@damn-dev/cli 0.9.20 → 0.13.3

package/runtime/apps/backend/prisma/schema.prisma

@@ -69,18 +69,20 @@ model Verification {
 }
 
 model Workspace {
-  id          String                @id @default(cuid())
-  name        String
-  ownerId     String
-  owner       User                  @relation(fields: [ownerId], references: [id])
-  createdAt   DateTime              @default(now())
-  agents      Agent[]
-  channels    Channel[]
-  skills      Skill[]
-  tasks       Task[]
-  missions    Mission[]
-  members     WorkspaceMember[]
-  invitations WorkspaceInvitation[]
+  id            String                @id @default(cuid())
+  name          String
+  ownerId       String
+  owner         User                  @relation(fields: [ownerId], references: [id])
+  createdAt     DateTime              @default(now())
+  // JSON: { policy: 'all'|'allowlist'|'denylist', allowedDomains: string[], deniedDomains: string[] }
+  browserPolicy String?
+  agents        Agent[]
+  channels      Channel[]
+  skills        Skill[]
+  tasks         Task[]
+  missions      Mission[]
+  members       WorkspaceMember[]
+  invitations   WorkspaceInvitation[]
 }
 
 model Agent {
@@ -439,12 +441,26 @@ model FileEditApproval {
   createdAt     DateTime  @default(now())
 }
 
+// Historically named DelegationRule; now stores approval rules for every
+// auto-approvable approval type (shell / delegate / skill_tool / git_pr).
+// `agentId = null` means workspace-scoped (applies to every agent in
+// the workspace that owns the rule). `workspaceId` is set on every new row
+// and denormalized on agent-scoped rows too — enforces workspace isolation
+// at the query layer. Table name preserved to avoid a SQLite
+// drop-and-recreate under `prisma db push`.
 model DelegationRule {
   id          String   @id @default(cuid())
-  agentId     String
+  agentId     String?
+  workspaceId String?
   pattern     String
+  type        String?
+  reason      String?
+  createdBy   String?
   autoApprove Boolean  @default(true)
   createdAt   DateTime @default(now())
+
+  @@index([agentId, type])
+  @@index([workspaceId, agentId, type])
 }
 
 model PushToken {