@wardby/cli 0.6.0 → 0.8.0

package/dist/core/stop-run.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Stopping a run on request (the stop_run MCP tool). Every executor already owns the stop of the
+ * runs it executes (`Executor.stop`), and each makes the terminal write itself, conditional on the
+ * run still being pending or running, so the first terminal write wins and a finished run is never
+ * rewritten:
+ *
+ * - a native run in the control plane is recorded `cancelled` and stops at its next step boundary
+ *   (InProcessExecutor/DbosExecutor; a run that has not started never does);
+ * - a native run in the sandbox is recorded `cancelled`, its gateway session ends so the worker's
+ *   next call is refused, and after a short grace its worker is killed and removed
+ *   (NativeSandboxExecutor);
+ * - a coding run, queued for a slot or running, is recorded `cancelled` first (the fence that keeps
+ *   a finishing run from pushing or opening a pull request), then its proxy session is cancelled and
+ *   its job stopped and removed (ContainerExecutor).
+ *
+ * This module adds what a caller asks for on top: the run's in-flight delegated child runs are
+ * stopped too (depth-first, so nothing keeps spending for a parent that stopped), who stopped it
+ * and why is kept on the row (Run.stopRequestReason) and logged, and a run already finished is
+ * returned unchanged.
+ */
+import type { PrismaClient, RunStatus } from "#prisma";
+import type { Executor } from "../providers/executor/types.js";
+export type StopRunDb = Pick<PrismaClient, "run">;
+export interface StopRunOptions {
+    db: StopRunDb;
+    executor: Pick<Executor, "stop">;
+    runId: string;
+    /** Who asked (a principal id), recorded with the reason. */
+    stoppedBy: string;
+    /** The caller's own words, if any. */
+    reason?: string;
+}
+export interface StopRunResult {
+    runId: string;
+    /** The run's status before this call. */
+    previousStatus: RunStatus;
+    /** The run's status after it: `cancelled` once stopped, or whatever it had already ended as. */
+    status: RunStatus;
+    /** False when the run had already finished: nothing was changed. */
+    stopRequested: boolean;
+    /** In-flight delegated child runs this call stopped as well. */
+    stoppedChildRunIds: string[];
+}
+/** The text recorded on a stopped run: who stopped it and why. */
+export declare function stopRunReason(stoppedBy: string, reason?: string): string;
+export declare function stopRun(options: StopRunOptions): Promise<StopRunResult>;

package/dist/core/stop-run.js

@@ -0,0 +1,61 @@
+import { logger } from "./logger.js";
+const stopLog = logger.child({ module: "stop-run" });
+const DRIVABLE = ["pending", "running"];
+/** Delegation trees are shallow; this only bounds a malformed one. */
+const MAX_CHILD_DEPTH = 16;
+/** The text recorded on a stopped run: who stopped it and why. */
+export function stopRunReason(stoppedBy, reason) {
+    const why = reason?.trim();
+    return `Stopped by ${stoppedBy} with stop_run${why ? `: ${why}` : "."}`;
+}
+export async function stopRun(options) {
+    const { db, runId } = options;
+    const row = await db.run.findUnique({ where: { id: runId }, select: { status: true } });
+    if (!row)
+        throw new Error(`Unknown run "${runId}".`);
+    const previousStatus = row.status;
+    if (!DRIVABLE.includes(previousStatus)) {
+        return { runId, previousStatus, status: previousStatus, stopRequested: false, stoppedChildRunIds: [] };
+    }
+    const reason = stopRunReason(options.stoppedBy, options.reason);
+    stopLog.info({ runId, stoppedBy: options.stoppedBy, previousStatus, reason }, "stopping run");
+    const stoppedChildRunIds = [];
+    await stopOne(options, runId, reason, stoppedChildRunIds, 0, new Set());
+    const after = await db.run.findUniqueOrThrow({ where: { id: runId }, select: { status: true } });
+    return { runId, previousStatus, status: after.status, stopRequested: true, stoppedChildRunIds };
+}
+async function stopOne(options, runId, reason, stoppedChildRunIds, depth, visited) {
+    const { db, executor } = options;
+    visited.add(runId);
+    try {
+        await executor.stop(runId, reason);
+    }
+    catch (err) {
+        // Still stop the children and record the request: a failed stop is retried by calling again.
+        stopLog.warn({ err, runId }, "the executor failed to stop the run");
+    }
+    // A run that never started has nothing to interrupt: end it here if no executor did.
+    await db.run.updateMany({
+        where: { id: runId, status: "pending" },
+        data: { status: "cancelled", error: reason, finishedAt: new Date() },
+    });
+    // Kept for get_run; written only on a run this stop (or another) cancelled, never on one that
+    // finished some other way meanwhile. stopRequestedAt stays null: it is the native sandbox
+    // gateway's deferred-stop marker, which the scheduler leader drains.
+    await db.run.updateMany({
+        where: { id: runId, status: "cancelled", stopRequestReason: null },
+        data: { stopRequestReason: reason },
+    });
+    if (depth >= MAX_CHILD_DEPTH)
+        return;
+    const children = await db.run.findMany({
+        where: { parentRunId: runId, status: { in: [...DRIVABLE] } },
+        select: { id: true },
+    });
+    for (const child of children) {
+        if (visited.has(child.id))
+            continue;
+        stoppedChildRunIds.push(child.id);
+        await stopOne(options, child.id, `Parent run ${runId} was stopped. ${reason}`, stoppedChildRunIds, depth + 1, visited);
+    }
+}

package/dist/core/tool-admin.d.ts

@@ -33,6 +33,8 @@ export interface ToolChanges {
     description?: string;
     paramsZod?: string;
     code?: string;
+    /** null clears it (back to the default limit). Checked against the ceiling by the caller (toolTimeoutProblem). */
+    timeoutMs?: number | null;
 }
 /**
  * Why a tool change was refused because of its attachments:
@@ -76,6 +78,8 @@ export declare function deleteToolGuarded(db: Pick<PrismaClient, "$transaction">
     authorize: AuthorizeTool;
 }): Promise<string[]>;
 /** One `wardby tool list` line: names are only unique per owner, so the id and owner disambiguate. */
-export declare function formatToolLine(tool: Pick<Tool, "id" | "name" | "description" | "ownerId">): string;
+export declare function formatToolLine(tool: Pick<Tool, "id" | "name" | "description" | "ownerId"> & {
+    timeoutMs?: number | null;
+}): string;
 /** Attached agents for an operator-facing refusal: unlike MCP's, nothing is redacted. */
 export declare function formatAttachedAgents(agents: AttachedAgent[]): string;

package/dist/core/tool-admin.js

@@ -46,7 +46,10 @@ export class ToolAttachedError extends Error {
 }
 /** Whether `changes` names at least one field to change. */
 export function hasToolChanges(changes) {
-    return changes.description !== undefined || changes.paramsZod !== undefined || changes.code !== undefined;
+    return (changes.description !== undefined ||
+        changes.paramsZod !== undefined ||
+        changes.code !== undefined ||
+        changes.timeoutMs !== undefined);
 }
 /**
  * The row update for `changes`, with jsonSchema re-derived exactly as tool
@@ -59,6 +62,7 @@ export async function prepareToolUpdate(changes) {
     const data = {
         ...(changes.description !== undefined ? { description: changes.description } : {}),
         ...(changes.code !== undefined ? { code: changes.code } : {}),
+        ...(changes.timeoutMs !== undefined ? { timeoutMs: changes.timeoutMs } : {}),
     };
     if (changes.paramsZod !== undefined) {
         const schemaResult = await deriveJsonSchema(changes.paramsZod);
@@ -119,7 +123,8 @@ export async function deleteToolGuarded(db, toolId, options) {
 }
 /** One `wardby tool list` line: names are only unique per owner, so the id and owner disambiguate. */
 export function formatToolLine(tool) {
-    return `${tool.id}  ${tool.name}  owner:${tool.ownerId ?? "public"}  ${tool.description}`;
+    const timeout = tool.timeoutMs === null || tool.timeoutMs === undefined ? "" : `  timeoutMs:${tool.timeoutMs}`;
+    return `${tool.id}  ${tool.name}  owner:${tool.ownerId ?? "public"}${timeout}  ${tool.description}`;
 }
 /** Attached agents for an operator-facing refusal: unlike MCP's, nothing is redacted. */
 export function formatAttachedAgents(agents) {

package/dist/core/tool-names.d.ts

@@ -9,6 +9,8 @@
  * the model would see a duplicate tool name and one tool would silently
  * shadow the other; every attach path refuses that instead
  * (findSameNamedAttachedTool), and the runner asserts it at load time.
+ * The same holds against an attached MCP server's exposed tool names
+ * (findSameNamedMcpTool); the runner leaves a clashing MCP tool out.
  */
 import type { Prisma, PrismaClient, Tool } from "#prisma";
 /** The runner's synthesized sub-agent tools are `delegate_to_<boundName>`. */
@@ -28,6 +30,17 @@ export type ToolLookupDb = Pick<PrismaClient | Prisma.TransactionClient, "tool"
  * is Serializable) so a concurrent attach can't slip in between.
  */
 export declare function findSameNamedAttachedTool(db: Pick<ToolLookupDb, "agentTool">, agentId: string, tool: Pick<Tool, "id" | "name">): Promise<Pick<Tool, "id" | "name" | "ownerId"> | null>;
+/**
+ * An MCP attachment of `agentId` whose exposed tool name (`<server>__<tool>`) equals `toolName`,
+ * or null: the other direction of attach_mcp_server's clash check, for every path that attaches a
+ * Tool. Every exposed name contains "__", so any other name needs no lookup.
+ */
+export declare function findSameNamedMcpTool(db: Pick<PrismaClient | Prisma.TransactionClient, "agentMcpServer">, agentId: string, toolName: string): Promise<{
+    serverId: string;
+    serverName: string;
+} | null>;
+/** The refusal for a Tool whose name is an exposed MCP tool name on the agent (findSameNamedMcpTool). */
+export declare function sameNamedMcpToolMessage(agentRef: string, toolName: string, serverName: string): string;
 /**
  * Resolves a CLI tool reference: an id, else a name. A name is no longer
  * unique across owners, so more than one match is refused -- with the

package/dist/core/tool-names.js

@@ -1,6 +1,7 @@
 import { MEMORY_TOOL_NAMES } from "./memory-tools.js";
 import { SUBAGENT_MEMORY_TOOL_NAMES } from "./subagent-memory-tools.js";
 import { ISSUE_TRACKER_TOOL_NAMES } from "./issue-tracker-tools.js";
+import { exposedNames } from "./mcp-servers.js";
 /** The runner's synthesized sub-agent tools are `delegate_to_<boundName>`. */
 export const DELEGATE_TOOL_PREFIX = "delegate_to_";
 /**
@@ -44,6 +45,25 @@ export async function findSameNamedAttachedTool(db, agentId, tool) {
     });
     return clash?.tool ?? null;
 }
+/**
+ * An MCP attachment of `agentId` whose exposed tool name (`<server>__<tool>`) equals `toolName`,
+ * or null: the other direction of attach_mcp_server's clash check, for every path that attaches a
+ * Tool. Every exposed name contains "__", so any other name needs no lookup.
+ */
+export async function findSameNamedMcpTool(db, agentId, toolName) {
+    if (!toolName.includes("__"))
+        return null;
+    const rows = await db.agentMcpServer.findMany({
+        where: { agentId },
+        select: { allowedTools: true, server: { select: { id: true, name: true } } },
+    });
+    const hit = rows.find((row) => exposedNames(row.server.name, row.allowedTools).includes(toolName));
+    return hit ? { serverId: hit.server.id, serverName: hit.server.name } : null;
+}
+/** The refusal for a Tool whose name is an exposed MCP tool name on the agent (findSameNamedMcpTool). */
+export function sameNamedMcpToolMessage(agentRef, toolName, serverName) {
+    return `Agent "${agentRef}" already has the tool "${toolName}" from MCP server "${serverName}"; detach it or allow a different tool first.`;
+}
 /**
  * Resolves a CLI tool reference: an id, else a name. A name is no longer
  * unique across owners, so more than one match is refused -- with the

package/dist/core/webhooks.d.ts

@@ -22,6 +22,9 @@ export type ResolveWebhookRunResult = {
 } | {
     ok: false;
     reason: "not_found" | "invalid_secret" | "disabled";
+} | {
+    ok: false;
+    reason: "invalid_repository";
 } | {
     ok: false;
     reason: "invalid_issue";
@@ -35,4 +38,5 @@ export type ResolveWebhookRunResult = {
 export declare function resolveWebhookRun(id: string, presentedSecret: string, db: PrismaClient, executor: Executor, codingTask?: string, opts?: {
     issue?: unknown;
     issueTrackers?: IssueTrackerRegistry;
+    repository?: string;
 }): Promise<ResolveWebhookRunResult>;

package/dist/core/webhooks.js

@@ -10,6 +10,7 @@
  */
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { AttributionError, explicitAttribution, RESPONSE_PATH_SNAPSHOT_BUDGET, } from "./attribution.js";
+import { RepositoryChoiceRefusedError } from "./coding-repository.js";
 import { dispatchRun } from "./dispatch.js";
 import { atLeast, effectiveAccess } from "./grants.js";
 function hashSecret(secret) {
@@ -81,6 +82,13 @@ export async function resolveWebhookRun(id, presentedSecret, db, executor, codin
     if (codingTask !== undefined && !taskAllowed(agent.kind, agent.codingProfile)) {
         return { ok: false, reason: "disabled" };
     }
+    // Choosing a repository takes the same opt-in as a task, and only a coding agent has one.
+    if (opts.repository !== undefined) {
+        if (agent.kind !== "coding")
+            return { ok: false, reason: "invalid_repository" };
+        if (!taskAllowed(agent.kind, agent.codingProfile))
+            return { ok: false, reason: "disabled" };
+    }
     // An invalid or unlinked issue refuses the call before any run exists.
     let attribution;
     if (opts.issue !== undefined) {
@@ -97,55 +105,66 @@ export async function resolveWebhookRun(id, presentedSecret, db, executor, codin
         }
     }
     let rejected = "disabled";
-    const dispatched = await dispatchRun({
-        db,
-        executor,
-        selfDefects: { db, issueTrackers: opts.issueTrackers },
-        agentId: agent.id,
-        trigger: "webhook",
-        attribution,
-        // Coding agents keep the existing per-agent opt-in (allowWebhookTaskOverride);
-        // a native agent's system prompt has no per-run input at all otherwise, so
-        // accepting task text over an authenticated webhook call needs no separate
-        // opt-in — it's a much lower-risk capability than a coding agent being told
-        // to modify a real repository.
-        codingTask: agent.kind === "coding" ? codingTask : undefined,
-        taskOverride: agent.kind === "native" ? codingTask : undefined,
-        // The webhook is its creator's standing trigger: its runs are visible to
-        // the creator (and the agent owner), like a trigger_agent call.
-        triggeredById: webhook.ownerId,
-        beforePersist: async (tx, currentAgent) => {
-            const current = await tx.webhook.findUnique({ where: { id } });
-            if (!current) {
-                rejected = "not_found";
-                return false;
-            }
-            if (!secretMatches(presentedSecret, current.secretHash)) {
-                rejected = "invalid_secret";
-                return false;
-            }
-            if (current.status !== "enabled") {
-                rejected = "disabled";
-                return false;
-            }
-            if (codingTask !== undefined && !taskAllowed(currentAgent.kind, currentAgent.codingProfile)) {
-                rejected = "disabled";
-                return false;
-            }
-            // The creator must still be allowed to trigger the agent (resource-
-            // sharing grants spec §3.10): its owner, or a holder of execute. Read
-            // through tx, so a revoke or make_owner takes effect on the next fire.
-            // A webhook on a formerly public agent keeps firing through the
-            // migration's everyone-execute grant.
-            const creatorAccess = await effectiveAccess(tx, "agent", currentAgent, current.ownerId);
-            if (!atLeast("agent", creatorAccess, "execute")) {
-                rejected = "disabled";
-                return false;
-            }
-            await tx.webhook.update({ where: { id }, data: { lastFiredAt: new Date() } });
-            return true;
-        },
-    });
+    let dispatched;
+    try {
+        dispatched = await dispatchRun({
+            db,
+            executor,
+            selfDefects: { db, issueTrackers: opts.issueTrackers },
+            agentId: agent.id,
+            trigger: "webhook",
+            attribution,
+            // Coding agents keep the existing per-agent opt-in (allowWebhookTaskOverride);
+            // a native agent's system prompt has no per-run input at all otherwise, so
+            // accepting task text over an authenticated webhook call needs no separate
+            // opt-in — it's a much lower-risk capability than a coding agent being told
+            // to modify a real repository.
+            codingTask: agent.kind === "coding" ? codingTask : undefined,
+            taskOverride: agent.kind === "native" ? codingTask : undefined,
+            codingRepository: agent.kind === "coding" ? opts.repository : undefined,
+            // The webhook is its creator's standing trigger: its runs are visible to
+            // the creator (and the agent owner), like a trigger_agent call.
+            triggeredById: webhook.ownerId,
+            beforePersist: async (tx, currentAgent) => {
+                const current = await tx.webhook.findUnique({ where: { id } });
+                if (!current) {
+                    rejected = "not_found";
+                    return false;
+                }
+                if (!secretMatches(presentedSecret, current.secretHash)) {
+                    rejected = "invalid_secret";
+                    return false;
+                }
+                if (current.status !== "enabled") {
+                    rejected = "disabled";
+                    return false;
+                }
+                if ((codingTask !== undefined || opts.repository !== undefined) &&
+                    !taskAllowed(currentAgent.kind, currentAgent.codingProfile)) {
+                    rejected = "disabled";
+                    return false;
+                }
+                // The creator must still be allowed to trigger the agent (resource-
+                // sharing grants spec §3.10): its owner, or a holder of execute. Read
+                // through tx, so a revoke or make_owner takes effect on the next fire.
+                // A webhook on a formerly public agent keeps firing through the
+                // migration's everyone-execute grant.
+                const creatorAccess = await effectiveAccess(tx, "agent", currentAgent, current.ownerId);
+                if (!atLeast("agent", creatorAccess, "execute")) {
+                    rejected = "disabled";
+                    return false;
+                }
+                await tx.webhook.update({ where: { id }, data: { lastFiredAt: new Date() } });
+                return true;
+            },
+        });
+    }
+    catch (err) {
+        // The refusal's message lists the agent's repositories; the caller gets only the code.
+        if (err instanceof RepositoryChoiceRefusedError)
+            return { ok: false, reason: "invalid_repository" };
+        throw err;
+    }
     if (!dispatched)
         return { ok: false, reason: rejected };
     return { ok: true, runId: dispatched.run.id };

package/dist/core/workflow-events.d.ts

@@ -1,7 +1,13 @@
-export declare const WORKFLOW_EVENT_KINDS: readonly ["issue_picked_up", "run_failed", "pr_opened", "review_posted", "review_fix", "pr_closed"];
+import type { PackageAuditDigest, PackageAuditMode } from "../coding/registry/audit-mode.js";
+import type { RegistryRefusalSummary } from "../coding/registry/report.js";
+export declare const WORKFLOW_EVENT_KINDS: readonly ["issue_picked_up", "run_failed", "run_blocked", "pr_opened", "review_posted", "review_fix", "pr_closed", "packages_audited"];
 export type WorkflowEventKind = (typeof WORKFLOW_EVENT_KINDS)[number];
 /** Template inputs per kind. Every string here may be shown in Slack (escaped). */
 export type WorkflowPayload = {
+    kind: "run_blocked";
+    agentName: string;
+    packageRefusals: RegistryRefusalSummary[];
+} | {
     kind: "issue_picked_up";
     agentName: string;
     trigger: string;
@@ -34,7 +40,11 @@ export type WorkflowPayload = {
     prUrl: string;
     merged: boolean;
     movedTo: string | null;
-};
+} | ({
+    kind: "packages_audited";
+    agentName: string;
+    mode: PackageAuditMode;
+} & PackageAuditDigest);
 /** What a thread's parent message shows about its subject. */
 export interface ThreadSubject {
     /** "PAY-241" or "org/repo#212" or "run abc123". */
@@ -44,11 +54,13 @@ export interface ThreadSubject {
 }
 export declare const dedupeKeys: {
     issuePickedUp: (runId: string) => string;
+    runBlocked: (runId: string) => string;
     runFailed: (runId: string) => string;
     prOpened: (codeProvider: string, repository: string, n: number) => string;
     reviewPosted: (runId: string) => string;
     reviewFix: (repository: string, n: number, round: number, state: "started" | "capped") => string;
     prClosed: (codeProvider: string, repository: string, n: number) => string;
+    packagesAudited: (runId: string) => string;
 };
 export declare const threadKeys: {
     issue: (provider: string, key: string) => string;

package/dist/core/workflow-events.js

@@ -2,18 +2,22 @@ import { logger } from "./logger.js";
 export const WORKFLOW_EVENT_KINDS = [
     "issue_picked_up",
     "run_failed",
+    "run_blocked",
     "pr_opened",
     "review_posted",
     "review_fix",
     "pr_closed",
+    "packages_audited",
 ];
 export const dedupeKeys = {
     issuePickedUp: (runId) => `issue_picked_up:${runId}`,
+    runBlocked: (runId) => `run_blocked:${runId}`,
     runFailed: (runId) => `run_failed:${runId}`,
     prOpened: (codeProvider, repository, n) => `pr_opened:${codeProvider}:${repository}#${n}`,
     reviewPosted: (runId) => `review_posted:${runId}`,
     reviewFix: (repository, n, round, state) => `review_fix:${repository}#${n}:${round}:${state}`,
     prClosed: (codeProvider, repository, n) => `pr_closed:${codeProvider}:${repository}#${n}`,
+    packagesAudited: (runId) => `packages_audited:${runId}`,
 };
 export const threadKeys = {
     issue: (provider, key) => `issue:${provider}:${key}`,

package/dist/core/workflow-run-events.d.ts

@@ -1,12 +1,14 @@
 /**
  * Workflow notifications a run's finalizer emits: run_failed for a top-level
- * run that did not succeed (children are summarized by their parent), and
+ * run that did not succeed, run_blocked for package refusals without changes
+ * (children are summarized by their parent), packages_audited when its coding
+ * children installed anything under package audit mode, and
  * review_posted when the run published a verdict on its own check. Called
  * only by the finalizer that made the run terminal. Never throws.
  */
 import type { PrismaClient } from "#prisma";
-export type RunEventsDb = Pick<PrismaClient, "agent" | "runHostCheck">;
-/** Emits run_failed (top-level, non-success) and review_posted (verdict published). Never throws. */
+export type RunEventsDb = Pick<PrismaClient, "agent" | "runHostCheck" | "run" | "runBudgetEvent" | "registryFetch" | "registryAuditRecord">;
+/** Emits top-level run outcomes and published review verdicts. Never throws. */
 export declare function emitRunFinishedEvents(db: RunEventsDb, run: {
     id: string;
     agentId: string;

package/dist/core/workflow-run-events.js

@@ -1,19 +1,55 @@
+import { pullRequestWebUrl } from "../coding/code-host.js";
+import { packageAuditDigest } from "../coding/registry/audit-mode.js";
+import { blockingRefusals, collectPackageAudit, collectRunOutcome, isBlockedByRefusals } from "./host-status.js";
 import { logger } from "./logger.js";
 import { dedupeKeys, emitWorkflowEvent, shortReason } from "./workflow-events.js";
 const log = logger.child({ module: "workflow-run-events" });
 const FAILED = new Set(["failed", "budget_exhausted", "cancelled", "lost", "refused"]);
 const VERDICTS = new Set(["APPROVE", "CHANGES_REQUESTED", "COMMENT"]);
-/** Emits run_failed (top-level, non-success) and review_posted (verdict published). Never throws. */
+/** Emits top-level run outcomes and published review verdicts. Never throws. */
 export async function emitRunFinishedEvents(db, run) {
     try {
         const agentName = (await db.agent.findUnique({ where: { id: run.agentId }, select: { name: true } }))?.name ?? run.agentId;
-        if (!run.parentRunId && FAILED.has(run.status)) {
-            await emitWorkflowEvent({
-                dedupeKey: dedupeKeys.runFailed(run.id),
-                runId: run.id,
-                agentId: run.agentId,
-                payload: { kind: "run_failed", agentName, status: run.status, reason: shortReason(run.error) },
-            });
+        if (!run.parentRunId) {
+            try {
+                // Only a succeeded run can be blocked (isBlockedByRefusals), so only it needs its children read.
+                const succeeded = { id: run.id, status: "succeeded", finalText: null };
+                const outcome = run.status === "succeeded" ? await collectRunOutcome(db, succeeded) : null;
+                if (outcome && isBlockedByRefusals(succeeded, outcome)) {
+                    await emitWorkflowEvent({
+                        dedupeKey: dedupeKeys.runBlocked(run.id),
+                        runId: run.id,
+                        agentId: run.agentId,
+                        payload: { kind: "run_blocked", agentName, packageRefusals: blockingRefusals(outcome) },
+                    });
+                }
+                // Any terminal status: what audit mode let in is worth knowing whether or not the run succeeded.
+                const audit = outcome ? outcome.packageAudit : await collectPackageAudit(db, run.id);
+                if (audit && audit.summary.entries.length > 0) {
+                    await emitWorkflowEvent({
+                        dedupeKey: dedupeKeys.packagesAudited(run.id),
+                        runId: run.id,
+                        agentId: run.agentId,
+                        payload: {
+                            kind: "packages_audited",
+                            agentName,
+                            mode: audit.mode,
+                            ...packageAuditDigest(audit.mode, audit.summary),
+                        },
+                    });
+                }
+            }
+            catch {
+                // A reporting read failure must not prevent other workflow events.
+            }
+            if (FAILED.has(run.status)) {
+                await emitWorkflowEvent({
+                    dedupeKey: dedupeKeys.runFailed(run.id),
+                    runId: run.id,
+                    agentId: run.agentId,
+                    payload: { kind: "run_failed", agentName, status: run.status, reason: shortReason(run.error) },
+                });
+            }
         }
         const check = await db.runHostCheck.findUnique({ where: { runId: run.id } });
         if (check?.verdict && VERDICTS.has(check.verdict) && check.prNumber !== null) {
@@ -28,7 +64,7 @@ export async function emitRunFinishedEvents(db, run) {
                     agentName,
                     verdict: check.verdict,
                     prLabel,
-                    prUrl: check.provider === "github" ? `https://github.com/${check.repository}/pull/${check.prNumber}` : null,
+                    prUrl: pullRequestWebUrl(check.provider, check.repository, check.prNumber),
                     ciPending: check.ciPendingAtReview === true,
                 },
             });

package/dist/core/zod-json-schema.d.ts

@@ -0,0 +1,4 @@
+export interface LegacyJsonSchemaOptions {
+    closeObjects?: boolean;
+}
+export declare function legacyJsonSchema(node: unknown, options?: LegacyJsonSchemaOptions): unknown;

package/dist/core/zod-json-schema.js

@@ -0,0 +1,39 @@
+function isStringKeySchema(value) {
+    return (!!value &&
+        typeof value === "object" &&
+        !Array.isArray(value) &&
+        Object.keys(value).length === 1 &&
+        value.type === "string");
+}
+export function legacyJsonSchema(node, options = {}) {
+    if (Array.isArray(node))
+        return node.map((item) => legacyJsonSchema(item, options));
+    if (!node || typeof node !== "object")
+        return node;
+    const source = node;
+    const out = {};
+    for (const [key, value] of Object.entries(source)) {
+        if (source.type === "integer" && key === "minimum" && value === Number.MIN_SAFE_INTEGER)
+            continue;
+        if (source.type === "integer" && key === "maximum" && value === Number.MAX_SAFE_INTEGER)
+            continue;
+        if (key === "propertyNames" && isStringKeySchema(value))
+            continue;
+        if (options.closeObjects &&
+            key === "additionalProperties" &&
+            value &&
+            typeof value === "object" &&
+            Object.keys(value).length === 0) {
+            out[key] = true;
+            continue;
+        }
+        // A `properties` map's keys are names, not keywords: only its values are schemas.
+        out[key === "oneOf" ? "anyOf" : key] =
+            key === "properties" && value && typeof value === "object"
+                ? Object.fromEntries(Object.entries(value).map(([name, sub]) => [name, legacyJsonSchema(sub, options)]))
+                : legacyJsonSchema(value, options);
+    }
+    if (options.closeObjects && source.type === "object" && "properties" in source && !("additionalProperties" in source))
+        out.additionalProperties = false;
+    return out;
+}

package/dist/core/zod3-window.d.ts

@@ -0,0 +1,35 @@
+import type { PrismaClient } from "#prisma";
+import { type Zod4Compatibility } from "../sandbox/zod-params.js";
+import type { SandboxResult } from "../sandbox/eval-core.js";
+export declare const ZOD3_WINDOW_ENDS = "Zod 3 schemas stop working in the next release";
+/** The warning for one paramsZod, or undefined when Zod 4 compiles it (or there is nothing to say). */
+export declare function zod3WindowWarning(subject: string, compatibility: Zod4Compatibility): string | undefined;
+/** How a warning names a tool. */
+export declare function toolSubject(name: string): string;
+export declare function cachedZod4Compatibility(paramsZod: string): Promise<Zod4Compatibility>;
+/** Test hook: empties the compatibility cache. */
+export declare function clearZod4CompatibilityCache(): void;
+/** The warnings for one tool's paramsZod (empty or one entry), ready for a result's `warnings`. */
+export declare function zod3ToolWarnings(subject: string, paramsZod: string): Promise<string[]>;
+/**
+ * A tool row with its Zod 3 window warnings, for a caller who owns it (and so
+ * already sees its paramsZod). Rows projected for anyone else, which carry no
+ * paramsZod, pass through unchanged: a warning would reveal part of the schema.
+ */
+export declare function withZod3ToolWarnings<T extends object>(projected: T): Promise<T | (T & {
+    warnings: string[];
+})>;
+/**
+ * dry_run_tool's check of a schema Zod 4 does compile: whether Zod 4 treats
+ * the sample arguments as the current release does. Names no values.
+ */
+export declare function zod3SampleArgsWarning(subject: string, current: SandboxResult, zod4: SandboxResult): string | undefined;
+interface WarnLog {
+    warn(fields: object, message: string): void;
+}
+/**
+ * Logs one warning per stored tool whose paramsZod Zod 4 can't compile. Runs
+ * in the background at startup; never throws.
+ */
+export declare function logZod3ToolWarnings(db: Pick<PrismaClient, "tool">, log: WarnLog): Promise<number>;
+export {};