@wardby/cli 0.3.0 → 0.4.1

package/dist/providers/issue-tracker/types.d.ts

@@ -0,0 +1,269 @@
+/**
+ * Host-neutral issue-tracker surface for native agents. Jira Cloud is the
+ * first implementation (./jira.ts). The control plane holds the credential;
+ * no method takes a token. See docs/private/2026-09-30-jira-issue-tracker-design.md.
+ */
+export type IssueTrackerProvider = "jira";
+export declare const ISSUE_TRACKER_PROVIDERS: readonly IssueTrackerProvider[];
+/** The product name shown to people (e.g. in a pull request's "Resolves Jira issue …" line). */
+export declare const ISSUE_TRACKER_NAMES: Readonly<Record<IssueTrackerProvider, string>>;
+export interface IssuePerson {
+    accountId: string;
+    displayName: string;
+}
+export interface IssueCommentView {
+    id: string;
+    author: IssuePerson | null;
+    created: string;
+    body: string;
+    /** Written by the bot and carrying this agent's footer: editable with jira_edit_own_comment. */
+    byThisAgent: boolean;
+}
+export interface IssueView {
+    key: string;
+    projectKey: string;
+    summary: string;
+    description: string;
+    status: string;
+    /** The status's category (Jira statusCategory.key): "done" is what dedupe treats as resolved. */
+    statusCategory: IssueStatusCategory;
+    issueType: string;
+    priority: string | null;
+    labels: string[];
+    assignee: IssuePerson | null;
+    reporter: IssuePerson | null;
+    url: string;
+    /** Most recent last; capped. */
+    comments: IssueCommentView[];
+    commentsTruncated: boolean;
+    /** Capped list; contents are read with readAttachmentText. Filenames are untrusted. */
+    attachments: IssueAttachmentView[];
+    /** Issue links (e.g. "relates to PROJ-9"), capped. Summaries are untrusted issue text. */
+    links: IssueLinkView[];
+}
+export interface IssueLinkView {
+    /** How this issue relates to the other, as Jira words it from this side ("relates to", "is blocked by"). */
+    relation: string;
+    key: string;
+    summary: string;
+    status: string;
+}
+export type IssueStatusCategory = "new" | "indeterminate" | "done";
+export interface IssueAttachmentView {
+    id: string;
+    filename: string;
+    mimeType: string;
+    size: number;
+}
+export interface CreateIssueInput {
+    projectKey: string;
+    /** Issue type name (case-insensitive); resolved to an id from the project's create metadata. */
+    issueType: string;
+    summary: string;
+    descriptionMarkdown: string;
+    labels?: string[];
+    /** Priority name. */
+    priority?: string;
+    /** Component names. */
+    components?: string[];
+    parentKey?: string;
+    /** customfield_N -> raw JSON value. */
+    customFields?: Record<string, unknown>;
+    /** Issue properties, set in the create call itself. */
+    properties?: Record<string, unknown>;
+    /** Projects whose bare issue keys in the description become smart links. */
+    issueKeyProjects?: readonly string[];
+}
+export interface CreateMetaIssueType {
+    id: string;
+    name: string;
+    subtask: boolean;
+}
+export interface CreateMetaField {
+    fieldId: string;
+    name: string;
+    required: boolean;
+    hasDefault: boolean;
+    allowedValues?: string[];
+}
+export interface IssueSearchHit {
+    key: string;
+    summary: string;
+    status: string;
+    issueType: string;
+    updated: string;
+    url: string;
+}
+export interface IssueSearchResult {
+    issues: IssueSearchHit[];
+    truncated: boolean;
+}
+/** Who the tracker credential acts as (Jira: GET /myself). */
+export interface IssueTrackerIdentity {
+    accountId: string;
+    displayName: string;
+    accountType: string;
+}
+/**
+ * Bounds one tracker call for callers on a latency budget (e.g. inside a database transaction).
+ * `timeoutMs` caps the WHOLE call, every request it makes included; with `retryOn429: false` a 429 fails
+ * at once instead of sleeping for Retry-After, so the call cannot outlive `timeoutMs`.
+ */
+export interface TrackerCallOptions {
+    timeoutMs?: number;
+    retryOn429?: boolean;
+}
+/** What cost attribution keeps about an issue (src/core/attribution.ts): the hierarchy as of now. */
+export interface IssueSnapshot {
+    /** The key that was asked for (WorkItem.key). */
+    key: string;
+    title?: string;
+    type?: string;
+    url: string;
+    /** The project (Jira) / team (Linear) the issue is in now. */
+    scopeKey: string;
+    parent?: {
+        key: string;
+        title?: string;
+        kind: string;
+    };
+}
+export interface IssueTracker {
+    readonly provider: IssueTrackerProvider;
+    /** The bot's own accountId (cached after the first call). */
+    botAccountId(): Promise<string>;
+    /** The account the credential acts as, from the same cached call as botAccountId. */
+    identity(): Promise<IssueTrackerIdentity>;
+    getIssue(key: string, opts: {
+        maxComments: number;
+        agentMarker: string;
+    } & TrackerCallOptions): Promise<IssueView>;
+    /** The project the issue is in now; an old key (kept as an alias after a move) resolves to its new project. */
+    issueProject(key: string): Promise<string>;
+    /** Title, type, scope and parent of `key` in one call, for cost attribution. Throws IssueTrackerError. */
+    snapshotIssue(key: string, opts?: {
+        timeoutMs?: number;
+        retryOn429?: boolean;
+    }): Promise<IssueSnapshot>;
+    search(jql: string, opts: {
+        maxResults: number;
+    }): Promise<IssueSearchResult>;
+    /** Whether issue `key` matches `jql` (used for a link's jqlFilter). Callers on a latency budget pass a short timeout and no 429 retry. */
+    matchesJql(key: string, jql: string, opts?: TrackerCallOptions): Promise<boolean>;
+    comment(key: string, 
+    /** issueKeyProjects: projects whose bare issue keys in the text become smart links. */
+    input: {
+        markdown: string;
+        visibilityRole?: string;
+        issueKeyProjects?: readonly string[];
+    }, opts?: TrackerCallOptions): Promise<{
+        id: string;
+        url: string;
+    }>;
+    editComment(key: string, commentId: string, input: {
+        markdown: string;
+        issueKeyProjects?: readonly string[];
+    }): Promise<void>;
+    /** The comment's author accountId and plain text (uncapped: only for ownership checks, never shown to a model), or null when it doesn't exist. */
+    readComment(key: string, commentId: string): Promise<{
+        authorId: string | null;
+        body: string;
+    } | null>;
+    issueUrl(key: string): string;
+    /** Transitions the service account can perform now: target status name + category. */
+    transitions(key: string): Promise<Array<{
+        id: string;
+        name: string;
+        toStatus: string;
+        toCategory: string;
+    }>>;
+    /** Performs the transition whose target status name matches (case-insensitive). */
+    transitionTo(key: string, toStatus: string): Promise<{
+        transitionId: string;
+        toStatus: string;
+    }>;
+    /** Field ids the service account may edit on this issue (from editmeta). */
+    editableFields(key: string): Promise<string[]>;
+    /** Sets fields: labels (string[]), components (names), priority (name), customfield_N (raw JSON value). */
+    editFields(key: string, fields: Record<string, unknown>): Promise<void>;
+    linkTypes(opts?: TrackerCallOptions): Promise<Array<{
+        name: string;
+        inward: string;
+        outward: string;
+    }>>;
+    linkIssues(input: {
+        type: string;
+        inwardKey: string;
+        outwardKey: string;
+    }, opts?: TrackerCallOptions): Promise<void>;
+    /** Adds (or, for an existing globalId, updates) a web link on the issue: Jira's remote link, shown under "Web links". */
+    addRemoteLink(key: string, input: {
+        globalId: string;
+        url: string;
+        title: string;
+        status?: {
+            resolved: boolean;
+        };
+    }): Promise<void>;
+    /** The property's JSON value, or null when it does not exist. */
+    getProperty(key: string, property: string): Promise<unknown>;
+    setProperty(key: string, property: string, value: unknown): Promise<void>;
+    /** Issue types creatable in the project by the service account. */
+    createMeta(projectKey: string): Promise<{
+        issueTypes: CreateMetaIssueType[];
+    }>;
+    /** Create-screen fields for one issue type (by id). */
+    fieldMeta(projectKey: string, issueTypeId: string): Promise<CreateMetaField[]>;
+    /** Creates an issue; missing required fields (without defaults) fail with tracker_invalid_request naming them. */
+    createIssue(input: CreateIssueInput, opts?: TrackerCallOptions): Promise<{
+        key: string;
+        url: string;
+    }>;
+    /** First `maxBytes` of a text-like attachment, decoded as UTF-8; other types fail with tracker_invalid_request. */
+    readAttachmentText(id: string, maxBytes: number): Promise<{
+        filename: string;
+        mimeType: string;
+        text: string;
+        truncated: boolean;
+    }>;
+}
+export type IssueTrackerErrorCode = "tracker_not_found" | "tracker_permission_denied" | "tracker_rate_limited" | "tracker_invalid_request" | "tracker_api_error" | "tracker_invalid_response";
+export declare class IssueTrackerError extends Error {
+    readonly code: IssueTrackerErrorCode;
+    constructor(code: IssueTrackerErrorCode, message?: string);
+}
+export type IssueTrackerRegistry = Partial<Record<IssueTrackerProvider, IssueTracker>>;
+export type IssueEventKind = "created" | "transitioned" | "labeled" | "assigned" | "mention";
+/** What a webhook adapter (jira-events.ts) normalises a payload into, for src/core/issue-events.ts. */
+export interface IssueEvent {
+    provider: IssueTrackerProvider;
+    projectKey: string;
+    issueKey: string;
+    /** Every kind this one delivery represents (an update can transition AND label). */
+    kinds: IssueEventKind[];
+    actor: {
+        accountId: string;
+        displayName: string;
+    };
+    /** The new status name, with "transitioned". */
+    toStatus?: string;
+    /** Labels added by this change, with "labeled". */
+    addedLabels: string[];
+    /** The new assignee's accountId, with "assigned". */
+    assigneeAccountId?: string;
+    /** The mentioning comment, with "mention". */
+    comment?: {
+        id: string;
+        body: string;
+    };
+    /** Untrusted: whoever wrote them was not gated. Absent when the payload lacked the issue. */
+    subject?: {
+        summary: string;
+        description: string;
+    };
+}
+/** Shared by the ingress and the tools: a Jira issue key, e.g. PROJ-123. */
+export declare const ISSUE_KEY: RegExp;
+/** A Jira project key. */
+export declare const PROJECT_KEY: RegExp;
+export declare const projectOf: (issueKey: string) => string;

package/dist/providers/issue-tracker/types.js

@@ -0,0 +1,16 @@
+export const ISSUE_TRACKER_PROVIDERS = ["jira"];
+/** The product name shown to people (e.g. in a pull request's "Resolves Jira issue …" line). */
+export const ISSUE_TRACKER_NAMES = { jira: "Jira" };
+export class IssueTrackerError extends Error {
+    code;
+    constructor(code, message = code) {
+        super(message);
+        this.code = code;
+        this.name = "IssueTrackerError";
+    }
+}
+/** Shared by the ingress and the tools: a Jira issue key, e.g. PROJ-123. */
+export const ISSUE_KEY = /^[A-Z][A-Z0-9_]{0,254}-[1-9]\d{0,9}$/;
+/** A Jira project key. */
+export const PROJECT_KEY = /^[A-Z][A-Z0-9_]{0,254}$/;
+export const projectOf = (issueKey) => issueKey.slice(0, issueKey.lastIndexOf("-"));

package/dist/providers/jobs/docker.d.ts

@@ -1,5 +1,6 @@
 import { type CollectExclusions } from "../../coding/collect-exclude.js";
 import type { CodingProvider } from "../../coding/provider.js";
+import { type ServiceStateReporter } from "./service-state.js";
 import type { JobHandle, JobResult, JobSpec, JobStatus, WorkspaceJobLauncher } from "./types.js";
 /** How long one service image pull may take before the run fails as service_unready. */
 export declare const SERVICE_IMAGE_PULL_TIMEOUT_MS = 300000;
@@ -99,6 +100,8 @@ export interface DockerJobLauncherOptions {
      * DEFAULT_SERVICE_READY_TIMEOUT_MS). Start-up never runs past the run's own deadline either.
      */
     serviceReadyTimeoutMs?: number;
+    /** Display-only observer of each service's start-up state (the viewer); its errors are ignored. */
+    onServiceState?: ServiceStateReporter;
     /** Optional observer invoked after provisioning fails but before resources are cleaned up. */
     onProvisionFailure?: (context: {
         runId: string;
@@ -148,7 +151,8 @@ export declare class DockerJobLauncher implements WorkspaceJobLauncher {
      * attempt bounded by timeoutSeconds, failing after failureThreshold consecutive failures. A
      * service that exited or vanished fails at once, and so does one still unready when the start-up
      * budget runs out (each probe and wait is clipped to what is left of it). Probe output is never
-     * logged or kept, so these errors carry no cause.
+     * logged or kept, so these errors carry no cause. Returns the number of probes made; records
+     * why it failed in `failure` for the display-only state report.
      */
     private waitForServiceReady;
     private refresh;

package/dist/providers/jobs/docker.js

@@ -12,6 +12,7 @@ import { assertDockerHostSupportsIsolation, assertClaudeAgentContainerInspection
 import { serviceUnreadyError } from "../../coding/services/wording.js";
 import { assertServiceContainerInspection, buildDockerServicePlan, dockerServiceContainerNames, } from "./docker-services.js";
 import { claudeToolSetup } from "./claude-tool-setup.js";
+import { reportServiceState, } from "./service-state.js";
 import { replaceDirectoryFromStaging } from "./workspace-swap.js";
 const BACKEND = "docker";
 const STATE_SCHEMA_VERSION = 1;
@@ -773,41 +774,61 @@ export class DockerJobLauncher {
         if (!keeperId)
             throw new Error("docker_resource_attestation_failed");
         await this.startContainer(keeperName);
+        const report = (name, update) => reportServiceState(this.options.onServiceState, { runId: record.runId, name, ...update });
+        for (const planned of services)
+            await report(planned.service.name, { state: "pending" });
         for (const planned of services) {
             const name = planned.service.name;
-            if (budget.remainingMs() <= 0)
-                throw serviceUnready(name);
-            await this.ensureServiceImage(planned, budget);
-            if (budget.remainingMs() <= 0)
-                throw serviceUnready(name);
-            let createFailure;
+            const failure = { reason: "image_unavailable" };
+            let attempts;
             try {
-                await this.createAndAssert(appendLabels(planned.createArgs, labels), ["container", "inspect", planned.container], (value) => {
-                    const inspected = value;
-                    assertServiceContainerInspection(inspected, record.spec, planned.service, keeperId);
-                    if (!labelsMatch(inspected.Config?.Labels, labels))
-                        throw new Error("docker_resource_attestation_failed");
-                }, undefined, (error) => {
-                    createFailure = error;
-                });
+                if (budget.remainingMs() <= 0)
+                    throw serviceUnready(name);
+                await this.ensureServiceImage(planned, budget);
+                if (budget.remainingMs() <= 0)
+                    throw serviceUnready(name);
+                failure.reason = "start_failed";
+                let createFailure;
+                try {
+                    await this.createAndAssert(appendLabels(planned.createArgs, labels), ["container", "inspect", planned.container], (value) => {
+                        const inspected = value;
+                        assertServiceContainerInspection(inspected, record.spec, planned.service, keeperId);
+                        if (!labelsMatch(inspected.Config?.Labels, labels))
+                            throw new Error("docker_resource_attestation_failed");
+                    }, undefined, (error) => {
+                        createFailure = error;
+                    });
+                }
+                catch (error) {
+                    // createAndAssert tolerates a failed create (a crash retry may find it made), so a service
+                    // Docker refused to create shows up as a failed inspection; the create's own failure is the
+                    // useful cause, not that generic "not found". Attestation failures rethrow as is.
+                    if (error instanceof DockerCommandError)
+                        throw serviceUnready(name, createFailure ?? error);
+                    throw error;
+                }
+                if (budget.remainingMs() <= 0)
+                    throw serviceUnready(name);
+                try {
+                    await this.startContainer(planned.container);
+                }
+                catch (error) {
+                    throw serviceUnready(name, error);
+                }
+                failure.reason = "probe_failed";
+                await report(name, { state: "probing", attempts: 0 });
+                attempts = await this.waitForServiceReady(planned, budget, failure, (made) => report(name, { state: "probing", attempts: made }));
             }
             catch (error) {
-                // createAndAssert tolerates a failed create (a crash retry may find it made), so a service
-                // Docker refused to create shows up as a failed inspection; the create's own failure is the
-                // useful cause, not that generic "not found". Attestation failures rethrow as is.
-                if (error instanceof DockerCommandError)
-                    throw serviceUnready(name, createFailure ?? error);
+                const reason = failure.reason !== "exited" && budget.remainingMs() <= 0 ? "timed_out" : failure.reason;
+                await report(name, {
+                    state: "failed",
+                    reason,
+                    ...(failure.attempts === undefined ? {} : { attempts: failure.attempts }),
+                });
                 throw error;
             }
-            if (budget.remainingMs() <= 0)
-                throw serviceUnready(name);
-            try {
-                await this.startContainer(planned.container);
-            }
-            catch (error) {
-                throw serviceUnready(name, error);
-            }
-            await this.waitForServiceReady(planned, budget);
+            await report(name, { state: "ready", attempts });
         }
         return keeperId;
     }
@@ -844,9 +865,10 @@ export class DockerJobLauncher {
      * attempt bounded by timeoutSeconds, failing after failureThreshold consecutive failures. A
      * service that exited or vanished fails at once, and so does one still unready when the start-up
      * budget runs out (each probe and wait is clipped to what is left of it). Probe output is never
-     * logged or kept, so these errors carry no cause.
+     * logged or kept, so these errors carry no cause. Returns the number of probes made; records
+     * why it failed in `failure` for the display-only state report.
      */
-    async waitForServiceReady(planned, budget) {
+    async waitForServiceReady(planned, budget, failure, onProbeFailed) {
         const { command, periodSeconds, timeoutSeconds, failureThreshold } = planned.service.readiness;
         const name = planned.service.name;
         let failures = 0;
@@ -858,12 +880,16 @@ export class DockerJobLauncher {
                 state = await this.inspect(["container", "inspect", planned.container]);
             }
             catch (error) {
-                if (error instanceof DockerCommandError)
+                if (error instanceof DockerCommandError) {
+                    failure.reason = "exited";
                     throw serviceUnready(name);
+                }
                 throw error;
             }
-            if (state.State?.Running !== true)
+            if (state.State?.Running !== true) {
+                failure.reason = "exited";
                 throw serviceUnready(name);
+            }
             const remaining = budget.remainingMs();
             if (remaining <= 0)
                 throw serviceUnready(name);
@@ -872,13 +898,15 @@ export class DockerJobLauncher {
                     timeoutMs: Math.min(timeoutSeconds * 1_000, remaining),
                     maxOutputBytes: MAX_SERVICE_PROBE_OUTPUT_BYTES,
                 });
-                return;
+                return failures + 1;
             }
             catch {
                 failures += 1;
+                failure.attempts = failures;
                 if (failures >= failureThreshold)
                     throw serviceUnready(name);
             }
+            await onProbeFailed(failures);
             const wait = Math.min(periodSeconds * 1_000, budget.remainingMs());
             if (wait <= 0)
                 throw serviceUnready(name);

package/dist/providers/jobs/kubernetes.d.ts

@@ -1,6 +1,7 @@
 import { type Readable } from "node:stream";
 import type { KubernetesJobConfig } from "../../config/providers.js";
 import { type KubernetesApi } from "./kubernetes-api.js";
+import { type ServiceStateReporter } from "./service-state.js";
 import type { CodingProvider } from "../../coding/provider.js";
 import type { JobHandle, JobResult, JobSpec, JobStatus, WorkspaceJobLauncher } from "./types.js";
 export interface KubernetesClusterInfo {
@@ -38,6 +39,8 @@ export interface KubernetesJobLauncherOptions {
         stream: Readable;
         done: Promise<number>;
     };
+    /** Display-only observer of each service sidecar's start-up state (the viewer); its errors are ignored. */
+    onServiceState?: ServiceStateReporter;
     onWarning?: (message: string) => void;
 }
 /** Archives a trusted local directory with the host's `tar`, under a minimal environment. */

package/dist/providers/jobs/kubernetes.js

@@ -37,6 +37,7 @@ import { ENFORCEMENT_PROBE_DENY_REACHABLE, ENFORCEMENT_PROBE_PROVEN, ENFORCEMENT
 import { claudeToolSetup } from "./claude-tool-setup.js";
 import { readProxyWitness } from "./kubernetes-witness.js";
 import { safeExtract } from "./safe-extract.js";
+import { reportServiceState, } from "./service-state.js";
 import { serviceUnreadyError } from "../../coding/services/wording.js";
 import { replaceDirectoryFromStaging } from "./workspace-swap.js";
 import { collectExclusions, normalizeCollectExclusions, tarExcludeArgs, } from "../../coding/collect-exclude.js";
@@ -156,6 +157,29 @@ const FATAL_WAITING_REASONS = new Set([
     "CreateContainerError",
     "CrashLoopBackOff",
 ]);
+const IMAGE_WAITING_REASONS = new Set(["ErrImagePull", "ImagePullBackOff", "InvalidImageName"]);
+/**
+ * A service sidecar's start-up state as the pod status shows it. The kubelet runs the startup
+ * probe, so attempt counts are unknown here; checks mirror waitForKeeper's own failure rules.
+ */
+function observedServiceState(status) {
+    if (status === undefined)
+        return { state: "pending" };
+    if ((status.restartCount ?? 0) > 0)
+        return { state: "failed", reason: "probe_failed" };
+    const waiting = status.state?.waiting?.reason ?? "";
+    if (IMAGE_WAITING_REASONS.has(waiting))
+        return { state: "failed", reason: "image_unavailable" };
+    if (FATAL_WAITING_REASONS.has(waiting))
+        return { state: "failed", reason: "start_failed" };
+    if (status.state?.terminated !== undefined)
+        return { state: "failed", reason: "exited" };
+    if (status.started === true)
+        return { state: "ready" };
+    if (status.state?.running !== undefined)
+        return { state: "probing" };
+    return { state: "pending" };
+}
 const CAPABILITY = /^rrp_[A-Za-z0-9_-]{16,512}$/;
 const TOKEN = /^[a-f0-9]{20}$/;
 const WORKSPACE_STORAGE = `${STORAGE_ROOT}/workspace`;
@@ -635,7 +659,7 @@ export class KubernetesJobLauncher {
         await this.createIfMissing(() => this.api.createSecret(this.namespace, buildCapabilitySecret(spec, this.namespace, capability, toolSetup)));
         await this.createIfMissing(() => this.api.createNetworkPolicy(this.namespace, policy));
         await this.createIfMissing(() => this.api.createPod(this.namespace, pod));
-        await this.waitForKeeper(names, (spec.services ?? []).map((service) => service.name), spec.provider === "claude-code");
+        await this.waitForKeeper(names, spec.runId, (spec.services ?? []).map((service) => service.name), spec.provider === "claude-code");
         const [actualPod, actualPolicy] = await Promise.all([
             this.api.readPod(this.namespace, names.pod),
             this.api.readNetworkPolicy(this.namespace, names.policy),
@@ -679,8 +703,16 @@ export class KubernetesJobLauncher {
                 throw error;
         }
     }
-    async waitForKeeper(names, serviceNames, toolRunner = false) {
+    async waitForKeeper(names, runId, serviceNames, toolRunner = false) {
         const started = this.now();
+        const reported = new Map();
+        const report = async (name, observed) => {
+            const key = `${observed.state}:${observed.reason ?? ""}`;
+            if (reported.get(name) === key)
+                return;
+            reported.set(name, key);
+            await reportServiceState(this.options.onServiceState, { runId, name, ...observed });
+        };
         for (;;) {
             const pod = await this.api.readPod(this.namespace, names.pod);
             if (!pod || pod.status?.phase === "Failed")
@@ -688,6 +720,8 @@ export class KubernetesJobLauncher {
             const statuses = pod.status?.containerStatuses ?? [];
             const initStatuses = pod.status?.initContainerStatuses ?? [];
             const sidecar = (name) => initStatuses.find((status) => status.name === serviceContainerName(name));
+            for (const name of serviceNames)
+                await report(name, observedServiceState(sidecar(name)));
             // A service sidecar that restarted (its startup probe gave up), can't be pulled or created, or
             // exited will never let the keeper start. Name the service rather than a generic start failure.
             const failedService = serviceNames.find((name) => {
@@ -711,8 +745,12 @@ export class KubernetesJobLauncher {
                 keeper?.state?.terminated !== undefined) {
                 throw new Error("kubernetes_pod_start_failed");
             }
-            if (keeper?.ready === true)
+            if (keeper?.ready === true) {
+                // Native sidecars start in order before the keeper, so a ready keeper means every service started.
+                for (const name of serviceNames)
+                    await report(name, { state: "ready" });
                 return;
+            }
             if (this.now() - started >= this.readyTimeoutMs) {
                 if (toolRunner && toolStatus?.started !== true) {
                     throw new Error("kubernetes_tool_runner_unready");
@@ -720,8 +758,10 @@ export class KubernetesJobLauncher {
                 // At the bound, a service that never passed its startup probe (still pulling, still starting)
                 // is why the keeper never started.
                 const waiting = serviceNames.find((name) => sidecar(name)?.started !== true);
-                if (waiting !== undefined)
+                if (waiting !== undefined) {
+                    await report(waiting, { state: "failed", reason: "timed_out" });
                     throw serviceUnreadyError(waiting);
+                }
                 throw new Error("kubernetes_pod_start_timeout");
             }
             await this.sleep(READY_POLL_MS);

package/dist/providers/jobs/service-state.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Display-only observation of coding-run service start-up (docs/coding-services.md): launchers
+ * report each service's state as they see it, for the viewer. Never part of the launch's own
+ * control flow: a reporter error is swallowed. The launcher does await each report inline,
+ * though, so a reporter must be fast.
+ */
+export type ServiceState = "pending" | "probing" | "ready" | "failed";
+/** Fixed identifiers only: never probe output, container logs, or anything from the repository. */
+export type ServiceFailureReason = "image_unavailable" | "start_failed" | "exited" | "probe_failed" | "timed_out";
+export interface ServiceStateUpdate {
+    runId: string;
+    /** The catalog service name (CodingService.name). */
+    name: string;
+    state: ServiceState;
+    /** Readiness probes completed so far; only launchers that run the probe themselves (Docker) know it. */
+    attempts?: number;
+    /** Set only with state "failed". */
+    reason?: ServiceFailureReason;
+}
+export type ServiceStateReporter = (update: ServiceStateUpdate) => Promise<void>;
+/** Calls `reporter` if there is one; any error it throws is dropped (status is display-only). */
+export declare function reportServiceState(reporter: ServiceStateReporter | undefined, update: ServiceStateUpdate): Promise<void>;

package/dist/providers/jobs/service-state.js

@@ -0,0 +1,17 @@
+/**
+ * Display-only observation of coding-run service start-up (docs/coding-services.md): launchers
+ * report each service's state as they see it, for the viewer. Never part of the launch's own
+ * control flow: a reporter error is swallowed. The launcher does await each report inline,
+ * though, so a reporter must be fast.
+ */
+/** Calls `reporter` if there is one; any error it throws is dropped (status is display-only). */
+export async function reportServiceState(reporter, update) {
+    if (!reporter)
+        return;
+    try {
+        await reporter(update);
+    }
+    catch {
+        // Display-only: a lost update must never fail or slow a launch.
+    }
+}

package/dist/providers/llm/anthropic.d.ts

@@ -2,12 +2,12 @@
  * Direct Anthropic (Claude) adapter for the LlmProvider seam. `@anthropic-ai/sdk`
  * is imported only here; all protocol/pricing-dispatch logic lives in the
  * shared ClaudeLlmProvider base class (claude-provider.ts) — this file's only
- * job is constructing the right client and pricing module.
+ * job is constructing the right client.
  */
 import Anthropic from "@anthropic-ai/sdk";
 import { ClaudeLlmProvider } from "./claude-provider.js";
-export { anthropicSupportedModels } from "./pricing-anthropic.js";
+import type { CatalogLookup } from "./catalog-lookup.js";
 export declare function anthropicCredentialsPresent(env?: NodeJS.ProcessEnv): boolean;
 export declare class AnthropicLlmProvider extends ClaudeLlmProvider {
-    constructor(apiKey?: string, client?: Anthropic);
+    constructor(apiKey?: string, client?: Anthropic, lookup?: CatalogLookup);
 }

package/dist/providers/llm/anthropic.js

@@ -2,24 +2,18 @@
  * Direct Anthropic (Claude) adapter for the LlmProvider seam. `@anthropic-ai/sdk`
  * is imported only here; all protocol/pricing-dispatch logic lives in the
  * shared ClaudeLlmProvider base class (claude-provider.ts) — this file's only
- * job is constructing the right client and pricing module.
+ * job is constructing the right client.
  */
 import Anthropic from "@anthropic-ai/sdk";
 import { ClaudeLlmProvider } from "./claude-provider.js";
-import { anthropicPriceUsd, anthropicSupportedEfforts, getAnthropicPricing } from "./pricing-anthropic.js";
-export { anthropicSupportedModels } from "./pricing-anthropic.js";
 export function anthropicCredentialsPresent(env = process.env) {
     return Boolean(env.ANTHROPIC_API_KEY);
 }
 export class AnthropicLlmProvider extends ClaudeLlmProvider {
-    constructor(apiKey = process.env.ANTHROPIC_API_KEY ?? "", client) {
+    constructor(apiKey = process.env.ANTHROPIC_API_KEY ?? "", client, lookup) {
         if (!client && !apiKey) {
             throw new Error("ANTHROPIC_API_KEY is not set — required by the Anthropic LlmProvider adapter.");
         }
-        super(client ?? new Anthropic({ apiKey }), {
-            getPricing: getAnthropicPricing,
-            priceUsd: anthropicPriceUsd,
-            supportedEfforts: anthropicSupportedEfforts,
-        });
+        super(client ?? new Anthropic({ apiKey }), lookup);
     }
 }