@wardby/cli 0.6.0 → 0.8.0

package/help/troubleshooting/coding-workers.md

@@ -3,7 +3,7 @@ id: troubleshooting/coding-workers
 title: Troubleshoot coding workers
 summary: Investigate coding-worker setup, isolation preflight, and safe failure handling.
 audience: operator
-tags: [coding-agents, docker, kubernetes, isolation, services]
+tags: [coding-agents, get_run, request, requestUnavailable, quota, coding_queue_timeout, docker, kubernetes, isolation, services, debug-trace, debugTraceMinutes, debugTraceMaxMb, maxOutputTokens, output-tokens, claude-code, codex, memory, CODING_MEMORY_MB, CODING_CPUS, out-of-memory]
 appliesTo: >=0.2.1
 ---
 
@@ -54,14 +54,93 @@ raise `codingProfile.maxTurns` (up to 1000) with `update_agent` for the first,
 or narrow the task for the second. Codex runs have no turn limit. See
 [Coding run reached its turn limit](../errors/coding-turn-limit.md).
 
+## Claude Code replies that exceed the output token maximum
+
+A Claude Code run caps each model reply at 32000 output tokens by default,
+thinking included. When a reply needs more, Claude Code ends with an error
+that the response exceeded the output token maximum and the run fails as a
+stream failure. Raise `codingProfile.maxOutputTokens` (1024 to 128000; `null`
+restores the default) with `update_agent`, for example
+`{ "id": "<agent id>", "codingProfile": { "maxOutputTokens": 64000 } }`. The
+coding proxy reserves `maxOutputTokens` × the model's output price against the
+run's budget for every model request, so a higher value needs a larger
+`budgetUsd`; a request whose reservation does not fit ends the run as
+`budget_exhausted` (see the help article `errors/budget-exhausted`), so a small
+budget runs out sooner. Codex agents refuse the
+setting. The default and the setting need a Claude Code worker image from
+Wardby 0.7.0 or later: an older pinned image still caps replies at 4096 tokens
+and rejects a run whose agent sets `maxOutputTokens`.
+
+## Runs refused because the provider is out of credit
+
+A diagnostic of `job_coding_stream_quota_exceeded` means the model provider
+behind the coding proxy refused the run because its account is out of credit or
+over a spend limit, not that the run's own budget ran out. Every run on that
+account fails the same way until the limit is raised; see the help article
+`errors/coding-stream-quota-exceeded`.
+
+## Runs that die while running checks (out of memory)
+
+A run that fails with `coding_failure_executor` while it runs a linter, a type
+check or a test suite has often run out of memory. Each coding pod gets
+`CODING_MEMORY_MB` (2048 MiB by default) and `CODING_CPUS` (1 by default). In a
+Codex run the agent and its commands share that pod. In a Claude Code run the
+commands run in a tool-runner container limited to at most 512 MiB and 0.25 CPU.
+
+1. Turn on a debug trace (below) and run it again. A Node.js crash shows as
+   `Aborted` with exit code 134 in a command's output.
+2. Raise `CODING_MEMORY_MB` and `CODING_CPUS` on the control plane. On GKE, deploy
+   with `CODING_MEMORY_MB=6144 CODING_CPUS=2 deploy/gke/up.sh` (see the GKE deploy
+   guide). This applies to every coding run.
+3. For a Claude Code agent with heavy checks, run it on Codex instead, since raising
+   the pod's memory doesn't raise the tool runner's limit.
+
+## See what a run was asked to do
+
+From Wardby 0.8.0, `get_run` returns a coding run's `request`: the task it
+received from `trigger_agent`, a webhook or a lead, without the agent's standing
+instructions. Use it to check what a lead told a coding agent. The agent's secret
+values and token-shaped values are masked. If the secrets can't be read, you get
+`requestUnavailable: true` instead of the text.
+
+## Debug trace
+
+When a run's fixed error code or a slow run doesn't say enough, an admin can
+trace the agent's runs for a while:
+`update_agent { "id": "<agent id>", "codingProfile": { "debugTraceMinutes": 30 } }`.
+Each run dispatched in that window writes its whole agent stream, redacted, to
+its worker container's log under a `debugTrace` key. That covers Codex events,
+or, for Claude Code (Wardby 0.7.0 or later), every Agent SDK message:
+each command the agent ran with its output, the final usage and duration, plus
+stream failures in full. For Claude Code, the time between a command's
+`tool_use` and its `tool_result` line is how long that command took. A run's
+trace stops at 2 MiB by default; set `codingProfile.debugTraceMaxMb` (1 to 64,
+admin only) for more. The trace can hold prompts and repository content, so
+keep it on briefly. See
+[the debug trace section](../../docs/coding-worker-isolation.md#debug-trace)
+for where the log lives and what is redacted.
+
 ## Runs that wait for cluster capacity
 
-On Kubernetes with `KUBERNETES_RESOURCE_QUOTA` set, a run whose pod would not
-fit the namespace quota stays `pending` with `codingQueuedAt` set, like a run
-over `CODING_MAX_CONCURRENT`, and starts once other runs finish. A run still
-waiting after `CODING_QUEUE_TIMEOUT_SEC` fails with `coding_queue_timeout`:
-raise the quota, lower the run pods' size, or lower `CODING_MAX_CONCURRENT` so
-fewer runs compete.
+On Kubernetes, a run whose pod would not fit the namespace quota waits instead
+of failing. With `KUBERNETES_RESOURCE_QUOTA` set, it is held before it starts;
+without it, or if the quota fills up meanwhile, the cluster refuses the pod and
+the run returns to the queue. Either way it stays `pending` with
+`codingQueuedAt` set, like a run over `CODING_MAX_CONCURRENT`, and is retried
+(a refused run no sooner than about a minute later). A refused run shows
+`running` briefly, then `pending` again.
+
+A run still waiting after `CODING_QUEUE_TIMEOUT_SEC` fails with
+`coding_queue_timeout`. That can mean either the concurrency limit or the
+namespace quota. To tell which, look for the control-plane log line
+`coding run waiting for capacity: the cluster refused its pod` (quota), and run
+`kubectl describe resourcequota -n <namespace>` to compare used against hard
+limits. If the quota is full, raise it, lower the run pods' size, or lower
+`CODING_MAX_CONCURRENT` so fewer runs compete; size the quota for
+`CODING_MAX_CONCURRENT` times the run pod's requests. If the log line
+`kubernetes_resource_quota_unconfigured` appears, set `KUBERNETES_RESOURCE_QUOTA`
+to the named quota and grant the launcher `get` on it. See
+[the queue section](../../docs/coding-worker-isolation.md#control-plane-configuration).
 
 A lead agent with `parallelDelegations` starts several coding runs together;
 expect some of them to queue when the lead fans out wider than the free slots.

package/help/troubleshooting/debugging-agent-runs.md

@@ -0,0 +1,29 @@
+---
+id: troubleshooting/debugging-agent-runs
+title: Debug an agent run
+summary: Triage a run that failed, opened no pull request, or missed what you expected, using the MCP tools and GitHub without server logs.
+audience: operator
+tags: [debugging, triage, get_run, list_runs, failureCategory, diagnosticId, get_run_transcript, no_changes]
+appliesTo: >=0.7.0
+---
+
+# Debug an agent run
+
+Find the run with `list_runs`, read it with `get_run`, then follow what you see.
+Without an `agentId`, `list_runs` lists your runs across every agent (from
+Wardby 0.8.0); add `active: true` or `since` to narrow it.
+
+| What you see                  | What to check                                                                                      |
+| ----------------------------- | -------------------------------------------------------------------------------------------------- |
+| No run started                | `list_repositories` on the router: is a link holding the trigger you used?                         |
+| Failed or refused             | `status`, `error`, `failureCategory` and the final text. Call `search_help` with the category      |
+| Lead ran, no coding run       | The lead's final text, which should say why it didn't delegate                                     |
+| Succeeded, no pull request    | `codingResult.outcome`: `no_changes`, `budget_exhausted`, or `branch_pushed` on a local repository |
+| Pull request missed the point | The diff, the review, the original request, and `request` on `get_run` (from Wardby 0.8.0)         |
+
+A failed coding run's specific reason is only in the server log. Send an operator
+the run ID and its `diagnosticId`. For Claude Code agents with `sessionResume` on,
+`get_run_transcript` shows what the agent did; see
+[Resume Claude Code runs locally](../resume-runs-locally.md).
+
+The full guide is [Debugging an agent run](../../docs/debugging-agent-runs.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wardby/cli",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Self-hosted control plane for budget-guarded AI agents.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/wardby/wardby#readme",
@@ -58,7 +58,7 @@
     "build:help": "tsx src/help/build.ts",
     "sync:reviewer-prompt": "tsx src/quickstart/sync-reviewer-prompt.ts",
     "build:viewer-schemas": "tsx src/viewer/build-schemas.ts",
-    "build": "npm run build:vendor && PRISMA_HIDE_UPDATE_MESSAGE=1 prisma generate && tsc -p tsconfig.build.json && npm run build:help",
+    "build": "npm run build:vendor && PRISMA_HIDE_UPDATE_MESSAGE=1 prisma generate && tsc -p tsconfig.build.json && node scripts/copy-build-modules.mjs && npm run build:help",
     "prepare": "npm run build:vendor && PRISMA_HIDE_UPDATE_MESSAGE=1 prisma generate",
     "prepack": "npm run build",
     "cli": "tsx --conditions=wardby-source src/wardby-bin.ts",
@@ -67,6 +67,7 @@
     "test": "npm run build:vendor && vitest run",
     "test:package": "node scripts/npm-package-acceptance.mjs",
     "test:contract": "vitest run --config vitest.contract.config.ts",
+    "test:release": "npm run build:vendor && vitest run --config vitest.release.config.ts",
     "test:kubernetes": "WARDBY_KUBERNETES_TEST=1 vitest run src/providers/jobs/kubernetes.integration.test.ts",
     "test:native-docker": "WARDBY_NATIVE_DOCKER_TEST=1 vitest run src/native-worker/docker.acceptance.test.ts",
     "test:native-kind": "WARDBY_NATIVE_KIND_TEST=1 vitest run src/native-worker/kubernetes.acceptance.test.ts",
@@ -100,12 +101,16 @@
     "@anthropic-ai/bedrock-sdk": "^0.33.4",
     "@anthropic-ai/sdk": "^0.124.0",
     "@aws-crypto/sha256-js": "4.0.0",
+    "@aws-sdk/client-s3": "3.1140.0",
+    "@aws-sdk/lib-storage": "3.1140.0",
     "@aws-sdk/rds-signer": "3.1140.0",
+    "@aws-sdk/s3-request-presigner": "3.1140.0",
     "@dbos-inc/dbos-sdk": "4.27.6",
+    "@google-cloud/storage": "8.2.0",
     "@kubernetes/client-node": "^2.0.0",
-    "@modelcontextprotocol/client": "^2.3.1",
-    "@modelcontextprotocol/node": "^2.0.0",
-    "@modelcontextprotocol/server": "^2.0.0",
+    "@modelcontextprotocol/client": "^2.4.0",
+    "@modelcontextprotocol/node": "^2.1.2",
+    "@modelcontextprotocol/server": "^2.4.0",
     "@prisma/adapter-pg": "7.10.0",
     "@prisma/client": "7.10.0",
     "@prometheus-io/client": "^0.16.1",
@@ -124,11 +129,11 @@
     "pino": "^9.14.0",
     "quickjs-emscripten": "^0.32.0",
     "semver": "^7.8.5",
+    "smol-toml": "1.9.0",
     "tar-stream": "^3.2.1",
-    "undici": "^8.7.0",
+    "undici": "^8.12.3",
     "yaml": "^2.9.1",
-    "zod": "^3.25.76",
-    "zod-to-json-schema": "^3.25.2"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
@@ -148,10 +153,13 @@
     "tsx": "^4.19.0",
     "typescript": "^5.6.0",
     "typescript-eslint": "^8.69.0",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.12",
+    "zod-to-json-schema": "^3.25.2"
   },
   "overrides": {
     "deepmerge-ts": "8.0.2",
-    "mysql2": "3.24.4"
+    "minimatch": "11.0.3",
+    "mysql2": "3.24.4",
+    "uuid": "11.1.1"
   }
 }

package/prisma/migrations/20261016000000_registry_approved_accepted_advisories/migration.sql

@@ -0,0 +1,3 @@
+-- Additive: the blocking advisories a run's packagePolicy.acceptedAdvisories
+-- waived for a version its lockfile plan approved (empty when none).
+ALTER TABLE "RegistryApprovedVersion" ADD COLUMN "acceptedAdvisories" TEXT[] DEFAULT ARRAY[]::TEXT[];

package/prisma/migrations/20261016000001_mark_ready_when_passing/migration.sql

@@ -0,0 +1,3 @@
+-- Additive: opt-in to mark Wardby's draft pull requests ready once they pass, claimed once per pull request.
+ALTER TABLE "AgentRepository" ADD COLUMN "markReadyWhenPassing" BOOLEAN NOT NULL DEFAULT false;
+ALTER TABLE "CodingRun" ADD COLUMN "markedReadyAt" TIMESTAMP(3);

package/prisma/migrations/20261017000000_debug_trace_max_mb/migration.sql

@@ -0,0 +1,4 @@
+-- Configurable per-run debug-trace cap: the profile carries the admin-set cap
+-- (MiB), and each traced run records at dispatch the cap it used.
+ALTER TABLE "CodingAgentProfile" ADD COLUMN "debugTraceMaxMb" INTEGER;
+ALTER TABLE "CodingRun" ADD COLUMN "debugTraceMaxMb" INTEGER;

package/prisma/migrations/20261018000000_dependency_cache/migration.sql

@@ -0,0 +1,53 @@
+-- Additive: the run dependency cache. An agent flag snapshotted onto each
+-- coding run, the run's reported cache result, the proxy session's approved
+-- lock hashes and seal, and the snapshot metadata the coding proxy keeps.
+-- A snapshot outlives the run that created it: createdByRunId is cleared, not
+-- cascaded, when that run is deleted.
+
+-- AlterTable
+ALTER TABLE "CodingAgentProfile" ADD COLUMN "dependencyCache" BOOLEAN NOT NULL DEFAULT false;
+
+-- AlterTable
+ALTER TABLE "CodingRun" ADD COLUMN "dependencyCache" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN "dependencyCacheResult" JSONB;
+
+-- AlterTable
+ALTER TABLE "CodingProxySession" ADD COLUMN "dependencyCacheLockHashes" TEXT[] DEFAULT ARRAY[]::TEXT[],
+ADD COLUMN "dependencyCacheSealedAt" TIMESTAMP(3);
+
+-- CreateTable
+CREATE TABLE "DependencySnapshot" (
+    "id" TEXT NOT NULL,
+    "ecosystem" TEXT NOT NULL,
+    "repository" TEXT NOT NULL,
+    "projectPath" TEXT NOT NULL DEFAULT '.',
+    "lockHash" TEXT NOT NULL,
+    "workerImage" TEXT NOT NULL,
+    "policyHash" TEXT NOT NULL,
+    "blobKey" TEXT NOT NULL,
+    "sha256" TEXT NOT NULL,
+    "sizeBytes" BIGINT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "lastUsedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "createdByRunId" TEXT,
+
+    CONSTRAINT "DependencySnapshot_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "DependencySnapshot_blobKey_key" ON "DependencySnapshot"("blobKey");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "DependencySnapshot_ecosystem_repository_projectPath_lockHas_key" ON "DependencySnapshot"("ecosystem", "repository", "projectPath", "lockHash", "workerImage", "policyHash");
+
+-- CreateIndex
+CREATE INDEX "DependencySnapshot_ecosystem_repository_projectPath_workerI_idx" ON "DependencySnapshot"("ecosystem", "repository", "projectPath", "workerImage", "policyHash", "createdAt");
+
+-- CreateIndex
+CREATE INDEX "DependencySnapshot_lastUsedAt_idx" ON "DependencySnapshot"("lastUsedAt");
+
+-- CreateIndex
+CREATE INDEX "DependencySnapshot_createdByRunId_projectPath_idx" ON "DependencySnapshot"("createdByRunId", "projectPath");
+
+-- AddForeignKey
+ALTER TABLE "DependencySnapshot" ADD CONSTRAINT "DependencySnapshot_createdByRunId_fkey" FOREIGN KEY ("createdByRunId") REFERENCES "CodingRun"("runId") ON DELETE SET NULL ON UPDATE CASCADE;

package/prisma/migrations/20261019000000_claude_max_output_tokens/migration.sql

@@ -0,0 +1,5 @@
+-- Claude Code output tokens per model reply: the profile carries the agent's
+-- setting, and each run records at dispatch the value it used. Null = the
+-- worker default.
+ALTER TABLE "CodingAgentProfile" ADD COLUMN "maxOutputTokens" INTEGER;
+ALTER TABLE "CodingRun" ADD COLUMN "maxOutputTokens" INTEGER;

package/prisma/migrations/20261021000000_pr_description_hash/migration.sql

@@ -0,0 +1,4 @@
+-- Additive: the pull request description Wardby last wrote (hash + author run, root rows only), and each run's description update outcome.
+ALTER TABLE "CodingRun" ADD COLUMN "prDescriptionSha256" TEXT;
+ALTER TABLE "CodingRun" ADD COLUMN "prDescriptionRunId" TEXT;
+ALTER TABLE "CodingRun" ADD COLUMN "prDescriptionOutcome" TEXT;

package/prisma/migrations/20261022000000_dependency_snapshot_validation_metadata/migration.sql

@@ -0,0 +1,4 @@
+ALTER TABLE "DependencySnapshot"
+  ADD COLUMN "archiveScanVersion" INTEGER,
+  ADD COLUMN "archiveEntries" INTEGER,
+  ADD COLUMN "unpackedBytes" BIGINT;

package/prisma/migrations/20261023000000_package_audit_mode/migration.sql

@@ -0,0 +1,27 @@
+-- Package audit mode (docs/coding-packages.md#package-audit-mode): a timed
+-- per-agent mode, fixed on each coding run at dispatch, and the run's record
+-- of what the registry served only because of it.
+CREATE TYPE "PackageAuditMode" AS ENUM ('audit', 'full');
+
+ALTER TABLE "CodingAgentProfile" ADD COLUMN "packageAuditMode" "PackageAuditMode";
+ALTER TABLE "CodingAgentProfile" ADD COLUMN "packageAuditUntil" TIMESTAMP(3);
+ALTER TABLE "CodingRun" ADD COLUMN "packageAuditMode" "PackageAuditMode";
+ALTER TABLE "RegistryAllowance" ADD COLUMN "auditedVia" TEXT;
+ALTER TABLE "RegistryApprovedVersion" ADD COLUMN "audit" JSONB;
+
+CREATE TABLE "RegistryAuditRecord" (
+    "runId" TEXT NOT NULL,
+    "ecosystem" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "version" TEXT NOT NULL,
+    "relation" TEXT NOT NULL,
+    "via" TEXT,
+    "sizeBytes" INTEGER,
+    "advisories" JSONB NOT NULL DEFAULT '[]',
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "RegistryAuditRecord_pkey" PRIMARY KEY ("runId","ecosystem","name","version")
+);
+
+ALTER TABLE "RegistryAuditRecord" ADD CONSTRAINT "RegistryAuditRecord_runId_fkey"
+  FOREIGN KEY ("runId") REFERENCES "CodingRun"("runId") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20261024000000_budget_events/migration.sql

@@ -0,0 +1,26 @@
+-- Budget refusal records and estimated settlement of interrupted requests.
+
+CREATE TYPE "RunBudgetEventKind" AS ENUM ('refused');
+
+CREATE TABLE "RunBudgetEvent" (
+    "id" TEXT NOT NULL,
+    "runId" TEXT NOT NULL,
+    "kind" "RunBudgetEventKind" NOT NULL,
+    "limit" TEXT NOT NULL,
+    "at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "details" JSONB NOT NULL,
+    CONSTRAINT "RunBudgetEvent_pkey" PRIMARY KEY ("id")
+);
+
+CREATE INDEX "RunBudgetEvent_runId_at_idx" ON "RunBudgetEvent"("runId", "at");
+
+ALTER TABLE "RunBudgetEvent" ADD CONSTRAINT "RunBudgetEvent_runId_fkey"
+    FOREIGN KEY ("runId") REFERENCES "Run"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "CodingRun" ADD COLUMN "budgetLimitedBy" TEXT;
+
+ALTER TABLE "CodingProxyRequest" ADD COLUMN "costEstimated" BOOLEAN NOT NULL DEFAULT false;
+
+ALTER TABLE "NativeGatewayCall" ADD COLUMN "costEstimated" BOOLEAN NOT NULL DEFAULT false;
+
+ALTER TABLE "CodingProxySession" ADD COLUMN "budgetRefusal" JSONB;

package/prisma/migrations/20261025000000_cache_aware_holds/migration.sql

@@ -0,0 +1,9 @@
+-- Cache-aware holds: per-request size, ceiling, basis and conversation key.
+
+ALTER TABLE "CodingProxyRequest" ADD COLUMN "requestBytes" INTEGER;
+ALTER TABLE "CodingProxyRequest" ADD COLUMN "ceilingUsd" DECIMAL(18,10);
+ALTER TABLE "CodingProxyRequest" ADD COLUMN "reservationBasis" TEXT;
+ALTER TABLE "CodingProxyRequest" ADD COLUMN "conversationKey" TEXT;
+
+CREATE INDEX "CodingProxyRequest_sessionId_conversationKey_idx"
+    ON "CodingProxyRequest"("sessionId", "conversationKey");

package/prisma/migrations/20261026000000_budget_overrun/migration.sql

@@ -0,0 +1,4 @@
+-- Per-agent allowed overrun (percent above budgetUsd) for coding runs, and the
+-- pre-overrun budget recorded on each coding run.
+ALTER TABLE "Agent" ADD COLUMN "allowedOverrunPercent" INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE "CodingRun" ADD COLUMN "budgetBaseUsd" DECIMAL(10,6);

package/prisma/migrations/20261027000000_coding_run_request/migration.sql

@@ -0,0 +1 @@
+ALTER TABLE "CodingRun" ADD COLUMN "request" TEXT;

package/prisma/migrations/20261028000000_native_gateway_review_reads/migration.sql

@@ -0,0 +1,6 @@
+-- Additive: what a native sandbox run's review tools have read (repo_pr_read pages and
+-- repo_read_file reads), saved between gateway requests so repo_publish_review can refuse
+-- unread_files. Null until the run reads a pull request.
+
+-- AlterTable
+ALTER TABLE "NativeGatewaySession" ADD COLUMN "reviewReads" JSONB;

package/prisma/migrations/20261029000000_lead_survives_deploy/migration.sql

@@ -0,0 +1,6 @@
+-- A run's current DBOS workflow when a cross-version takeover forked it (null = the run id),
+-- and the delegation call that created a child run.
+ALTER TABLE "Run" ADD COLUMN "executionWorkflowId" TEXT;
+ALTER TABLE "Run" ADD COLUMN "parentCallId" TEXT;
+
+CREATE UNIQUE INDEX "Run_parentRunId_parentCallId_key" ON "Run"("parentRunId", "parentCallId");

package/prisma/migrations/20261030000000_local_review_covered_sha/migration.sql

@@ -0,0 +1,2 @@
+-- The head a local review read every file of (null when it did not): repo_pr_read's lastCoveredSha.
+ALTER TABLE "LocalReview" ADD COLUMN "coveredSha" TEXT;

package/prisma/migrations/20261031000000_coding_run_budget_limit/migration.sql

@@ -0,0 +1,9 @@
+-- Overrun from available room: a coding run reserves its base budget, and may
+-- spend past it up to the limit recorded here only through top-ups its budget
+-- group and run tree have room for. Null = no top-ups (older runs, or no
+-- allowed overrun): the reservation is the run's limit, as before.
+ALTER TABLE "CodingRun" ADD COLUMN "budgetLimitUsd" DECIMAL(10,6);
+
+-- A top-up the group or run tree had no room for. Postgres 12+ allows ADD VALUE
+-- inside a transaction as long as the new value is not used in the same one.
+ALTER TYPE "RunBudgetEventKind" ADD VALUE 'overrun_unavailable';

package/prisma/migrations/20261101000000_run_transcripts/migration.sql

@@ -0,0 +1,22 @@
+-- Session resume: per-agent setting, per-run copy, and transcript metadata.
+ALTER TABLE "CodingAgentProfile" ADD COLUMN "sessionResume" BOOLEAN NOT NULL DEFAULT false;
+ALTER TABLE "CodingRun" ADD COLUMN "sessionResume" BOOLEAN NOT NULL DEFAULT false;
+
+CREATE TABLE "RunTranscript" (
+    "runId" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "status" TEXT NOT NULL,
+    "reason" TEXT,
+    "sessionId" TEXT,
+    "blobKey" TEXT,
+    "sizeBytes" INTEGER,
+    "sha256" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    CONSTRAINT "RunTranscript_pkey" PRIMARY KEY ("runId")
+);
+
+CREATE INDEX "RunTranscript_expiresAt_idx" ON "RunTranscript"("expiresAt");
+
+ALTER TABLE "RunTranscript" ADD CONSTRAINT "RunTranscript_runId_fkey"
+    FOREIGN KEY ("runId") REFERENCES "Run"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20261102000000_host_providers/migration.sql

@@ -0,0 +1,56 @@
+-- Tool-backed host providers: config and approved snapshots. No secret values.
+CREATE TABLE "HostProvider" (
+    "name" TEXT NOT NULL,
+    "contractVersion" INTEGER NOT NULL,
+    "gitHost" TEXT NOT NULL,
+    "apiHosts" TEXT[],
+    "gitUsername" TEXT NOT NULL,
+    "pullRequestUrlTemplate" TEXT NOT NULL,
+    "repositoryApiPath" TEXT NOT NULL,
+    "permissionApiPath" TEXT,
+    "webhook" JSONB NOT NULL,
+    "webhookSecretId" TEXT NOT NULL,
+    "permissionSecretId" TEXT,
+    "createdById" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    CONSTRAINT "HostProvider_pkey" PRIMARY KEY ("name")
+);
+
+CREATE TABLE "HostProviderOperation" (
+    "provider" TEXT NOT NULL,
+    "operation" TEXT NOT NULL,
+    "toolId" TEXT,
+    "code" TEXT NOT NULL,
+    "paramsZod" TEXT NOT NULL,
+    "approvedById" TEXT NOT NULL,
+    "approvedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "HostProviderOperation_pkey" PRIMARY KEY ("provider", "operation")
+);
+
+CREATE TABLE "HostProviderCredential" (
+    "id" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "repositoryPattern" TEXT NOT NULL,
+    "secretId" TEXT NOT NULL,
+    "credentialKind" TEXT NOT NULL DEFAULT 'static',
+    CONSTRAINT "HostProviderCredential_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "HostProviderTrustedAccount" (
+    "provider" TEXT NOT NULL,
+    "accountId" TEXT NOT NULL,
+    "addedById" TEXT NOT NULL,
+    "addedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "HostProviderTrustedAccount_pkey" PRIMARY KEY ("provider", "accountId")
+);
+
+CREATE UNIQUE INDEX "HostProviderCredential_provider_repositoryPattern_key" ON "HostProviderCredential"("provider", "repositoryPattern");
+
+ALTER TABLE "HostProvider" ADD CONSTRAINT "HostProvider_webhookSecretId_fkey" FOREIGN KEY ("webhookSecretId") REFERENCES "Secret"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "HostProvider" ADD CONSTRAINT "HostProvider_permissionSecretId_fkey" FOREIGN KEY ("permissionSecretId") REFERENCES "Secret"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "HostProviderOperation" ADD CONSTRAINT "HostProviderOperation_provider_fkey" FOREIGN KEY ("provider") REFERENCES "HostProvider"("name") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "HostProviderOperation" ADD CONSTRAINT "HostProviderOperation_toolId_fkey" FOREIGN KEY ("toolId") REFERENCES "Tool"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+ALTER TABLE "HostProviderCredential" ADD CONSTRAINT "HostProviderCredential_provider_fkey" FOREIGN KEY ("provider") REFERENCES "HostProvider"("name") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "HostProviderCredential" ADD CONSTRAINT "HostProviderCredential_secretId_fkey" FOREIGN KEY ("secretId") REFERENCES "Secret"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "HostProviderTrustedAccount" ADD CONSTRAINT "HostProviderTrustedAccount_provider_fkey" FOREIGN KEY ("provider") REFERENCES "HostProvider"("name") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20261104000000_coding_agent_repository_list/migration.sql

@@ -0,0 +1,5 @@
+-- A coding agent may work in several repositories: each link can name its own base
+-- branch, and a run records that its repository came from a link.
+ALTER TABLE "AgentRepository" ADD COLUMN "baseRef" TEXT;
+ALTER TABLE "CodingRun" ADD COLUMN "viaRepositoryLink" BOOLEAN NOT NULL DEFAULT false;
+ALTER TABLE "NativeGatewayCall" ADD COLUMN "childRepository" TEXT;

package/prisma/migrations/20261106000000_tool_timeout/migration.sql

@@ -0,0 +1,4 @@
+-- A sandboxed tool may set its own time limit per call, in milliseconds. Null keeps the
+-- default limit. A host provider's approved snapshot of a tool keeps the value it approved.
+ALTER TABLE "Tool" ADD COLUMN "timeoutMs" INTEGER;
+ALTER TABLE "HostProviderOperation" ADD COLUMN "timeoutMs" INTEGER;

package/prisma/migrations/20261107000000_mcp_servers/migration.sql

@@ -0,0 +1,33 @@
+-- Remote MCP servers an owner registers, and their attachments to native agents.
+CREATE TABLE "McpServer" (
+    "id" TEXT NOT NULL,
+    "ownerId" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "url" TEXT NOT NULL,
+    "secretNames" TEXT[] DEFAULT ARRAY[]::TEXT[],
+    "toolSnapshot" JSONB NOT NULL DEFAULT '[]',
+    "snapshotAt" TIMESTAMP(3),
+    "serverInfo" JSONB,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    CONSTRAINT "McpServer_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "AgentMcpServer" (
+    "agentId" TEXT NOT NULL,
+    "serverId" TEXT NOT NULL,
+    "allowedTools" TEXT[],
+    "callTimeoutMs" INTEGER,
+    "attachedById" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    CONSTRAINT "AgentMcpServer_pkey" PRIMARY KEY ("agentId", "serverId")
+);
+
+CREATE UNIQUE INDEX "McpServer_ownerId_name_key" ON "McpServer"("ownerId", "name");
+CREATE INDEX "McpServer_ownerId_idx" ON "McpServer"("ownerId");
+CREATE INDEX "AgentMcpServer_serverId_idx" ON "AgentMcpServer"("serverId");
+
+ALTER TABLE "McpServer" ADD CONSTRAINT "McpServer_ownerId_fkey" FOREIGN KEY ("ownerId") REFERENCES "Principal"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "AgentMcpServer" ADD CONSTRAINT "AgentMcpServer_agentId_fkey" FOREIGN KEY ("agentId") REFERENCES "Agent"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "AgentMcpServer" ADD CONSTRAINT "AgentMcpServer_serverId_fkey" FOREIGN KEY ("serverId") REFERENCES "McpServer"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20261108000000_coding_mcp/migration.sql

@@ -0,0 +1,5 @@
+-- Coding runs: pinned MCP tools, the MCP token's hash, and a call counter.
+ALTER TABLE "CodingProxySession" ADD COLUMN "mcpTools" JSONB;
+ALTER TABLE "CodingProxySession" ADD COLUMN "mcpTokenHash" TEXT;
+ALTER TABLE "CodingProxySession" ADD COLUMN "mcpCallCount" INTEGER NOT NULL DEFAULT 0;
+CREATE UNIQUE INDEX "CodingProxySession_mcpTokenHash_key" ON "CodingProxySession"("mcpTokenHash");

package/prisma/migrations/20261109000000_task_run_index/migration.sql

@@ -0,0 +1,3 @@
+-- The run-drivability and cancelled-task lookups filter Task on (runId, status); the drivability
+-- check runs on every coding MCP request.
+CREATE INDEX "Task_runId_status_idx" ON "Task"("runId", "status");