@wardby/cli 0.5.3 → 0.7.0

package/dist/providers/executor/linked-issue-reader.js

@@ -0,0 +1,30 @@
+/** A tracker read for a continuation's task must not hold up its launch. */
+const TRACKER_READ_TIMEOUT_MS = 10_000;
+/**
+ * The executor's readLinkedIssue: a GitHub issue through the review host's
+ * issue read (the App's installation token for the run's repository), a Jira
+ * issue through the configured tracker. Null when the number is a pull
+ * request, the issue is missing, or no host or tracker is configured.
+ */
+export function linkedIssueReader(deps) {
+    return async (ref) => {
+        if (ref.provider === "github") {
+            const host = deps.hosts.github;
+            if (!host?.readIssue)
+                return null;
+            // Title and body only: the task carries the ticket, not its discussion.
+            const result = await host.readIssue(ref.repository, ref.number, { comments: false });
+            return result.kind === "issue" ? { title: result.title, body: result.body } : null;
+        }
+        const tracker = deps.issueTrackers.jira;
+        if (!tracker)
+            return null;
+        const view = await tracker.getIssue(ref.key, {
+            maxComments: 0,
+            agentMarker: "",
+            timeoutMs: TRACKER_READ_TIMEOUT_MS,
+            retryOn429: false,
+        });
+        return { title: view.summary, body: view.description };
+    };
+}

package/dist/providers/executor/routing.d.ts

@@ -1,25 +1,51 @@
-import type { CodingImageSelector, Executor, ExecutionRecoveryResult, PersistedExecutionHandle } from "./types.js";
 import type { CodingProvider } from "../../coding/provider.js";
+import type { CodingImageSelector, Executor, ExecutionRecoveryResult, PersistedExecutionHandle } from "./types.js";
+/**
+ * Which executor owns a run: a coding run, a native run in the control plane
+ * (in-process or DBOS), or a native run in an isolated sandbox worker. Read
+ * from the run's own row (agent kind plus Run.nativeExecutionMode), never from
+ * the agent's current setting, so a setting change reaches only later runs.
+ */
+export type ExecutionTarget = "native" | "native-sandbox" | "coding";
 export interface ExecutionKindResolver {
-    kindForRun(runId: string): Promise<"native" | "coding" | null>;
+    kindForRun(runId: string): Promise<ExecutionTarget | null>;
 }
-/** Keeps native execution unchanged while routing coding runs to isolation. */
+/**
+ * Keeps native execution unchanged while routing coding runs to isolation and
+ * sandbox-mode native runs to the native sandbox executor.
+ *
+ * With no sandbox executor composed in, a sandbox run goes to the native
+ * executor, whose runner refuses to execute it (executeRun fails it before
+ * any spend, closing its host check and status comments): fail closed through
+ * the one path that already finishes a run properly, never a silent run in
+ * the control plane.
+ */
 export declare class RoutingExecutor implements Executor {
     private readonly resolver;
     private readonly native;
     private readonly coding;
-    constructor(resolver: ExecutionKindResolver, native: Executor, coding: Executor);
+    private readonly sandbox?;
+    constructor(resolver: ExecutionKindResolver, native: Executor, coding: Executor, sandbox?: Executor | undefined);
+    private route;
     start(runId: string): Promise<void>;
     stop(runId: string, reason?: string): Promise<void>;
     /**
-     * Recovery is routed by the run's agent kind, exactly like start/stop: a
-     * native run's handle belongs to the native executor (e.g. a DBOS
-     * workflow handle), a coding run's to the container executor. Routing by
-     * handle backend would need this class to know every backend name.
+     * Recovery is routed by the run's target, exactly like start/stop: a native
+     * run's handle belongs to the native executor (e.g. a DBOS workflow handle),
+     * a sandbox run's to the sandbox executor, a coding run's to the container
+     * executor. Routing by handle backend would need this class to know every
+     * backend name.
      */
     recover(handle: PersistedExecutionHandle): Promise<ExecutionRecoveryResult>;
-    /** Lifecycle fans out to both executors; each is optional on the seam. */
+    /** Only coding runs wait in the coding queue, so only the coding executor is asked. */
+    cleanupQueueTimeout(runId: string): Promise<void>;
+    /** Each distinct executor once, in a fixed order: native, coding, sandbox. */
+    private distinct;
+    /** Lifecycle fans out to every distinct executor; each hook is optional on the seam. */
     launch(): Promise<void>;
+    /** Fans out like `launch`. */
+    warmUp(): Promise<void>;
+    /** Reverse of `launch`. */
     close(): Promise<void>;
     resolveCodingWorkerImage(selector: CodingImageSelector): string;
     resolveCodingToolImage(selector: CodingImageSelector): string | null;
@@ -33,6 +59,7 @@ export declare class RoutingExecutor implements Executor {
         path: string;
         maxBytes: number;
     }): Promise<string | null>;
+    supportsNativeSandbox(): boolean;
     supportsCodingServices(provider: CodingProvider): boolean;
 }
 export declare class PrismaExecutionKindResolver implements ExecutionKindResolver {
@@ -44,6 +71,7 @@ export declare class PrismaExecutionKindResolver implements ExecutionKindResolve
                     id: string;
                 };
                 select: {
+                    nativeExecutionMode: true;
                     agent: {
                         select: {
                             kind: true;
@@ -51,11 +79,12 @@ export declare class PrismaExecutionKindResolver implements ExecutionKindResolve
                     };
                 };
             }): Promise<{
+                nativeExecutionMode: string | null;
                 agent: {
                     kind: string;
                 };
             } | null>;
         };
     });
-    kindForRun(runId: string): Promise<"native" | "coding" | null>;
+    kindForRun(runId: string): Promise<ExecutionTarget | null>;
 }

package/dist/providers/executor/routing.js

@@ -1,53 +1,90 @@
-/** Keeps native execution unchanged while routing coding runs to isolation. */
+/**
+ * Keeps native execution unchanged while routing coding runs to isolation and
+ * sandbox-mode native runs to the native sandbox executor.
+ *
+ * With no sandbox executor composed in, a sandbox run goes to the native
+ * executor, whose runner refuses to execute it (executeRun fails it before
+ * any spend, closing its host check and status comments): fail closed through
+ * the one path that already finishes a run properly, never a silent run in
+ * the control plane.
+ */
 export class RoutingExecutor {
     resolver;
     native;
     coding;
-    constructor(resolver, native, coding) {
+    sandbox;
+    constructor(resolver, native, coding, sandbox) {
         this.resolver = resolver;
         this.native = native;
         this.coding = coding;
+        this.sandbox = sandbox;
+    }
+    async route(runId) {
+        const target = await this.resolver.kindForRun(runId);
+        if (target === "native")
+            return { target, executor: this.native };
+        if (target === "native-sandbox")
+            return { target, executor: this.sandbox ?? this.native };
+        if (target === "coding")
+            return { target, executor: this.coding };
+        return null;
     }
     async start(runId) {
-        const kind = await this.resolver.kindForRun(runId);
-        if (kind === "native")
-            return this.native.start(runId);
-        if (kind === "coding")
-            return this.coding.start(runId);
-        throw new Error("executor_run_not_found");
+        const routed = await this.route(runId);
+        if (!routed)
+            throw new Error("executor_run_not_found");
+        return routed.executor.start(runId);
     }
     async stop(runId, reason) {
-        const kind = await this.resolver.kindForRun(runId);
-        if (kind === "native")
-            return this.native.stop(runId, reason);
-        if (kind === "coding")
-            return this.coding.stop(runId, reason);
+        const routed = await this.route(runId);
+        if (routed)
+            return routed.executor.stop(runId, reason);
     }
     /**
-     * Recovery is routed by the run's agent kind, exactly like start/stop: a
-     * native run's handle belongs to the native executor (e.g. a DBOS
-     * workflow handle), a coding run's to the container executor. Routing by
-     * handle backend would need this class to know every backend name.
+     * Recovery is routed by the run's target, exactly like start/stop: a native
+     * run's handle belongs to the native executor (e.g. a DBOS workflow handle),
+     * a sandbox run's to the sandbox executor, a coding run's to the container
+     * executor. Routing by handle backend would need this class to know every
+     * backend name.
      */
     async recover(handle) {
-        const kind = await this.resolver.kindForRun(handle.runId);
-        if (kind === "native") {
-            if (!this.native.recover)
-                return { state: "lost", reason: "native_recovery_unavailable" };
-            return this.native.recover(handle);
+        const routed = await this.route(handle.runId);
+        const target = routed?.target ?? "coding";
+        const executor = routed?.executor ?? this.coding;
+        if (!executor.recover) {
+            const reason = target === "native"
+                ? "native_recovery_unavailable"
+                : target === "native-sandbox" && this.sandbox
+                    ? "native_sandbox_recovery_unavailable"
+                    : target === "native-sandbox"
+                        ? "native_recovery_unavailable"
+                        : "coding_recovery_unavailable";
+            return { state: "lost", reason };
         }
-        if (!this.coding.recover)
-            return { state: "lost", reason: "coding_recovery_unavailable" };
-        return this.coding.recover(handle);
+        return executor.recover(handle);
+    }
+    /** Only coding runs wait in the coding queue, so only the coding executor is asked. */
+    async cleanupQueueTimeout(runId) {
+        await this.coding.cleanupQueueTimeout?.(runId);
+    }
+    /** Each distinct executor once, in a fixed order: native, coding, sandbox. */
+    distinct() {
+        return [this.native, this.coding, this.sandbox].filter((executor, index, all) => executor !== undefined && all.indexOf(executor) === index);
     }
-    /** Lifecycle fans out to both executors; each is optional on the seam. */
+    /** Lifecycle fans out to every distinct executor; each hook is optional on the seam. */
     async launch() {
-        await this.native.launch?.();
-        await this.coding.launch?.();
+        for (const executor of this.distinct())
+            await executor.launch?.();
     }
+    /** Fans out like `launch`. */
+    async warmUp() {
+        for (const executor of this.distinct())
+            await executor.warmUp?.();
+    }
+    /** Reverse of `launch`. */
     async close() {
-        await this.coding.close?.();
-        await this.native.close?.();
+        for (const executor of this.distinct().reverse())
+            await executor.close?.();
     }
     resolveCodingWorkerImage(selector) {
         if (!this.coding.resolveCodingWorkerImage)
@@ -69,6 +106,9 @@ export class RoutingExecutor {
             return null;
         return this.coding.readCodingRepositoryFile(input);
     }
+    supportsNativeSandbox() {
+        return this.sandbox !== undefined;
+    }
     supportsCodingServices(provider) {
         return this.coding.supportsCodingServices?.(provider) === true;
     }
@@ -81,8 +121,13 @@ export class PrismaExecutionKindResolver {
     async kindForRun(runId) {
         const run = await this.db.run.findUnique({
             where: { id: runId },
-            select: { agent: { select: { kind: true } } },
+            select: { nativeExecutionMode: true, agent: { select: { kind: true } } },
         });
-        return run?.agent.kind === "native" || run?.agent.kind === "coding" ? run.agent.kind : null;
+        if (run?.agent.kind === "coding")
+            return "coding";
+        if (run?.agent.kind !== "native")
+            return null;
+        // Null = a run from before the snapshot existed: the control plane, as it always ran.
+        return run.nativeExecutionMode === "sandbox" ? "native-sandbox" : "native";
     }
 }

package/dist/providers/executor/types.d.ts

@@ -35,6 +35,14 @@ export interface Executor {
      * terminal Run persistence completed. Recovery must never relaunch a job.
      */
     recover?: (handle: PersistedExecutionHandle) => Promise<ExecutionRecoveryResult>;
+    /**
+     * Called by drainCodingQueue for each queued coding run it failed with coding_queue_timeout, after
+     * that write: releases what an earlier attempt of the run left (a launch the backend refused for
+     * capacity), such as a continuation's in-progress host signal and its input artifact. Best effort;
+     * a throw is logged by the caller. Optional: an executor that never leaves a queued run anything
+     * to release omits it.
+     */
+    cleanupQueueTimeout?: (runId: string) => Promise<void>;
     /**
      * Optional one-time startup. A durable backend connects and re-drives the
      * workflows it owned before the last restart. Composition roots call it
@@ -43,6 +51,13 @@ export interface Executor {
     launch?: () => Promise<void>;
     /** Optional graceful shutdown counterpart to `launch`. */
     close?: () => Promise<void>;
+    /**
+     * Fire-and-forget start-up warm-up, called only from a long-running server process's own
+     * start-up (`wardby serve`, the MCP server, `wardby scheduler`) — never from a one-shot CLI
+     * command. Delegates to the coding job launcher's own `warmUp` (e.g. Kubernetes's memoized
+     * cluster preflight); never throws.
+     */
+    warmUp?: () => Promise<void>;
     /**
      * Resolves a coding agent's profile selection to an immutable worker
      * image digest, once, at dispatch time (src/core/dispatch.ts) — never
@@ -85,5 +100,15 @@ export interface Executor {
      * says so (Kubernetes and Docker, for Codex and Claude Code).
      */
     supportsCodingServices?(provider: CodingProvider): boolean;
+    /**
+     * Whether this executor can run sandbox-mode native runs (a native sandbox executor is composed
+     * in). MCP refuses to set an agent to sandbox mode where it cannot (docs/native-sandbox.md).
+     */
+    supportsNativeSandbox?(): boolean;
+    /**
+     * true: this executor cannot resolve coding inputs; dispatch records the coding run unresolved
+     * and the process that starts it resolves them (resolveDeferredCodingRun).
+     */
+    defersCodingResolution?: boolean;
 }
 import type { CodingProvider } from "../../coding/provider.js";

package/dist/providers/index.d.ts

@@ -34,7 +34,8 @@ export interface ProviderRegistry {
     llm: LlmProvider;
     secrets: SecretCipher;
     auth: AuthProvider;
-    storage: BlobStore;
+    /** Absent unless BLOB_STORE is configured. */
+    storage?: BlobStore;
     executor: Executor;
     datastore: Datastore;
     memory: AgentMemoryStore;

package/dist/providers/issue-tracker/types.d.ts

@@ -264,6 +264,23 @@ export interface IssueEvent {
 }
 /** Shared by the ingress and the tools: a Jira issue key, e.g. PROJ-123. */
 export declare const ISSUE_KEY: RegExp;
+/** A GitHub issue's recorded key (githubIssueKey): "<owner>/<repo>#<number>", the repository normalised to lowercase. */
+export declare const GITHUB_ISSUE_KEY: RegExp;
+/** The product name of each system an issue can be recorded from (CodingRun / IssuePullRequest issueProvider). */
+export declare const ISSUE_SOURCE_NAMES: Readonly<Record<string, string>>;
+/**
+ * A recorded issue (CodingRun / IssuePullRequest issueProvider + issueKey) as
+ * people see it: the key re-validated for its provider, the system's name and
+ * the issue's page. A GitHub issue's page comes from its key; a tracker
+ * issue's from `trackerUrl` (the tracker's issueUrl), dropped when it throws
+ * or is not https. Undefined for an unknown provider or a malformed key.
+ */
+export declare function issueReference(provider: string, key: string, trackerUrl?: (key: string) => string | undefined): {
+    key: string;
+    url?: string;
+    trackerName: string;
+} | undefined;
 /** A Jira project key. */
 export declare const PROJECT_KEY: RegExp;
+/** An issue key's project: a Jira key's project key ("PROJ-123" → "PROJ"); a GitHub issue key's repository ("owner/repo#5" → "owner/repo"). */
 export declare const projectOf: (issueKey: string) => string;

package/dist/providers/issue-tracker/types.js

@@ -11,6 +11,44 @@ export class IssueTrackerError extends Error {
 }
 /** Shared by the ingress and the tools: a Jira issue key, e.g. PROJ-123. */
 export const ISSUE_KEY = /^[A-Z][A-Z0-9_]{0,254}-[1-9]\d{0,9}$/;
+/** A GitHub issue's recorded key (githubIssueKey): "<owner>/<repo>#<number>", the repository normalised to lowercase. */
+export const GITHUB_ISSUE_KEY = /^[a-z0-9](?:[a-z0-9-]{0,37}[a-z0-9])?\/[a-z0-9._-]{1,100}#[1-9]\d{0,9}$/;
+/** The product name of each system an issue can be recorded from (CodingRun / IssuePullRequest issueProvider). */
+export const ISSUE_SOURCE_NAMES = { ...ISSUE_TRACKER_NAMES, github: "GitHub" };
+/**
+ * A recorded issue (CodingRun / IssuePullRequest issueProvider + issueKey) as
+ * people see it: the key re-validated for its provider, the system's name and
+ * the issue's page. A GitHub issue's page comes from its key; a tracker
+ * issue's from `trackerUrl` (the tracker's issueUrl), dropped when it throws
+ * or is not https. Undefined for an unknown provider or a malformed key.
+ */
+export function issueReference(provider, key, trackerUrl) {
+    let url;
+    if (provider === "github") {
+        if (!GITHUB_ISSUE_KEY.test(key))
+            return undefined;
+        const hash = key.lastIndexOf("#");
+        url = `https://github.com/${key.slice(0, hash)}/issues/${key.slice(hash + 1)}`;
+    }
+    else if (provider === "jira") {
+        if (!ISSUE_KEY.test(key))
+            return undefined;
+        try {
+            url = trackerUrl?.(key);
+        }
+        catch {
+            url = undefined;
+        }
+    }
+    else {
+        return undefined;
+    }
+    return { key, ...(url?.startsWith("https://") ? { url } : {}), trackerName: ISSUE_SOURCE_NAMES[provider] };
+}
 /** A Jira project key. */
 export const PROJECT_KEY = /^[A-Z][A-Z0-9_]{0,254}$/;
-export const projectOf = (issueKey) => issueKey.slice(0, issueKey.lastIndexOf("-"));
+/** An issue key's project: a Jira key's project key ("PROJ-123" → "PROJ"); a GitHub issue key's repository ("owner/repo#5" → "owner/repo"). */
+export const projectOf = (issueKey) => {
+    const hash = issueKey.lastIndexOf("#");
+    return issueKey.slice(0, hash >= 0 ? hash : issueKey.lastIndexOf("-"));
+};

package/dist/providers/jobs/claude-tool-setup.d.ts

@@ -19,5 +19,9 @@ export interface ClaudeToolSetup {
         content: string;
         mode: number;
     }[];
+    /** Present only when the run's dependency cache is on, so older tool runners see an unchanged setup. */
+    dependencyCache?: true;
+    /** With dependencyCache only: the workspace volume size (limits.diskMb) the cache must stay inside. */
+    diskMb?: number;
 }
 export declare function claudeToolSetup(spec: JobSpec, capability: string): string;

package/dist/providers/jobs/claude-tool-setup.js

@@ -2,8 +2,10 @@
  * What Claude Code's tool runner (the credential-free container that runs commands in the
  * repository) needs from the trusted launcher: the package-registry settings every Codex shell
  * gets, built from the run's registry-only token (deriveRegistryToken, never the capability), and
- * the run's service test variables. Delivered as CLAUDE_TOOL_SETUP_ENV: a Kubernetes Secret key, or
- * `docker create --env NAME` with the value in the CLI's own environment.
+ * the run's service test variables, and whether the run's dependency cache is on. Delivered as the
+ * WARDBY_TOOL_SETUP environment variable (CLAUDE_TOOL_SETUP_ENV, docker-isolation.ts; a test keeps it
+ * equal to the tool runner's TOOL_SETUP_ENV): a Kubernetes Secret key, or `docker create --env NAME`
+ * with the value in the CLI's own environment.
  */
 import { serviceEnvironment } from "../../coding-worker/driver.js";
 import { registryWorkerSetup } from "../../coding/registry/worker-config.js";
@@ -35,6 +37,7 @@ export function claudeToolSetup(spec, capability) {
         // Same precedence as the Codex driver: the registry's own settings win over a service's.
         env: { ...serviceEnvironment(spec.services), ...registry.env },
         files: registry.files,
+        ...(spec.dependencyCache ? { dependencyCache: true, diskMb: spec.limits.diskMb } : {}),
     };
     const raw = JSON.stringify(setup);
     const limits = CLAUDE_TOOL_SETUP_LIMITS;

package/dist/providers/jobs/docker-isolation.d.ts

@@ -25,6 +25,14 @@ export declare const CLAUDE_TOOL_SETUP_ENV = "WARDBY_TOOL_SETUP";
 export declare const CODING_PROXY_DENY_PORT = 8788;
 export declare const DOCKER_ISOLATION_ERROR = "docker_isolation_unsupported";
 export declare const WORKER_STOP_GRACE_SECONDS = 10;
+/** The Claude worker's SDK config dir (claude-coding-worker/driver.ts CLAUDE_CONFIG_DIR). */
+export declare const CLAUDE_CONFIG_PATH = "/tmp/claude-config";
+/**
+ * Its own memory-backed scratch on a session-resume run: room for a session file up to the largest the
+ * control plane reads (coding/protocol.ts MAX_RAW_TRANSCRIPT_BYTES, 64 MiB) plus the SDK's small config
+ * files. Past it the SDK's writes there fail with ENOSPC, as /tmp's would; /tmp itself keeps its room.
+ */
+export declare const CLAUDE_CONFIG_SCRATCH_MIB = 80;
 export declare const WORKER_PATHS: {
     readonly workspace: "/workspace";
     readonly git: "/workspace/.git";

package/dist/providers/jobs/docker-isolation.js

@@ -28,6 +28,14 @@ export const CLAUDE_TOOL_SETUP_ENV = "WARDBY_TOOL_SETUP";
 export const CODING_PROXY_DENY_PORT = 8788;
 export const DOCKER_ISOLATION_ERROR = "docker_isolation_unsupported";
 export const WORKER_STOP_GRACE_SECONDS = 10;
+/** The Claude worker's SDK config dir (claude-coding-worker/driver.ts CLAUDE_CONFIG_DIR). */
+export const CLAUDE_CONFIG_PATH = "/tmp/claude-config";
+/**
+ * Its own memory-backed scratch on a session-resume run: room for a session file up to the largest the
+ * control plane reads (coding/protocol.ts MAX_RAW_TRANSCRIPT_BYTES, 64 MiB) plus the SDK's small config
+ * files. Past it the SDK's writes there fail with ENOSPC, as /tmp's would; /tmp itself keeps its room.
+ */
+export const CLAUDE_CONFIG_SCRATCH_MIB = 80;
 export const WORKER_PATHS = {
     workspace: "/workspace",
     git: "/workspace/.git",
@@ -90,6 +98,9 @@ function validateSpec(spec) {
     else if (spec.toolImage !== undefined) {
         throw isolationError();
     }
+    if (spec.sessionResume !== undefined && (spec.sessionResume !== true || spec.provider !== "claude-code")) {
+        throw isolationError();
+    }
     if (spec.services !== undefined) {
         // docker-services.ts re-validates every entry against the catalog schema. Both providers' shells
         // share the network keeper's namespace: Codex's worker, and Claude Code's tool runner.
@@ -432,6 +443,12 @@ export function buildClaudeAgentCreateArgs(spec, proxyPort = CODING_PROXY_PORT)
         `/tmp:rw,noexec,nosuid,nodev,size=${scratchMb}m,mode=1777`,
         "--tmpfs",
         `/home/wardby:rw,noexec,nosuid,nodev,size=${scratchMb}m,uid=${CODING_WORKER_UID},gid=${CODING_WORKER_GID},mode=0700`,
+        ...(spec.sessionResume
+            ? [
+                "--tmpfs",
+                `${CLAUDE_CONFIG_PATH}:rw,noexec,nosuid,nodev,size=${CLAUDE_CONFIG_SCRATCH_MIB}m,uid=${CODING_WORKER_UID},gid=${CODING_WORKER_GID},mode=0700`,
+            ]
+            : []),
         "--mount",
         `type=volume,src=${names.storageVolume},dst=${WORKER_PATHS.input},volume-subpath=input,volume-nocopy,readonly`,
         "--mount",

package/dist/providers/jobs/docker.d.ts

@@ -164,6 +164,7 @@ export declare class DockerJobLauncher implements WorkspaceJobLauncher {
     private removeNetworkIfAttested;
     private removeVolumeIfAttested;
     private seedRun;
+    readTranscript(handle: JobHandle, maxBytes: number): Promise<string | undefined>;
     private readResultArtifact;
     private readWorkerFailureDiagnostic;
     private keeperName;

package/dist/providers/jobs/docker.js

@@ -7,7 +7,7 @@ import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { logger } from "../../core/logger.js";
 import { ensurePrivateDirectory } from "../../core/private-directory.js";
 import { readBoundedRegularFile } from "../../coding-worker/artifact.js";
-import { parseCodingAgentOutputJson, redactAndTruncate, MAX_CODING_ARTIFACT_BYTES, MAX_CODING_OUTPUT_ISSUES, SAFE_CODING_OUTPUT_ISSUE, } from "../../coding/protocol.js";
+import { parseCodingWorkerOutputJson, redactAndTruncate, MAX_CODING_ARTIFACT_BYTES, MAX_CODING_INPUT_BYTES, MAX_CODING_OUTPUT_ISSUES, SAFE_CODING_OUTPUT_ISSUE, } from "../../coding/protocol.js";
 import { assertDockerHostSupportsIsolation, assertClaudeAgentContainerInspection, assertClaudeToolRunnerContainerInspection, assertIsolationNetworkInspection, assertKeeperContainerInspection, assertNetworkKeeperContainerInspection, assertProxyContainerInspection, assertStorageVolumeInspection, assertWorkerContainerInspection, buildDockerIsolationPlan, CLAUDE_TOOL_SETUP_ENV, dockerSupportsServicesFor, } from "./docker-isolation.js";
 import { serviceUnreadyError } from "../../coding/services/wording.js";
 import { assertServiceContainerInspection, buildDockerServicePlan, dockerServiceContainerNames, } from "./docker-services.js";
@@ -272,7 +272,7 @@ export class NodeDockerArtifactTransfer {
     }
     async seedInput(sourceFile, container) {
         const metadata = await lstat(sourceFile);
-        if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > MAX_CODING_ARTIFACT_BYTES) {
+        if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > MAX_CODING_INPUT_BYTES) {
             throw new Error("docker_input_artifact_invalid");
         }
         const docker = new NodeDockerCommandRunner({
@@ -1067,13 +1067,38 @@ export class DockerJobLauncher {
         await this.transfer.seedDirectory(resolve(runRoot, "git"), keeper, "/run/wardby/storage/git");
         await this.transfer.seedInput(record.spec.inputArtifact, keeper);
     }
+    async readTranscript(handle, maxBytes) {
+        await this.ready;
+        const record = await this.findRecord(handle);
+        if (!record)
+            return undefined;
+        const staging = await mkdtemp(join(this.stateRoot, ".wardby-transcript-"));
+        const target = join(staging, "session.jsonl");
+        try {
+            try {
+                await this.run([
+                    "container",
+                    "cp",
+                    `${this.keeperName(record)}:/run/wardby/storage/output/session.jsonl`,
+                    target,
+                ]);
+            }
+            catch {
+                return undefined;
+            }
+            return await readBoundedRegularFile(target, maxBytes, "transcript_too_large");
+        }
+        finally {
+            await rm(staging, { recursive: true, force: true });
+        }
+    }
     async readResultArtifact(record) {
         const staging = await mkdtemp(join(this.stateRoot, ".wardby-result-"));
         const target = join(staging, "result.json");
         try {
             await this.run(["container", "cp", `${this.keeperName(record)}:/run/wardby/storage/output/result.json`, target]);
             const raw = await readBoundedRegularFile(target, MAX_CODING_ARTIFACT_BYTES, "docker_result_artifact_invalid");
-            const output = parseCodingAgentOutputJson(raw);
+            const output = parseCodingWorkerOutputJson(raw);
             if (output.runId !== record.runId)
                 throw new Error("docker_result_run_mismatch");
             return JSON.stringify(output);
@@ -1174,7 +1199,7 @@ export class DockerJobLauncher {
     }
     async validateInputArtifact(path) {
         const metadata = await lstat(path);
-        if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > MAX_CODING_ARTIFACT_BYTES) {
+        if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > MAX_CODING_INPUT_BYTES) {
             throw new Error("docker_input_artifact_invalid");
         }
     }

package/dist/providers/jobs/fake-kubernetes-api.d.ts

@@ -1,4 +1,4 @@
-import type { V1ConfigMap, V1Endpoints, V1NetworkPolicy, V1Pod, V1ResourceQuota, V1Secret, V1Service } from "@kubernetes/client-node";
+import type { V1ConfigMap, V1Deployment, V1Endpoints, V1NetworkPolicy, V1Pod, V1ResourceQuota, V1Secret, V1Service } from "@kubernetes/client-node";
 import type { Readable, Writable } from "node:stream";
 import { type KubernetesApi, type KubernetesExecOptions } from "./kubernetes-api.js";
 export interface FakeExecCall {
@@ -10,7 +10,7 @@ export interface FakeExecCall {
     stdout?: Writable;
     timeoutMs: number;
 }
-type Kind = "configmap" | "secret" | "pod" | "networkpolicy" | "service" | "endpoints" | "resourcequota";
+type Kind = "configmap" | "secret" | "pod" | "networkpolicy" | "service" | "endpoints" | "resourcequota" | "deployment";
 type Obj = {
     metadata?: {
         name?: string;
@@ -31,6 +31,19 @@ export declare class FakeKubernetesApi implements KubernetesApi {
     onExec: (call: FakeExecCall) => Promise<number>;
     /** The admission chain a dry-run create runs through. Default: echo the pod back unchanged. */
     onDryRunCreatePod: (namespace: string, body: V1Pod) => Promise<V1Pod>;
+    /** Runs at the start of every pod create; tests throw KubernetesQuotaExceededError (or anything) from it. */
+    onCreatePod: (namespace: string, body: V1Pod) => Promise<void>;
+    readonly deploymentPatches: Array<{
+        name: string;
+        replicas?: number;
+        annotations?: Record<string, string>;
+    }>;
+    /** Deployment names whose patch throws KubernetesForbiddenError. */
+    forbidden: Set<string>;
+    /** "deployment/<name>" or "endpoints/<name>" keys whose read throws KubernetesForbiddenError. */
+    forbiddenReads: Set<string>;
+    /** "verb/resource/name" keys canI answers false for. */
+    accessDenied: Set<string>;
     logs: Map<string, string>;
     /** What readApiServerVersion reports; tests that care about provenance set it. */
     apiServerVersion: string;
@@ -85,6 +98,8 @@ export declare class FakeKubernetesApi implements KubernetesApi {
      */
     dryRunCreatePod(namespace: string, body: V1Pod): Promise<V1Pod>;
     readPod(namespace: string, name: string): Promise<V1Pod | undefined>;
+    /** Matches `key=value[,key=value]` selectors against stored pods' labels. */
+    listPods(namespace: string, labelSelector: string): Promise<V1Pod[]>;
     deletePod(namespace: string, name: string, gracePeriodSeconds: number): Promise<void>;
     createNetworkPolicy(namespace: string, body: V1NetworkPolicy): Promise<V1NetworkPolicy>;
     readNetworkPolicy(namespace: string, name: string): Promise<V1NetworkPolicy | undefined>;
@@ -92,6 +107,12 @@ export declare class FakeKubernetesApi implements KubernetesApi {
     readService(namespace: string, name: string): Promise<V1Service | undefined>;
     readEndpoints(namespace: string, name: string): Promise<V1Endpoints | undefined>;
     readResourceQuota(namespace: string, name: string): Promise<V1ResourceQuota | undefined>;
+    readDeployment(namespace: string, name: string): Promise<V1Deployment | undefined>;
+    patchDeployment(namespace: string, name: string, patch: {
+        replicas?: number;
+        annotations?: Record<string, string>;
+    }): Promise<void>;
+    canI(_namespace: string, verb: string, _group: string, resource: string, name: string): Promise<boolean>;
     readApiServerVersion(): Promise<string>;
     readNamespace(name: string): Promise<boolean>;
     exec(namespace: string, pod: string, container: string, command: string[], options: KubernetesExecOptions): Promise<number>;