@lobu/cli 6.0.1 → 7.0.0

package/dist/db/migrations/20260429120000_agent_changed_notify.sql

@@ -0,0 +1,97 @@
+-- migrate:up
+
+-- Phase 6: NOTIFY trigger for invalidatableCache invalidation.
+--
+-- The agent-related runtime caches (formerly Redis-backed) read agents,
+-- channel bindings, user-agent associations, and per-(user,agent) auth
+-- profiles directly from Postgres. Each gateway process keeps a small
+-- read-through cache invalidated by `pg_notify('agent_changed', <key>)`.
+--
+-- We emit a single channel name and let the cache implementation match
+-- the payload against the cached key. Channels are deliberately coarse
+-- (one per logical resource family) to keep the postmaster's notification
+-- table small — see invalidatable-cache.ts.
+
+CREATE OR REPLACE FUNCTION public.notify_agent_changed()
+RETURNS trigger
+LANGUAGE plpgsql AS $$
+BEGIN
+  PERFORM pg_notify('agent_changed', COALESCE(NEW.id, OLD.id));
+  RETURN COALESCE(NEW, OLD);
+END;
+$$;
+
+DROP TRIGGER IF EXISTS agents_changed_notify ON public.agents;
+CREATE TRIGGER agents_changed_notify
+  AFTER INSERT OR UPDATE OR DELETE ON public.agents
+  FOR EACH ROW EXECUTE FUNCTION public.notify_agent_changed();
+
+
+-- Channel bindings: payload is "<platform>:<teamId|->:<channelId>" so the
+-- in-process cache (keyed identically) can drop just the affected entry.
+CREATE OR REPLACE FUNCTION public.notify_channel_binding_changed()
+RETURNS trigger
+LANGUAGE plpgsql AS $$
+DECLARE
+  rec record;
+  payload text;
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    rec := OLD;
+  ELSE
+    rec := NEW;
+  END IF;
+  payload := format(
+    '%s:%s:%s',
+    rec.platform,
+    COALESCE(rec.team_id, '-'),
+    rec.channel_id
+  );
+  PERFORM pg_notify('channel_binding_changed', payload);
+  RETURN COALESCE(NEW, OLD);
+END;
+$$;
+
+DROP TRIGGER IF EXISTS agent_channel_bindings_changed_notify ON public.agent_channel_bindings;
+CREATE TRIGGER agent_channel_bindings_changed_notify
+  AFTER INSERT OR UPDATE OR DELETE ON public.agent_channel_bindings
+  FOR EACH ROW EXECUTE FUNCTION public.notify_channel_binding_changed();
+
+
+-- User-agent associations: payload is "<platform>:<userId>" so the
+-- agent listing cache for a single user can be dropped without affecting
+-- other users.
+CREATE OR REPLACE FUNCTION public.notify_agent_users_changed()
+RETURNS trigger
+LANGUAGE plpgsql AS $$
+DECLARE
+  rec record;
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    rec := OLD;
+  ELSE
+    rec := NEW;
+  END IF;
+  PERFORM pg_notify(
+    'agent_users_changed',
+    format('%s:%s', rec.platform, rec.user_id)
+  );
+  RETURN COALESCE(NEW, OLD);
+END;
+$$;
+
+DROP TRIGGER IF EXISTS agent_users_changed_notify ON public.agent_users;
+CREATE TRIGGER agent_users_changed_notify
+  AFTER INSERT OR UPDATE OR DELETE ON public.agent_users
+  FOR EACH ROW EXECUTE FUNCTION public.notify_agent_users_changed();
+
+-- migrate:down
+
+DROP TRIGGER IF EXISTS agent_users_changed_notify ON public.agent_users;
+DROP FUNCTION IF EXISTS public.notify_agent_users_changed();
+
+DROP TRIGGER IF EXISTS agent_channel_bindings_changed_notify ON public.agent_channel_bindings;
+DROP FUNCTION IF EXISTS public.notify_channel_binding_changed();
+
+DROP TRIGGER IF EXISTS agents_changed_notify ON public.agents;
+DROP FUNCTION IF EXISTS public.notify_agent_changed();

package/dist/db/migrations/20260429120100_user_auth_profiles_and_model_prefs.sql

@@ -0,0 +1,36 @@
+-- migrate:up
+
+-- Phase 6: PG-backed storage for per-user runtime state previously held in Redis.
+--
+-- These tables replace Redis-keyed structures:
+--   user:auth-profiles:{userId}:{agentId}      → user_auth_profiles
+--   {providerId}:model_preference:{userId}     → user_model_preferences
+--
+-- The previous Redis layout kept the credential/refreshToken in the secret
+-- store and persisted only refs in the cached JSON; we keep that contract
+-- and store the same JSON document in `profiles` here.
+
+CREATE TABLE IF NOT EXISTS public.user_auth_profiles (
+  user_id text NOT NULL,
+  agent_id text NOT NULL,
+  profiles jsonb DEFAULT '[]'::jsonb NOT NULL,
+  updated_at timestamp with time zone DEFAULT now() NOT NULL,
+  PRIMARY KEY (user_id, agent_id)
+);
+
+CREATE INDEX IF NOT EXISTS user_auth_profiles_agent_id_idx
+  ON public.user_auth_profiles (agent_id);
+
+
+CREATE TABLE IF NOT EXISTS public.user_model_preferences (
+  user_id text NOT NULL,
+  provider_id text NOT NULL,
+  model text NOT NULL,
+  updated_at timestamp with time zone DEFAULT now() NOT NULL,
+  PRIMARY KEY (user_id, provider_id)
+);
+
+-- migrate:down
+
+DROP TABLE IF EXISTS public.user_model_preferences;
+DROP TABLE IF EXISTS public.user_auth_profiles;

package/dist/db/migrations/20260429120200_fix_notify_old_keys.sql

@@ -0,0 +1,130 @@
+-- migrate:up
+
+-- Phase 6 follow-up: emit BOTH the OLD and NEW cache keys when a row's key
+-- columns change in an UPDATE. The Phase-6 triggers only emitted the NEW
+-- key, so a process that had the OLD key cached would miss the invalidation
+-- and serve stale data until the TTL expired.
+
+-- Phase 6 follow-up: add a partial unique index that treats NULL team_id as
+-- a single equivalence class. Postgres unique constraints treat NULLs as
+-- distinct, so the existing UNIQUE (platform, channel_id, team_id) lets
+-- repeated upserts of (platform, channel_id, NULL) insert duplicate rows;
+-- the matching ON CONFLICT clause never fires and a subsequent getBinding()
+-- reads an arbitrary row.
+--
+-- Using a partial index lets the existing platform/channel_id/team_id
+-- constraint stay in place for the team_id-set rows; the new index covers
+-- the team_id-null branch.
+CREATE UNIQUE INDEX IF NOT EXISTS agent_channel_bindings_no_team_unique
+  ON public.agent_channel_bindings (platform, channel_id)
+  WHERE team_id IS NULL;
+
+
+CREATE OR REPLACE FUNCTION public.notify_channel_binding_changed()
+RETURNS trigger
+LANGUAGE plpgsql AS $$
+DECLARE
+  new_payload text;
+  old_payload text;
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    PERFORM pg_notify(
+      'channel_binding_changed',
+      format('%s:%s:%s', OLD.platform, COALESCE(OLD.team_id, '-'), OLD.channel_id)
+    );
+    RETURN OLD;
+  END IF;
+
+  new_payload := format(
+    '%s:%s:%s', NEW.platform, COALESCE(NEW.team_id, '-'), NEW.channel_id
+  );
+  PERFORM pg_notify('channel_binding_changed', new_payload);
+
+  IF TG_OP = 'UPDATE' THEN
+    old_payload := format(
+      '%s:%s:%s', OLD.platform, COALESCE(OLD.team_id, '-'), OLD.channel_id
+    );
+    IF old_payload <> new_payload THEN
+      PERFORM pg_notify('channel_binding_changed', old_payload);
+    END IF;
+  END IF;
+
+  RETURN NEW;
+END;
+$$;
+
+
+CREATE OR REPLACE FUNCTION public.notify_agent_users_changed()
+RETURNS trigger
+LANGUAGE plpgsql AS $$
+DECLARE
+  new_payload text;
+  old_payload text;
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    PERFORM pg_notify(
+      'agent_users_changed', format('%s:%s', OLD.platform, OLD.user_id)
+    );
+    RETURN OLD;
+  END IF;
+
+  new_payload := format('%s:%s', NEW.platform, NEW.user_id);
+  PERFORM pg_notify('agent_users_changed', new_payload);
+
+  IF TG_OP = 'UPDATE' THEN
+    old_payload := format('%s:%s', OLD.platform, OLD.user_id);
+    IF old_payload <> new_payload THEN
+      PERFORM pg_notify('agent_users_changed', old_payload);
+    END IF;
+  END IF;
+
+  RETURN NEW;
+END;
+$$;
+
+-- migrate:down
+
+DROP INDEX IF EXISTS public.agent_channel_bindings_no_team_unique;
+
+-- Restore the Phase-6 (pre-fix) function bodies, which only emitted the NEW key.
+CREATE OR REPLACE FUNCTION public.notify_channel_binding_changed()
+RETURNS trigger
+LANGUAGE plpgsql AS $$
+DECLARE
+  rec record;
+  payload text;
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    rec := OLD;
+  ELSE
+    rec := NEW;
+  END IF;
+  payload := format(
+    '%s:%s:%s',
+    rec.platform,
+    COALESCE(rec.team_id, '-'),
+    rec.channel_id
+  );
+  PERFORM pg_notify('channel_binding_changed', payload);
+  RETURN COALESCE(NEW, OLD);
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION public.notify_agent_users_changed()
+RETURNS trigger
+LANGUAGE plpgsql AS $$
+DECLARE
+  rec record;
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    rec := OLD;
+  ELSE
+    rec := NEW;
+  END IF;
+  PERFORM pg_notify(
+    'agent_users_changed',
+    format('%s:%s', rec.platform, rec.user_id)
+  );
+  RETURN COALESCE(NEW, OLD);
+END;
+$$;

package/dist/db/migrations/20260429130000_oauth_states_cli_sessions_rate_limits.sql

@@ -0,0 +1,83 @@
+-- migrate:up
+
+-- Phase 7 of Redis -> Postgres migration: replace the three remaining
+-- ephemeral-key Redis stores (OAuth state CSRF nonces, CLI auth sessions,
+-- and the fixed-window rate limiter) with thin Postgres tables. None of
+-- these need cross-process pub/sub or pipelining; they're cheap row-level
+-- reads/writes with a TTL column for lazy cleanup on read plus a periodic
+-- vacuum task.
+--
+-- Design notes:
+--   - All three tables key on a text id and store an explicit `expires_at`.
+--     Lazy reads filter `expires_at > now()`; a background sweeper deletes
+--     stale rows in bulk.
+--   - `payload` is jsonb so the OAuth state stores can keep their schema
+--     flexible (PKCE verifier, redirect URI, MCP discovery context, etc.)
+--     without churning migrations.
+--   - The rate_limits table is a single counter per (key, window_started_at)
+--     instead of one row per request — the existing Redis impl is a fixed
+--     window with INCR + EXPIRE, so a counter row matches the semantics
+--     exactly.
+
+-- OAuth state nonces: provider PKCE flows, MCP OAuth flow, Slack install,
+-- CLI browser/device handoff. `scope` mirrors the Redis key-prefix
+-- (e.g. `claude:oauth_state`, `mcp-oauth:state`, `slack:oauth:state`,
+-- `cli:auth:request`) so a single lookup tagged by scope+id replaces the
+-- previous prefix+id Redis lookup.
+CREATE TABLE IF NOT EXISTS public.oauth_states (
+    id text PRIMARY KEY,
+    scope text NOT NULL,
+    payload jsonb NOT NULL,
+    expires_at timestamptz NOT NULL,
+    created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS oauth_states_scope_idx
+    ON public.oauth_states (scope);
+
+CREATE INDEX IF NOT EXISTS oauth_states_expires_at_idx
+    ON public.oauth_states (expires_at);
+
+-- CLI auth sessions for the `lobu` CLI. Each row is a long-lived (30 day)
+-- refresh-token-anchored session; the access token is JWT-shaped and
+-- carries `sessionId` so verifyAccessToken can re-check the row exists
+-- and hasn't been revoked.
+CREATE TABLE IF NOT EXISTS public.cli_sessions (
+    session_id text PRIMARY KEY,
+    user_id text NOT NULL,
+    email text,
+    name text,
+    refresh_token_id text NOT NULL,
+    expires_at timestamptz NOT NULL,
+    created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS cli_sessions_user_id_idx
+    ON public.cli_sessions (user_id);
+
+CREATE INDEX IF NOT EXISTS cli_sessions_expires_at_idx
+    ON public.cli_sessions (expires_at);
+
+-- Fixed-window rate limit counters. One row per (key, window_started_at);
+-- a successful consume() does an UPSERT that increments `count`, sets the
+-- window if missing, and returns the new count. The window expires when
+-- `expires_at <= now()`.
+--
+-- `key` is the same string the Redis impl used (`rate-limit:cli:admin-login:<ip>`,
+-- etc) so callers don't have to translate.
+CREATE TABLE IF NOT EXISTS public.rate_limits (
+    key text PRIMARY KEY,
+    count integer NOT NULL DEFAULT 0,
+    window_started_at timestamptz NOT NULL,
+    expires_at timestamptz NOT NULL,
+    updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS rate_limits_expires_at_idx
+    ON public.rate_limits (expires_at);
+
+-- migrate:down
+
+DROP TABLE IF EXISTS public.rate_limits;
+DROP TABLE IF EXISTS public.cli_sessions;
+DROP TABLE IF EXISTS public.oauth_states;

package/dist/db/migrations/20260429140000_phase8_grants_chat_connections_mcp_sessions.sql

@@ -0,0 +1,84 @@
+-- migrate:up
+
+-- Phase 8 of Redis -> Postgres migration: replace the remaining Redis-only
+-- substrates that don't fit cleanly into the existing tables with proper
+-- typed Postgres tables.
+--
+-- 1. `grants` — per-(agent, kind, pattern) grant rows. Replaces the
+--    `grant:<agentId>:<pattern>` Redis key prefix and SCAN-by-prefix list.
+--    Wildcard expansion happens in the application layer.
+-- 2. `chat_connections` — chat-platform (Telegram/Slack/Discord/...) connection
+--    rows. Replaces the `connection:<id>`, `connections:all`, and
+--    `connections:agent:<id>` Redis keys used by ChatInstanceManager. The
+--    existing `public.connections` table is for Lobu product connectors,
+--    not chat platforms.
+-- 3. `mcp_proxy_sessions` — short-lived MCP server session-id mappings used
+--    by the MCP proxy. The existing `public.mcp_sessions` table is the
+--    inbound MCP-server-as-server session table; this is the outbound
+--    upstream-MCP session-id cache.
+
+-- ============================================================================
+-- grants
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS public.grants (
+    agent_id text NOT NULL REFERENCES public.agents(id) ON DELETE CASCADE,
+    kind text NOT NULL,
+    pattern text NOT NULL,
+    expires_at timestamptz,
+    granted_at timestamptz NOT NULL DEFAULT now(),
+    denied boolean NOT NULL DEFAULT false,
+    PRIMARY KEY (agent_id, kind, pattern)
+);
+
+CREATE INDEX IF NOT EXISTS grants_agent_id_idx
+    ON public.grants (agent_id);
+
+CREATE INDEX IF NOT EXISTS grants_expires_at_idx
+    ON public.grants (expires_at)
+    WHERE expires_at IS NOT NULL;
+
+-- ============================================================================
+-- chat_connections
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS public.chat_connections (
+    id text PRIMARY KEY,
+    platform text NOT NULL,
+    template_agent_id text REFERENCES public.agents(id) ON DELETE CASCADE,
+    config jsonb NOT NULL,
+    settings jsonb NOT NULL DEFAULT '{}'::jsonb,
+    metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+    status text NOT NULL DEFAULT 'active',
+    error_message text,
+    created_at timestamptz NOT NULL DEFAULT now(),
+    updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS chat_connections_template_agent_id_idx
+    ON public.chat_connections (template_agent_id)
+    WHERE template_agent_id IS NOT NULL;
+
+CREATE INDEX IF NOT EXISTS chat_connections_platform_idx
+    ON public.chat_connections (platform);
+
+-- ============================================================================
+-- mcp_proxy_sessions  (NOT to be confused with public.mcp_sessions which is
+--                      the inbound MCP server's session table)
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS public.mcp_proxy_sessions (
+    session_key text PRIMARY KEY,
+    upstream_session_id text NOT NULL,
+    expires_at timestamptz NOT NULL,
+    updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS mcp_proxy_sessions_expires_at_idx
+    ON public.mcp_proxy_sessions (expires_at);
+
+-- migrate:down
+
+DROP TABLE IF EXISTS public.mcp_proxy_sessions;
+DROP TABLE IF EXISTS public.chat_connections;
+DROP TABLE IF EXISTS public.grants;

package/dist/db/migrations/20260429140100_runs_priority_expires_at_retry_delay.sql

@@ -0,0 +1,44 @@
+-- migrate:up
+
+-- Phase 10 of Redis -> Postgres migration: honor the caller-supplied
+-- queue options (priority, expireInSeconds, retryDelay) that RunsQueue
+-- previously dropped on the floor.
+--
+-- 1. priority: int, default 0; claim ORDER BY priority DESC, run_at ASC, id ASC.
+-- 2. expires_at: row-level TTL. Claim filter excludes expired rows; the
+--    periodic cleanup task deletes them.
+-- 3. retry_delay_seconds: when set, scheduleRetry uses fixed-delay backoff
+--    instead of exponential. NULL falls back to the existing exponential
+--    cap-300s curve.
+
+ALTER TABLE public.runs
+    ADD COLUMN IF NOT EXISTS priority integer NOT NULL DEFAULT 0,
+    ADD COLUMN IF NOT EXISTS expires_at timestamptz,
+    ADD COLUMN IF NOT EXISTS retry_delay_seconds integer;
+
+-- Refresh the lobu-claim index so priority + run_at decide claim order.
+DROP INDEX IF EXISTS public.runs_lobu_claim_idx;
+
+CREATE INDEX IF NOT EXISTS runs_lobu_claim_idx
+    ON public.runs (run_type, queue_name, priority DESC, run_at ASC, id ASC)
+    WHERE status = 'pending'
+      AND run_type IN ('chat_message', 'schedule', 'agent_run', 'internal');
+
+CREATE INDEX IF NOT EXISTS runs_expires_at_idx
+    ON public.runs (expires_at)
+    WHERE expires_at IS NOT NULL;
+
+-- migrate:down
+
+DROP INDEX IF EXISTS public.runs_expires_at_idx;
+DROP INDEX IF EXISTS public.runs_lobu_claim_idx;
+
+CREATE INDEX IF NOT EXISTS runs_lobu_claim_idx
+    ON public.runs (run_type, queue_name, run_at)
+    WHERE status = 'pending'
+      AND run_type IN ('chat_message', 'schedule', 'agent_run', 'internal');
+
+ALTER TABLE public.runs
+    DROP COLUMN IF EXISTS retry_delay_seconds,
+    DROP COLUMN IF EXISTS expires_at,
+    DROP COLUMN IF EXISTS priority;

package/dist/db/migrations/20260429180000_drop_invalidatable_cache_triggers.sql

@@ -0,0 +1,25 @@
+-- migrate:up
+
+-- Drop the NOTIFY triggers + functions that powered the InvalidatableCache.
+-- The cache layer was removed: stores read-through to PG directly. Reads sit
+-- at ~7 SELECTs per chat dispatch — well within PG capacity at current scale.
+-- The runs-queue's pg_notify('runs_lobu:<queue>', ...) wakeup path is
+-- unaffected (different channel, different trigger).
+
+DROP TRIGGER IF EXISTS agent_users_changed_notify ON public.agent_users;
+DROP FUNCTION IF EXISTS public.notify_agent_users_changed();
+
+DROP TRIGGER IF EXISTS agent_channel_bindings_changed_notify ON public.agent_channel_bindings;
+DROP FUNCTION IF EXISTS public.notify_channel_binding_changed();
+
+DROP TRIGGER IF EXISTS agents_changed_notify ON public.agents;
+DROP FUNCTION IF EXISTS public.notify_agent_changed();
+
+-- migrate:down
+
+-- Restoration mirrors 20260429120000_agent_changed_notify.sql +
+-- 20260429120200_fix_notify_old_keys.sql; if you need to roll back, replay
+-- those by hand. We don't reproduce them here because the cache that consumed
+-- these channels no longer exists — a rollback to the old behavior requires
+-- restoring the cache code too.
+SELECT 1;

package/dist/db/migrations/20260430005614_agents_apply_fields.sql

@@ -0,0 +1,21 @@
+-- migrate:up
+
+-- Persist three agent settings fields that the file-loader produces from
+-- lobu.toml but the postgres-backed AgentConfigStore had nowhere to put:
+--   * egress_config       -> AgentSettings.egressConfig
+--   * pre_approved_tools  -> AgentSettings.preApprovedTools
+--   * guardrails          -> AgentSettings.guardrails
+-- Without these columns, `lobu apply` would silently drop the values on
+-- every push, producing perpetual drift between local and cloud.
+
+ALTER TABLE public.agents
+  ADD COLUMN egress_config jsonb DEFAULT '{}'::jsonb,
+  ADD COLUMN pre_approved_tools jsonb DEFAULT '[]'::jsonb,
+  ADD COLUMN guardrails jsonb DEFAULT '[]'::jsonb;
+
+-- migrate:down
+
+ALTER TABLE public.agents
+  DROP COLUMN egress_config,
+  DROP COLUMN pre_approved_tools,
+  DROP COLUMN guardrails;

package/dist/db/migrations/20260430022231_fix_connection_config_encryption.sql

@@ -0,0 +1,69 @@
+-- migrate:up
+
+-- Fix connection-config encryption asymmetry in agent_connections.config.
+--
+-- encryptConfig() in postgres-stores.ts historically returned raw
+-- "iv:tag:ciphertext" output from @lobu/core's `encrypt()`, but
+-- decryptConfig() only decrypts strings that start with "enc:v1:". So any
+-- secret-named field that hit encryptConfig was stored as prefixless
+-- ciphertext and round-tripped as that ciphertext literal on read.
+--
+-- This migration backfills existing prefixless rows by re-prefixing them so
+-- the now-aligned decryptConfig path can decrypt them.
+--
+-- Identification: AES-GCM in @lobu/core uses a 12-byte IV (24 hex chars)
+-- and a 16-byte auth tag (32 hex chars), joined with the ciphertext as
+-- `iv:tag:ciphertext`. We match exactly that shape to avoid touching
+-- arbitrary `:` separated values.
+--
+-- Idempotent: jsonb_object_agg only rewrites string values that match the
+-- prefixless shape AND lack the prefix. Re-running the migration is a noop.
+
+UPDATE public.agent_connections AS ac
+SET config = sub.fixed_config
+FROM (
+  SELECT
+    id,
+    jsonb_object_agg(
+      key,
+      CASE
+        WHEN jsonb_typeof(value) = 'string'
+             AND value #>> '{}' ~ '^[0-9a-f]{24}:[0-9a-f]{32}:[0-9a-f]+$'
+             AND value #>> '{}' NOT LIKE 'enc:v1:%'
+        THEN to_jsonb('enc:v1:' || (value #>> '{}'))
+        ELSE value
+      END
+    ) AS fixed_config
+  FROM public.agent_connections,
+       LATERAL jsonb_each(config)
+  GROUP BY id
+) AS sub
+WHERE ac.id = sub.id
+  AND ac.config IS DISTINCT FROM sub.fixed_config;
+
+-- migrate:down
+
+-- Strip the "enc:v1:" prefix to restore the prefixless ciphertext shape.
+-- Same regex: only touch strings whose remainder is `iv:tag:ciphertext`.
+
+UPDATE public.agent_connections AS ac
+SET config = sub.fixed_config
+FROM (
+  SELECT
+    id,
+    jsonb_object_agg(
+      key,
+      CASE
+        WHEN jsonb_typeof(value) = 'string'
+             AND value #>> '{}' LIKE 'enc:v1:%'
+             AND substring(value #>> '{}' FROM 8) ~ '^[0-9a-f]{24}:[0-9a-f]{32}:[0-9a-f]+$'
+        THEN to_jsonb(substring(value #>> '{}' FROM 8))
+        ELSE value
+      END
+    ) AS fixed_config
+  FROM public.agent_connections,
+       LATERAL jsonb_each(config)
+  GROUP BY id
+) AS sub
+WHERE ac.id = sub.id
+  AND ac.config IS DISTINCT FROM sub.fixed_config;

package/dist/db/migrations/20260430151215_add_task_run_type.sql

@@ -0,0 +1,77 @@
+-- migrate:up transaction:false
+
+-- Add 'task' to the runs_run_type_check + extend runs_lobu_claim_idx.
+--
+-- Background: the lobu-queue lanes (chat_message, schedule, agent_run,
+-- internal) are claimed in-process by the gateway's RunsQueue. The 'task'
+-- lane extends that pattern for platform-side periodic + lazy work
+-- (token refresh, classification reconciliation, embed backfill, watcher
+-- maintenance, etc.) that previously ran from a single setInterval-driven
+-- maintenance scheduler.
+--
+-- Lock-safety: this migration runs `transaction:false` so that
+-- CREATE INDEX CONCURRENTLY and VALIDATE CONSTRAINT release locks between
+-- statements. Without it, dbmate's per-migration transaction would force
+-- ACCESS EXCLUSIVE on the runs table for the duration of a constraint
+-- validation or index build — visible downtime for a hot queue table.
+SET lock_timeout = '5s';
+
+-- 1. Widen the run_type CHECK constraint without scanning the table.
+--    NOT VALID adds the catalog row under a brief ACCESS EXCLUSIVE.
+--    VALIDATE takes only SHARE UPDATE EXCLUSIVE so concurrent reads/writes
+--    are unaffected. Idempotent: re-runs safely if a prior run died midway.
+DO $$
+BEGIN
+    IF NOT EXISTS (
+        SELECT 1
+          FROM pg_constraint
+         WHERE conrelid = 'public.runs'::regclass
+           AND conname = 'runs_run_type_check_v2'
+    ) THEN
+        ALTER TABLE public.runs
+            ADD CONSTRAINT runs_run_type_check_v2 CHECK (run_type = ANY (ARRAY[
+                'sync'::text,
+                'action'::text,
+                'embed_backfill'::text,
+                'watcher'::text,
+                'auth'::text,
+                'chat_message'::text,
+                'schedule'::text,
+                'agent_run'::text,
+                'internal'::text,
+                'task'::text
+            ])) NOT VALID;
+    END IF;
+END$$;
+
+ALTER TABLE public.runs VALIDATE CONSTRAINT runs_run_type_check_v2;
+
+ALTER TABLE public.runs DROP CONSTRAINT IF EXISTS runs_run_type_check;
+ALTER TABLE public.runs RENAME CONSTRAINT runs_run_type_check_v2 TO runs_run_type_check;
+
+-- 2. Replace the lobu claim index. Originally written with CONCURRENTLY,
+--    but dbmate's transaction wrapper still presents these to PG as
+--    in-transaction even with `transaction:false`, which breaks
+--    CREATE/DROP INDEX CONCURRENTLY (see comments in
+--    20260426130001_db_integrity_cleanup_concurrent.sql for the same
+--    workaround). The partial index only covers `status = 'pending'`
+--    rows in the lobu lanes — typically a small set since pending rows
+--    are claimed within milliseconds — so the ACCESS EXCLUSIVE held
+--    during the non-concurrent build is sub-second in practice.
+DROP INDEX IF EXISTS public.runs_lobu_claim_idx;
+
+CREATE INDEX runs_lobu_claim_idx
+    ON public.runs (run_type, queue_name, priority DESC, run_at ASC, id ASC)
+    WHERE status = 'pending'
+      AND run_type IN ('chat_message', 'schedule', 'agent_run', 'internal', 'task');
+
+-- migrate:down
+
+-- This migration is forward-only.
+--
+-- Reverting would require either deleting all rows with run_type='task'
+-- (data loss — both pending tasks and historical run records) or leaving
+-- the constraint widened (the failure mode the up migration was avoiding).
+-- Neither is safe to do automatically. If you genuinely need to revert,
+-- write a follow-up migration that explicitly handles the data first.
+SELECT 1;