@wardby/cli 0.2.1 → 0.4.0

package/help/troubleshooting/budgets.md

@@ -0,0 +1,32 @@
+---
+id: troubleshooting/budgets
+title: Troubleshoot budgets and reservations
+summary: Diagnose run refusals caused by an exhausted agent, shared budget group, or sub-agent run tree.
+audience: operator
+tags: [budgets, reservations, refusals, scheduling]
+appliesTo: >=0.2.1
+---
+
+# Troubleshoot budgets and reservations
+
+Wardby reserves budget when it dispatches a run. The reservation is limited by
+the agent's `budgetUsd`, the remaining shared daily, weekly, or monthly budget
+group capacity, and the remaining parent run-tree capacity for a sub-agent.
+
+When no capacity remains, Wardby records the run as refused and does not start
+a worker. Common errors include `budget_group_exhausted:day`,
+`budget_group_exhausted:week`, `budget_group_exhausted:month`, and
+`run_tree_exhausted`.
+
+Inspect the agent, its budget group, and recent runs before increasing a limit.
+In-progress runs retain their unspent reservation, so overlapping scheduled,
+webhook, and manual runs share one cap rather than each assuming the full
+remaining balance.
+
+A run's spend is recorded as it goes, not only when it finishes. A sub-agent
+dispatched partway through a run therefore gets the run tree's capacity minus
+what the parent (and any earlier sub-agents) have already spent, so a parent
+that spends heavily before delegating can leave a sub-agent refused with
+`run_tree_exhausted`.
+
+For a shared-group refusal, read [Budget group exhausted](../errors/budget-group-exhausted.md).

package/help/troubleshooting/coding-workers.md

@@ -0,0 +1,47 @@
+---
+id: troubleshooting/coding-workers
+title: Troubleshoot coding workers
+summary: Investigate coding-worker setup, isolation preflight, and safe failure handling.
+audience: operator
+tags: [coding-agents, docker, kubernetes, isolation, services]
+appliesTo: >=0.2.1
+---
+
+# Troubleshoot coding workers
+
+Before enabling a coding agent, configure an immutable worker image, the
+trusted coding proxy, a scoped GitHub App installation, and the selected job
+launcher. Run `wardby coding preflight` after changing the Docker or Kubernetes
+configuration.
+
+Wardby refuses to weaken an isolation profile when a required host feature,
+network setting, mount, environment, or cleanup guarantee cannot be verified.
+Investigate the host configuration instead of bypassing the refusal.
+
+Codex and Claude Code workers have different supported launcher combinations.
+Review the deployment guide for your target before assigning a coding profile.
+
+For the specific isolation refusal, read [Coding-worker isolation unavailable](../errors/docker-isolation-unsupported.md).
+
+## Service refusals and failures
+
+A repository can declare services such as PostgreSQL in `.wardby/services.yaml`
+on its base branch. Wardby checks the declaration, the service catalog, and the
+agent's `codingProfile.services` before a run starts, and refuses the run with a
+`service_*` code when they disagree. The run's `error` (from `get_run`) is the
+code followed by a sentence the requester also sees on the run's status comment.
+
+- [`service_declaration_invalid`](../errors/service-declaration-invalid.md):
+  the file on the base branch is not a valid declaration.
+- [`service_declaration_unavailable`](../errors/service-declaration-unavailable.md):
+  Wardby could not read the file through the GitHub App.
+- [`service_unknown`](../errors/service-unknown.md): the catalog has no such
+  name and version.
+- [`service_not_allowed`](../errors/service-not-allowed.md): the agent does not
+  allow that service.
+- [`service_launcher_unsupported`](../errors/service-launcher-unsupported.md):
+  services need the Kubernetes or Docker job launcher.
+- [`service_unready`](../errors/service-unready.md): the run started but a
+  service never became ready (launcher error `coding_service_unready:<name>`).
+
+See [Coding services](../coding-services.md).

package/help/troubleshooting/repository-access.md

@@ -0,0 +1,27 @@
+---
+id: troubleshooting/repository-access
+title: Troubleshoot repository access
+summary: Diagnose why Wardby refused repository work or could not verify the agent owner's GitHub access.
+audience: operator
+tags: [github, repositories, authorization, refusals]
+appliesTo: >=0.2.1
+---
+
+# Troubleshoot repository access
+
+Wardby checks that the owner of a coding or repository-linked agent has the
+required current GitHub permission. A coding repository requires write access;
+a read-only repository link requires read access. An administrator can record a
+repository approval when no individual's access is appropriate.
+
+`repo_access` means the current owner no longer has the required permission,
+has unlinked their account, or the repository was not authorized. Restore the
+owner's GitHub link and permission, or have an administrator review and record
+the appropriate repository authorization.
+
+`repo_access_unavailable` means Wardby could not verify GitHub access after its
+retry. Do not treat it as permission granted: resolve the GitHub/API condition
+and re-run the work later.
+
+Read [Repository access refused](../errors/repo-access.md) for the safe
+remediation sequence.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wardby/cli",
-  "version": "0.2.1",
+  "version": "0.4.0",
   "description": "Self-hosted control plane for budget-guarded AI agents.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/wardby/wardby#readme",
@@ -35,8 +35,10 @@
     ".env.example",
     "NOTICE",
     "bin/",
+    "docs/",
     "deploy/local/docker-compose.yml",
     "dist/",
+    "help/",
     "prisma/migrations/",
     "prisma/migrate.config.mjs",
     "prisma/schema.prisma",
@@ -52,7 +54,9 @@
     "format": "prettier --write .",
     "format:check": "prettier --check .",
     "build:vendor": "node scripts/build-sandbox-vendor.mjs",
-    "build": "npm run build:vendor && PRISMA_HIDE_UPDATE_MESSAGE=1 prisma generate && tsc -p tsconfig.build.json",
+    "build:help": "tsx src/help/build.ts",
+    "build:viewer-schemas": "tsx src/viewer/build-schemas.ts",
+    "build": "npm run build:vendor && PRISMA_HIDE_UPDATE_MESSAGE=1 prisma generate && tsc -p tsconfig.build.json && npm run build:help",
     "prepare": "npm run build:vendor && PRISMA_HIDE_UPDATE_MESSAGE=1 prisma generate",
     "prepack": "npm run build",
     "cli": "tsx --conditions=wardby-source src/cli.ts",
@@ -63,6 +67,7 @@
     "test:kubernetes": "WARDBY_KUBERNETES_TEST=1 vitest run src/providers/jobs/kubernetes.integration.test.ts",
     "prisma:generate": "PRISMA_HIDE_UPDATE_MESSAGE=1 prisma generate",
     "prisma:migrate": "prisma migrate deploy",
+    "dbos:migrate": "dbos schema \"$DATABASE_URL\"",
     "db:up": "docker compose -f deploy/local/docker-compose.yml up -d",
     "db:down": "docker compose -f deploy/local/docker-compose.yml down",
     "coding:local:up": "docker compose --env-file .env.local -f deploy/local/docker-compose.yml -f deploy/local/docker-compose.phase5.yml up --build -d coding-proxy",
@@ -76,7 +81,8 @@
     "verify:phase5": "npm run typecheck && npm run test:phase5 && npm run build && npm run worker:image:policy",
     "test:docker-isolation": "node scripts/docker-isolation-acceptance.mjs",
     "test:docker-job": "node scripts/docker-job-acceptance.mjs",
-    "claude:images:local": "docker build -f src/claude-coding-worker/Dockerfile -t wardby-claude-coding-worker:phase5 . && docker build -f src/claude-tool-runner/Dockerfile -t wardby-claude-tool-runner:phase5 .",
+    "test:docker-services": "node scripts/docker-services-acceptance.mjs",
+    "claude:images:local": "docker build -f src/claude-coding-worker/Dockerfile -t wardby-claude-coding-worker:phase5 . && docker build -f src/claude-tool-runner/Dockerfile -t wardby-claude-tool-runner:phase5 . && docker build -f src/claude-tool-runner/Dockerfile --target node-python -t wardby-claude-tool-runner:phase5-node-python .",
     "test:claude-compatibility": "docker build -f src/claude-coding-worker/Dockerfile.compatibility -t wardby-claude-compat:phase5 . && docker run --rm wardby-claude-compat:phase5",
     "test:claude-docker": "node scripts/claude-docker-acceptance.mjs",
     "test:production-boundary": "node scripts/production-boundary-policy.mjs",
@@ -94,9 +100,11 @@
     "@prisma/adapter-pg": "7.10.0",
     "@prisma/client": "7.10.0",
     "@prometheus-io/client": "^0.16.1",
+    "@renovatebot/pep440": "^5.0.1",
     "croner": "^10.0.1",
     "dotenv-flow": "^4.1.0",
     "fast-xml-parser": "^5.11.1",
+    "fflate": "^0.8.3",
     "gpt-tokenizer": "^2.5.0",
     "jose": "^6.2.12",
     "node-html-parser": "^9.0.3",
@@ -105,8 +113,10 @@
     "pg": "8.23.0",
     "pino": "^9.14.0",
     "quickjs-emscripten": "^0.32.0",
+    "semver": "^7.8.5",
     "tar-stream": "^3.2.1",
     "undici": "^8.7.0",
+    "yaml": "^2.9.1",
     "zod": "^3.25.76",
     "zod-to-json-schema": "^3.25.2"
   },
@@ -116,6 +126,7 @@
     "@types/node": "^24.0.0",
     "@types/papaparse": "^5.5.2",
     "@types/pg": "8.23.1",
+    "@types/semver": "^7.8.0",
     "@types/tar-stream": "^3.1.4",
     "esbuild": "^0.28.2",
     "eslint": "^10.10.0",

package/prisma/migrations/20260925010000_coding_collect_exclude/migration.sql

@@ -0,0 +1,8 @@
+-- Additive: per-agent workspace paths never collected from a coding run. See
+-- docs/superpowers/specs/2026-09-25-coding-package-registry-design.md §4.
+
+-- AlterTable
+ALTER TABLE "CodingAgentProfile" ADD COLUMN     "collectExclude" JSONB NOT NULL DEFAULT '[]';
+
+-- AlterTable
+ALTER TABLE "CodingRun" ADD COLUMN     "collectExclude" JSONB NOT NULL DEFAULT '[]';

package/prisma/migrations/20260925015000_allowed_egress_default/migration.sql

@@ -0,0 +1,8 @@
+-- allowedEgress was stored but never enforced and is no longer written. A default
+-- lets new rows omit it; the columns are dropped in a later release.
+
+-- AlterTable
+ALTER TABLE "CodingAgentProfile" ALTER COLUMN "allowedEgress" SET DEFAULT '[]';
+
+-- AlterTable
+ALTER TABLE "CodingRun" ALTER COLUMN "allowedEgress" SET DEFAULT '[]';

package/prisma/migrations/20260925020000_coding_package_registry/migration.sql

@@ -0,0 +1,55 @@
+-- Additive: coding package registry. See
+-- docs/superpowers/specs/2026-09-25-coding-package-registry-design.md.
+
+-- CreateEnum
+CREATE TYPE "RegistryFetchOutcome" AS ENUM ('served', 'refused');
+
+-- AlterTable
+ALTER TABLE "CodingAgentProfile" ADD COLUMN     "packageAllowlist" JSONB NOT NULL DEFAULT '{}',
+ADD COLUMN     "packagePolicy" JSONB NOT NULL DEFAULT '{}';
+
+-- AlterTable
+ALTER TABLE "CodingRun" ADD COLUMN     "packageAllowlist" JSONB NOT NULL DEFAULT '{}',
+ADD COLUMN     "packagePolicy" JSONB NOT NULL DEFAULT '{}';
+
+-- AlterTable
+ALTER TABLE "CodingProxySession" ADD COLUMN     "registryTokenHash" TEXT;
+
+-- CreateTable
+CREATE TABLE "RegistryAllowance" (
+    "runId" TEXT NOT NULL,
+    "ecosystem" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "RegistryAllowance_pkey" PRIMARY KEY ("runId","ecosystem","name")
+);
+
+-- CreateTable
+CREATE TABLE "RegistryFetch" (
+    "id" TEXT NOT NULL,
+    "runId" TEXT NOT NULL,
+    "ecosystem" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "version" TEXT,
+    "filename" TEXT,
+    "integrity" TEXT,
+    "sizeBytes" INTEGER,
+    "outcome" "RegistryFetchOutcome" NOT NULL,
+    "reason" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "RegistryFetch_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "CodingProxySession_registryTokenHash_key" ON "CodingProxySession"("registryTokenHash");
+
+-- CreateIndex
+CREATE INDEX "RegistryFetch_runId_createdAt_idx" ON "RegistryFetch"("runId", "createdAt");
+
+-- AddForeignKey
+ALTER TABLE "RegistryAllowance" ADD CONSTRAINT "RegistryAllowance_runId_fkey" FOREIGN KEY ("runId") REFERENCES "CodingRun"("runId") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "RegistryFetch" ADD CONSTRAINT "RegistryFetch_runId_fkey" FOREIGN KEY ("runId") REFERENCES "CodingRun"("runId") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20260925030000_tool_name_per_owner/migration.sql

@@ -0,0 +1,11 @@
+-- Tool names become unique per owner instead of globally, matching
+-- BudgetGroup / Datastore / Secret. Safe on existing data: global uniqueness
+-- already implies per-owner uniqueness. As with those models, PostgreSQL
+-- treats NULLs as distinct, so public (null-owner) tools are not deduplicated
+-- by this index; `wardby tool create` checks that case in the application.
+
+-- DropIndex
+DROP INDEX "Tool_name_key";
+
+-- CreateIndex
+CREATE UNIQUE INDEX "Tool_ownerId_name_key" ON "Tool"("ownerId", "name");

package/prisma/migrations/20260926010000_run_trigger_host_event/migration.sql

@@ -0,0 +1,7 @@
+-- Additive: a run started by a code-review host event (GitHub App webhook).
+-- Its own migration: Postgres cannot use a newly added enum value in the
+-- same transaction that adds it. See
+-- docs/private/2026-09-25-code-review-host-design.md §4.
+
+-- AlterEnum
+ALTER TYPE "RunTrigger" ADD VALUE 'host_event';

package/prisma/migrations/20260926020000_code_review_hosts/migration.sql

@@ -0,0 +1,53 @@
+-- Additive: repository links for native agents, the check a run owns, and
+-- host webhook delivery de-duplication. See
+-- docs/private/2026-09-25-code-review-host-design.md §4.
+
+-- CreateTable
+CREATE TABLE "AgentRepository" (
+    "id" TEXT NOT NULL,
+    "agentId" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "repository" TEXT NOT NULL,
+    "access" TEXT NOT NULL,
+    "triggers" TEXT[] DEFAULT ARRAY[]::TEXT[],
+    "checkName" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "AgentRepository_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "RunHostCheck" (
+    "runId" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "repository" TEXT NOT NULL,
+    "checkId" TEXT NOT NULL,
+    "headSha" TEXT NOT NULL,
+    "completedAt" TIMESTAMP(3),
+
+    CONSTRAINT "RunHostCheck_pkey" PRIMARY KEY ("runId")
+);
+
+-- CreateTable
+CREATE TABLE "HostEventDelivery" (
+    "provider" TEXT NOT NULL,
+    "deliveryId" TEXT NOT NULL,
+    "receivedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "HostEventDelivery_pkey" PRIMARY KEY ("provider","deliveryId")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "AgentRepository_agentId_provider_repository_key" ON "AgentRepository"("agentId", "provider", "repository");
+
+-- CreateIndex
+CREATE INDEX "AgentRepository_provider_repository_idx" ON "AgentRepository"("provider", "repository");
+
+-- CreateIndex
+CREATE INDEX "HostEventDelivery_receivedAt_idx" ON "HostEventDelivery"("receivedAt");
+
+-- AddForeignKey
+ALTER TABLE "AgentRepository" ADD CONSTRAINT "AgentRepository_agentId_fkey" FOREIGN KEY ("agentId") REFERENCES "Agent"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "RunHostCheck" ADD CONSTRAINT "RunHostCheck_runId_fkey" FOREIGN KEY ("runId") REFERENCES "Run"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20260926030000_auth_user_roles/migration.sql

@@ -0,0 +1,9 @@
+-- Additive: roles for self-hosted users (security finding A1). A privileged
+-- operation (make_owner, setting workerImageRef, package approval) needs its
+-- scope on the token AND one of the user's roles granting it, checked on
+-- every request. Role names are validated in code (admin, package-approver).
+-- Existing users get no roles (member) - an operator re-grants admin with
+-- `wardby auth user grant --subject <subject> --role admin`.
+
+-- AlterTable
+ALTER TABLE "AuthUser" ADD COLUMN     "roles" TEXT[] DEFAULT ARRAY[]::TEXT[];

package/prisma/migrations/20260926040000_agent_effort/migration.sql

@@ -0,0 +1,6 @@
+-- Additive: per-agent reasoning effort for native agents. Nullable, so every
+-- existing agent keeps the provider's default. Levels are validated in code
+-- against the agent's model (low, medium, high, xhigh, max), not a DB enum.
+
+-- AlterTable
+ALTER TABLE "Agent" ADD COLUMN "effort" TEXT;

package/prisma/migrations/20260926050000_registry_lockfile_plan/migration.sql

@@ -0,0 +1,32 @@
+-- Additive: npm lockfile verification (POST /registry/npm/-/plan). See
+-- docs/coding-packages.md. Immutable per-version facts read from the
+-- registry, and the exact versions a run's lockfile plan approved.
+
+-- CreateTable
+CREATE TABLE "RegistryVersionFact" (
+    "ecosystem" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "version" TEXT NOT NULL,
+    "publishedAt" TIMESTAMP(3) NOT NULL,
+    "integrity" TEXT NOT NULL,
+    "downloadUrl" TEXT NOT NULL,
+    "dependencies" JSONB NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "RegistryVersionFact_pkey" PRIMARY KEY ("ecosystem","name","version")
+);
+
+-- CreateTable
+CREATE TABLE "RegistryApprovedVersion" (
+    "runId" TEXT NOT NULL,
+    "ecosystem" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "version" TEXT NOT NULL,
+    "integrity" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "RegistryApprovedVersion_pkey" PRIMARY KEY ("runId","ecosystem","name","version")
+);
+
+-- AddForeignKey
+ALTER TABLE "RegistryApprovedVersion" ADD CONSTRAINT "RegistryApprovedVersion_runId_fkey" FOREIGN KEY ("runId") REFERENCES "CodingRun"("runId") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20260926050000_repo_access_authorization/migration.sql

@@ -0,0 +1,82 @@
+-- Repository access authorization (security findings H5-1/A3/C3-2, H5-2,
+-- E-08/H5-4). A principal can give an agent authority over a repository only
+-- through its own verified host identity's access, or an explicit, recorded
+-- admin approval; the authorization is stamped on the row that grants it.
+-- See docs/private/2026-09-26-repo-access-authorization-spec-and-plan.md §5.
+
+-- CreateTable
+CREATE TABLE "HostIdentity" (
+    "principalId" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "hostUserId" TEXT NOT NULL,
+    "login" TEXT NOT NULL,
+    "linkedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "HostIdentity_pkey" PRIMARY KEY ("principalId","provider")
+);
+
+-- CreateTable
+CREATE TABLE "HostIdentityLinkRequest" (
+    "id" TEXT NOT NULL,
+    "principalId" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "stateHash" TEXT NOT NULL,
+    "codeVerifier" TEXT NOT NULL,
+    "hostUserId" TEXT,
+    "login" TEXT,
+    "confirmHash" TEXT,
+    "attempts" INTEGER NOT NULL DEFAULT 0,
+    "callbackAt" TIMESTAMP(3),
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "HostIdentityLinkRequest_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "HostIdentity_provider_hostUserId_key" ON "HostIdentity"("provider", "hostUserId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "HostIdentityLinkRequest_stateHash_key" ON "HostIdentityLinkRequest"("stateHash");
+
+-- CreateIndex
+CREATE INDEX "HostIdentityLinkRequest_principalId_idx" ON "HostIdentityLinkRequest"("principalId");
+
+-- CreateIndex
+CREATE INDEX "HostIdentityLinkRequest_expiresAt_idx" ON "HostIdentityLinkRequest"("expiresAt");
+
+-- AddForeignKey
+ALTER TABLE "HostIdentity" ADD CONSTRAINT "HostIdentity_principalId_fkey" FOREIGN KEY ("principalId") REFERENCES "Principal"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "HostIdentityLinkRequest" ADD CONSTRAINT "HostIdentityLinkRequest_principalId_fkey" FOREIGN KEY ("principalId") REFERENCES "Principal"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AlterTable
+ALTER TABLE "AgentRepository" ADD COLUMN     "authorizedAt" TIMESTAMP(3),
+ADD COLUMN     "authorizedById" TEXT,
+ADD COLUMN     "authorizedVia" TEXT;
+
+-- AlterTable
+ALTER TABLE "CodingAgentProfile" ADD COLUMN     "repositoryAuthorizedAt" TIMESTAMP(3),
+ADD COLUMN     "repositoryAuthorizedById" TEXT,
+ADD COLUMN     "repositoryAuthorizedVia" TEXT;
+
+-- AlterTable
+ALTER TABLE "RunHostCheck" ADD COLUMN     "prNumber" INTEGER;
+
+-- Backfill: every existing assignment is the operator's own and keeps
+-- working ("grandfathered", not re-checked at use). New or changed
+-- assignments go through the check.
+UPDATE "AgentRepository" SET "authorizedVia" = 'grandfathered', "authorizedAt" = CURRENT_TIMESTAMP;
+UPDATE "CodingAgentProfile" SET "repositoryAuthorizedVia" = 'grandfathered', "repositoryAuthorizedAt" = CURRENT_TIMESTAMP;
+
+-- Deliberate: a check name is only meaningful with the pull_request trigger
+-- (a check is only ever published for the PR a run was dispatched for), so
+-- names on other links are cleared before the name becomes unique per
+-- repository. Existing pull_request links were already unique by name.
+UPDATE "AgentRepository" SET "checkName" = NULL
+  WHERE "triggers" IS NULL OR NOT ('pull_request' = ANY("triggers"));
+
+-- CreateIndex
+CREATE UNIQUE INDEX "AgentRepository_provider_repository_checkName_key" ON "AgentRepository"("provider", "repository", "checkName");

package/prisma/migrations/20260926060000_registry_plan_refusal/migration.sql

@@ -0,0 +1,19 @@
+-- Additive: the exact versions a run's lockfile plan definitively refused,
+-- so a download of one is answered from the plan (no graph walk). See
+-- docs/coding-packages.md.
+
+-- CreateTable
+CREATE TABLE "RegistryPlanRefusal" (
+    "runId" TEXT NOT NULL,
+    "ecosystem" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "version" TEXT NOT NULL,
+    "code" TEXT NOT NULL,
+    "reason" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "RegistryPlanRefusal_pkey" PRIMARY KEY ("runId","ecosystem","name","version")
+);
+
+-- AddForeignKey
+ALTER TABLE "RegistryPlanRefusal" ADD CONSTRAINT "RegistryPlanRefusal_runId_fkey" FOREIGN KEY ("runId") REFERENCES "CodingRun"("runId") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20260926100000_registry_plan_refusal_published_at/migration.sql

@@ -0,0 +1,5 @@
+-- Additive: a too-new plan refusal keeps the version's publish time, so the
+-- answer re-checks the age at answer time and the refusal lapses.
+
+-- AlterTable
+ALTER TABLE "RegistryPlanRefusal" ADD COLUMN     "publishedAt" TIMESTAMP(3);

package/prisma/migrations/20260926190000_run_host_status/migration.sql

@@ -0,0 +1,18 @@
+-- The status comment posted for a mention-started run, edited with its outcome.
+
+-- CreateTable
+CREATE TABLE "RunHostStatus" (
+    "runId" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "repository" TEXT NOT NULL,
+    "number" INTEGER NOT NULL,
+    "commentKind" TEXT NOT NULL,
+    "commentId" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "completedAt" TIMESTAMP(3),
+
+    CONSTRAINT "RunHostStatus_pkey" PRIMARY KEY ("runId")
+);
+
+-- AddForeignKey
+ALTER TABLE "RunHostStatus" ADD CONSTRAINT "RunHostStatus_runId_fkey" FOREIGN KEY ("runId") REFERENCES "Run"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20260926210000_run_host_status_at_dispatch/migration.sql

@@ -0,0 +1,5 @@
+-- The status row is now written with the run, before its comment exists.
+
+-- AlterTable
+ALTER TABLE "RunHostStatus" ALTER COLUMN "commentId" DROP NOT NULL,
+ADD COLUMN "replyToReviewCommentId" TEXT;

package/prisma/migrations/20260927010000_resource_grants/migration.sql

@@ -0,0 +1,72 @@
+-- Resource sharing grants (A2/S2-2, N1, R2-1, A6). Replaces "null owner =
+-- public and mutable by anyone" with explicit grants. See
+-- docs/private/2026-09-26-resource-sharing-grants-spec-and-plan.md.
+-- Needs PostgreSQL 13+ for gen_random_uuid() (core since 13).
+
+-- CreateTable
+CREATE TABLE "ResourceGrant" (
+    "id" TEXT NOT NULL,
+    "resourceType" TEXT NOT NULL,
+    "resourceId" TEXT NOT NULL,
+    "granteeKind" TEXT NOT NULL,
+    "granteePrincipalId" TEXT,
+    "granteeKey" TEXT NOT NULL,
+    "level" TEXT NOT NULL,
+    "source" TEXT NOT NULL DEFAULT 'owner',
+    "grantedById" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "ResourceGrant_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "ResourceGrant_resourceType_resourceId_granteeKey_key" ON "ResourceGrant"("resourceType", "resourceId", "granteeKey");
+
+-- CreateIndex
+CREATE INDEX "ResourceGrant_granteeKey_resourceType_idx" ON "ResourceGrant"("granteeKey", "resourceType");
+
+-- CreateIndex
+CREATE INDEX "ResourceGrant_granteePrincipalId_idx" ON "ResourceGrant"("granteePrincipalId");
+
+-- AddForeignKey
+ALTER TABLE "ResourceGrant" ADD CONSTRAINT "ResourceGrant_granteePrincipalId_fkey" FOREIGN KEY ("granteePrincipalId") REFERENCES "Principal"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- Grantee shape. Not representable in schema.prisma (like DatastoreEntry_scope_xor,
+-- 20260912040000_named_shared_datastores), so invisible to migrate diff.
+ALTER TABLE "ResourceGrant" ADD CONSTRAINT "ResourceGrant_grantee_shape" CHECK (
+    ("granteeKind" = 'principal' AND "granteePrincipalId" IS NOT NULL
+        AND "granteeKey" = 'principal:' || "granteePrincipalId")
+    OR ("granteeKind" = 'everyone' AND "granteePrincipalId" IS NULL AND "granteeKey" = 'everyone')
+);
+
+-- AlterTable
+ALTER TABLE "Run" ADD COLUMN "triggeredById" TEXT;
+
+-- CreateIndex
+CREATE INDEX "Run_agentId_triggeredById_idx" ON "Run"("agentId", "triggeredById");
+
+-- AlterTable
+ALTER TABLE "AgentTool" ADD COLUMN "attachedById" TEXT,
+    ADD COLUMN "capabilitiesGrantedById" TEXT;
+
+-- Data: owner-less agents keep working at execute-for-everyone; nobody can edit them.
+INSERT INTO "ResourceGrant" ("id", "resourceType", "resourceId", "granteeKind", "granteeKey", "level", "source", "updatedAt")
+SELECT gen_random_uuid()::text, 'agent', a."id", 'everyone', 'everyone', 'execute', 'migration_public', CURRENT_TIMESTAMP
+FROM "Agent" a WHERE a."ownerId" IS NULL;
+
+-- Data: capabilities on an owned agent whose tool is the owner's or owner-less
+-- were set by that owner (only the owner could attach to an owned agent, and
+-- only its own or an owner-less tool), so they carry its consent. Every other
+-- attachment stays unstamped = inert until the owner re-grants.
+UPDATE "AgentTool" at
+SET "capabilitiesGrantedById" = a."ownerId", "attachedById" = a."ownerId"
+FROM "Agent" a, "Tool" t
+WHERE a."id" = at."agentId" AND t."id" = at."toolId"
+  AND a."ownerId" IS NOT NULL
+  AND (t."ownerId" IS NULL OR t."ownerId" = a."ownerId");
+
+-- Data: triggerer of historic runs, where a Task recorded it.
+UPDATE "Run" r SET "triggeredById" = t."principalId"
+FROM "Task" t
+WHERE t."runId" = r."id" AND t."kind" = 'run' AND t."principalId" IS NOT NULL;

package/prisma/migrations/20260927020000_proxy_session_budget_exhausted/migration.sql

@@ -0,0 +1,3 @@
+-- Record the first time the coding proxy refuses a session's request for
+-- budget, so the run can be reported as out of budget rather than failed.
+ALTER TABLE "CodingProxySession" ADD COLUMN "budgetExhaustedAt" TIMESTAMP(3);

package/prisma/migrations/20260927030000_coding_debug_trace/migration.sql

@@ -0,0 +1,4 @@
+-- Admin-requested debug trace for coding runs: the profile carries an expiry,
+-- and each run records at dispatch whether it was traced.
+ALTER TABLE "CodingAgentProfile" ADD COLUMN "debugTraceUntil" TIMESTAMP(3);
+ALTER TABLE "CodingRun" ADD COLUMN "debugTrace" BOOLEAN NOT NULL DEFAULT false;

package/prisma/migrations/20260927040000_proxy_session_upstream_failure/migration.sql

@@ -0,0 +1,3 @@
+-- Record the first upstream failure code the coding proxy relays for a
+-- session, so the run can be reported as refused by the model provider.
+ALTER TABLE "CodingProxySession" ADD COLUMN "upstreamFailure" TEXT;