@wardby/cli 0.3.0 → 0.4.1

package/dist/core/model-usage.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Per-run, per-model usage by priced token kind (RunModelUsage). Native runs
+ * use one model (Agent.model), written once at finish; coding runs are
+ * recomputed from the proxy ledger (prisma-ledger.ts). Always set, never
+ * incremented, so a repeat is harmless. Best effort: Run.costUsd stays the
+ * budget's source of truth.
+ */
+import type { PrismaClient } from "#prisma";
+import type { EngineResult } from "../providers/engine/types.js";
+export declare function recordNativeModelUsage(db: Pick<PrismaClient, "runModelUsage">, runId: string, model: string, usage: EngineResult["usage"]): Promise<void>;

package/dist/core/model-usage.js

@@ -0,0 +1,24 @@
+import { logger } from "./logger.js";
+const log = logger.child({ module: "model-usage" });
+export async function recordNativeModelUsage(db, runId, model, usage) {
+    if (usage.tokensIn === 0 && usage.tokensOut === 0 && usage.costUsd === 0)
+        return;
+    const cached = usage.cachedInputTokens ?? 0;
+    const values = {
+        freshInputTokens: Math.max(0, usage.tokensIn - cached),
+        cachedInputTokens: cached,
+        cacheWriteTokens: usage.cacheWriteTokens ?? 0,
+        outputTokens: usage.tokensOut,
+        costUsd: usage.costUsd,
+    };
+    try {
+        await db.runModelUsage.upsert({
+            where: { runId_model: { runId, model } },
+            create: { runId, model, ...values },
+            update: values,
+        });
+    }
+    catch (err) {
+        log.warn({ err, runId, model }, "could not record the run's model usage");
+    }
+}

package/dist/core/reconciler.d.ts

@@ -31,13 +31,15 @@
  * Each pass also completes review-host checks left "in progress" by a run
  * that ended without reaching `executeRun`'s own finalizer (reaped here as
  * `lost`, failed to start, failed while loading, ...). One sweep covers all
- * of those paths instead of patching each. Mention status comments get the
- * same sweep: it also catches a run that ended before its comment was posted.
+ * of those paths instead of patching each. Mention status comments, and the
+ * status comments of runs started by Jira issue events, get the same sweep:
+ * it also catches a run that ended before its comment was posted.
  */
 import type { PrismaClient } from "#prisma";
 import type { Executor } from "../providers/executor/types.js";
 import type { ReviewHostRegistry } from "../providers/review-host/types.js";
-export type ReconcilerDb = Pick<PrismaClient, "run" | "runHostCheck" | "runHostStatus">;
+import type { IssueTrackerRegistry } from "../providers/issue-tracker/types.js";
+export type ReconcilerDb = Pick<PrismaClient, "run" | "runHostCheck" | "runHostStatus" | "runIssueStatus" | "agentIssueProject" | "issuePullRequest" | "codingRun" | "agent" | "$transaction" | "$queryRaw">;
 /**
  * How long after a run finishes before its still-open check counts as
  * orphaned: long enough that the sweep never races `executeRun`'s own
@@ -66,7 +68,7 @@ export declare function closeOrphanedHostChecks(db: Pick<PrismaClient, "runHostC
  */
 export declare function closeOrphanedHostStatuses(db: Pick<PrismaClient, "runHostStatus" | "run">, hosts: ReviewHostRegistry | undefined, now?: Date): Promise<void>;
 /** Runs one reconciliation pass. Returns the number of runs marked `lost`. */
-export declare function reconcileOnce(db: ReconcilerDb, now?: Date, heartbeatTimeoutMs?: number, executor?: Executor, reviewHosts?: ReviewHostRegistry): Promise<number>;
+export declare function reconcileOnce(db: ReconcilerDb, now?: Date, heartbeatTimeoutMs?: number, executor?: Executor, reviewHosts?: ReviewHostRegistry, issueTrackers?: IssueTrackerRegistry): Promise<number>;
 export interface ReconcilerOptions {
     db?: ReconcilerDb;
     intervalMs?: number;
@@ -74,6 +76,8 @@ export interface ReconcilerOptions {
     executor?: Executor;
     /** Hosts used to complete checks orphaned by runs that ended abnormally; none configured = no sweep. */
     reviewHosts?: ReviewHostRegistry;
+    /** Trackers used to complete issue status comments orphaned the same way; none configured = no sweep. */
+    issueTrackers?: IssueTrackerRegistry;
 }
 export interface ReconcilerHandle {
     stop(): void;

package/dist/core/reconciler.js

@@ -31,15 +31,20 @@
  * Each pass also completes review-host checks left "in progress" by a run
  * that ended without reaching `executeRun`'s own finalizer (reaped here as
  * `lost`, failed to start, failed while loading, ...). One sweep covers all
- * of those paths instead of patching each. Mention status comments get the
- * same sweep: it also catches a run that ended before its comment was posted.
+ * of those paths instead of patching each. Mention status comments, and the
+ * status comments of runs started by Jira issue events, get the same sweep:
+ * it also catches a run that ended before its comment was posted.
  */
 import { HEARTBEAT_TIMEOUT_MS, RECONCILE_INTERVAL_MS } from "./timing.js";
 import { prisma as defaultDb } from "./db.js";
 import { logger } from "./logger.js";
 import { closeOpenHostCheck } from "./review-host-checks.js";
 import { completeHostStatus } from "./host-status.js";
+import { closeOrphanedIssueStatuses } from "./issue-status.js";
+import { fileSelfDefect } from "./self-defects.js";
 const reconcilerLog = logger.child({ module: "reconciler" });
+/** A pass waits this long per self-defect, then moves on; the filing finishes (or logs) in the background. */
+const SELF_DEFECT_WAIT = { waitMs: 2_000 };
 /**
  * How long after a run finishes before its still-open check counts as
  * orphaned: long enough that the sweep never races `executeRun`'s own
@@ -115,7 +120,7 @@ export async function closeOrphanedHostStatuses(db, hosts, now = new Date()) {
         await completeHostStatus(db, run, hosts, { postIfMissing: true });
 }
 /** Runs one reconciliation pass. Returns the number of runs marked `lost`. */
-export async function reconcileOnce(db, now = new Date(), heartbeatTimeoutMs = HEARTBEAT_TIMEOUT_MS, executor, reviewHosts) {
+export async function reconcileOnce(db, now = new Date(), heartbeatTimeoutMs = HEARTBEAT_TIMEOUT_MS, executor, reviewHosts, issueTrackers) {
     const cutoff = new Date(now.getTime() - heartbeatTimeoutMs);
     const stale = {
         executionManaged: true,
@@ -207,6 +212,8 @@ export async function reconcileOnce(db, now = new Date(), heartbeatTimeoutMs = H
                 data: { status: "lost", error: reason, finishedAt: now },
             });
             lost += result.count;
+            if (result.count > 0)
+                await fileSelfDefect(db, issueTrackers, { ...run, status: "lost", error: reason, finishedAt: now }, SELF_DEFECT_WAIT);
             continue;
         }
         const result = await db.run.updateMany({
@@ -214,9 +221,13 @@ export async function reconcileOnce(db, now = new Date(), heartbeatTimeoutMs = H
             data: { status: "lost", error: reason, finishedAt: now },
         });
         lost += result.count;
+        // Only after this pass made the row lost (not when another instance won the race); bounded, never throws.
+        if (result.count > 0)
+            await fileSelfDefect(db, issueTrackers, { ...run, status: "lost", error: reason, finishedAt: now }, SELF_DEFECT_WAIT);
     }
     await closeOrphanedHostChecks(db, reviewHosts, now);
     await closeOrphanedHostStatuses(db, reviewHosts, now);
+    await closeOrphanedIssueStatuses(db, issueTrackers, now);
     return lost;
 }
 export function startReconciler(options = {}) {
@@ -224,7 +235,7 @@ export function startReconciler(options = {}) {
     const intervalMs = options.intervalMs ?? RECONCILE_INTERVAL_MS;
     const heartbeatTimeoutMs = options.heartbeatTimeoutMs ?? HEARTBEAT_TIMEOUT_MS;
     const timer = setInterval(() => {
-        reconcileOnce(db, new Date(), heartbeatTimeoutMs, options.executor, options.reviewHosts).catch((err) => {
+        reconcileOnce(db, new Date(), heartbeatTimeoutMs, options.executor, options.reviewHosts, options.issueTrackers).catch((err) => {
             reconcilerLog.error({ err }, "reconcile pass failed");
         });
     }, intervalMs);

package/dist/core/review-host-tools.js

@@ -272,14 +272,21 @@ export async function handleReviewHostTool(name, argsJson, ctx) {
             }
             case "repo_read_file": {
                 const a = ReadFileArgs.parse(parsed);
-                return JSON.stringify(await host.readFile(link.repository, a.path, a.ref, {
+                const read = await host.readFile(link.repository, a.path, a.ref, {
                     startLine: a.startLine ?? 1,
                     maxLines: a.maxLines ?? 400,
-                }));
+                });
+                // `text` is the raw window for machine callers; agents get only the numbered `content`.
+                if (read.kind === "file") {
+                    const { text: _text, ...shown } = read;
+                    return JSON.stringify(shown);
+                }
+                return JSON.stringify(read);
             }
             case "repo_list_files": {
                 const a = ListFilesArgs.parse(parsed);
-                return JSON.stringify(await host.listFiles(link.repository, a.ref, a.pathPrefix));
+                const { ref, count, truncated, files } = await host.listFiles(link.repository, a.ref, a.pathPrefix);
+                return JSON.stringify({ ref, count, truncated, files });
             }
             case "repo_publish_review": {
                 const a = PublishArgs.parse(parsed);

package/dist/core/run-pricing.d.ts

@@ -0,0 +1,61 @@
+/**
+ * A run is billed at the model catalog entry recorded when it started, for
+ * its whole life: a resumed attempt (crash, pod move, reconciler adoption)
+ * reads the entry back from its Run row instead of the live catalog, so an
+ * admin's later set_model / disable_model never changes a run already under
+ * way. Runs from before the catalog have no stored entry and use the current
+ * catalog (identical to the shipped prices they started with).
+ */
+import type { Prisma } from "#prisma";
+import type { LlmProvider } from "../providers/llm/types.js";
+import { type CatalogEntry, type ResolvedCatalogEntry } from "../providers/llm/catalog-types.js";
+import type { ModelCatalog } from "../providers/llm/catalog.js";
+import { type CodingProvider } from "../coding/provider.js";
+export interface PinnedPricing {
+    entry: CatalogEntry;
+    priceVersion: string;
+}
+export interface RunPricingDb {
+    run: {
+        updateMany(args: {
+            where: {
+                id: string;
+                pricingVersion: null;
+            };
+            data: {
+                pricingVersion: string;
+                pricingSnapshot: Prisma.InputJsonValue;
+            };
+        }): Promise<{
+            count: number;
+        }>;
+        findUnique(args: {
+            where: {
+                id: string;
+            };
+            select: {
+                pricingVersion: true;
+                pricingSnapshot: true;
+            };
+        }): Promise<{
+            pricingVersion: string | null;
+            pricingSnapshot: unknown;
+        } | null>;
+    };
+}
+export declare function pinNativeRunPricing(db: RunPricingDb, run: {
+    id: string;
+    pricingVersion: string | null;
+    pricingSnapshot: unknown;
+}, model: string, llm: LlmProvider): Promise<PinnedPricing | undefined>;
+/** A coding agent's model is in the catalog but belongs to a model provider its coding provider cannot drive. */
+export declare class CodingModelProviderMismatchError extends Error {
+    constructor(model: string, provider: CodingProvider);
+}
+/**
+ * A coding run's entry at dispatch: in the catalog, enabled, and of this coding provider's model provider.
+ * Throws ModelUnavailableError or CodingModelProviderMismatchError; dispatchRun turns either into a failed run.
+ */
+export declare function resolveCodingEntry(provider: CodingProvider, model: string, catalog?: ModelCatalog): ResolvedCatalogEntry;
+/** Config-time check for create_agent/update_agent: the model must be runnable here. */
+export declare function assertAgentModelAvailable(model: string, llm?: LlmProvider): void;

package/dist/core/run-pricing.js

@@ -0,0 +1,56 @@
+import { RoutingLlmProvider } from "../providers/llm/routing.js";
+import { entryOf, parseStoredEntry, } from "../providers/llm/catalog-types.js";
+import { currentModelCatalog } from "../providers/llm/catalog-store.js";
+import { codingProviderForModelProvider } from "../coding/provider.js";
+function stored(row) {
+    const entry = parseStoredEntry(row.pricingSnapshot);
+    return entry && row.pricingVersion ? { entry, priceVersion: row.pricingVersion } : undefined;
+}
+export async function pinNativeRunPricing(db, run, model, llm) {
+    const existing = stored(run);
+    if (existing)
+        return existing;
+    if (!(llm instanceof RoutingLlmProvider))
+        return undefined;
+    const resolved = llm.entryFor(model); // throws ModelUnavailableError before any spend
+    const entry = entryOf(resolved);
+    const { count } = await db.run.updateMany({
+        where: { id: run.id, pricingVersion: null },
+        // entryOf returns plain JSON data (fresh array, no Dates); the interface's readonly
+        // efforts array is all that keeps it from matching Prisma's Json input type.
+        data: { pricingVersion: resolved.priceVersion, pricingSnapshot: entry },
+    });
+    if (count === 1)
+        return { entry, priceVersion: resolved.priceVersion };
+    // Another attempt of this run recorded first: bill at what it recorded.
+    const row = await db.run.findUnique({
+        where: { id: run.id },
+        select: { pricingVersion: true, pricingSnapshot: true },
+    });
+    return (row && stored(row)) ?? { entry, priceVersion: resolved.priceVersion };
+}
+/** A coding agent's model is in the catalog but belongs to a model provider its coding provider cannot drive. */
+export class CodingModelProviderMismatchError extends Error {
+    constructor(model, provider) {
+        super(`Model "${model}" is not supported by coding provider "${provider}".`);
+        this.name = "CodingModelProviderMismatchError";
+    }
+}
+/**
+ * A coding run's entry at dispatch: in the catalog, enabled, and of this coding provider's model provider.
+ * Throws ModelUnavailableError or CodingModelProviderMismatchError; dispatchRun turns either into a failed run.
+ */
+export function resolveCodingEntry(provider, model, catalog = currentModelCatalog()) {
+    const entry = catalog.require(model);
+    if (codingProviderForModelProvider(entry.provider) !== provider) {
+        throw new CodingModelProviderMismatchError(model, provider);
+    }
+    return entry;
+}
+/** Config-time check for create_agent/update_agent: the model must be runnable here. */
+export function assertAgentModelAvailable(model, llm) {
+    if (llm instanceof RoutingLlmProvider)
+        llm.entryFor(model);
+    else
+        currentModelCatalog().require(model);
+}

package/dist/core/runner.d.ts

@@ -21,6 +21,7 @@ import type { ProviderRegistry } from "../providers/index.js";
 import { type StepRunner } from "../providers/engine/types.js";
 import type { Executor } from "../providers/executor/types.js";
 import type { ReviewHostRegistry } from "../providers/review-host/types.js";
+import type { IssueTrackerRegistry } from "../providers/issue-tracker/types.js";
 import { type RepoAccessGate } from "./repo-access.js";
 /**
  * The subset of the Prisma client the runner touches — mockable in tests.
@@ -28,11 +29,13 @@ import { type RepoAccessGate } from "./repo-access.js";
  * also satisfies `dispatch.ts`'s `DispatchDb`, needed for dispatching a
  * coding-kind sub-agent from inside a running native turn loop.
  */
-export type RunnerDb = Pick<PrismaClient, "agent" | "run" | "agentTool" | "agentSecret" | "agentDatastore" | "budgetGroup" | "agentSubAgent" | "resourceGrant" | "codingRun" | "task" | "webhook" | "$transaction" | "$queryRaw" | "agentRepository" | "runHostCheck" | "runHostStatus" | "hostIdentity">;
-/** The providers a native run needs; `executor` and `reviewHosts` are optional capabilities. */
+export type RunnerDb = Pick<PrismaClient, "agent" | "run" | "agentTool" | "agentSecret" | "agentDatastore" | "budgetGroup" | "agentSubAgent" | "resourceGrant" | "codingRun" | "task" | "webhook" | "$transaction" | "$queryRaw" | "agentRepository" | "runModelUsage" | "runHostCheck" | "runHostStatus" | "hostIdentity" | "agentIssueProject" | "issuePullRequest" | "runIssueStatus" | "issueFingerprint">;
+/** The providers a native run needs; `executor`, `reviewHosts` and `issueTrackers` are optional capabilities. */
 export type NativeRunProviders = Pick<ProviderRegistry, "llm" | "engine" | "datastore" | "secrets" | "memory"> & {
     executor?: ProviderRegistry["executor"];
     reviewHosts?: ReviewHostRegistry;
+    /** Issue trackers (Jira): the jira_* built-ins and issue status comments. */
+    issueTrackers?: IssueTrackerRegistry;
     /** Repository authorization for repo_* calls; built from reviewHosts when absent. */
     repoAccess?: RepoAccessGate;
 };

package/dist/core/runner.js

@@ -27,7 +27,7 @@ import { buildSecretsAccessor, scopeSecretsAccessor } from "./secrets.js";
 import { buildSharedDatastoreAccessor, scopeSharedDatastoreAccessor } from "./datastores.js";
 import { effectiveBudgetForRun } from "./budget-groups.js";
 import { withRunHeartbeat } from "./run-heartbeat.js";
-import { dispatchRun } from "./dispatch.js";
+import { ContinuationRefusedError, dispatchRun } from "./dispatch.js";
 import { canDelegate } from "./grants.js";
 import { MEMORY_TOOL_DEFS, MEMORY_TOOL_NAMES, handleMemoryTool } from "./memory-tools.js";
 import { DELEGATE_TOOL_PREFIX, duplicateToolNames } from "./tool-names.js";
@@ -40,6 +40,14 @@ import { closeOpenHostCheck } from "./review-host-checks.js";
 import { serviceRefusalSentence } from "../coding/services/wording.js";
 import { RUN_TASK_TAG, splitTaskOverride, wrapUntrusted } from "./untrusted-content.js";
 import { completeHostStatus } from "./host-status.js";
+import { ISSUE_TRACKER_TOOL_DEFS, ISSUE_TRACKER_TOOL_NAMES, handleIssueTrackerTool, } from "./issue-tracker-tools.js";
+import { completeIssueStatus } from "./issue-status.js";
+import { fileIssue } from "./issue-dedupe.js";
+import { fileSelfDefect } from "./self-defects.js";
+import { recordNativeModelUsage } from "./model-usage.js";
+import { pinNativeRunPricing } from "./run-pricing.js";
+import { RoutingLlmProvider } from "../providers/llm/routing.js";
+import { ModelUnavailableError } from "../providers/llm/catalog-types.js";
 import { trackRun } from "./in-flight-runs.js";
 import { createRepoAccessGate, requiredLevel } from "./repo-access.js";
 const runnerLog = logger.child({ module: "runner" });
@@ -115,6 +123,30 @@ const DelegateArgs = z
 function configuredReviewHosts(hosts) {
     return hosts && Object.values(hosts).some(Boolean) ? hosts : undefined;
 }
+/**
+ * The composed issue trackers, or undefined when there are none (no Jira site
+ * configured yields an empty registry). Undefined means the run never touches
+ * the AgentIssueProject/RunIssueStatus tables at all.
+ */
+function configuredIssueTrackers(trackers) {
+    return trackers && Object.values(trackers).some(Boolean) ? trackers : undefined;
+}
+/** An AgentIssueProject row as the jira_* tools see it. */
+function toIssueProjectLink(row) {
+    return {
+        provider: "jira",
+        projectKey: row.projectKey,
+        access: row.access === "write" ? "write" : "read",
+        commentVisibilityRole: row.commentVisibilityRole,
+        // `?? []` (fail closed): a row or pinned load from before the allowlists existed allows nothing.
+        allowedTransitions: row.allowedTransitions ?? [],
+        writableFields: row.writableFields ?? [],
+        allowedLinkTypes: row.allowedLinkTypes ?? [],
+        creatableIssueTypes: row.creatableIssueTypes ?? [],
+        // No built-in cap: absent (an older pinned load) means none, like null.
+        maxNewIssuesPerRun: row.maxNewIssuesPerRun ?? null,
+    };
+}
 /**
  * The two states a Run can still be driven out of. Every write `executeRun`
  * makes is filtered on these: a durable executor can have two attempts of the
@@ -143,8 +175,12 @@ export class RunCancelledError extends Error {
  * the race, the winner's if it did not.
  */
 async function finishRun(db, runId, data) {
-    await db.run.updateMany({ where: { id: runId, status: { in: [...DRIVABLE] } }, data });
-    return db.run.findUniqueOrThrow({ where: { id: runId } });
+    return (await finishRunClaimed(db, runId, data)).run;
+}
+/** finishRun, also saying whether this call made the row terminal (false: something else finished it first). */
+async function finishRunClaimed(db, runId, data) {
+    const updated = await db.run.updateMany({ where: { id: runId, status: { in: [...DRIVABLE] } }, data });
+    return { run: await db.run.findUniqueOrThrow({ where: { id: runId } }), claimed: updated.count > 0 };
 }
 /**
  * Why a coding run cannot start in this process: runs reach the runner only
@@ -256,16 +292,23 @@ async function executeTrackedRun(runId, providers, db, onText, step) {
     const repoAccess = reviewHosts
         ? (providers.repoAccess ?? createRepoAccessGate({ db, hosts: reviewHosts }))
         : undefined;
+    const issueTrackers = configuredIssueTrackers(providers.issueTrackers);
     // Pinned in one checkpointed step: on replay after a crash, the agent row
     // or its budget group may have changed since first execution. The
     // engine's control flow depends on budgetUsd and maxTurns, so they must
     // be pinned to the values seen on first execution or the replay's step
     // order diverges from the record.
-    const loaded = await step("load", async () => {
+    const loadedOrUnavailable = await step("load", async () => {
         const agent = await db.agent.findUnique({ where: { id: existingRun.agentId } });
         if (!agent) {
             throw new Error(`Run "${runId}" references missing agent "${existingRun.agentId}".`);
         }
+        // The run's catalog entry, recorded on first execution and read back on
+        // every replay or resume, so its prices never move under it (run-pricing.ts).
+        // A model that is missing, disabled, or has no configured provider fails
+        // the run here, before any spend. Coding agents never run in this engine
+        // (failed below) and are priced by the coding proxy, so they pin nothing.
+        const pricing = agent.kind === "coding" ? undefined : await pinNativeRunPricing(db, existingRun, agent.model, providers.llm);
         const attached = await db.agentTool.findMany({
             where: { agentId: agent.id },
             include: { tool: true },
@@ -301,6 +344,10 @@ async function executeTrackedRun(runId, providers, db, onText, step) {
                 checkName: l.checkName,
             }))
             : [];
+        // Likewise only when a Jira site is configured.
+        const issueProjectLinks = issueTrackers
+            ? (await db.agentIssueProject.findMany({ where: { agentId: agent.id, provider: "jira" } })).map(toIssueProjectLink)
+            : [];
         const isDispatchedChild = existingRun.parentRunId != null;
         // Appended, never prepended: the loaded systemPrompt's stable prefix
         // stays prompt-cache-eligible across every dispatch, even though the
@@ -325,9 +372,11 @@ async function executeTrackedRun(runId, providers, db, onText, step) {
         return {
             agentId: agent.id,
             kind: agent.kind,
+            pricing,
             memoryEnabled: agent.memoryEnabled,
             subAgentEdges,
             repositoryLinks,
+            issueProjectLinks,
             agent: {
                 systemPrompt,
                 model: agent.model,
@@ -360,6 +409,7 @@ async function executeTrackedRun(runId, providers, db, onText, step) {
                 ...(isDispatchedChild ? [PARENT_MEMORY_GET_TOOL] : []),
                 ...subAgentEdges.map((edge) => delegateToolDef(edge.boundName)),
                 ...(repositoryLinks.length > 0 ? REVIEW_HOST_TOOL_DEFS : []),
+                ...(issueProjectLinks.length > 0 ? ISSUE_TRACKER_TOOL_DEFS : []),
             ],
             // An attachment's four capability fields are honoured only when the
             // agent's CURRENT owner granted them (resource-sharing grants spec
@@ -381,14 +431,33 @@ async function executeTrackedRun(runId, providers, db, onText, step) {
                 ];
             })),
         };
+    }).catch((err) => {
+        // Returned, not thrown, so the run is marked failed below rather than left pending for a retry
+        // that would fail the same way. Matched by message too: a DBOS replay may hand back a
+        // deserialized error that is no longer a ModelUnavailableError instance.
+        if (err instanceof ModelUnavailableError ||
+            (err instanceof Error && err.message.startsWith("model_unavailable:"))) {
+            return { unavailable: err.message };
+        }
+        throw err;
     });
-    if (loaded.kind === "coding") {
-        return finishRun(db, runId, {
-            status: "failed",
-            error: CODING_EXECUTOR_NOT_CONFIGURED,
-            finishedAt: new Date(),
-        });
-    }
+    // Fails a run that ends before its engine starts, closing what its trigger opened (the review
+    // check, the host and issue status comments) exactly as the normal and catch paths below do.
+    // Deliberately no self-defect: both callers are configuration states, not this run's defect (an
+    // admin disabled or removed the model, or this deployment has no coding executor), and filing
+    // would open one defect per affected agent rather than describe a failure of that agent.
+    const finishEarly = async (error) => {
+        const finished = await finishRun(db, runId, { status: "failed", error, finishedAt: new Date() });
+        await closeOpenHostCheck(db, finished, reviewHosts);
+        await completeHostStatus(db, finished, reviewHosts);
+        await completeIssueStatus(db, finished, issueTrackers);
+        return finished;
+    };
+    if ("unavailable" in loadedOrUnavailable)
+        return finishEarly(loadedOrUnavailable.unavailable);
+    const loaded = loadedOrUnavailable;
+    if (loaded.kind === "coding")
+        return finishEarly(CODING_EXECUTOR_NOT_CONFIGURED);
     // Conditional on DRIVABLE rather than on `pending`: an adopted attempt
     // legitimately finds the row already `running`, but a terminal row must
     // never be flipped back to `running`.
@@ -397,6 +466,9 @@ async function executeTrackedRun(runId, providers, db, onText, step) {
         const toolsByName = new Map(Object.entries(loaded.toolsByName));
         const secretsAccessor = buildSecretsAccessor(loaded.agentId, providers.secrets, db);
         const sharedDatastoreAccessor = buildSharedDatastoreAccessor(loaded.agentId, providers.datastore, db);
+        // jira_create_issue's per-run cap counter: shared by every tool call of this attempt (a resumed attempt
+        // starts a fresh one, floored by the run's recorded fingerprint creates).
+        const issueCreationCounters = new Map();
         const runSandboxTool = async (name, argsJson) => {
             if (loaded.memoryEnabled && MEMORY_TOOL_NAMES.has(name)) {
                 return handleMemoryTool(name, argsJson, loaded.agentId, providers.memory);
@@ -449,6 +521,30 @@ async function executeTrackedRun(runId, providers, db, onText, step) {
                     },
                 });
             }
+            // `?? []`: a load step replayed from before these links were pinned has none.
+            // Each link is re-normalised too: one pinned before the allowlists existed lacks them.
+            const issueProjectLinks = (loaded.issueProjectLinks ?? []).map(toIssueProjectLink);
+            if (ISSUE_TRACKER_TOOL_NAMES.has(name) && issueProjectLinks.length > 0 && issueTrackers) {
+                return handleIssueTrackerTool(name, argsJson, {
+                    agentId: loaded.agentId,
+                    links: issueProjectLinks,
+                    trackers: issueTrackers,
+                    // Live, not from the pinned load: an unlink, downgrade, or new
+                    // visibility role takes effect on the very next call.
+                    currentLink: async (projectKey) => {
+                        const row = await db.agentIssueProject.findUnique({
+                            where: { agentId_provider_projectKey: { agentId: loaded.agentId, provider: "jira", projectKey } },
+                        });
+                        return row ? toIssueProjectLink(row) : null;
+                    },
+                    creation: {
+                        runId,
+                        counters: issueCreationCounters,
+                        fileIssue: (input) => fileIssue({ db }, input),
+                        recordedCreates: (projectKey) => db.issueFingerprint.count({ where: { createdByRunId: runId, issueProvider: "jira", projectKey } }),
+                    },
+                });
+            }
             if (name === "subagent_memory_get") {
                 return handleSubAgentMemoryGet(argsJson, loaded.agentId, db, providers.memory);
             }
@@ -567,19 +663,35 @@ async function executeTrackedRun(runId, providers, db, onText, step) {
                     // dispatchRun reserves the child's budget itself, inside its persist
                     // transaction: the agent's budgetUsd tightened by its budget group and
                     // by this run tree (parentRunId), or refused when either is spent.
-                    const dispatched = await dispatchRun({
-                        db,
-                        executor: providers.executor,
-                        agentId: edge.childAgentId,
-                        trigger: "subagent",
-                        codingTask: args.task,
-                        continuesCodingRunId: args.continuePriorRun,
-                        parentRunId: runId,
-                        // The child's result flows back into this run, which the
-                        // triggerer sees, so the child is visible to them too.
-                        triggeredById: existingRun.triggeredById,
-                        awaitExecution: true,
-                    });
+                    let dispatched;
+                    try {
+                        dispatched = await dispatchRun({
+                            db,
+                            executor: providers.executor,
+                            selfDefects: { db, issueTrackers },
+                            agentId: edge.childAgentId,
+                            trigger: "subagent",
+                            codingTask: args.task,
+                            continuesCodingRunId: args.continuePriorRun,
+                            parentRunId: runId,
+                            // The child's result flows back into this run, which the
+                            // triggerer sees, so the child is visible to them too.
+                            triggeredById: existingRun.triggeredById,
+                            awaitExecution: true,
+                        });
+                    }
+                    catch (err) {
+                        // A continuation this deployment cannot make (the run id came from
+                        // a pull request another deployment opened, say) is the model's to
+                        // report, not a reason to fail the whole run.
+                        if (!(err instanceof ContinuationRefusedError))
+                            throw err;
+                        return JSON.stringify({
+                            error: "continuation_refused",
+                            message: `${err.message} No sub-agent run was started. Do not open a new pull request in its place: ` +
+                                "tell the requester that this wardby deployment cannot continue that pull request's branch.",
+                        });
+                    }
                     if (!dispatched) {
                         return JSON.stringify({ error: "dispatch_failed", message: "The sub-agent run could not be created." });
                     }
@@ -676,15 +788,42 @@ async function executeTrackedRun(runId, providers, db, onText, step) {
             }
             return JSON.stringify(result.value);
         };
+        // Live progress for observers (MCP get_run, the viewer). Absolute totals, so a DBOS replay
+        // re-writing them is harmless. Written into the run's own cost columns on purpose: the run
+        // tree's shared budget (computeRunTreeSpend) then counts a running parent's spend so far, as it
+        // already does for coding runs, whose proxy ledger writes their totals live. Best-effort: a
+        // failed write only delays what observers see, and finishRun writes the final totals anyway.
+        const onProgress = async (progress) => {
+            try {
+                await db.run.updateMany({
+                    where: { id: runId, status: "running" },
+                    data: {
+                        turns: progress.turns,
+                        tokensIn: progress.usage.tokensIn,
+                        tokensOut: progress.usage.tokensOut,
+                        costUsd: progress.usage.costUsd,
+                        heartbeatAt: new Date(),
+                    },
+                });
+            }
+            catch (err) {
+                runnerLog.warn({ err, runId }, "failed to record run progress");
+            }
+        };
         const engineResult = await providers.engine.run({
             agent: loaded.agent,
             tools: loaded.tools,
-            providers: { llm: providers.llm },
+            providers: {
+                llm: loaded.pricing && providers.llm instanceof RoutingLlmProvider
+                    ? providers.llm.forRun(loaded.pricing.entry)
+                    : providers.llm,
+            },
             runSandboxTool,
             onText,
+            onProgress,
             step,
         });
-        const finished = await finishRun(db, runId, {
+        const { run: finished, claimed } = await finishRunClaimed(db, runId, {
             status: engineResult.status,
             tokensIn: engineResult.usage.tokensIn,
             tokensOut: engineResult.usage.tokensOut,
@@ -694,8 +833,15 @@ async function executeTrackedRun(runId, providers, db, onText, step) {
             turns: engineResult.turns,
             finishedAt: new Date(),
         });
+        // Per-model usage is written on the same path as Run.costUsd: any future mid-run cost write must write usage too.
+        await recordNativeModelUsage(db, runId, loaded.agent.model, engineResult.usage);
         await closeOpenHostCheck(db, finished, reviewHosts);
         await completeHostStatus(db, finished, reviewHosts);
+        await completeIssueStatus(db, finished, issueTrackers);
+        // Only the call that made the row terminal files, so a run another finalizer (the reconciler) ended is not
+        // filed twice. Bounded and never throws.
+        if (claimed)
+            await fileSelfDefect(db, issueTrackers, finished);
         return finished;
     }
     catch (err) {
@@ -704,13 +850,18 @@ async function executeTrackedRun(runId, providers, db, onText, step) {
         // (a real bug, or tool-loading failing outside the per-tool try above)
         // must still never leave the run dangling in "running". A cancellation
         // is not a failure: it carries the operator's own reason.
-        const finished = await finishRun(db, runId, {
+        const { run: finished, claimed } = await finishRunClaimed(db, runId, {
             status: err instanceof RunCancelledError ? "cancelled" : "failed",
             error: err instanceof Error ? err.message : String(err),
             finishedAt: new Date(),
         });
         await closeOpenHostCheck(db, finished, reviewHosts);
         await completeHostStatus(db, finished, reviewHosts);
+        await completeIssueStatus(db, finished, issueTrackers);
+        // Only the call that made the row terminal files, so a run another finalizer (the reconciler) ended is not
+        // filed twice. Bounded and never throws.
+        if (claimed)
+            await fileSelfDefect(db, issueTrackers, finished);
         return finished;
     }
 }