@wardby/cli 0.4.1 → 0.5.0

package/dist/coding/profile.d.ts

@@ -16,6 +16,7 @@ export declare const CodingProfileSchema: z.ZodObject<{
     toolchainVersion: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     workerImageRef: z.ZodDefault<z.ZodNullable<z.ZodEffects<z.ZodString, string, string>>>;
     workspaceDiskMb: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+    maxTurns: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
     packageAllowlist: z.ZodDefault<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>, Record<string, string[]>, Record<string, string[]>>>;
     packagePolicy: z.ZodDefault<z.ZodEffects<z.ZodObject<{
         minReleaseAgeDays: z.ZodOptional<z.ZodNumber>;
@@ -32,6 +33,7 @@ export declare const CodingProfileSchema: z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     repository: string;
     baseRef: string;
+    maxTurns: number | null;
     services: string[];
     provider: "codex" | "claude-code";
     timeoutSec: number;
@@ -50,6 +52,7 @@ export declare const CodingProfileSchema: z.ZodObject<{
 }, {
     repository: string;
     baseRef?: string | undefined;
+    maxTurns?: number | null | undefined;
     services?: string[] | undefined;
     provider?: "codex" | "claude-code" | undefined;
     timeoutSec?: number | undefined;
@@ -79,6 +82,7 @@ export declare const CodingProfilePatchSchema: z.ZodObject<{
     toolchainVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     workerImageRef: z.ZodOptional<z.ZodNullable<z.ZodEffects<z.ZodString, string, string>>>;
     workspaceDiskMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    maxTurns: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     packageAllowlist: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>, Record<string, string[]>, Record<string, string[]>>>;
     packagePolicy: z.ZodOptional<z.ZodEffects<z.ZodObject<{
         minReleaseAgeDays: z.ZodOptional<z.ZodNumber>;
@@ -95,6 +99,7 @@ export declare const CodingProfilePatchSchema: z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     repository?: string | undefined;
     baseRef?: string | undefined;
+    maxTurns?: number | null | undefined;
     services?: string[] | undefined;
     provider?: "codex" | "claude-code" | undefined;
     timeoutSec?: number | undefined;
@@ -113,6 +118,7 @@ export declare const CodingProfilePatchSchema: z.ZodObject<{
 }, {
     repository?: string | undefined;
     baseRef?: string | undefined;
+    maxTurns?: number | null | undefined;
     services?: string[] | undefined;
     provider?: "codex" | "claude-code" | undefined;
     timeoutSec?: number | undefined;

package/dist/coding/profile.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { isImmutableDockerImage } from "../providers/jobs/docker-isolation.js";
-import { MAX_CODING_TASK_BYTES, normalizeGitHubRepository, normalizeGitRef } from "./protocol.js";
+import { MAX_CODING_TASK_BYTES, MAX_CODING_TURNS, isLocalRepository, normalizeGitHubRepository, normalizeGitRef, normalizeLocalRepository, } from "./protocol.js";
 import { MAX_COLLECT_EXCLUDE_PATHS, validateCollectExcludePath } from "./collect-exclude.js";
 import { CODING_PROVIDERS } from "./provider.js";
 import { WARDBY_PROTECTED_PATHS, isWellFormedProtectedPath, protectsSomePath } from "./protected-paths.js";
@@ -24,18 +24,22 @@ const INVALID_SINGLE_LINE_CONTROL = /[\u0000-\u001F\u007F]/;
 function byteLength(value) {
     return Buffer.byteLength(value, "utf8");
 }
+/** GitHub names, or `local:/abs/path` (syntactic only; trusted roots are enforced where it is authorized and used). */
+function normalizeProfileRepository(value) {
+    return isLocalRepository(value) ? normalizeLocalRepository(value) : normalizeGitHubRepository(value);
+}
 const repositorySchema = z
     .string()
     .refine((value) => {
     try {
-        normalizeGitHubRepository(value);
+        normalizeProfileRepository(value);
         return true;
     }
     catch {
         return false;
     }
-}, "must be a canonical name or uncredentialed github.com repository")
-    .transform(normalizeGitHubRepository);
+}, "must be a canonical name, an uncredentialed github.com repository, or local:/absolute/path")
+    .transform(normalizeProfileRepository);
 const baseRefSchema = z
     .string()
     .refine((value) => {
@@ -80,6 +84,8 @@ const workerImageRefSchema = z
     .refine(isImmutableDockerImage, "must be an immutable repository digest")
     .nullable();
 const workspaceDiskMbSchema = z.number().int().min(64).max(32_768).nullable();
+/** Claude Code runs only: the most agent turns a run may take; null = the worker default (DEFAULT_CLAUDE_MAX_TURNS). */
+const maxTurnsSchema = z.number().int().min(1).max(MAX_CODING_TURNS).nullable();
 const packageAllowlistSchema = z
     .record(z.string(), z.array(z.string().min(1).max(256)).max(256))
     .superRefine((value, ctx) => {
@@ -115,6 +121,7 @@ const codingProfileFields = {
     toolchainVersion: toolchainVersionSchema,
     workerImageRef: workerImageRefSchema,
     workspaceDiskMb: workspaceDiskMbSchema,
+    maxTurns: maxTurnsSchema,
     protectedPaths: z
         .array(protectedPathSchema)
         .min(1)
@@ -144,6 +151,7 @@ export const CodingProfileSchema = z
     toolchainVersion: codingProfileFields.toolchainVersion.default(null),
     workerImageRef: codingProfileFields.workerImageRef.default(null),
     workspaceDiskMb: codingProfileFields.workspaceDiskMb.default(null),
+    maxTurns: codingProfileFields.maxTurns.default(null),
     packageAllowlist: codingProfileFields.packageAllowlist.default({}),
     packagePolicy: codingProfileFields.packagePolicy.default({}),
     services: codingProfileFields.services.default([]),
@@ -163,6 +171,7 @@ export const CodingProfilePatchSchema = z
     toolchainVersion: codingProfileFields.toolchainVersion.optional(),
     workerImageRef: codingProfileFields.workerImageRef.optional(),
     workspaceDiskMb: codingProfileFields.workspaceDiskMb.optional(),
+    maxTurns: codingProfileFields.maxTurns.optional(),
     packageAllowlist: codingProfileFields.packageAllowlist.optional(),
     packagePolicy: codingProfileFields.packagePolicy.optional(),
     services: codingProfileFields.services.optional(),

package/dist/coding/protocol.d.ts

@@ -37,6 +37,17 @@ export declare function isReservedServiceEnvName(name: string): boolean;
 export declare const CodingServiceTestEnvSchema: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>>, Record<string, string>, Record<string, string>>;
 export declare function normalizeGitHubRepository(value: string): string;
 export declare function normalizeGitRef(value: string): string;
+/** Repository identity prefix for a git folder on the wardby host: `local:/abs/path`. */
+export declare const LOCAL_REPO_PREFIX = "local:";
+export declare function isLocalRepository(value: string): boolean;
+/** Upper bound on a whole `local:/abs/path` value, in UTF-8 bytes. */
+export declare const MAX_LOCAL_REPOSITORY_BYTES = 4096;
+/**
+ * Syntactic only: at most MAX_LOCAL_REPOSITORY_BYTES, no ASCII control
+ * characters (NUL included), absolute, normalized; returns "local:/abs/path"
+ * (no trailing slash).
+ */
+export declare function normalizeLocalRepository(value: string): string;
 export declare const CodingBaseRefSchema: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
 export declare const CodingTaskOverrideSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>;
 /**
@@ -69,6 +80,10 @@ export declare function composeCodingTask(instructions: string | null | undefine
  * re-validates whatever survives.
  */
 export declare function normalizeCodingTag(value: unknown): string | null | undefined;
+/** Upper bound on CodingAgentProfile.maxTurns (Claude Code runs). */
+export declare const MAX_CODING_TURNS = 1000;
+/** The Claude Code worker's turn limit when the agent sets none; the run's budget and timeout are the real limits. */
+export declare const DEFAULT_CLAUDE_MAX_TURNS = 200;
 /** Longest line a debug-traced worker writes to its log (src/coding-worker/debug-trace.ts). */
 export declare const MAX_DEBUG_TRACE_LINE_BYTES: number;
 export declare const CodingTaskInputSchema: z.ZodEffects<z.ZodObject<{
@@ -103,6 +118,12 @@ export declare const CodingTaskInputSchema: z.ZodEffects<z.ZodObject<{
      * untraced run is unchanged for workers that predate it.
      */
     debugTrace: z.ZodOptional<z.ZodBoolean>;
+    /**
+     * Claude Code turn limit (CodingAgentProfile.maxTurns, fixed on the run at
+     * dispatch). Absent means the worker default; written only when the agent
+     * sets one, so other runs' input is unchanged for workers that predate it.
+     */
+    maxTurns: z.ZodOptional<z.ZodNumber>;
     /**
      * Coding-run services started next to this run (docs/coding-services.md):
      * each one's catalog name and version, and the variables the agent's shells
@@ -137,6 +158,7 @@ export declare const CodingTaskInputSchema: z.ZodEffects<z.ZodObject<{
         runId: string;
     } | undefined;
     debugTrace?: boolean | undefined;
+    maxTurns?: number | undefined;
     services?: {
         name: string;
         version: string;
@@ -156,6 +178,7 @@ export declare const CodingTaskInputSchema: z.ZodEffects<z.ZodObject<{
         runId: string;
     } | undefined;
     debugTrace?: boolean | undefined;
+    maxTurns?: number | undefined;
     services?: {
         name: string;
         version: string;
@@ -175,6 +198,7 @@ export declare const CodingTaskInputSchema: z.ZodEffects<z.ZodObject<{
         runId: string;
     } | undefined;
     debugTrace?: boolean | undefined;
+    maxTurns?: number | undefined;
     services?: {
         name: string;
         version: string;
@@ -194,6 +218,7 @@ export declare const CodingTaskInputSchema: z.ZodEffects<z.ZodObject<{
         runId: string;
     } | undefined;
     debugTrace?: boolean | undefined;
+    maxTurns?: number | undefined;
     services?: {
         name: string;
         version: string;
@@ -259,7 +284,7 @@ export declare const CodingAgentOutputSchema: z.ZodEffects<z.ZodObject<{
 }>;
 export declare const CodingRunResultSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
     schemaVersion: z.ZodLiteral<1>;
-    outcome: z.ZodEnum<["pull_request_opened", "pull_request_updated", "no_changes", "budget_exhausted"]>;
+    outcome: z.ZodEnum<["pull_request_opened", "pull_request_updated", "branch_pushed", "no_changes", "budget_exhausted"]>;
     repository: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
     baseRef: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
     headRef: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>>;
@@ -293,7 +318,7 @@ export declare const CodingRunResultSchema: z.ZodEffects<z.ZodEffects<z.ZodObjec
     tag: z.ZodEffects<z.ZodOptional<z.ZodNullable<z.ZodString>>, string | undefined, string | null | undefined>;
 }, "strict", z.ZodTypeAny, {
     repository: string;
-    outcome: "no_changes" | "budget_exhausted" | "pull_request_opened" | "pull_request_updated";
+    outcome: "no_changes" | "budget_exhausted" | "pull_request_opened" | "pull_request_updated" | "branch_pushed";
     schemaVersion: 1;
     baseRef: string;
     summary: string;
@@ -313,7 +338,7 @@ export declare const CodingRunResultSchema: z.ZodEffects<z.ZodEffects<z.ZodObjec
     pullRequestNumber?: number | undefined;
 }, {
     repository: string;
-    outcome: "no_changes" | "budget_exhausted" | "pull_request_opened" | "pull_request_updated";
+    outcome: "no_changes" | "budget_exhausted" | "pull_request_opened" | "pull_request_updated" | "branch_pushed";
     schemaVersion: 1;
     baseRef: string;
     summary: string;
@@ -333,7 +358,7 @@ export declare const CodingRunResultSchema: z.ZodEffects<z.ZodEffects<z.ZodObjec
     pullRequestNumber?: number | undefined;
 }>, {
     repository: string;
-    outcome: "no_changes" | "budget_exhausted" | "pull_request_opened" | "pull_request_updated";
+    outcome: "no_changes" | "budget_exhausted" | "pull_request_opened" | "pull_request_updated" | "branch_pushed";
     schemaVersion: 1;
     baseRef: string;
     summary: string;
@@ -353,7 +378,7 @@ export declare const CodingRunResultSchema: z.ZodEffects<z.ZodEffects<z.ZodObjec
     pullRequestNumber?: number | undefined;
 }, {
     repository: string;
-    outcome: "no_changes" | "budget_exhausted" | "pull_request_opened" | "pull_request_updated";
+    outcome: "no_changes" | "budget_exhausted" | "pull_request_opened" | "pull_request_updated" | "branch_pushed";
     schemaVersion: 1;
     baseRef: string;
     summary: string;
@@ -379,7 +404,7 @@ export declare const CodingRunResultSchema: z.ZodEffects<z.ZodEffects<z.ZodObjec
         outcome: "passed" | "failed" | "skipped";
     }[];
     repository: string;
-    outcome: "no_changes" | "budget_exhausted" | "pull_request_opened" | "pull_request_updated";
+    outcome: "no_changes" | "budget_exhausted" | "pull_request_opened" | "pull_request_updated" | "branch_pushed";
     schemaVersion: 1;
     baseRef: string;
     usage: {
@@ -393,7 +418,7 @@ export declare const CodingRunResultSchema: z.ZodEffects<z.ZodEffects<z.ZodObjec
     pullRequestNumber?: number | undefined;
 }, {
     repository: string;
-    outcome: "no_changes" | "budget_exhausted" | "pull_request_opened" | "pull_request_updated";
+    outcome: "no_changes" | "budget_exhausted" | "pull_request_opened" | "pull_request_updated" | "branch_pushed";
     schemaVersion: 1;
     baseRef: string;
     summary: string;

package/dist/coding/protocol.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { isAbsolute, resolve } from "node:path";
 export const CODING_PROTOCOL_VERSION = 1;
 /** The code host every coding run's repository and pull request live on (see pullRequestUrlSchema); the one place to change when another is added. */
 export const CODING_CODE_PROVIDER = "github";
@@ -192,10 +193,50 @@ function isGitRef(value) {
         return false;
     }
 }
+/** Repository identity prefix for a git folder on the wardby host: `local:/abs/path`. */
+export const LOCAL_REPO_PREFIX = "local:";
+export function isLocalRepository(value) {
+    return value.startsWith(LOCAL_REPO_PREFIX);
+}
+/** Upper bound on a whole `local:/abs/path` value, in UTF-8 bytes. */
+export const MAX_LOCAL_REPOSITORY_BYTES = 4096;
+/**
+ * Syntactic only: at most MAX_LOCAL_REPOSITORY_BYTES, no ASCII control
+ * characters (NUL included), absolute, normalized; returns "local:/abs/path"
+ * (no trailing slash).
+ */
+export function normalizeLocalRepository(value) {
+    if (!isLocalRepository(value))
+        throw new Error("local repository must start with local:");
+    if (byteLength(value) > MAX_LOCAL_REPOSITORY_BYTES) {
+        throw new Error(`local repository must be at most ${MAX_LOCAL_REPOSITORY_BYTES} UTF-8 bytes`);
+    }
+    const path = value.slice(LOCAL_REPO_PREFIX.length);
+    if (INVALID_SINGLE_LINE_CONTROL.test(path)) {
+        throw new Error("local repository path must not contain control characters");
+    }
+    if (!isAbsolute(path))
+        throw new Error("local repository path must be absolute");
+    return `${LOCAL_REPO_PREFIX}${resolve(path)}`;
+}
+function isCodingRepository(value) {
+    if (!isLocalRepository(value))
+        return isGitHubRepository(value);
+    try {
+        normalizeLocalRepository(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function normalizeCodingRepository(value) {
+    return isLocalRepository(value) ? normalizeLocalRepository(value) : normalizeGitHubRepository(value);
+}
 const repositorySchema = z
     .string()
-    .refine(isGitHubRepository, "must be a canonical name or uncredentialed github.com repository")
-    .transform(normalizeGitHubRepository);
+    .refine(isCodingRepository, "must be a canonical name, an uncredentialed github.com repository, or local:/absolute/path")
+    .transform(normalizeCodingRepository);
 export const CodingBaseRefSchema = z.string().refine(isGitRef, "must be a safe branch ref").transform(normalizeGitRef);
 export const CodingTaskOverrideSchema = boundedText(MAX_CODING_TASK_BYTES);
 /**
@@ -276,6 +317,10 @@ const testResultSchema = z
     outcome: z.enum(["passed", "failed", "skipped"]),
 })
     .strict();
+/** Upper bound on CodingAgentProfile.maxTurns (Claude Code runs). */
+export const MAX_CODING_TURNS = 1000;
+/** The Claude Code worker's turn limit when the agent sets none; the run's budget and timeout are the real limits. */
+export const DEFAULT_CLAUDE_MAX_TURNS = 200;
 /** Longest line a debug-traced worker writes to its log (src/coding-worker/debug-trace.ts). */
 export const MAX_DEBUG_TRACE_LINE_BYTES = 16 * 1024;
 export const CodingTaskInputSchema = z
@@ -305,6 +350,12 @@ export const CodingTaskInputSchema = z
      * untraced run is unchanged for workers that predate it.
      */
     debugTrace: z.boolean().optional(),
+    /**
+     * Claude Code turn limit (CodingAgentProfile.maxTurns, fixed on the run at
+     * dispatch). Absent means the worker default; written only when the agent
+     * sets one, so other runs' input is unchanged for workers that predate it.
+     */
+    maxTurns: z.number().int().min(1).max(MAX_CODING_TURNS).optional(),
     /**
      * Coding-run services started next to this run (docs/coding-services.md):
      * each one's catalog name and version, and the variables the agent's shells
@@ -367,7 +418,7 @@ const pullRequestUrlSchema = z
 export const CodingRunResultSchema = z
     .object({
     schemaVersion: z.literal(CODING_PROTOCOL_VERSION),
-    outcome: z.enum(["pull_request_opened", "pull_request_updated", "no_changes", "budget_exhausted"]),
+    outcome: z.enum(["pull_request_opened", "pull_request_updated", "branch_pushed", "no_changes", "budget_exhausted"]),
     repository: repositorySchema,
     baseRef: CodingBaseRefSchema,
     headRef: CodingBaseRefSchema.optional(),
@@ -390,7 +441,18 @@ export const CodingRunResultSchema = z
     if (isPrOutcome && prFields.some((field) => field === undefined)) {
         ctx.addIssue({ code: z.ZodIssueCode.custom, message: "a PR outcome requires all PR fields" });
     }
-    if (!isPrOutcome && prFields.some((field) => field !== undefined)) {
+    if (value.outcome === "branch_pushed") {
+        if (value.headRef === undefined || value.commitSha === undefined) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "a pushed-branch outcome requires headRef and commitSha",
+            });
+        }
+        if (value.pullRequestUrl !== undefined || value.pullRequestNumber !== undefined) {
+            ctx.addIssue({ code: z.ZodIssueCode.custom, message: "a pushed-branch outcome has no pull request" });
+        }
+    }
+    else if (!isPrOutcome && prFields.some((field) => field !== undefined)) {
         ctx.addIssue({ code: z.ZodIssueCode.custom, message: "non-PR outcomes must not include PR fields" });
     }
     if (value.pullRequestUrl && value.pullRequestNumber) {

package/dist/coding-worker/artifact.d.ts

@@ -25,6 +25,7 @@ export declare function readCodingInput(path: string): Promise<{
         runId: string;
     } | undefined;
     debugTrace?: boolean | undefined;
+    maxTurns?: number | undefined;
     services?: {
         name: string;
         version: string;

package/dist/coding-worker/errors.js

@@ -10,6 +10,8 @@ const SAFE_WORKER_ERROR_CODES = new Set([
     "coding_artifact_nesting_limit",
     "coding_artifact_duplicate_key",
     "coding_turn_failed",
+    // Claude Code reached the run's turn limit (CodingAgentProfile.maxTurns) before finishing.
+    "coding_turn_limit",
     "coding_stream_failed",
     "coding_stream_proxy_denied",
     "coding_stream_rate_limited",

package/dist/config/providers.d.ts

@@ -37,6 +37,8 @@ export interface GitHubVcsConfig {
     maxChangedFiles?: number;
     maxDiffBytes?: number;
 }
+/** Trusted roots for `local:` repositories (LOCAL_REPO_ROOTS, path-delimiter separated); unset = local repositories disabled. */
+export { loadLocalRepoRoots } from "../coding/local-repo.js";
 export declare function loadGitHubVcsConfig(env?: NodeJS.ProcessEnv): GitHubVcsConfig;
 /** GitHub App webhook settings for the code-review host ingress; unset = ingress disabled. */
 export declare function loadGitHubEventConfig(env?: NodeJS.ProcessEnv): {
@@ -100,6 +102,11 @@ export interface ContainerExecutorConfig {
     maxDiskMb: number;
     additionalWorkerImages: Record<string, Record<string, string>>;
 }
+/**
+ * An image variable's value, trimmed; empty or blank is unset. An env file that ships
+ * `CODING_WORKER_IMAGE=` must read as "no Codex worker", not as an invalid image.
+ */
+export declare function imageVariable(value: string | undefined): string | undefined;
 export declare function loadContainerExecutorConfig(env?: NodeJS.ProcessEnv): ContainerExecutorConfig;
 /**
  * Caps coding runs holding a concurrency slot across every control-plane
@@ -146,6 +153,12 @@ export interface KubernetesJobConfig {
      * alone is sufficient — no separate overall-timeout knob needs to move in lockstep.
      */
     enforcementExecTimeoutMs?: number;
+    /**
+     * The namespace ResourceQuota coding-run pods count against (KUBERNETES_RESOURCE_QUOTA). When
+     * set, a run whose pod would not fit the quota's free room waits in the coding queue instead of
+     * failing when the API server refuses the pod. Unset = no check (the RBAC grant is by name).
+     */
+    resourceQuota?: string;
 }
 export declare function loadKubernetesJobConfig(env?: NodeJS.ProcessEnv): KubernetesJobConfig;
 export interface McpConfig {

package/dist/config/providers.js

@@ -29,6 +29,8 @@ function optionalPositiveInteger(value, name) {
         throw new Error(`${name} must be a positive integer.`);
     return parsed;
 }
+/** Trusted roots for `local:` repositories (LOCAL_REPO_ROOTS, path-delimiter separated); unset = local repositories disabled. */
+export { loadLocalRepoRoots } from "../coding/local-repo.js";
 export function loadGitHubVcsConfig(env = process.env) {
     return {
         appId: env.GITHUB_APP_ID,
@@ -152,15 +154,22 @@ function optionalBoundedInteger(value, name, min, max) {
     }
     return parsed;
 }
+/**
+ * An image variable's value, trimmed; empty or blank is unset. An env file that ships
+ * `CODING_WORKER_IMAGE=` must read as "no Codex worker", not as an invalid image.
+ */
+export function imageVariable(value) {
+    return value?.trim() || undefined;
+}
 export function loadContainerExecutorConfig(env = process.env) {
     const additionalWorkerImages = {};
-    if (env.CODING_WORKER_IMAGE_NODE_PYTHON_3_12) {
-        additionalWorkerImages["node-python"] = { "3.12": env.CODING_WORKER_IMAGE_NODE_PYTHON_3_12 };
-    }
+    const nodePythonWorker = imageVariable(env.CODING_WORKER_IMAGE_NODE_PYTHON_3_12);
+    if (nodePythonWorker)
+        additionalWorkerImages["node-python"] = { "3.12": nodePythonWorker };
     const claudeToolRunnerImages = {};
-    if (env.CODING_CLAUDE_TOOL_RUNNER_IMAGE_NODE_PYTHON_3_12) {
-        claudeToolRunnerImages["node-python"] = { "3.12": env.CODING_CLAUDE_TOOL_RUNNER_IMAGE_NODE_PYTHON_3_12 };
-    }
+    const nodePythonToolRunner = imageVariable(env.CODING_CLAUDE_TOOL_RUNNER_IMAGE_NODE_PYTHON_3_12);
+    if (nodePythonToolRunner)
+        claudeToolRunnerImages["node-python"] = { "3.12": nodePythonToolRunner };
     const diskMb = optionalPositiveInteger(env.CODING_DISK_MB, "CODING_DISK_MB") ?? 2048;
     // Defaults to the effective diskMb: raising the ceiling an agents:write caller can request is an
     // explicit operator choice, so upgrading with an unchanged environment changes nothing.
@@ -169,9 +178,9 @@ export function loadContainerExecutorConfig(env = process.env) {
         throw new Error(`CODING_MAX_DISK_MB (${maxDiskMb}) must be at least the effective CODING_DISK_MB (${diskMb}).`);
     }
     return {
-        workerImage: env.CODING_WORKER_IMAGE,
-        claudeWorkerImage: env.CODING_CLAUDE_WORKER_IMAGE,
-        claudeToolRunnerImage: env.CODING_CLAUDE_TOOL_RUNNER_IMAGE,
+        workerImage: imageVariable(env.CODING_WORKER_IMAGE),
+        claudeWorkerImage: imageVariable(env.CODING_CLAUDE_WORKER_IMAGE),
+        claudeToolRunnerImage: imageVariable(env.CODING_CLAUDE_TOOL_RUNNER_IMAGE),
         claudeToolRunnerImages,
         proxyContainer: env.CODING_PROXY_CONTAINER,
         stateRoot: env.CODING_JOB_STATE_ROOT,
@@ -228,6 +237,9 @@ export function loadKubernetesJobConfig(env = process.env) {
     };
     if (env.KUBERNETES_CONTEXT)
         config.context = env.KUBERNETES_CONTEXT;
+    if (env.KUBERNETES_RESOURCE_QUOTA) {
+        config.resourceQuota = dnsLabel(env.KUBERNETES_RESOURCE_QUOTA, "KUBERNETES_RESOURCE_QUOTA", "");
+    }
     if (env.KUBERNETES_RUNTIME_CLASS) {
         config.runtimeClassName = dnsLabel(env.KUBERNETES_RUNTIME_CLASS, "KUBERNETES_RUNTIME_CLASS", "");
     }

package/dist/core/attribution.d.ts

@@ -77,6 +77,19 @@ export declare function linkedPullRequestAttribution(db: Pick<PrismaClient, "iss
     timeoutMs?: number;
     retryOn429?: boolean;
 }): Promise<AttributionIntent | undefined>;
+/**
+ * Attribution for a run on a pull request a wardby coding run opened, taken
+ * from that run's own issue. Covers a review that starts before the pull
+ * request is linked to its issue: the link is recorded when the lead run that
+ * delegated the work finishes, and a review can start earlier. The run id must
+ * come from the marker on an App-authored pull request
+ * (CodeReviewHost.pullRequestOrigin), never from pull request text. Undefined
+ * when that run is not this deployment's or has no issue.
+ */
+export declare function openingRunAttribution(db: Pick<PrismaClient, "codingRun" | "workItem">, trackers: IssueTrackerRegistry | undefined, openingRunId: string, opts?: {
+    timeoutMs?: number;
+    retryOn429?: boolean;
+}): Promise<AttributionIntent | undefined>;
 /** A refusal whose message is safe to return to the caller. */
 export declare class AttributionError extends Error {
     constructor(message: string);

package/dist/core/attribution.js

@@ -167,6 +167,36 @@ export async function linkedPullRequestAttribution(db, trackers, pr, opts) {
         return undefined;
     return { source: "linked_pr", item: await resolveWorkItem(db, trackers, issue.provider, issue.key, opts) };
 }
+/**
+ * Attribution for a run on a pull request a wardby coding run opened, taken
+ * from that run's own issue. Covers a review that starts before the pull
+ * request is linked to its issue: the link is recorded when the lead run that
+ * delegated the work finishes, and a review can start earlier. The run id must
+ * come from the marker on an App-authored pull request
+ * (CodeReviewHost.pullRequestOrigin), never from pull request text. Undefined
+ * when that run is not this deployment's or has no issue.
+ */
+export async function openingRunAttribution(db, trackers, openingRunId, opts) {
+    try {
+        const row = await db.codingRun.findUnique({
+            where: { runId: openingRunId },
+            select: {
+                issueProvider: true,
+                issueKey: true,
+                rootCodingRun: { select: { issueProvider: true, issueKey: true } },
+            },
+        });
+        const provider = row?.issueProvider ?? row?.rootCodingRun?.issueProvider;
+        const key = row?.issueKey ?? row?.rootCodingRun?.issueKey;
+        if (!provider || !key)
+            return undefined;
+        return { source: "linked_pr", item: await resolveWorkItem(db, trackers, provider, key, opts) };
+    }
+    catch (err) {
+        log.warn({ err, openingRunId }, "opening run lookup failed; the run is unattributed");
+        return undefined;
+    }
+}
 /** A refusal whose message is safe to return to the caller. */
 export class AttributionError extends Error {
     constructor(message) {

package/dist/core/budget-groups.d.ts

@@ -141,7 +141,9 @@ export interface RunTreeSpend {
  * twice, and the tree spends inside the root's hold, so counting that hold
  * would leave the tree nothing. It also leaves out holds of runs that started
  * after the root (they already counted the root's hold). capUsd is therefore
- * the tree's whole ceiling, and remainingUsd = capUsd - spentUsd.
+ * the tree's whole ceiling, and remainingUsd = capUsd - spentUsd - live
+ * sibling holds. remainingUsd also nets the unspent holds of in-flight
+ * sibling branches (parallel delegations, siblingHoldsUsd).
  */
 export declare function computeRunTreeSpend(db: BudgetGroupsDb, parentRunId: string, now?: Date): Promise<RunTreeSpend>;
 export type BudgetConstraint = Period | "run-tree";

package/dist/core/budget-groups.js

@@ -163,17 +163,65 @@ async function collectTreeRunIds(db, rootRunId) {
  * twice, and the tree spends inside the root's hold, so counting that hold
  * would leave the tree nothing. It also leaves out holds of runs that started
  * after the root (they already counted the root's hold). capUsd is therefore
- * the tree's whole ceiling, and remainingUsd = capUsd - spentUsd.
+ * the tree's whole ceiling, and remainingUsd = capUsd - spentUsd - live
+ * sibling holds. remainingUsd also nets the unspent holds of in-flight
+ * sibling branches (parallel delegations, siblingHoldsUsd).
  */
 export async function computeRunTreeSpend(db, parentRunId, now = new Date()) {
     const { rootRunId, capUsd, spentUsd, remainingUsd } = await runTreeSpend(db, parentRunId, now);
     return { rootRunId, capUsd, spentUsd, remainingUsd };
 }
-async function runTreeSpend(db, parentRunId, now) {
+/**
+ * The unspent holds of the tree's in-flight runs beside the asking run: every
+ * live run (isHoldLive) not on its ancestor chain -- siblings of the asking
+ * run or of an ancestor, and everything below them. Sequential delegation
+ * never has one; parallel delegations do, and without this each concurrent
+ * child would claim the same remainder. Each run holds its own reservation (a
+ * coding run's CodingRun.budgetReservedUsd, a native run's agent budgetUsd)
+ * minus its own cost: a native branch's budgetUsd bounds only its own model
+ * spend, so a coding grandchild under it holds its reservation separately. A
+ * finished run holds nothing and counts its real spend only, so the tree's
+ * remainder rises when a sibling finishes. With `self`, only runs that
+ * started before it count (first come, first served, as in computeGroupSpend).
+ */
+function siblingHoldsUsd(rows, parentRunId, now, self) {
+    const byId = new Map(rows.map((r) => [r.id, r]));
+    const ancestors = new Set();
+    for (let id = parentRunId; id && !ancestors.has(id); id = byId.get(id)?.parentRunId ?? null) {
+        ancestors.add(id);
+    }
+    const queueTimeoutSec = loadCodingConcurrencyConfig().queueTimeoutSec;
+    let total = 0;
+    for (const r of rows) {
+        if (ancestors.has(r.id))
+            continue;
+        if (self && (r.id === self.id || !isOrderedBefore(r, self)))
+            continue;
+        if (!isHoldLive(r, now, queueTimeoutSec))
+            continue;
+        const reservation = r.codingRun ? Number(r.codingRun.budgetReservedUsd) : Number(r.agent.budgetUsd);
+        total += Math.max(0, reservation - Number(r.costUsd));
+    }
+    return total;
+}
+async function runTreeSpend(db, parentRunId, now, self) {
     const root = await findRootRun(db, parentRunId);
     const treeRunIds = await collectTreeRunIds(db, root.id);
-    const rows = await db.run.findMany({ where: { id: { in: treeRunIds } }, select: { costUsd: true } });
+    const rows = await db.run.findMany({
+        where: { id: { in: treeRunIds } },
+        select: {
+            id: true,
+            parentRunId: true,
+            status: true,
+            costUsd: true,
+            startedAt: true,
+            heartbeatAt: true,
+            agent: { select: { budgetUsd: true } },
+            codingRun: { select: { budgetReservedUsd: true, timeoutSec: true } },
+        },
+    });
     const spentUsd = rows.reduce((sum, r) => sum + Number(r.costUsd), 0);
+    const heldUsd = siblingHoldsUsd(rows, parentRunId, now, self);
     const rootAgent = await db.agent.findUniqueOrThrow({
         where: { id: root.agentId },
         select: { id: true, budgetGroupId: true, budgetUsd: true },
@@ -190,7 +238,7 @@ async function runTreeSpend(db, parentRunId, now) {
         rootRunId: root.id,
         capUsd,
         spentUsd,
-        remainingUsd: Math.max(0, capUsd - spentUsd),
+        remainingUsd: Math.max(0, capUsd - spentUsd - heldUsd),
         treeRunIds,
         root: rootOrder,
         rootBudgetGroupId: rootAgent.budgetGroupId,
@@ -219,7 +267,7 @@ export async function effectiveBudgetForRun(db, agent, now = new Date(), parentR
     const ownSpend = { excludeReservationRunIds: self ? [self.id] : [], holdsBefore: self };
     if (!parentRunId)
         return groupCappedBudget(db, agent, now, ownSpend);
-    const tree = await runTreeSpend(db, parentRunId, now);
+    const tree = await runTreeSpend(db, parentRunId, now, self);
     const sharesRootGroup = agent.budgetGroupId !== null && agent.budgetGroupId === tree.rootBudgetGroupId;
     const spend = sharesRootGroup
         ? { excludeReservationRunIds: [...tree.treeRunIds, ...(self ? [self.id] : [])], holdsBefore: tree.root }

package/dist/core/ci-context.d.ts

@@ -0,0 +1,8 @@
+import type { CiView, PullRequestView } from "../providers/review-host/types.js";
+export interface AgentCiView extends CiView {
+    /** The description carries Wardby's Dependency install incomplete warning. Description text: informational only. */
+    sandboxInstallIncomplete: boolean;
+    note: string;
+}
+export declare function ciNote(ci: CiView, sandboxInstallIncomplete: boolean): string;
+export declare function ciForAgent(view: Pick<PullRequestView, "headSha" | "body" | "ci">): AgentCiView;