feat(actions): agent_actions table + repo

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/db/migrations/016_agent_actions.sql

@@ -0,0 +1,19 @@
+-- 016_agent_actions.sql — queue + audit trail for Little Blue's infra actions.
+-- Risky actions land here as 'pending' for owner approval; every executed action
+-- (safe or approved-risky) is recorded with its result. Deliberately separate from
+-- pending_changes (entity CRUD) to isolate command execution.
+CREATE TABLE agent_actions (
+  id           uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  action_id    text NOT NULL,                 -- whitelist id from config/actions.json
+  params       jsonb NOT NULL DEFAULT '{}'::jsonb,
+  agent_id     uuid REFERENCES agents(id),
+  tier         text NOT NULL CHECK (tier IN ('safe','risky')),
+  status       text NOT NULL DEFAULT 'pending'
+               CHECK (status IN ('pending','executed','failed','rejected')),
+  result       jsonb,
+  requested_by jsonb,
+  resolved_by  jsonb,
+  created_at   timestamptz NOT NULL DEFAULT now(),
+  resolved_at  timestamptz
+);
+CREATE INDEX idx_agent_actions_pending ON agent_actions(status) WHERE status='pending';

lib/db/repos/agent_actions.js

@@ -0,0 +1,38 @@
+import { pool } from '../pool.js';
+import { recordAudit } from './audit.js';
+
+export async function create({ action_id, tier, params, agent_id, requested_by }) {
+  const { rows: [r] } = await pool.query(
+    `INSERT INTO agent_actions(action_id, tier, params, agent_id, requested_by)
+     VALUES($1,$2,$3,$4,$5) RETURNING *`,
+    [action_id, tier, params || {}, agent_id || null, requested_by || null]
+  );
+  await recordAudit(requested_by, 'create', 'agent_action', r.id, null, r);
+  return r;
+}
+
+export async function listPending({ limit = 100 } = {}) {
+  const { rows } = await pool.query(
+    `SELECT * FROM agent_actions WHERE status='pending' ORDER BY created_at LIMIT $1`, [limit]);
+  return rows;
+}
+
+export async function getById(id) {
+  const { rows: [r] } = await pool.query(`SELECT * FROM agent_actions WHERE id=$1`, [id]);
+  return r;
+}
+
+export async function resolve(id, status, result, resolved_by) {
+  const { rows: [r] } = await pool.query(
+    `UPDATE agent_actions SET status=$1, result=$2, resolved_by=$3, resolved_at=now()
+     WHERE id=$4 AND status='pending' RETURNING *`,
+    [status, result || null, resolved_by || null, id]);
+  if (r) await recordAudit(resolved_by, 'update', 'agent_action', id, null, r);
+  return r;
+}
+
+export async function recent({ limit = 50 } = {}) {
+  const { rows } = await pool.query(
+    `SELECT * FROM agent_actions WHERE status<>'pending' ORDER BY resolved_at DESC NULLS LAST LIMIT $1`, [limit]);
+  return rows;
+}