@wardby/cli 0.6.0 → 0.8.0

package/dist/providers/coding-proxy/types.d.ts

@@ -1,5 +1,7 @@
 import { type CatalogEntry } from "../llm/catalog-types.js";
 import type { ModelPricing } from "../llm/pricing-core.js";
+import type { ProxyRefusalDetails } from "../../core/budget-events.js";
+import type { McpToolPin } from "../../core/mcp-tools.js";
 export type ProxySessionStatus = "active" | "cancelled";
 export type ProxyRequestStatus = "reserved" | "completed" | "released" | "uncertain";
 export type ProxyProtocol = "openai-responses" | "anthropic-messages";
@@ -39,10 +41,18 @@ export interface ProxySession {
     registryTokenHash?: string | null;
     /** When the ledger first refused a request of this session for budget. */
     budgetExhaustedAt?: Date | null;
+    /** The numbers behind the first budget refusal, set with budgetExhaustedAt. */
+    budgetRefusal?: ProxyRefusalRecord | null;
     /** The code of the first upstream failure the proxy relayed for this session. */
     upstreamFailure?: string | null;
     /** The run's catalog entry, copied at session creation; null on sessions from before the catalog. */
     terms?: ProxyModelTerms | null;
+    /** The run's pinned MCP tools (no URLs or secrets); null when the run has none, and on older sessions. */
+    mcpTools: McpToolPin[] | null;
+    /** SHA-256 (base64url) of the run's MCP token; null when the run has no MCP tools. */
+    mcpTokenHash: string | null;
+    /** The run's MCP tools/call count so far. */
+    mcpCallCount: number;
 }
 export interface ProxyRequest {
     id: string;
@@ -56,6 +66,24 @@ export interface ProxyRequest {
     pricing: PricingSnapshot;
     usage?: ProxyUsage;
     upstreamStatus?: number;
+    /** An uncertain request settled at an estimate: actualCostUsd and usage are estimated, not reported. */
+    costEstimated?: boolean;
+    requestBytes?: number;
+    ceilingUsd?: number;
+    reservationBasis?: ReservationBasis;
+    conversationKey?: string | null;
+}
+export type ReservationBasis = "cached" | "full";
+/** The latest finished (completed or uncertain) request of a conversation, for the next request's hold. */
+export interface PreviousReply {
+    model: string;
+    status: "completed" | "uncertain";
+    costEstimated: boolean;
+    usage?: ProxyUsage;
+    /** UTF-8 bytes of the request body the proxy forwarded; null on rows from before cache-aware holds. */
+    requestBytes: number | null;
+    /** When the previous request was reserved: the prompt cache was last refreshed around then. */
+    startedAt: Date;
 }
 export interface CreateProxySessionInput {
     id: string;
@@ -68,6 +96,10 @@ export interface CreateProxySessionInput {
     budgetUsd: number;
     registryTokenHash: string;
     terms?: ProxyModelTerms;
+    /** The run's pinned MCP tools; set together with mcpTokenHash, and only when there is at least one. */
+    mcpTools?: McpToolPin[];
+    /** SHA-256 (base64url) of the run's MCP token (mcpTokenHash in src/coding/mcp-token.ts). */
+    mcpTokenHash?: string;
 }
 export interface ReserveProxyRequestInput {
     id: string;
@@ -78,7 +110,13 @@ export interface ReserveProxyRequestInput {
     reservationUsd: number;
     pricing: PricingSnapshot;
     now: Date;
+    requestBytes?: number;
+    ceilingUsd?: number;
+    reservationBasis?: ReservationBasis;
+    conversationKey?: string | null;
 }
+/** What the proxy knows about a refusal: the numbers only; names and the binding limit are the control plane's. */
+export type ProxyRefusalRecord = Omit<ProxyRefusalDetails, "agentBudgetUsd" | "groupName" | "leadAgentName">;
 export type ReserveProxyRequestResult = {
     outcome: "reserved";
     request: ProxyRequest;
@@ -87,6 +125,7 @@ export type ReserveProxyRequestResult = {
     request: ProxyRequest;
 } | {
     outcome: "budget_exhausted";
+    details: Omit<ProxyRefusalRecord, "source">;
 } | {
     outcome: "inactive";
     reason: "cancelled" | "expired";
@@ -94,13 +133,33 @@ export type ReserveProxyRequestResult = {
 export interface ProxyLedger {
     createSession(input: CreateProxySessionInput): Promise<void>;
     findSessionByCapabilityHash(capabilityHash: string): Promise<ProxySession | null>;
+    /** The session whose MCP token hashes to this; any status (the caller checks it is active and in time). */
+    findSessionByMcpTokenHash(mcpTokenHash: string): Promise<ProxySession | undefined>;
     reserve(input: ReserveProxyRequestInput): Promise<ReserveProxyRequestResult>;
     complete(requestId: string, usage: ProxyUsage, actualCostUsd: number, upstreamStatus: number): Promise<ProxyRequest>;
     release(requestId: string, upstreamStatus: number): Promise<void>;
-    markUncertain(requestId: string, upstreamStatus?: number): Promise<void>;
+    /**
+     * Marks a reserved request uncertain. With an estimate it is also settled at that cost (and
+     * counts at it, not at its hold); without one it keeps its full hold.
+     */
+    markUncertain(requestId: string, upstreamStatus?: number, estimate?: {
+        usage: ProxyUsage;
+        costUsd: number;
+    }): Promise<void>;
+    /**
+     * What an interrupted reply's output can be estimated from: the median output tokens of the
+     * session's completed replies for this model. Its input comes from previousReply.
+     */
+    settlementHints(sessionId: string, model: string): Promise<{
+        medianOutputTokens?: number;
+    }>;
+    /** The latest completed or uncertain request of a conversation, or null when it has none. */
+    previousReply(sessionId: string, conversationKey: string): Promise<PreviousReply | null>;
     cancelSession(sessionId: string): Promise<void>;
     /** Whether a request of this session was ever refused for budget. */
     budgetExhausted(sessionId: string): Promise<boolean>;
+    /** The numbers behind the session's first budget refusal, if any. */
+    budgetRefusal(sessionId: string): Promise<ProxyRefusalRecord | null>;
     /** Records an upstream failure code on the session; only the first one is kept. */
     recordUpstreamFailure(sessionId: string, code: string): Promise<void>;
     /** The first upstream failure code relayed for this session, if any. */
@@ -115,7 +174,25 @@ export interface ProxyAuditEvent {
     status?: number;
     reason?: string;
     reservationUsd?: number;
+    /** For request.reserved and a budget refusal: the worst-case hold and how the hold was priced. */
+    ceilingUsd?: number;
+    reservationBasis?: ReservationBasis;
+    /** Why the hold fell back to the ceiling (basis "full"). */
+    holdFallback?: string;
+    /** Basis "cached": tokens priced at the cache-read rate, and at the input + cache-write rates. */
+    holdCachedTokens?: number;
+    holdUncachedTokens?: number;
+    /** For response.completed: how much the reply cost above its hold (reason "reservation_exceeded"). */
+    overshootUsd?: number;
+    /** For a budget refusal: the numbers behind it. */
+    budgetUsd?: number;
+    spentUsd?: number;
+    heldReservedUsd?: number;
+    heldUncertainUsd?: number;
+    turn?: number;
     costUsd?: number;
+    /** For request.uncertain: the estimated cost it was settled at, when one could be made. */
+    estimatedCostUsd?: number;
     inputTokens?: number;
     outputTokens?: number;
     cachedInputTokens?: number;

package/dist/providers/datastore/types.d.ts

@@ -15,6 +15,11 @@ export interface DatastoreSetOptions {
      * for values that actually carry PII.
      */
     pii?: boolean;
+    /**
+     * Shared stores only: the agent doing the write, so the secret guard can
+     * check the value against that agent's attached secrets. Never persisted.
+     */
+    writerAgentId?: string;
 }
 export interface Datastore {
     get(agentId: string, key: string): Promise<DatastoreValue | undefined>;

package/dist/providers/engine/types.d.ts

@@ -67,6 +67,21 @@ export declare class RunOwnershipLostError extends Error {
         discardedUsage?: Readonly<Record<string, number>>;
     });
 }
+/** Why a run ends lost when its replay meets a step its record does not have (StepReplayMismatchError). */
+export declare const STEPS_CHANGED_REASON = "Could not continue across versions: the run's steps changed in the new version.";
+/**
+ * Part of the StepRunner contract: a durable step runner may throw this when a
+ * replayed run reaches a step whose name differs from the one recorded at that
+ * position (the run was recorded by a release whose steps differ). The run
+ * cannot continue from its record; engines rethrow it untouched and the
+ * runner ends the run lost with STEPS_CHANGED_REASON.
+ */
+export declare class StepReplayMismatchError extends Error {
+    readonly step: string;
+    constructor(step: string, options?: {
+        cause?: unknown;
+    });
+}
 /** The no-checkpoint default: run the step body directly. */
 export declare const runStepInline: StepRunner;
 /**
@@ -86,8 +101,8 @@ export interface EngineRunContext {
     agent: EngineAgent;
     tools: LoadedTool[];
     providers: Pick<ProviderRegistry, "llm">;
-    /** Host bridge: validates params (Zod-in-sandbox) then runs the tool body in the WASM sandbox. Never throws — a tool/validation failure is a JSON error result string, fed back to the model as the tool's result. */
-    runSandboxTool(name: string, argsJson: string): Promise<string>;
+    /** Host bridge: validates params (Zod-in-sandbox) then runs the tool body in the WASM sandbox. Never throws — a tool/validation failure is a JSON error result string, fed back to the model as the tool's result. `callId` is the model's id for this tool call; the same on a replay of the turn. */
+    runSandboxTool(name: string, argsJson: string, callId?: string): Promise<string>;
     /**
      * Consecutive tool calls of one model turn for which this returns true run
      * at the same time as each other (a lead's delegate_to_* calls, when the

package/dist/providers/engine/types.js

@@ -34,5 +34,22 @@ export class RunOwnershipLostError extends Error {
             this.discardedUsage = options.discardedUsage;
     }
 }
+/** Why a run ends lost when its replay meets a step its record does not have (StepReplayMismatchError). */
+export const STEPS_CHANGED_REASON = "Could not continue across versions: the run's steps changed in the new version.";
+/**
+ * Part of the StepRunner contract: a durable step runner may throw this when a
+ * replayed run reaches a step whose name differs from the one recorded at that
+ * position (the run was recorded by a release whose steps differ). The run
+ * cannot continue from its record; engines rethrow it untouched and the
+ * runner ends the run lost with STEPS_CHANGED_REASON.
+ */
+export class StepReplayMismatchError extends Error {
+    step;
+    constructor(step, options) {
+        super(`step_replay_mismatch: the recorded run has a different step where "${step}" was expected.`, options?.cause === undefined ? undefined : { cause: options.cause });
+        this.name = "StepReplayMismatchError";
+        this.step = step;
+    }
+}
 /** The no-checkpoint default: run the step body directly. */
 export const runStepInline = (_name, fn) => fn();

package/dist/providers/executor/composition.d.ts

@@ -3,13 +3,18 @@ import { type ProviderConfig } from "../../config/providers.js";
 import { type Power } from "../../core/power.js";
 import { type ReReviewDeps } from "../../core/review-fix.js";
 import type { KubernetesApi } from "../jobs/kubernetes-api.js";
+import { loadAgentSecretValues } from "../../core/secret-guard.js";
 import type { Executor } from "./types.js";
 import { type RepoAccessGate } from "../../core/repo-access.js";
 /**
  * The coding-run terminal hook: a review-fix round's coding run that made no change re-reviews
- * the PR once (core/review-fix.ts). Started in the background so the executor's terminal path
- * (and the slot release after it) never waits on the host; idempotent, and never throws.
- * `deps` is read only when a run finishes, after composition returned.
+ * the PR once (core/review-fix.ts), and the reviews of its pull request that waited for it (a
+ * draft's head it may have pushed before recording its result, core/host-events.ts) are
+ * released. Started in the background so the executor's terminal path (and the slot release
+ * after it) never waits on the host; idempotent (released rows are claimed), and never throws.
+ * Started outside the caller's async context: a delegated coding run finishes inside its lead's
+ * delegation step, and a review started from there would be refused by DBOS as a workflow
+ * started from inside a step. `deps` is read only when a run finishes, after composition returned.
  */
 export declare function reReviewOnCodingRunTerminal(deps: () => ReReviewDeps): (runId: string) => void;
 export interface ConfiguredExecutorOptions {
@@ -32,6 +37,8 @@ export interface ConfiguredExecutorOptions {
      * launcher (wakes the coding proxy before a run); absent: `DISABLED_POWER`.
      */
     power?: Power;
+    /** Decrypts agent secrets for transcript redaction (session resume). Absent: transcripts are never stored. */
+    secretCipher?: Parameters<typeof loadAgentSecretValues>[1];
 }
 /**
  * Builds container execution only when Docker or Kubernetes is explicitly

package/dist/providers/executor/composition.js

@@ -1,11 +1,15 @@
 import { tmpdir } from "node:os";
 import { resolve } from "node:path";
-import { loadCodingConcurrencyConfig, loadContainerExecutorConfig, loadGitHubVcsConfig, loadKubernetesJobConfig, loadProviderConfig, } from "../../config/providers.js";
+import { loadBlobStoreConfig, loadCodingConcurrencyConfig, loadContainerExecutorConfig, loadGitHubVcsConfig, loadKubernetesJobConfig, loadProviderConfig, } from "../../config/providers.js";
+import { summarizePackageAudit } from "../../coding/registry/audit-mode.js";
 import { summarizeRegistryFetches } from "../../coding/registry/report.js";
+import { linkedIssueReader } from "./linked-issue-reader.js";
 import { drainCodingQueue } from "../../core/coding-queue.js";
 import { prismaServiceStateReporter } from "../../core/coding-service-status.js";
 import { logger } from "../../core/logger.js";
+import { outsideRunContext } from "../../core/async-context.js";
 import { DISABLED_POWER } from "../../core/power.js";
+import { startDeferredForRequest } from "../../core/host-events.js";
 import { reReviewAfterNoChangeFix } from "../../core/review-fix.js";
 import { EnvironmentCredentialResolver } from "../coding-proxy/environment-credentials.js";
 import { CodingProxy } from "../coding-proxy/proxy.js";
@@ -18,7 +22,11 @@ import { preflightCanaryImage, runKubernetesPreflight } from "../jobs/kubernetes
 import { CODING_WORKER_IMAGES_REQUIRED } from "../../coding/docker-preflight.js";
 import { KubernetesJobLauncher } from "../jobs/kubernetes.js";
 import { buildVcsProvider } from "../vcs/index.js";
+import { RunTranscriptRecorder, loadTranscriptMaxBytes, loadTranscriptRetentionDays, } from "../../coding/transcript/recorder.js";
+import { loadAgentSecretValues } from "../../core/secret-guard.js";
+import { createBlobStore } from "../storage/index.js";
 import { ContainerExecutor, PrismaContainerExecutionStore, RunCapabilityVault } from "./container.js";
+import { loadMcpToolPins } from "../../core/mcp-tools.js";
 import { PrismaExecutionKindResolver, RoutingExecutor } from "./routing.js";
 import { createRepoAccessGate } from "../../core/repo-access.js";
 import { buildIssueTrackers } from "../issue-tracker/index.js";
@@ -26,16 +34,24 @@ import { buildReviewHosts } from "../review-host/index.js";
 const compositionLog = logger.child({ module: "executor-composition" });
 /**
  * The coding-run terminal hook: a review-fix round's coding run that made no change re-reviews
- * the PR once (core/review-fix.ts). Started in the background so the executor's terminal path
- * (and the slot release after it) never waits on the host; idempotent, and never throws.
- * `deps` is read only when a run finishes, after composition returned.
+ * the PR once (core/review-fix.ts), and the reviews of its pull request that waited for it (a
+ * draft's head it may have pushed before recording its result, core/host-events.ts) are
+ * released. Started in the background so the executor's terminal path (and the slot release
+ * after it) never waits on the host; idempotent (released rows are claimed), and never throws.
+ * Started outside the caller's async context: a delegated coding run finishes inside its lead's
+ * delegation step, and a review started from there would be refused by DBOS as a workflow
+ * started from inside a step. `deps` is read only when a run finishes, after composition returned.
  */
 export function reReviewOnCodingRunTerminal(deps) {
-    return (runId) => {
+    return (runId) => outsideRunContext(() => {
         void Promise.resolve()
             .then(() => reReviewAfterNoChangeFix(runId, deps()))
             .catch((err) => compositionLog.warn({ err, runId }, "no-change re-review hook failed"));
-    };
+        // Never throws (logs its own failures).
+        void Promise.resolve()
+            .then(() => startDeferredForRequest(deps(), runId))
+            .catch((err) => compositionLog.warn({ err, runId }, "could not release the reviews waiting for this run"));
+    });
 }
 /**
  * Builds container execution only when Docker or Kubernetes is explicitly
@@ -101,6 +117,7 @@ export function buildConfiguredExecutor(options) {
             config: kubernetes,
             workspaceRoot,
             resolveCapability: (runId) => capabilities.get(runId),
+            resolveMcpToken: (runId) => capabilities.mcpToken(runId),
             readyTimeoutMs: kubernetes.readyTimeoutMs,
             enforcementExecTimeoutMs: kubernetes.enforcementExecTimeoutMs,
             power: options.power ?? DISABLED_POWER,
@@ -125,6 +142,7 @@ export function buildConfiguredExecutor(options) {
             workspaceRoot,
             proxyContainer: proxyContainer,
             resolveCapability: (runId) => capabilities.get(runId),
+            resolveMcpToken: (runId) => capabilities.mcpToken(runId),
             isRunActive: async (runId, handle) => {
                 const coding = await options.db.codingRun.findUnique({
                     where: { runId },
@@ -141,12 +159,29 @@ export function buildConfiguredExecutor(options) {
     // The release and terminal hooks need the composed RoutingExecutor, which only exists
     // after the ContainerExecutor it wraps is built. The closure reads
     // `composed` only when a run finishes, which is after this function returns.
+    const blobStoreConfig = loadBlobStoreConfig(env);
+    const cipher = options.secretCipher;
+    const transcripts = new RunTranscriptRecorder({
+        db: options.db,
+        blobs: blobStoreConfig && cipher ? createBlobStore(blobStoreConfig) : undefined,
+        secretValues: async (agentId) => {
+            if (!cipher)
+                throw new Error("transcript_secrets_unavailable");
+            const named = await loadAgentSecretValues(options.db, cipher, agentId);
+            return named.flatMap((entry) => entry.values);
+        },
+        retentionDays: loadTranscriptRetentionDays(env),
+        maxBytes: loadTranscriptMaxBytes(env),
+    });
     const coding = new ContainerExecutor({
+        transcripts,
         store: new PrismaContainerExecutionStore(options.db, { maxConcurrent: concurrency.maxConcurrent, issueTrackers }),
         jobs,
         vcs,
         sessions,
         capabilities,
+        // Remote MCP servers: a coding run gets its agent's pinned tools and an MCP token ([] when off).
+        mcpToolPins: (agentId, pinOptions) => loadMcpToolPins(options.db, agentId, pinOptions),
         artifactRoot,
         workerImage: config.workerImage,
         claudeWorkerImage: config.claudeWorkerImage,
@@ -158,10 +193,20 @@ export function buildConfiguredExecutor(options) {
         limits: { cpus: config.cpus, memoryMb: config.memoryMb, pids: config.pids, diskMb: config.diskMb },
         maxDiskMb: config.maxDiskMb,
         repoAccess,
+        readLinkedIssue: linkedIssueReader({ hosts: reviewHosts, issueTrackers }),
         issueUrl: (provider, key) => (provider === "jira" ? issueTrackers.jira?.issueUrl(key) : undefined),
         registryReport: async (runId) => {
             const rows = await options.db.registryFetch.findMany({ where: { runId }, orderBy: { createdAt: "asc" } });
-            return summarizeRegistryFetches(rows);
+            const coding = await options.db.codingRun.findUnique({ where: { runId }, select: { packageAuditMode: true } });
+            const packageAuditMode = coding?.packageAuditMode ?? null;
+            if (!packageAuditMode)
+                return summarizeRegistryFetches(rows);
+            const audits = await options.db.registryAuditRecord.findMany({ where: { runId }, orderBy: { createdAt: "asc" } });
+            return {
+                ...summarizeRegistryFetches(rows),
+                packageAuditMode,
+                packageAudit: summarizePackageAudit(audits).entries,
+            };
         },
         onCodingRunTerminal: reReviewOnCodingRunTerminal(() => ({
             db: options.db,