@wardby/cli 0.2.1 → 0.3.0

package/dist/generated/prisma/models/CodingRun.d.ts

@@ -40,9 +40,11 @@ export type CodingRunMinAggregateOutputType = {
     failureCategory: string | null;
     diagnosticId: string | null;
     workerImage: string | null;
+    toolImage: string | null;
     budgetReservedUsd: runtime.Decimal | null;
     queuedAt: Date | null;
     workspaceDiskMb: number | null;
+    debugTrace: boolean | null;
     createdAt: Date | null;
     updatedAt: Date | null;
     rootCodingRunId: string | null;
@@ -62,9 +64,11 @@ export type CodingRunMaxAggregateOutputType = {
     failureCategory: string | null;
     diagnosticId: string | null;
     workerImage: string | null;
+    toolImage: string | null;
     budgetReservedUsd: runtime.Decimal | null;
     queuedAt: Date | null;
     workspaceDiskMb: number | null;
+    debugTrace: boolean | null;
     createdAt: Date | null;
     updatedAt: Date | null;
     rootCodingRunId: string | null;
@@ -80,6 +84,7 @@ export type CodingRunCountAggregateOutputType = {
     timeoutSec: number;
     allowedEgress: number;
     protectedPaths: number;
+    collectExclude: number;
     jobBackend: number;
     jobHandle: number;
     result: number;
@@ -87,9 +92,14 @@ export type CodingRunCountAggregateOutputType = {
     failureCategory: number;
     diagnosticId: number;
     workerImage: number;
+    toolImage: number;
     budgetReservedUsd: number;
     queuedAt: number;
     workspaceDiskMb: number;
+    packageAllowlist: number;
+    packagePolicy: number;
+    debugTrace: number;
+    services: number;
     createdAt: number;
     updatedAt: number;
     rootCodingRunId: number;
@@ -122,9 +132,11 @@ export type CodingRunMinAggregateInputType = {
     failureCategory?: true;
     diagnosticId?: true;
     workerImage?: true;
+    toolImage?: true;
     budgetReservedUsd?: true;
     queuedAt?: true;
     workspaceDiskMb?: true;
+    debugTrace?: true;
     createdAt?: true;
     updatedAt?: true;
     rootCodingRunId?: true;
@@ -144,9 +156,11 @@ export type CodingRunMaxAggregateInputType = {
     failureCategory?: true;
     diagnosticId?: true;
     workerImage?: true;
+    toolImage?: true;
     budgetReservedUsd?: true;
     queuedAt?: true;
     workspaceDiskMb?: true;
+    debugTrace?: true;
     createdAt?: true;
     updatedAt?: true;
     rootCodingRunId?: true;
@@ -162,6 +176,7 @@ export type CodingRunCountAggregateInputType = {
     timeoutSec?: true;
     allowedEgress?: true;
     protectedPaths?: true;
+    collectExclude?: true;
     jobBackend?: true;
     jobHandle?: true;
     result?: true;
@@ -169,9 +184,14 @@ export type CodingRunCountAggregateInputType = {
     failureCategory?: true;
     diagnosticId?: true;
     workerImage?: true;
+    toolImage?: true;
     budgetReservedUsd?: true;
     queuedAt?: true;
     workspaceDiskMb?: true;
+    packageAllowlist?: true;
+    packagePolicy?: true;
+    debugTrace?: true;
+    services?: true;
     createdAt?: true;
     updatedAt?: true;
     rootCodingRunId?: true;
@@ -264,6 +284,7 @@ export type CodingRunGroupByOutputType = {
     timeoutSec: number;
     allowedEgress: runtime.JsonValue;
     protectedPaths: runtime.JsonValue;
+    collectExclude: runtime.JsonValue;
     jobBackend: string | null;
     jobHandle: string | null;
     result: runtime.JsonValue | null;
@@ -271,9 +292,14 @@ export type CodingRunGroupByOutputType = {
     failureCategory: string | null;
     diagnosticId: string | null;
     workerImage: string | null;
+    toolImage: string | null;
     budgetReservedUsd: runtime.Decimal;
     queuedAt: Date | null;
     workspaceDiskMb: number | null;
+    packageAllowlist: runtime.JsonValue;
+    packagePolicy: runtime.JsonValue;
+    debugTrace: boolean;
+    services: runtime.JsonValue;
     createdAt: Date;
     updatedAt: Date;
     rootCodingRunId: string | null;
@@ -300,6 +326,7 @@ export type CodingRunWhereInput = {
     timeoutSec?: Prisma.IntFilter<"CodingRun"> | number;
     allowedEgress?: Prisma.JsonFilter<"CodingRun">;
     protectedPaths?: Prisma.JsonFilter<"CodingRun">;
+    collectExclude?: Prisma.JsonFilter<"CodingRun">;
     jobBackend?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
     jobHandle?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
     result?: Prisma.JsonNullableFilter<"CodingRun">;
@@ -307,9 +334,14 @@ export type CodingRunWhereInput = {
     failureCategory?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
     diagnosticId?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
     workerImage?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
+    toolImage?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
     budgetReservedUsd?: Prisma.DecimalFilter<"CodingRun"> | runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Prisma.DateTimeNullableFilter<"CodingRun"> | Date | string | null;
     workspaceDiskMb?: Prisma.IntNullableFilter<"CodingRun"> | number | null;
+    packageAllowlist?: Prisma.JsonFilter<"CodingRun">;
+    packagePolicy?: Prisma.JsonFilter<"CodingRun">;
+    debugTrace?: Prisma.BoolFilter<"CodingRun"> | boolean;
+    services?: Prisma.JsonFilter<"CodingRun">;
     createdAt?: Prisma.DateTimeFilter<"CodingRun"> | Date | string;
     updatedAt?: Prisma.DateTimeFilter<"CodingRun"> | Date | string;
     rootCodingRunId?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
@@ -317,6 +349,10 @@ export type CodingRunWhereInput = {
     proxySession?: Prisma.XOR<Prisma.CodingProxySessionNullableScalarRelationFilter, Prisma.CodingProxySessionWhereInput> | null;
     rootCodingRun?: Prisma.XOR<Prisma.CodingRunNullableScalarRelationFilter, Prisma.CodingRunWhereInput> | null;
     continuations?: Prisma.CodingRunListRelationFilter;
+    registryAllowances?: Prisma.RegistryAllowanceListRelationFilter;
+    registryFetches?: Prisma.RegistryFetchListRelationFilter;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionListRelationFilter;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalListRelationFilter;
 };
 export type CodingRunOrderByWithRelationInput = {
     runId?: Prisma.SortOrder;
@@ -329,6 +365,7 @@ export type CodingRunOrderByWithRelationInput = {
     timeoutSec?: Prisma.SortOrder;
     allowedEgress?: Prisma.SortOrder;
     protectedPaths?: Prisma.SortOrder;
+    collectExclude?: Prisma.SortOrder;
     jobBackend?: Prisma.SortOrderInput | Prisma.SortOrder;
     jobHandle?: Prisma.SortOrderInput | Prisma.SortOrder;
     result?: Prisma.SortOrderInput | Prisma.SortOrder;
@@ -336,9 +373,14 @@ export type CodingRunOrderByWithRelationInput = {
     failureCategory?: Prisma.SortOrderInput | Prisma.SortOrder;
     diagnosticId?: Prisma.SortOrderInput | Prisma.SortOrder;
     workerImage?: Prisma.SortOrderInput | Prisma.SortOrder;
+    toolImage?: Prisma.SortOrderInput | Prisma.SortOrder;
     budgetReservedUsd?: Prisma.SortOrder;
     queuedAt?: Prisma.SortOrderInput | Prisma.SortOrder;
     workspaceDiskMb?: Prisma.SortOrderInput | Prisma.SortOrder;
+    packageAllowlist?: Prisma.SortOrder;
+    packagePolicy?: Prisma.SortOrder;
+    debugTrace?: Prisma.SortOrder;
+    services?: Prisma.SortOrder;
     createdAt?: Prisma.SortOrder;
     updatedAt?: Prisma.SortOrder;
     rootCodingRunId?: Prisma.SortOrderInput | Prisma.SortOrder;
@@ -346,6 +388,10 @@ export type CodingRunOrderByWithRelationInput = {
     proxySession?: Prisma.CodingProxySessionOrderByWithRelationInput;
     rootCodingRun?: Prisma.CodingRunOrderByWithRelationInput;
     continuations?: Prisma.CodingRunOrderByRelationAggregateInput;
+    registryAllowances?: Prisma.RegistryAllowanceOrderByRelationAggregateInput;
+    registryFetches?: Prisma.RegistryFetchOrderByRelationAggregateInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionOrderByRelationAggregateInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalOrderByRelationAggregateInput;
 };
 export type CodingRunWhereUniqueInput = Prisma.AtLeast<{
     runId?: string;
@@ -361,6 +407,7 @@ export type CodingRunWhereUniqueInput = Prisma.AtLeast<{
     timeoutSec?: Prisma.IntFilter<"CodingRun"> | number;
     allowedEgress?: Prisma.JsonFilter<"CodingRun">;
     protectedPaths?: Prisma.JsonFilter<"CodingRun">;
+    collectExclude?: Prisma.JsonFilter<"CodingRun">;
     jobBackend?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
     jobHandle?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
     result?: Prisma.JsonNullableFilter<"CodingRun">;
@@ -368,9 +415,14 @@ export type CodingRunWhereUniqueInput = Prisma.AtLeast<{
     failureCategory?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
     diagnosticId?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
     workerImage?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
+    toolImage?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
     budgetReservedUsd?: Prisma.DecimalFilter<"CodingRun"> | runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Prisma.DateTimeNullableFilter<"CodingRun"> | Date | string | null;
     workspaceDiskMb?: Prisma.IntNullableFilter<"CodingRun"> | number | null;
+    packageAllowlist?: Prisma.JsonFilter<"CodingRun">;
+    packagePolicy?: Prisma.JsonFilter<"CodingRun">;
+    debugTrace?: Prisma.BoolFilter<"CodingRun"> | boolean;
+    services?: Prisma.JsonFilter<"CodingRun">;
     createdAt?: Prisma.DateTimeFilter<"CodingRun"> | Date | string;
     updatedAt?: Prisma.DateTimeFilter<"CodingRun"> | Date | string;
     rootCodingRunId?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
@@ -378,6 +430,10 @@ export type CodingRunWhereUniqueInput = Prisma.AtLeast<{
     proxySession?: Prisma.XOR<Prisma.CodingProxySessionNullableScalarRelationFilter, Prisma.CodingProxySessionWhereInput> | null;
     rootCodingRun?: Prisma.XOR<Prisma.CodingRunNullableScalarRelationFilter, Prisma.CodingRunWhereInput> | null;
     continuations?: Prisma.CodingRunListRelationFilter;
+    registryAllowances?: Prisma.RegistryAllowanceListRelationFilter;
+    registryFetches?: Prisma.RegistryFetchListRelationFilter;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionListRelationFilter;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalListRelationFilter;
 }, "runId">;
 export type CodingRunOrderByWithAggregationInput = {
     runId?: Prisma.SortOrder;
@@ -390,6 +446,7 @@ export type CodingRunOrderByWithAggregationInput = {
     timeoutSec?: Prisma.SortOrder;
     allowedEgress?: Prisma.SortOrder;
     protectedPaths?: Prisma.SortOrder;
+    collectExclude?: Prisma.SortOrder;
     jobBackend?: Prisma.SortOrderInput | Prisma.SortOrder;
     jobHandle?: Prisma.SortOrderInput | Prisma.SortOrder;
     result?: Prisma.SortOrderInput | Prisma.SortOrder;
@@ -397,9 +454,14 @@ export type CodingRunOrderByWithAggregationInput = {
     failureCategory?: Prisma.SortOrderInput | Prisma.SortOrder;
     diagnosticId?: Prisma.SortOrderInput | Prisma.SortOrder;
     workerImage?: Prisma.SortOrderInput | Prisma.SortOrder;
+    toolImage?: Prisma.SortOrderInput | Prisma.SortOrder;
     budgetReservedUsd?: Prisma.SortOrder;
     queuedAt?: Prisma.SortOrderInput | Prisma.SortOrder;
     workspaceDiskMb?: Prisma.SortOrderInput | Prisma.SortOrder;
+    packageAllowlist?: Prisma.SortOrder;
+    packagePolicy?: Prisma.SortOrder;
+    debugTrace?: Prisma.SortOrder;
+    services?: Prisma.SortOrder;
     createdAt?: Prisma.SortOrder;
     updatedAt?: Prisma.SortOrder;
     rootCodingRunId?: Prisma.SortOrderInput | Prisma.SortOrder;
@@ -423,6 +485,7 @@ export type CodingRunScalarWhereWithAggregatesInput = {
     timeoutSec?: Prisma.IntWithAggregatesFilter<"CodingRun"> | number;
     allowedEgress?: Prisma.JsonWithAggregatesFilter<"CodingRun">;
     protectedPaths?: Prisma.JsonWithAggregatesFilter<"CodingRun">;
+    collectExclude?: Prisma.JsonWithAggregatesFilter<"CodingRun">;
     jobBackend?: Prisma.StringNullableWithAggregatesFilter<"CodingRun"> | string | null;
     jobHandle?: Prisma.StringNullableWithAggregatesFilter<"CodingRun"> | string | null;
     result?: Prisma.JsonNullableWithAggregatesFilter<"CodingRun">;
@@ -430,9 +493,14 @@ export type CodingRunScalarWhereWithAggregatesInput = {
     failureCategory?: Prisma.StringNullableWithAggregatesFilter<"CodingRun"> | string | null;
     diagnosticId?: Prisma.StringNullableWithAggregatesFilter<"CodingRun"> | string | null;
     workerImage?: Prisma.StringNullableWithAggregatesFilter<"CodingRun"> | string | null;
+    toolImage?: Prisma.StringNullableWithAggregatesFilter<"CodingRun"> | string | null;
     budgetReservedUsd?: Prisma.DecimalWithAggregatesFilter<"CodingRun"> | runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Prisma.DateTimeNullableWithAggregatesFilter<"CodingRun"> | Date | string | null;
     workspaceDiskMb?: Prisma.IntNullableWithAggregatesFilter<"CodingRun"> | number | null;
+    packageAllowlist?: Prisma.JsonWithAggregatesFilter<"CodingRun">;
+    packagePolicy?: Prisma.JsonWithAggregatesFilter<"CodingRun">;
+    debugTrace?: Prisma.BoolWithAggregatesFilter<"CodingRun"> | boolean;
+    services?: Prisma.JsonWithAggregatesFilter<"CodingRun">;
     createdAt?: Prisma.DateTimeWithAggregatesFilter<"CodingRun"> | Date | string;
     updatedAt?: Prisma.DateTimeWithAggregatesFilter<"CodingRun"> | Date | string;
     rootCodingRunId?: Prisma.StringNullableWithAggregatesFilter<"CodingRun"> | string | null;
@@ -445,8 +513,9 @@ export type CodingRunCreateInput = {
     provider: string;
     model: string;
     timeoutSec: number;
-    allowedEgress: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: string | null;
     jobHandle?: string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -454,15 +523,24 @@ export type CodingRunCreateInput = {
     failureCategory?: string | null;
     diagnosticId?: string | null;
     workerImage?: string | null;
+    toolImage?: string | null;
     budgetReservedUsd: runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Date | string | null;
     workspaceDiskMb?: number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Date | string;
     updatedAt?: Date | string;
     run: Prisma.RunCreateNestedOneWithoutCodingRunInput;
     proxySession?: Prisma.CodingProxySessionCreateNestedOneWithoutRunInput;
     rootCodingRun?: Prisma.CodingRunCreateNestedOneWithoutContinuationsInput;
     continuations?: Prisma.CodingRunCreateNestedManyWithoutRootCodingRunInput;
+    registryAllowances?: Prisma.RegistryAllowanceCreateNestedManyWithoutRunInput;
+    registryFetches?: Prisma.RegistryFetchCreateNestedManyWithoutRunInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionCreateNestedManyWithoutRunInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalCreateNestedManyWithoutRunInput;
 };
 export type CodingRunUncheckedCreateInput = {
     runId: string;
@@ -473,8 +551,9 @@ export type CodingRunUncheckedCreateInput = {
     provider: string;
     model: string;
     timeoutSec: number;
-    allowedEgress: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: string | null;
     jobHandle?: string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -482,14 +561,23 @@ export type CodingRunUncheckedCreateInput = {
     failureCategory?: string | null;
     diagnosticId?: string | null;
     workerImage?: string | null;
+    toolImage?: string | null;
     budgetReservedUsd: runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Date | string | null;
     workspaceDiskMb?: number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Date | string;
     updatedAt?: Date | string;
     rootCodingRunId?: string | null;
     proxySession?: Prisma.CodingProxySessionUncheckedCreateNestedOneWithoutRunInput;
     continuations?: Prisma.CodingRunUncheckedCreateNestedManyWithoutRootCodingRunInput;
+    registryAllowances?: Prisma.RegistryAllowanceUncheckedCreateNestedManyWithoutRunInput;
+    registryFetches?: Prisma.RegistryFetchUncheckedCreateNestedManyWithoutRunInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUncheckedCreateNestedManyWithoutRunInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUncheckedCreateNestedManyWithoutRunInput;
 };
 export type CodingRunUpdateInput = {
     task?: Prisma.StringFieldUpdateOperationsInput | string;
@@ -501,6 +589,7 @@ export type CodingRunUpdateInput = {
     timeoutSec?: Prisma.IntFieldUpdateOperationsInput | number;
     allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     jobHandle?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -508,15 +597,24 @@ export type CodingRunUpdateInput = {
     failureCategory?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     diagnosticId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     workerImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    toolImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     budgetReservedUsd?: Prisma.DecimalFieldUpdateOperationsInput | runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Prisma.NullableDateTimeFieldUpdateOperationsInput | Date | string | null;
     workspaceDiskMb?: Prisma.NullableIntFieldUpdateOperationsInput | number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: Prisma.BoolFieldUpdateOperationsInput | boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     run?: Prisma.RunUpdateOneRequiredWithoutCodingRunNestedInput;
     proxySession?: Prisma.CodingProxySessionUpdateOneWithoutRunNestedInput;
     rootCodingRun?: Prisma.CodingRunUpdateOneWithoutContinuationsNestedInput;
     continuations?: Prisma.CodingRunUpdateManyWithoutRootCodingRunNestedInput;
+    registryAllowances?: Prisma.RegistryAllowanceUpdateManyWithoutRunNestedInput;
+    registryFetches?: Prisma.RegistryFetchUpdateManyWithoutRunNestedInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUpdateManyWithoutRunNestedInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUpdateManyWithoutRunNestedInput;
 };
 export type CodingRunUncheckedUpdateInput = {
     runId?: Prisma.StringFieldUpdateOperationsInput | string;
@@ -529,6 +627,7 @@ export type CodingRunUncheckedUpdateInput = {
     timeoutSec?: Prisma.IntFieldUpdateOperationsInput | number;
     allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     jobHandle?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -536,14 +635,23 @@ export type CodingRunUncheckedUpdateInput = {
     failureCategory?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     diagnosticId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     workerImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    toolImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     budgetReservedUsd?: Prisma.DecimalFieldUpdateOperationsInput | runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Prisma.NullableDateTimeFieldUpdateOperationsInput | Date | string | null;
     workspaceDiskMb?: Prisma.NullableIntFieldUpdateOperationsInput | number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: Prisma.BoolFieldUpdateOperationsInput | boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     rootCodingRunId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     proxySession?: Prisma.CodingProxySessionUncheckedUpdateOneWithoutRunNestedInput;
     continuations?: Prisma.CodingRunUncheckedUpdateManyWithoutRootCodingRunNestedInput;
+    registryAllowances?: Prisma.RegistryAllowanceUncheckedUpdateManyWithoutRunNestedInput;
+    registryFetches?: Prisma.RegistryFetchUncheckedUpdateManyWithoutRunNestedInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUncheckedUpdateManyWithoutRunNestedInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUncheckedUpdateManyWithoutRunNestedInput;
 };
 export type CodingRunCreateManyInput = {
     runId: string;
@@ -554,8 +662,9 @@ export type CodingRunCreateManyInput = {
     provider: string;
     model: string;
     timeoutSec: number;
-    allowedEgress: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: string | null;
     jobHandle?: string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -563,9 +672,14 @@ export type CodingRunCreateManyInput = {
     failureCategory?: string | null;
     diagnosticId?: string | null;
     workerImage?: string | null;
+    toolImage?: string | null;
     budgetReservedUsd: runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Date | string | null;
     workspaceDiskMb?: number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Date | string;
     updatedAt?: Date | string;
     rootCodingRunId?: string | null;
@@ -580,6 +694,7 @@ export type CodingRunUpdateManyMutationInput = {
     timeoutSec?: Prisma.IntFieldUpdateOperationsInput | number;
     allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     jobHandle?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -587,9 +702,14 @@ export type CodingRunUpdateManyMutationInput = {
     failureCategory?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     diagnosticId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     workerImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    toolImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     budgetReservedUsd?: Prisma.DecimalFieldUpdateOperationsInput | runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Prisma.NullableDateTimeFieldUpdateOperationsInput | Date | string | null;
     workspaceDiskMb?: Prisma.NullableIntFieldUpdateOperationsInput | number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: Prisma.BoolFieldUpdateOperationsInput | boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
 };
@@ -604,6 +724,7 @@ export type CodingRunUncheckedUpdateManyInput = {
     timeoutSec?: Prisma.IntFieldUpdateOperationsInput | number;
     allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     jobHandle?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -611,9 +732,14 @@ export type CodingRunUncheckedUpdateManyInput = {
     failureCategory?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     diagnosticId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     workerImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    toolImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     budgetReservedUsd?: Prisma.DecimalFieldUpdateOperationsInput | runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Prisma.NullableDateTimeFieldUpdateOperationsInput | Date | string | null;
     workspaceDiskMb?: Prisma.NullableIntFieldUpdateOperationsInput | number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: Prisma.BoolFieldUpdateOperationsInput | boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     rootCodingRunId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
@@ -641,6 +767,7 @@ export type CodingRunCountOrderByAggregateInput = {
     timeoutSec?: Prisma.SortOrder;
     allowedEgress?: Prisma.SortOrder;
     protectedPaths?: Prisma.SortOrder;
+    collectExclude?: Prisma.SortOrder;
     jobBackend?: Prisma.SortOrder;
     jobHandle?: Prisma.SortOrder;
     result?: Prisma.SortOrder;
@@ -648,9 +775,14 @@ export type CodingRunCountOrderByAggregateInput = {
     failureCategory?: Prisma.SortOrder;
     diagnosticId?: Prisma.SortOrder;
     workerImage?: Prisma.SortOrder;
+    toolImage?: Prisma.SortOrder;
     budgetReservedUsd?: Prisma.SortOrder;
     queuedAt?: Prisma.SortOrder;
     workspaceDiskMb?: Prisma.SortOrder;
+    packageAllowlist?: Prisma.SortOrder;
+    packagePolicy?: Prisma.SortOrder;
+    debugTrace?: Prisma.SortOrder;
+    services?: Prisma.SortOrder;
     createdAt?: Prisma.SortOrder;
     updatedAt?: Prisma.SortOrder;
     rootCodingRunId?: Prisma.SortOrder;
@@ -676,9 +808,11 @@ export type CodingRunMaxOrderByAggregateInput = {
     failureCategory?: Prisma.SortOrder;
     diagnosticId?: Prisma.SortOrder;
     workerImage?: Prisma.SortOrder;
+    toolImage?: Prisma.SortOrder;
     budgetReservedUsd?: Prisma.SortOrder;
     queuedAt?: Prisma.SortOrder;
     workspaceDiskMb?: Prisma.SortOrder;
+    debugTrace?: Prisma.SortOrder;
     createdAt?: Prisma.SortOrder;
     updatedAt?: Prisma.SortOrder;
     rootCodingRunId?: Prisma.SortOrder;
@@ -698,9 +832,11 @@ export type CodingRunMinOrderByAggregateInput = {
     failureCategory?: Prisma.SortOrder;
     diagnosticId?: Prisma.SortOrder;
     workerImage?: Prisma.SortOrder;
+    toolImage?: Prisma.SortOrder;
     budgetReservedUsd?: Prisma.SortOrder;
     queuedAt?: Prisma.SortOrder;
     workspaceDiskMb?: Prisma.SortOrder;
+    debugTrace?: Prisma.SortOrder;
     createdAt?: Prisma.SortOrder;
     updatedAt?: Prisma.SortOrder;
     rootCodingRunId?: Prisma.SortOrder;
@@ -807,7 +943,653 @@ export type CodingRunUpdateOneRequiredWithoutProxySessionNestedInput = {
     connect?: Prisma.CodingRunWhereUniqueInput;
     update?: Prisma.XOR<Prisma.XOR<Prisma.CodingRunUpdateToOneWithWhereWithoutProxySessionInput, Prisma.CodingRunUpdateWithoutProxySessionInput>, Prisma.CodingRunUncheckedUpdateWithoutProxySessionInput>;
 };
-export type CodingRunCreateWithoutRunInput = {
+export type CodingRunCreateNestedOneWithoutRegistryAllowancesInput = {
+    create?: Prisma.XOR<Prisma.CodingRunCreateWithoutRegistryAllowancesInput, Prisma.CodingRunUncheckedCreateWithoutRegistryAllowancesInput>;
+    connectOrCreate?: Prisma.CodingRunCreateOrConnectWithoutRegistryAllowancesInput;
+    connect?: Prisma.CodingRunWhereUniqueInput;
+};
+export type CodingRunUpdateOneRequiredWithoutRegistryAllowancesNestedInput = {
+    create?: Prisma.XOR<Prisma.CodingRunCreateWithoutRegistryAllowancesInput, Prisma.CodingRunUncheckedCreateWithoutRegistryAllowancesInput>;
+    connectOrCreate?: Prisma.CodingRunCreateOrConnectWithoutRegistryAllowancesInput;
+    upsert?: Prisma.CodingRunUpsertWithoutRegistryAllowancesInput;
+    connect?: Prisma.CodingRunWhereUniqueInput;
+    update?: Prisma.XOR<Prisma.XOR<Prisma.CodingRunUpdateToOneWithWhereWithoutRegistryAllowancesInput, Prisma.CodingRunUpdateWithoutRegistryAllowancesInput>, Prisma.CodingRunUncheckedUpdateWithoutRegistryAllowancesInput>;
+};
+export type CodingRunCreateNestedOneWithoutRegistryFetchesInput = {
+    create?: Prisma.XOR<Prisma.CodingRunCreateWithoutRegistryFetchesInput, Prisma.CodingRunUncheckedCreateWithoutRegistryFetchesInput>;
+    connectOrCreate?: Prisma.CodingRunCreateOrConnectWithoutRegistryFetchesInput;
+    connect?: Prisma.CodingRunWhereUniqueInput;
+};
+export type CodingRunUpdateOneRequiredWithoutRegistryFetchesNestedInput = {
+    create?: Prisma.XOR<Prisma.CodingRunCreateWithoutRegistryFetchesInput, Prisma.CodingRunUncheckedCreateWithoutRegistryFetchesInput>;
+    connectOrCreate?: Prisma.CodingRunCreateOrConnectWithoutRegistryFetchesInput;
+    upsert?: Prisma.CodingRunUpsertWithoutRegistryFetchesInput;
+    connect?: Prisma.CodingRunWhereUniqueInput;
+    update?: Prisma.XOR<Prisma.XOR<Prisma.CodingRunUpdateToOneWithWhereWithoutRegistryFetchesInput, Prisma.CodingRunUpdateWithoutRegistryFetchesInput>, Prisma.CodingRunUncheckedUpdateWithoutRegistryFetchesInput>;
+};
+export type CodingRunCreateNestedOneWithoutRegistryApprovedVersionsInput = {
+    create?: Prisma.XOR<Prisma.CodingRunCreateWithoutRegistryApprovedVersionsInput, Prisma.CodingRunUncheckedCreateWithoutRegistryApprovedVersionsInput>;
+    connectOrCreate?: Prisma.CodingRunCreateOrConnectWithoutRegistryApprovedVersionsInput;
+    connect?: Prisma.CodingRunWhereUniqueInput;
+};
+export type CodingRunUpdateOneRequiredWithoutRegistryApprovedVersionsNestedInput = {
+    create?: Prisma.XOR<Prisma.CodingRunCreateWithoutRegistryApprovedVersionsInput, Prisma.CodingRunUncheckedCreateWithoutRegistryApprovedVersionsInput>;
+    connectOrCreate?: Prisma.CodingRunCreateOrConnectWithoutRegistryApprovedVersionsInput;
+    upsert?: Prisma.CodingRunUpsertWithoutRegistryApprovedVersionsInput;
+    connect?: Prisma.CodingRunWhereUniqueInput;
+    update?: Prisma.XOR<Prisma.XOR<Prisma.CodingRunUpdateToOneWithWhereWithoutRegistryApprovedVersionsInput, Prisma.CodingRunUpdateWithoutRegistryApprovedVersionsInput>, Prisma.CodingRunUncheckedUpdateWithoutRegistryApprovedVersionsInput>;
+};
+export type CodingRunCreateNestedOneWithoutRegistryPlanRefusalsInput = {
+    create?: Prisma.XOR<Prisma.CodingRunCreateWithoutRegistryPlanRefusalsInput, Prisma.CodingRunUncheckedCreateWithoutRegistryPlanRefusalsInput>;
+    connectOrCreate?: Prisma.CodingRunCreateOrConnectWithoutRegistryPlanRefusalsInput;
+    connect?: Prisma.CodingRunWhereUniqueInput;
+};
+export type CodingRunUpdateOneRequiredWithoutRegistryPlanRefusalsNestedInput = {
+    create?: Prisma.XOR<Prisma.CodingRunCreateWithoutRegistryPlanRefusalsInput, Prisma.CodingRunUncheckedCreateWithoutRegistryPlanRefusalsInput>;
+    connectOrCreate?: Prisma.CodingRunCreateOrConnectWithoutRegistryPlanRefusalsInput;
+    upsert?: Prisma.CodingRunUpsertWithoutRegistryPlanRefusalsInput;
+    connect?: Prisma.CodingRunWhereUniqueInput;
+    update?: Prisma.XOR<Prisma.XOR<Prisma.CodingRunUpdateToOneWithWhereWithoutRegistryPlanRefusalsInput, Prisma.CodingRunUpdateWithoutRegistryPlanRefusalsInput>, Prisma.CodingRunUncheckedUpdateWithoutRegistryPlanRefusalsInput>;
+};
+export type CodingRunCreateWithoutRunInput = {
+    task: string;
+    repository: string;
+    baseRef: string;
+    headRef: string;
+    provider: string;
+    model: string;
+    timeoutSec: number;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    protectedPaths: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    jobBackend?: string | null;
+    jobHandle?: string | null;
+    result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
+    resultSchema?: number;
+    failureCategory?: string | null;
+    diagnosticId?: string | null;
+    workerImage?: string | null;
+    toolImage?: string | null;
+    budgetReservedUsd: runtime.Decimal | runtime.DecimalJsLike | number | string;
+    queuedAt?: Date | string | null;
+    workspaceDiskMb?: number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    createdAt?: Date | string;
+    updatedAt?: Date | string;
+    proxySession?: Prisma.CodingProxySessionCreateNestedOneWithoutRunInput;
+    rootCodingRun?: Prisma.CodingRunCreateNestedOneWithoutContinuationsInput;
+    continuations?: Prisma.CodingRunCreateNestedManyWithoutRootCodingRunInput;
+    registryAllowances?: Prisma.RegistryAllowanceCreateNestedManyWithoutRunInput;
+    registryFetches?: Prisma.RegistryFetchCreateNestedManyWithoutRunInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionCreateNestedManyWithoutRunInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalCreateNestedManyWithoutRunInput;
+};
+export type CodingRunUncheckedCreateWithoutRunInput = {
+    task: string;
+    repository: string;
+    baseRef: string;
+    headRef: string;
+    provider: string;
+    model: string;
+    timeoutSec: number;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    protectedPaths: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    jobBackend?: string | null;
+    jobHandle?: string | null;
+    result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
+    resultSchema?: number;
+    failureCategory?: string | null;
+    diagnosticId?: string | null;
+    workerImage?: string | null;
+    toolImage?: string | null;
+    budgetReservedUsd: runtime.Decimal | runtime.DecimalJsLike | number | string;
+    queuedAt?: Date | string | null;
+    workspaceDiskMb?: number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    createdAt?: Date | string;
+    updatedAt?: Date | string;
+    rootCodingRunId?: string | null;
+    proxySession?: Prisma.CodingProxySessionUncheckedCreateNestedOneWithoutRunInput;
+    continuations?: Prisma.CodingRunUncheckedCreateNestedManyWithoutRootCodingRunInput;
+    registryAllowances?: Prisma.RegistryAllowanceUncheckedCreateNestedManyWithoutRunInput;
+    registryFetches?: Prisma.RegistryFetchUncheckedCreateNestedManyWithoutRunInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUncheckedCreateNestedManyWithoutRunInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUncheckedCreateNestedManyWithoutRunInput;
+};
+export type CodingRunCreateOrConnectWithoutRunInput = {
+    where: Prisma.CodingRunWhereUniqueInput;
+    create: Prisma.XOR<Prisma.CodingRunCreateWithoutRunInput, Prisma.CodingRunUncheckedCreateWithoutRunInput>;
+};
+export type CodingRunUpsertWithoutRunInput = {
+    update: Prisma.XOR<Prisma.CodingRunUpdateWithoutRunInput, Prisma.CodingRunUncheckedUpdateWithoutRunInput>;
+    create: Prisma.XOR<Prisma.CodingRunCreateWithoutRunInput, Prisma.CodingRunUncheckedCreateWithoutRunInput>;
+    where?: Prisma.CodingRunWhereInput;
+};
+export type CodingRunUpdateToOneWithWhereWithoutRunInput = {
+    where?: Prisma.CodingRunWhereInput;
+    data: Prisma.XOR<Prisma.CodingRunUpdateWithoutRunInput, Prisma.CodingRunUncheckedUpdateWithoutRunInput>;
+};
+export type CodingRunUpdateWithoutRunInput = {
+    task?: Prisma.StringFieldUpdateOperationsInput | string;
+    repository?: Prisma.StringFieldUpdateOperationsInput | string;
+    baseRef?: Prisma.StringFieldUpdateOperationsInput | string;
+    headRef?: Prisma.StringFieldUpdateOperationsInput | string;
+    provider?: Prisma.StringFieldUpdateOperationsInput | string;
+    model?: Prisma.StringFieldUpdateOperationsInput | string;
+    timeoutSec?: Prisma.IntFieldUpdateOperationsInput | number;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    protectedPaths?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    jobBackend?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    jobHandle?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
+    resultSchema?: Prisma.IntFieldUpdateOperationsInput | number;
+    failureCategory?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    diagnosticId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    workerImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    toolImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    budgetReservedUsd?: Prisma.DecimalFieldUpdateOperationsInput | runtime.Decimal | runtime.DecimalJsLike | number | string;
+    queuedAt?: Prisma.NullableDateTimeFieldUpdateOperationsInput | Date | string | null;
+    workspaceDiskMb?: Prisma.NullableIntFieldUpdateOperationsInput | number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: Prisma.BoolFieldUpdateOperationsInput | boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
+    updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
+    proxySession?: Prisma.CodingProxySessionUpdateOneWithoutRunNestedInput;
+    rootCodingRun?: Prisma.CodingRunUpdateOneWithoutContinuationsNestedInput;
+    continuations?: Prisma.CodingRunUpdateManyWithoutRootCodingRunNestedInput;
+    registryAllowances?: Prisma.RegistryAllowanceUpdateManyWithoutRunNestedInput;
+    registryFetches?: Prisma.RegistryFetchUpdateManyWithoutRunNestedInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUpdateManyWithoutRunNestedInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUpdateManyWithoutRunNestedInput;
+};
+export type CodingRunUncheckedUpdateWithoutRunInput = {
+    task?: Prisma.StringFieldUpdateOperationsInput | string;
+    repository?: Prisma.StringFieldUpdateOperationsInput | string;
+    baseRef?: Prisma.StringFieldUpdateOperationsInput | string;
+    headRef?: Prisma.StringFieldUpdateOperationsInput | string;
+    provider?: Prisma.StringFieldUpdateOperationsInput | string;
+    model?: Prisma.StringFieldUpdateOperationsInput | string;
+    timeoutSec?: Prisma.IntFieldUpdateOperationsInput | number;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    protectedPaths?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    jobBackend?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    jobHandle?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
+    resultSchema?: Prisma.IntFieldUpdateOperationsInput | number;
+    failureCategory?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    diagnosticId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    workerImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    toolImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    budgetReservedUsd?: Prisma.DecimalFieldUpdateOperationsInput | runtime.Decimal | runtime.DecimalJsLike | number | string;
+    queuedAt?: Prisma.NullableDateTimeFieldUpdateOperationsInput | Date | string | null;
+    workspaceDiskMb?: Prisma.NullableIntFieldUpdateOperationsInput | number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: Prisma.BoolFieldUpdateOperationsInput | boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
+    updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
+    rootCodingRunId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    proxySession?: Prisma.CodingProxySessionUncheckedUpdateOneWithoutRunNestedInput;
+    continuations?: Prisma.CodingRunUncheckedUpdateManyWithoutRootCodingRunNestedInput;
+    registryAllowances?: Prisma.RegistryAllowanceUncheckedUpdateManyWithoutRunNestedInput;
+    registryFetches?: Prisma.RegistryFetchUncheckedUpdateManyWithoutRunNestedInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUncheckedUpdateManyWithoutRunNestedInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUncheckedUpdateManyWithoutRunNestedInput;
+};
+export type CodingRunCreateWithoutContinuationsInput = {
+    task: string;
+    repository: string;
+    baseRef: string;
+    headRef: string;
+    provider: string;
+    model: string;
+    timeoutSec: number;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    protectedPaths: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    jobBackend?: string | null;
+    jobHandle?: string | null;
+    result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
+    resultSchema?: number;
+    failureCategory?: string | null;
+    diagnosticId?: string | null;
+    workerImage?: string | null;
+    toolImage?: string | null;
+    budgetReservedUsd: runtime.Decimal | runtime.DecimalJsLike | number | string;
+    queuedAt?: Date | string | null;
+    workspaceDiskMb?: number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    createdAt?: Date | string;
+    updatedAt?: Date | string;
+    run: Prisma.RunCreateNestedOneWithoutCodingRunInput;
+    proxySession?: Prisma.CodingProxySessionCreateNestedOneWithoutRunInput;
+    rootCodingRun?: Prisma.CodingRunCreateNestedOneWithoutContinuationsInput;
+    registryAllowances?: Prisma.RegistryAllowanceCreateNestedManyWithoutRunInput;
+    registryFetches?: Prisma.RegistryFetchCreateNestedManyWithoutRunInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionCreateNestedManyWithoutRunInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalCreateNestedManyWithoutRunInput;
+};
+export type CodingRunUncheckedCreateWithoutContinuationsInput = {
+    runId: string;
+    task: string;
+    repository: string;
+    baseRef: string;
+    headRef: string;
+    provider: string;
+    model: string;
+    timeoutSec: number;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    protectedPaths: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    jobBackend?: string | null;
+    jobHandle?: string | null;
+    result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
+    resultSchema?: number;
+    failureCategory?: string | null;
+    diagnosticId?: string | null;
+    workerImage?: string | null;
+    toolImage?: string | null;
+    budgetReservedUsd: runtime.Decimal | runtime.DecimalJsLike | number | string;
+    queuedAt?: Date | string | null;
+    workspaceDiskMb?: number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    createdAt?: Date | string;
+    updatedAt?: Date | string;
+    rootCodingRunId?: string | null;
+    proxySession?: Prisma.CodingProxySessionUncheckedCreateNestedOneWithoutRunInput;
+    registryAllowances?: Prisma.RegistryAllowanceUncheckedCreateNestedManyWithoutRunInput;
+    registryFetches?: Prisma.RegistryFetchUncheckedCreateNestedManyWithoutRunInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUncheckedCreateNestedManyWithoutRunInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUncheckedCreateNestedManyWithoutRunInput;
+};
+export type CodingRunCreateOrConnectWithoutContinuationsInput = {
+    where: Prisma.CodingRunWhereUniqueInput;
+    create: Prisma.XOR<Prisma.CodingRunCreateWithoutContinuationsInput, Prisma.CodingRunUncheckedCreateWithoutContinuationsInput>;
+};
+export type CodingRunCreateWithoutRootCodingRunInput = {
+    task: string;
+    repository: string;
+    baseRef: string;
+    headRef: string;
+    provider: string;
+    model: string;
+    timeoutSec: number;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    protectedPaths: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    jobBackend?: string | null;
+    jobHandle?: string | null;
+    result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
+    resultSchema?: number;
+    failureCategory?: string | null;
+    diagnosticId?: string | null;
+    workerImage?: string | null;
+    toolImage?: string | null;
+    budgetReservedUsd: runtime.Decimal | runtime.DecimalJsLike | number | string;
+    queuedAt?: Date | string | null;
+    workspaceDiskMb?: number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    createdAt?: Date | string;
+    updatedAt?: Date | string;
+    run: Prisma.RunCreateNestedOneWithoutCodingRunInput;
+    proxySession?: Prisma.CodingProxySessionCreateNestedOneWithoutRunInput;
+    continuations?: Prisma.CodingRunCreateNestedManyWithoutRootCodingRunInput;
+    registryAllowances?: Prisma.RegistryAllowanceCreateNestedManyWithoutRunInput;
+    registryFetches?: Prisma.RegistryFetchCreateNestedManyWithoutRunInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionCreateNestedManyWithoutRunInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalCreateNestedManyWithoutRunInput;
+};
+export type CodingRunUncheckedCreateWithoutRootCodingRunInput = {
+    runId: string;
+    task: string;
+    repository: string;
+    baseRef: string;
+    headRef: string;
+    provider: string;
+    model: string;
+    timeoutSec: number;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    protectedPaths: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    jobBackend?: string | null;
+    jobHandle?: string | null;
+    result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
+    resultSchema?: number;
+    failureCategory?: string | null;
+    diagnosticId?: string | null;
+    workerImage?: string | null;
+    toolImage?: string | null;
+    budgetReservedUsd: runtime.Decimal | runtime.DecimalJsLike | number | string;
+    queuedAt?: Date | string | null;
+    workspaceDiskMb?: number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    createdAt?: Date | string;
+    updatedAt?: Date | string;
+    proxySession?: Prisma.CodingProxySessionUncheckedCreateNestedOneWithoutRunInput;
+    continuations?: Prisma.CodingRunUncheckedCreateNestedManyWithoutRootCodingRunInput;
+    registryAllowances?: Prisma.RegistryAllowanceUncheckedCreateNestedManyWithoutRunInput;
+    registryFetches?: Prisma.RegistryFetchUncheckedCreateNestedManyWithoutRunInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUncheckedCreateNestedManyWithoutRunInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUncheckedCreateNestedManyWithoutRunInput;
+};
+export type CodingRunCreateOrConnectWithoutRootCodingRunInput = {
+    where: Prisma.CodingRunWhereUniqueInput;
+    create: Prisma.XOR<Prisma.CodingRunCreateWithoutRootCodingRunInput, Prisma.CodingRunUncheckedCreateWithoutRootCodingRunInput>;
+};
+export type CodingRunCreateManyRootCodingRunInputEnvelope = {
+    data: Prisma.CodingRunCreateManyRootCodingRunInput | Prisma.CodingRunCreateManyRootCodingRunInput[];
+    skipDuplicates?: boolean;
+};
+export type CodingRunUpsertWithoutContinuationsInput = {
+    update: Prisma.XOR<Prisma.CodingRunUpdateWithoutContinuationsInput, Prisma.CodingRunUncheckedUpdateWithoutContinuationsInput>;
+    create: Prisma.XOR<Prisma.CodingRunCreateWithoutContinuationsInput, Prisma.CodingRunUncheckedCreateWithoutContinuationsInput>;
+    where?: Prisma.CodingRunWhereInput;
+};
+export type CodingRunUpdateToOneWithWhereWithoutContinuationsInput = {
+    where?: Prisma.CodingRunWhereInput;
+    data: Prisma.XOR<Prisma.CodingRunUpdateWithoutContinuationsInput, Prisma.CodingRunUncheckedUpdateWithoutContinuationsInput>;
+};
+export type CodingRunUpdateWithoutContinuationsInput = {
+    task?: Prisma.StringFieldUpdateOperationsInput | string;
+    repository?: Prisma.StringFieldUpdateOperationsInput | string;
+    baseRef?: Prisma.StringFieldUpdateOperationsInput | string;
+    headRef?: Prisma.StringFieldUpdateOperationsInput | string;
+    provider?: Prisma.StringFieldUpdateOperationsInput | string;
+    model?: Prisma.StringFieldUpdateOperationsInput | string;
+    timeoutSec?: Prisma.IntFieldUpdateOperationsInput | number;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    protectedPaths?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    jobBackend?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    jobHandle?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
+    resultSchema?: Prisma.IntFieldUpdateOperationsInput | number;
+    failureCategory?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    diagnosticId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    workerImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    toolImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    budgetReservedUsd?: Prisma.DecimalFieldUpdateOperationsInput | runtime.Decimal | runtime.DecimalJsLike | number | string;
+    queuedAt?: Prisma.NullableDateTimeFieldUpdateOperationsInput | Date | string | null;
+    workspaceDiskMb?: Prisma.NullableIntFieldUpdateOperationsInput | number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: Prisma.BoolFieldUpdateOperationsInput | boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
+    updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
+    run?: Prisma.RunUpdateOneRequiredWithoutCodingRunNestedInput;
+    proxySession?: Prisma.CodingProxySessionUpdateOneWithoutRunNestedInput;
+    rootCodingRun?: Prisma.CodingRunUpdateOneWithoutContinuationsNestedInput;
+    registryAllowances?: Prisma.RegistryAllowanceUpdateManyWithoutRunNestedInput;
+    registryFetches?: Prisma.RegistryFetchUpdateManyWithoutRunNestedInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUpdateManyWithoutRunNestedInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUpdateManyWithoutRunNestedInput;
+};
+export type CodingRunUncheckedUpdateWithoutContinuationsInput = {
+    runId?: Prisma.StringFieldUpdateOperationsInput | string;
+    task?: Prisma.StringFieldUpdateOperationsInput | string;
+    repository?: Prisma.StringFieldUpdateOperationsInput | string;
+    baseRef?: Prisma.StringFieldUpdateOperationsInput | string;
+    headRef?: Prisma.StringFieldUpdateOperationsInput | string;
+    provider?: Prisma.StringFieldUpdateOperationsInput | string;
+    model?: Prisma.StringFieldUpdateOperationsInput | string;
+    timeoutSec?: Prisma.IntFieldUpdateOperationsInput | number;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    protectedPaths?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    jobBackend?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    jobHandle?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
+    resultSchema?: Prisma.IntFieldUpdateOperationsInput | number;
+    failureCategory?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    diagnosticId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    workerImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    toolImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    budgetReservedUsd?: Prisma.DecimalFieldUpdateOperationsInput | runtime.Decimal | runtime.DecimalJsLike | number | string;
+    queuedAt?: Prisma.NullableDateTimeFieldUpdateOperationsInput | Date | string | null;
+    workspaceDiskMb?: Prisma.NullableIntFieldUpdateOperationsInput | number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: Prisma.BoolFieldUpdateOperationsInput | boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
+    updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
+    rootCodingRunId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    proxySession?: Prisma.CodingProxySessionUncheckedUpdateOneWithoutRunNestedInput;
+    registryAllowances?: Prisma.RegistryAllowanceUncheckedUpdateManyWithoutRunNestedInput;
+    registryFetches?: Prisma.RegistryFetchUncheckedUpdateManyWithoutRunNestedInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUncheckedUpdateManyWithoutRunNestedInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUncheckedUpdateManyWithoutRunNestedInput;
+};
+export type CodingRunUpsertWithWhereUniqueWithoutRootCodingRunInput = {
+    where: Prisma.CodingRunWhereUniqueInput;
+    update: Prisma.XOR<Prisma.CodingRunUpdateWithoutRootCodingRunInput, Prisma.CodingRunUncheckedUpdateWithoutRootCodingRunInput>;
+    create: Prisma.XOR<Prisma.CodingRunCreateWithoutRootCodingRunInput, Prisma.CodingRunUncheckedCreateWithoutRootCodingRunInput>;
+};
+export type CodingRunUpdateWithWhereUniqueWithoutRootCodingRunInput = {
+    where: Prisma.CodingRunWhereUniqueInput;
+    data: Prisma.XOR<Prisma.CodingRunUpdateWithoutRootCodingRunInput, Prisma.CodingRunUncheckedUpdateWithoutRootCodingRunInput>;
+};
+export type CodingRunUpdateManyWithWhereWithoutRootCodingRunInput = {
+    where: Prisma.CodingRunScalarWhereInput;
+    data: Prisma.XOR<Prisma.CodingRunUpdateManyMutationInput, Prisma.CodingRunUncheckedUpdateManyWithoutRootCodingRunInput>;
+};
+export type CodingRunScalarWhereInput = {
+    AND?: Prisma.CodingRunScalarWhereInput | Prisma.CodingRunScalarWhereInput[];
+    OR?: Prisma.CodingRunScalarWhereInput[];
+    NOT?: Prisma.CodingRunScalarWhereInput | Prisma.CodingRunScalarWhereInput[];
+    runId?: Prisma.StringFilter<"CodingRun"> | string;
+    task?: Prisma.StringFilter<"CodingRun"> | string;
+    repository?: Prisma.StringFilter<"CodingRun"> | string;
+    baseRef?: Prisma.StringFilter<"CodingRun"> | string;
+    headRef?: Prisma.StringFilter<"CodingRun"> | string;
+    provider?: Prisma.StringFilter<"CodingRun"> | string;
+    model?: Prisma.StringFilter<"CodingRun"> | string;
+    timeoutSec?: Prisma.IntFilter<"CodingRun"> | number;
+    allowedEgress?: Prisma.JsonFilter<"CodingRun">;
+    protectedPaths?: Prisma.JsonFilter<"CodingRun">;
+    collectExclude?: Prisma.JsonFilter<"CodingRun">;
+    jobBackend?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
+    jobHandle?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
+    result?: Prisma.JsonNullableFilter<"CodingRun">;
+    resultSchema?: Prisma.IntFilter<"CodingRun"> | number;
+    failureCategory?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
+    diagnosticId?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
+    workerImage?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
+    toolImage?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
+    budgetReservedUsd?: Prisma.DecimalFilter<"CodingRun"> | runtime.Decimal | runtime.DecimalJsLike | number | string;
+    queuedAt?: Prisma.DateTimeNullableFilter<"CodingRun"> | Date | string | null;
+    workspaceDiskMb?: Prisma.IntNullableFilter<"CodingRun"> | number | null;
+    packageAllowlist?: Prisma.JsonFilter<"CodingRun">;
+    packagePolicy?: Prisma.JsonFilter<"CodingRun">;
+    debugTrace?: Prisma.BoolFilter<"CodingRun"> | boolean;
+    services?: Prisma.JsonFilter<"CodingRun">;
+    createdAt?: Prisma.DateTimeFilter<"CodingRun"> | Date | string;
+    updatedAt?: Prisma.DateTimeFilter<"CodingRun"> | Date | string;
+    rootCodingRunId?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
+};
+export type CodingRunCreateWithoutProxySessionInput = {
+    task: string;
+    repository: string;
+    baseRef: string;
+    headRef: string;
+    provider: string;
+    model: string;
+    timeoutSec: number;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    protectedPaths: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    jobBackend?: string | null;
+    jobHandle?: string | null;
+    result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
+    resultSchema?: number;
+    failureCategory?: string | null;
+    diagnosticId?: string | null;
+    workerImage?: string | null;
+    toolImage?: string | null;
+    budgetReservedUsd: runtime.Decimal | runtime.DecimalJsLike | number | string;
+    queuedAt?: Date | string | null;
+    workspaceDiskMb?: number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    createdAt?: Date | string;
+    updatedAt?: Date | string;
+    run: Prisma.RunCreateNestedOneWithoutCodingRunInput;
+    rootCodingRun?: Prisma.CodingRunCreateNestedOneWithoutContinuationsInput;
+    continuations?: Prisma.CodingRunCreateNestedManyWithoutRootCodingRunInput;
+    registryAllowances?: Prisma.RegistryAllowanceCreateNestedManyWithoutRunInput;
+    registryFetches?: Prisma.RegistryFetchCreateNestedManyWithoutRunInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionCreateNestedManyWithoutRunInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalCreateNestedManyWithoutRunInput;
+};
+export type CodingRunUncheckedCreateWithoutProxySessionInput = {
+    runId: string;
+    task: string;
+    repository: string;
+    baseRef: string;
+    headRef: string;
+    provider: string;
+    model: string;
+    timeoutSec: number;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    protectedPaths: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    jobBackend?: string | null;
+    jobHandle?: string | null;
+    result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
+    resultSchema?: number;
+    failureCategory?: string | null;
+    diagnosticId?: string | null;
+    workerImage?: string | null;
+    toolImage?: string | null;
+    budgetReservedUsd: runtime.Decimal | runtime.DecimalJsLike | number | string;
+    queuedAt?: Date | string | null;
+    workspaceDiskMb?: number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    createdAt?: Date | string;
+    updatedAt?: Date | string;
+    rootCodingRunId?: string | null;
+    continuations?: Prisma.CodingRunUncheckedCreateNestedManyWithoutRootCodingRunInput;
+    registryAllowances?: Prisma.RegistryAllowanceUncheckedCreateNestedManyWithoutRunInput;
+    registryFetches?: Prisma.RegistryFetchUncheckedCreateNestedManyWithoutRunInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUncheckedCreateNestedManyWithoutRunInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUncheckedCreateNestedManyWithoutRunInput;
+};
+export type CodingRunCreateOrConnectWithoutProxySessionInput = {
+    where: Prisma.CodingRunWhereUniqueInput;
+    create: Prisma.XOR<Prisma.CodingRunCreateWithoutProxySessionInput, Prisma.CodingRunUncheckedCreateWithoutProxySessionInput>;
+};
+export type CodingRunUpsertWithoutProxySessionInput = {
+    update: Prisma.XOR<Prisma.CodingRunUpdateWithoutProxySessionInput, Prisma.CodingRunUncheckedUpdateWithoutProxySessionInput>;
+    create: Prisma.XOR<Prisma.CodingRunCreateWithoutProxySessionInput, Prisma.CodingRunUncheckedCreateWithoutProxySessionInput>;
+    where?: Prisma.CodingRunWhereInput;
+};
+export type CodingRunUpdateToOneWithWhereWithoutProxySessionInput = {
+    where?: Prisma.CodingRunWhereInput;
+    data: Prisma.XOR<Prisma.CodingRunUpdateWithoutProxySessionInput, Prisma.CodingRunUncheckedUpdateWithoutProxySessionInput>;
+};
+export type CodingRunUpdateWithoutProxySessionInput = {
+    task?: Prisma.StringFieldUpdateOperationsInput | string;
+    repository?: Prisma.StringFieldUpdateOperationsInput | string;
+    baseRef?: Prisma.StringFieldUpdateOperationsInput | string;
+    headRef?: Prisma.StringFieldUpdateOperationsInput | string;
+    provider?: Prisma.StringFieldUpdateOperationsInput | string;
+    model?: Prisma.StringFieldUpdateOperationsInput | string;
+    timeoutSec?: Prisma.IntFieldUpdateOperationsInput | number;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    protectedPaths?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    jobBackend?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    jobHandle?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
+    resultSchema?: Prisma.IntFieldUpdateOperationsInput | number;
+    failureCategory?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    diagnosticId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    workerImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    toolImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    budgetReservedUsd?: Prisma.DecimalFieldUpdateOperationsInput | runtime.Decimal | runtime.DecimalJsLike | number | string;
+    queuedAt?: Prisma.NullableDateTimeFieldUpdateOperationsInput | Date | string | null;
+    workspaceDiskMb?: Prisma.NullableIntFieldUpdateOperationsInput | number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: Prisma.BoolFieldUpdateOperationsInput | boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
+    updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
+    run?: Prisma.RunUpdateOneRequiredWithoutCodingRunNestedInput;
+    rootCodingRun?: Prisma.CodingRunUpdateOneWithoutContinuationsNestedInput;
+    continuations?: Prisma.CodingRunUpdateManyWithoutRootCodingRunNestedInput;
+    registryAllowances?: Prisma.RegistryAllowanceUpdateManyWithoutRunNestedInput;
+    registryFetches?: Prisma.RegistryFetchUpdateManyWithoutRunNestedInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUpdateManyWithoutRunNestedInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUpdateManyWithoutRunNestedInput;
+};
+export type CodingRunUncheckedUpdateWithoutProxySessionInput = {
+    runId?: Prisma.StringFieldUpdateOperationsInput | string;
+    task?: Prisma.StringFieldUpdateOperationsInput | string;
+    repository?: Prisma.StringFieldUpdateOperationsInput | string;
+    baseRef?: Prisma.StringFieldUpdateOperationsInput | string;
+    headRef?: Prisma.StringFieldUpdateOperationsInput | string;
+    provider?: Prisma.StringFieldUpdateOperationsInput | string;
+    model?: Prisma.StringFieldUpdateOperationsInput | string;
+    timeoutSec?: Prisma.IntFieldUpdateOperationsInput | number;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    protectedPaths?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    jobBackend?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    jobHandle?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
+    resultSchema?: Prisma.IntFieldUpdateOperationsInput | number;
+    failureCategory?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    diagnosticId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    workerImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    toolImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    budgetReservedUsd?: Prisma.DecimalFieldUpdateOperationsInput | runtime.Decimal | runtime.DecimalJsLike | number | string;
+    queuedAt?: Prisma.NullableDateTimeFieldUpdateOperationsInput | Date | string | null;
+    workspaceDiskMb?: Prisma.NullableIntFieldUpdateOperationsInput | number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: Prisma.BoolFieldUpdateOperationsInput | boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
+    updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
+    rootCodingRunId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    continuations?: Prisma.CodingRunUncheckedUpdateManyWithoutRootCodingRunNestedInput;
+    registryAllowances?: Prisma.RegistryAllowanceUncheckedUpdateManyWithoutRunNestedInput;
+    registryFetches?: Prisma.RegistryFetchUncheckedUpdateManyWithoutRunNestedInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUncheckedUpdateManyWithoutRunNestedInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUncheckedUpdateManyWithoutRunNestedInput;
+};
+export type CodingRunCreateWithoutRegistryAllowancesInput = {
     task: string;
     repository: string;
     baseRef: string;
@@ -815,8 +1597,9 @@ export type CodingRunCreateWithoutRunInput = {
     provider: string;
     model: string;
     timeoutSec: number;
-    allowedEgress: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: string | null;
     jobHandle?: string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -824,16 +1607,26 @@ export type CodingRunCreateWithoutRunInput = {
     failureCategory?: string | null;
     diagnosticId?: string | null;
     workerImage?: string | null;
+    toolImage?: string | null;
     budgetReservedUsd: runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Date | string | null;
     workspaceDiskMb?: number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Date | string;
     updatedAt?: Date | string;
+    run: Prisma.RunCreateNestedOneWithoutCodingRunInput;
     proxySession?: Prisma.CodingProxySessionCreateNestedOneWithoutRunInput;
     rootCodingRun?: Prisma.CodingRunCreateNestedOneWithoutContinuationsInput;
     continuations?: Prisma.CodingRunCreateNestedManyWithoutRootCodingRunInput;
+    registryFetches?: Prisma.RegistryFetchCreateNestedManyWithoutRunInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionCreateNestedManyWithoutRunInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalCreateNestedManyWithoutRunInput;
 };
-export type CodingRunUncheckedCreateWithoutRunInput = {
+export type CodingRunUncheckedCreateWithoutRegistryAllowancesInput = {
+    runId: string;
     task: string;
     repository: string;
     baseRef: string;
@@ -841,8 +1634,9 @@ export type CodingRunUncheckedCreateWithoutRunInput = {
     provider: string;
     model: string;
     timeoutSec: number;
-    allowedEgress: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: string | null;
     jobHandle?: string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -850,29 +1644,37 @@ export type CodingRunUncheckedCreateWithoutRunInput = {
     failureCategory?: string | null;
     diagnosticId?: string | null;
     workerImage?: string | null;
+    toolImage?: string | null;
     budgetReservedUsd: runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Date | string | null;
     workspaceDiskMb?: number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Date | string;
     updatedAt?: Date | string;
     rootCodingRunId?: string | null;
     proxySession?: Prisma.CodingProxySessionUncheckedCreateNestedOneWithoutRunInput;
     continuations?: Prisma.CodingRunUncheckedCreateNestedManyWithoutRootCodingRunInput;
+    registryFetches?: Prisma.RegistryFetchUncheckedCreateNestedManyWithoutRunInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUncheckedCreateNestedManyWithoutRunInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUncheckedCreateNestedManyWithoutRunInput;
 };
-export type CodingRunCreateOrConnectWithoutRunInput = {
+export type CodingRunCreateOrConnectWithoutRegistryAllowancesInput = {
     where: Prisma.CodingRunWhereUniqueInput;
-    create: Prisma.XOR<Prisma.CodingRunCreateWithoutRunInput, Prisma.CodingRunUncheckedCreateWithoutRunInput>;
+    create: Prisma.XOR<Prisma.CodingRunCreateWithoutRegistryAllowancesInput, Prisma.CodingRunUncheckedCreateWithoutRegistryAllowancesInput>;
 };
-export type CodingRunUpsertWithoutRunInput = {
-    update: Prisma.XOR<Prisma.CodingRunUpdateWithoutRunInput, Prisma.CodingRunUncheckedUpdateWithoutRunInput>;
-    create: Prisma.XOR<Prisma.CodingRunCreateWithoutRunInput, Prisma.CodingRunUncheckedCreateWithoutRunInput>;
+export type CodingRunUpsertWithoutRegistryAllowancesInput = {
+    update: Prisma.XOR<Prisma.CodingRunUpdateWithoutRegistryAllowancesInput, Prisma.CodingRunUncheckedUpdateWithoutRegistryAllowancesInput>;
+    create: Prisma.XOR<Prisma.CodingRunCreateWithoutRegistryAllowancesInput, Prisma.CodingRunUncheckedCreateWithoutRegistryAllowancesInput>;
     where?: Prisma.CodingRunWhereInput;
 };
-export type CodingRunUpdateToOneWithWhereWithoutRunInput = {
+export type CodingRunUpdateToOneWithWhereWithoutRegistryAllowancesInput = {
     where?: Prisma.CodingRunWhereInput;
-    data: Prisma.XOR<Prisma.CodingRunUpdateWithoutRunInput, Prisma.CodingRunUncheckedUpdateWithoutRunInput>;
+    data: Prisma.XOR<Prisma.CodingRunUpdateWithoutRegistryAllowancesInput, Prisma.CodingRunUncheckedUpdateWithoutRegistryAllowancesInput>;
 };
-export type CodingRunUpdateWithoutRunInput = {
+export type CodingRunUpdateWithoutRegistryAllowancesInput = {
     task?: Prisma.StringFieldUpdateOperationsInput | string;
     repository?: Prisma.StringFieldUpdateOperationsInput | string;
     baseRef?: Prisma.StringFieldUpdateOperationsInput | string;
@@ -882,6 +1684,7 @@ export type CodingRunUpdateWithoutRunInput = {
     timeoutSec?: Prisma.IntFieldUpdateOperationsInput | number;
     allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     jobHandle?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -889,16 +1692,26 @@ export type CodingRunUpdateWithoutRunInput = {
     failureCategory?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     diagnosticId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     workerImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    toolImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     budgetReservedUsd?: Prisma.DecimalFieldUpdateOperationsInput | runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Prisma.NullableDateTimeFieldUpdateOperationsInput | Date | string | null;
     workspaceDiskMb?: Prisma.NullableIntFieldUpdateOperationsInput | number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: Prisma.BoolFieldUpdateOperationsInput | boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
+    run?: Prisma.RunUpdateOneRequiredWithoutCodingRunNestedInput;
     proxySession?: Prisma.CodingProxySessionUpdateOneWithoutRunNestedInput;
     rootCodingRun?: Prisma.CodingRunUpdateOneWithoutContinuationsNestedInput;
     continuations?: Prisma.CodingRunUpdateManyWithoutRootCodingRunNestedInput;
+    registryFetches?: Prisma.RegistryFetchUpdateManyWithoutRunNestedInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUpdateManyWithoutRunNestedInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUpdateManyWithoutRunNestedInput;
 };
-export type CodingRunUncheckedUpdateWithoutRunInput = {
+export type CodingRunUncheckedUpdateWithoutRegistryAllowancesInput = {
+    runId?: Prisma.StringFieldUpdateOperationsInput | string;
     task?: Prisma.StringFieldUpdateOperationsInput | string;
     repository?: Prisma.StringFieldUpdateOperationsInput | string;
     baseRef?: Prisma.StringFieldUpdateOperationsInput | string;
@@ -908,6 +1721,7 @@ export type CodingRunUncheckedUpdateWithoutRunInput = {
     timeoutSec?: Prisma.IntFieldUpdateOperationsInput | number;
     allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     jobHandle?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -915,16 +1729,24 @@ export type CodingRunUncheckedUpdateWithoutRunInput = {
     failureCategory?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     diagnosticId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     workerImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    toolImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     budgetReservedUsd?: Prisma.DecimalFieldUpdateOperationsInput | runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Prisma.NullableDateTimeFieldUpdateOperationsInput | Date | string | null;
     workspaceDiskMb?: Prisma.NullableIntFieldUpdateOperationsInput | number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: Prisma.BoolFieldUpdateOperationsInput | boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     rootCodingRunId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     proxySession?: Prisma.CodingProxySessionUncheckedUpdateOneWithoutRunNestedInput;
     continuations?: Prisma.CodingRunUncheckedUpdateManyWithoutRootCodingRunNestedInput;
+    registryFetches?: Prisma.RegistryFetchUncheckedUpdateManyWithoutRunNestedInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUncheckedUpdateManyWithoutRunNestedInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUncheckedUpdateManyWithoutRunNestedInput;
 };
-export type CodingRunCreateWithoutContinuationsInput = {
+export type CodingRunCreateWithoutRegistryFetchesInput = {
     task: string;
     repository: string;
     baseRef: string;
@@ -932,8 +1754,9 @@ export type CodingRunCreateWithoutContinuationsInput = {
     provider: string;
     model: string;
     timeoutSec: number;
-    allowedEgress: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: string | null;
     jobHandle?: string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -941,16 +1764,25 @@ export type CodingRunCreateWithoutContinuationsInput = {
     failureCategory?: string | null;
     diagnosticId?: string | null;
     workerImage?: string | null;
+    toolImage?: string | null;
     budgetReservedUsd: runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Date | string | null;
     workspaceDiskMb?: number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Date | string;
     updatedAt?: Date | string;
     run: Prisma.RunCreateNestedOneWithoutCodingRunInput;
     proxySession?: Prisma.CodingProxySessionCreateNestedOneWithoutRunInput;
     rootCodingRun?: Prisma.CodingRunCreateNestedOneWithoutContinuationsInput;
+    continuations?: Prisma.CodingRunCreateNestedManyWithoutRootCodingRunInput;
+    registryAllowances?: Prisma.RegistryAllowanceCreateNestedManyWithoutRunInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionCreateNestedManyWithoutRunInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalCreateNestedManyWithoutRunInput;
 };
-export type CodingRunUncheckedCreateWithoutContinuationsInput = {
+export type CodingRunUncheckedCreateWithoutRegistryFetchesInput = {
     runId: string;
     task: string;
     repository: string;
@@ -959,8 +1791,9 @@ export type CodingRunUncheckedCreateWithoutContinuationsInput = {
     provider: string;
     model: string;
     timeoutSec: number;
-    allowedEgress: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: string | null;
     jobHandle?: string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -968,19 +1801,109 @@ export type CodingRunUncheckedCreateWithoutContinuationsInput = {
     failureCategory?: string | null;
     diagnosticId?: string | null;
     workerImage?: string | null;
+    toolImage?: string | null;
     budgetReservedUsd: runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Date | string | null;
     workspaceDiskMb?: number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Date | string;
     updatedAt?: Date | string;
     rootCodingRunId?: string | null;
     proxySession?: Prisma.CodingProxySessionUncheckedCreateNestedOneWithoutRunInput;
+    continuations?: Prisma.CodingRunUncheckedCreateNestedManyWithoutRootCodingRunInput;
+    registryAllowances?: Prisma.RegistryAllowanceUncheckedCreateNestedManyWithoutRunInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUncheckedCreateNestedManyWithoutRunInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUncheckedCreateNestedManyWithoutRunInput;
 };
-export type CodingRunCreateOrConnectWithoutContinuationsInput = {
+export type CodingRunCreateOrConnectWithoutRegistryFetchesInput = {
     where: Prisma.CodingRunWhereUniqueInput;
-    create: Prisma.XOR<Prisma.CodingRunCreateWithoutContinuationsInput, Prisma.CodingRunUncheckedCreateWithoutContinuationsInput>;
+    create: Prisma.XOR<Prisma.CodingRunCreateWithoutRegistryFetchesInput, Prisma.CodingRunUncheckedCreateWithoutRegistryFetchesInput>;
 };
-export type CodingRunCreateWithoutRootCodingRunInput = {
+export type CodingRunUpsertWithoutRegistryFetchesInput = {
+    update: Prisma.XOR<Prisma.CodingRunUpdateWithoutRegistryFetchesInput, Prisma.CodingRunUncheckedUpdateWithoutRegistryFetchesInput>;
+    create: Prisma.XOR<Prisma.CodingRunCreateWithoutRegistryFetchesInput, Prisma.CodingRunUncheckedCreateWithoutRegistryFetchesInput>;
+    where?: Prisma.CodingRunWhereInput;
+};
+export type CodingRunUpdateToOneWithWhereWithoutRegistryFetchesInput = {
+    where?: Prisma.CodingRunWhereInput;
+    data: Prisma.XOR<Prisma.CodingRunUpdateWithoutRegistryFetchesInput, Prisma.CodingRunUncheckedUpdateWithoutRegistryFetchesInput>;
+};
+export type CodingRunUpdateWithoutRegistryFetchesInput = {
+    task?: Prisma.StringFieldUpdateOperationsInput | string;
+    repository?: Prisma.StringFieldUpdateOperationsInput | string;
+    baseRef?: Prisma.StringFieldUpdateOperationsInput | string;
+    headRef?: Prisma.StringFieldUpdateOperationsInput | string;
+    provider?: Prisma.StringFieldUpdateOperationsInput | string;
+    model?: Prisma.StringFieldUpdateOperationsInput | string;
+    timeoutSec?: Prisma.IntFieldUpdateOperationsInput | number;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    protectedPaths?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    jobBackend?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    jobHandle?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
+    resultSchema?: Prisma.IntFieldUpdateOperationsInput | number;
+    failureCategory?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    diagnosticId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    workerImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    toolImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    budgetReservedUsd?: Prisma.DecimalFieldUpdateOperationsInput | runtime.Decimal | runtime.DecimalJsLike | number | string;
+    queuedAt?: Prisma.NullableDateTimeFieldUpdateOperationsInput | Date | string | null;
+    workspaceDiskMb?: Prisma.NullableIntFieldUpdateOperationsInput | number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: Prisma.BoolFieldUpdateOperationsInput | boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
+    updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
+    run?: Prisma.RunUpdateOneRequiredWithoutCodingRunNestedInput;
+    proxySession?: Prisma.CodingProxySessionUpdateOneWithoutRunNestedInput;
+    rootCodingRun?: Prisma.CodingRunUpdateOneWithoutContinuationsNestedInput;
+    continuations?: Prisma.CodingRunUpdateManyWithoutRootCodingRunNestedInput;
+    registryAllowances?: Prisma.RegistryAllowanceUpdateManyWithoutRunNestedInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUpdateManyWithoutRunNestedInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUpdateManyWithoutRunNestedInput;
+};
+export type CodingRunUncheckedUpdateWithoutRegistryFetchesInput = {
+    runId?: Prisma.StringFieldUpdateOperationsInput | string;
+    task?: Prisma.StringFieldUpdateOperationsInput | string;
+    repository?: Prisma.StringFieldUpdateOperationsInput | string;
+    baseRef?: Prisma.StringFieldUpdateOperationsInput | string;
+    headRef?: Prisma.StringFieldUpdateOperationsInput | string;
+    provider?: Prisma.StringFieldUpdateOperationsInput | string;
+    model?: Prisma.StringFieldUpdateOperationsInput | string;
+    timeoutSec?: Prisma.IntFieldUpdateOperationsInput | number;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    protectedPaths?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    jobBackend?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    jobHandle?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
+    resultSchema?: Prisma.IntFieldUpdateOperationsInput | number;
+    failureCategory?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    diagnosticId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    workerImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    toolImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    budgetReservedUsd?: Prisma.DecimalFieldUpdateOperationsInput | runtime.Decimal | runtime.DecimalJsLike | number | string;
+    queuedAt?: Prisma.NullableDateTimeFieldUpdateOperationsInput | Date | string | null;
+    workspaceDiskMb?: Prisma.NullableIntFieldUpdateOperationsInput | number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: Prisma.BoolFieldUpdateOperationsInput | boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
+    updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
+    rootCodingRunId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    proxySession?: Prisma.CodingProxySessionUncheckedUpdateOneWithoutRunNestedInput;
+    continuations?: Prisma.CodingRunUncheckedUpdateManyWithoutRootCodingRunNestedInput;
+    registryAllowances?: Prisma.RegistryAllowanceUncheckedUpdateManyWithoutRunNestedInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUncheckedUpdateManyWithoutRunNestedInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUncheckedUpdateManyWithoutRunNestedInput;
+};
+export type CodingRunCreateWithoutRegistryApprovedVersionsInput = {
     task: string;
     repository: string;
     baseRef: string;
@@ -988,8 +1911,9 @@ export type CodingRunCreateWithoutRootCodingRunInput = {
     provider: string;
     model: string;
     timeoutSec: number;
-    allowedEgress: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: string | null;
     jobHandle?: string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -997,16 +1921,25 @@ export type CodingRunCreateWithoutRootCodingRunInput = {
     failureCategory?: string | null;
     diagnosticId?: string | null;
     workerImage?: string | null;
+    toolImage?: string | null;
     budgetReservedUsd: runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Date | string | null;
     workspaceDiskMb?: number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Date | string;
     updatedAt?: Date | string;
     run: Prisma.RunCreateNestedOneWithoutCodingRunInput;
     proxySession?: Prisma.CodingProxySessionCreateNestedOneWithoutRunInput;
+    rootCodingRun?: Prisma.CodingRunCreateNestedOneWithoutContinuationsInput;
     continuations?: Prisma.CodingRunCreateNestedManyWithoutRootCodingRunInput;
+    registryAllowances?: Prisma.RegistryAllowanceCreateNestedManyWithoutRunInput;
+    registryFetches?: Prisma.RegistryFetchCreateNestedManyWithoutRunInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalCreateNestedManyWithoutRunInput;
 };
-export type CodingRunUncheckedCreateWithoutRootCodingRunInput = {
+export type CodingRunUncheckedCreateWithoutRegistryApprovedVersionsInput = {
     runId: string;
     task: string;
     repository: string;
@@ -1015,8 +1948,9 @@ export type CodingRunUncheckedCreateWithoutRootCodingRunInput = {
     provider: string;
     model: string;
     timeoutSec: number;
-    allowedEgress: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: string | null;
     jobHandle?: string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -1024,32 +1958,37 @@ export type CodingRunUncheckedCreateWithoutRootCodingRunInput = {
     failureCategory?: string | null;
     diagnosticId?: string | null;
     workerImage?: string | null;
+    toolImage?: string | null;
     budgetReservedUsd: runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Date | string | null;
     workspaceDiskMb?: number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Date | string;
     updatedAt?: Date | string;
+    rootCodingRunId?: string | null;
     proxySession?: Prisma.CodingProxySessionUncheckedCreateNestedOneWithoutRunInput;
     continuations?: Prisma.CodingRunUncheckedCreateNestedManyWithoutRootCodingRunInput;
+    registryAllowances?: Prisma.RegistryAllowanceUncheckedCreateNestedManyWithoutRunInput;
+    registryFetches?: Prisma.RegistryFetchUncheckedCreateNestedManyWithoutRunInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUncheckedCreateNestedManyWithoutRunInput;
 };
-export type CodingRunCreateOrConnectWithoutRootCodingRunInput = {
+export type CodingRunCreateOrConnectWithoutRegistryApprovedVersionsInput = {
     where: Prisma.CodingRunWhereUniqueInput;
-    create: Prisma.XOR<Prisma.CodingRunCreateWithoutRootCodingRunInput, Prisma.CodingRunUncheckedCreateWithoutRootCodingRunInput>;
+    create: Prisma.XOR<Prisma.CodingRunCreateWithoutRegistryApprovedVersionsInput, Prisma.CodingRunUncheckedCreateWithoutRegistryApprovedVersionsInput>;
 };
-export type CodingRunCreateManyRootCodingRunInputEnvelope = {
-    data: Prisma.CodingRunCreateManyRootCodingRunInput | Prisma.CodingRunCreateManyRootCodingRunInput[];
-    skipDuplicates?: boolean;
-};
-export type CodingRunUpsertWithoutContinuationsInput = {
-    update: Prisma.XOR<Prisma.CodingRunUpdateWithoutContinuationsInput, Prisma.CodingRunUncheckedUpdateWithoutContinuationsInput>;
-    create: Prisma.XOR<Prisma.CodingRunCreateWithoutContinuationsInput, Prisma.CodingRunUncheckedCreateWithoutContinuationsInput>;
+export type CodingRunUpsertWithoutRegistryApprovedVersionsInput = {
+    update: Prisma.XOR<Prisma.CodingRunUpdateWithoutRegistryApprovedVersionsInput, Prisma.CodingRunUncheckedUpdateWithoutRegistryApprovedVersionsInput>;
+    create: Prisma.XOR<Prisma.CodingRunCreateWithoutRegistryApprovedVersionsInput, Prisma.CodingRunUncheckedCreateWithoutRegistryApprovedVersionsInput>;
     where?: Prisma.CodingRunWhereInput;
 };
-export type CodingRunUpdateToOneWithWhereWithoutContinuationsInput = {
+export type CodingRunUpdateToOneWithWhereWithoutRegistryApprovedVersionsInput = {
     where?: Prisma.CodingRunWhereInput;
-    data: Prisma.XOR<Prisma.CodingRunUpdateWithoutContinuationsInput, Prisma.CodingRunUncheckedUpdateWithoutContinuationsInput>;
+    data: Prisma.XOR<Prisma.CodingRunUpdateWithoutRegistryApprovedVersionsInput, Prisma.CodingRunUncheckedUpdateWithoutRegistryApprovedVersionsInput>;
 };
-export type CodingRunUpdateWithoutContinuationsInput = {
+export type CodingRunUpdateWithoutRegistryApprovedVersionsInput = {
     task?: Prisma.StringFieldUpdateOperationsInput | string;
     repository?: Prisma.StringFieldUpdateOperationsInput | string;
     baseRef?: Prisma.StringFieldUpdateOperationsInput | string;
@@ -1059,6 +1998,7 @@ export type CodingRunUpdateWithoutContinuationsInput = {
     timeoutSec?: Prisma.IntFieldUpdateOperationsInput | number;
     allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     jobHandle?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -1066,16 +2006,25 @@ export type CodingRunUpdateWithoutContinuationsInput = {
     failureCategory?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     diagnosticId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     workerImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    toolImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     budgetReservedUsd?: Prisma.DecimalFieldUpdateOperationsInput | runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Prisma.NullableDateTimeFieldUpdateOperationsInput | Date | string | null;
     workspaceDiskMb?: Prisma.NullableIntFieldUpdateOperationsInput | number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: Prisma.BoolFieldUpdateOperationsInput | boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     run?: Prisma.RunUpdateOneRequiredWithoutCodingRunNestedInput;
     proxySession?: Prisma.CodingProxySessionUpdateOneWithoutRunNestedInput;
     rootCodingRun?: Prisma.CodingRunUpdateOneWithoutContinuationsNestedInput;
+    continuations?: Prisma.CodingRunUpdateManyWithoutRootCodingRunNestedInput;
+    registryAllowances?: Prisma.RegistryAllowanceUpdateManyWithoutRunNestedInput;
+    registryFetches?: Prisma.RegistryFetchUpdateManyWithoutRunNestedInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUpdateManyWithoutRunNestedInput;
 };
-export type CodingRunUncheckedUpdateWithoutContinuationsInput = {
+export type CodingRunUncheckedUpdateWithoutRegistryApprovedVersionsInput = {
     runId?: Prisma.StringFieldUpdateOperationsInput | string;
     task?: Prisma.StringFieldUpdateOperationsInput | string;
     repository?: Prisma.StringFieldUpdateOperationsInput | string;
@@ -1086,6 +2035,7 @@ export type CodingRunUncheckedUpdateWithoutContinuationsInput = {
     timeoutSec?: Prisma.IntFieldUpdateOperationsInput | number;
     allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     jobHandle?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -1093,56 +2043,24 @@ export type CodingRunUncheckedUpdateWithoutContinuationsInput = {
     failureCategory?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     diagnosticId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     workerImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    toolImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     budgetReservedUsd?: Prisma.DecimalFieldUpdateOperationsInput | runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Prisma.NullableDateTimeFieldUpdateOperationsInput | Date | string | null;
     workspaceDiskMb?: Prisma.NullableIntFieldUpdateOperationsInput | number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: Prisma.BoolFieldUpdateOperationsInput | boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     rootCodingRunId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     proxySession?: Prisma.CodingProxySessionUncheckedUpdateOneWithoutRunNestedInput;
+    continuations?: Prisma.CodingRunUncheckedUpdateManyWithoutRootCodingRunNestedInput;
+    registryAllowances?: Prisma.RegistryAllowanceUncheckedUpdateManyWithoutRunNestedInput;
+    registryFetches?: Prisma.RegistryFetchUncheckedUpdateManyWithoutRunNestedInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUncheckedUpdateManyWithoutRunNestedInput;
 };
-export type CodingRunUpsertWithWhereUniqueWithoutRootCodingRunInput = {
-    where: Prisma.CodingRunWhereUniqueInput;
-    update: Prisma.XOR<Prisma.CodingRunUpdateWithoutRootCodingRunInput, Prisma.CodingRunUncheckedUpdateWithoutRootCodingRunInput>;
-    create: Prisma.XOR<Prisma.CodingRunCreateWithoutRootCodingRunInput, Prisma.CodingRunUncheckedCreateWithoutRootCodingRunInput>;
-};
-export type CodingRunUpdateWithWhereUniqueWithoutRootCodingRunInput = {
-    where: Prisma.CodingRunWhereUniqueInput;
-    data: Prisma.XOR<Prisma.CodingRunUpdateWithoutRootCodingRunInput, Prisma.CodingRunUncheckedUpdateWithoutRootCodingRunInput>;
-};
-export type CodingRunUpdateManyWithWhereWithoutRootCodingRunInput = {
-    where: Prisma.CodingRunScalarWhereInput;
-    data: Prisma.XOR<Prisma.CodingRunUpdateManyMutationInput, Prisma.CodingRunUncheckedUpdateManyWithoutRootCodingRunInput>;
-};
-export type CodingRunScalarWhereInput = {
-    AND?: Prisma.CodingRunScalarWhereInput | Prisma.CodingRunScalarWhereInput[];
-    OR?: Prisma.CodingRunScalarWhereInput[];
-    NOT?: Prisma.CodingRunScalarWhereInput | Prisma.CodingRunScalarWhereInput[];
-    runId?: Prisma.StringFilter<"CodingRun"> | string;
-    task?: Prisma.StringFilter<"CodingRun"> | string;
-    repository?: Prisma.StringFilter<"CodingRun"> | string;
-    baseRef?: Prisma.StringFilter<"CodingRun"> | string;
-    headRef?: Prisma.StringFilter<"CodingRun"> | string;
-    provider?: Prisma.StringFilter<"CodingRun"> | string;
-    model?: Prisma.StringFilter<"CodingRun"> | string;
-    timeoutSec?: Prisma.IntFilter<"CodingRun"> | number;
-    allowedEgress?: Prisma.JsonFilter<"CodingRun">;
-    protectedPaths?: Prisma.JsonFilter<"CodingRun">;
-    jobBackend?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
-    jobHandle?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
-    result?: Prisma.JsonNullableFilter<"CodingRun">;
-    resultSchema?: Prisma.IntFilter<"CodingRun"> | number;
-    failureCategory?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
-    diagnosticId?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
-    workerImage?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
-    budgetReservedUsd?: Prisma.DecimalFilter<"CodingRun"> | runtime.Decimal | runtime.DecimalJsLike | number | string;
-    queuedAt?: Prisma.DateTimeNullableFilter<"CodingRun"> | Date | string | null;
-    workspaceDiskMb?: Prisma.IntNullableFilter<"CodingRun"> | number | null;
-    createdAt?: Prisma.DateTimeFilter<"CodingRun"> | Date | string;
-    updatedAt?: Prisma.DateTimeFilter<"CodingRun"> | Date | string;
-    rootCodingRunId?: Prisma.StringNullableFilter<"CodingRun"> | string | null;
-};
-export type CodingRunCreateWithoutProxySessionInput = {
+export type CodingRunCreateWithoutRegistryPlanRefusalsInput = {
     task: string;
     repository: string;
     baseRef: string;
@@ -1150,8 +2068,9 @@ export type CodingRunCreateWithoutProxySessionInput = {
     provider: string;
     model: string;
     timeoutSec: number;
-    allowedEgress: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: string | null;
     jobHandle?: string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -1159,16 +2078,25 @@ export type CodingRunCreateWithoutProxySessionInput = {
     failureCategory?: string | null;
     diagnosticId?: string | null;
     workerImage?: string | null;
+    toolImage?: string | null;
     budgetReservedUsd: runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Date | string | null;
     workspaceDiskMb?: number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Date | string;
     updatedAt?: Date | string;
     run: Prisma.RunCreateNestedOneWithoutCodingRunInput;
+    proxySession?: Prisma.CodingProxySessionCreateNestedOneWithoutRunInput;
     rootCodingRun?: Prisma.CodingRunCreateNestedOneWithoutContinuationsInput;
     continuations?: Prisma.CodingRunCreateNestedManyWithoutRootCodingRunInput;
+    registryAllowances?: Prisma.RegistryAllowanceCreateNestedManyWithoutRunInput;
+    registryFetches?: Prisma.RegistryFetchCreateNestedManyWithoutRunInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionCreateNestedManyWithoutRunInput;
 };
-export type CodingRunUncheckedCreateWithoutProxySessionInput = {
+export type CodingRunUncheckedCreateWithoutRegistryPlanRefusalsInput = {
     runId: string;
     task: string;
     repository: string;
@@ -1177,8 +2105,9 @@ export type CodingRunUncheckedCreateWithoutProxySessionInput = {
     provider: string;
     model: string;
     timeoutSec: number;
-    allowedEgress: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: string | null;
     jobHandle?: string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -1186,28 +2115,37 @@ export type CodingRunUncheckedCreateWithoutProxySessionInput = {
     failureCategory?: string | null;
     diagnosticId?: string | null;
     workerImage?: string | null;
+    toolImage?: string | null;
     budgetReservedUsd: runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Date | string | null;
     workspaceDiskMb?: number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Date | string;
     updatedAt?: Date | string;
     rootCodingRunId?: string | null;
+    proxySession?: Prisma.CodingProxySessionUncheckedCreateNestedOneWithoutRunInput;
     continuations?: Prisma.CodingRunUncheckedCreateNestedManyWithoutRootCodingRunInput;
+    registryAllowances?: Prisma.RegistryAllowanceUncheckedCreateNestedManyWithoutRunInput;
+    registryFetches?: Prisma.RegistryFetchUncheckedCreateNestedManyWithoutRunInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUncheckedCreateNestedManyWithoutRunInput;
 };
-export type CodingRunCreateOrConnectWithoutProxySessionInput = {
+export type CodingRunCreateOrConnectWithoutRegistryPlanRefusalsInput = {
     where: Prisma.CodingRunWhereUniqueInput;
-    create: Prisma.XOR<Prisma.CodingRunCreateWithoutProxySessionInput, Prisma.CodingRunUncheckedCreateWithoutProxySessionInput>;
+    create: Prisma.XOR<Prisma.CodingRunCreateWithoutRegistryPlanRefusalsInput, Prisma.CodingRunUncheckedCreateWithoutRegistryPlanRefusalsInput>;
 };
-export type CodingRunUpsertWithoutProxySessionInput = {
-    update: Prisma.XOR<Prisma.CodingRunUpdateWithoutProxySessionInput, Prisma.CodingRunUncheckedUpdateWithoutProxySessionInput>;
-    create: Prisma.XOR<Prisma.CodingRunCreateWithoutProxySessionInput, Prisma.CodingRunUncheckedCreateWithoutProxySessionInput>;
+export type CodingRunUpsertWithoutRegistryPlanRefusalsInput = {
+    update: Prisma.XOR<Prisma.CodingRunUpdateWithoutRegistryPlanRefusalsInput, Prisma.CodingRunUncheckedUpdateWithoutRegistryPlanRefusalsInput>;
+    create: Prisma.XOR<Prisma.CodingRunCreateWithoutRegistryPlanRefusalsInput, Prisma.CodingRunUncheckedCreateWithoutRegistryPlanRefusalsInput>;
     where?: Prisma.CodingRunWhereInput;
 };
-export type CodingRunUpdateToOneWithWhereWithoutProxySessionInput = {
+export type CodingRunUpdateToOneWithWhereWithoutRegistryPlanRefusalsInput = {
     where?: Prisma.CodingRunWhereInput;
-    data: Prisma.XOR<Prisma.CodingRunUpdateWithoutProxySessionInput, Prisma.CodingRunUncheckedUpdateWithoutProxySessionInput>;
+    data: Prisma.XOR<Prisma.CodingRunUpdateWithoutRegistryPlanRefusalsInput, Prisma.CodingRunUncheckedUpdateWithoutRegistryPlanRefusalsInput>;
 };
-export type CodingRunUpdateWithoutProxySessionInput = {
+export type CodingRunUpdateWithoutRegistryPlanRefusalsInput = {
     task?: Prisma.StringFieldUpdateOperationsInput | string;
     repository?: Prisma.StringFieldUpdateOperationsInput | string;
     baseRef?: Prisma.StringFieldUpdateOperationsInput | string;
@@ -1217,6 +2155,7 @@ export type CodingRunUpdateWithoutProxySessionInput = {
     timeoutSec?: Prisma.IntFieldUpdateOperationsInput | number;
     allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     jobHandle?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -1224,16 +2163,25 @@ export type CodingRunUpdateWithoutProxySessionInput = {
     failureCategory?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     diagnosticId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     workerImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    toolImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     budgetReservedUsd?: Prisma.DecimalFieldUpdateOperationsInput | runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Prisma.NullableDateTimeFieldUpdateOperationsInput | Date | string | null;
     workspaceDiskMb?: Prisma.NullableIntFieldUpdateOperationsInput | number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: Prisma.BoolFieldUpdateOperationsInput | boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     run?: Prisma.RunUpdateOneRequiredWithoutCodingRunNestedInput;
+    proxySession?: Prisma.CodingProxySessionUpdateOneWithoutRunNestedInput;
     rootCodingRun?: Prisma.CodingRunUpdateOneWithoutContinuationsNestedInput;
     continuations?: Prisma.CodingRunUpdateManyWithoutRootCodingRunNestedInput;
+    registryAllowances?: Prisma.RegistryAllowanceUpdateManyWithoutRunNestedInput;
+    registryFetches?: Prisma.RegistryFetchUpdateManyWithoutRunNestedInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUpdateManyWithoutRunNestedInput;
 };
-export type CodingRunUncheckedUpdateWithoutProxySessionInput = {
+export type CodingRunUncheckedUpdateWithoutRegistryPlanRefusalsInput = {
     runId?: Prisma.StringFieldUpdateOperationsInput | string;
     task?: Prisma.StringFieldUpdateOperationsInput | string;
     repository?: Prisma.StringFieldUpdateOperationsInput | string;
@@ -1244,6 +2192,7 @@ export type CodingRunUncheckedUpdateWithoutProxySessionInput = {
     timeoutSec?: Prisma.IntFieldUpdateOperationsInput | number;
     allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     jobHandle?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -1251,13 +2200,22 @@ export type CodingRunUncheckedUpdateWithoutProxySessionInput = {
     failureCategory?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     diagnosticId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     workerImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    toolImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     budgetReservedUsd?: Prisma.DecimalFieldUpdateOperationsInput | runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Prisma.NullableDateTimeFieldUpdateOperationsInput | Date | string | null;
     workspaceDiskMb?: Prisma.NullableIntFieldUpdateOperationsInput | number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: Prisma.BoolFieldUpdateOperationsInput | boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     rootCodingRunId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    proxySession?: Prisma.CodingProxySessionUncheckedUpdateOneWithoutRunNestedInput;
     continuations?: Prisma.CodingRunUncheckedUpdateManyWithoutRootCodingRunNestedInput;
+    registryAllowances?: Prisma.RegistryAllowanceUncheckedUpdateManyWithoutRunNestedInput;
+    registryFetches?: Prisma.RegistryFetchUncheckedUpdateManyWithoutRunNestedInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUncheckedUpdateManyWithoutRunNestedInput;
 };
 export type CodingRunCreateManyRootCodingRunInput = {
     runId: string;
@@ -1268,8 +2226,9 @@ export type CodingRunCreateManyRootCodingRunInput = {
     provider: string;
     model: string;
     timeoutSec: number;
-    allowedEgress: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: string | null;
     jobHandle?: string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -1277,9 +2236,14 @@ export type CodingRunCreateManyRootCodingRunInput = {
     failureCategory?: string | null;
     diagnosticId?: string | null;
     workerImage?: string | null;
+    toolImage?: string | null;
     budgetReservedUsd: runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Date | string | null;
     workspaceDiskMb?: number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Date | string;
     updatedAt?: Date | string;
 };
@@ -1293,6 +2257,7 @@ export type CodingRunUpdateWithoutRootCodingRunInput = {
     timeoutSec?: Prisma.IntFieldUpdateOperationsInput | number;
     allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     jobHandle?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -1300,14 +2265,23 @@ export type CodingRunUpdateWithoutRootCodingRunInput = {
     failureCategory?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     diagnosticId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     workerImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    toolImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     budgetReservedUsd?: Prisma.DecimalFieldUpdateOperationsInput | runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Prisma.NullableDateTimeFieldUpdateOperationsInput | Date | string | null;
     workspaceDiskMb?: Prisma.NullableIntFieldUpdateOperationsInput | number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: Prisma.BoolFieldUpdateOperationsInput | boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     run?: Prisma.RunUpdateOneRequiredWithoutCodingRunNestedInput;
     proxySession?: Prisma.CodingProxySessionUpdateOneWithoutRunNestedInput;
     continuations?: Prisma.CodingRunUpdateManyWithoutRootCodingRunNestedInput;
+    registryAllowances?: Prisma.RegistryAllowanceUpdateManyWithoutRunNestedInput;
+    registryFetches?: Prisma.RegistryFetchUpdateManyWithoutRunNestedInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUpdateManyWithoutRunNestedInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUpdateManyWithoutRunNestedInput;
 };
 export type CodingRunUncheckedUpdateWithoutRootCodingRunInput = {
     runId?: Prisma.StringFieldUpdateOperationsInput | string;
@@ -1320,6 +2294,7 @@ export type CodingRunUncheckedUpdateWithoutRootCodingRunInput = {
     timeoutSec?: Prisma.IntFieldUpdateOperationsInput | number;
     allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     jobHandle?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -1327,13 +2302,22 @@ export type CodingRunUncheckedUpdateWithoutRootCodingRunInput = {
     failureCategory?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     diagnosticId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     workerImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    toolImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     budgetReservedUsd?: Prisma.DecimalFieldUpdateOperationsInput | runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Prisma.NullableDateTimeFieldUpdateOperationsInput | Date | string | null;
     workspaceDiskMb?: Prisma.NullableIntFieldUpdateOperationsInput | number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: Prisma.BoolFieldUpdateOperationsInput | boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     proxySession?: Prisma.CodingProxySessionUncheckedUpdateOneWithoutRunNestedInput;
     continuations?: Prisma.CodingRunUncheckedUpdateManyWithoutRootCodingRunNestedInput;
+    registryAllowances?: Prisma.RegistryAllowanceUncheckedUpdateManyWithoutRunNestedInput;
+    registryFetches?: Prisma.RegistryFetchUncheckedUpdateManyWithoutRunNestedInput;
+    registryApprovedVersions?: Prisma.RegistryApprovedVersionUncheckedUpdateManyWithoutRunNestedInput;
+    registryPlanRefusals?: Prisma.RegistryPlanRefusalUncheckedUpdateManyWithoutRunNestedInput;
 };
 export type CodingRunUncheckedUpdateManyWithoutRootCodingRunInput = {
     runId?: Prisma.StringFieldUpdateOperationsInput | string;
@@ -1346,6 +2330,7 @@ export type CodingRunUncheckedUpdateManyWithoutRootCodingRunInput = {
     timeoutSec?: Prisma.IntFieldUpdateOperationsInput | number;
     allowedEgress?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     protectedPaths?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    collectExclude?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     jobBackend?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     jobHandle?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     result?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue;
@@ -1353,9 +2338,14 @@ export type CodingRunUncheckedUpdateManyWithoutRootCodingRunInput = {
     failureCategory?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     diagnosticId?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     workerImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
+    toolImage?: Prisma.NullableStringFieldUpdateOperationsInput | string | null;
     budgetReservedUsd?: Prisma.DecimalFieldUpdateOperationsInput | runtime.Decimal | runtime.DecimalJsLike | number | string;
     queuedAt?: Prisma.NullableDateTimeFieldUpdateOperationsInput | Date | string | null;
     workspaceDiskMb?: Prisma.NullableIntFieldUpdateOperationsInput | number | null;
+    packageAllowlist?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    packagePolicy?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
+    debugTrace?: Prisma.BoolFieldUpdateOperationsInput | boolean;
+    services?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
     createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
 };
@@ -1364,9 +2354,17 @@ export type CodingRunUncheckedUpdateManyWithoutRootCodingRunInput = {
  */
 export type CodingRunCountOutputType = {
     continuations: number;
+    registryAllowances: number;
+    registryFetches: number;
+    registryApprovedVersions: number;
+    registryPlanRefusals: number;
 };
 export type CodingRunCountOutputTypeSelect<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = {
     continuations?: boolean | CodingRunCountOutputTypeCountContinuationsArgs;
+    registryAllowances?: boolean | CodingRunCountOutputTypeCountRegistryAllowancesArgs;
+    registryFetches?: boolean | CodingRunCountOutputTypeCountRegistryFetchesArgs;
+    registryApprovedVersions?: boolean | CodingRunCountOutputTypeCountRegistryApprovedVersionsArgs;
+    registryPlanRefusals?: boolean | CodingRunCountOutputTypeCountRegistryPlanRefusalsArgs;
 };
 /**
  * CodingRunCountOutputType without action
@@ -1383,6 +2381,30 @@ export type CodingRunCountOutputTypeDefaultArgs<ExtArgs extends runtime.Types.Ex
 export type CodingRunCountOutputTypeCountContinuationsArgs<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = {
     where?: Prisma.CodingRunWhereInput;
 };
+/**
+ * CodingRunCountOutputType without action
+ */
+export type CodingRunCountOutputTypeCountRegistryAllowancesArgs<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = {
+    where?: Prisma.RegistryAllowanceWhereInput;
+};
+/**
+ * CodingRunCountOutputType without action
+ */
+export type CodingRunCountOutputTypeCountRegistryFetchesArgs<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = {
+    where?: Prisma.RegistryFetchWhereInput;
+};
+/**
+ * CodingRunCountOutputType without action
+ */
+export type CodingRunCountOutputTypeCountRegistryApprovedVersionsArgs<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = {
+    where?: Prisma.RegistryApprovedVersionWhereInput;
+};
+/**
+ * CodingRunCountOutputType without action
+ */
+export type CodingRunCountOutputTypeCountRegistryPlanRefusalsArgs<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = {
+    where?: Prisma.RegistryPlanRefusalWhereInput;
+};
 export type CodingRunSelect<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = runtime.Types.Extensions.GetSelect<{
     runId?: boolean;
     task?: boolean;
@@ -1394,6 +2416,7 @@ export type CodingRunSelect<ExtArgs extends runtime.Types.Extensions.InternalArg
     timeoutSec?: boolean;
     allowedEgress?: boolean;
     protectedPaths?: boolean;
+    collectExclude?: boolean;
     jobBackend?: boolean;
     jobHandle?: boolean;
     result?: boolean;
@@ -1401,9 +2424,14 @@ export type CodingRunSelect<ExtArgs extends runtime.Types.Extensions.InternalArg
     failureCategory?: boolean;
     diagnosticId?: boolean;
     workerImage?: boolean;
+    toolImage?: boolean;
     budgetReservedUsd?: boolean;
     queuedAt?: boolean;
     workspaceDiskMb?: boolean;
+    packageAllowlist?: boolean;
+    packagePolicy?: boolean;
+    debugTrace?: boolean;
+    services?: boolean;
     createdAt?: boolean;
     updatedAt?: boolean;
     rootCodingRunId?: boolean;
@@ -1411,6 +2439,10 @@ export type CodingRunSelect<ExtArgs extends runtime.Types.Extensions.InternalArg
     proxySession?: boolean | Prisma.CodingRun$proxySessionArgs<ExtArgs>;
     rootCodingRun?: boolean | Prisma.CodingRun$rootCodingRunArgs<ExtArgs>;
     continuations?: boolean | Prisma.CodingRun$continuationsArgs<ExtArgs>;
+    registryAllowances?: boolean | Prisma.CodingRun$registryAllowancesArgs<ExtArgs>;
+    registryFetches?: boolean | Prisma.CodingRun$registryFetchesArgs<ExtArgs>;
+    registryApprovedVersions?: boolean | Prisma.CodingRun$registryApprovedVersionsArgs<ExtArgs>;
+    registryPlanRefusals?: boolean | Prisma.CodingRun$registryPlanRefusalsArgs<ExtArgs>;
     _count?: boolean | Prisma.CodingRunCountOutputTypeDefaultArgs<ExtArgs>;
 }, ExtArgs["result"]["codingRun"]>;
 export type CodingRunSelectCreateManyAndReturn<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = runtime.Types.Extensions.GetSelect<{
@@ -1424,6 +2456,7 @@ export type CodingRunSelectCreateManyAndReturn<ExtArgs extends runtime.Types.Ext
     timeoutSec?: boolean;
     allowedEgress?: boolean;
     protectedPaths?: boolean;
+    collectExclude?: boolean;
     jobBackend?: boolean;
     jobHandle?: boolean;
     result?: boolean;
@@ -1431,9 +2464,14 @@ export type CodingRunSelectCreateManyAndReturn<ExtArgs extends runtime.Types.Ext
     failureCategory?: boolean;
     diagnosticId?: boolean;
     workerImage?: boolean;
+    toolImage?: boolean;
     budgetReservedUsd?: boolean;
     queuedAt?: boolean;
     workspaceDiskMb?: boolean;
+    packageAllowlist?: boolean;
+    packagePolicy?: boolean;
+    debugTrace?: boolean;
+    services?: boolean;
     createdAt?: boolean;
     updatedAt?: boolean;
     rootCodingRunId?: boolean;
@@ -1451,6 +2489,7 @@ export type CodingRunSelectUpdateManyAndReturn<ExtArgs extends runtime.Types.Ext
     timeoutSec?: boolean;
     allowedEgress?: boolean;
     protectedPaths?: boolean;
+    collectExclude?: boolean;
     jobBackend?: boolean;
     jobHandle?: boolean;
     result?: boolean;
@@ -1458,9 +2497,14 @@ export type CodingRunSelectUpdateManyAndReturn<ExtArgs extends runtime.Types.Ext
     failureCategory?: boolean;
     diagnosticId?: boolean;
     workerImage?: boolean;
+    toolImage?: boolean;
     budgetReservedUsd?: boolean;
     queuedAt?: boolean;
     workspaceDiskMb?: boolean;
+    packageAllowlist?: boolean;
+    packagePolicy?: boolean;
+    debugTrace?: boolean;
+    services?: boolean;
     createdAt?: boolean;
     updatedAt?: boolean;
     rootCodingRunId?: boolean;
@@ -1478,6 +2522,7 @@ export type CodingRunSelectScalar = {
     timeoutSec?: boolean;
     allowedEgress?: boolean;
     protectedPaths?: boolean;
+    collectExclude?: boolean;
     jobBackend?: boolean;
     jobHandle?: boolean;
     result?: boolean;
@@ -1485,19 +2530,28 @@ export type CodingRunSelectScalar = {
     failureCategory?: boolean;
     diagnosticId?: boolean;
     workerImage?: boolean;
+    toolImage?: boolean;
     budgetReservedUsd?: boolean;
     queuedAt?: boolean;
     workspaceDiskMb?: boolean;
+    packageAllowlist?: boolean;
+    packagePolicy?: boolean;
+    debugTrace?: boolean;
+    services?: boolean;
     createdAt?: boolean;
     updatedAt?: boolean;
     rootCodingRunId?: boolean;
 };
-export type CodingRunOmit<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = runtime.Types.Extensions.GetOmit<"runId" | "task" | "repository" | "baseRef" | "headRef" | "provider" | "model" | "timeoutSec" | "allowedEgress" | "protectedPaths" | "jobBackend" | "jobHandle" | "result" | "resultSchema" | "failureCategory" | "diagnosticId" | "workerImage" | "budgetReservedUsd" | "queuedAt" | "workspaceDiskMb" | "createdAt" | "updatedAt" | "rootCodingRunId", ExtArgs["result"]["codingRun"]>;
+export type CodingRunOmit<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = runtime.Types.Extensions.GetOmit<"runId" | "task" | "repository" | "baseRef" | "headRef" | "provider" | "model" | "timeoutSec" | "allowedEgress" | "protectedPaths" | "collectExclude" | "jobBackend" | "jobHandle" | "result" | "resultSchema" | "failureCategory" | "diagnosticId" | "workerImage" | "toolImage" | "budgetReservedUsd" | "queuedAt" | "workspaceDiskMb" | "packageAllowlist" | "packagePolicy" | "debugTrace" | "services" | "createdAt" | "updatedAt" | "rootCodingRunId", ExtArgs["result"]["codingRun"]>;
 export type CodingRunInclude<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = {
     run?: boolean | Prisma.RunDefaultArgs<ExtArgs>;
     proxySession?: boolean | Prisma.CodingRun$proxySessionArgs<ExtArgs>;
     rootCodingRun?: boolean | Prisma.CodingRun$rootCodingRunArgs<ExtArgs>;
     continuations?: boolean | Prisma.CodingRun$continuationsArgs<ExtArgs>;
+    registryAllowances?: boolean | Prisma.CodingRun$registryAllowancesArgs<ExtArgs>;
+    registryFetches?: boolean | Prisma.CodingRun$registryFetchesArgs<ExtArgs>;
+    registryApprovedVersions?: boolean | Prisma.CodingRun$registryApprovedVersionsArgs<ExtArgs>;
+    registryPlanRefusals?: boolean | Prisma.CodingRun$registryPlanRefusalsArgs<ExtArgs>;
     _count?: boolean | Prisma.CodingRunCountOutputTypeDefaultArgs<ExtArgs>;
 };
 export type CodingRunIncludeCreateManyAndReturn<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = {
@@ -1515,6 +2569,10 @@ export type $CodingRunPayload<ExtArgs extends runtime.Types.Extensions.InternalA
         proxySession: Prisma.$CodingProxySessionPayload<ExtArgs> | null;
         rootCodingRun: Prisma.$CodingRunPayload<ExtArgs> | null;
         continuations: Prisma.$CodingRunPayload<ExtArgs>[];
+        registryAllowances: Prisma.$RegistryAllowancePayload<ExtArgs>[];
+        registryFetches: Prisma.$RegistryFetchPayload<ExtArgs>[];
+        registryApprovedVersions: Prisma.$RegistryApprovedVersionPayload<ExtArgs>[];
+        registryPlanRefusals: Prisma.$RegistryPlanRefusalPayload<ExtArgs>[];
     };
     scalars: runtime.Types.Extensions.GetPayloadResult<{
         runId: string;
@@ -1525,8 +2583,12 @@ export type $CodingRunPayload<ExtArgs extends runtime.Types.Extensions.InternalA
         provider: string;
         model: string;
         timeoutSec: number;
+        /**
+         * Unused; dropped after rollout (see the package-registry plan, Task 14).
+         */
         allowedEgress: runtime.JsonValue;
         protectedPaths: runtime.JsonValue;
+        collectExclude: runtime.JsonValue;
         jobBackend: string | null;
         jobHandle: string | null;
         result: runtime.JsonValue | null;
@@ -1538,6 +2600,10 @@ export type $CodingRunPayload<ExtArgs extends runtime.Types.Extensions.InternalA
         failureCategory: string | null;
         diagnosticId: string | null;
         workerImage: string | null;
+        /**
+         * Claude Code's tool-runner image, resolved from the agent's toolchain at dispatch; null for Codex runs.
+         */
+        toolImage: string | null;
         budgetReservedUsd: runtime.Decimal;
         /**
          * Phase 12 concurrency queue: set when start() found every coding slot
@@ -1549,6 +2615,19 @@ export type $CodingRunPayload<ExtArgs extends runtime.Types.Extensions.InternalA
          * Per-agent workspace size in MiB; null = CODING_DISK_MB.
          */
         workspaceDiskMb: number | null;
+        packageAllowlist: runtime.JsonValue;
+        packagePolicy: runtime.JsonValue;
+        /**
+         * Fixed at dispatch from the profile's debugTraceUntil: the worker writes a
+         * full stream trace to its own pod log (never to the database).
+         */
+        debugTrace: boolean;
+        /**
+         * Coding-run services resolved at dispatch from the base branch's
+         * .wardby/services.yaml: one snapshot per service (the catalog entry minus
+         * kind), fixed for the run's lifetime. Empty = none.
+         */
+        services: runtime.JsonValue;
         createdAt: Date;
         updatedAt: Date;
         /**
@@ -1893,6 +2972,10 @@ export interface Prisma__CodingRunClient<T, Null = never, ExtArgs extends runtim
     proxySession<T extends Prisma.CodingRun$proxySessionArgs<ExtArgs> = {}>(args?: Prisma.Subset<T, Prisma.CodingRun$proxySessionArgs<ExtArgs>>): Prisma.Prisma__CodingProxySessionClient<runtime.Types.Result.GetResult<Prisma.$CodingProxySessionPayload<ExtArgs>, T, "findUniqueOrThrow", GlobalOmitOptions> | null, null, ExtArgs, GlobalOmitOptions>;
     rootCodingRun<T extends Prisma.CodingRun$rootCodingRunArgs<ExtArgs> = {}>(args?: Prisma.Subset<T, Prisma.CodingRun$rootCodingRunArgs<ExtArgs>>): Prisma.Prisma__CodingRunClient<runtime.Types.Result.GetResult<Prisma.$CodingRunPayload<ExtArgs>, T, "findUniqueOrThrow", GlobalOmitOptions> | null, null, ExtArgs, GlobalOmitOptions>;
     continuations<T extends Prisma.CodingRun$continuationsArgs<ExtArgs> = {}>(args?: Prisma.Subset<T, Prisma.CodingRun$continuationsArgs<ExtArgs>>): Prisma.PrismaPromise<runtime.Types.Result.GetResult<Prisma.$CodingRunPayload<ExtArgs>, T, "findMany", GlobalOmitOptions> | Null>;
+    registryAllowances<T extends Prisma.CodingRun$registryAllowancesArgs<ExtArgs> = {}>(args?: Prisma.Subset<T, Prisma.CodingRun$registryAllowancesArgs<ExtArgs>>): Prisma.PrismaPromise<runtime.Types.Result.GetResult<Prisma.$RegistryAllowancePayload<ExtArgs>, T, "findMany", GlobalOmitOptions> | Null>;
+    registryFetches<T extends Prisma.CodingRun$registryFetchesArgs<ExtArgs> = {}>(args?: Prisma.Subset<T, Prisma.CodingRun$registryFetchesArgs<ExtArgs>>): Prisma.PrismaPromise<runtime.Types.Result.GetResult<Prisma.$RegistryFetchPayload<ExtArgs>, T, "findMany", GlobalOmitOptions> | Null>;
+    registryApprovedVersions<T extends Prisma.CodingRun$registryApprovedVersionsArgs<ExtArgs> = {}>(args?: Prisma.Subset<T, Prisma.CodingRun$registryApprovedVersionsArgs<ExtArgs>>): Prisma.PrismaPromise<runtime.Types.Result.GetResult<Prisma.$RegistryApprovedVersionPayload<ExtArgs>, T, "findMany", GlobalOmitOptions> | Null>;
+    registryPlanRefusals<T extends Prisma.CodingRun$registryPlanRefusalsArgs<ExtArgs> = {}>(args?: Prisma.Subset<T, Prisma.CodingRun$registryPlanRefusalsArgs<ExtArgs>>): Prisma.PrismaPromise<runtime.Types.Result.GetResult<Prisma.$RegistryPlanRefusalPayload<ExtArgs>, T, "findMany", GlobalOmitOptions> | Null>;
     /**
      * Attaches callbacks for the resolution and/or rejection of the Promise.
      * @param onfulfilled The callback to execute when the Promise is resolved.
@@ -1928,6 +3011,7 @@ export interface CodingRunFieldRefs {
     readonly timeoutSec: Prisma.FieldRef<"CodingRun", 'Int'>;
     readonly allowedEgress: Prisma.FieldRef<"CodingRun", 'Json'>;
     readonly protectedPaths: Prisma.FieldRef<"CodingRun", 'Json'>;
+    readonly collectExclude: Prisma.FieldRef<"CodingRun", 'Json'>;
     readonly jobBackend: Prisma.FieldRef<"CodingRun", 'String'>;
     readonly jobHandle: Prisma.FieldRef<"CodingRun", 'String'>;
     readonly result: Prisma.FieldRef<"CodingRun", 'Json'>;
@@ -1935,9 +3019,14 @@ export interface CodingRunFieldRefs {
     readonly failureCategory: Prisma.FieldRef<"CodingRun", 'String'>;
     readonly diagnosticId: Prisma.FieldRef<"CodingRun", 'String'>;
     readonly workerImage: Prisma.FieldRef<"CodingRun", 'String'>;
+    readonly toolImage: Prisma.FieldRef<"CodingRun", 'String'>;
     readonly budgetReservedUsd: Prisma.FieldRef<"CodingRun", 'Decimal'>;
     readonly queuedAt: Prisma.FieldRef<"CodingRun", 'DateTime'>;
     readonly workspaceDiskMb: Prisma.FieldRef<"CodingRun", 'Int'>;
+    readonly packageAllowlist: Prisma.FieldRef<"CodingRun", 'Json'>;
+    readonly packagePolicy: Prisma.FieldRef<"CodingRun", 'Json'>;
+    readonly debugTrace: Prisma.FieldRef<"CodingRun", 'Boolean'>;
+    readonly services: Prisma.FieldRef<"CodingRun", 'Json'>;
     readonly createdAt: Prisma.FieldRef<"CodingRun", 'DateTime'>;
     readonly updatedAt: Prisma.FieldRef<"CodingRun", 'DateTime'>;
     readonly rootCodingRunId: Prisma.FieldRef<"CodingRun", 'String'>;
@@ -2383,6 +3472,98 @@ export type CodingRun$continuationsArgs<ExtArgs extends runtime.Types.Extensions
     skip?: number;
     distinct?: Prisma.CodingRunScalarFieldEnum | Prisma.CodingRunScalarFieldEnum[];
 };
+/**
+ * CodingRun.registryAllowances
+ */
+export type CodingRun$registryAllowancesArgs<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = {
+    /**
+     * Select specific fields to fetch from the RegistryAllowance
+     */
+    select?: Prisma.RegistryAllowanceSelect<ExtArgs> | null;
+    /**
+     * Omit specific fields from the RegistryAllowance
+     */
+    omit?: Prisma.RegistryAllowanceOmit<ExtArgs> | null;
+    /**
+     * Choose, which related nodes to fetch as well
+     */
+    include?: Prisma.RegistryAllowanceInclude<ExtArgs> | null;
+    where?: Prisma.RegistryAllowanceWhereInput;
+    orderBy?: Prisma.RegistryAllowanceOrderByWithRelationInput | Prisma.RegistryAllowanceOrderByWithRelationInput[];
+    cursor?: Prisma.RegistryAllowanceWhereUniqueInput;
+    take?: number;
+    skip?: number;
+    distinct?: Prisma.RegistryAllowanceScalarFieldEnum | Prisma.RegistryAllowanceScalarFieldEnum[];
+};
+/**
+ * CodingRun.registryFetches
+ */
+export type CodingRun$registryFetchesArgs<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = {
+    /**
+     * Select specific fields to fetch from the RegistryFetch
+     */
+    select?: Prisma.RegistryFetchSelect<ExtArgs> | null;
+    /**
+     * Omit specific fields from the RegistryFetch
+     */
+    omit?: Prisma.RegistryFetchOmit<ExtArgs> | null;
+    /**
+     * Choose, which related nodes to fetch as well
+     */
+    include?: Prisma.RegistryFetchInclude<ExtArgs> | null;
+    where?: Prisma.RegistryFetchWhereInput;
+    orderBy?: Prisma.RegistryFetchOrderByWithRelationInput | Prisma.RegistryFetchOrderByWithRelationInput[];
+    cursor?: Prisma.RegistryFetchWhereUniqueInput;
+    take?: number;
+    skip?: number;
+    distinct?: Prisma.RegistryFetchScalarFieldEnum | Prisma.RegistryFetchScalarFieldEnum[];
+};
+/**
+ * CodingRun.registryApprovedVersions
+ */
+export type CodingRun$registryApprovedVersionsArgs<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = {
+    /**
+     * Select specific fields to fetch from the RegistryApprovedVersion
+     */
+    select?: Prisma.RegistryApprovedVersionSelect<ExtArgs> | null;
+    /**
+     * Omit specific fields from the RegistryApprovedVersion
+     */
+    omit?: Prisma.RegistryApprovedVersionOmit<ExtArgs> | null;
+    /**
+     * Choose, which related nodes to fetch as well
+     */
+    include?: Prisma.RegistryApprovedVersionInclude<ExtArgs> | null;
+    where?: Prisma.RegistryApprovedVersionWhereInput;
+    orderBy?: Prisma.RegistryApprovedVersionOrderByWithRelationInput | Prisma.RegistryApprovedVersionOrderByWithRelationInput[];
+    cursor?: Prisma.RegistryApprovedVersionWhereUniqueInput;
+    take?: number;
+    skip?: number;
+    distinct?: Prisma.RegistryApprovedVersionScalarFieldEnum | Prisma.RegistryApprovedVersionScalarFieldEnum[];
+};
+/**
+ * CodingRun.registryPlanRefusals
+ */
+export type CodingRun$registryPlanRefusalsArgs<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = {
+    /**
+     * Select specific fields to fetch from the RegistryPlanRefusal
+     */
+    select?: Prisma.RegistryPlanRefusalSelect<ExtArgs> | null;
+    /**
+     * Omit specific fields from the RegistryPlanRefusal
+     */
+    omit?: Prisma.RegistryPlanRefusalOmit<ExtArgs> | null;
+    /**
+     * Choose, which related nodes to fetch as well
+     */
+    include?: Prisma.RegistryPlanRefusalInclude<ExtArgs> | null;
+    where?: Prisma.RegistryPlanRefusalWhereInput;
+    orderBy?: Prisma.RegistryPlanRefusalOrderByWithRelationInput | Prisma.RegistryPlanRefusalOrderByWithRelationInput[];
+    cursor?: Prisma.RegistryPlanRefusalWhereUniqueInput;
+    take?: number;
+    skip?: number;
+    distinct?: Prisma.RegistryPlanRefusalScalarFieldEnum | Prisma.RegistryPlanRefusalScalarFieldEnum[];
+};
 /**
  * CodingRun without action
  */