@coreplane/switchboard 1.239.0 → 1.241.0

package/dist/assets/config/config.example.yaml

@@ -323,14 +323,24 @@ workspaceDir: ./workspaces
 # ship:
 #   maxRounds: 3      # review rounds per unit
 #   maxMinutes: 120   # the ship preset's wall-clock budget in minutes (the registry's default)
+#   addressSeverity: minor  # the severity an approve's findings are held to (blocking|major|minor|nit);
+#                     # a finding at or above it sends the round into a fix step instead of merge-ready.
+#                     # Per channel/user: config set … --ship.addressSeverity; per run: severity:<level>.
 
-# `harness` is a retired key (docs/reference/specs/harness-pi.md item 1). It
-# moved the presets onto pi one at a time; every preset runs on pi now — the pi
-# coding agent started inside the run's own execution container (or as a child
-# of the bot for a preset without a workspace) with the run's model-proxy
-# bearer as its only key — and there is no other loop. A block written during
-# the series still loads when every value is `pi`; `native` names the deleted
-# loop and fails the load by name, as does an unknown preset. Remove the block.
+# Which harness each preset's runs are driven by (docs/reference/specs/harness.md
+# item 8): a mapping of preset to a harness's name. Two exist — `pi` (the pi
+# coding agent, the default for every preset) and `opencode` (OpenCode's server,
+# `opencode serve`) — each started inside the run's own execution container (or
+# as a child of the bot for a preset without a workspace) with the run's
+# model-proxy bearer as its only key, every tool call decided in the bot, every
+# event on the run's record. A preset the block does not name runs on pi;
+# nothing defaults to OpenCode. A run keeps the harness it started on, so
+# changing a word moves the next run, never one in flight. Any other word
+# (`native`, the deleted loop; `codex`) fails the load naming the two, as does
+# an unknown preset. How-to: docs/how-to/put-a-preset-on-opencode.md.
+# harness:
+#   coding: opencode   # coding runs on OpenCode
+#   review: pi         # the default, written out
 
 # What the harness writes into pi's per-run settings for every run on pi
 # (docs/reference/specs/harness-pi.md item 4): pi's compaction thresholds, in
@@ -346,6 +356,18 @@ workspaceDir: ./workspaces
 #     reserveTokens: 150000
 #     keepRecentTokens: 8000
 
+# What the harness writes into OpenCode's per-run configuration for every run
+# on OpenCode (docs/reference/specs/harness.md item 8): OpenCode's compaction
+# thresholds, in tokens, under OpenCode's own names — `buffer`, the tokens kept
+# free of the model's window before a compaction runs; `keepTokens`, how much
+# of the newest turns it keeps. Unset, OpenCode's defaults stand and the file
+# names no compaction. The OpenCode twin of the `pi` block above; positive
+# integers only, any other shape or key fails the load by name.
+# opencode:
+#   compaction:
+#     buffer: 20000
+#     keepTokens: 8000
+
 # The fan-out cap a spawning run meets (docs/reference/specs/agent-conductor.md).
 # `agent:conductor` starts child runs as the person who asked — each an
 # ordinary run in a thread of its own, under that person's permissions — and
@@ -386,6 +408,9 @@ workspaceDir: ./workspaces
 #   cloudflareAccountName: acme-infra              # optional: how the page names the account beside its share (else the id's first hex)
 #   cloudflareTokenEnv: CF_ANALYTICS_TOKEN     # token with Account Analytics:Read
 #   anthropicAdminKeyEnv: ANTHROPIC_ADMIN_KEY  # optional: sk-ant-admin… for LLM spend
+#   snapshot:                                  # the page serves a snapshot of both billing sources, never a live read;
+#     everyHours: 24                           #   how often the bot reads them (1–168, default 24). `costs snapshot`
+#                                              #   takes one now. Kept on the state Worker any `*.worker` block names
 #   groups:
 #     myapp:
 #       label: My App

package/dist/assets/deploy/cloudflare/worker.ts

@@ -17,8 +17,11 @@ import {
   createInstanceResponse,
   instanceStatusResponse,
   isInstanceNotFound,
+  parseInstanceEventPath,
   parseInstanceStatusPath,
   parseCreateInstanceRequest,
+  parseSendEventRequest,
+  sendEventResponse,
   parseSubjectAuthorization,
   type CreateInstanceOutcome,
 } from "../../src/core/coordinator/instancesRoute.ts";
@@ -87,6 +90,7 @@ export interface Env {
   DASHBOARD_TOKEN?: string; // dashboard auth `token` strategy: the bearer (the default env name; config may name another)
   SWITCHBOARD_INGRESS_TOKENS?: string; // enables HTTP /ingress + MCP /mcp (JSON token→identity map); the `cron` entry is what scheduled runs present; an entry whose `http:<subject>` actor holds `deploy:write` in the bot's config may POST /admin/restart
   BRAVE_SEARCH_API_KEY?: string; // web_search backend (Brave); web_fetch works without it
+  GITHUB_WEBHOOK_SECRET?: string; // check-run intake: signs POST /webhooks/github; absent, the intake answers 503 disabled
   CF_ANALYTICS_TOKEN?: string; // costs dash: Cloudflare API token, Account Analytics:Read only
   ANTHROPIC_ADMIN_KEY?: string; // costs dash (optional): Anthropic Admin API key for the LLM cost report
   MEMORY_TOKEN?: string; // durable memory + friction ledger + schedule firings + MCP registry: bearer for the state Worker
@@ -125,6 +129,7 @@ const FORWARDED_OPTIONAL = [
   "ANTHROPIC_ADMIN_KEY",
   "SWITCHBOARD_INGRESS_TOKENS",
   "BRAVE_SEARCH_API_KEY",
+  "GITHUB_WEBHOOK_SECRET",
   "MEMORY_TOKEN",
   "MCP_CREDENTIAL_KEY",
   "MCP_ACCESS_CLIENT_ID",
@@ -407,6 +412,57 @@ async function handleCoordinatorInstanceStatus(request: Request, env: Env, id: s
   return json(res.status, res.body);
 }
 
+/** `POST /admin/coordinator/instances/<id>/events` — the shim's event relay
+ *  (docs/reference/specs/http-ingress.md item 12): the bot's check-run intake
+ *  holds no Workflow binding, so its `checks-settled-<head>` send crosses here
+ *  and this Worker's own `SHIP_COORDINATOR` binding delivers it. The same door
+ *  as the create and the status: the bearer in the map, the bot's `authorize`
+ *  answer. The engine's `instance.not_found` is 404; any other refusal (an
+ *  instance that already ended) is 502 by reason — the sender treats both as a
+ *  failed send and the driver's bounded wait is the fallback. */
+async function handleCoordinatorInstanceEvent(request: Request, env: Env, id: string): Promise<Response> {
+  const json = (status: number, body: Record<string, unknown>) =>
+    new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+  if (request.method !== "POST")
+    return json(405, {
+      ok: false,
+      error: `method not allowed: ${request.method} — ${COORDINATOR_INSTANCES_PATH}/<id>/events answers POST only`,
+    });
+  const authorization = request.headers.get("authorization") ?? undefined;
+  const authn = authenticateIngressBearer(authorization, env.SWITCHBOARD_INGRESS_TOKENS, "coordinator");
+  if (!authn.ok) {
+    console.warn(`[coordinator] instance event ${authn.status} — ${authn.reason}`);
+    return json(authn.status, { ok: false, error: authn.reason });
+  }
+  let answer: Response;
+  try {
+    answer = await getContainer(env.SWITCHBOARD, INSTANCE).fetch(
+      new Request(`${INTERNAL}${COORDINATOR_AUTHORIZE_PATH}`, {
+        method: "POST",
+        headers: { authorization: authorization ?? "" },
+      }),
+    );
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    return json(503, { ok: false, error: `coordinator disabled: the bot could not be asked (${reason})` });
+  }
+  const auth = parseSubjectAuthorization(answer.status, await answer.text().catch(() => ""));
+  if (!auth.ok) return json(auth.status, { ok: false, error: auth.reason });
+  const parsed = parseSendEventRequest(await request.text().catch(() => ""));
+  if (!parsed.ok) return json(400, { ok: false, error: parsed.reason });
+  let outcome: Parameters<typeof sendEventResponse>[0];
+  try {
+    await (await env.SHIP_COORDINATOR.get(id)).sendEvent({ type: parsed.type, payload: parsed.payload });
+    outcome = { kind: "sent", id };
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    outcome = isInstanceNotFound(reason) ? { kind: "absent", id } : { kind: "failed", id, reason };
+  }
+  const res = sendEventResponse(outcome);
+  console.log(`[coordinator] ${auth.subject} → instance ${id} event ${parsed.type}: ${outcome.kind}`);
+  return json(res.status, res.body);
+}
+
 /** Record a firing on the state Worker's ScheduleDO (the /runs Scheduled panel
  *  reads it). Best-effort: a failure here is a log line — the run itself (if
  *  any) already happened and is its own record. */
@@ -440,29 +496,32 @@ export default {
       // The routes the Worker answers itself — the restart, the coordinator's
       // instance creation and an instance's status, all over bindings only this
       // Worker holds; everything else is the container's.
-      const statusId = parseInstanceStatusPath(pathname);
+      const eventsId = parseInstanceEventPath(pathname);
+      const statusId = eventsId === undefined ? parseInstanceStatusPath(pathname) : undefined;
       const res =
         pathname === "/admin/restart"
           ? await handleAdminRestart(forwarded, env)
           : pathname === COORDINATOR_INSTANCES_PATH
             ? await handleCoordinatorInstances(forwarded, env)
-            : statusId !== undefined
-              ? await handleCoordinatorInstanceStatus(forwarded, env, statusId)
-              : pathname === COPY_PATH
-                ? // The artifact copy (artifactsCopy.ts): the R2 binding and the Slack
-                  // token are this Worker's; the bot only asks, with its copy bearer.
-                  // `forwarded`, never `inbound`: `withTraceContext` rebuilt the request
-                  // with `new Request(inbound, …)`, which takes the body stream with it —
-                  // `inbound.text()` is empty afterwards and the route read "not JSON" live.
-                  await handleArtifactsCopy(forwarded, {
-                    bucket: env.ARTIFACTS,
-                    bucketName: env.ARTIFACTS_BUCKET_NAME,
-                    copyToken: env.ARTIFACTS_COPY_TOKEN,
-                    slackToken: env.SLACK_BOT_TOKEN,
-                    fetch: (input, init) => fetch(input, init),
-                    lengthPipe: (size) => new FixedLengthStream(size),
-                  })
-                : withLength(await getContainer(env.SWITCHBOARD, INSTANCE).fetch(forwarded));
+            : eventsId !== undefined
+              ? await handleCoordinatorInstanceEvent(forwarded, env, eventsId)
+              : statusId !== undefined
+                ? await handleCoordinatorInstanceStatus(forwarded, env, statusId)
+                : pathname === COPY_PATH
+                  ? // The artifact copy (artifactsCopy.ts): the R2 binding and the Slack
+                    // token are this Worker's; the bot only asks, with its copy bearer.
+                    // `forwarded`, never `inbound`: `withTraceContext` rebuilt the request
+                    // with `new Request(inbound, …)`, which takes the body stream with it —
+                    // `inbound.text()` is empty afterwards and the route read "not JSON" live.
+                    await handleArtifactsCopy(forwarded, {
+                      bucket: env.ARTIFACTS,
+                      bucketName: env.ARTIFACTS_BUCKET_NAME,
+                      copyToken: env.ARTIFACTS_COPY_TOKEN,
+                      slackToken: env.SLACK_BOT_TOKEN,
+                      fetch: (input, init) => fetch(input, init),
+                      lengthPipe: (size) => new FixedLengthStream(size),
+                    })
+                  : withLength(await getContainer(env.SWITCHBOARD, INSTANCE).fetch(forwarded));
       root.end(res.status >= 500 ? "error" : "ok", { httpStatus: res.status });
       return res;
     } catch (err) {

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -10,6 +10,7 @@ import {
 } from "../../src/core/memory/engine.ts";
 import { tokenize } from "../../src/core/memory/scorer.ts";
 import { FIRING_DETAIL_MAX, isScheduleFiring, type ScheduleFiring } from "../../src/core/schedules.ts";
+import { isCostsSnapshot, type CostsSnapshot } from "../../src/core/costsSnapshotStore.ts";
 import { REPO_SLUG } from "../../src/core/delivery.ts";
 import {
   isDeliverySnapshot,
@@ -176,6 +177,8 @@ export interface Env {
   SESSION_LOGS: DurableObjectNamespace<SessionLogDO>;
   /** Delivery snapshots (delivery item 10): ONE DeliveryDO (named "delivery"), one snapshot per repository. */
   DELIVERY: DurableObjectNamespace<DeliveryDO>;
+  /** The costs snapshot (costs item 6): ONE CostsSnapshotDO (named "costs"), one snapshot per installation. */
+  COSTS: DurableObjectNamespace<CostsSnapshotDO>;
   /** The ship coordinator Workflow in the bot's shim Worker (run-history item
    *  47): where `RunHistoryDO.finish` sends `run-finished-<runId>` for a record
    *  carrying `parentInstanceId`. Optional: this Worker deploys without it (the
@@ -188,6 +191,9 @@ export interface Env {
 /** The single DeliveryDO's name — every repository's snapshot lives in one object. */
 const DELIVERY_OBJECT = "delivery";
 
+/** The single CostsSnapshotDO's name — the installation has one costs snapshot. */
+const COSTS_OBJECT = "costs";
+
 /** The single ConfigDO's name. */
 const CONFIG_OBJECT = "config";
 /** A config document key: short, lowercase, like `overrides`. */
@@ -929,6 +935,110 @@ async function handleDelivery(pathname: string, body: unknown, env: Env): Promis
   return json({ error: "not found" }, 404);
 }
 
+// ---------------------------------------------------------------------------
+// The costs snapshot (docs/reference/specs/costs.md item 6)
+// ---------------------------------------------------------------------------
+
+/** The datasets a snapshot's `usage` carries, each stored as its own row. */
+const USAGE_PARTS = [
+  "containers",
+  "durableObjectRequests",
+  "durableObjectDays",
+  "durableObjectStorage",
+  "workers",
+  "r2Storage",
+  "r2Operations",
+  "workflows",
+] as const;
+
+/**
+ * The installation's one costs snapshot: both billing sources' rows over the
+ * page's widest range plus the run history's per-user usage, and when they
+ * were read (`CostsSnapshot`, the shape the bot validates too). Stored as one
+ * row per part — the meta, each usage dataset, the LLM rows, the run usage —
+ * so no single value nears the row limit as the window's rows grow; replaced
+ * whole on every put, in one transaction, and read back as one document.
+ */
+export class CostsSnapshotDO extends DurableObject<Env> {
+  private readonly sql: SqlStorage;
+
+  constructor(ctx: DurableObjectState, env: Env) {
+    super(ctx, env);
+    this.sql = ctx.storage.sql;
+    this.sql.exec(`
+      CREATE TABLE IF NOT EXISTS parts (
+        part TEXT PRIMARY KEY,
+        body TEXT NOT NULL
+      );
+    `);
+  }
+
+  /** Replace the snapshot whole: every part rewritten in one transaction. */
+  async put(snapshot: CostsSnapshot): Promise<void> {
+    const { usage, llm, runUsage, ...meta } = snapshot;
+    const rows: Array<[string, unknown]> = [
+      ["meta", meta],
+      ...USAGE_PARTS.map((name): [string, unknown] => [`usage.${name}`, usage[name]]),
+      ["llm", llm],
+      ["runUsage", runUsage],
+    ];
+    this.ctx.storage.transactionSync(() => {
+      this.sql.exec(`DELETE FROM parts`);
+      for (const [part, body] of rows)
+        this.sql.exec(`INSERT INTO parts (part, body) VALUES (?, ?)`, part, JSON.stringify(body));
+    });
+  }
+
+  /** The stored snapshot reassembled from its parts, or null when none was stored (or the parts do not make one). */
+  async get(): Promise<CostsSnapshot | null> {
+    const parts = new Map(
+      this.sql
+        .exec<{ part: string; body: string }>(`SELECT part, body FROM parts`)
+        .toArray()
+        .map((r) => [r.part, r.body]),
+    );
+    const meta = parts.get("meta");
+    if (meta === undefined) return null;
+    const read = (part: string): unknown => {
+      const body = parts.get(part);
+      return body === undefined ? undefined : (JSON.parse(body) as unknown);
+    };
+    const usage = Object.fromEntries(USAGE_PARTS.map((name) => [name, read(`usage.${name}`)]));
+    const snapshot = {
+      ...(JSON.parse(meta) as Record<string, unknown>),
+      usage,
+      llm: read("llm"),
+      runUsage: read("runUsage"),
+    };
+    return isCostsSnapshot(snapshot) ? snapshot : null;
+  }
+}
+
+const COSTS_ROUTES = new Set(["/costs/snapshot/get", "/costs/snapshot/put"]);
+
+async function handleCosts(pathname: string, body: unknown, env: Env): Promise<Response> {
+  const b = (typeof body === "object" && body !== null ? body : {}) as Record<string, unknown>;
+  const dO = env.COSTS.get(env.COSTS.idFromName(COSTS_OBJECT));
+  if (pathname === "/costs/snapshot/get") {
+    const snapshot = await dO.get();
+    console.log(
+      `[costs/snapshot/get] -> ${snapshot ? `snapshot taken ${snapshot.takenAt} by ${snapshot.takenBy}` : "none"}`,
+    );
+    return json({ snapshot });
+  }
+  if (pathname === "/costs/snapshot/put") {
+    if (!isCostsSnapshot(b.snapshot))
+      return json(
+        { error: "snapshot must be a CostsSnapshot (takenAt, takenBy, durationMs, range, usage, llm, runUsage)" },
+        400,
+      );
+    await dO.put(b.snapshot);
+    console.log(`[costs/snapshot/put] <- snapshot taken ${b.snapshot.takenAt} by ${b.snapshot.takenBy}`);
+    return json({ ok: true });
+  }
+  return json({ error: "not found" }, 404);
+}
+
 /** Documents are small; a body over this is refused before storage. */
 const MAX_CONFIG_DOCUMENT_BYTES = 256 * 1024;
 
@@ -3229,6 +3339,8 @@ const MAX_SNAPSHOT_BODY_BYTES = 16 * 1024 * 1024;
 function bodyFenceFor(pathname: string): number {
   if (WIDE_BODY_ROUTES.has(pathname)) return MAX_RUN_PUT_BODY_BYTES;
   if (pathname === "/delivery/put" || pathname === "/delivery/merge") return MAX_SNAPSHOT_BODY_BYTES;
+  // A ninety-day costs snapshot is a few hundred KB today and grows with the account's rows.
+  if (pathname === "/costs/snapshot/put") return MAX_SNAPSHOT_BODY_BYTES;
   return MAX_BODY_BYTES;
 }
 
@@ -3707,6 +3819,7 @@ async function handleRuns(pathname: string, body: unknown, env: Env): Promise<Re
 const ROUTES = new Set([
   ...CONFIG_ROUTES,
   ...DELIVERY_ROUTES,
+  ...COSTS_ROUTES,
   "/retrieve",
   "/write",
   "/list",
@@ -3735,7 +3848,7 @@ interface Admission {
 async function handleRequest(request: Request, env: Env, admission: Admission): Promise<Response> {
   const url = new URL(request.url);
   if (url.pathname === "/healthz" && request.method === "GET")
-    return json({ ok: true, build: BUILD, features: ["memory", "schedules", "runs", "config", "delivery"] });
+    return json({ ok: true, build: BUILD, features: ["memory", "schedules", "runs", "config", "delivery", "costs"] });
   if (!admission.known) return json({ error: "not found" }, 404);
   if (request.method !== "POST") return json({ error: "method not allowed" }, 405);
   if (!admission.authorized) return json({ error: "unauthorized" }, 401);
@@ -3787,6 +3900,7 @@ async function handleRequest(request: Request, env: Env, admission: Admission):
   if (url.pathname.startsWith("/runs/")) return handleRuns(url.pathname, body, env);
   if (url.pathname.startsWith("/config/")) return handleConfig(url.pathname, body, env);
   if (url.pathname.startsWith("/delivery/")) return handleDelivery(url.pathname, body, env);
+  if (url.pathname.startsWith("/costs/")) return handleCosts(url.pathname, body, env);
 
   if (url.pathname === "/retrieve") {
     const parsed = parseRetrieve(body);

package/dist/assets/deploy/cloudflare-memory/wrangler.template.jsonc

@@ -36,6 +36,11 @@
       // repository — the merged pull requests' facts over the window, one row
       // each, and when they were read (docs/reference/specs/delivery.md item 10).
       { "name": "DELIVERY", "class_name": "DeliveryDO" },
+      // ONE CostsSnapshotDO (named "costs"): the installation's costs snapshot —
+      // both billing sources' rows over the costs page's widest range and the run
+      // history's per-user usage, one row per part, replaced whole on every take
+      // (docs/reference/specs/costs.md item 6).
+      { "name": "COSTS", "class_name": "CostsSnapshotDO" },
       // One SessionLogDO per session — a thread and an agent (the DO name is
       // `<threadKey>:<agent>`): the transcript rows of every run of the
       // session, a full-text index over them, and the notepad
@@ -74,6 +79,7 @@
     // retired with its rows — docs/reference/specs/self-improvement.md item 1.
     { "tag": "v7", "deleted_classes": ["FrictionDO"] },
     { "tag": "v8", "new_sqlite_classes": ["DeliveryDO"] },
-    { "tag": "v9", "new_sqlite_classes": ["SessionLogDO"] }
+    { "tag": "v9", "new_sqlite_classes": ["SessionLogDO"] },
+    { "tag": "v10", "new_sqlite_classes": ["CostsSnapshotDO"] }
   ]
 }