_id, case_id)
+);
+CREATE INDEX IF NOT EXISTS jira_issue_links_issue ON jira_issue_links(project_id, jira_issue_key);
+
+-- A proposed test plan posted to Jira for review (label bugmole-plan).
+CREATE TABLE IF NOT EXISTS jira_plan_issues (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  jira_issue_key TEXT NOT NULL,
+  proposal_ids_json TEXT NOT NULL,
+  -- proposed | approved | partially_approved | rejected
+  status TEXT NOT NULL DEFAULT 'proposed',
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS jira_plan_issues_project ON jira_plan_issues(project_id, status);
+
+-- A retest limited to some cases of a case set (a Jira ticket's case).
+-- JSON: {"caseSetId": "...", "caseIds": ["..."], "jiraIssueKey": "PROJ-1"}.
+ALTER TABLE runs ADD COLUMN case_scope_json TEXT;

package/src/registry/migrations/0042_subscription_gaps.sql

@@ -0,0 +1,10 @@
+-- Which projects stay writable when a workspace has more projects than its
+-- plan allows. By default the oldest ones do; an owner can pick instead, and
+-- the pick is remembered here so the next plan change honors it.
+-- (src/registry-worker/billing/subscriptions.ts applyProjectLimit)
+ALTER TABLE projects ADD COLUMN kept_at TEXT;
+
+-- Why a CLI device registration was refused (a plan limit, for example), so
+-- the waiting CLI can print the reason and the billing link instead of
+-- polling until the attempt expires. JSON: { error, code, upgradeUrl, billingUrl }.
+ALTER TABLE device_authorizations ADD COLUMN refusal_json TEXT;

package/src/registry/migrations/0043_workspace_feature_overrides.sql

@@ -0,0 +1,17 @@
+-- Per-workspace feature overrides set by platform operators (trials, comps,
+-- incidents). An unexpired row forces a feature on or off for one workspace,
+-- after the global kill switch and beta opt-in and before the plan. See
+-- src/registry-worker/feature-access.ts and docs/feature-flags.md.
+CREATE TABLE IF NOT EXISTS workspace_feature_overrides (
+  workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  feature TEXT NOT NULL,
+  enabled INTEGER NOT NULL,
+  -- ISO timestamp; NULL means until cleared.
+  expires_at TEXT,
+  reason TEXT,
+  -- The operator named by the admin CLI (x-bugmole-operator).
+  set_by TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  PRIMARY KEY (workspace_id, feature)
+);

package/src/registry/migrations/0044_project_identity.sql

@@ -0,0 +1,31 @@
+-- One app is one project (src/registry/project-identity.ts).
+--
+-- identity_key is the normalized, credential-free key: `domain:<host>` for an
+-- app on the internet, `repo:<host>/<path>#<appPath>` for a repository and the
+-- app's folder in it. identity_hash is its SHA-256, which lookups use: the
+-- same identity in one workspace resolves to the existing project, and on
+-- Free it can't be claimed by a second Free workspace.
+ALTER TABLE projects ADD COLUMN identity_kind TEXT;
+ALTER TABLE projects ADD COLUMN identity_key TEXT;
+ALTER TABLE projects ADD COLUMN identity_hash TEXT;
+-- The app's origin when the CLI or dashboard knew it; informational only.
+ALTER TABLE projects ADD COLUMN identity_origin TEXT;
+
+CREATE UNIQUE INDEX IF NOT EXISTS projects_workspace_identity
+  ON projects(workspace_id, identity_hash)
+  WHERE identity_hash IS NOT NULL AND deleted_at IS NULL;
+CREATE INDEX IF NOT EXISTS projects_identity_hash
+  ON projects(identity_hash)
+  WHERE identity_hash IS NOT NULL;
+
+-- Projects paused after the plan's inactiveProjectDays without activity
+-- (jobs/inactivity.ts). A paused project is read-only, takes no runs, tasks
+-- or claims, and doesn't count toward the project limit until activated.
+ALTER TABLE projects ADD COLUMN inactive_at TEXT;
+-- When someone last activated it, which also counts as activity.
+ALTER TABLE projects ADD COLUMN activated_at TEXT;
+
+-- A CLI pairing carries the identity it computed, and the claim may resolve
+-- it to a teammate's existing project; the CLI learns which from the poll.
+ALTER TABLE device_authorizations ADD COLUMN identity_json TEXT;
+ALTER TABLE device_authorizations ADD COLUMN resolved_project_id TEXT;

package/src/registry/project-identity.test.ts

@@ -0,0 +1,99 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import {
+  describeIdentity,
+  domainIdentityFromUrl,
+  identityHash,
+  normalizeAppPath,
+  normalizeGitRemote,
+  normalizeIdentityHost,
+  parseProjectIdentity,
+  repoIdentity,
+} from "./project-identity.js";
+
+test("every way git writes a remote normalizes to one host/path, without credentials", () => {
+  const same = [
+    "https://github.com/Acme/Shop.git",
+    "https://github.com/acme/shop",
+    "https://github.com/acme/shop/",
+    "http://GitHub.com/acme/shop.git",
+    "https://ada:ghp_secretToken123@github.com/acme/shop.git",
+    "https://x-access-token:ghs_abc@github.com/acme/shop.git",
+    "git@github.com:acme/shop.git",
+    "git@github.com:Acme/Shop",
+    "ssh://git@github.com/acme/shop.git",
+    "ssh://git@github.com:22/acme/shop.git",
+    "git+ssh://git@github.com/acme/shop.git",
+    "git://github.com/acme/shop.git",
+    "github.com/acme/shop",
+  ];
+  for (const remote of same) {
+    const normalized = normalizeGitRemote(remote);
+    assert.equal(normalized, "github.com/acme/shop", remote);
+    assert.doesNotMatch(normalized!, /secret|ghp_|ghs_|ada|token|@|:/, `${remote} leaks credentials`);
+  }
+});
+
+test("self-hosted remotes keep their path's case and nested groups; ports and users are dropped", () => {
+  assert.equal(normalizeGitRemote("ssh://git@gitlab.example.com:2222/Platform/Web/Shop.git"), "gitlab.example.com/Platform/Web/Shop");
+  assert.equal(normalizeGitRemote("https://deploy:pw@git.EXAMPLE.com:8443/team/app.git"), "git.example.com/team/app");
+  assert.equal(normalizeGitRemote("git@ssh.dev.azure.com:v3/acme/proj/shop"), "dev.azure.com/acme/proj/shop");
+  assert.equal(normalizeGitRemote("https://gitlab.com/Acme/Sub/Shop.git"), "gitlab.com/acme/sub/shop");
+});
+
+test("local paths and junk aren't remotes", () => {
+  for (const value of ["", "   ", "/srv/git/shop.git", "../shop", "file:///srv/git/shop.git", "C:\\repos\\shop", "https://github.com/", "git@github.com:../x", 42, null]) {
+    assert.equal(normalizeGitRemote(value), null, String(value));
+  }
+});
+
+test("app paths are clean relative folders; the root is '.'", () => {
+  assert.equal(normalizeAppPath(undefined), ".");
+  assert.equal(normalizeAppPath(""), ".");
+  assert.equal(normalizeAppPath("./"), ".");
+  assert.equal(normalizeAppPath("./apps/web/"), "apps/web");
+  assert.equal(normalizeAppPath("apps\\mobile"), "apps/mobile");
+  assert.equal(normalizeAppPath("/apps//web"), "apps/web");
+  assert.equal(normalizeAppPath("apps/../secrets"), null);
+  assert.equal(normalizeAppPath(7), null);
+});
+
+test("each app of a monorepo is its own identity; the same app from two clones is one", async () => {
+  const web = repoIdentity("git@github.com:acme/shop.git", "apps/web");
+  const mobile = repoIdentity("https://github.com/acme/shop", "apps/mobile");
+  const webAgain = repoIdentity("https://tok@github.com/Acme/Shop.git", "./apps/web/", "http://localhost:3000/login");
+  assert.equal(web?.key, "repo:github.com/acme/shop#apps/web");
+  assert.equal(mobile?.key, "repo:github.com/acme/shop#apps/mobile");
+  assert.equal(webAgain?.key, web?.key, "the port a teammate runs on isn't part of the identity");
+  assert.equal(webAgain?.origin, "http://localhost:3000");
+  assert.notEqual(await identityHash(web!.key), await identityHash(mobile!.key));
+  assert.equal(await identityHash(web!.key), await identityHash(webAgain!.key));
+  assert.match(await identityHash(web!.key), /^[0-9a-f]{64}$/);
+  assert.equal(describeIdentity(web!), "github.com/acme/shop (apps/web)");
+  assert.equal(describeIdentity(repoIdentity("github.com/acme/shop", ".")!), "github.com/acme/shop");
+});
+
+test("a cloud project is its public domain; local and private hosts aren't identities", () => {
+  assert.equal(domainIdentityFromUrl("https://www.Shop.example.com:8443/cart?x=1")?.key, "domain:shop.example.com");
+  assert.equal(domainIdentityFromUrl("https://user:pw@shop.example.com/")?.origin, "https://shop.example.com");
+  for (const url of ["http://localhost:3000", "http://127.0.0.1:8080", "http://192.168.1.4", "http://10.0.0.2", "http://172.20.1.1", "http://app.localhost", "http://intranet", "http://[::1]:3000", "ftp://shop.example.com", "not a url"]) {
+    assert.equal(domainIdentityFromUrl(url), null, url);
+  }
+  assert.equal(normalizeIdentityHost("WWW.Example.COM."), "example.com");
+  assert.equal(normalizeIdentityHost("https://ada@example.com:443/path"), "example.com");
+});
+
+test("the registry re-reads what a client sends and refuses what it can't use", () => {
+  assert.equal(parseProjectIdentity(undefined), null);
+  assert.equal(parseProjectIdentity({}), null);
+  assert.deepEqual(parseProjectIdentity({ kind: "repo", remote: "https://u:p@github.com/acme/shop.git", appPath: "apps/web" }), {
+    kind: "repo", key: "repo:github.com/acme/shop#apps/web", origin: null,
+  });
+  assert.equal((parseProjectIdentity({ remote: "github.com/acme/shop" }) as { key: string }).key, "repo:github.com/acme/shop#.");
+  assert.equal((parseProjectIdentity({ appUrl: "https://shop.example.com/x" }) as { key: string }).key, "domain:shop.example.com");
+  assert.equal((parseProjectIdentity({ kind: "domain", domain: "Shop.Example.com" }) as { key: string }).key, "domain:shop.example.com");
+  assert.equal(parseProjectIdentity({ appUrl: "http://localhost:3000" }), null, "a local URL identifies nothing");
+  for (const bad of ["github.com/acme/shop", [], { kind: "svn" }, { kind: "repo", remote: "/srv/shop" }, { remote: "github.com/acme/shop", appPath: "../x" }, { kind: "domain", domain: "localhost" }, { kind: "domain" }, { appUrl: "javascript:alert(1)" }]) {
+    assert.equal(parseProjectIdentity(bad), "invalid", JSON.stringify(bad));
+  }
+});