@wardby/cli 0.3.0 → 0.4.1

package/dist/core/scheduler.d.ts

@@ -9,6 +9,7 @@
 import type { Agent } from "#prisma";
 import type { Executor } from "../providers/executor/types.js";
 import { type DispatchDb } from "./dispatch.js";
+import type { SelfDefectSink } from "./self-defects.js";
 export type SchedulerDb = DispatchDb;
 /**
  * Per spec: "Executor throws synchronously on start → the run is marked
@@ -25,7 +26,7 @@ export declare function findDueCandidates(db: Pick<SchedulerDb, "agent">, now: D
  * Returns the new run's id, or null if the agent wasn't (or is no longer)
  * due, or another tick already holds its row lock.
  */
-export declare function claimDueRun(db: SchedulerDb, executor: Executor, agentId: string, now: Date): Promise<string | null>;
+export declare function claimDueRun(db: SchedulerDb, executor: Executor, agentId: string, now: Date, selfDefects?: SelfDefectSink): Promise<string | null>;
 export interface SchedulerOptions {
     executor: Executor;
     db?: SchedulerDb;
@@ -39,6 +40,8 @@ export interface SchedulerOptions {
      * failing hook cannot stop scheduled agents from firing.
      */
     onLeaderTick?: () => Promise<void>;
+    /** Files a self-defect when a scheduled run's executor fails to start it. Optional. */
+    selfDefects?: SelfDefectSink;
 }
 export interface SchedulerHandle {
     stop(): void;

package/dist/core/scheduler.js

@@ -39,11 +39,12 @@ export async function findDueCandidates(db, now) {
  * Returns the new run's id, or null if the agent wasn't (or is no longer)
  * due, or another tick already holds its row lock.
  */
-export async function claimDueRun(db, executor, agentId, now) {
+export async function claimDueRun(db, executor, agentId, now, selfDefects) {
     const dispatched = await dispatchRun({
         db,
         executor,
         agentId,
+        selfDefects,
         trigger: "scheduled",
         now,
         lockAgent: true,
@@ -88,7 +89,7 @@ export function startScheduler(options) {
         const due = await findDueCandidates(db, now());
         for (const agent of due) {
             try {
-                const runId = await claimDueRun(db, options.executor, agent.id, now());
+                const runId = await claimDueRun(db, options.executor, agent.id, now(), options.selfDefects);
                 if (runId) {
                     log(`firing agent "${agent.name}" -> run ${runId}`);
                 }

package/dist/core/self-defects.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Self-defects: when a run of an opted-in agent (Agent.defectProjectKey +
+ * defectIssueType) ends failed, lost or budget_exhausted, the control plane
+ * (no model involved) files a defect for it through fileIssue, deduped by a
+ * structural fingerprint so a recurring failure becomes "seen again" comments
+ * on one issue rather than a new issue per run.
+ *
+ *   fingerprint  self:<agentId>:<status>:<category>
+ *   category     CodingRun.failureCategory, else the leading `code:` token of
+ *                Run.error, else "unknown" — only ever a closed-shape token
+ *                (lower-case letters/underscore), never the error's free text
+ *
+ * Fails closed: the agent needs a live write link to defectProjectKey whose
+ * creatableIssueTypes includes defectIssueType; otherwise it logs and skips.
+ * Self-defects are not counted against the link's maxNewIssuesPerRun: that cap
+ * bounds what a run's model may create, while this is a control-plane action
+ * whose volume the fingerprint dedupe already bounds (one open issue per
+ * agent/status/category).
+ *
+ * Filed by whichever write made the run's row terminal (its update count says so, so a run files once): the
+ * runner, the container store, the reconciler, the coding queue's timeout, a failed executor start
+ * (markRunFailedFromExecutorError) and DBOS recovery's mark-failed.
+ *
+ * Best effort and never throws. No recursion: this is only ever called after a
+ * run's row is final, outside any run, and a failure to file only logs — it
+ * never fails a run, so it can never trigger another filing.
+ */
+import type { PrismaClient } from "#prisma";
+import { type IssueTrackerRegistry } from "../providers/issue-tracker/types.js";
+import { type FileIssueInput, type FileIssueResult } from "./issue-dedupe.js";
+/** Run statuses that file a defect; succeeded, cancelled and refused never do. */
+export declare const SELF_DEFECT_STATUSES: ReadonlySet<string>;
+/** How long a caller waits for the filing; past this it carries on in the background (and still only logs). */
+export declare const SELF_DEFECT_WAIT_MS = 15000;
+export type SelfDefectDb = Pick<PrismaClient, "agent" | "agentIssueProject" | "codingRun" | "$transaction">;
+/** The finished run, as its final row has it. */
+export interface SelfDefectRun {
+    id: string;
+    agentId: string;
+    status: string;
+    error: string | null;
+    finishedAt: Date | null;
+}
+export interface SelfDefectOptions {
+    /** Injected for tests; defaults to issue-dedupe's fileIssue on `db`. */
+    fileIssue?: (input: FileIssueInput) => Promise<FileIssueResult>;
+    waitMs?: number;
+}
+/**
+ * Where a write that ends a run files its self-defect: the database to read the run and file through, and the
+ * configured issue trackers. Absent, or with no tracker configured, the write files nothing and makes no extra query.
+ */
+export interface SelfDefectSink {
+    db: SelfDefectDb & Pick<PrismaClient, "run">;
+    issueTrackers?: IssueTrackerRegistry;
+    /** Injected for tests; the wait defaults to SELF_DEFECT_SHORT_WAIT_MS. */
+    options?: SelfDefectOptions;
+}
+/** The bound for callers on a dispatch, queue or executor path: past it the filing carries on detached. */
+export declare const SELF_DEFECT_SHORT_WAIT_MS = 2000;
+/** True when at least one issue tracker is configured (no Jira site configured yields an empty registry). */
+export declare function hasIssueTrackers(trackers: IssueTrackerRegistry | undefined): trackers is IssueTrackerRegistry;
+/**
+ * The leading `code:` token of a run error (lower-cased) when it is a safe category (CATEGORY_PATTERN), else
+ * "unknown". Never any of the free text after it.
+ */
+export declare function errorClass(error: string | null | undefined): string;
+export declare function selfDefectFingerprint(agentId: string, status: string, category: string): string;
+/**
+ * Files (or re-sights) the defect for a finished run. Resolves to the filing's
+ * result, or null when nothing was filed (not a filing status, not opted in,
+ * no live link, an error, or still in flight after `waitMs`). Never throws.
+ */
+export declare function fileSelfDefect(db: SelfDefectDb, trackers: IssueTrackerRegistry | undefined, run: SelfDefectRun, opts?: SelfDefectOptions): Promise<FileIssueResult | null>;
+/**
+ * For a write that just made `runId` terminal (its update count said so, so this files once): reads the final row
+ * and files its self-defect, waiting at most SELF_DEFECT_SHORT_WAIT_MS. No-op, with no query, without a configured
+ * tracker. Never throws.
+ */
+export declare function fileSelfDefectForRun(sink: SelfDefectSink | undefined, runId: string): Promise<FileIssueResult | null>;

package/dist/core/self-defects.js

@@ -0,0 +1,180 @@
+import { agentFooter } from "../providers/issue-tracker/jira.js";
+import { ISSUE_TRACKER_PROVIDERS, } from "../providers/issue-tracker/types.js";
+import { fileIssue } from "./issue-dedupe.js";
+import { propertyKey } from "./issue-tracker-tools.js";
+import { logger } from "./logger.js";
+const log = logger.child({ module: "self-defects" });
+/** Run statuses that file a defect; succeeded, cancelled and refused never do. */
+export const SELF_DEFECT_STATUSES = new Set(["failed", "lost", "budget_exhausted"]);
+/** How long a caller waits for the filing; past this it carries on in the background (and still only logs). */
+export const SELF_DEFECT_WAIT_MS = 15_000;
+const SUMMARY_MAX_LENGTH = 255;
+/**
+ * What a category may look like to be published in the issue and fingerprint: lower-case letters and underscores,
+ * at most 32. No digits, dots or dashes, so secret-shaped (ghp_…, sk-ant-…), host-shaped (db.internal.corp) and
+ * id-shaped (run-8f3a…) prefixes never reach Jira and fingerprints stay a small closed set.
+ */
+const CATEGORY_PATTERN = /^[a-z][a-z_]{0,31}$/;
+/** The bound for callers on a dispatch, queue or executor path: past it the filing carries on detached. */
+export const SELF_DEFECT_SHORT_WAIT_MS = 2_000;
+/** True when at least one issue tracker is configured (no Jira site configured yields an empty registry). */
+export function hasIssueTrackers(trackers) {
+    return !!trackers && Object.values(trackers).some(Boolean);
+}
+/**
+ * The leading `code:` token of a run error (lower-cased) when it is a safe category (CATEGORY_PATTERN), else
+ * "unknown". Never any of the free text after it.
+ */
+export function errorClass(error) {
+    const match = /^([^:\s]{1,64}):/.exec(error ?? "");
+    return safeCategory(match?.[1]) ?? "unknown";
+}
+export function selfDefectFingerprint(agentId, status, category) {
+    return `self:${agentId}:${status}:${category}`;
+}
+function safeCategory(value) {
+    const lowered = value?.trim().toLowerCase();
+    return lowered && CATEGORY_PATTERN.test(lowered) ? lowered : null;
+}
+/**
+ * Files (or re-sights) the defect for a finished run. Resolves to the filing's
+ * result, or null when nothing was filed (not a filing status, not opted in,
+ * no live link, an error, or still in flight after `waitMs`). Never throws.
+ */
+export async function fileSelfDefect(db, trackers, run, opts = {}) {
+    if (!SELF_DEFECT_STATUSES.has(run.status) || !trackers)
+        return null;
+    const filing = attempt(db, trackers, run, opts).catch((err) => {
+        log.warn({ err, runId: run.id, agentId: run.agentId }, "could not file the run's self-defect");
+        return null;
+    });
+    const waitMs = opts.waitMs ?? SELF_DEFECT_WAIT_MS;
+    let timer;
+    const timedOut = new Promise((resolve) => {
+        timer = setTimeout(() => {
+            log.warn({ runId: run.id, waitMs }, "self-defect filing still in progress; no longer waiting for it");
+            resolve(null);
+        }, waitMs);
+        timer.unref?.();
+    });
+    try {
+        return await Promise.race([filing, timedOut]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * For a write that just made `runId` terminal (its update count said so, so this files once): reads the final row
+ * and files its self-defect, waiting at most SELF_DEFECT_SHORT_WAIT_MS. No-op, with no query, without a configured
+ * tracker. Never throws.
+ */
+export async function fileSelfDefectForRun(sink, runId) {
+    if (!sink || !hasIssueTrackers(sink.issueTrackers))
+        return null;
+    let row;
+    try {
+        row = await sink.db.run.findUnique({
+            where: { id: runId },
+            select: { id: true, agentId: true, status: true, error: true, finishedAt: true },
+        });
+    }
+    catch (err) {
+        log.warn({ err, runId }, "could not read the run to file its self-defect");
+        return null;
+    }
+    if (!row)
+        return null;
+    return fileSelfDefect(sink.db, sink.issueTrackers, row, {
+        waitMs: SELF_DEFECT_SHORT_WAIT_MS,
+        ...sink.options,
+    });
+}
+async function attempt(db, trackers, run, opts) {
+    const configured = ISSUE_TRACKER_PROVIDERS.filter((p) => trackers[p]);
+    if (configured.length === 0)
+        return null;
+    const agent = await db.agent.findUnique({
+        where: { id: run.agentId },
+        select: { id: true, name: true, defectProjectKey: true, defectIssueType: true },
+    });
+    if (!agent?.defectProjectKey || !agent.defectIssueType)
+        return null;
+    const projectKey = agent.defectProjectKey;
+    const issueType = agent.defectIssueType;
+    let tracker;
+    let link;
+    for (const provider of configured) {
+        // Live, read now: an unlink, downgrade or allowlist change since the run started applies here.
+        const row = await db.agentIssueProject.findUnique({
+            where: { agentId_provider_projectKey: { agentId: agent.id, provider, projectKey } },
+            select: {
+                provider: true,
+                projectKey: true,
+                access: true,
+                commentVisibilityRole: true,
+                creatableIssueTypes: true,
+            },
+        });
+        if (!row)
+            continue;
+        const typeAllowed = row.creatableIssueTypes.some((t) => t.trim().toLowerCase() === issueType.trim().toLowerCase());
+        if (row.access !== "write" || !typeAllowed) {
+            log.warn({ runId: run.id, agentId: agent.id, projectKey, access: row.access, typeAllowed }, "self-defects skipped: the agent's link to the defect project is not writable or does not allow the issue type");
+            return null;
+        }
+        tracker = trackers[provider];
+        link = row;
+        break;
+    }
+    if (!tracker || !link) {
+        log.warn({ runId: run.id, agentId: agent.id, projectKey }, "self-defects skipped: no link to the defect project");
+        return null;
+    }
+    let codingCategory = null;
+    try {
+        const coding = await db.codingRun.findUnique({ where: { runId: run.id }, select: { failureCategory: true } });
+        codingCategory = safeCategory(coding?.failureCategory);
+    }
+    catch (err) {
+        log.debug({ err, runId: run.id }, "no coding failure category for the self-defect");
+    }
+    const category = codingCategory ?? errorClass(run.error);
+    const finished = (run.finishedAt ?? new Date()).toISOString();
+    const summary = `wardby agent "${agent.name}": ${run.status}${category === "unknown" ? "" : ` (${category})`}`;
+    const description = [
+        `A run of wardby agent "${agent.name}" ended ${run.status}.`,
+        "",
+        `- Run: ${run.id}`,
+        `- Agent: ${agent.id}`,
+        `- Status: ${run.status}`,
+        `- Failure category: ${category}`,
+        `- Finished: ${finished}`,
+        "",
+        "Filed by wardby itself. The run's error text is not included; see the run in wardby for details.",
+    ].join("\n");
+    const file = opts.fileIssue ?? ((input) => fileIssue({ db }, input));
+    // Not subject to maxNewIssuesPerRun (control plane; dedupe bounds volume), so createAllowed stays at its default.
+    const result = await file({
+        agentId: agent.id,
+        runId: run.id,
+        link,
+        tracker,
+        fingerprint: selfDefectFingerprint(agent.id, run.status, category),
+        create: {
+            issueType,
+            summary: summary.length > SUMMARY_MAX_LENGTH ? `${summary.slice(0, SUMMARY_MAX_LENGTH - 1)}…` : summary,
+            descriptionMarkdown: description,
+            properties: { [propertyKey(agent.id, "self-defect")]: { runId: run.id } },
+        },
+        footerMarkdown: agentFooter(agent.id),
+        seenAgainMarkdown: `Run ${run.id} ended ${run.status} at ${finished}.\n\n${agentFooter(agent.id)}`,
+    });
+    if ("error" in result) {
+        log.warn({ runId: run.id, agentId: agent.id, error: result.error }, "self-defect filing failed");
+    }
+    else {
+        log.info({ runId: run.id, agentId: agent.id, outcome: result.outcome, issueKey: result.issueKey }, "self-defect filed");
+    }
+    return result;
+}

package/dist/core/tool-names.js

@@ -1,5 +1,6 @@
 import { MEMORY_TOOL_NAMES } from "./memory-tools.js";
 import { SUBAGENT_MEMORY_TOOL_NAMES } from "./subagent-memory-tools.js";
+import { ISSUE_TRACKER_TOOL_NAMES } from "./issue-tracker-tools.js";
 /** The runner's synthesized sub-agent tools are `delegate_to_<boundName>`. */
 export const DELEGATE_TOOL_PREFIX = "delegate_to_";
 /**
@@ -13,6 +14,8 @@ export function reservedToolNameReason(name) {
     if (SUBAGENT_MEMORY_TOOL_NAMES.has(name)) {
         return `Tool name "${name}" is reserved for the built-in sub-agent memory tools.`;
     }
+    if (ISSUE_TRACKER_TOOL_NAMES.has(name))
+        return `Tool name "${name}" is reserved for the built-in Jira tools.`;
     if (name.startsWith(DELEGATE_TOOL_PREFIX)) {
         return `Tool names starting with "${DELEGATE_TOOL_PREFIX}" are reserved for sub-agent delegation tools.`;
     }

package/dist/core/webhooks.d.ts

@@ -1,5 +1,6 @@
 import type { PrismaClient, Webhook } from "#prisma";
 import type { Executor } from "../providers/executor/types.js";
+import type { IssueTrackerRegistry } from "../providers/issue-tracker/types.js";
 export type WebhookMetadata = Pick<Webhook, "id" | "agentId" | "status" | "ownerId" | "createdAt" | "lastFiredAt">;
 /** Creates a webhook and returns the raw secret ONCE — only its hash is ever stored. */
 export declare function createWebhook(agentId: string, ownerId: string, db: PrismaClient): Promise<{
@@ -21,10 +22,17 @@ export type ResolveWebhookRunResult = {
 } | {
     ok: false;
     reason: "not_found" | "invalid_secret" | "disabled";
+} | {
+    ok: false;
+    reason: "invalid_issue";
+    message: string;
 };
 /**
  * Validates the presented secret and, if valid + enabled, enqueues a run via
  * the exact same `createRun` path `trigger_agent`/the scheduler use — the
  * budget guardrail applies identically regardless of what triggered the run.
  */
-export declare function resolveWebhookRun(id: string, presentedSecret: string, db: PrismaClient, executor: Executor, codingTask?: string): Promise<ResolveWebhookRunResult>;
+export declare function resolveWebhookRun(id: string, presentedSecret: string, db: PrismaClient, executor: Executor, codingTask?: string, opts?: {
+    issue?: unknown;
+    issueTrackers?: IssueTrackerRegistry;
+}): Promise<ResolveWebhookRunResult>;

package/dist/core/webhooks.js

@@ -9,6 +9,7 @@
  * is always 32 bytes, so there's no length-mismatch case to special-case).
  */
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { AttributionError, explicitAttribution, RESPONSE_PATH_SNAPSHOT_BUDGET, } from "./attribution.js";
 import { dispatchRun } from "./dispatch.js";
 import { atLeast, effectiveAccess } from "./grants.js";
 function hashSecret(secret) {
@@ -66,7 +67,7 @@ export async function deleteWebhook(id, db) {
  * the exact same `createRun` path `trigger_agent`/the scheduler use — the
  * budget guardrail applies identically regardless of what triggered the run.
  */
-export async function resolveWebhookRun(id, presentedSecret, db, executor, codingTask) {
+export async function resolveWebhookRun(id, presentedSecret, db, executor, codingTask, opts = {}) {
     const webhook = await db.webhook.findUnique({ where: { id } });
     if (!webhook)
         return { ok: false, reason: "not_found" };
@@ -80,12 +81,29 @@ export async function resolveWebhookRun(id, presentedSecret, db, executor, codin
     if (codingTask !== undefined && !taskAllowed(agent.kind, agent.codingProfile)) {
         return { ok: false, reason: "disabled" };
     }
+    // An invalid or unlinked issue refuses the call before any run exists.
+    let attribution;
+    if (opts.issue !== undefined) {
+        try {
+            attribution = await explicitAttribution(db, opts.issueTrackers, agent.id, opts.issue, {
+                ...RESPONSE_PATH_SNAPSHOT_BUDGET,
+                field: "wardbyIssue",
+            });
+        }
+        catch (err) {
+            if (err instanceof AttributionError)
+                return { ok: false, reason: "invalid_issue", message: err.message };
+            throw err;
+        }
+    }
     let rejected = "disabled";
     const dispatched = await dispatchRun({
         db,
         executor,
+        selfDefects: { db, issueTrackers: opts.issueTrackers },
         agentId: agent.id,
         trigger: "webhook",
+        attribution,
         // Coding agents keep the existing per-agent opt-in (allowWebhookTaskOverride);
         // a native agent's system prompt has no per-run input at all otherwise, so
         // accepting task text over an authenticated webhook call needs no separate

package/dist/env.js

@@ -17,4 +17,9 @@ const projectDir = resolve(process.env.WARDBY_PROJECT_DIR || process.cwd());
 // process variable, preserving explicit shell/container configuration as the
 // highest-priority source in either mode.
 dotenvFlow.config({ path: join(projectDir, ".wardby"), silent: true });
-dotenvFlow.config({ path: projectDir });
+// The application's own .env files are optional: dotenv-flow reports "no .env*
+// files" as a failure, so only load when some exist. Not `silent: true`, which
+// would also hide parse errors in a real .env.
+if (dotenvFlow.listFiles({ path: projectDir, node_env: process.env.NODE_ENV }).length > 0) {
+    dotenvFlow.config({ path: projectDir });
+}

package/dist/generated/prisma/browser.d.ts

@@ -122,6 +122,18 @@ export type CodingRun = Prisma.CodingRunModel;
  * "external" is reserved.
  */
 export type CodingService = Prisma.CodingServiceModel;
+/**
+ * Model CodingRunServiceStatus
+ * Live start-up state of one coding-run service (one row per run x
+ * service), written by the job launcher as it observes the service, for
+ * display only (the viewer). The run's CodingRun.services
+ * snapshot says what was started; this says how far each one got.
+ * `attempts` is the readiness probes made so far, known only where wardby
+ * runs the probe itself (Docker); `reason` is a fixed identifier
+ * (image_unavailable, start_failed, exited, probe_failed, timed_out),
+ * never probe output.
+ */
+export type CodingRunServiceStatus = Prisma.CodingRunServiceStatusModel;
 /**
  * Model CodingProxySession
  * Trusted-boundary state for one coding run. Only a capability digest and an
@@ -326,3 +338,57 @@ export type HostIdentity = Prisma.HostIdentityModel;
  * Lives 10 minutes.
  */
 export type HostIdentityLinkRequest = Prisma.HostIdentityLinkRequestModel;
+/**
+ * Model AgentIssueProject
+ * Which issue-tracker projects (Jira today) a native agent may act on, and
+ * which issue events trigger it. Admin-approved in phase 1 (no way to verify
+ * an owner's Jira access). See
+ * docs/private/2026-09-30-jira-issue-tracker-design.md §3.
+ */
+export type AgentIssueProject = Prisma.AgentIssueProjectModel;
+/**
+ * Model IssueFingerprint
+ * Dedupe record: an issue wardby created for a fingerprint (several over time — regressions).
+ */
+export type IssueFingerprint = Prisma.IssueFingerprintModel;
+/**
+ * Model IssuePullRequest
+ * A pull request wardby opened for a tracker issue (the Jira -> code bridge). Provider-neutral on both sides.
+ * Deliberately no foreign keys to Agent or Run: audit-style rows that survive agent/run deletion.
+ */
+export type IssuePullRequest = Prisma.IssuePullRequestModel;
+/**
+ * Model RunIssueStatus
+ * The status comment wardby posts on the Jira issue whose event started this
+ * run ("working on it"), edited with the outcome when the run ends.
+ */
+export type RunIssueStatus = Prisma.RunIssueStatusModel;
+/**
+ * Model WorkItem
+ * Latest known state of an issue/epic in an external tracker (Jira, later
+ * Linear). Shared by every run attributed to it; titles are refreshed by the
+ * next snapshot, so reports always show current names.
+ */
+export type WorkItem = Prisma.WorkItemModel;
+/**
+ * Model RunAttribution
+ * Which work item a run's cost belongs to, with its parent frozen as of
+ * dispatch. Written in dispatchRun's persist transaction; child runs copy
+ * their parent's row (source "inherited"). Control-plane data only.
+ */
+export type RunAttribution = Prisma.RunAttributionModel;
+/**
+ * Model RunModelUsage
+ * Per-run, per-model usage by priced token kind. Sum of costUsd over a
+ * run's rows equals Run.costUsd (to Run.costUsd's 6 decimal places).
+ */
+export type RunModelUsage = Prisma.RunModelUsageModel;
+/**
+ * Model ModelCatalogEntry
+ * A deployment's override of the shipped model catalog
+ * (src/providers/llm/catalog-shipped.ts), written by set_model /
+ * disable_model (models:admin). A row fully replaces the shipped entry with
+ * the same key; enabled=false removes the model; a row with no shipped match
+ * adds one. Rates are the provider's exact published numbers (sourceUrl).
+ */
+export type ModelCatalogEntry = Prisma.ModelCatalogEntryModel;

package/dist/generated/prisma/client.d.ts

@@ -141,6 +141,18 @@ export type CodingRun = Prisma.CodingRunModel;
  * "external" is reserved.
  */
 export type CodingService = Prisma.CodingServiceModel;
+/**
+ * Model CodingRunServiceStatus
+ * Live start-up state of one coding-run service (one row per run x
+ * service), written by the job launcher as it observes the service, for
+ * display only (the viewer). The run's CodingRun.services
+ * snapshot says what was started; this says how far each one got.
+ * `attempts` is the readiness probes made so far, known only where wardby
+ * runs the probe itself (Docker); `reason` is a fixed identifier
+ * (image_unavailable, start_failed, exited, probe_failed, timed_out),
+ * never probe output.
+ */
+export type CodingRunServiceStatus = Prisma.CodingRunServiceStatusModel;
 /**
  * Model CodingProxySession
  * Trusted-boundary state for one coding run. Only a capability digest and an
@@ -345,3 +357,57 @@ export type HostIdentity = Prisma.HostIdentityModel;
  * Lives 10 minutes.
  */
 export type HostIdentityLinkRequest = Prisma.HostIdentityLinkRequestModel;
+/**
+ * Model AgentIssueProject
+ * Which issue-tracker projects (Jira today) a native agent may act on, and
+ * which issue events trigger it. Admin-approved in phase 1 (no way to verify
+ * an owner's Jira access). See
+ * docs/private/2026-09-30-jira-issue-tracker-design.md §3.
+ */
+export type AgentIssueProject = Prisma.AgentIssueProjectModel;
+/**
+ * Model IssueFingerprint
+ * Dedupe record: an issue wardby created for a fingerprint (several over time — regressions).
+ */
+export type IssueFingerprint = Prisma.IssueFingerprintModel;
+/**
+ * Model IssuePullRequest
+ * A pull request wardby opened for a tracker issue (the Jira -> code bridge). Provider-neutral on both sides.
+ * Deliberately no foreign keys to Agent or Run: audit-style rows that survive agent/run deletion.
+ */
+export type IssuePullRequest = Prisma.IssuePullRequestModel;
+/**
+ * Model RunIssueStatus
+ * The status comment wardby posts on the Jira issue whose event started this
+ * run ("working on it"), edited with the outcome when the run ends.
+ */
+export type RunIssueStatus = Prisma.RunIssueStatusModel;
+/**
+ * Model WorkItem
+ * Latest known state of an issue/epic in an external tracker (Jira, later
+ * Linear). Shared by every run attributed to it; titles are refreshed by the
+ * next snapshot, so reports always show current names.
+ */
+export type WorkItem = Prisma.WorkItemModel;
+/**
+ * Model RunAttribution
+ * Which work item a run's cost belongs to, with its parent frozen as of
+ * dispatch. Written in dispatchRun's persist transaction; child runs copy
+ * their parent's row (source "inherited"). Control-plane data only.
+ */
+export type RunAttribution = Prisma.RunAttributionModel;
+/**
+ * Model RunModelUsage
+ * Per-run, per-model usage by priced token kind. Sum of costUsd over a
+ * run's rows equals Run.costUsd (to Run.costUsd's 6 decimal places).
+ */
+export type RunModelUsage = Prisma.RunModelUsageModel;
+/**
+ * Model ModelCatalogEntry
+ * A deployment's override of the shipped model catalog
+ * (src/providers/llm/catalog-shipped.ts), written by set_model /
+ * disable_model (models:admin). A row fully replaces the shipped entry with
+ * the same key; enabled=false removes the model; a row with no shipped match
+ * adds one. Rates are the provider's exact published numbers (sourceUrl).
+ */
+export type ModelCatalogEntry = Prisma.ModelCatalogEntryModel;