@wardby/cli 0.5.2 → 0.6.0

package/dist/providers/executor/dbos.js

@@ -11,16 +11,67 @@
  * The heartbeat is kept while the workflow runs here so the reconciler's
  * stale-heartbeat detection is unchanged; the reconciler consults
  * `recover()` (Task 6) before declaring a DBOS run lost.
+ *
+ * A stalled-but-alive owner can overlap an adopted attempt of the same run:
+ * whichever records a step second loses ownership, stops at that step
+ * without writing the run, and hands the SDK's conflict back so DBOS parks
+ * it as a duplicate execution (see dbosStep and runInsideWorkflow).
  */
 import { DBOS, Error as DbosErrors } from "@dbos-inc/dbos-sdk";
+import pg from "pg";
+import { RunOwnershipLostError } from "../engine/types.js";
 import { executeRun, RunCancelledError } from "../../core/runner.js";
 import { markRunFailedFromExecutorError } from "../../core/dispatch.js";
 import { prisma as defaultDb } from "../../core/db.js";
 import { HEARTBEAT_INTERVAL_MS } from "../../core/timing.js";
 import { logger } from "../../core/logger.js";
+import { databaseAuthFromEnv, pgConnectionConfig } from "../../core/pg-auth.js";
 import { ADOPTION_EXHAUSTED_REASON, decideRecovery, shouldGiveUpAdoption, versionMismatchReason, } from "./dbos-status.js";
 export const DBOS_BACKEND = "dbos";
 const dbosLog = logger.child({ module: "dbos-executor" });
+/** DBOS's own system pool size (DEFAULT_POOL_SIZE in the SDK's system_database.js); kept for ours. */
+const DBOS_SYSTEM_POOL_SIZE = 10;
+/** DBOS's own connect timeout when the URL sets no connect_timeout (getClientConfig in the SDK's utils.js). */
+const DBOS_CONNECT_TIMEOUT_MS = 10_000;
+/**
+ * DBOS.setConfig input. Under password auth this is exactly what launch() always passed, and DBOS
+ * opens its own pool from the URL. Under rds-iam DBOS gets a pool whose password is the IAM token;
+ * DBOS then runs its migrations, queries and LISTEN through that pool and never opens a URL
+ * connection (system_database.js: a custom pool skips database creation and is what every
+ * connection borrows from). The pool copies what DBOS would have set on its own: size, connect
+ * timeout and application_name. DBOS never ends a pool it was given — see endSystemPool().
+ */
+export function dbosLaunchConfig(config, executorId, auth, pgAuth) {
+    const url = config.systemDatabaseUrl;
+    const launch = {
+        name: "wardby",
+        systemDatabaseUrl: url,
+        systemDatabaseSchemaName: config.schemaName,
+        executorID: executorId,
+        runAdminServer: false,
+        logLevel: "warn",
+    };
+    if (auth !== "rds-iam")
+        return launch;
+    const connection = pgConnectionConfig(url, auth, pgAuth); // validates the URL first
+    const connectTimeout = Number.parseInt(new URL(url).searchParams.get("connect_timeout") ?? "", 10);
+    const pool = new pg.Pool({
+        application_name: `dbos_transact_${executorId}`,
+        ...connection,
+        max: DBOS_SYSTEM_POOL_SIZE,
+        connectionTimeoutMillis: connectTimeout ? connectTimeout * 1000 : DBOS_CONNECT_TIMEOUT_MS,
+    });
+    // DBOS attaches no listener to a caller's pool; an idle connection's error would otherwise crash the process.
+    pool.on("error", (err) => dbosLog.warn({ err }, "DBOS system database pool error"));
+    return { ...launch, systemDatabasePool: pool };
+}
+/** The pool launch() handed DBOS, if any. Module-level like DBOS itself: whoever shuts DBOS down ends it. */
+let systemPool;
+async function endSystemPool() {
+    const pool = systemPool;
+    systemPool = undefined;
+    await pool?.end().catch((err) => dbosLog.warn({ err }, "failed to close the DBOS system database pool"));
+}
 /** The executor whose deps the registered workflow uses. Set by launch(). */
 let activeExecutor;
 /** Setter (rather than `activeExecutor = this` inline) to avoid aliasing `this` to a variable. */
@@ -44,19 +95,48 @@ const cancellationReasons = new Map();
  * out of the next step boundary. Translated here into a `RunCancelledError`
  * so executeRun's backstop records `cancelled` plus the operator's reason,
  * rather than `failed` plus an SDK-internal message.
+ *
+ * DBOS signals that another execution of this workflow recorded the step
+ * first by throwing `DBOSWorkflowConflictError` after this attempt's step
+ * body already ran. Translated into a `RunOwnershipLostError` (carrying the
+ * discarded step's usage, if any, for the log) so executeRun's backstop stops
+ * this attempt without writing the run; runInsideWorkflow turns it back into
+ * the SDK error.
  */
-const dbosStep = async (name, fn) => {
+export const dbosStep = async (name, fn) => {
+    let ran;
     try {
-        return await DBOS.runStep(fn, { name, retriesAllowed: false });
+        return await DBOS.runStep(async () => {
+            const value = await fn();
+            ran = { value };
+            return value;
+        }, { name, retriesAllowed: false });
     }
     catch (err) {
         if (err instanceof DbosErrors.DBOSWorkflowCancelledError) {
             const reason = cancellationReasons.get(err.workflowID);
             throw new RunCancelledError(`Run cancelled: ${reason ?? "no reason given"}`);
         }
+        if (err instanceof DbosErrors.DBOSWorkflowConflictError) {
+            const discardedUsage = usageOf(ran?.value);
+            throw new RunOwnershipLostError(name, { cause: err, ...(discardedUsage ? { discardedUsage } : {}) });
+        }
         throw err;
     }
 };
+/**
+ * The numeric `usage` fields of a step result, if it has any (an LLM turn's
+ * token counts and cost). Tool steps return a string and yield nothing.
+ */
+function usageOf(value) {
+    if (typeof value !== "object" || value === null || !("usage" in value))
+        return undefined;
+    const usage = value.usage;
+    if (typeof usage !== "object" || usage === null)
+        return undefined;
+    const numeric = Object.entries(usage).filter((entry) => typeof entry[1] === "number");
+    return numeric.length > 0 ? Object.fromEntries(numeric) : undefined;
+}
 /**
  * Registered once at module load — DBOS requires registration before
  * launch(). The body must be deterministic between steps; everything
@@ -112,15 +192,24 @@ export class DbosExecutor {
         }
         setActiveExecutor(this);
         if (!DBOS.isInitialized()) {
-            DBOS.setConfig({
-                name: "wardby",
-                systemDatabaseUrl: this.config.systemDatabaseUrl,
-                systemDatabaseSchemaName: this.config.schemaName,
-                executorID: this.id,
-                runAdminServer: false,
-                logLevel: "warn",
-            });
-            await DBOS.launch();
+            const launchConfig = dbosLaunchConfig(this.config, this.id, databaseAuthFromEnv());
+            systemPool = launchConfig.systemDatabasePool;
+            try {
+                DBOS.setConfig(launchConfig);
+                await DBOS.launch();
+            }
+            catch (err) {
+                // DBOS.launch can throw after it initialized (registering the application version, starting
+                // event receivers). Shut that half-launched DBOS down so the next launch() starts clean, then
+                // end the pool either way: the next launch() makes a new one.
+                if (activeExecutor === this)
+                    setActiveExecutor(undefined);
+                if (DBOS.isInitialized()) {
+                    await DBOS.shutdown().catch((shutdownErr) => dbosLog.warn({ err: shutdownErr }, "failed to shut down DBOS after a failed launch"));
+                }
+                await endSystemPool();
+                throw err;
+            }
         }
         this.launched = true;
         dbosLog.info({ executorId: DBOS.executorID }, "DBOS executor launched");
@@ -131,7 +220,12 @@ export class DbosExecutor {
         this.launched = false;
         if (activeExecutor === this)
             setActiveExecutor(undefined);
-        await DBOS.shutdown({ workflowCompletionTimeoutMS: 5_000 });
+        try {
+            await DBOS.shutdown({ workflowCompletionTimeoutMS: 5_000 });
+        }
+        finally {
+            await endSystemPool();
+        }
     }
     /** Where a run this executor marks failed files its self-defect (no-op without a configured issue tracker). */
     get selfDefects() {
@@ -263,6 +357,18 @@ export class DbosExecutor {
         try {
             await executeRun(runId, this.providers, this.db, undefined, dbosStep);
         }
+        catch (err) {
+            // An ownership loss leaves the workflow body as the SDK's own conflict error, so DBOS takes
+            // its duplicate-execution path: it records nothing and parks this attempt until the winner
+            // records the outcome. Any other error escaping here would be recorded as the workflow's
+            // outcome while the winner still runs. The runner already logged the loss.
+            if (err instanceof RunOwnershipLostError) {
+                throw err.cause instanceof DbosErrors.DBOSWorkflowConflictError
+                    ? err.cause
+                    : new DbosErrors.DBOSWorkflowConflictError(runId);
+            }
+            throw err;
+        }
         finally {
             clearInterval(timer);
             cancellationReasons.delete(runId);

package/dist/providers/executor/deferred.d.ts

@@ -0,0 +1,56 @@
+/**
+ * An Executor for a process that must never start or stop runs itself: the
+ * native sandbox gateway (docs/native-sandbox.md). Sandbox workers can reach
+ * the gateway, so it holds no Docker socket, cluster credential, or in-process
+ * engine; a child it dispatches is only recorded (Run.startDeferredAt) and a
+ * stop it needs only requested (Run.stopRequestedAt). The scheduler leader
+ * carries both out through the server's own executor (`drainDeferredRuns`).
+ *
+ * Coding dispatch still needs the worker image and the repository's service
+ * declaration and knowledge files, resolved at dispatch: those come from a
+ * resolve-only view of the configured coding executor, whose start/stop are
+ * never called here.
+ */
+import type { PrismaClient } from "#prisma";
+import type { CodingImageSelector, Executor } from "./types.js";
+import type { CodingProvider } from "../../coding/provider.js";
+export type DeferredExecutorDb = Pick<PrismaClient, "run">;
+export declare class DeferredExecutor implements Executor {
+    private readonly db;
+    /** Coding resolution only (image, service declaration, repository files); never started or stopped. */
+    private readonly resolver?;
+    constructor(db: DeferredExecutorDb, 
+    /** Coding resolution only (image, service declaration, repository files); never started or stopped. */
+    resolver?: Executor | undefined);
+    start(runId: string): Promise<void>;
+    stop(runId: string, reason?: string): Promise<void>;
+    resolveCodingWorkerImage(selector: CodingImageSelector): string;
+    resolveCodingToolImage(selector: CodingImageSelector): string | null;
+    readCodingServiceDeclaration(input: {
+        repository: string;
+        baseRef: string;
+    }): Promise<string | null>;
+    readCodingRepositoryFile(input: {
+        repository: string;
+        baseRef: string;
+        path: string;
+        maxBytes: number;
+    }): Promise<string | null>;
+    supportsCodingServices(provider: CodingProvider): boolean;
+}
+export interface DrainDeferredRunsOptions {
+    db: Pick<PrismaClient, "run">;
+    executor: Executor;
+    /** Where a start failure is recorded; defaults to marking the run failed with the error. */
+    onStartFailed?: (runId: string, err: unknown) => Promise<void>;
+    limit?: number;
+}
+/**
+ * Starts runs a deferred executor dispatched, and stops runs it asked to stop, through the
+ * server's executor. Called on the scheduler leader's tick. Each row is claimed by clearing its
+ * marker in a conditional update first, so two drains never start or stop the same run twice.
+ */
+export declare function drainDeferredRuns(options: DrainDeferredRunsOptions): Promise<{
+    started: number;
+    stopped: number;
+}>;

package/dist/providers/executor/deferred.js

@@ -0,0 +1,119 @@
+/**
+ * An Executor for a process that must never start or stop runs itself: the
+ * native sandbox gateway (docs/native-sandbox.md). Sandbox workers can reach
+ * the gateway, so it holds no Docker socket, cluster credential, or in-process
+ * engine; a child it dispatches is only recorded (Run.startDeferredAt) and a
+ * stop it needs only requested (Run.stopRequestedAt). The scheduler leader
+ * carries both out through the server's own executor (`drainDeferredRuns`).
+ *
+ * Coding dispatch still needs the worker image and the repository's service
+ * declaration and knowledge files, resolved at dispatch: those come from a
+ * resolve-only view of the configured coding executor, whose start/stop are
+ * never called here.
+ */
+import { logger } from "../../core/logger.js";
+const deferredLog = logger.child({ module: "deferred-executor" });
+export class DeferredExecutor {
+    db;
+    resolver;
+    constructor(db, 
+    /** Coding resolution only (image, service declaration, repository files); never started or stopped. */
+    resolver) {
+        this.db = db;
+        this.resolver = resolver;
+    }
+    async start(runId) {
+        await this.db.run.updateMany({ where: { id: runId, status: "pending" }, data: { startDeferredAt: new Date() } });
+    }
+    async stop(runId, reason) {
+        // Never started: nothing runs it, so it can simply end here.
+        const cancelled = await this.db.run.updateMany({
+            where: { id: runId, status: "pending", startDeferredAt: { not: null } },
+            data: {
+                status: "cancelled",
+                error: reason ?? "Cancelled before it started.",
+                finishedAt: new Date(),
+                startDeferredAt: null,
+            },
+        });
+        if (cancelled.count > 0)
+            return;
+        await this.db.run.updateMany({
+            where: { id: runId, status: { in: ["pending", "running"] } },
+            data: { stopRequestedAt: new Date(), stopRequestReason: reason ?? null },
+        });
+    }
+    resolveCodingWorkerImage(selector) {
+        if (!this.resolver?.resolveCodingWorkerImage)
+            throw new Error("coding_execution_not_configured");
+        return this.resolver.resolveCodingWorkerImage(selector);
+    }
+    resolveCodingToolImage(selector) {
+        if (!this.resolver?.resolveCodingToolImage)
+            throw new Error("coding_execution_not_configured");
+        return this.resolver.resolveCodingToolImage(selector);
+    }
+    async readCodingServiceDeclaration(input) {
+        return this.resolver?.readCodingServiceDeclaration?.(input) ?? null;
+    }
+    async readCodingRepositoryFile(input) {
+        return this.resolver?.readCodingRepositoryFile?.(input) ?? null;
+    }
+    supportsCodingServices(provider) {
+        return this.resolver?.supportsCodingServices?.(provider) === true;
+    }
+}
+/**
+ * Starts runs a deferred executor dispatched, and stops runs it asked to stop, through the
+ * server's executor. Called on the scheduler leader's tick. Each row is claimed by clearing its
+ * marker in a conditional update first, so two drains never start or stop the same run twice.
+ */
+export async function drainDeferredRuns(options) {
+    const { db, executor } = options;
+    const limit = options.limit ?? 50;
+    let started = 0;
+    let stopped = 0;
+    const toStart = await db.run.findMany({
+        where: { startDeferredAt: { not: null }, status: "pending" },
+        orderBy: { startDeferredAt: "asc" },
+        take: limit,
+        select: { id: true },
+    });
+    for (const { id } of toStart) {
+        const claimed = await db.run.updateMany({
+            where: { id, startDeferredAt: { not: null }, status: "pending" },
+            data: { startDeferredAt: null },
+        });
+        if (claimed.count === 0)
+            continue;
+        started += 1;
+        // Not awaited: an in-process executor's start runs the whole run.
+        void executor.start(id).catch(async (err) => {
+            deferredLog.error({ err, runId: id }, "deferred run failed to start");
+            await (options.onStartFailed?.(id, err) ??
+                db.run.updateMany({
+                    where: { id, status: { in: ["pending", "running"] } },
+                    data: { status: "failed", error: err instanceof Error ? err.message : String(err), finishedAt: new Date() },
+                }));
+        });
+    }
+    const toStop = await db.run.findMany({
+        where: { stopRequestedAt: { not: null } },
+        orderBy: { stopRequestedAt: "asc" },
+        take: limit,
+        select: { id: true, stopRequestReason: true, status: true },
+    });
+    for (const row of toStop) {
+        const claimed = await db.run.updateMany({
+            where: { id: row.id, stopRequestedAt: { not: null } },
+            data: { stopRequestedAt: null, stopRequestReason: null },
+        });
+        if (claimed.count === 0 || !["pending", "running"].includes(row.status))
+            continue;
+        stopped += 1;
+        await executor.stop(row.id, row.stopRequestReason ?? undefined).catch((err) => {
+            deferredLog.warn({ err, runId: row.id }, "deferred stop request failed");
+        });
+    }
+    return { started, stopped };
+}

package/dist/providers/executor/routing.d.ts

@@ -1,25 +1,49 @@
-import type { CodingImageSelector, Executor, ExecutionRecoveryResult, PersistedExecutionHandle } from "./types.js";
 import type { CodingProvider } from "../../coding/provider.js";
+import type { CodingImageSelector, Executor, ExecutionRecoveryResult, PersistedExecutionHandle } from "./types.js";
+/**
+ * Which executor owns a run: a coding run, a native run in the control plane
+ * (in-process or DBOS), or a native run in an isolated sandbox worker. Read
+ * from the run's own row (agent kind plus Run.nativeExecutionMode), never from
+ * the agent's current setting, so a setting change reaches only later runs.
+ */
+export type ExecutionTarget = "native" | "native-sandbox" | "coding";
 export interface ExecutionKindResolver {
-    kindForRun(runId: string): Promise<"native" | "coding" | null>;
+    kindForRun(runId: string): Promise<ExecutionTarget | null>;
 }
-/** Keeps native execution unchanged while routing coding runs to isolation. */
+/**
+ * Keeps native execution unchanged while routing coding runs to isolation and
+ * sandbox-mode native runs to the native sandbox executor.
+ *
+ * With no sandbox executor composed in, a sandbox run goes to the native
+ * executor, whose runner refuses to execute it (executeRun fails it before
+ * any spend, closing its host check and status comments): fail closed through
+ * the one path that already finishes a run properly, never a silent run in
+ * the control plane.
+ */
 export declare class RoutingExecutor implements Executor {
     private readonly resolver;
     private readonly native;
     private readonly coding;
-    constructor(resolver: ExecutionKindResolver, native: Executor, coding: Executor);
+    private readonly sandbox?;
+    constructor(resolver: ExecutionKindResolver, native: Executor, coding: Executor, sandbox?: Executor | undefined);
+    private route;
     start(runId: string): Promise<void>;
     stop(runId: string, reason?: string): Promise<void>;
     /**
-     * Recovery is routed by the run's agent kind, exactly like start/stop: a
-     * native run's handle belongs to the native executor (e.g. a DBOS
-     * workflow handle), a coding run's to the container executor. Routing by
-     * handle backend would need this class to know every backend name.
+     * Recovery is routed by the run's target, exactly like start/stop: a native
+     * run's handle belongs to the native executor (e.g. a DBOS workflow handle),
+     * a sandbox run's to the sandbox executor, a coding run's to the container
+     * executor. Routing by handle backend would need this class to know every
+     * backend name.
      */
     recover(handle: PersistedExecutionHandle): Promise<ExecutionRecoveryResult>;
-    /** Lifecycle fans out to both executors; each is optional on the seam. */
+    /** Each distinct executor once, in a fixed order: native, coding, sandbox. */
+    private distinct;
+    /** Lifecycle fans out to every distinct executor; each hook is optional on the seam. */
     launch(): Promise<void>;
+    /** Fans out like `launch`. */
+    warmUp(): Promise<void>;
+    /** Reverse of `launch`. */
     close(): Promise<void>;
     resolveCodingWorkerImage(selector: CodingImageSelector): string;
     resolveCodingToolImage(selector: CodingImageSelector): string | null;
@@ -33,6 +57,7 @@ export declare class RoutingExecutor implements Executor {
         path: string;
         maxBytes: number;
     }): Promise<string | null>;
+    supportsNativeSandbox(): boolean;
     supportsCodingServices(provider: CodingProvider): boolean;
 }
 export declare class PrismaExecutionKindResolver implements ExecutionKindResolver {
@@ -44,6 +69,7 @@ export declare class PrismaExecutionKindResolver implements ExecutionKindResolve
                     id: string;
                 };
                 select: {
+                    nativeExecutionMode: true;
                     agent: {
                         select: {
                             kind: true;
@@ -51,11 +77,12 @@ export declare class PrismaExecutionKindResolver implements ExecutionKindResolve
                     };
                 };
             }): Promise<{
+                nativeExecutionMode: string | null;
                 agent: {
                     kind: string;
                 };
             } | null>;
         };
     });
-    kindForRun(runId: string): Promise<"native" | "coding" | null>;
+    kindForRun(runId: string): Promise<ExecutionTarget | null>;
 }

package/dist/providers/executor/routing.js

@@ -1,53 +1,86 @@
-/** Keeps native execution unchanged while routing coding runs to isolation. */
+/**
+ * Keeps native execution unchanged while routing coding runs to isolation and
+ * sandbox-mode native runs to the native sandbox executor.
+ *
+ * With no sandbox executor composed in, a sandbox run goes to the native
+ * executor, whose runner refuses to execute it (executeRun fails it before
+ * any spend, closing its host check and status comments): fail closed through
+ * the one path that already finishes a run properly, never a silent run in
+ * the control plane.
+ */
 export class RoutingExecutor {
     resolver;
     native;
     coding;
-    constructor(resolver, native, coding) {
+    sandbox;
+    constructor(resolver, native, coding, sandbox) {
         this.resolver = resolver;
         this.native = native;
         this.coding = coding;
+        this.sandbox = sandbox;
+    }
+    async route(runId) {
+        const target = await this.resolver.kindForRun(runId);
+        if (target === "native")
+            return { target, executor: this.native };
+        if (target === "native-sandbox")
+            return { target, executor: this.sandbox ?? this.native };
+        if (target === "coding")
+            return { target, executor: this.coding };
+        return null;
     }
     async start(runId) {
-        const kind = await this.resolver.kindForRun(runId);
-        if (kind === "native")
-            return this.native.start(runId);
-        if (kind === "coding")
-            return this.coding.start(runId);
-        throw new Error("executor_run_not_found");
+        const routed = await this.route(runId);
+        if (!routed)
+            throw new Error("executor_run_not_found");
+        return routed.executor.start(runId);
     }
     async stop(runId, reason) {
-        const kind = await this.resolver.kindForRun(runId);
-        if (kind === "native")
-            return this.native.stop(runId, reason);
-        if (kind === "coding")
-            return this.coding.stop(runId, reason);
+        const routed = await this.route(runId);
+        if (routed)
+            return routed.executor.stop(runId, reason);
     }
     /**
-     * Recovery is routed by the run's agent kind, exactly like start/stop: a
-     * native run's handle belongs to the native executor (e.g. a DBOS
-     * workflow handle), a coding run's to the container executor. Routing by
-     * handle backend would need this class to know every backend name.
+     * Recovery is routed by the run's target, exactly like start/stop: a native
+     * run's handle belongs to the native executor (e.g. a DBOS workflow handle),
+     * a sandbox run's to the sandbox executor, a coding run's to the container
+     * executor. Routing by handle backend would need this class to know every
+     * backend name.
      */
     async recover(handle) {
-        const kind = await this.resolver.kindForRun(handle.runId);
-        if (kind === "native") {
-            if (!this.native.recover)
-                return { state: "lost", reason: "native_recovery_unavailable" };
-            return this.native.recover(handle);
+        const routed = await this.route(handle.runId);
+        const target = routed?.target ?? "coding";
+        const executor = routed?.executor ?? this.coding;
+        if (!executor.recover) {
+            const reason = target === "native"
+                ? "native_recovery_unavailable"
+                : target === "native-sandbox" && this.sandbox
+                    ? "native_sandbox_recovery_unavailable"
+                    : target === "native-sandbox"
+                        ? "native_recovery_unavailable"
+                        : "coding_recovery_unavailable";
+            return { state: "lost", reason };
         }
-        if (!this.coding.recover)
-            return { state: "lost", reason: "coding_recovery_unavailable" };
-        return this.coding.recover(handle);
+        return executor.recover(handle);
+    }
+    /** Each distinct executor once, in a fixed order: native, coding, sandbox. */
+    distinct() {
+        return [this.native, this.coding, this.sandbox].filter((executor, index, all) => executor !== undefined && all.indexOf(executor) === index);
     }
-    /** Lifecycle fans out to both executors; each is optional on the seam. */
+    /** Lifecycle fans out to every distinct executor; each hook is optional on the seam. */
     async launch() {
-        await this.native.launch?.();
-        await this.coding.launch?.();
+        for (const executor of this.distinct())
+            await executor.launch?.();
+    }
+    /** Fans out like `launch`. */
+    async warmUp() {
+        for (const executor of this.distinct())
+            await executor.warmUp?.();
     }
+    /** Reverse of `launch`. */
     async close() {
-        await this.coding.close?.();
-        await this.native.close?.();
+        for (const executor of this.distinct().reverse())
+            await executor.close?.();
     }
     resolveCodingWorkerImage(selector) {
         if (!this.coding.resolveCodingWorkerImage)
@@ -69,6 +102,9 @@ export class RoutingExecutor {
             return null;
         return this.coding.readCodingRepositoryFile(input);
     }
+    supportsNativeSandbox() {
+        return this.sandbox !== undefined;
+    }
     supportsCodingServices(provider) {
         return this.coding.supportsCodingServices?.(provider) === true;
     }
@@ -81,8 +117,13 @@ export class PrismaExecutionKindResolver {
     async kindForRun(runId) {
         const run = await this.db.run.findUnique({
             where: { id: runId },
-            select: { agent: { select: { kind: true } } },
+            select: { nativeExecutionMode: true, agent: { select: { kind: true } } },
         });
-        return run?.agent.kind === "native" || run?.agent.kind === "coding" ? run.agent.kind : null;
+        if (run?.agent.kind === "coding")
+            return "coding";
+        if (run?.agent.kind !== "native")
+            return null;
+        // Null = a run from before the snapshot existed: the control plane, as it always ran.
+        return run.nativeExecutionMode === "sandbox" ? "native-sandbox" : "native";
     }
 }

package/dist/providers/executor/types.d.ts

@@ -43,6 +43,13 @@ export interface Executor {
     launch?: () => Promise<void>;
     /** Optional graceful shutdown counterpart to `launch`. */
     close?: () => Promise<void>;
+    /**
+     * Fire-and-forget start-up warm-up, called only from a long-running server process's own
+     * start-up (`wardby serve`, the MCP server, `wardby scheduler`) — never from a one-shot CLI
+     * command. Delegates to the coding job launcher's own `warmUp` (e.g. Kubernetes's memoized
+     * cluster preflight); never throws.
+     */
+    warmUp?: () => Promise<void>;
     /**
      * Resolves a coding agent's profile selection to an immutable worker
      * image digest, once, at dispatch time (src/core/dispatch.ts) — never
@@ -85,5 +92,10 @@ export interface Executor {
      * says so (Kubernetes and Docker, for Codex and Claude Code).
      */
     supportsCodingServices?(provider: CodingProvider): boolean;
+    /**
+     * Whether this executor can run sandbox-mode native runs (a native sandbox executor is composed
+     * in). MCP refuses to set an agent to sandbox mode where it cannot (docs/native-sandbox.md).
+     */
+    supportsNativeSandbox?(): boolean;
 }
 import type { CodingProvider } from "../../coding/provider.js";

package/dist/providers/jobs/docker.js

@@ -7,7 +7,7 @@ import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { logger } from "../../core/logger.js";
 import { ensurePrivateDirectory } from "../../core/private-directory.js";
 import { readBoundedRegularFile } from "../../coding-worker/artifact.js";
-import { parseCodingAgentOutputJson, redactAndTruncate, MAX_CODING_ARTIFACT_BYTES, MAX_CODING_OUTPUT_ISSUES, SAFE_CODING_OUTPUT_ISSUE, } from "../../coding/protocol.js";
+import { parseCodingAgentOutputJson, redactAndTruncate, MAX_CODING_ARTIFACT_BYTES, MAX_CODING_INPUT_BYTES, MAX_CODING_OUTPUT_ISSUES, SAFE_CODING_OUTPUT_ISSUE, } from "../../coding/protocol.js";
 import { assertDockerHostSupportsIsolation, assertClaudeAgentContainerInspection, assertClaudeToolRunnerContainerInspection, assertIsolationNetworkInspection, assertKeeperContainerInspection, assertNetworkKeeperContainerInspection, assertProxyContainerInspection, assertStorageVolumeInspection, assertWorkerContainerInspection, buildDockerIsolationPlan, CLAUDE_TOOL_SETUP_ENV, dockerSupportsServicesFor, } from "./docker-isolation.js";
 import { serviceUnreadyError } from "../../coding/services/wording.js";
 import { assertServiceContainerInspection, buildDockerServicePlan, dockerServiceContainerNames, } from "./docker-services.js";
@@ -272,7 +272,7 @@ export class NodeDockerArtifactTransfer {
     }
     async seedInput(sourceFile, container) {
         const metadata = await lstat(sourceFile);
-        if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > MAX_CODING_ARTIFACT_BYTES) {
+        if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > MAX_CODING_INPUT_BYTES) {
             throw new Error("docker_input_artifact_invalid");
         }
         const docker = new NodeDockerCommandRunner({
@@ -1174,7 +1174,7 @@ export class DockerJobLauncher {
     }
     async validateInputArtifact(path) {
         const metadata = await lstat(path);
-        if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > MAX_CODING_ARTIFACT_BYTES) {
+        if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > MAX_CODING_INPUT_BYTES) {
             throw new Error("docker_input_artifact_invalid");
         }
     }