@lobu/cli 6.0.1 → 7.0.0

package/dist/db/migrations/20260513150000_auth_profiles_cdp_url.sql

@@ -0,0 +1,43 @@
+-- migrate:up
+
+-- Add `cdp_url` to auth_profiles. For a device-bound `browser_session`
+-- profile, exactly one of {user_data_dir, cdp_url} should be set:
+--   user_data_dir  → managed Chrome with isolated cookies (default)
+--   cdp_url        → attach to a running Chrome via remote-debugging-port
+-- The application enforces this invariant; we don't add a CHECK constraint
+-- because the OR-on-NULL semantics are awkward to express and the column
+-- is harmless when both are NULL (legacy fleet path with cookies in
+-- auth_data jsonb).
+
+ALTER TABLE public.auth_profiles
+    ADD COLUMN IF NOT EXISTS cdp_url text;
+
+-- A device-bound browser_session profile MUST set exactly one of
+-- (user_data_dir, cdp_url). Other profile kinds — and non-device-bound
+-- browser_session profiles (cookies in auth_data, fleet-served) — are
+-- exempt. Enforcing this at the DB stops a buggy admin tool or a bad
+-- merge from setting both and then having the connector silently prefer
+-- whichever code path it sees first.
+DO $$
+BEGIN
+    IF NOT EXISTS (
+        SELECT 1 FROM pg_constraint WHERE conname = 'auth_profiles_device_browser_path_xor'
+    ) THEN
+        ALTER TABLE public.auth_profiles
+            ADD CONSTRAINT auth_profiles_device_browser_path_xor
+            CHECK (
+                device_worker_id IS NULL
+                OR profile_kind <> 'browser_session'
+                OR (
+                    (user_data_dir IS NOT NULL AND cdp_url IS NULL)
+                    OR (user_data_dir IS NULL AND cdp_url IS NOT NULL)
+                )
+            );
+    END IF;
+END$$;
+
+-- migrate:down
+
+ALTER TABLE public.auth_profiles
+    DROP CONSTRAINT IF EXISTS auth_profiles_device_browser_path_xor,
+    DROP COLUMN IF EXISTS cdp_url;

package/dist/db/migrations/20260513200000_notifications_as_events.sql

@@ -0,0 +1,86 @@
+-- migrate:up
+
+-- Unify notifications with events.
+--
+-- A notification was a (org, user, title, body, type, resource_url) row in
+-- its own table with per-user `is_read`. Conceptually it's an event with a
+-- particular kind + per-user delivery / read-state. This migration turns
+-- every notification into:
+--   1. an event with semantic_type='notification' (org-wide visibility in
+--      the events stream — searchable, addressable, links into knowledge);
+--   2. a notification_targets row (event_id, user_id, delivered_at, read_at)
+--      so the inbox still scopes to the targeted user.
+--
+-- After this, "send to admins" inserts one event + N targets; "mark read"
+-- updates a target row; "unread count" counts target rows without read_at.
+-- Search across events naturally includes notifications, but a user's
+-- inbox is still private to them.
+
+CREATE TABLE public.notification_targets (
+    event_id bigint NOT NULL REFERENCES public.events(id) ON DELETE CASCADE,
+    user_id text NOT NULL,
+    delivered_at timestamp with time zone NOT NULL DEFAULT now(),
+    read_at timestamp with time zone,
+    PRIMARY KEY (event_id, user_id)
+);
+
+-- Fast inbox lookups: list a user's unread notifications, newest first.
+CREATE INDEX idx_notification_targets_user_unread
+    ON public.notification_targets (user_id, delivered_at DESC)
+    WHERE read_at IS NULL;
+
+-- All of a user's notifications, newest first (for read-list pagination).
+CREATE INDEX idx_notification_targets_user_all
+    ON public.notification_targets (user_id, delivered_at DESC);
+
+-- Backfill existing notifications. We keep 1:1 row mapping (one event per
+-- legacy notification) for safety — at scale the right model is "one event,
+-- many targets" but the old schema didn't capture that and we can't
+-- retroactively coalesce without an oracle.
+WITH legacy AS (
+    SELECT id, organization_id, user_id, type, title, body,
+           resource_type, resource_id, resource_url, is_read, created_at
+    FROM public.notifications
+    ORDER BY id ASC
+),
+inserted AS (
+    INSERT INTO public.events
+        (organization_id, title, payload_text, payload_type, semantic_type,
+         occurred_at, created_at, metadata, origin_id)
+    SELECT
+        l.organization_id,
+        l.title,
+        l.body,
+        'text',
+        'notification',
+        l.created_at,
+        l.created_at,
+        jsonb_build_object(
+            'notification_type', l.type,
+            'resource_type', l.resource_type,
+            'resource_id', l.resource_id,
+            'resource_url', l.resource_url,
+            'legacy_notification_id', l.id
+        ),
+        'notification:legacy:' || l.id::text
+    FROM legacy l
+    RETURNING id AS event_id, (metadata->>'legacy_notification_id')::bigint AS legacy_id
+)
+INSERT INTO public.notification_targets (event_id, user_id, delivered_at, read_at)
+SELECT
+    i.event_id,
+    l.user_id,
+    l.created_at,
+    CASE WHEN l.is_read THEN l.created_at ELSE NULL END
+FROM inserted i
+JOIN public.notifications l ON l.id = i.legacy_id;
+
+-- Drop the legacy table. All readers/writers go through the new service.
+DROP TABLE public.notifications;
+
+-- migrate:down
+
+-- One-way migration. Recovery is from backup; events created here stay
+-- (deleting them would also wipe their notification_targets via CASCADE).
+-- If you really need to roll back: re-create the table, copy notifications
+-- back out of events + notification_targets, drop the event rows.

package/dist/db/migrations/20260514000000_scheduled_jobs.sql

@@ -0,0 +1,97 @@
+-- migrate:up
+
+-- User-driven scheduled jobs.
+--
+-- Why a separate table:
+--   * `runs` already holds *fired* / *pending-to-fire* rows via
+--     scheduler.spawn(). Each scheduled_jobs row is the *definition* of a
+--     recurring (or one-shot) schedule — its source of truth.
+--   * The ticker (`scheduled-jobs-tick`) scans this table on cron, spawns
+--     a runs row per firing via TaskScheduler.spawn, and advances
+--     next_run_at from `cron`. If the tick or a firing fails, the next
+--     tick re-reads the same row (next_run_at didn't move forward) and
+--     retries. Self-healing.
+--   * Attribution lives here: who scheduled it (user or agent), what run
+--     was the trigger, what event was the trigger. Lets "why did the
+--     system act?" become a single JOIN.
+--   * Cascade-on-delete: when an agent is deleted, all its schedules
+--     evaporate via the FK — no orphan wake-ups firing into the void.
+
+CREATE TABLE public.scheduled_jobs (
+    id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    organization_id text NOT NULL REFERENCES public.organization(id) ON DELETE CASCADE,
+
+    -- What fires
+    action_type text NOT NULL,        -- 'send_notification' | 'wake_agent' | ...
+    action_args jsonb NOT NULL,       -- handler payload
+    cron text,                        -- null = one-shot; cron string = recurring
+    next_run_at timestamp with time zone NOT NULL,
+    last_fired_at timestamp with time zone,
+    last_fired_run_id bigint,         -- the runs.id from the most recent firing
+    paused boolean NOT NULL DEFAULT false,
+
+    description text NOT NULL,        -- human summary for the UI / audit
+
+    -- Attribution
+    created_by_user text,             -- user that scheduled it (null when agent did)
+    created_by_agent text,            -- agent that scheduled it (null when user did)
+    source_run_id bigint,             -- runs.id that originated the scheduling, if any
+    source_event_id bigint,           -- events.id that originated, if any
+    source_thread_id text,            -- chat-thread context, if any
+
+    created_at timestamp with time zone NOT NULL DEFAULT now(),
+    updated_at timestamp with time zone NOT NULL DEFAULT now(),
+
+    CONSTRAINT scheduled_jobs_attribution_check CHECK (
+        created_by_user IS NOT NULL OR created_by_agent IS NOT NULL
+    )
+);
+
+-- Cascade: dropping an agent kills its scheduled jobs (so an agent's
+-- wake-ups don't outlive the agent itself). Conditional so the migration
+-- works on installs where the agents table doesn't exist yet (very
+-- old) — every row already has organization_id which is the harder constraint.
+DO $$
+BEGIN
+    IF EXISTS (SELECT 1 FROM pg_class WHERE relname = 'agents' AND relkind = 'r') THEN
+        ALTER TABLE public.scheduled_jobs
+            ADD CONSTRAINT scheduled_jobs_agent_fkey
+            FOREIGN KEY (created_by_agent) REFERENCES public.agents(id) ON DELETE CASCADE;
+    END IF;
+END$$;
+
+DO $$
+BEGIN
+    IF EXISTS (SELECT 1 FROM pg_class WHERE relname = 'runs' AND relkind = 'r') THEN
+        ALTER TABLE public.scheduled_jobs
+            ADD CONSTRAINT scheduled_jobs_source_run_fkey
+            FOREIGN KEY (source_run_id) REFERENCES public.runs(id) ON DELETE SET NULL;
+    END IF;
+END$$;
+
+DO $$
+BEGIN
+    IF EXISTS (SELECT 1 FROM pg_class WHERE relname = 'events' AND relkind = 'r') THEN
+        ALTER TABLE public.scheduled_jobs
+            ADD CONSTRAINT scheduled_jobs_source_event_fkey
+            FOREIGN KEY (source_event_id) REFERENCES public.events(id) ON DELETE SET NULL;
+    END IF;
+END$$;
+
+-- Index: the ticker's hot read.
+CREATE INDEX idx_scheduled_jobs_due
+    ON public.scheduled_jobs (next_run_at)
+    WHERE NOT paused;
+
+-- Index: list per-agent / per-user.
+CREATE INDEX idx_scheduled_jobs_org_agent
+    ON public.scheduled_jobs (organization_id, created_by_agent)
+    WHERE created_by_agent IS NOT NULL;
+
+CREATE INDEX idx_scheduled_jobs_org_user
+    ON public.scheduled_jobs (organization_id, created_by_user)
+    WHERE created_by_user IS NOT NULL;
+
+-- migrate:down
+
+DROP TABLE IF EXISTS public.scheduled_jobs;

package/dist/db/migrations/20260514120000_auth_profiles_connector_key_nullable.sql

@@ -0,0 +1,42 @@
+-- migrate:up
+
+-- Drop the NOT NULL on auth_profiles.connector_key so browser_session
+-- profiles can be device-bound resources without a connector binding.
+--
+-- A browser_session profile is physically (device, browser_kind, user_data_dir
+-- XOR cdp_url) — the connector_key was always a hint, not a gate. One CDP
+-- attach on a Mac already has cookies for every site the user is logged into;
+-- forcing one row per connector against the same cdp_url was bookkeeping for
+-- the DB's benefit, not the user's. Connection resolution falls back to
+-- "browser_session on the connection's device_worker_id" when no exact
+-- connector match exists.
+--
+-- Other profile kinds (env, oauth_app, oauth_account, interactive) remain
+-- per-connector; the new check constraint keeps them honest.
+
+ALTER TABLE public.auth_profiles
+    ALTER COLUMN connector_key DROP NOT NULL;
+
+DO $$
+BEGIN
+    IF NOT EXISTS (
+        SELECT 1 FROM pg_constraint WHERE conname = 'auth_profiles_connector_key_required'
+    ) THEN
+        ALTER TABLE public.auth_profiles
+            ADD CONSTRAINT auth_profiles_connector_key_required
+            CHECK (
+                connector_key IS NOT NULL
+                OR profile_kind = 'browser_session'
+            );
+    END IF;
+END$$;
+
+-- migrate:down
+
+ALTER TABLE public.auth_profiles
+    DROP CONSTRAINT IF EXISTS auth_profiles_connector_key_required;
+
+-- Restoring NOT NULL would fail if any browser_session rows now have
+-- connector_key = NULL. Backfill with a placeholder before running this.
+ALTER TABLE public.auth_profiles
+    ALTER COLUMN connector_key SET NOT NULL;

package/dist/eval/types.d.ts

@@ -84,6 +84,8 @@ export interface EvalResult {
     p50LatencyMs: number;
     totalTokens: TokenUsage;
     trials: TrialResult[];
+    /** Set when the eval crashed before producing trials — counts as a failure. */
+    error?: string;
 }
 export interface EvalReport {
     agent: string;

package/dist/eval/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/eval/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,QAAA,MAAM,eAAe;;;;;;;;;;;iBAUnB,CAAC;AAOH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;iBAc/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAIxD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,UAAU,CAAC;IACxB,MAAM,EAAE,WAAW,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/eval/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,QAAA,MAAM,eAAe;;;;;;;;;;;iBAUnB,CAAC;AAOH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;iBAc/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAIxD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,UAAU,CAAC;IACxB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB"}

package/dist/index.d.ts

@@ -1,2 +1,13 @@
+/**
+ * Options shared by most cloud subcommands. `--context` is always present;
+ * `--org` / `--json` are opt-in. Descriptions here are the canonical ones —
+ * commands needing a different wording (e.g. "Org slug override (defaults to
+ * [memory].org)") keep their own explicit `.option(...)` call.
+ */
+export interface CommonActionOpts {
+    context?: string;
+    org?: string;
+    json?: boolean;
+}
 export declare function runCli(argv?: readonly string[]): Promise<void>;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA8BA,wBAAsB,MAAM,CAC1B,IAAI,GAAE,SAAS,MAAM,EAAiB,GACrC,OAAO,CAAC,IAAI,CAAC,CA2qBf"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiBA;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAyBD,wBAAsB,MAAM,CAC1B,IAAI,GAAE,SAAS,MAAM,EAAiB,GACrC,OAAO,CAAC,IAAI,CAAC,CAu4Bf"}