@coreplane/switchboard 1.204.0 → 1.205.0

package/dist/assets/config/config.example.yaml

@@ -41,6 +41,7 @@ defaults:
     general: anthropic/claude-haiku-4-5
     coding: anthropic/claude-opus-5
     review: anthropic/claude-opus-5
+    explore: anthropic/claude-opus-5 # the two-hour read-only investigation (docs/reference/specs/agent-explore.md)
   # Default model effort per agent: low | medium | high (how hard the model
   # thinks per turn; lower = much faster turns). Same layering as models —
   # per-channel/user `effort` / `efforts.<agent>` and a per-request `effort:`
@@ -48,6 +49,21 @@ defaults:
   # provider default. Skipped for models without effort support.
   # efforts:
   #   coding: medium
+  # A boundary caps what ANY run in a scope may have — never grants — on the
+  # three axes of a run's profile (docs/reference/specs/routing-and-config.md item 2):
+  # maxMinutes (the wall-clock budget; at least 2), maxIdentity (the credential
+  # a run acts as: none < read < write) and machines (the classes its tools may
+  # execute on: none, blank, repo-cold, repo-resident). Unlike every other
+  # setting, boundaries INTERSECT across defaults, channel and user — the
+  # smallest budget, the lowest identity, the classes every layer allows — so a
+  # channel or a user can only tighten what is set here. A budget above a cap is
+  # clipped (the card and the run record say so); a preset whose identity or
+  # class is above a cap is refused by name before any executor exists. Absent →
+  # nothing is capped and every preset runs exactly its declared profile.
+  # boundary:
+  #   maxMinutes: 120
+  #   maxIdentity: write
+  #   machines: [none, blank, repo-cold, repo-resident]
 
 # PR reviews and the reading diff (docs/reference/specs/reading-diff.md). Every
 # review records its full `git diff`; the ABRIDGED version (meat.dev, run on
@@ -72,6 +88,12 @@ defaults:
 #       review: anthropic/claude-opus-5
 #     efforts:
 #       coding: medium
+#     # Cap this channel's runs (see defaults.boundary): here every run acts
+#     # with at most a read credential — `agent:coding` is refused by name,
+#     # `agent:review` runs — and no run gets more than 45 minutes.
+#     boundary:
+#       maxMinutes: 45
+#       maxIdentity: read
 
 # Static per-user defaults (user ID -> scope).
 # users:
@@ -249,10 +271,13 @@ workspaceDir: ./workspaces
 # <task>` runs the coding → review → fix loop to LGTM as one pipeline: at most
 # `maxRounds` review rounds and `maxMinutes` minutes of wall clock — whichever
 # hits first ends the loop, and each child round's own budget is clipped to the
-# remaining pipeline time. Defaults shown; both must be integers >= 1.
+# remaining pipeline time. `maxMinutes` is the ship preset's declared budget:
+# a channel or user `boundary.maxMinutes` and a per-message `budget:` directive
+# clip it like any preset's, and the card says so. Defaults shown; both must be
+# integers >= 1.
 # ship:
 #   maxRounds: 3      # review rounds per pipeline
-#   maxMinutes: 120   # pipeline wall-clock budget in minutes
+#   maxMinutes: 120   # the ship preset's wall-clock budget in minutes (the registry's default)
 
 # Spend reporting: GET /costs (Access-gated). Optional. See docs/reference/specs/costs.md.
 # costs:
@@ -273,7 +298,7 @@ workspaceDir: ./workspaces
 #       anthropicWorkspaceId: wrkspc_...          # this app's Anthropic workspace
 
 # Delivery indicators: GET /delivery and `delivery report` (docs/reference/specs/delivery.md).
-# Optional. Needs a GitHub credential (the App triple or GH_TOKEN); read-only.
+# Optional. Needs a GitHub credential (the App triple or GH_TOKEN); read-only on GitHub.
 # delivery:
 #   repos: [acme/api, acme/web]          # the repositories the page serves; the first is its default
 #                                        #   (`delivery report --repo owner/name` needs no entry here)
@@ -281,6 +306,10 @@ workspaceDir: ./workspaces
 #                                        #   beside this installation's own App identity
 #   agentLogins: []                      # logins that are agents beyond the `[bot]` suffix
 #   agentCoauthors: [Claude]             # `Co-Authored-By:` names that mark a commit as an agent's
+#   snapshot:                            # each repository's facts are read from GitHub on an interval and
+#     everyMinutes: 60                   #   served from that snapshot (its age on the page; `?fresh=1` /
+#                                        #   `--fresh` read now); 5–1440 minutes, default 60. Kept on the
+#                                        #   state Worker any `*.worker` block below names; in memory without one
 
 # Dashboard authentication (docs/reference/specs/access-gate.md). Everything the dashboard
 # serves — /runs*, /residents*, /costs*, /mcp/connect/*, and every /api/* command

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -10,6 +10,8 @@ import {
 } from "../../src/core/memory/engine.ts";
 import { tokenize } from "../../src/core/memory/scorer.ts";
 import { FIRING_DETAIL_MAX, isScheduleFiring, type ScheduleFiring } from "../../src/core/schedules.ts";
+import { REPO_SLUG } from "../../src/core/delivery.ts";
+import { isDeliverySnapshot, type DeliverySnapshot } from "../../src/core/deliverySnapshotStore.ts";
 import {
   applyRetention,
   clampRetentionPolicy,
@@ -127,9 +129,14 @@ export interface Env {
   CONFIG: DurableObjectNamespace<ConfigDO>;
   /** Live-run transcripts (run-history item 32): one RunTranscriptDO per live run, named by run id. */
   RUN_TRANSCRIPTS: DurableObjectNamespace<RunTranscriptDO>;
+  /** Delivery snapshots (delivery item 10): ONE DeliveryDO (named "delivery"), one snapshot per repository. */
+  DELIVERY: DurableObjectNamespace<DeliveryDO>;
   MEMORY_TOKEN?: string;
 }
 
+/** The single DeliveryDO's name — every repository's snapshot lives in one object. */
+const DELIVERY_OBJECT = "delivery";
+
 /** The single ConfigDO's name. */
 const CONFIG_OBJECT = "config";
 /** A config document key: short, lowercase, like `overrides`. */
@@ -700,6 +707,112 @@ function parseStored<T>(text: string, guard: (v: unknown) => v is T): T | null {
   }
 }
 
+// ---------------------------------------------------------------------------
+// Durable Object: delivery snapshots, one per repository
+// ---------------------------------------------------------------------------
+
+// The delivery page's snapshot (docs/reference/specs/delivery.md item 10): the
+// merged pull requests' facts over the snapshot window, as GitHub gave them,
+// and when they were read. A busy repository's window is a few MB — the review
+// bodies and every workflow run of every branch — so a snapshot is stored as
+// one row per pull request under a meta row, never as one JSON value (the
+// per-row limit is 2 MB). A put replaces the repository's snapshot whole, in
+// one transaction; a get reassembles it in pull request number order.
+
+/** One pull request's facts may not exceed a fraction of the row limit; the fence names the pull request. */
+const MAX_PULL_REQUEST_FACTS_BYTES = 1024 * 1024;
+
+export class DeliveryDO extends DurableObject<Env> {
+  private readonly sql: SqlStorage;
+
+  constructor(ctx: DurableObjectState, env: Env) {
+    super(ctx, env);
+    this.sql = ctx.storage.sql;
+    this.sql.exec(`
+      CREATE TABLE IF NOT EXISTS snapshots (
+        repo TEXT PRIMARY KEY,
+        snapshot_at TEXT NOT NULL,
+        meta TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS pull_requests (
+        repo TEXT NOT NULL,
+        number INTEGER NOT NULL,
+        facts TEXT NOT NULL,
+        PRIMARY KEY (repo, number)
+      );
+    `);
+  }
+
+  /** Replace the repository's snapshot: the meta row and one row per pull request, in one transaction. */
+  async put(snapshot: DeliverySnapshot): Promise<number> {
+    const { prs, ...meta } = snapshot;
+    this.ctx.storage.transactionSync(() => {
+      this.sql.exec(`DELETE FROM pull_requests WHERE repo = ?`, snapshot.repo);
+      for (const pr of prs) {
+        this.sql.exec(
+          `INSERT OR REPLACE INTO pull_requests (repo, number, facts) VALUES (?, ?, ?)`,
+          snapshot.repo,
+          pr.number,
+          JSON.stringify(pr),
+        );
+      }
+      this.sql.exec(
+        `INSERT OR REPLACE INTO snapshots (repo, snapshot_at, meta) VALUES (?, ?, ?)`,
+        snapshot.repo,
+        snapshot.snapshotAt,
+        JSON.stringify(meta),
+      );
+    });
+    return prs.length;
+  }
+
+  /** The repository's snapshot, pull requests in number order; null when none was stored. */
+  async get(repo: string): Promise<DeliverySnapshot | null> {
+    const row = this.sql.exec<{ meta: string }>(`SELECT meta FROM snapshots WHERE repo = ?`, repo).toArray()[0];
+    if (!row) return null;
+    const prs = this.sql
+      .exec<{ facts: string }>(`SELECT facts FROM pull_requests WHERE repo = ? ORDER BY number`, repo)
+      .toArray()
+      .map((r) => JSON.parse(r.facts) as DeliverySnapshot["prs"][number]);
+    return { ...(JSON.parse(row.meta) as Omit<DeliverySnapshot, "prs">), prs };
+  }
+}
+
+const DELIVERY_ROUTES = new Set(["/delivery/get", "/delivery/put"]);
+
+async function handleDelivery(pathname: string, body: unknown, env: Env): Promise<Response> {
+  const b = (typeof body === "object" && body !== null ? body : {}) as Record<string, unknown>;
+  const dO = env.DELIVERY.get(env.DELIVERY.idFromName(DELIVERY_OBJECT));
+  if (pathname === "/delivery/get") {
+    if (typeof b.repo !== "string" || !REPO_SLUG.test(b.repo)) return json({ error: "repo must be owner/name" }, 400);
+    const snapshot = await dO.get(b.repo);
+    console.log(
+      `[delivery/get] ${b.repo} -> ${snapshot ? `${snapshot.prs.length} pull requests as of ${snapshot.snapshotAt}` : "none"}`,
+    );
+    return json({ snapshot });
+  }
+  if (pathname === "/delivery/put") {
+    if (!isDeliverySnapshot(b.snapshot))
+      return json(
+        { error: "snapshot must be a DeliverySnapshot (repo, snapshotAt, range, prs[], truncated, completeFrom)" },
+        400,
+      );
+    const encoder = new TextEncoder();
+    const oversized = b.snapshot.prs.find(
+      (pr) => encoder.encode(JSON.stringify(pr)).byteLength > MAX_PULL_REQUEST_FACTS_BYTES,
+    );
+    if (oversized)
+      return json(
+        { error: `pull request ${oversized.number}'s facts must be at most ${MAX_PULL_REQUEST_FACTS_BYTES} bytes` },
+        413,
+      );
+    const prs = await dO.put(b.snapshot);
+    console.log(`[delivery/put] ${b.snapshot.repo} <- ${prs} pull requests as of ${b.snapshot.snapshotAt}`);
+    return json({ ok: true, prs });
+  }
+  return json({ error: "not found" }, 404);
+}
+
 /** Documents are small; a body over this is refused before storage. */
 const MAX_CONFIG_DOCUMENT_BYTES = 256 * 1024;
 
@@ -2180,6 +2293,16 @@ const LEDGER_ROUTES = new Set([
 
 /** Routes whose bodies may carry a record, a transcript chunk, or an event batch. */
 const WIDE_BODY_ROUTES = new Set(["/runs/put", "/runs/finish", "/runs/append", "/runs/transcript/write"]);
+/** A delivery snapshot: every merged pull request's reviews and its branch's workflow runs over
+ *  the window — a busy repository's runs to a few MB (measured: 291 pull requests, 2.1 MB). */
+const MAX_SNAPSHOT_BODY_BYTES = 8 * 1024 * 1024;
+
+/** The request body ceiling per route, decided after routing and before the parse. */
+function bodyFenceFor(pathname: string): number {
+  if (WIDE_BODY_ROUTES.has(pathname)) return MAX_RUN_PUT_BODY_BYTES;
+  if (pathname === "/delivery/put") return MAX_SNAPSHOT_BODY_BYTES;
+  return MAX_BODY_BYTES;
+}
 
 const gen = (v: unknown): Validated<string> =>
   typeof v === "string" && GEN_PATTERN.test(v)
@@ -2486,6 +2609,7 @@ async function handleRuns(pathname: string, body: unknown, env: Env): Promise<Re
 
 const ROUTES = new Set([
   ...CONFIG_ROUTES,
+  ...DELIVERY_ROUTES,
   "/retrieve",
   "/write",
   "/list",
@@ -2513,7 +2637,7 @@ interface Admission {
 async function handleRequest(request: Request, env: Env, admission: Admission): Promise<Response> {
   const url = new URL(request.url);
   if (url.pathname === "/healthz" && request.method === "GET")
-    return json({ ok: true, build: BUILD, features: ["memory", "schedules", "runs", "config"] });
+    return json({ ok: true, build: BUILD, features: ["memory", "schedules", "runs", "config", "delivery"] });
   if (!admission.known) return json({ error: "not found" }, 404);
   if (request.method !== "POST") return json({ error: "method not allowed" }, 405);
   if (!admission.authorized) return json({ error: "unauthorized" }, 401);
@@ -2533,8 +2657,9 @@ async function handleRequest(request: Request, env: Env, admission: Admission):
     return json({ error: "body must declare a numeric Content-Length" }, 411);
   }
   // The ledger's bulk routes carry a finished record, a transcript chunk, or
-  // an event batch (32 × 64 KiB) and share /runs/put's fence.
-  const maxBodyBytes = WIDE_BODY_ROUTES.has(url.pathname) ? MAX_RUN_PUT_BODY_BYTES : MAX_BODY_BYTES;
+  // an event batch (32 × 64 KiB) and share /runs/put's fence; a delivery
+  // snapshot carries a whole window of pull request facts and has its own.
+  const maxBodyBytes = bodyFenceFor(url.pathname);
   if (Number(header) > maxBodyBytes) {
     return json({ error: `body must be at most ${maxBodyBytes} bytes` }, 413);
   }
@@ -2563,6 +2688,7 @@ async function handleRequest(request: Request, env: Env, admission: Admission):
   }
   if (url.pathname.startsWith("/runs/")) return handleRuns(url.pathname, body, env);
   if (url.pathname.startsWith("/config/")) return handleConfig(url.pathname, body, env);
+  if (url.pathname.startsWith("/delivery/")) return handleDelivery(url.pathname, body, env);
 
   if (url.pathname === "/retrieve") {
     const parsed = parseRetrieve(body);

package/dist/assets/deploy/cloudflare-memory/wrangler.template.jsonc

@@ -31,7 +31,11 @@
       // transcript a resumed run continues from (docs/reference/specs/run-history.md item
       // 32). Kept apart from the history object so transcript bytes never queue
       // behind an admission decision; cleared at finish.
-      { "name": "RUN_TRANSCRIPTS", "class_name": "RunTranscriptDO" }
+      { "name": "RUN_TRANSCRIPTS", "class_name": "RunTranscriptDO" },
+      // ONE DeliveryDO (named "delivery"): the delivery page's snapshot per
+      // repository — the merged pull requests' facts over the window, one row
+      // each, and when they were read (docs/reference/specs/delivery.md item 10).
+      { "name": "DELIVERY", "class_name": "DeliveryDO" }
     ]
   },
   // SQLite-backed DOs (durable across restarts — AGENTS.md invariant 6).
@@ -45,6 +49,7 @@
     // The friction ledger is read from run history (RunHistoryDO carries every
     // run's diagnosis); the FrictionDO that once mirrored those diagnoses is
     // retired with its rows — docs/reference/specs/self-improvement.md item 1.
-    { "tag": "v7", "deleted_classes": ["FrictionDO"] }
+    { "tag": "v7", "deleted_classes": ["FrictionDO"] },
+    { "tag": "v8", "new_sqlite_classes": ["DeliveryDO"] }
   ]
 }

package/dist/assets/deploy/cloudflare-sandbox/worker.ts

@@ -340,9 +340,12 @@ function streamExec(
           // command (137 when the follow-up SIGKILL had to) — annotate so the
           // agent knows what happened and how to adapt.
           const timedOut = exitCode === 124 || exitCode === 137;
+          // A job past the ceiling is detached with `setsid -f`: every /exec
+          // runs under `timeout … bash -c`, whose process group is reaped when
+          // the command returns, so a plain background job dies with it.
           const note = timedOut
             ? `command timed out in the sandbox after ${execTimeoutSecs}s (pass the bash tool's timeoutMs for longer commands, max ${BASH_TIMEOUT_MAX_MS} ms); ` +
-              "re-run as smaller/faster steps or background it with nohup"
+              "re-run as smaller/faster steps, or start it detached with `setsid -f sh -c '<command> > /tmp/job.log 2>&1'` and poll the log on later calls"
             : "";
           // The command as the Worker's own root (docs/reference/specs/tracing.md item 22).
           execRoot(attemptStartedAt, traceparent).end(exitCode === 0 ? "ok" : "error", {