@coreplane/switchboard 1.241.0 → 1.243.0

package/dist/assets/config/config.example.yaml

@@ -11,7 +11,11 @@ providers:
   anthropic:
     type: anthropic
     apiKeyEnv: ANTHROPIC_API_KEY
-  # Any OpenAI-compatible endpoint works with the same adapter:
+  # OpenAI itself runs on the same compatible adapter: any preset's model may
+  # be openai/<model-id> anywhere a model is accepted. The adapter speaks Chat
+  # Completions, not the Responses API, sends no reasoning control (our effort
+  # tiers do not reach these models), and meters tokens without pricing them.
+  # A first-class OpenAI block is a plan's business, not this file's.
   openai:
     type: openai-compatible
     baseUrl: https://api.openai.com/v1
@@ -65,10 +69,19 @@ defaults:
   # clipped (the card and the run record say so); a preset whose identity or
   # class is above a cap is refused by name before any executor exists. Absent →
   # nothing is capped and every preset runs exactly its declared profile.
+  # A fourth field, `confirm`, is the front door's and caps no run: the first
+  # blast-radius class a command the router bound from prose is handed back at
+  # (`To run this: …`) instead of run — `write` (every write is handed back; a
+  # read or a repository's own test or build runs) or `destructive` (a write
+  # runs at once; only a destructive one is handed back). It intersects toward
+  # caution like the run axes — a channel or a user can only ask MORE than what
+  # is set here — and unset everywhere it is the built-in `write`. `exec` and
+  # `never` are refused by name.
   # boundary:
   #   maxMinutes: 120
   #   maxIdentity: write
   #   machines: [none, blank, repo-cold, repo-resident]
+  #   confirm: write
 
 # PR reviews and the reading diff (docs/reference/specs/reading-diff.md). Every
 # review records its full `git diff`; the ABRIDGED version (meat.dev, run on
@@ -100,10 +113,16 @@ defaults:
 #       maxMinutes: 45
 #       maxIdentity: read
 
-# Static per-user defaults (user ID -> scope).
+# Static per-user defaults (user ID -> scope). A user's `harness` puts that
+# person's runs of a preset on another harness (docs/reference/specs/harness.md
+# item 8) — every run of it they request, in any channel, and nobody else's; the
+# same words as the top-level `harness` block, which they override (a channel's
+# `harness` sits between). From chat: `config set me --harness.coding opencode`.
 # users:
 #   slack:U012345:
 #     model: openai/gpt-5
+#     harness:
+#       coding: opencode
 
 # Authorization (docs/reference/specs/authorization.md item 9, docs/reference/authorization.md):
 # two blocks. `restrict` names what is CLOSED unless granted — an agent listed
@@ -327,17 +346,22 @@ workspaceDir: ./workspaces
 #                     # a finding at or above it sends the round into a fix step instead of merge-ready.
 #                     # Per channel/user: config set … --ship.addressSeverity; per run: severity:<level>.
 
-# Which harness each preset's runs are driven by (docs/reference/specs/harness.md
-# item 8): a mapping of preset to a harness's name. Two exist — `pi` (the pi
-# coding agent, the default for every preset) and `opencode` (OpenCode's server,
-# `opencode serve`) — each started inside the run's own execution container (or
-# as a child of the bot for a preset without a workspace) with the run's
-# model-proxy bearer as its only key, every tool call decided in the bot, every
-# event on the run's record. A preset the block does not name runs on pi;
-# nothing defaults to OpenCode. A run keeps the harness it started on, so
-# changing a word moves the next run, never one in flight. Any other word
-# (`native`, the deleted loop; `codex`) fails the load naming the two, as does
-# an unknown preset. How-to: docs/how-to/put-a-preset-on-opencode.md.
+# Which harness each preset's runs are driven by, deployment-wide
+# (docs/reference/specs/harness.md item 8): a mapping of preset to a harness's
+# name. Two exist — `pi` (the pi coding agent, the default for every preset)
+# and `opencode` (OpenCode's server, `opencode serve`) — each started inside
+# the run's own execution container (or as a child of the bot for a preset
+# without a workspace) with the run's model-proxy bearer as its only key, every
+# tool call decided in the bot, every event on the run's record. This block is
+# the defaults layer of the per-scope `harness` setting: a channel's or a
+# user's `harness` (above, or `config set channel|me --harness.<preset> …`)
+# overrides it for the runs in that scope, user over channel over here. A
+# preset no layer names runs on pi; nothing defaults to OpenCode. A run keeps
+# the harness it started on, so changing a word moves the next run, never one
+# in flight. Any other word (`native`, the deleted loop; `codex`) fails the
+# load naming the two, as does an unknown preset, in every layer; a
+# `defaults.harness` key is refused pointing here. How-to:
+# docs/how-to/put-a-preset-on-opencode.md.
 # harness:
 #   coding: opencode   # coding runs on OpenCode
 #   review: pi         # the default, written out
@@ -411,6 +435,8 @@ workspaceDir: ./workspaces
 #   snapshot:                                  # the page serves a snapshot of both billing sources, never a live read;
 #     everyHours: 24                           #   how often the bot reads them (1–168, default 24). `costs snapshot`
 #                                              #   takes one now. Kept on the state Worker any `*.worker` block names
+#     alertChannel: slack:C0123ABCD            #   optional: a line there after three failed takes in a row, and one
+#                                              #   when a take lands again; otherwise only the page's status line says
 #   groups:
 #     myapp:
 #       label: My App
@@ -423,6 +449,12 @@ workspaceDir: ./workspaces
 #       r2Buckets:                                # optional: bucket name → label for buckets not named <worker>-cache
 #         some-other-bucket: uploads
 #       anthropicWorkspaceId: wrkspc_...          # this app's Anthropic workspace
+#   prices:                                    # optional: USD per million tokens by <provider>/<model>, the ref a run's
+#     openai/gpt-5:                            #   spans name — for a model the Anthropic list does not know, or to
+#       input: 1.25                            #   override the list; all four kinds named (a provider with no
+#       output: 10                             #   cache-write charge says 0). A model neither knows is "unpriced",
+#       cacheRead: 0.125                       #   never $0, on the costs page and on a run's own page
+#       cacheWrite: 0
 
 # Delivery indicators: GET /delivery and `delivery report` (docs/reference/specs/delivery.md).
 # Optional. Needs a GitHub credential (the App triple or GH_TOKEN); read-only on GitHub.

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -25,6 +25,7 @@ import {
   isRunSession,
   isRunVisibilityFilter,
   normalizeStored,
+  pullRequestNumberOf,
   RETENTION_BOUNDS,
   RUN_EVENTS_DEFAULT_PAGE,
   RUN_EVENTS_MAX_PAGE,
@@ -59,11 +60,11 @@ import {
 } from "../../src/core/runLedger/sessionLog.ts";
 import type { RunEvent } from "../../src/core/runEvents.ts";
 import {
-  aggregateUsageByUser,
   isRunUsage,
   usageOfEvents,
   type RunUsage,
-  type RunUsageReport,
+  type RunUsageRows,
+  type UsageIdentity,
   type UsageRun,
 } from "../../src/core/runUsage.ts";
 import {
@@ -1265,13 +1266,15 @@ export class RunHistoryDO extends DurableObject<Env> {
     this.migrateRunsTable();
     // The indexes the visibility predicate's leaves walk (`channel_id IN`,
     // `channel_visibility IN`, `user_id =`), each ordered like the page; the
-    // session the sweep asks about; the parent a children listing filters on.
+    // session the sweep asks about; the parent a children listing filters on;
+    // the pull request a findings listing filters on.
     this.sql.exec(`
       CREATE INDEX IF NOT EXISTS runs_channel_finished ON runs(channel_id, finished_at DESC, run_id DESC);
       CREATE INDEX IF NOT EXISTS runs_visibility_finished ON runs(channel_visibility, finished_at DESC, run_id DESC);
       CREATE INDEX IF NOT EXISTS runs_user_finished ON runs(user_id, finished_at DESC, run_id DESC);
       CREATE INDEX IF NOT EXISTS runs_session ON runs(session_key);
       CREATE INDEX IF NOT EXISTS runs_parent ON runs(parent_run_id, finished_at DESC, run_id DESC);
+      CREATE INDEX IF NOT EXISTS runs_pr ON runs(repo, pr_number, finished_at DESC, run_id DESC);
     `);
     // The sessions registry (session-log item 7): every session log a run of
     // this store claimed, with its thread — the sweep cannot enumerate the
@@ -1438,7 +1441,11 @@ export class RunHistoryDO extends DurableObject<Env> {
    *  aggregate fills it from the run's stored events. The parent a child names
    *  (run-history item 46), the column a children listing filters on: the
    *  record already carries it in `summary_json`, so existing rows are filled
-   *  from there once, and every later `put` writes it beside the row. */
+   *  from there once, and every later `put` writes it beside the row. The pull
+   *  request a run names (run-history item 58; `pullRequestNumberOf`), the
+   *  column a findings listing filters on: the same one-time fill from
+   *  `summary_json` — the coding post-step's `pr`, else a posted review's
+   *  target — and every later `put` writes it beside the row. */
   migrateRunsTable(): void {
     const columns = new Set(
       this.sql
@@ -1457,6 +1464,19 @@ export class RunHistoryDO extends DurableObject<Env> {
          WHERE json_type(summary_json, '$.parentRunId') = 'text'`,
       );
     }
+    if (!columns.has("pr_number")) {
+      this.sql.exec(`ALTER TABLE runs ADD COLUMN pr_number INTEGER`);
+      // `pullRequestNumberOf` in SQL: the coding post-step's pull request, else
+      // the one a posted review targeted (a skipped post has no target).
+      this.sql.exec(
+        `UPDATE runs SET pr_number = COALESCE(
+           CASE WHEN json_type(summary_json, '$.pr.number') = 'integer' THEN json_extract(summary_json, '$.pr.number') END,
+           CASE WHEN json_extract(summary_json, '$.reviewPost.posted') = 1
+                 AND json_type(summary_json, '$.reviewPost.target.number') = 'integer'
+                THEN json_extract(summary_json, '$.reviewPost.target.number') END
+         )`,
+      );
+    }
   }
 
   private liveByThread(threadKey: string): LiveRunRow | undefined {
@@ -1970,8 +1990,8 @@ export class RunHistoryDO extends DurableObject<Env> {
         );
       this.sql.exec(
         `INSERT INTO runs (run_id, label, agent, model, channel_id, user_id, thread_key, channel_visibility, repo, started_at, finished_at, stored_at, status,
-                           event_count, stored_event_count, truncated, bytes, diagnosis_json, summary_json, session_key, usage_json, parent_run_id)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                           event_count, stored_event_count, truncated, bytes, diagnosis_json, summary_json, session_key, usage_json, parent_run_id, pr_number)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
          ON CONFLICT(run_id) DO UPDATE SET
            label = excluded.label, agent = excluded.agent, model = excluded.model, channel_id = excluded.channel_id,
            user_id = excluded.user_id, thread_key = excluded.thread_key, channel_visibility = excluded.channel_visibility,
@@ -1981,7 +2001,8 @@ export class RunHistoryDO extends DurableObject<Env> {
            bytes = excluded.bytes, diagnosis_json = excluded.diagnosis_json, summary_json = excluded.summary_json,
            session_key = excluded.session_key,
            usage_json = COALESCE(excluded.usage_json, runs.usage_json),
-           parent_run_id = excluded.parent_run_id`,
+           parent_run_id = excluded.parent_run_id,
+           pr_number = excluded.pr_number`,
         stored.id,
         stored.label ?? null,
         stored.agent ?? null,
@@ -2004,6 +2025,7 @@ export class RunHistoryDO extends DurableObject<Env> {
         stored.session?.key ?? null,
         stored.usage ? JSON.stringify(stored.usage) : null,
         stored.parentRunId ?? null,
+        pullRequestNumberOf(stored) ?? null,
       );
       // The session's registry row learns its newest finish (session-log item
       // 7); a record that reaches the store without a claim (the plain put
@@ -2208,28 +2230,32 @@ export class RunHistoryDO extends DurableObject<Env> {
   }
 
   /**
-   * Who spent what, per UTC day (costs.md, cost by user), over the runs that
-   * finished in [sinceMs, untilMs) and are inside the retention window. A row
-   * written before `usage_json` existed is filled in here from its stored
-   * `model.turn` events — up to USAGE_BACKFILL_PER_CALL a call, the rest
-   * reported as `pending` — so the history heals as it is read, with no
+   * What the runs that finished in [sinceMs, untilMs) and are inside the
+   * retention window cost (costs.md items 10–10a; run-history item 56): one row
+   * per run — its requester, thread, channel, agent and usage — plus the
+   * identity of every parent a child names that is outside the batch, so the
+   * bot bills the child without a second read. The arithmetic is the bot's; the
+   * Worker only reads its rows. A row written before `usage_json` existed is
+   * filled in here from its stored `model.turn` events — up to
+   * USAGE_BACKFILL_PER_CALL a call, the rest answered without `usage` and
+   * counted in `pending` — so the history heals as it is read, with no
    * operator step; a run without turns is written back as the zero usage so it
-   * is not re-read. A child is billed to its parent's requester; a parent
-   * outside the range is looked up by id.
+   * is not re-read.
    */
-  usageByUser(sinceMs: number, untilMs: number): RunUsageReport {
+  usage(sinceMs: number, untilMs: number): RunUsageRows {
     const now = systemClock();
     const { policy } = this.policyState();
     const cutoff = now - policy.retentionDays * 86_400_000;
     const rows = this.sql
       .exec<UsageRow>(
-        `SELECT run_id, user_id, started_at, finished_at, usage_json, summary_json FROM runs
+        `SELECT run_id, user_id, agent, channel_id, thread_key, started_at, finished_at, usage_json, summary_json FROM runs
           WHERE finished_at >= ? AND finished_at < ? ORDER BY finished_at ASC, run_id ASC`,
         Math.max(sinceMs, cutoff),
         untilMs,
       )
       .toArray();
     let backfilled = 0;
+    let pending = 0;
     const runs: UsageRun[] = rows.map((row) => {
       let usage = parseUsageJson(row.usage_json);
       if (usage === undefined && backfilled < USAGE_BACKFILL_PER_CALL) {
@@ -2237,31 +2263,38 @@ export class RunHistoryDO extends DurableObject<Env> {
         this.sql.exec(`UPDATE runs SET usage_json = ? WHERE run_id = ?`, JSON.stringify(usage), row.run_id);
         backfilled += 1;
       }
+      if (usage === undefined) pending += 1;
       const who = identityOfSummary(row.summary_json);
       return {
         id: row.run_id,
         userId: row.user_id,
         ...(who.userName ? { userName: who.userName } : {}),
         ...(who.parentRunId ? { parentRunId: who.parentRunId } : {}),
+        threadKey: row.thread_key,
+        channelId: row.channel_id,
+        ...(row.agent ? { agent: row.agent } : {}),
         startedAt: row.started_at,
         finishedAt: row.finished_at,
         ...(usage ? { usage } : {}),
       };
     });
-    const lookupParent = (id: string) => {
+    // The parents a child names that are not in the batch: looked up once each, known or not.
+    const inBatch = new Set(runs.map((r) => r.id));
+    const parents: Record<string, UsageIdentity> = {};
+    for (const id of new Set(runs.map((r) => r.parentRunId).filter((p): p is string => !!p && !inBatch.has(p)))) {
       const p = this.sql
         .exec<{ user_id: string; summary_json: string }>(`SELECT user_id, summary_json FROM runs WHERE run_id = ?`, id)
         .toArray()[0];
-      if (!p) return undefined;
+      if (!p) continue;
       const who = identityOfSummary(p.summary_json);
-      return { userId: p.user_id, ...(who.userName ? { userName: who.userName } : {}) };
-    };
-    const { rows: out, pending } = aggregateUsageByUser(runs, lookupParent);
+      parents[id] = { userId: p.user_id, ...(who.userName ? { userName: who.userName } : {}) };
+    }
     const earliest = this.sql
       .exec<{ m: number | null }>(`SELECT MIN(finished_at) AS m FROM runs WHERE finished_at >= ?`, cutoff)
       .one().m;
     return {
-      rows: out,
+      runs,
+      parents,
       pending,
       ...(earliest !== null ? { earliestFinishedAt: earliest } : {}),
       retentionDays: policy.retentionDays,
@@ -2343,6 +2376,11 @@ export class RunHistoryDO extends DurableObject<Env> {
       where.push(`parent_run_id = ?`);
       params.push(q.parentRunId);
     }
+    if (q.pr !== undefined) {
+      // `namesPullRequest` in SQL: the row's repository and the number it names.
+      where.push(`repo = ?`, `pr_number = ?`);
+      params.push(q.pr.repo, q.pr.number);
+    }
     if (q.visibleTo !== undefined && q.visibleTo.kind !== "all") where.push(visibilitySql(q.visibleTo, params));
     const select = `SELECT run_id, agent, channel_id, finished_at, bytes, event_count, summary_json FROM runs WHERE ${where.join(" AND ")} ORDER BY finished_at DESC, run_id DESC`;
     // `LIMIT` holds on the over-bound path too: the kept set is the newest
@@ -2423,6 +2461,9 @@ const USAGE_BACKFILL_PER_CALL = 200;
 type UsageRow = {
   run_id: string;
   user_id: string;
+  agent: string | null;
+  channel_id: string;
+  thread_key: string;
   started_at: number;
   finished_at: number;
   usage_json: string | null;
@@ -2590,12 +2631,26 @@ function parseRunList(body: unknown): Validated<{ storeKey: string; query: RunLi
     if (!id.ok) return invalid("parentRunId must match ^[A-Za-z0-9_-]{1,64}$");
     query.parentRunId = id.value;
   }
+  if (b.pr !== undefined) {
+    const pr = b.pr as Record<string, unknown> | null;
+    if (
+      typeof pr !== "object" ||
+      pr === null ||
+      typeof pr.repo !== "string" ||
+      !REPO_SLUG.test(pr.repo) ||
+      typeof pr.number !== "number" ||
+      !Number.isInteger(pr.number) ||
+      pr.number < 1
+    )
+      return invalid("pr must be { repo: owner/name, number: a positive integer }");
+    query.pr = { repo: pr.repo, number: pr.number };
+  }
   if (b.visibleTo !== undefined) {
     // A malformed filter is a 400, never "all": the bot degrades to live rows
     // rather than the DO widening what an actor may see.
     if (!isRunVisibilityFilter(b.visibleTo)) return invalid("visibleTo must be a run visibility filter");
-    if (boundParameters(b.visibleTo) > DO_MAX_BOUND_PARAMETERS - RUN_LIST_BASE_PARAMETERS)
-      return invalid(`visibleTo names more than ${DO_MAX_BOUND_PARAMETERS - RUN_LIST_BASE_PARAMETERS} ids`);
+    const headroom = DO_MAX_BOUND_PARAMETERS - RUN_LIST_BASE_PARAMETERS - (query.pr ? RUN_LIST_PR_PARAMETERS : 0);
+    if (boundParameters(b.visibleTo) > headroom) return invalid(`visibleTo names more than ${headroom} ids`);
     query.visibleTo = b.visibleTo;
   }
   return { ok: true, value: { storeKey: key.value, query } };
@@ -2604,6 +2659,8 @@ function parseRunList(body: unknown): Validated<{ storeKey: string; query: RunLi
 /** Parameters the page query binds before any filter: the cursor pair (3) and the age floor (1),
  *  plus `agent`, `channel`, `threadKey`, `parentRunId`, and the LIMIT at most — the headroom `visibleTo` must fit under. */
 const RUN_LIST_BASE_PARAMETERS = 9;
+/** The two more a `pr` filter binds (`repo`, `pr_number`), taken from the same headroom only when asked. */
+const RUN_LIST_PR_PARAMETERS = 2;
 
 /** How many `?` a filter binds (one per id, one per user). */
 function boundParameters(f: RunVisibilityFilter): number {
@@ -3800,13 +3857,13 @@ async function handleRuns(pathname: string, body: unknown, env: Env): Promise<Re
     );
     return json(result ?? { events: null });
   }
-  if (pathname === "/runs/usage-by-user") {
+  if (pathname === "/runs/usage") {
     const parsed = parseRunUsageQuery(body);
     if (!parsed.ok) return json({ error: parsed.error }, 400);
     const { storeKey, sinceMs, untilMs } = parsed.value;
-    const report = await stub(storeKey).usageByUser(sinceMs, untilMs);
-    console.log(`[runs/usage-by-user] ${storeKey} -> ${report.rows.length} rows, ${report.pending} pending`);
-    return json(report);
+    const rows = await stub(storeKey).usage(sinceMs, untilMs);
+    console.log(`[runs/usage] ${storeKey} -> ${rows.runs.length} runs, ${rows.pending} pending`);
+    return json(rows);
   }
   // /runs/delete
   const parsed = parseRunTarget(body);
@@ -3831,7 +3888,7 @@ const ROUTES = new Set([
   "/runs/summary",
   "/runs/list",
   "/runs/events",
-  "/runs/usage-by-user",
+  "/runs/usage",
   "/runs/delete",
   ...LEDGER_ROUTES,
 ]);