@wardby/cli 0.5.2 → 0.6.0

package/dist/config/github-allowed-accounts.js

@@ -0,0 +1,36 @@
+/**
+ * Which GitHub accounts this server serves through its GitHub App: the App's
+ * owner, always, plus WARDBY_GITHUB_ALLOWED_ACCOUNTS. Fail closed — there is no
+ * wildcard. Events from other accounts are ignored, their installations
+ * removed, and their repositories refused.
+ */
+export const GITHUB_ACCOUNT_NOT_ALLOWED = "github_account_not_allowed";
+const LOGIN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/;
+export function isGitHubLogin(value) {
+    return typeof value === "string" && LOGIN.test(value);
+}
+export function parseGitHubAllowedAccounts(raw) {
+    const entries = (raw ?? "")
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter((entry) => entry !== "");
+    for (const entry of entries) {
+        if (!LOGIN.test(entry))
+            throw new Error(`WARDBY_GITHUB_ALLOWED_ACCOUNTS: "${entry}" is not a GitHub login.`);
+    }
+    return new Set(entries.map((entry) => entry.toLowerCase()));
+}
+export function loadGitHubAllowedAccounts(env = process.env) {
+    return parseGitHubAllowedAccounts(env.WARDBY_GITHUB_ALLOWED_ACCOUNTS);
+}
+/** The App's owner plus the configured accounts, lower-cased. */
+export function trustedAccounts(ownerLogin, extra) {
+    return new Set([ownerLogin.toLowerCase(), ...extra]);
+}
+/** The owner of an `owner/name` GitHub repository, lower-cased. */
+export function githubAccountOf(repository) {
+    return repository.split("/", 1)[0].toLowerCase();
+}
+export function isGitHubAccountAllowed(trusted, login) {
+    return trusted.has(login.toLowerCase());
+}

package/dist/config/low-power.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Low-power mode from the environment.
+ *
+ * WARDBY_LOW_POWER=1 lets the control plane scale idle GKE deployments to zero;
+ * LOW_POWER_IDLE_MINUTES is how long they sit idle first. Unset/0 = off. See
+ * docs/getting-started-gke.md "Low-power mode".
+ */
+export interface LowPowerConfig {
+    enabled: boolean;
+    idleMinutes: number;
+}
+export declare function loadLowPowerConfig(env?: NodeJS.ProcessEnv): LowPowerConfig;

package/dist/config/low-power.js

@@ -0,0 +1,18 @@
+const DEFAULT_IDLE_MINUTES = 30;
+export function loadLowPowerConfig(env = process.env) {
+    const flag = env.WARDBY_LOW_POWER?.trim();
+    if (flag !== undefined && flag !== "" && flag !== "0" && flag !== "1") {
+        throw new Error("WARDBY_LOW_POWER must be 0 or 1.");
+    }
+    // LOW_POWER_IDLE_MINUTES only matters with the mode on; off, it is ignored entirely.
+    if (flag !== "1")
+        return { enabled: false, idleMinutes: DEFAULT_IDLE_MINUTES };
+    const raw = env.LOW_POWER_IDLE_MINUTES?.trim();
+    if (!raw)
+        return { enabled: true, idleMinutes: DEFAULT_IDLE_MINUTES };
+    const idleMinutes = /^\d+$/.test(raw) ? Number(raw) : NaN;
+    if (!(idleMinutes >= 5 && idleMinutes <= 1440)) {
+        throw new Error("LOW_POWER_IDLE_MINUTES must be an integer from 5 to 1440.");
+    }
+    return { enabled: true, idleMinutes };
+}

package/dist/config/mobile.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Mobile app access (WARDBY_MOBILE_ENABLED, off by default). S1: the app's
+ * private-use OAuth redirect (RFC 8252 §7.1); later: push notifications.
+ */
+export declare const DEFAULT_MOBILE_REDIRECT_URI = "com.wardby.mobile:/oauth";
+export declare const MOBILE_DISABLED = "mobile_disabled";
+export interface MobileConfig {
+    enabled: boolean;
+    /** The one redirect URI mobile sign-in may use; matched exactly. */
+    redirectUri: string;
+}
+export declare function loadMobileConfig(env?: NodeJS.ProcessEnv): MobileConfig;

package/dist/config/mobile.js

@@ -0,0 +1,18 @@
+/**
+ * Mobile app access (WARDBY_MOBILE_ENABLED, off by default). S1: the app's
+ * private-use OAuth redirect (RFC 8252 §7.1); later: push notifications.
+ */
+export const DEFAULT_MOBILE_REDIRECT_URI = "com.wardby.mobile:/oauth";
+export const MOBILE_DISABLED = "mobile_disabled";
+/** A reverse-domain scheme (at least one dot), ":/", then a path — no host, query, or fragment. */
+const PRIVATE_USE_REDIRECT = /^[a-z][a-z0-9+-]*(\.[a-z0-9+-]+)+:\/(?!\/)[A-Za-z0-9/_-]*$/;
+export function loadMobileConfig(env = process.env) {
+    const raw = env.WARDBY_MOBILE_ENABLED?.trim().toLowerCase() ?? "";
+    if (raw !== "" && raw !== "true" && raw !== "false")
+        throw new Error("WARDBY_MOBILE_ENABLED must be true or false.");
+    const redirectUri = env.WARDBY_MOBILE_REDIRECT_URI?.trim() || DEFAULT_MOBILE_REDIRECT_URI;
+    if (!PRIVATE_USE_REDIRECT.test(redirectUri)) {
+        throw new Error("WARDBY_MOBILE_REDIRECT_URI must be a private-use redirect such as com.example.app:/oauth.");
+    }
+    return { enabled: raw === "true", redirectUri };
+}

package/dist/config/providers.d.ts

@@ -7,6 +7,7 @@
  * adapters) is added once the adapters exist.
  */
 import { type KubernetesPlatform } from "../providers/jobs/kubernetes-platform.js";
+import { type MobileConfig } from "./mobile.js";
 export type JobLauncherKind = "local" | "docker" | "kubernetes";
 export type EmailProviderKind = "smtp" | "ses";
 export type SecretCipherKind = "app-key" | "kms";
@@ -79,6 +80,13 @@ export interface JiraConfig {
  * are rejected.
  */
 export declare function loadJiraConfig(env?: NodeJS.ProcessEnv): JiraConfig | null;
+export interface SlackConfig {
+    botToken: string;
+    apiBaseUrl: string;
+    customize: boolean;
+}
+/** Slack workflow notifications; null when WARDBY_SLACK_BOT_TOKEN is unset (and no other Slack variable is). */
+export declare function loadSlackConfig(env?: NodeJS.ProcessEnv): SlackConfig | null;
 export interface ContainerExecutorConfig {
     workerImage?: string;
     claudeWorkerImage?: string;
@@ -122,6 +130,49 @@ export interface CodingConcurrencyConfig {
  * before closing the executor (SHUTDOWN_DRAIN_SECONDS, default 600; 0 = do
  * not wait). Keep the platform's termination grace period above this.
  */
+/** The native sandbox (docs/native-sandbox.md): where sandbox-mode native runs execute. */
+interface NativeSandboxCommonConfig {
+    workerImage: string;
+    /** What a worker dials; undefined = the launcher's default (Docker: the gateway alias; Kubernetes: the Service's ClusterIP). */
+    gatewayUrl?: string;
+    cpus: number;
+    memoryMb: number;
+    /** Docker only: Kubernetes has no per-pod process limit (it is a node-level kubelet setting). */
+    pids: number;
+    /** NATIVE_SANDBOX_MAX_CONCURRENT: at most this many sandbox runs at once (unset = no cap). */
+    maxConcurrent?: number;
+    /** NATIVE_SANDBOX_WARM_POOL_SIZE: idle, isolated workers kept ready for runs to claim (0 = no pool). */
+    warmPoolSize: number;
+    /** NATIVE_SANDBOX_WARM_MAX_AGE_MS: an idle worker older than this is replaced, never claimed. */
+    warmMaxAgeMs: number;
+}
+export interface DockerNativeSandboxConfig extends NativeSandboxCommonConfig {
+    launcher: "docker";
+    /** The container running `wardby native-gateway`, joined to each run's network. */
+    gatewayContainer: string;
+}
+export interface KubernetesNativeSandboxConfig extends NativeSandboxCommonConfig {
+    launcher: "kubernetes";
+    /** Where run pods (and the native gateway) live. */
+    namespace: string;
+    context?: string;
+    /** The native gateway's Service in that namespace. */
+    gatewayService: string;
+    runtimeClassName?: string;
+    /** KUBERNETES_PLATFORM: worker pods are conformed to its admission rules. */
+    platform: KubernetesPlatform;
+    /** NATIVE_SANDBOX_PRIORITY_CLASS, else KUBERNETES_RUN_PRIORITY_CLASS. */
+    priorityClassName?: string;
+    /** How long a worker pod may take to start running (NATIVE_SANDBOX_READY_TIMEOUT_MS). */
+    readyTimeoutMs?: number;
+    /** How long its isolation may take to prove from inside (NATIVE_SANDBOX_ENFORCEMENT_TIMEOUT_MS). */
+    enforcementTimeoutMs?: number;
+}
+/** The native gateway Service (and Deployment) name when NATIVE_GATEWAY_SERVICE is unset. */
+export declare const DEFAULT_NATIVE_GATEWAY_SERVICE = "wardby-native-gateway";
+export type NativeSandboxConfig = DockerNativeSandboxConfig | KubernetesNativeSandboxConfig;
+/** Undefined when NATIVE_SANDBOX_LAUNCHER is unset (sandbox-mode runs then fail closed). Throws on a bad configuration. */
+export declare function loadNativeSandboxConfig(env?: NodeJS.ProcessEnv): NativeSandboxConfig | undefined;
 export declare function loadShutdownDrainSeconds(env?: NodeJS.ProcessEnv): number;
 export declare function loadCodingConcurrencyConfig(env?: NodeJS.ProcessEnv): CodingConcurrencyConfig;
 /** JOB_LAUNCHER=kubernetes: where coding-run pods go, how they reach the in-cluster proxy, and which platform's admission rules apply. */
@@ -144,8 +195,9 @@ export interface KubernetesJobConfig {
     preflightTimeoutMs?: number;
     readyTimeoutMs?: number;
     /**
-     * Bound for a single NetworkPolicy-enforcement probe exec (the keeper running two sequential
-     * connects). Defaults to the launcher's own 10 s, which a resource-constrained keeper (e.g. a
+     * Time budget for a single NetworkPolicy-enforcement probe (the keeper running two sequential
+     * connects); a streak's probes share one exec whose timeout the launcher derives from this.
+     * Defaults to the launcher's own 10 s, which a resource-constrained keeper (e.g. a
      * laptop `kind` cluster's default 250m CPU / 128Mi limit) can exceed even though the probe
      * itself is healthy — observed live: raising this to 60_000 was enough on `kind`. GKE Autopilot
      * is unaffected by leaving this unset. The launcher derives its overall enforcement wall-clock
@@ -199,6 +251,8 @@ export interface AuthConfig {
     signingKey?: string;
     credentialHashKey?: string;
     maxClients?: number;
+    /** Self-hosted mode: mobile sign-in (WARDBY_MOBILE_ENABLED, WARDBY_MOBILE_REDIRECT_URI). */
+    mobile: MobileConfig;
 }
 /** Read auth-adapter config (issuer/JWKS/audience/signing key) from the environment. */
 export declare function loadAuthConfig(env?: NodeJS.ProcessEnv): AuthConfig;

package/dist/config/providers.js

@@ -6,7 +6,8 @@
  * code change. The `assembleProviders` factory (which constructs the concrete
  * adapters) is added once the adapters exist.
  */
-import { KUBERNETES_PLATFORMS } from "../providers/jobs/kubernetes-platform.js";
+import { GVISOR_RUNTIME_CLASS, KUBERNETES_PLATFORMS, platformProfile, } from "../providers/jobs/kubernetes-platform.js";
+import { loadMobileConfig } from "./mobile.js";
 /** Read provider selection from environment variables, defaulting to portable. */
 export function loadProviderConfig(env = process.env) {
     return {
@@ -137,6 +138,30 @@ export function loadJiraConfig(env = process.env) {
         ...(epicLinkField ? { epicLinkField } : {}),
     };
 }
+/** Slack workflow notifications; null when WARDBY_SLACK_BOT_TOKEN is unset (and no other Slack variable is). */
+export function loadSlackConfig(env = process.env) {
+    const token = env.WARDBY_SLACK_BOT_TOKEN?.trim();
+    const base = env.WARDBY_SLACK_API_BASE_URL?.trim();
+    const customizeRaw = env.WARDBY_SLACK_CUSTOMIZE?.trim().toLowerCase();
+    if (!token) {
+        if (base || customizeRaw)
+            throw new Error("WARDBY_SLACK_API_BASE_URL/WARDBY_SLACK_CUSTOMIZE need WARDBY_SLACK_BOT_TOKEN.");
+        return null;
+    }
+    if (!token.startsWith("xoxb-"))
+        throw new Error("WARDBY_SLACK_BOT_TOKEN must be a bot token (xoxb-…).");
+    let apiBaseUrl = "https://slack.com/api";
+    if (base) {
+        const url = new URL(base);
+        if (url.protocol !== "https:")
+            throw new Error("WARDBY_SLACK_API_BASE_URL must be an https URL.");
+        apiBaseUrl = base.replace(/\/+$/, "");
+    }
+    if (customizeRaw && customizeRaw !== "true" && customizeRaw !== "false") {
+        throw new Error("WARDBY_SLACK_CUSTOMIZE must be true or false.");
+    }
+    return { botToken: token, apiBaseUrl, customize: customizeRaw === "true" };
+}
 function optionalPositiveNumber(value, name, fallback) {
     if (value === undefined)
         return fallback;
@@ -195,11 +220,67 @@ export function loadContainerExecutorConfig(env = process.env) {
         additionalWorkerImages,
     };
 }
-/**
- * How long a shutting-down instance waits for its in-flight native runs
- * before closing the executor (SHUTDOWN_DRAIN_SECONDS, default 600; 0 = do
- * not wait). Keep the platform's termination grace period above this.
- */
+/** The native gateway Service (and Deployment) name when NATIVE_GATEWAY_SERVICE is unset. */
+export const DEFAULT_NATIVE_GATEWAY_SERVICE = "wardby-native-gateway";
+/** Undefined when NATIVE_SANDBOX_LAUNCHER is unset (sandbox-mode runs then fail closed). Throws on a bad configuration. */
+export function loadNativeSandboxConfig(env = process.env) {
+    const launcher = env.NATIVE_SANDBOX_LAUNCHER?.trim();
+    if (!launcher)
+        return undefined;
+    if (launcher !== "docker" && launcher !== "kubernetes") {
+        throw new Error(`NATIVE_SANDBOX_LAUNCHER must be "docker" or "kubernetes" (got "${launcher}").`);
+    }
+    const workerImage = imageVariable(env.NATIVE_SANDBOX_WORKER_IMAGE);
+    if (!workerImage)
+        throw new Error(`NATIVE_SANDBOX_WORKER_IMAGE is required when NATIVE_SANDBOX_LAUNCHER=${launcher}.`);
+    const gatewayUrl = env.NATIVE_GATEWAY_URL?.trim();
+    if (gatewayUrl && !/^https?:\/\/[^\s]+$/.test(gatewayUrl)) {
+        throw new Error(`NATIVE_GATEWAY_URL must be an http(s) URL (got "${gatewayUrl}").`);
+    }
+    const common = {
+        workerImage,
+        ...(gatewayUrl ? { gatewayUrl } : {}),
+        cpus: optionalPositiveNumber(env.NATIVE_SANDBOX_CPUS, "NATIVE_SANDBOX_CPUS", 1),
+        memoryMb: optionalPositiveInteger(env.NATIVE_SANDBOX_MEMORY_MB, "NATIVE_SANDBOX_MEMORY_MB") ?? 512,
+        pids: optionalPositiveInteger(env.NATIVE_SANDBOX_PIDS, "NATIVE_SANDBOX_PIDS") ?? 128,
+        ...optionalField("maxConcurrent", optionalPositiveInteger(env.NATIVE_SANDBOX_MAX_CONCURRENT, "NATIVE_SANDBOX_MAX_CONCURRENT")),
+        warmPoolSize: optionalBoundedInteger(env.NATIVE_SANDBOX_WARM_POOL_SIZE?.trim() || undefined, "NATIVE_SANDBOX_WARM_POOL_SIZE", 0, 50) ?? 0,
+        warmMaxAgeMs: optionalBoundedInteger(env.NATIVE_SANDBOX_WARM_MAX_AGE_MS?.trim() || undefined, "NATIVE_SANDBOX_WARM_MAX_AGE_MS", 60_000, 21_600_000) ?? 1_800_000,
+    };
+    if (launcher === "kubernetes") {
+        // A cluster pulls by registry digest; a local image id means nothing to it.
+        if (!/@sha256:[0-9a-f]{64}$/.test(workerImage)) {
+            throw new Error("NATIVE_SANDBOX_WORKER_IMAGE must be a registry digest (repo@sha256:...) when NATIVE_SANDBOX_LAUNCHER=kubernetes.");
+        }
+        const namespace = env.NATIVE_SANDBOX_NAMESPACE?.trim() || env.KUBERNETES_NAMESPACE?.trim() || "wardby-coding";
+        const runtimeClassName = env.NATIVE_SANDBOX_RUNTIME_CLASS?.trim() || env.KUBERNETES_RUNTIME_CLASS?.trim() || undefined;
+        const context = env.KUBERNETES_CONTEXT?.trim() || undefined;
+        // The platform and run priority class are the coding launcher's settings, validated the same way.
+        const cluster = loadKubernetesJobConfig({
+            KUBERNETES_PLATFORM: env.KUBERNETES_PLATFORM,
+            KUBERNETES_RUN_PRIORITY_CLASS: env.NATIVE_SANDBOX_PRIORITY_CLASS?.trim() || env.KUBERNETES_RUN_PRIORITY_CLASS,
+        });
+        if (platformProfile(cluster.platform).requiresGvisor && runtimeClassName !== GVISOR_RUNTIME_CLASS) {
+            throw new Error(`KUBERNETES_PLATFORM=${cluster.platform} runs native workers only under gVisor: set NATIVE_SANDBOX_RUNTIME_CLASS (or KUBERNETES_RUNTIME_CLASS) to ${GVISOR_RUNTIME_CLASS} (found ${runtimeClassName ?? "unset"}).`);
+        }
+        return {
+            launcher,
+            ...common,
+            namespace,
+            gatewayService: env.NATIVE_GATEWAY_SERVICE?.trim() || DEFAULT_NATIVE_GATEWAY_SERVICE,
+            platform: cluster.platform,
+            ...(context ? { context } : {}),
+            ...(runtimeClassName ? { runtimeClassName } : {}),
+            ...optionalField("priorityClassName", cluster.priorityClassName),
+            ...optionalField("readyTimeoutMs", optionalBoundedInteger(env.NATIVE_SANDBOX_READY_TIMEOUT_MS, "NATIVE_SANDBOX_READY_TIMEOUT_MS", 1_000, 1_800_000)),
+            ...optionalField("enforcementTimeoutMs", optionalBoundedInteger(env.NATIVE_SANDBOX_ENFORCEMENT_TIMEOUT_MS, "NATIVE_SANDBOX_ENFORCEMENT_TIMEOUT_MS", 1_000, 600_000)),
+        };
+    }
+    const gatewayContainer = env.NATIVE_GATEWAY_CONTAINER?.trim();
+    if (!gatewayContainer)
+        throw new Error("NATIVE_GATEWAY_CONTAINER is required when NATIVE_SANDBOX_LAUNCHER=docker.");
+    return { launcher, ...common, gatewayContainer };
+}
 export function loadShutdownDrainSeconds(env = process.env) {
     const value = env.SHUTDOWN_DRAIN_SECONDS?.trim();
     if (!value)
@@ -293,6 +374,7 @@ export function loadAuthConfig(env = process.env) {
         signingKey: env.AUTH_SIGNING_KEY,
         credentialHashKey: env.AUTH_CREDENTIAL_HASH_KEY,
         maxClients: env.AUTH_MAX_CLIENTS ? Number(env.AUTH_MAX_CLIENTS) : undefined,
+        mobile: loadMobileConfig(env),
     };
 }
 /** Read secret-cipher config (the app-key master key) from the environment. */
@@ -309,3 +391,7 @@ export function loadDbosConfig(env = process.env) {
         executorId: env.DBOS_EXECUTOR_ID ?? crypto.randomUUID(),
     };
 }
+/** `{ [key]: value }` when value is set, else nothing: for spreading optional fields under exactOptionalPropertyTypes. */
+function optionalField(key, value) {
+    return (value === undefined ? {} : { [key]: value });
+}

package/dist/core/db.d.ts

@@ -1,4 +1,6 @@
+import type { PoolConfig } from "pg";
 import { PrismaClient } from "#prisma";
+import { type DatabaseAuth, type PgAuthOptions } from "./pg-auth.js";
 /**
  * Connection-pool sizing for the node-postgres pool behind @prisma/adapter-pg.
  *
@@ -28,13 +30,21 @@ export interface PoolSettings {
     connectionTimeoutMillis: number;
 }
 export declare function poolSettings(connectionString: string): PoolSettings;
+export interface PrismaClientOptions {
+    /** Overrides the pool size for a caller that sizes its own pools
+     *  (the coding proxy keeps its ledger and its package registry apart). */
+    poolMax?: number;
+    /** Defaults to DATABASE_AUTH (see pg-auth.ts). */
+    auth?: DatabaseAuth;
+    /** Test seam for rds-iam (environment, token signer, CA file reader). */
+    pgAuth?: PgAuthOptions;
+}
+/** The pg pool config behind every Prisma client: auth (pg-auth.ts) plus pool sizing. */
+export declare function prismaPgConfig(url: string, options?: PrismaClientOptions): PoolConfig;
 /**
  * The one way wardby builds a Prisma client. `url` defaults to DATABASE_URL
- * as read at call time.
+ * as read at call time. How it authenticates follows DATABASE_AUTH
+ * (password by default, or rds-iam; see pg-auth.ts).
  */
-/** `poolMax` overrides the pool size for a caller that sizes its own pools
- *  (the coding proxy keeps its ledger and its package registry apart). */
-export declare function createPrismaClient(url?: string | undefined, options?: {
-    poolMax?: number;
-}): PrismaClient;
+export declare function createPrismaClient(url?: string | undefined, options?: PrismaClientOptions): PrismaClient;
 export declare const prisma: PrismaClient;

package/dist/core/db.js

@@ -1,6 +1,7 @@
 import { availableParallelism } from "node:os";
 import { PrismaPg } from "@prisma/adapter-pg";
 import { PrismaClient } from "#prisma";
+import { databaseAuthFromEnv, pgConnectionConfig } from "./pg-auth.js";
 /**
  * Connection-pool sizing for the node-postgres pool behind @prisma/adapter-pg.
  *
@@ -56,20 +57,21 @@ class MissingUrlAdapter extends PrismaPg {
         throw new Error("DATABASE_URL is not set: cannot connect to the database.");
     }
 }
+/** The pg pool config behind every Prisma client: auth (pg-auth.ts) plus pool sizing. */
+export function prismaPgConfig(url, options = {}) {
+    return {
+        ...pgConnectionConfig(url, options.auth ?? databaseAuthFromEnv(), options.pgAuth),
+        ...poolSettings(url),
+        ...(options.poolMax !== undefined ? { max: options.poolMax } : {}),
+    };
+}
 /**
  * The one way wardby builds a Prisma client. `url` defaults to DATABASE_URL
- * as read at call time.
+ * as read at call time. How it authenticates follows DATABASE_AUTH
+ * (password by default, or rds-iam; see pg-auth.ts).
  */
-/** `poolMax` overrides the pool size for a caller that sizes its own pools
- *  (the coding proxy keeps its ledger and its package registry apart). */
 export function createPrismaClient(url = process.env.DATABASE_URL, options = {}) {
-    const adapter = url
-        ? new PrismaPg({
-            connectionString: url,
-            ...poolSettings(url),
-            ...(options.poolMax !== undefined ? { max: options.poolMax } : {}),
-        })
-        : new MissingUrlAdapter({ connectionString: "" });
+    const adapter = url ? new PrismaPg(prismaPgConfig(url, options)) : new MissingUrlAdapter({ connectionString: "" });
     return new PrismaClient({ adapter });
 }
 export const prisma = createPrismaClient();

package/dist/core/dispatch.d.ts

@@ -28,6 +28,17 @@ export interface DispatchRunOptions {
      * exclusive with `codingBaseRef`. Coding agents only.
      */
     continuesCodingRunId?: string;
+    /**
+     * The step in the delegating agent's declared merge order for this coding
+     * run (1 = merge first; equal numbers mean no order between them). Integer
+     * 1-99, validated by the caller (the delegate_to_* tool's mergeOrder
+     * argument); throws `Error("invalid_merge_order")` otherwise. Coding agents
+     * only; ignored for a native agent (no CodingRun to store it on). A
+     * continuation (`continuesCodingRunId`) that omits this inherits the pull
+     * request's effective value: the newest non-null `mergeOrder` among the
+     * root coding run and its continuations.
+     */
+    mergeOrder?: number;
     now?: Date;
     lockAgent?: boolean;
     task?: {

package/dist/core/dispatch.js

@@ -227,8 +227,37 @@ ownerId) {
         headRef: root.headRef,
         continuationOf: { runId: root.runId },
         rootCodingRunId: root.runId,
+        mergeOrder: await effectiveMergeOrder(reader, root.runId),
     };
 }
+/**
+ * The pull request's current merge step: the newest non-null mergeOrder
+ * (by run start) among the root coding run and every continuation of it
+ * (CodingRun.rootCodingRunId, indexed), or null when none set one. A
+ * continuation that omits mergeOrder inherits this, so an earlier
+ * continuation's override is kept rather than reverting to the root's.
+ */
+async function effectiveMergeOrder(reader, rootRunId) {
+    const newest = await reader.codingRun.findFirst({
+        where: { OR: [{ runId: rootRunId }, { rootCodingRunId: rootRunId }], mergeOrder: { not: null } },
+        orderBy: [{ run: { startedAt: "desc" } }, { runId: "desc" }],
+        select: { mergeOrder: true },
+    });
+    return newest?.mergeOrder ?? null;
+}
+/**
+ * Resolves the CodingRun's mergeOrder: the caller's own value if given (an
+ * integer 1-99; anything else throws), else the inherited effective value
+ * (undefined for a fresh branch), else null (no order).
+ */
+function resolveMergeOrder(options, inherited) {
+    if (options.mergeOrder === undefined)
+        return inherited ?? null;
+    if (!Number.isInteger(options.mergeOrder) || options.mergeOrder < 1 || options.mergeOrder > 99) {
+        throw new Error("invalid_merge_order");
+    }
+    return options.mergeOrder;
+}
 /** Read failures that are the file's fault rather than the host's: reported as an invalid declaration. */
 const UNREADABLE_DECLARATION = {
     github_file_too_large: `it is larger than ${MAX_SERVICE_DECLARATION_BYTES} bytes`,
@@ -439,6 +468,8 @@ export async function dispatchRun(options) {
                 agentId: agent.id,
                 trigger: options.trigger ?? "manual",
                 executionManaged: true,
+                // Fixed for the run's life: the executor routes on this, never on the agent's current setting.
+                nativeExecutionMode: agent.kind === "native" ? agent.nativeExecutionMode : null,
                 parentRunId: options.parentRunId,
                 grantedParentMemoryKeys: options.grantedParentMemoryKeys ?? [],
                 taskOverride: options.taskOverride,
@@ -478,8 +509,9 @@ export async function dispatchRun(options) {
             const budgetUsd = codingBudget.budgetUsd;
             // Resolved once: before the transaction when the declaration was read from it.
             const branch = declarationRead?.branch ?? (await resolveCodingBranch(tx, options, agent.codingProfile, agent.ownerId));
-            const { baseRef, continuationOf, rootCodingRunId } = branch;
+            const { baseRef, continuationOf, rootCodingRunId, mergeOrder: inheritedMergeOrder } = branch;
             const headRef = branch.headRef ?? `wardby/run-${run.id}`;
+            const mergeOrder = resolveMergeOrder(options, inheritedMergeOrder);
             const input = CodingTaskInputSchema.parse({
                 schemaVersion: CODING_PROTOCOL_VERSION,
                 runId: run.id,
@@ -523,8 +555,11 @@ export async function dispatchRun(options) {
                     toolImage,
                     budgetReservedUsd: budgetUsd,
                     rootCodingRunId,
+                    mergeOrder,
                     workspaceDiskMb: agent.codingProfile.workspaceDiskMb,
                     maxTurns: agent.codingProfile.maxTurns,
+                    repoSkills: agent.codingProfile.repoSkills,
+                    claudeBareMode: agent.codingProfile.claudeBareMode,
                     // Fixed here so a run's tracing never changes mid-run.
                     debugTrace: agent.codingProfile.debugTraceUntil != null &&
                         now.getTime() < agent.codingProfile.debugTraceUntil.getTime(),

package/dist/core/engine-native.js

@@ -6,7 +6,7 @@
  * lives behind a seam (a future LangGraph engine swaps in here) and why
  * the budget guardrail must stay above whichever engine is running.
  */
-import { runStepInline } from "../providers/engine/types.js";
+import { RunOwnershipLostError, runStepInline } from "../providers/engine/types.js";
 import { applyPreflightSafetyMargin, checkTokenCalibration, estimateInputCost, isOverBudget } from "./budget.js";
 import { logger } from "./logger.js";
 import { UNTRUSTED_CONTEXT_TAG, UNTRUSTED_TOOL_OUTPUT_TAG, wrapUntrusted } from "./untrusted-content.js";
@@ -197,11 +197,15 @@ export class NativeEngine {
             engineLog.info({ turn, toolCallIds: batch.map((i) => toolCalls[i].id) }, "running tool calls concurrently");
             const settled = await Promise.allSettled(batch.map((i) => runCall(i)));
             const rejections = settled.filter((outcome) => outcome.status === "rejected");
-            for (const extra of rejections.slice(1)) {
-                engineLog.warn({ turn, err: extra.reason }, "concurrent tool call also failed");
+            // An ownership loss wins over an ordinary failure: this attempt no longer owns the run, so it
+            // must stop without a terminal write rather than fail the run for the attempt that does.
+            const thrown = rejections.find((r) => r.reason instanceof RunOwnershipLostError) ?? rejections[0];
+            for (const extra of rejections) {
+                if (extra !== thrown)
+                    engineLog.warn({ turn, err: extra.reason }, "concurrent tool call also failed");
             }
-            if (rejections.length > 0)
-                throw rejections[0].reason;
+            if (thrown)
+                throw thrown.reason;
             settled.forEach((outcome, position) => {
                 results[batch[position]] = outcome.value;
             });

package/dist/core/host-events.d.ts

@@ -5,10 +5,10 @@
  * module decides which agents run. See
  * docs/private/2026-09-25-code-review-host-design.md §6.3.
  */
-import type { PrismaClient } from "#prisma";
+import { type PrismaClient } from "#prisma";
 import type { Executor } from "../providers/executor/types.js";
 import type { IssueTrackerRegistry } from "../providers/issue-tracker/types.js";
-import type { HostEvent, ReviewHostRegistry } from "../providers/review-host/types.js";
+import type { CodeReviewHost, HostEvent, ReviewHostRegistry } from "../providers/review-host/types.js";
 import { type OpenSibling } from "./related-pull-requests.js";
 import { type RepoAccessGate } from "./repo-access.js";
 import { type DriftScope } from "../knowledge/relevance.js";
@@ -84,12 +84,58 @@ export declare function siblingContinuationHints(siblings: readonly OpenSibling[
  */
 export declare function mentionTaskText(event: MentionEvent, siblings?: readonly OpenSibling[]): string;
 export declare function unknownPriorRunBody(priorRunId: string): string;
+export interface ReviewTarget {
+    agentId: string;
+    checkName: string;
+}
+/** A review run's task: the head to review, plus any extra context its trigger adds. */
+export declare function reviewTaskText(repository: string, prNumber: number, headSha: string, context?: {
+    task: string;
+    untrustedContext: string;
+}): string;
+/** Starts one review run per target on a pull request head; returns the started run ids. */
+export declare function startReviews(deps: ReviewStartDeps, host: CodeReviewHost, repository: string, prNumber: number, headSha: string, targets: ReviewTarget[], 
+/** True for automatic triggers; an explicit re-run or `@wardby review` always runs. */
+skipReviewedCommits?: boolean, 
+/**
+ * Extra context for this review: `task` (written by wardby, trusted) is appended to the
+ * review task; `untrustedContext` (anything a model or a person wrote) travels separately,
+ * delivered as data.
+ */
+context?: {
+    task: string;
+    untrustedContext: string;
+}): Promise<string[]>;
 /**
  * The reconciler's fallback for deferred reviews: drops rows older than
  * DEFERRED_REVIEW_MAX_AGE_MS, and starts (regardless of CI) those waiting
  * longer than DEFERRED_REVIEW_MAX_WAIT_MS, at most DEFERRED_REVIEW_BATCH per
  * pass, oldest first. Covers CI that never reported, ran very long, or whose
- * completion webhook was missed. Never throws; returns the runs started.
+ * completion webhook was missed. Rows waiting for a delegating run (reason
+ * "request") are released the same way once they are that old, but only when
+ * that run is terminal (or gone): a lead the reconciler marked lost never
+ * reaches its finalizer. Never throws; returns the runs started.
  */
 export declare function startDeferredReviews(deps: ReviewStartDeps, now?: Date): Promise<string[]>;
+/**
+ * The run whose finish a review of this pull request waits for: the root of
+ * the run tree when the PR's opening coding run was delegated (it has a
+ * parent run) and that root is not terminal yet; otherwise null (a
+ * non-delegated coding PR, a finished request, or an unknown marker). A lead's
+ * delegate_to_* calls block until each child is terminal, so a terminal root
+ * means every sibling coding run of the request has finished and opened its
+ * pull request. A continuation's marker resolves to its root coding run, then
+ * up that run's parents. `repository`, when given, must be the coding run's.
+ */
+export declare function requestLeadRunId(db: Pick<HostEventDb, "$queryRaw">, prMarkerRunId: string, repository?: string): Promise<string | null>;
+/**
+ * The delegating run `leadRunId` is terminal (it succeeded, failed, or was
+ * cancelled): releases every review that waited for it. A reviewer linked
+ * with waitForCi whose head's CI is still pending is handed to CI (the row
+ * becomes reason "ci", its max wait counted from now); every other row is
+ * started (claimed by delete, so concurrent releases start each review once).
+ * Called from the lead's finalizer, after the related pull requests sections
+ * were rewritten. Never throws.
+ */
+export declare function startDeferredForRequest(deps: ReviewStartDeps, leadRunId: string): Promise<void>;
 export declare function routeHostEvent(event: HostEvent, deps: RouteHostEventDeps): Promise<RouteResult>;