* feat: add force_sandboxing global setting and #sandbox bash annotation
Add a new global setting `force_sandboxing` to enable nsjail sandboxing
for all jobs, overriding the DISABLE_NSJAIL environment variable.
Also add a #sandbox annotation for bash scripts to enable sandboxing
on a per-script basis.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: decouple nsjail probing from DISABLE_NSJAIL and apply force_sandboxing to all executors
NSJAIL_AVAILABLE now always probes for the nsjail binary at startup
regardless of the DISABLE_NSJAIL policy flag, fixing #sandbox annotation
and force_sandboxing being unusable in default (DISABLE_NSJAIL=true)
configuration. All language executors now use is_sandboxing_enabled()
instead of checking DISABLE_NSJAIL directly, so force_sandboxing
applies to all job types, not just bash.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: clarify force_sandboxing and DISABLE_NSJAIL relationship
Neither setting overrides the other — sandboxing is enabled when either
force_sandboxing=true OR DISABLE_NSJAIL=false. Updated frontend
description and backend comments to reflect this.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
* all
* revert typo
* all
* all
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* Improve CLAUDE.md instructions and compact DB schema summary
- Add code validation instructions (cargo check, npm run check) to all
CLAUDE.md files with guidance to use only relevant feature flags
- Reference backend/CLAUDE.md and frontend/CLAUDE.md paths from root
- Add database querying guidance (psql commands for exact table info)
- Compact summarize_schema.py output: inline columns, shorten types,
one-line enums, drop indexes (use psql \d for exact info)
- Fix FK parsing for multi-line ALTER TABLE statements
- Result: schema summary reduced from 1514 lines/40KB to 194 lines/23KB
* cleaning
* fix: use prefix-based type abbreviations and filter CONSTRAINT pseudo-columns
- Change TYPE_ABBREVIATIONS matching from exact to prefix-based so
parametrized types (character(64) -> char(64)) and array types
(integer[] -> int[], real[] -> float[]) are properly abbreviated
- Skip CONSTRAINT lines inside CREATE TABLE blocks that were being
incorrectly matched as columns by the column regex
- Update summarized_schema.txt to reflect both changes
Co-authored-by: centdix <centdix@users.noreply.github.com>
---------
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: centdix <centdix@users.noreply.github.com>
* Add AWS Bedrock session token support in API and worker
* Add Bedrock auth mode integration tests for AI agents
* Split Bedrock integration test env vars for IAM and session creds
* cleaning
* Add masked Bedrock bearer-token debug info logs
* Revert "Add masked Bedrock bearer-token debug info logs"
This reverts commit 6b2fc5e7c2d5b1c6db81f416a4439941a084108c.
* cleaning
* fix: replace leftover common:: references in dependency_map test
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: add missing deno_core/mcp features and gate dead code in permissions test
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat(ai): support 1M context window for Anthropic resources
Add `enable_1m_context` boolean field to Anthropic resource configuration.
When enabled (and not using Vertex AI), sends the `anthropic-beta: context-1m-2025-08-07`
header in both the API proxy layer and the AI agent worker layer.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(ai): add serde alias for enable_1M_context DB field name
The resource_type schema uses `enable_1M_context` (uppercase M) but
serde only matched `enable_1m_context` and `enable1mContext`, causing
the field to always deserialize as false.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Ruben Fiszel
Pyra
hugocasa
Alexander Petric
centdix
Devdatta Talele