@wardby/cli 0.1.0 → 0.2.1

package/dist/coding/protocol.js

@@ -6,6 +6,14 @@ export const MAX_CODING_SUMMARY_BYTES = 8 * 1024;
 export const MAX_CODING_TESTS = 64;
 export const MAX_CODING_TEST_COMMAND_BYTES = 2 * 1024;
 export const MAX_TAG_BYTES = 32;
+/**
+ * A worker's output-schema failure, reduced to where and how it failed, never
+ * what the model wrote: `<path>:<zod issue code>`, where the path is dot-joined
+ * schema keys and array indices (`$` for the root). Unrecognized keys the model
+ * invented are carried only as the `unrecognized_keys` code, never by name.
+ */
+export const MAX_CODING_OUTPUT_ISSUES = 8;
+export const SAFE_CODING_OUTPUT_ISSUE = /^(?:\$|[a-z][A-Za-z]{0,31}(?:\.(?:[a-z][A-Za-z]{0,31}|\d{1,3})){0,7}):[a-z_]{1,32}$/;
 const MAX_REPOSITORY_INPUT_BYTES = 512;
 const MAX_REF_BYTES = 255;
 const MAX_MODEL_BYTES = 128;
@@ -108,6 +116,24 @@ const repositorySchema = z
     .transform(normalizeGitHubRepository);
 export const CodingBaseRefSchema = z.string().refine(isGitRef, "must be a safe branch ref").transform(normalizeGitRef);
 export const CodingTaskOverrideSchema = boundedText(MAX_CODING_TASK_BYTES);
+/**
+ * A coding worker receives only its task text, so a coding agent's own
+ * instructions (its systemPrompt) travel inside that text, ahead of the
+ * request. Blank instructions leave the task unchanged. The combination must
+ * still fit MAX_CODING_TASK_BYTES; exceeding it is an error naming both parts
+ * rather than a silent truncation of either.
+ */
+export function composeCodingTask(instructions, task) {
+    const standing = instructions?.trim();
+    if (!standing)
+        return task;
+    const composed = `Standing instructions for this coding agent:\n${standing}\n\nRequest:\n${task}`;
+    if (byteLength(composed) > MAX_CODING_TASK_BYTES) {
+        throw new Error(`The coding agent's instructions (${byteLength(standing)} bytes) plus this task (${byteLength(task)} bytes) ` +
+            `exceed the ${MAX_CODING_TASK_BYTES}-byte coding task limit; shorten one of them.`);
+    }
+    return composed;
+}
 const runIdSchema = boundedText(MAX_RUN_ID_BYTES, true).refine((value) => /^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(value), "must be an opaque identifier");
 const modelSchema = boundedText(MAX_MODEL_BYTES, true).refine((value) => /^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(value), "must be a model identifier");
 const usageSchema = z
@@ -117,6 +143,30 @@ const usageSchema = z
     costUsd: z.number().finite().nonnegative().max(MAX_COST_USD),
 })
     .strict();
+const SAFE_TAG = new RegExp(`^[A-Za-z0-9][A-Za-z0-9._/-]{0,${MAX_TAG_BYTES - 1}}$`);
+/**
+ * The tag only labels a pull request title, so a model's malformed tag must not
+ * sink an otherwise finished run. A tag that already passes is kept as-is; any
+ * other string becomes a lowercase slug (runs of disallowed characters to "-",
+ * no leading or trailing punctuation, at most MAX_TAG_BYTES), and one with
+ * nothing usable left, or a non-string, becomes null. GitHub finalization still
+ * re-validates whatever survives.
+ */
+export function normalizeCodingTag(value) {
+    if (value === undefined || value === null)
+        return value;
+    if (typeof value !== "string")
+        return null;
+    if (SAFE_TAG.test(value))
+        return value;
+    const slug = value
+        .toLowerCase()
+        .replace(/[^a-z0-9._/-]+/g, "-")
+        .replace(/^[^a-z0-9]+/, "")
+        .slice(0, MAX_TAG_BYTES)
+        .replace(/[^a-z0-9]+$/, "");
+    return SAFE_TAG.test(slug) ? slug : null;
+}
 /**
  * A short, caller-visible reference (e.g. a ticket ID) surfaced in the PR title. Never free text.
  * Accepts null as well as undefined: OpenAI's strict Structured Outputs mode requires every
@@ -126,7 +176,7 @@ const usageSchema = z
  */
 const tagSchema = z
     .string()
-    .regex(new RegExp(`^[A-Za-z0-9][A-Za-z0-9._/-]{0,${MAX_TAG_BYTES - 1}}$`), "must be a short, safe tag")
+    .regex(SAFE_TAG, "must be a short, safe tag")
     .nullable()
     .optional()
     .transform((value) => value ?? undefined);
@@ -175,7 +225,8 @@ export const CodingAgentOutputSchema = z
     outcome: z.enum(["changes_ready", "no_changes", "budget_exhausted"]),
     summary: boundedText(MAX_CODING_SUMMARY_BYTES),
     tests: z.array(testResultSchema).max(MAX_CODING_TESTS),
-    tag: tagSchema,
+    // Model-written, so normalized rather than rejected; see normalizeCodingTag.
+    tag: z.preprocess(normalizeCodingTag, tagSchema),
 })
     .strict()
     .transform((value) => ({

package/dist/coding-worker/artifact.d.ts

@@ -1,4 +1,16 @@
 import { type CodingAgentOutput } from "../coding/protocol.js";
+/**
+ * Reads a regular file of at most `maxBytes`, refusing symlinks and anything
+ * that is not a regular file.
+ *
+ * Every check runs against the open handle, never against the path before
+ * opening it: an lstat followed by a read of the same path leaves a window in
+ * which the file can be swapped for a symlink or a larger file. O_NOFOLLOW
+ * refuses a symlink at open time, O_NONBLOCK keeps a FIFO from hanging the
+ * open, and fstat on the descriptor checks what was actually opened. The lstat
+ * afterwards covers platforms without O_NOFOLLOW: it must be the same inode.
+ */
+export declare function readBoundedRegularFile(path: string, maxBytes: number, errorCode: string): Promise<string>;
 export declare function readCodingInput(path: string): Promise<{
     repository: string;
     schemaVersion: 1;

package/dist/coding-worker/artifact.js

@@ -1,12 +1,54 @@
-import { lstat, mkdir, open, readFile, rename, unlink } from "node:fs/promises";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, rename, unlink } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { MAX_CODING_ARTIFACT_BYTES, parseCodingTaskInputJson } from "../coding/protocol.js";
-export async function readCodingInput(path) {
-    const metadata = await lstat(path);
-    if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > MAX_CODING_ARTIFACT_BYTES) {
-        throw new Error("coding_input_invalid_file");
+/**
+ * Reads a regular file of at most `maxBytes`, refusing symlinks and anything
+ * that is not a regular file.
+ *
+ * Every check runs against the open handle, never against the path before
+ * opening it: an lstat followed by a read of the same path leaves a window in
+ * which the file can be swapped for a symlink or a larger file. O_NOFOLLOW
+ * refuses a symlink at open time, O_NONBLOCK keeps a FIFO from hanging the
+ * open, and fstat on the descriptor checks what was actually opened. The lstat
+ * afterwards covers platforms without O_NOFOLLOW: it must be the same inode.
+ */
+export async function readBoundedRegularFile(path, maxBytes, errorCode) {
+    let file;
+    try {
+        file = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+    }
+    catch (error) {
+        // ELOOP: the path is a symlink.
+        if (error.code === "ELOOP")
+            throw new Error(errorCode, { cause: error });
+        throw error;
+    }
+    try {
+        const metadata = await file.stat();
+        if (!metadata.isFile() || metadata.size > maxBytes)
+            throw new Error(errorCode);
+        const link = await lstat(path);
+        if (link.isSymbolicLink() || link.ino !== metadata.ino || link.dev !== metadata.dev)
+            throw new Error(errorCode);
+        const buffer = Buffer.alloc(maxBytes + 1);
+        let length = 0;
+        while (length < buffer.length) {
+            const { bytesRead } = await file.read(buffer, length, buffer.length - length, length);
+            if (bytesRead === 0)
+                break;
+            length += bytesRead;
+        }
+        if (length > maxBytes)
+            throw new Error(errorCode);
+        return buffer.subarray(0, length).toString("utf8");
+    }
+    finally {
+        await file.close();
     }
-    return parseCodingTaskInputJson(await readFile(path, "utf8"));
+}
+export async function readCodingInput(path) {
+    return parseCodingTaskInputJson(await readBoundedRegularFile(path, MAX_CODING_ARTIFACT_BYTES, "coding_input_invalid_file"));
 }
 export async function writeCodingOutputAtomic(path, output) {
     const directory = dirname(path);

package/dist/coding-worker/driver.d.ts

@@ -20,6 +20,7 @@ export declare const CODING_OUTPUT_JSON_SCHEMA: {
         };
         readonly tag: {
             readonly type: readonly ["string", "null"];
+            readonly description: "Optional short label shown in the pull request title, such as a ticket id. At most 32 characters: letters, digits, '.', '_', '/', '-', starting with a letter or digit, with no spaces. Example: \"add-jokes\". Use null when there is no natural label.";
         };
         readonly tests: {
             readonly type: "array";

package/dist/coding-worker/driver.js

@@ -20,7 +20,10 @@ export const CODING_OUTPUT_JSON_SCHEMA = {
         runId: { type: "string" },
         outcome: { type: "string", enum: ["changes_ready", "no_changes", "budget_exhausted"] },
         summary: { type: "string" },
-        tag: { type: ["string", "null"] },
+        tag: {
+            type: ["string", "null"],
+            description: "Optional short label shown in the pull request title, such as a ticket id. At most 32 characters: letters, digits, '.', '_', '/', '-', starting with a letter or digit, with no spaces. Example: \"add-jokes\". Use null when there is no natural label.",
+        },
         tests: {
             type: "array",
             maxItems: 64,

package/dist/coding-worker/errors.d.ts

@@ -1 +1,8 @@
+/**
+ * For `coding_output_invalid`, where the model's final answer failed the output
+ * schema: the failing schema paths and issue codes, so the operator log can say
+ * which field was wrong without ever carrying the value. Undefined when the
+ * cause is not a schema failure.
+ */
+export declare function safeOutputIssues(error: unknown): string[] | undefined;
 export declare function safeWorkerErrorCode(error: unknown): string;

package/dist/coding-worker/errors.js

@@ -1,3 +1,5 @@
+import { ZodError } from "zod";
+import { MAX_CODING_OUTPUT_ISSUES, SAFE_CODING_OUTPUT_ISSUE } from "../coding/protocol.js";
 const SAFE_WORKER_ERROR_CODES = new Set([
     "wardby_proxy_url_missing",
     "wardby_run_capability_missing",
@@ -13,6 +15,22 @@ const SAFE_WORKER_ERROR_CODES = new Set([
     "coding_output_invalid",
     "coding_output_run_mismatch",
 ]);
+/**
+ * For `coding_output_invalid`, where the model's final answer failed the output
+ * schema: the failing schema paths and issue codes, so the operator log can say
+ * which field was wrong without ever carrying the value. Undefined when the
+ * cause is not a schema failure.
+ */
+export function safeOutputIssues(error) {
+    const cause = error instanceof Error ? error.cause : undefined;
+    if (!(cause instanceof ZodError))
+        return undefined;
+    const issues = cause.issues
+        .map((issue) => `${issue.path.length === 0 ? "$" : issue.path.join(".")}:${issue.code}`)
+        .filter((issue) => SAFE_CODING_OUTPUT_ISSUE.test(issue))
+        .slice(0, MAX_CODING_OUTPUT_ISSUES);
+    return issues.length > 0 ? issues : undefined;
+}
 export function safeWorkerErrorCode(error) {
     if (!(error instanceof Error))
         return "worker_failed";

package/dist/coding-worker/main.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { readCodingInput, writeCodingOutputAtomic } from "./artifact.js";
 import { runCodingWorker } from "./driver.js";
-import { safeWorkerErrorCode } from "./errors.js";
+import { safeOutputIssues, safeWorkerErrorCode } from "./errors.js";
 import { createCodexSdkClient } from "./sdk.js";
 const INPUT_PATH = "/run/wardby/input/input.json";
 const OUTPUT_PATH = "/run/wardby/output/result.json";
@@ -38,6 +38,7 @@ catch (error) {
         : safeCode === "worker_failed"
             ? `worker_${stage}_failed`
             : safeCode;
-    process.stderr.write(`${JSON.stringify({ error: code })}\n`);
+    const issues = code === "coding_output_invalid" ? safeOutputIssues(error) : undefined;
+    process.stderr.write(`${JSON.stringify({ error: code, ...(issues ? { issues } : {}) })}\n`);
     process.exitCode = controller.signal.aborted ? 143 : 1;
 }

package/dist/core/budget-groups.d.ts

@@ -12,7 +12,7 @@
  * budget of 0, which the engine's turn-1 gate already refuses exactly
  * like any other zero/negative budget.
  */
-import type { Agent, BudgetGroup, PrismaClient } from "@prisma/client";
+import type { Agent, BudgetGroup, PrismaClient } from "#prisma";
 export type Period = "day" | "week" | "month";
 export type BudgetGroupsDb = Pick<PrismaClient, "budgetGroup" | "run" | "agent">;
 /**

package/dist/core/coding-queue.d.ts

@@ -14,7 +14,7 @@
  * Called on the scheduler leader's tick and immediately in any process
  * whose coding run just finished (ContainerExecutor onSlotReleased).
  */
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import type { Executor } from "../providers/executor/types.js";
 export declare const CODING_QUEUE_TIMEOUT_ERROR = "coding_queue_timeout";
 export type CodingQueueDb = Pick<PrismaClient, "run" | "codingRun" | "$transaction">;

package/dist/core/datastores.d.ts

@@ -4,7 +4,7 @@
  * by a per-attachment `boundName` (sharedDatastore.get(boundName, key)) —
  * same boundName convention as AgentSecret.
  */
-import type { PrismaClient, Datastore as DatastoreRow } from "@prisma/client";
+import type { PrismaClient, Datastore as DatastoreRow } from "#prisma";
 import type { Datastore, DatastoreSetOptions, DatastoreValue } from "../providers/datastore/types.js";
 export type DatastoreMetadata = Pick<DatastoreRow, "id" | "name" | "ownerId" | "createdAt" | "updatedAt">;
 export interface SharedDatastoreAccessor {

package/dist/core/db.d.ts

@@ -1,2 +1,36 @@
-import { PrismaClient } from "@prisma/client";
-export declare const prisma: PrismaClient<import("@prisma/client").Prisma.PrismaClientOptions, never, import("@prisma/client/runtime/library").DefaultArgs>;
+import { PrismaClient } from "#prisma";
+/**
+ * Connection-pool sizing for the node-postgres pool behind @prisma/adapter-pg.
+ *
+ * Prisma 6's query engine owned the pool: `connection_limit` defaulted to
+ * cpus * 2 + 1 and a caller waited at most `pool_timeout` = 10 s for a free
+ * connection (then P2024). Prisma 7 hands the pool to `pg`, whose defaults are
+ * max = 10 and connectionTimeoutMillis = 0 — wait for a connection *forever*,
+ * so a saturated pool would hang requests instead of failing them. Both values
+ * are therefore set explicitly, to Prisma 6's defaults:
+ *
+ * - max: availableParallelism() * 2 + 1 (Prisma 6 counted physical cores; the
+ *   logical count is the closest portable Node equivalent).
+ * - connectionTimeoutMillis: 10 000 (Prisma 6's pool_timeout). A timeout now
+ *   surfaces as a pg "timeout exceeded when trying to connect" error, not P2024.
+ *
+ * `pg` ignores Prisma's own URL parameters, so the two that tuned these same
+ * knobs (`connection_limit`, `pool_timeout` in seconds) are still honoured here
+ * for URLs that set them. idleTimeoutMillis stays at pg's 10 s default.
+ *
+ * TLS is whatever the URL asks for (`sslmode`, `sslrootcert`, ...); certificate
+ * validation is never disabled here.
+ */
+export declare const DEFAULT_POOL_TIMEOUT_MS = 10000;
+export declare function defaultPoolMax(): number;
+export interface PoolSettings {
+    max: number;
+    connectionTimeoutMillis: number;
+}
+export declare function poolSettings(connectionString: string): PoolSettings;
+/**
+ * The one way wardby builds a Prisma client. `url` defaults to DATABASE_URL
+ * as read at call time.
+ */
+export declare function createPrismaClient(url?: string | undefined): PrismaClient;
+export declare const prisma: PrismaClient;

package/dist/core/db.js

@@ -1,2 +1,69 @@
-import { PrismaClient } from "@prisma/client";
-export const prisma = new PrismaClient();
+import { availableParallelism } from "node:os";
+import { PrismaPg } from "@prisma/adapter-pg";
+import { PrismaClient } from "#prisma";
+/**
+ * Connection-pool sizing for the node-postgres pool behind @prisma/adapter-pg.
+ *
+ * Prisma 6's query engine owned the pool: `connection_limit` defaulted to
+ * cpus * 2 + 1 and a caller waited at most `pool_timeout` = 10 s for a free
+ * connection (then P2024). Prisma 7 hands the pool to `pg`, whose defaults are
+ * max = 10 and connectionTimeoutMillis = 0 — wait for a connection *forever*,
+ * so a saturated pool would hang requests instead of failing them. Both values
+ * are therefore set explicitly, to Prisma 6's defaults:
+ *
+ * - max: availableParallelism() * 2 + 1 (Prisma 6 counted physical cores; the
+ *   logical count is the closest portable Node equivalent).
+ * - connectionTimeoutMillis: 10 000 (Prisma 6's pool_timeout). A timeout now
+ *   surfaces as a pg "timeout exceeded when trying to connect" error, not P2024.
+ *
+ * `pg` ignores Prisma's own URL parameters, so the two that tuned these same
+ * knobs (`connection_limit`, `pool_timeout` in seconds) are still honoured here
+ * for URLs that set them. idleTimeoutMillis stays at pg's 10 s default.
+ *
+ * TLS is whatever the URL asks for (`sslmode`, `sslrootcert`, ...); certificate
+ * validation is never disabled here.
+ */
+export const DEFAULT_POOL_TIMEOUT_MS = 10_000;
+export function defaultPoolMax() {
+    return availableParallelism() * 2 + 1;
+}
+export function poolSettings(connectionString) {
+    const settings = { max: defaultPoolMax(), connectionTimeoutMillis: DEFAULT_POOL_TIMEOUT_MS };
+    let params;
+    try {
+        params = new URL(connectionString).searchParams;
+    }
+    catch {
+        return settings;
+    }
+    const limit = Number(params.get("connection_limit"));
+    if (Number.isInteger(limit) && limit > 0)
+        settings.max = limit;
+    const timeout = params.get("pool_timeout");
+    if (timeout !== null && timeout !== "" && Number.isFinite(Number(timeout)) && Number(timeout) >= 0) {
+        // Prisma's pool_timeout=0 meant "no timeout"; pg's 0 means the same.
+        settings.connectionTimeoutMillis = Number(timeout) * 1000;
+    }
+    return settings;
+}
+/**
+ * Without a URL, pg would silently fall back to PGHOST/localhost:5432 as the
+ * OS user. Prisma 6 failed the first query instead ("Environment variable not
+ * found: DATABASE_URL"); keep that: construction succeeds, connecting fails.
+ */
+class MissingUrlAdapter extends PrismaPg {
+    async connect() {
+        throw new Error("DATABASE_URL is not set: cannot connect to the database.");
+    }
+}
+/**
+ * The one way wardby builds a Prisma client. `url` defaults to DATABASE_URL
+ * as read at call time.
+ */
+export function createPrismaClient(url = process.env.DATABASE_URL) {
+    const adapter = url
+        ? new PrismaPg({ connectionString: url, ...poolSettings(url) })
+        : new MissingUrlAdapter({ connectionString: "" });
+    return new PrismaClient({ adapter });
+}
+export const prisma = createPrismaClient();

package/dist/core/dispatch.d.ts

@@ -1,4 +1,4 @@
-import type { Prisma, PrismaClient, Run, RunTrigger, Task } from "@prisma/client";
+import type { Prisma, PrismaClient, Run, RunTrigger, Task } from "#prisma";
 import type { Executor } from "../providers/executor/types.js";
 export type DispatchDb = Pick<PrismaClient, "agent" | "run" | "codingRun" | "task" | "webhook" | "$transaction" | "$queryRaw">;
 type DispatchTx = Pick<Prisma.TransactionClient, "agent" | "run" | "codingRun" | "task" | "webhook" | "$queryRaw">;
@@ -63,6 +63,21 @@ export interface DispatchRunResult {
     run: Run;
     task?: Task;
 }
+/**
+ * A transient transaction conflict in the Serializable persist transaction:
+ * a serialization failure (40001) or a deadlock (40P01). It arrives in one of
+ * three shapes:
+ * - on a model statement: P2034;
+ * - on a raw statement ($queryRaw, e.g. the FOR UPDATE SKIP LOCKED below, or
+ *   anything a beforePersist callback runs): P2010, with the SQLSTATE at
+ *   meta.driverAdapterError.cause.originalCode under the pg driver adapter
+ *   (Prisma 7) -- Prisma 6's engine put 40001 at meta.code, still accepted;
+ * - at COMMIT (e.g. SSI write skew): an unwrapped DriverAdapterError, no
+ *   code or meta, with the SQLSTATE at cause.originalCode.
+ *
+ * @internal Exported only for the real-PostgreSQL tests.
+ */
+export declare function isSerializationConflict(err: unknown): boolean;
 /**
  * Record an executor-level failure on a run that never reached a terminal
  * state itself. Deliberately idempotent: the same failure can arrive twice —

package/dist/core/dispatch.js

@@ -1,12 +1,38 @@
-import { CODING_PROTOCOL_VERSION, CodingTaskInputSchema, normalizeGitHubRepository, publicCodingRunResult, } from "../coding/protocol.js";
+import { CODING_PROTOCOL_VERSION, CodingTaskInputSchema, normalizeGitHubRepository, publicCodingRunResult, composeCodingTask, } from "../coding/protocol.js";
 import { assertCodingProviderModel } from "../coding/provider.js";
 import { logger } from "./logger.js";
 const dispatchLog = logger.child({ module: "dispatch" });
-function isSerializationConflict(err) {
+/** SQLSTATEs worth retrying the persist transaction for: serialization failure, deadlock. */
+const RETRYABLE_SQLSTATES = new Set(["40001", "40P01"]);
+/**
+ * A transient transaction conflict in the Serializable persist transaction:
+ * a serialization failure (40001) or a deadlock (40P01). It arrives in one of
+ * three shapes:
+ * - on a model statement: P2034;
+ * - on a raw statement ($queryRaw, e.g. the FOR UPDATE SKIP LOCKED below, or
+ *   anything a beforePersist callback runs): P2010, with the SQLSTATE at
+ *   meta.driverAdapterError.cause.originalCode under the pg driver adapter
+ *   (Prisma 7) -- Prisma 6's engine put 40001 at meta.code, still accepted;
+ * - at COMMIT (e.g. SSI write skew): an unwrapped DriverAdapterError, no
+ *   code or meta, with the SQLSTATE at cause.originalCode.
+ *
+ * @internal Exported only for the real-PostgreSQL tests.
+ */
+export function isSerializationConflict(err) {
     if (!err || typeof err !== "object")
         return false;
     const candidate = err;
-    return candidate.code === "P2034" || (candidate.code === "P2010" && candidate.meta?.code === "40001");
+    if (candidate.code === "P2034")
+        return true;
+    if (candidate.code === "P2010") {
+        const sqlState = candidate.meta?.driverAdapterError?.cause?.originalCode;
+        return (typeof sqlState === "string" && RETRYABLE_SQLSTATES.has(sqlState)) || candidate.meta?.code === "40001";
+    }
+    if (candidate.name === "DriverAdapterError") {
+        const sqlState = candidate.cause?.originalCode;
+        return typeof sqlState === "string" && RETRYABLE_SQLSTATES.has(sqlState);
+    }
+    return false;
 }
 /**
  * Record an executor-level failure on a run that never reached a terminal
@@ -66,9 +92,11 @@ export async function dispatchRun(options) {
             if (!agent.codingProfile)
                 throw new Error(`Coding agent "${agent.id}" has no coding profile.`);
             assertCodingProviderModel(agent.codingProfile.provider, agent.model);
-            const task = options.codingTask ?? agent.codingProfile.defaultTask;
-            if (!task)
+            const request = options.codingTask ?? agent.codingProfile.defaultTask;
+            if (!request)
                 throw new Error(`Coding agent "${agent.id}" requires a task.`);
+            // The worker sees only the task text, so the agent's own instructions ride in it.
+            const task = composeCodingTask(agent.systemPrompt, request);
             const budgetUsd = options.budgetUsdOverride ?? Number(agent.budgetUsd);
             let baseRef = options.codingBaseRef ?? agent.codingProfile.baseRef;
             let headRef = `wardby/run-${run.id}`;

package/dist/core/http-runtime.js

@@ -57,11 +57,10 @@
  * later in the process, would replace this Agent with an h2-enabled one and
  * silently restore the corruption — the price of fixing this with a dispatcher
  * instead of owning the fetch stack. Nothing in the runtime image does that
- * today: the only other `setGlobalDispatcher` calls in the tree are undici
- * copies bundled inside `@prisma/client/runtime/binary.*` (guarded by the same
- * `=== undefined` check, and the binary engine is not the default) and
+ * today: the only other `setGlobalDispatcher` call in the tree is
  * `node-fetch-native` under the `prisma` CLI, which `deploy/Dockerfile:25`
- * asserts is absent from the runtime image.
+ * asserts is absent from the runtime image. (Prisma 7's client runtime and
+ * `@prisma/adapter-pg` contain none; Prisma 6's `runtime/binary.*` did.)
  *
  * Restoring Node's OWN dispatcher instead is not possible, though not for the
  * reason one might guess: undici defines the legacy symbol `configurable: false`

package/dist/core/lease.d.ts

@@ -7,7 +7,7 @@
  * expired, or already ours, and `RETURNING` tells the caller which case it
  * was — zero rows means someone else holds an unexpired lease.
  */
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 export type LeaseDb = Pick<PrismaClient, "$queryRaw">;
 /** Attempts to acquire (or renew) the lease for `scope`. Returns whether `holder` now holds it. */
 export declare function tryAcquireLease(db: LeaseDb, scope: string, holder: string, ttlMs: number): Promise<boolean>;

package/dist/core/private-directory.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Creates `path` as a private directory, or verifies an existing one is safe to
+ * trust.
+ *
+ * `mkdir(..., { mode: 0o700 })` does nothing to a directory that already
+ * exists. The coding state roots default to fixed names under the OS temp
+ * directory, so on a shared host another user could create one first -- or
+ * point it somewhere else with a symlink -- and then read or plant the job
+ * records, workspaces and artifacts wardby keeps there. This refuses:
+ *
+ * - a symlink, or anything that is not a directory;
+ * - a directory owned by a different user (root excepted: an operator-mounted
+ *   volume is commonly root-owned);
+ * - a directory any other user can write to.
+ *
+ * Group write is allowed, since a Kubernetes `fsGroup` volume is group-writable
+ * by design and its group is chosen by the operator. Ownership and mode are not
+ * checked on platforms without POSIX uids.
+ */
+export declare function ensurePrivateDirectory(path: string): Promise<void>;

package/dist/core/private-directory.js

@@ -0,0 +1,36 @@
+import { lstat, mkdir } from "node:fs/promises";
+/**
+ * Creates `path` as a private directory, or verifies an existing one is safe to
+ * trust.
+ *
+ * `mkdir(..., { mode: 0o700 })` does nothing to a directory that already
+ * exists. The coding state roots default to fixed names under the OS temp
+ * directory, so on a shared host another user could create one first -- or
+ * point it somewhere else with a symlink -- and then read or plant the job
+ * records, workspaces and artifacts wardby keeps there. This refuses:
+ *
+ * - a symlink, or anything that is not a directory;
+ * - a directory owned by a different user (root excepted: an operator-mounted
+ *   volume is commonly root-owned);
+ * - a directory any other user can write to.
+ *
+ * Group write is allowed, since a Kubernetes `fsGroup` volume is group-writable
+ * by design and its group is chosen by the operator. Ownership and mode are not
+ * checked on platforms without POSIX uids.
+ */
+export async function ensurePrivateDirectory(path) {
+    await mkdir(path, { recursive: true, mode: 0o700 });
+    const metadata = await lstat(path);
+    if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
+        throw new Error(`${path} must be a real directory, not a symlink.`);
+    }
+    const uid = process.getuid?.();
+    if (uid === undefined)
+        return;
+    if (metadata.uid !== uid && metadata.uid !== 0) {
+        throw new Error(`${path} is owned by uid ${metadata.uid}, not this process (uid ${uid}). Remove it or choose another path.`);
+    }
+    if ((metadata.mode & 0o002) !== 0) {
+        throw new Error(`${path} is writable by other users. Run chmod o-w on it or choose another path.`);
+    }
+}

package/dist/core/reconciler.d.ts

@@ -28,7 +28,7 @@
  * second one's WHERE simply matches zero rows — double-reconcile is a
  * no-op, not a race.
  */
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import type { Executor } from "../providers/executor/types.js";
 export type ReconcilerDb = Pick<PrismaClient, "run">;
 /** Runs one reconciliation pass. Returns the number of runs marked `lost`. */

package/dist/core/runner.d.ts

@@ -16,7 +16,7 @@
  * down) lives inside the engine now — there is exactly one place that
  * reasons about cost, not one here plus one in the engine.
  */
-import type { PrismaClient, Run, RunTrigger } from "@prisma/client";
+import type { PrismaClient, Run, RunTrigger } from "#prisma";
 import type { ProviderRegistry } from "../providers/index.js";
 import { type StepRunner } from "../providers/engine/types.js";
 import type { Executor } from "../providers/executor/types.js";

package/dist/core/scheduler.d.ts

@@ -6,7 +6,7 @@
  * create — never by the lease alone (the lease only prevents concurrent
  * *ticking*, not a race within a single tick against a future one).
  */
-import type { Agent } from "@prisma/client";
+import type { Agent } from "#prisma";
 import type { Executor } from "../providers/executor/types.js";
 import { type DispatchDb } from "./dispatch.js";
 export type SchedulerDb = DispatchDb;

package/dist/core/secrets.d.ts

@@ -6,7 +6,7 @@
  * always resolve a name within one owner's (or, at get-time, one agent's)
  * scope, never globally.
  */
-import type { PrismaClient, Secret } from "@prisma/client";
+import type { PrismaClient, Secret } from "#prisma";
 import type { SecretCipher } from "../providers/secrets/types.js";
 export type SecretMetadata = Pick<Secret, "id" | "name" | "keyId" | "ownerId" | "createdAt" | "updatedAt">;
 export interface SecretsAccessor {

package/dist/core/subagent-memory-tools.d.ts

@@ -1,4 +1,4 @@
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import type { LoadedTool } from "../providers/engine/types.js";
 import type { AgentMemoryStore } from "../providers/memory/types.js";
 export declare const SUBAGENT_MEMORY_TOOL_NAMES: ReadonlySet<string>;

package/dist/core/webhooks.d.ts

@@ -1,4 +1,4 @@
-import type { PrismaClient, Webhook } from "@prisma/client";
+import type { PrismaClient, Webhook } from "#prisma";
 import type { Executor } from "../providers/executor/types.js";
 export type WebhookMetadata = Pick<Webhook, "id" | "agentId" | "status" | "ownerId" | "createdAt" | "lastFiredAt">;
 /** Creates a webhook and returns the raw secret ONCE — only its hash is ever stored. */

package/dist/env.js

@@ -10,4 +10,11 @@
  */
 import "./core/http-runtime.js";
 import dotenvFlow from "dotenv-flow";
-dotenvFlow.config();
+import { join, resolve } from "node:path";
+const projectDir = resolve(process.env.WARDBY_PROJECT_DIR || process.cwd());
+// A quickstart installation owns this directory, so load it before an
+// application's root env files. dotenv-flow never overwrites an existing
+// process variable, preserving explicit shell/container configuration as the
+// highest-priority source in either mode.
+dotenvFlow.config({ path: join(projectDir, ".wardby"), silent: true });
+dotenvFlow.config({ path: projectDir });