@wardby/cli 0.7.0 → 0.9.0

package/dist/core/run-steps/writer.js

@@ -0,0 +1,279 @@
+/**
+ * The one writer of RunStep rows. Every source hands it batches (RunStepSink). Before anything is
+ * stored, each step's text is redacted by exact value against the secret values the loader covers:
+ * the agent's secrets (readable and brokered) and its attached MCP servers' secrets, the same source
+ * the transcript recorder uses; run capabilities are masked by token shape. The native-sandbox
+ * gateway capability is passed by the gateway as `extraSecretValues` and redacted the same way. A batch whose run's secret values
+ * can't be read writes nothing (fail closed). A step whose kind is unknown, whose callId is invalid or
+ * would change under redaction is dropped and not counted in stepsDropped; only steps past the cap are
+ * counted, once per callId. One run's batches are written in arrival order, within one process only
+ * (step/result ordering across processes is not guaranteed), under a row lock on the run, so seq has
+ * no gaps or duplicates whichever process writes. Known limits: a dropped step may be counted again
+ * after a process restart, after its run is evicted from the remembered set, past the per-run id
+ * limit, or when two processes write the same run. A result is matched only to a stored callId, which
+ * is already clean, so a result's callId is never persisted. At the detail level (the run's
+ * Run.runStepsLevel, fixed at dispatch), each step's detail text is redacted the same way
+ * (stepDetailer) before it is cut and stored; below it, detail material in a batch is dropped
+ * unread. Step text, input and output lose terminal control sequences and control characters
+ * (plainText: exact values masked on the raw text first, then stripControlSequences, then the full
+ * redaction), so no reader is sent an escape sequence. Log lines
+ * carry the run id, a fixed event code and an error's name: never text, never an error's message.
+ */
+import { createHash } from "node:crypto";
+import { REDACTED, redactSecrets } from "../../coding/redact.js";
+import { logger } from "../logger.js";
+import { loadAgentSecretValues } from "../secret-guard.js";
+import { MIN_REDACTABLE_SECRET_LENGTH } from "../secret-spans.js";
+import { loadRunStepRetentionDays, loadRunStepsLevel, recordedRunStepsLevel } from "./config.js";
+import { stripControlSequences } from "./control-chars.js";
+import { joinDetail, stepDetailer } from "./detail.js";
+import { stepSummarizer } from "./summarize.js";
+import { MAX_RUN_STEPS, MAX_STEP_DETAIL_CHARS, STEP_CALL_ID, STEP_STATUS, STEP_TOOL_NAME, tailOf, } from "./types.js";
+const stepsLog = logger.child({ module: "run-steps" });
+const DAY_MS = 24 * 60 * 60 * 1000;
+const TX = { maxWait: 5_000, timeout: 10_000 };
+/** How long flush() waits for queued writes at shutdown. */
+export const FLUSH_TIMEOUT_MS = 5_000;
+/** Over-cap callIds remembered (as 32-character hashes): at most this many per run and in all. */
+const DROPPED_PER_RUN = 10_000;
+const DROPPED_TOTAL = 200_000;
+const callKey = (callId) => createHash("sha256").update(callId).digest("hex").slice(0, 32);
+function uniqueByCallId(steps) {
+    const seen = new Set();
+    return steps.filter((step) => {
+        if (!STEP_CALL_ID.test(step.callId) || seen.has(step.callId))
+            return false;
+        seen.add(step.callId);
+        return true;
+    });
+}
+/** A private-use character: stands in for a masked value while control sequences are stripped. */
+const HELD = "\uE000";
+/**
+ * Untrusted text as plain text, safely: every secret value is masked on the raw text first, whole
+ * and partial (StepDetailer.premask: the text's edges and every line and ellipsis boundary), then
+ * control sequences are stripped (stripControlSequences), and only then does the full redaction
+ * run. Stripping first could take a secret's first character as a malformed sequence's final byte
+ * (`ESC Z` + value) and leave the rest of it matching nothing; the full redaction after the strip
+ * still masks a value that only the strip joined (one split by colour codes). The mask is a
+ * placeholder no sequence pattern can take as a byte of its own (a sequence before `[REDACTED]`
+ * would eat its "["), swapped for the marker after the strip.
+ */
+function plainText(raw, premask, headWasCut = false) {
+    if (!premask)
+        return stripControlSequences(raw);
+    const held = premask(raw.replaceAll(HELD, ""), headWasCut, HELD);
+    return stripControlSequences(held).replaceAll(HELD, REDACTED);
+}
+/**
+ * A result's detail suffix: its end taken from the raw output first (tailOf), so the premask's head
+ * check runs at the cut the detailer will see, then plainText, then the detailer.
+ */
+function plainOutput(raw, outputCut, premask, detailer) {
+    const source = tailOf(raw);
+    const cut = outputCut || source.cut;
+    return detailer.output({ output: plainText(source.text, premask, cut), outputCut: cut });
+}
+/** `step` without its detail-only input. */
+function withoutInput(step) {
+    if (step.kind !== "tool" || step.input === undefined)
+        return step;
+    const { input: _input, inputTruncated: _inputTruncated, ...rest } = step;
+    return rest;
+}
+/** A step's text and input as plainText. */
+function plainStep(step, premask) {
+    if (step.kind === "said")
+        return { ...step, text: plainText(step.text, premask) };
+    const input = step.input === undefined ? {} : { input: plainText(step.input, premask) };
+    return { ...step, text: plainText(step.text, premask), ...input };
+}
+function safeToolName(tool, secretValues) {
+    const shown = redactSecrets(tool, secretValues);
+    return STEP_TOOL_NAME.test(shown) ? shown : "tool";
+}
+export class RunStepWriter {
+    deps;
+    queues = new Map();
+    /**
+     * Hashes of the callIds already counted in stepsDropped, so history resent past the cap is not
+     * counted again. Least recently used run first; bounded in total, whatever the ids' length.
+     */
+    droppedIds = new Map();
+    constructor(deps) {
+        this.deps = deps;
+    }
+    record(runId, batch, extraSecretValues = []) {
+        if (this.deps.level === "off")
+            return Promise.resolve();
+        if (batch.steps.length === 0 && batch.results.length === 0)
+            return Promise.resolve();
+        const previous = this.queues.get(runId) ?? Promise.resolve();
+        const next = previous
+            .then(() => this.write(runId, batch, extraSecretValues))
+            .catch((err) => {
+            (this.deps.log ?? stepsLog).warn({ runId, event: "run_steps_write_failed", errorName: err instanceof Error ? err.name : typeof err }, "could not record a run's steps; they were dropped");
+        });
+        this.queues.set(runId, next);
+        void next.then(() => {
+            if (this.queues.get(runId) === next)
+                this.queues.delete(runId);
+        });
+        return next;
+    }
+    /**
+     * Resolves when every write queued so far has settled, or after `timeoutMs`: called before the
+     * process disconnects from the database, so a run's last steps are not cut off. Never rejects.
+     */
+    async flush(timeoutMs = FLUSH_TIMEOUT_MS) {
+        const pending = [...this.queues.values()];
+        if (pending.length === 0)
+            return;
+        let timer;
+        const bound = new Promise((resolve) => {
+            timer = setTimeout(resolve, timeoutMs);
+        });
+        try {
+            await Promise.race([Promise.allSettled(pending), bound]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    now() {
+        return (this.deps.now ?? (() => new Date()))();
+    }
+    async write(runId, batch, extraSecretValues) {
+        const { db } = this.deps;
+        const run = await db.run.findUnique({ where: { id: runId }, select: { agentId: true, runStepsLevel: true } });
+        if (!run)
+            return;
+        const level = recordedRunStepsLevel(run.runStepsLevel, this.deps.level);
+        if (level === "off")
+            return;
+        const detailed = level === "detail";
+        // Below detail a tool's input is never stored, so it is dropped here, before any redaction.
+        const extracted = uniqueByCallId(batch.steps.filter((step) => step.kind === "tool" || step.kind === "said")).map((step) => (detailed ? step : withoutInput(step)));
+        const results = batch.results.filter((r) => STEP_CALL_ID.test(r.callId) && STEP_STATUS.test(r.status));
+        const outputs = detailed && results.some((r) => typeof r.output === "string");
+        // Read fresh for every batch that stores text (steps, or outputs at detail), never cached: a
+        // rotated or newly attached secret must be covered. Rejects (and the batch is dropped) when the
+        // values can't be read: never an unredacted write.
+        const needsValues = extracted.length > 0 || outputs;
+        const own = needsValues ? await this.deps.secretValues(run.agentId) : [];
+        const extras = needsValues ? extraSecretValues.filter(Boolean) : [];
+        const rawValues = [...own, ...extras];
+        // Each value also as plain text, as the step text is: a value holding a control character
+        // (never a stripped form too short to redact safely).
+        const values = [
+            ...new Set(rawValues.flatMap((value) => {
+                const plain = stripControlSequences(value);
+                return plain.length >= MIN_REDACTABLE_SECRET_LENGTH ? [value, plain] : [value];
+            })),
+        ];
+        // The summary forms are built once per batch, on the first row; the detailer (whose premask
+        // every text goes through first) once per batch that has any secret value.
+        let summarize;
+        let detailer;
+        const detailOf = () => (detailer ??= stepDetailer(values));
+        const premask = values.length > 0 ? (raw, headWasCut, marker) => detailOf().premask(raw, headWasCut, marker) : undefined;
+        const steps = extracted.map((step) => plainStep(step, premask));
+        const at = this.now();
+        const expiresAt = new Date(at.getTime() + this.deps.retentionDays * DAY_MS);
+        // callId is stored as text: a step whose callId holds a secret value is not stored at all.
+        const clean = steps.filter((step) => redactSecrets(step.callId, values) === step.callId);
+        const rows = clean.map((step) => ({
+            kind: step.kind,
+            tool: step.kind === "tool" ? safeToolName(step.tool, values) : null,
+            callId: step.callId,
+            summary: (summarize ??= stepSummarizer(values))(step),
+            detail: detailed ? detailOf().step(step).slice(0, MAX_STEP_DETAIL_CHARS) : null,
+            at,
+            expiresAt,
+        }));
+        const maxSteps = this.deps.maxSteps ?? MAX_RUN_STEPS;
+        const counted = this.droppedIds.get(runId) ?? new Set();
+        if (this.droppedIds.has(runId)) {
+            this.droppedIds.delete(runId);
+            this.droppedIds.set(runId, counted);
+        }
+        // Each result's detail suffix, computed before the transaction: redaction is CPU work, and the
+        // transaction holds the run's row lock.
+        const suffixes = results.map((result) => outputs && typeof result.output === "string"
+            ? plainOutput(result.output, result.outputCut === true, premask, detailOf())
+            : undefined);
+        const newlyDropped = [];
+        await db.$transaction(async (tx) => {
+            await tx.$queryRaw `SELECT 1 FROM "Run" WHERE "id" = ${runId} FOR UPDATE`;
+            if (rows.length > 0) {
+                const existing = await tx.runStep.findMany({
+                    where: { runId, callId: { in: rows.map((row) => row.callId) } },
+                    select: { callId: true },
+                });
+                const known = new Set(existing.map((row) => row.callId));
+                const fresh = rows.filter((row) => !known.has(row.callId));
+                const last = await tx.runStep.findFirst({ where: { runId }, orderBy: { seq: "desc" }, select: { seq: true } });
+                const start = last?.seq ?? 0;
+                const kept = fresh.slice(0, Math.max(0, maxSteps - start));
+                if (kept.length > 0) {
+                    await tx.runStep.createMany({ data: kept.map((row, index) => ({ ...row, runId, seq: start + index + 1 })) });
+                }
+                const over = fresh.slice(kept.length).filter((row) => !counted.has(callKey(row.callId)));
+                newlyDropped.push(...over.map((row) => row.callId));
+                const dropped = over.length;
+                if (dropped > 0)
+                    await tx.run.update({ where: { id: runId }, data: { stepsDropped: { increment: dropped } } });
+            }
+            for (const [index, result] of results.entries()) {
+                const suffix = suffixes[index];
+                if (suffix === undefined) {
+                    // The first status wins: a result resent with the history, or replayed, changes nothing.
+                    await tx.runStep.updateMany({
+                        where: { runId, callId: result.callId, kind: "tool", status: null },
+                        data: { status: result.status },
+                    });
+                    continue;
+                }
+                const open = await tx.runStep.findFirst({
+                    where: { runId, callId: result.callId, kind: "tool", status: null },
+                    select: { id: true, detail: true },
+                });
+                if (!open)
+                    continue;
+                await tx.runStep.update({
+                    where: { id: open.id },
+                    data: { status: result.status, detail: joinDetail(open.detail, suffix) },
+                });
+            }
+        }, TX);
+        if (newlyDropped.length > 0)
+            this.rememberDropped(runId, counted, newlyDropped);
+    }
+    rememberDropped(runId, counted, ids) {
+        const limits = this.deps.droppedLimits ?? { perRun: DROPPED_PER_RUN, total: DROPPED_TOTAL };
+        for (const id of ids)
+            if (counted.size < limits.perRun)
+                counted.add(callKey(id));
+        this.droppedIds.delete(runId);
+        this.droppedIds.set(runId, counted);
+        while (this.rememberedDroppedCount() > limits.total && this.droppedIds.size > 1) {
+            this.droppedIds.delete(this.droppedIds.keys().next().value);
+        }
+    }
+    /** How many dropped callIds are remembered in all (tests). */
+    rememberedDroppedCount() {
+        let total = 0;
+        for (const set of this.droppedIds.values())
+            total += set.size;
+        return total;
+    }
+}
+/** The process's writer: settings from the environment (an invalid value throws, naming it). */
+export function buildRunStepWriter(db, cipher, env = process.env) {
+    return new RunStepWriter({
+        db,
+        level: loadRunStepsLevel(env),
+        retentionDays: loadRunStepRetentionDays(env),
+        secretValues: async (agentId) => (await loadAgentSecretValues(db, cipher, agentId)).flatMap((entry) => entry.values),
+    });
+}

package/dist/core/runner.d.ts

@@ -21,6 +21,7 @@ import { Prisma, type PrismaClient, type Run, type RunTrigger } from "#prisma";
 import type { ProviderRegistry } from "../providers/index.js";
 import type { EngineProgress, EngineResult, LoadedTool } from "../providers/engine/types.js";
 import { RunOwnershipLostError, type StepRunner } from "../providers/engine/types.js";
+import type { RunStepSink } from "./run-steps/types.js";
 import { type PrivilegedHost } from "../sandbox/host-functions.js";
 import type { safeFetch } from "../sandbox/safe-fetch.js";
 import { type RunDrivability, type WorkerLauncher } from "../native-worker/gateway.js";
@@ -36,6 +37,42 @@ import { ReviewReadLedger } from "./review-reads.js";
 import { type RepoAccessGate } from "./repo-access.js";
 import { type BudgetEventView } from "./budget-events.js";
 export declare const runnerLog: import("pino").Logger<never, boolean>;
+/**
+ * Sub-agent dispatch uses one synthetic tool per declared child, named by the
+ * boundName it's attached
+ * under. The parent's tool call blocks until the child run reaches a
+ * terminal state, and its result comes back as this tool call's result.
+ * A run delegates at most maxDelegationsPerRun times (default one: a
+ * classifier deciding plan-vs-implement commits to exactly one child) and to
+ * each child at most once. With Agent.parallelDelegations, the delegate_to_*
+ * calls of one turn run at the same time (NativeEngine.runToolCalls); their
+ * admission (the checks below plus the child row) is still one at a time,
+ * through the run's delegation gate, and a child refused for budget while a
+ * sibling runs waits for that sibling to finish (delegation-siblings.ts).
+ *
+ * Two execution paths depending on the child's `kind`:
+ * - `native`: calls `executeRun` directly, bypassing any `Executor` — the
+ *   created Run row is never marked `executionManaged`, so the reconciler
+ *   leaves it alone even if it runs long, the same way an attended
+ *   `wardby run` foreground execution does. Fast, in-process, no durability
+ *   machinery needed for a native turn loop.
+ * - `coding`: a coding-kind child needs a real Docker container (Codex),
+ *   which `executeRun` explicitly refuses to drive itself. Goes through
+ *   `dispatchRun` (the same persistence path webhooks/trigger_agent use)
+ *   with `awaitExecution: true`, so the already-existing `RoutingExecutor`
+ *   sends it to the container backend and this call blocks until it's
+ *   terminal — reusing proven infrastructure rather than re-implementing
+ *   container dispatch. Marked `executionManaged: true` here (unlike the
+ *   native path) since a long-running container crash mid-dispatch is
+ *   exactly the case the reconciler exists for. Under the coding
+ *   concurrency cap `Executor.start` can resolve with the child merely
+ *   queued (still pending), so the call then polls the child row until it
+ *   is terminal — see `waitForCodingChild`.
+ *
+ * The `delegate_to_` prefix lives in core/tool-names.ts, which reserves it
+ * so no user tool can be created under a name this dispatch would shadow.
+ */
+export declare function delegateToolDef(boundName: string, parallel: boolean, repositories?: readonly string[]): LoadedTool;
 declare const DelegateArgs: z.ZodObject<{
     task: z.ZodString;
     datastoreRef: z.ZodOptional<z.ZodObject<{
@@ -45,6 +82,7 @@ declare const DelegateArgs: z.ZodObject<{
     grantParentMemoryKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
     continuePriorRun: z.ZodOptional<z.ZodString>;
     mergeOrder: z.ZodOptional<z.ZodNumber>;
+    repository: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 /** A delegate_to_* call's arguments, or the tool result refusing them. */
 export declare function parseDelegateArgs(argsJson: string): {
@@ -52,18 +90,6 @@ export declare function parseDelegateArgs(argsJson: string): {
 } | {
     refusal: string;
 };
-/**
- * At most `limit` dispatches per run (default one: a classifier deciding plan-vs-implement
- * commits to exactly one child), and never the same child twice, so a retry can't leave two
- * children racing on the same task. A delegation waiting for budget holds its place.
- */
-export declare function delegationLimitRefusal(input: {
-    priorChildAgentIds: readonly string[];
-    waitingChildAgentIds: readonly string[];
-    childAgentId: string;
-    boundName: string;
-    limit: number;
-}): string | null;
 declare const DELEGATION_CHILD_SELECT: {
     readonly id: true;
     readonly kind: true;
@@ -71,10 +97,13 @@ declare const DELEGATION_CHILD_SELECT: {
     readonly budgetUsd: true;
     readonly ownerId: true;
     readonly nativeExecutionMode: true;
+    readonly runSteps: true;
     readonly codingProfile: {
         readonly select: {
             readonly allowWebhookTaskOverride: true;
             readonly timeoutSec: true;
+            readonly repository: true;
+            readonly baseRef: true;
         };
     };
 };
@@ -105,7 +134,7 @@ export declare function nativeChildResult(run: Pick<Run, "status" | "finalText"
  * also satisfies `dispatch.ts`'s `DispatchDb`, needed for dispatching a
  * coding-kind sub-agent from inside a running native turn loop.
  */
-export type RunnerDb = Pick<PrismaClient, "agent" | "run" | "agentTool" | "agentSecret" | "agentDatastore" | "budgetGroup" | "agentSubAgent" | "resourceGrant" | "codingRun" | "registryFetch" | "registryAuditRecord" | "task" | "webhook" | "$transaction" | "$queryRaw" | "agentRepository" | "runModelUsage" | "runHostCheck" | "runBudgetEvent" | "runHostStatus" | "hostIdentity" | "agentIssueProject" | "issuePullRequest" | "runIssueStatus" | "issueFingerprint" | "workItem" | "deferredReview" | "runAttribution">;
+export type RunnerDb = Pick<PrismaClient, "agent" | "run" | "agentTool" | "agentSecret" | "agentMcpServer" | "secret" | "agentDatastore" | "budgetGroup" | "agentSubAgent" | "resourceGrant" | "codingRun" | "registryFetch" | "registryAuditRecord" | "task" | "webhook" | "$transaction" | "$queryRaw" | "agentRepository" | "runModelUsage" | "runHostCheck" | "runBudgetEvent" | "runHostStatus" | "hostIdentity" | "agentIssueProject" | "issuePullRequest" | "runIssueStatus" | "issueFingerprint" | "workItem" | "deferredReview" | "runAttribution">;
 /** The providers a native run needs; `executor`, `reviewHosts` and `issueTrackers` are optional capabilities. */
 export type NativeRunProviders = Pick<ProviderRegistry, "llm" | "engine" | "datastore" | "secrets" | "memory"> & {
     executor?: ProviderRegistry["executor"];
@@ -121,6 +150,8 @@ export type NativeRunProviders = Pick<ProviderRegistry, "llm" | "engine" | "data
     nativeSandbox?: WorkerLauncher;
     /** Overrides the sandbox's outbound network call — tests only. */
     sandboxFetch?: typeof safeFetch;
+    /** Records runs' steps (src/core/run-steps/writer.ts); absent = no steps are recorded. */
+    runSteps?: RunStepSink;
 };
 /**
  * Raised when a run's step boundary observed a cancellation (DbosExecutor's
@@ -262,8 +293,6 @@ export interface LoadNativeRunOptions {
  * order diverges from the record.
  */
 export declare function loadNativeRun(options: LoadNativeRunOptions): Promise<{
-    repositoryLinks: RepositoryLink[];
-    issueProjectLinks: IssueProjectLink[];
     agent: {
         untrustedContext?: string | undefined;
         effort?: "low" | "medium" | "high" | "xhigh" | "max" | undefined;
@@ -275,6 +304,7 @@ export declare function loadNativeRun(options: LoadNativeRunOptions): Promise<{
     tools: LoadedTool[];
     toolsByName: {
         [k: string]: {
+            timeoutMs?: number | undefined;
             code: string;
             paramsZod: string;
             allowedSecrets: string[];
@@ -283,6 +313,9 @@ export declare function loadNativeRun(options: LoadNativeRunOptions): Promise<{
             allowedSharedDatastorePrefixes: Record<string, string[]>;
         };
     };
+    mcpTools?: import("./mcp-tools.js").McpToolPin[] | undefined;
+    repositoryLinks: RepositoryLink[];
+    issueProjectLinks: IssueProjectLink[];
     parallelDelegations?: boolean | undefined;
     maxDelegationsPerRun?: number | undefined;
     agentId: string;
@@ -311,6 +344,8 @@ export interface NativeRunToolsOptions {
     issueTrackers: IssueTrackerRegistry | undefined;
     /** What earlier requests of this run read (a sandbox run's gateway restores it per request); fresh otherwise. */
     reviewReads?: ReviewReadLedger;
+    /** A sandboxed run's session deadline (the gateway's); an MCP tool call never runs past it. */
+    deadlineAt?: Date;
 }
 /** An attached user tool as the load step pinned it: its code, schema, and consented capabilities. */
 export type LoadedUserTool = LoadedNativeRun["toolsByName"][string];
@@ -336,6 +371,7 @@ export declare function readRedactionValues(accessor: SecretsAccessor, names: re
  */
 export declare function createNativeRunTools(options: NativeRunToolsOptions): {
     toolsByName: Map<string, {
+        timeoutMs?: number | undefined;
         code: string;
         paramsZod: string;
         allowedSecrets: string[];
@@ -348,6 +384,13 @@ export declare function createNativeRunTools(options: NativeRunToolsOptions): {
     readableSecretValues: (name: string) => Promise<string[]>;
     runUserTool: (name: string, argsJson: string) => Promise<string>;
     runSandboxTool: (name: string, argsJson: string, callId?: string) => Promise<string>;
+    toolTimeoutMs: (name: string) => number | undefined;
+    watchStop: () => {
+        signal: AbortSignal;
+        done: () => void;
+    };
+    /** Every secret value of the agent's attached MCP servers (never handed to a worker; redaction only). */
+    mcpSecretValues: () => Promise<string[]>;
 };
 /**
  * Live progress for observers (MCP get_run, the viewer). Absolute totals, so a DBOS replay
@@ -374,6 +417,17 @@ export declare function finishNativeRun(ctx: NativeRunFinishContext, model: stri
 export declare function failNativeRun(ctx: NativeRunFinishContext, err: unknown): Promise<Run>;
 /** The terminal write for a run that cannot continue (it ends `lost` with `reason`), then the same settle path. */
 export declare function loseNativeRun(ctx: NativeRunFinishContext, reason: string): Promise<Run>;
+/** How often a user tool call in progress checks whether its run was stopped. */
+export declare const TOOL_STOP_POLL_MS = 2000;
+/**
+ * Aborts `signal` once the run is no longer drivable (stop_run, a cancelled task, a parent's
+ * stop). Polls every `intervalMs`, starting one interval in, so a quick call reads nothing; a
+ * failed read changes nothing and the next tick reads again. `done()` stops the polling.
+ */
+export declare function watchRunStop(db: RunnerDb, runId: string, intervalMs?: number): {
+    signal: AbortSignal;
+    done: () => void;
+};
 /** Where a run stands for the native gateway: still drivable, cancelled (its task), or otherwise ended. */
 export declare function runDrivability(db: RunnerDb, runId: string): Promise<RunDrivability>;
 /**
@@ -383,7 +437,7 @@ export declare function runDrivability(db: RunnerDb, runId: string): Promise<Run
  */
 export declare function sandboxWorkerInput(runId: string, loaded: LoadedNativeRun, tools: Pick<ReturnType<typeof createNativeRunTools>, "builtinHandler" | "toolsByName">): WorkerInput;
 /** What the durable delegation needs from the gateway ledger (src/native-worker/ledger.ts). */
-export type DelegationLedger = Pick<PrismaGatewayLedger, "claim" | "recordResult" | "setDelegation" | "delegation" | "waitingChildAgentIds">;
+export type DelegationLedger = Pick<PrismaGatewayLedger, "claim" | "recordResult" | "setDelegation" | "delegation" | "waitingDelegations">;
 export interface DurableDelegationContext {
     runId: string;
     existingRun: Run;