feat: add otel-host-agent and archon stacks, update signoz

2026-05-31 11:28:15 +08:00
parent 53b841926e
commit b7d3248b37
14 changed files with 886 additions and 26 deletions
@@ -56,6 +56,7 @@ These services require building custom Docker images from source.
 | [Apache Kafka](./src/kafka)                                    | 7.8.0               |
 | [Apache Pulsar](./src/pulsar)                                  | 4.0.7               |
 | [Apache RocketMQ](./src/rocketmq)                              | 5.3.1               |
+| [Archon](./apps/archon)                                        | latest              |
 | [Agentgateway](./src/agentgateway)                             | 0.11.2              |
 | [AnythingLLM](./src/anythingllm)                               | latest              |
 | [Bifrost Gateway](./src/bifrost-gateway)                       | v1.4.17             |
@@ -56,6 +56,7 @@ docker compose exec redis redis-cli ping
 | [Apache Kafka](./src/kafka)                                    | 7.8.0               |
 | [Apache Pulsar](./src/pulsar)                                  | 4.0.7               |
 | [Apache RocketMQ](./src/rocketmq)                              | 5.3.1               |
+| [Archon](./apps/archon)                                        | latest              |
 | [Agentgateway](./src/agentgateway)                             | 0.11.2              |
 | [AnythingLLM](./src/anythingllm)                               | latest              |
 | [Bifrost Gateway](./src/bifrost-gateway)                       | v1.4.17             |
@@ -0,0 +1,101 @@
+# Global registry prefix (optional)
+# GLOBAL_REGISTRY=
+
+# Service versions
+# The official pre-built Archon image is currently published as the latest tag.
+ARCHON_VERSION=latest
+POSTGRES_VERSION=17-alpine
+
+# Timezone
+TZ=UTC
+
+# Host port overrides
+ARCHON_PORT_OVERRIDE=3000
+POSTGRES_PORT_OVERRIDE=5432
+
+# Archon listener settings inside the container
+PORT=3000
+HOST=0.0.0.0
+
+# AI assistant credentials
+# Docker deployments should use explicit credentials instead of relying on host auth.
+CLAUDE_USE_GLOBAL_AUTH=false
+
+# Claude OAuth token (recommended for Docker)
+CLAUDE_CODE_OAUTH_TOKEN=sk-ant-oat01-xxxxx
+
+# Claude API key (alternative to OAuth token)
+# CLAUDE_API_KEY=sk-ant-xxxxx
+
+# Codex tokens (optional alternative assistant)
+# CODEX_ID_TOKEN=
+# CODEX_ACCESS_TOKEN=
+# CODEX_REFRESH_TOKEN=
+# CODEX_ACCOUNT_ID=
+
+# Default assistant for new conversations
+DEFAULT_AI_ASSISTANT=claude
+
+# Database
+# Leave empty to use SQLite at /.archon/archon.db.
+# For the local PostgreSQL profile, set:
+# DATABASE_URL=postgresql://postgres:postgres@postgres:5432/remote_coding_agent
+DATABASE_URL=
+POSTGRES_PASSWORD=postgres
+
+# Git provider tokens
+# If you use GitHub integrations, set both variables to the same personal access token.
+GH_TOKEN=
+GITHUB_TOKEN=
+WEBHOOK_SECRET=
+
+# GitLab and Gitea integrations (optional)
+GITLAB_URL=https://gitlab.com
+GITLAB_TOKEN=
+GITLAB_WEBHOOK_SECRET=
+GITEA_URL=
+GITEA_TOKEN=
+GITEA_WEBHOOK_SECRET=
+
+# Platform tokens (optional)
+TELEGRAM_BOT_TOKEN=
+DISCORD_BOT_TOKEN=
+SLACK_BOT_TOKEN=
+SLACK_APP_TOKEN=
+
+# Additional model provider API keys (optional)
+OPENAI_API_KEY=
+ANTHROPIC_API_KEY=
+GEMINI_API_KEY=
+OPENROUTER_API_KEY=
+
+# Adapter behavior
+BOT_DISPLAY_NAME=Archon
+TELEGRAM_STREAMING_MODE=stream
+DISCORD_STREAMING_MODE=batch
+SLACK_STREAMING_MODE=batch
+
+# Persistence
+# Leave these empty to use Docker-managed named volumes.
+# ARCHON_DATA=/opt/archon-data
+# ARCHON_USER_HOME=/opt/archon-user-home
+
+# Logging and runtime
+LOG_LEVEL=info
+MAX_CONCURRENT_CONVERSATIONS=10
+SESSION_RETENTION_DAYS=30
+
+# Telemetry opt-out (set to 1 to disable)
+# DO_NOT_TRACK=1
+
+# Resource limits - Archon app
+ARCHON_CPU_LIMIT=2.0
+ARCHON_MEMORY_LIMIT=4G
+ARCHON_CPU_RESERVATION=0.1
+ARCHON_MEMORY_RESERVATION=1G
+
+# Resource limits - PostgreSQL
+POSTGRES_CPU_LIMIT=1.0
+POSTGRES_MEMORY_LIMIT=1G
+POSTGRES_CPU_RESERVATION=0.1
+POSTGRES_MEMORY_RESERVATION=256M
@@ -0,0 +1,94 @@
+# Archon
+
+[English](./README.md) | [中文](./README.zh.md)
+
+Quick start: <https://archon.diy/docs/deployment/docker>.
+
+This service deploys Archon, an open-source workflow engine for AI coding agents. The stack uses the official pre-built web UI + API image, persists Archon's working state in Docker volumes, defaults to SQLite for zero-config startup, and offers an optional `with-db` profile for local PostgreSQL.
+
+## Services
+
+- **archon**: Archon web UI and API server.
+- **postgres**: Optional PostgreSQL 17 backend for shared or heavier workflow usage.
+
+## Quick Start
+
+1. Copy `.env.example` to `.env`:
+
+   ```bash
+   cp .env.example .env
+   ```
+
+2. Set at least one AI credential in `.env`.
+
+   For Docker deployments, prefer `CLAUDE_CODE_OAUTH_TOKEN` or `CLAUDE_API_KEY`. If you use GitHub repositories or webhooks, set both `GH_TOKEN` and `GITHUB_TOKEN` to the same personal access token.
+
+3. Start Archon:
+
+   ```bash
+   docker compose up -d
+   ```
+
+4. Open `http://localhost:3000`.
+
+## Optional Local PostgreSQL
+
+If you want a local PostgreSQL backend instead of SQLite, set this in `.env`:
+
+```ini
+DATABASE_URL=postgresql://postgres:postgres@postgres:5432/remote_coding_agent
+```
+
+Then start the optional profile:
+
+```bash
+docker compose --profile with-db up -d
+```
+
+## Core Environment Variables
+
+| Variable                  | Description                                                                 | Default               |
+| ------------------------- | --------------------------------------------------------------------------- | --------------------- |
+| `ARCHON_VERSION`          | Archon image tag                                                            | `latest`              |
+| `ARCHON_PORT_OVERRIDE`    | Host port for the Archon web UI and API                                     | `3000`                |
+| `CLAUDE_CODE_OAUTH_TOKEN` | Claude Code OAuth token for Docker deployments                              | placeholder           |
+| `CLAUDE_API_KEY`          | Anthropic API key as an alternative to OAuth                                | *(empty)*             |
+| `DEFAULT_AI_ASSISTANT`    | Default assistant for new conversations                                     | `claude`              |
+| `DATABASE_URL`            | PostgreSQL connection string; leave empty to use SQLite                     | *(empty)*             |
+| `GH_TOKEN`                | GitHub personal access token for cloning private repos and GitHub CLI usage | *(empty)*             |
+| `GITHUB_TOKEN`            | Same GitHub token reused by the GitHub adapter                              | *(empty)*             |
+| `ARCHON_DATA`             | Optional host path for `/.archon`; leave empty for a named volume           | Docker-managed volume |
+| `ARCHON_USER_HOME`        | Optional host path for `/home/appuser`; leave empty for a named volume      | Docker-managed volume |
+| `POSTGRES_PASSWORD`       | Password for the optional local PostgreSQL container                        | `postgres`            |
+
+## Volumes
+
+- `archon_data`: SQLite database, registered codebases, workspaces, worktrees, and other Archon-managed data under `/.archon`.
+- `archon_user_home`: Persisted `/home/appuser` state, including Claude/Codex auth, `~/.gitconfig`, shell history, and user-installed Archon assets.
+- `archon_postgres_data`: PostgreSQL data when the `with-db` profile is enabled.
+
+## Ports
+
+- **3000**: Archon web UI and API
+- **5432**: Optional local PostgreSQL, bound to `127.0.0.1` only when the `with-db` profile is enabled
+
+## Resource Requirements
+
+| Service  | CPU Limit | Memory Limit |
+| -------- | --------- | ------------ |
+| archon   | 2         | 4 GB         |
+| postgres | 1         | 1 GB         |
+
+The Archon image includes Chromium and Git tooling. Plan for **4+ GB RAM** and **2+ CPU cores**, and allocate more if you run concurrent workflows or browser-driven validation.
+
+## Notes
+
+- Default startup stores data in SQLite at `/.archon/archon.db`; use `DATABASE_URL` only when you need PostgreSQL.
+- The bundled PostgreSQL bootstrap mounts the current `000_combined.sql` schema for fresh installs. If a future upstream release adds incremental PostgreSQL migrations, apply the newer SQL files from the Archon repository before upgrading an existing PostgreSQL data volume.
+- If you expose Archon beyond localhost, put it behind an authenticated reverse proxy.
+
+## Documentation
+
+- [Archon Docker Guide](https://archon.diy/docs/deployment/docker)
+- [Archon Database Reference](https://archon.diy/docs/reference/database)
+- [GitHub](https://github.com/coleam00/Archon)
@@ -0,0 +1,94 @@
+# Archon
+
+[English](./README.md) | [中文](./README.zh.md)
+
+快速开始：<https://archon.diy/docs/deployment/docker>。
+
+此服务用于部署 Archon，一个面向 AI 编码代理的开源工作流引擎。该栈使用官方预构建的 Web UI + API 镜像，通过 Docker 卷持久化 Archon 的工作状态，默认使用 SQLite 实现零配置启动，并提供可选的 `with-db` profile 用于本地 PostgreSQL。
+
+## 服务
+
+- **archon**：Archon Web UI 和 API 服务器。
+- **postgres**：可选的 PostgreSQL 17 后端，适合共享访问或更高并发的工作流场景。
+
+## 快速开始
+
+1. 将 `.env.example` 复制为 `.env`：
+
+   ```bash
+   cp .env.example .env
+   ```
+
+2. 在 `.env` 中至少设置一种 AI 凭据。
+
+   对于 Docker 部署，优先使用 `CLAUDE_CODE_OAUTH_TOKEN` 或 `CLAUDE_API_KEY`。如果你要使用 GitHub 仓库或 Webhook，请将 `GH_TOKEN` 和 `GITHUB_TOKEN` 设置为同一个个人访问令牌。
+
+3. 启动 Archon：
+
+   ```bash
+   docker compose up -d
+   ```
+
+4. 打开 `http://localhost:3000`。
+
+## 可选的本地 PostgreSQL
+
+如果你想用本地 PostgreSQL 代替 SQLite，请在 `.env` 中设置：
+
+```ini
+DATABASE_URL=postgresql://postgres:postgres@postgres:5432/remote_coding_agent
+```
+
+然后启动可选 profile：
+
+```bash
+docker compose --profile with-db up -d
+```
+
+## 核心环境变量
+
+| 变量                      | 说明                                                 | 默认值            |
+| ------------------------- | ---------------------------------------------------- | ----------------- |
+| `ARCHON_VERSION`          | Archon 镜像标签                                      | `latest`          |
+| `ARCHON_PORT_OVERRIDE`    | Archon Web UI 和 API 的宿主机端口                    | `3000`            |
+| `CLAUDE_CODE_OAUTH_TOKEN` | Docker 部署推荐使用的 Claude Code OAuth Token        | 占位符            |
+| `CLAUDE_API_KEY`          | Anthropic API Key，作为 OAuth 的替代方案             | *(空)*            |
+| `DEFAULT_AI_ASSISTANT`    | 新会话的默认助手                                     | `claude`          |
+| `DATABASE_URL`            | PostgreSQL 连接串；留空时使用 SQLite                 | *(空)*            |
+| `GH_TOKEN`                | 用于克隆私有仓库和 GitHub CLI 的 GitHub 个人访问令牌 | *(空)*            |
+| `GITHUB_TOKEN`            | GitHub 适配器复用的同一个 GitHub Token               | *(空)*            |
+| `ARCHON_DATA`             | 可选的 `/.archon` 宿主机路径；留空时使用命名卷       | Docker 托管命名卷 |
+| `ARCHON_USER_HOME`        | 可选的 `/home/appuser` 宿主机路径；留空时使用命名卷  | Docker 托管命名卷 |
+| `POSTGRES_PASSWORD`       | 可选本地 PostgreSQL 容器的密码                       | `postgres`        |
+
+## 数据卷
+
+- `archon_data`：`/.archon` 下的 SQLite 数据库、已注册代码库、工作区、worktree 和其他 Archon 数据。
+- `archon_user_home`：持久化的 `/home/appuser` 状态，包括 Claude/Codex 登录信息、`~/.gitconfig`、shell 历史和用户安装的 Archon 资源。
+- `archon_postgres_data`：启用 `with-db` profile 时使用的 PostgreSQL 数据目录。
+
+## 端口
+
+- **3000**：Archon Web UI 和 API
+- **5432**：可选的本地 PostgreSQL，仅在启用 `with-db` profile 时绑定到 `127.0.0.1`
+
+## 资源需求
+
+| 服务     | CPU 限制 | 内存限制 |
+| -------- | -------- | -------- |
+| archon   | 2        | 4 GB     |
+| postgres | 1        | 1 GB     |
+
+Archon 镜像内置了 Chromium 和 Git 工具链。建议至少分配 **4+ GB RAM** 和 **2+ CPU 核心**；如果你要同时运行多个工作流或浏览器驱动的验证任务，请继续上调资源。
+
+## 说明
+
+- 默认启动路径会把数据写入 `/.archon/archon.db` 中的 SQLite；只有在需要 PostgreSQL 时才设置 `DATABASE_URL`。
+- 这个栈为全新 PostgreSQL 数据卷挂载了当前的 `000_combined.sql` 初始化脚本。如果未来上游版本新增了增量 PostgreSQL 迁移，请在升级已有 PostgreSQL 数据卷前，从 Archon 上游仓库应用新的 SQL 文件。
+- 如果你要把 Archon 暴露到 localhost 之外，请放到带认证的反向代理之后。
+
+## 文档
+
+- [Archon Docker 指南](https://archon.diy/docs/deployment/docker)
+- [Archon 数据库参考](https://archon.diy/docs/reference/database)
+- [GitHub 仓库](https://github.com/coleam00/Archon)
@@ -0,0 +1,108 @@
+# Archon defaults to a single-container SQLite deployment.
+# Enable the with-db profile and set DATABASE_URL to use local PostgreSQL.
+
+x-defaults: &defaults
+  restart: unless-stopped
+  logging:
+    driver: json-file
+    options:
+      max-size: 100m
+      max-file: '3'
+
+services:
+  archon:
+    <<: *defaults
+    image: ${GLOBAL_REGISTRY:-ghcr.io/}coleam00/archon:${ARCHON_VERSION:-latest}
+    ports:
+      - '${ARCHON_PORT_OVERRIDE:-3000}:${PORT:-3000}'
+    environment:
+      - TZ=${TZ:-UTC}
+      - ARCHON_DOCKER=true
+      - PORT=${PORT:-3000}
+      - HOST=${HOST:-0.0.0.0}
+      - CLAUDE_USE_GLOBAL_AUTH=${CLAUDE_USE_GLOBAL_AUTH:-false}
+      - CLAUDE_CODE_OAUTH_TOKEN=${CLAUDE_CODE_OAUTH_TOKEN:-}
+      - CLAUDE_API_KEY=${CLAUDE_API_KEY:-}
+      - CODEX_ID_TOKEN=${CODEX_ID_TOKEN:-}
+      - CODEX_ACCESS_TOKEN=${CODEX_ACCESS_TOKEN:-}
+      - CODEX_REFRESH_TOKEN=${CODEX_REFRESH_TOKEN:-}
+      - CODEX_ACCOUNT_ID=${CODEX_ACCOUNT_ID:-}
+      - DEFAULT_AI_ASSISTANT=${DEFAULT_AI_ASSISTANT:-claude}
+      - DATABASE_URL=${DATABASE_URL:-}
+      - GH_TOKEN=${GH_TOKEN:-}
+      - GITHUB_TOKEN=${GITHUB_TOKEN:-}
+      - WEBHOOK_SECRET=${WEBHOOK_SECRET:-}
+      - GITLAB_URL=${GITLAB_URL:-https://gitlab.com}
+      - GITLAB_TOKEN=${GITLAB_TOKEN:-}
+      - GITLAB_WEBHOOK_SECRET=${GITLAB_WEBHOOK_SECRET:-}
+      - GITEA_URL=${GITEA_URL:-}
+      - GITEA_TOKEN=${GITEA_TOKEN:-}
+      - GITEA_WEBHOOK_SECRET=${GITEA_WEBHOOK_SECRET:-}
+      - TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN:-}
+      - DISCORD_BOT_TOKEN=${DISCORD_BOT_TOKEN:-}
+      - SLACK_BOT_TOKEN=${SLACK_BOT_TOKEN:-}
+      - SLACK_APP_TOKEN=${SLACK_APP_TOKEN:-}
+      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
+      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
+      - GEMINI_API_KEY=${GEMINI_API_KEY:-}
+      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-}
+      - BOT_DISPLAY_NAME=${BOT_DISPLAY_NAME:-Archon}
+      - TELEGRAM_STREAMING_MODE=${TELEGRAM_STREAMING_MODE:-stream}
+      - DISCORD_STREAMING_MODE=${DISCORD_STREAMING_MODE:-batch}
+      - SLACK_STREAMING_MODE=${SLACK_STREAMING_MODE:-batch}
+      - LOG_LEVEL=${LOG_LEVEL:-info}
+      - MAX_CONCURRENT_CONVERSATIONS=${MAX_CONCURRENT_CONVERSATIONS:-10}
+      - SESSION_RETENTION_DAYS=${SESSION_RETENTION_DAYS:-30}
+      - DO_NOT_TRACK=${DO_NOT_TRACK:-}
+    volumes:
+      - ${ARCHON_DATA:-archon_data}:/.archon
+      - ${ARCHON_USER_HOME:-archon_user_home}:/home/appuser
+    healthcheck:
+      test: [CMD, curl, -f, 'http://localhost:${PORT:-3000}/api/health']
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 20s
+    deploy:
+      resources:
+        limits:
+          cpus: ${ARCHON_CPU_LIMIT:-2.0}
+          memory: ${ARCHON_MEMORY_LIMIT:-4G}
+        reservations:
+          cpus: ${ARCHON_CPU_RESERVATION:-0.1}
+          memory: ${ARCHON_MEMORY_RESERVATION:-1G}
+
+  postgres:
+    <<: *defaults
+    image: ${GLOBAL_REGISTRY:-}postgres:${POSTGRES_VERSION:-17-alpine}
+    profiles:
+      - with-db
+    environment:
+      - TZ=${TZ:-UTC}
+      - POSTGRES_DB=remote_coding_agent
+      - POSTGRES_USER=postgres
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-postgres}
+    ports:
+      - '127.0.0.1:${POSTGRES_PORT_OVERRIDE:-5432}:5432'
+    volumes:
+      - archon_postgres_data:/var/lib/postgresql/data
+      - ./migrations/000_combined.sql:/docker-entrypoint-initdb.d/000_combined.sql:ro
+    healthcheck:
+      test: [CMD-SHELL, 'pg_isready -U postgres -d remote_coding_agent']
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 15s
+    deploy:
+      resources:
+        limits:
+          cpus: ${POSTGRES_CPU_LIMIT:-1.0}
+          memory: ${POSTGRES_MEMORY_LIMIT:-1G}
+        reservations:
+          cpus: ${POSTGRES_CPU_RESERVATION:-0.1}
+          memory: ${POSTGRES_MEMORY_RESERVATION:-256M}
+
+volumes:
+  archon_data:
+  archon_user_home:
+  archon_postgres_data:
@@ -0,0 +1,300 @@
+-- Remote Coding Agent - Combined Schema
+-- Version: Combined (final state after migrations 001-020)
+-- Description: Complete database schema (idempotent - safe to run multiple times)
+--
+-- 8 Tables:
+--   1. remote_agent_codebases
+--   1b. remote_agent_codebase_env_vars
+--   2. remote_agent_conversations
+--   3. remote_agent_sessions
+--   4. remote_agent_isolation_environments
+--   5. remote_agent_workflow_runs
+--   6. remote_agent_workflow_events
+--   7. remote_agent_messages
+--
+-- Dropped tables (via migrations):
+--   - remote_agent_command_templates (017)
+--
+-- Dropped columns (via migrations):
+--   - conversations.worktree_path (007)
+--   - conversations.isolation_env_id_legacy (007)
+--   - conversations.isolation_provider (007)
+
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+
+-- ============================================================================
+-- Table 1: Codebases
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS remote_agent_codebases (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  name VARCHAR(255) NOT NULL,
+  repository_url VARCHAR(500),
+  default_cwd VARCHAR(500) NOT NULL,
+  ai_assistant_type VARCHAR(20) DEFAULT 'claude',
+  allow_env_keys BOOLEAN NOT NULL DEFAULT FALSE,
+  commands JSONB DEFAULT '{}'::jsonb,
+  created_at TIMESTAMP DEFAULT NOW(),
+  updated_at TIMESTAMP DEFAULT NOW()
+);
+
+COMMENT ON TABLE remote_agent_codebases IS
+  'Repository metadata: name, URL, working directory, AI assistant type, and command paths (JSONB)';
+
+-- ============================================================================
+-- Table 1b: Codebase Env Vars
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS remote_agent_codebase_env_vars (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  codebase_id UUID NOT NULL REFERENCES remote_agent_codebases(id) ON DELETE CASCADE,
+  key VARCHAR(255) NOT NULL,
+  value TEXT NOT NULL,
+  created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+  updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+  UNIQUE(codebase_id, key)
+);
+
+CREATE INDEX IF NOT EXISTS idx_codebase_env_vars_codebase_id
+  ON remote_agent_codebase_env_vars(codebase_id);
+
+COMMENT ON TABLE remote_agent_codebase_env_vars IS
+  'Per-project env vars merged into Options.env on Claude SDK calls. Managed via Web UI or config.';
+
+-- ============================================================================
+-- Table 2: Conversations
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS remote_agent_conversations (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  platform_type VARCHAR(20) NOT NULL,
+  platform_conversation_id VARCHAR(255) NOT NULL,
+  codebase_id UUID REFERENCES remote_agent_codebases(id) ON DELETE SET NULL,
+  cwd VARCHAR(500),
+  ai_assistant_type VARCHAR(20) DEFAULT 'claude',
+  isolation_env_id UUID,
+  title VARCHAR(255),
+  deleted_at TIMESTAMP WITH TIME ZONE,
+  hidden BOOLEAN DEFAULT FALSE,
+  created_at TIMESTAMP DEFAULT NOW(),
+  updated_at TIMESTAMP DEFAULT NOW(),
+  last_activity_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+  UNIQUE(platform_type, platform_conversation_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_remote_agent_conversations_codebase
+  ON remote_agent_conversations(codebase_id);
+CREATE INDEX IF NOT EXISTS idx_conversations_hidden
+  ON remote_agent_conversations(hidden);
+CREATE INDEX IF NOT EXISTS idx_conversations_codebase
+  ON remote_agent_conversations(codebase_id) WHERE deleted_at IS NULL;
+
+COMMENT ON COLUMN remote_agent_conversations.isolation_env_id IS
+  'UUID reference to isolation_environments table (the only isolation reference)';
+
+-- ============================================================================
+-- Table 3: Sessions
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS remote_agent_sessions (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  conversation_id UUID REFERENCES remote_agent_conversations(id) ON DELETE CASCADE,
+  codebase_id UUID REFERENCES remote_agent_codebases(id) ON DELETE SET NULL,
+  ai_assistant_type VARCHAR(20) NOT NULL,
+  assistant_session_id VARCHAR(255),
+  active BOOLEAN DEFAULT true,
+  metadata JSONB DEFAULT '{}'::jsonb,
+  parent_session_id UUID REFERENCES remote_agent_sessions(id),
+  transition_reason TEXT,
+  ended_reason TEXT,
+  started_at TIMESTAMP DEFAULT NOW(),
+  ended_at TIMESTAMP
+);
+
+CREATE INDEX IF NOT EXISTS idx_remote_agent_sessions_conversation
+  ON remote_agent_sessions(conversation_id, active);
+CREATE INDEX IF NOT EXISTS idx_remote_agent_sessions_codebase
+  ON remote_agent_sessions(codebase_id);
+CREATE INDEX IF NOT EXISTS idx_sessions_parent
+  ON remote_agent_sessions(parent_session_id);
+CREATE INDEX IF NOT EXISTS idx_sessions_conversation_started
+  ON remote_agent_sessions(conversation_id, started_at DESC);
+
+COMMENT ON COLUMN remote_agent_sessions.parent_session_id IS
+  'Links to the previous session in this conversation (for audit trail)';
+COMMENT ON COLUMN remote_agent_sessions.transition_reason IS
+  'Why this session was created: plan-to-execute, isolation-changed, reset-requested, etc.';
+COMMENT ON COLUMN remote_agent_sessions.ended_reason IS
+  'Why this session was deactivated: reset-requested, cwd-changed, conversation-closed, etc.';
+
+-- ============================================================================
+-- Table 4: Isolation Environments
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS remote_agent_isolation_environments (
+  id                    UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  codebase_id           UUID NOT NULL REFERENCES remote_agent_codebases(id) ON DELETE CASCADE,
+
+  -- Workflow identification (what work this is for)
+  workflow_type         TEXT NOT NULL,
+  workflow_id           TEXT NOT NULL,
+
+  -- Implementation details
+  provider              TEXT NOT NULL DEFAULT 'worktree',
+  working_path          TEXT NOT NULL,
+  branch_name           TEXT NOT NULL,
+
+  -- Lifecycle
+  status                TEXT NOT NULL DEFAULT 'active',
+  created_at            TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+  created_by_platform   TEXT,
+
+  -- Cross-reference metadata (for linking)
+  metadata              JSONB DEFAULT '{}'
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS unique_active_workflow
+  ON remote_agent_isolation_environments (codebase_id, workflow_type, workflow_id)
+  WHERE status = 'active';
+
+CREATE INDEX IF NOT EXISTS idx_isolation_env_codebase
+  ON remote_agent_isolation_environments(codebase_id);
+CREATE INDEX IF NOT EXISTS idx_isolation_env_status
+  ON remote_agent_isolation_environments(status);
+CREATE INDEX IF NOT EXISTS idx_isolation_env_workflow
+  ON remote_agent_isolation_environments(workflow_type, workflow_id);
+
+ALTER TABLE remote_agent_conversations
+  ADD COLUMN IF NOT EXISTS isolation_env_id UUID
+    REFERENCES remote_agent_isolation_environments(id) ON DELETE SET NULL;
+
+CREATE INDEX IF NOT EXISTS idx_conversations_isolation_env_id
+  ON remote_agent_conversations(isolation_env_id);
+
+COMMENT ON TABLE remote_agent_isolation_environments IS
+  'Work-centric isolated environments with independent lifecycle';
+COMMENT ON COLUMN remote_agent_isolation_environments.workflow_type IS
+  'Type of work: issue, pr, review, thread, task';
+COMMENT ON COLUMN remote_agent_isolation_environments.workflow_id IS
+  'Identifier for the work (issue number, PR number, thread hash, etc.)';
+
+-- ============================================================================
+-- Table 5: Workflow Runs
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS remote_agent_workflow_runs (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  workflow_name VARCHAR(255) NOT NULL,
+  conversation_id UUID REFERENCES remote_agent_conversations(id) ON DELETE CASCADE,
+  codebase_id UUID REFERENCES remote_agent_codebases(id) ON DELETE SET NULL,
+  current_step_index INTEGER,
+  status VARCHAR(20) NOT NULL DEFAULT 'pending',
+  user_message TEXT NOT NULL,
+  metadata JSONB DEFAULT '{}',
+  parent_conversation_id UUID REFERENCES remote_agent_conversations(id) ON DELETE SET NULL,
+  started_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+  completed_at TIMESTAMP WITH TIME ZONE,
+  last_activity_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+  working_path TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_workflow_runs_conversation
+  ON remote_agent_workflow_runs(conversation_id);
+CREATE INDEX IF NOT EXISTS idx_workflow_runs_status
+  ON remote_agent_workflow_runs(status);
+CREATE INDEX IF NOT EXISTS idx_workflow_runs_parent_conv
+  ON remote_agent_workflow_runs(parent_conversation_id);
+CREATE INDEX IF NOT EXISTS idx_workflow_runs_last_activity
+  ON remote_agent_workflow_runs(last_activity_at)
+  WHERE status = 'running';
+
+COMMENT ON TABLE remote_agent_workflow_runs IS
+  'Tracks workflow execution state for resumption and observability';
+
+-- ============================================================================
+-- Table 6: Workflow Events
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS remote_agent_workflow_events (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  workflow_run_id UUID NOT NULL REFERENCES remote_agent_workflow_runs(id) ON DELETE CASCADE,
+  event_type VARCHAR(50) NOT NULL,
+  step_index INTEGER,
+  step_name VARCHAR(255),
+  data JSONB DEFAULT '{}',
+  created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX IF NOT EXISTS idx_workflow_events_run_id
+  ON remote_agent_workflow_events(workflow_run_id);
+CREATE INDEX IF NOT EXISTS idx_workflow_events_type
+  ON remote_agent_workflow_events(event_type);
+
+COMMENT ON TABLE remote_agent_workflow_events IS
+  'Lean UI-relevant workflow events for observability (step transitions, artifacts, errors)';
+
+-- ============================================================================
+-- Table 7: Messages
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS remote_agent_messages (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  conversation_id UUID NOT NULL REFERENCES remote_agent_conversations(id) ON DELETE CASCADE,
+  role VARCHAR(20) NOT NULL,
+  content TEXT NOT NULL DEFAULT '',
+  metadata JSONB DEFAULT '{}'::jsonb,
+  created_at TIMESTAMP DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_messages_conversation_id
+  ON remote_agent_messages(conversation_id, created_at ASC);
+
+-- ============================================================================
+-- Cleanup: Drop legacy objects from older schemas
+-- ============================================================================
+
+DROP TABLE IF EXISTS remote_agent_command_templates;
+DROP INDEX IF EXISTS idx_remote_agent_command_templates_name;
+
+ALTER TABLE remote_agent_conversations DROP COLUMN IF EXISTS worktree_path;
+ALTER TABLE remote_agent_conversations DROP COLUMN IF EXISTS isolation_env_id_legacy;
+ALTER TABLE remote_agent_conversations DROP COLUMN IF EXISTS isolation_provider;
+DROP INDEX IF EXISTS idx_conversations_isolation;
+
+ALTER TABLE remote_agent_isolation_environments
+  DROP CONSTRAINT IF EXISTS unique_workflow;
+
+-- ============================================================================
+-- Idempotent ALTER statements for upgrading existing databases
+-- ============================================================================
+
+ALTER TABLE remote_agent_conversations
+  ADD COLUMN IF NOT EXISTS isolation_env_id UUID
+    REFERENCES remote_agent_isolation_environments(id) ON DELETE SET NULL;
+ALTER TABLE remote_agent_conversations
+  ADD COLUMN IF NOT EXISTS last_activity_at TIMESTAMP WITH TIME ZONE DEFAULT NOW();
+
+ALTER TABLE remote_agent_workflow_runs
+  ADD COLUMN IF NOT EXISTS last_activity_at TIMESTAMP WITH TIME ZONE DEFAULT NOW();
+
+ALTER TABLE remote_agent_sessions
+  ADD COLUMN IF NOT EXISTS parent_session_id UUID REFERENCES remote_agent_sessions(id);
+ALTER TABLE remote_agent_sessions
+  ADD COLUMN IF NOT EXISTS transition_reason TEXT;
+
+ALTER TABLE remote_agent_conversations
+  ADD COLUMN IF NOT EXISTS title VARCHAR(255);
+ALTER TABLE remote_agent_conversations
+  ADD COLUMN IF NOT EXISTS deleted_at TIMESTAMP WITH TIME ZONE;
+
+ALTER TABLE remote_agent_workflow_runs
+  ADD COLUMN IF NOT EXISTS parent_conversation_id UUID
+    REFERENCES remote_agent_conversations(id) ON DELETE SET NULL;
+ALTER TABLE remote_agent_conversations
+  ADD COLUMN IF NOT EXISTS hidden BOOLEAN DEFAULT FALSE;
+
+ALTER TABLE remote_agent_sessions
+  ADD COLUMN IF NOT EXISTS ended_reason TEXT;
+
+ALTER TABLE remote_agent_codebases
+  ADD COLUMN IF NOT EXISTS allow_env_keys BOOLEAN NOT NULL DEFAULT FALSE;
@@ -0,0 +1,8 @@
+# OpenTelemetry Collector Contrib image version
+OTEL_COLLECTOR_VERSION=0.153.0
+
+# Deployment environment label (used in resource attributes)
+DEPLOY_ENV=production
+
+# OTLP HTTP exporter endpoint (your OTel backend, e.g. OpenObserve, Grafana Tempo, Jaeger)
+OTEL_EXPORTER_ENDPOINT=http://localhost:4318
@@ -0,0 +1,121 @@
+receivers:
+  otlp:
+    protocols:
+      grpc:
+        endpoint: 0.0.0.0:4317
+      http:
+        endpoint: 0.0.0.0:4318
+  hostmetrics:
+    root_path: /hostfs
+    collection_interval: 60s
+    scrapers:
+      cpu: {}
+      disk: {}
+      load: {}
+      filesystem:
+        exclude_fs_types:
+          match_type: strict
+          fs_types:
+            - autofs
+            - binfmt_misc
+            - cgroup
+            - configfs
+            - debugfs
+            - devpts
+            - devtmpfs
+            - fusectl
+            - hugetlbfs
+            - mqueue
+            - nsfs
+            - overlay
+            - proc
+            - procfs
+            - pstore
+            - rpc_pipefs
+            - securityfs
+            - squashfs
+            - sysfs
+            - tmpfs
+            - tracefs
+        exclude_mount_points:
+          match_type: regexp
+          mount_points:
+            - ^/dev/.*$
+            - ^/proc/.*$
+            - ^/sys/.*$
+            - ^/run/.*$
+            - ^/var/lib/docker/.*$
+            - ^/snap/.*$
+      memory: {}
+      network:
+        exclude:
+          match_type: regexp
+          interfaces:
+            - '^veth.*$'
+            - '^docker.*$'
+            - '^br-.*$'
+            - ^lo$
+      paging: {}
+      process:
+        mute_process_name_error: true
+        mute_process_exe_error: true
+        mute_process_io_error: true
+        mute_process_user_error: true
+      processes: {}
+      system: {}
+
+  docker_stats:
+    endpoint: unix:///var/run/docker.sock
+    collection_interval: 10s
+    timeout: 20s
+
+processors:
+  batch:
+    send_batch_size: 1000
+    timeout: 10s
+  resourcedetection:
+    detectors: [env, system]
+    timeout: 2s
+    system:
+      hostname_sources: [os]
+  memory_limiter:
+    check_interval: 5s
+    limit_mib: 4000
+    spike_limit_mib: 800
+
+exporters:
+  otlphttp:
+    endpoint: ${OTEL_EXPORTER_ENDPOINT}
+    tls:
+      insecure: true
+    compression: gzip
+    sending_queue:
+      enabled: true
+      num_consumers: 10
+      queue_size: 10000
+    retry_on_failure:
+      enabled: true
+
+extensions:
+  health_check:
+    endpoint: 0.0.0.0:13133
+  pprof:
+    endpoint: 0.0.0.0:1777
+  zpages:
+    endpoint: 0.0.0.0:55679
+
+service:
+  extensions: [health_check, pprof, zpages]
+  pipelines:
+    traces:
+      receivers: [otlp]
+      processors: [memory_limiter, resourcedetection, batch]
+      exporters: [otlphttp]
+    metrics:
+      receivers: [otlp, hostmetrics, docker_stats]
+      processors: [memory_limiter, resourcedetection, batch]
+      exporters: [otlphttp]
+    logs:
+      receivers: [otlp]
+      processors: [memory_limiter, resourcedetection, batch]
+      exporters: [otlphttp]
@@ -0,0 +1,23 @@
+services:
+  collection-agent:
+    image: otel/opentelemetry-collector-contrib:${OTEL_COLLECTOR_VERSION:-0.153.0}
+    restart: unless-stopped
+    user: '0:0'
+    network_mode: host
+    environment:
+      - OTEL_RESOURCE_ATTRIBUTES=deployment.environment=${DEPLOY_ENV:-production}
+      - OTEL_EXPORTER_ENDPOINT=${OTEL_EXPORTER_ENDPOINT:-http://localhost:4318}
+    volumes:
+      - ./config.yaml:/etc/otelcol-contrib/config.yaml:ro
+      - /:/hostfs:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    deploy:
+      resources:
+        limits:
+          cpus: '1.0'
+          memory: 2G
+    logging:
+      driver: json-file
+      options:
+        max-size: 10m
+        max-file: '3'
@@ -9,11 +9,14 @@ TZ=UTC
 # SigNoz Version Configuration
 # ============================================

+# SigNoz image repository/name
+SIGNOZ_IMAGE_NAME=signoz/signoz
+
 # SigNoz all-in-one backend + frontend + alertmanager version
-SIGNOZ_VERSION=v0.118.0
+SIGNOZ_VERSION=v0.125.1

 # SigNoz OTel Collector version (also used for migration jobs)
-SIGNOZ_OTEL_COLLECTOR_VERSION=v0.144.2
+SIGNOZ_OTEL_COLLECTOR_VERSION=v0.144.4

 # ClickHouse version
 SIGNOZ_CLICKHOUSE_VERSION=25.5.6
@@ -16,13 +16,13 @@ SigNoz is an open-source observability platform that provides monitoring and tro
 ## Services

 | Service                          | Image                                                             | Description                                            |
-| -------------------------------- | ------------------------------------- | ------------------------------------------------------ |
-| `signoz`                         | signoz/signoz:v0.118.0                | All-in-one backend, frontend UI, and alert manager     |
-| `otel-collector`                 | signoz/signoz-otel-collector:v0.144.2 | Receives, processes, and exports telemetry data        |
+| -------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------ |
+| `signoz`                         | `${SIGNOZ_IMAGE_NAME:-signoz/signoz}:${SIGNOZ_VERSION:-v0.125.1}` | All-in-one backend, frontend UI, and alert manager     |
+| `otel-collector`                 | signoz/signoz-otel-collector:v0.144.4                             | Receives, processes, and exports telemetry data        |
 | `clickhouse`                     | clickhouse/clickhouse-server:25.5.6                               | Time-series database for traces, metrics, and logs     |
 | `zookeeper-1`                    | signoz/zookeeper:3.7.1                                            | ZooKeeper for ClickHouse replication metadata          |
 | `init-clickhouse`                | clickhouse/clickhouse-server:25.5.6                               | One-shot init that downloads the histogramQuantile UDF |
-| `signoz-telemetrystore-migrator` | signoz/signoz-otel-collector:v0.144.2 | One-shot schema migration for ClickHouse               |
+| `signoz-telemetrystore-migrator` | signoz/signoz-otel-collector:v0.144.4                             | One-shot schema migration for ClickHouse               |

 ## Quick Start

@@ -61,13 +61,16 @@ SigNoz is an open-source observability platform that provides monitoring and tro
 | `SIGNOZ_PORT_OVERRIDE`           | `8080`                      | SigNoz UI host port                            |
 | `SIGNOZ_OTEL_GRPC_PORT_OVERRIDE` | `4317`                      | OTLP gRPC receiver host port                   |
 | `SIGNOZ_OTEL_HTTP_PORT_OVERRIDE` | `4318`                      | OTLP HTTP receiver host port                   |
-| `SIGNOZ_VERSION`                 | `v0.118.0`                  | SigNoz image version                           |
-| `SIGNOZ_OTEL_COLLECTOR_VERSION`  | `v0.144.2`                  | OTel Collector image version                   |
+| `SIGNOZ_IMAGE_NAME`              | `signoz/signoz`             | SigNoz image repository/name                   |
+| `SIGNOZ_VERSION`                 | `v0.125.1`                  | SigNoz image version                           |
+| `SIGNOZ_OTEL_COLLECTOR_VERSION`  | `v0.144.4`                  | OTel Collector image version                   |
 | `SIGNOZ_CLICKHOUSE_VERSION`      | `25.5.6`                    | ClickHouse image version                       |
 | `TZ`                             | `UTC`                       | Timezone                                       |

 See `.env.example` for the complete list including resource limits.

+`SIGNOZ_IMAGE_NAME` lets you switch the SigNoz image repository while keeping the tag controlled by `SIGNOZ_VERSION`.
+
 ### Sending Telemetry Data

 Configure your application's OpenTelemetry SDK to export to:
@@ -16,13 +16,13 @@ SigNoz 是一个开源的可观测性平台，为分布式应用程序提供监
 ## 服务列表

 | 服务                             | 镜像                                                              | 描述                                     |
-| -------------------------------- | ------------------------------------- | ---------------------------------------- |
-| `signoz`                         | signoz/signoz:v0.118.0                | 后端、前端 UI 和告警管理器的合体镜像     |
-| `otel-collector`                 | signoz/signoz-otel-collector:v0.144.2 | 接收、处理和导出遥测数据                 |
+| -------------------------------- | ----------------------------------------------------------------- | ---------------------------------------- |
+| `signoz`                         | `${SIGNOZ_IMAGE_NAME:-signoz/signoz}:${SIGNOZ_VERSION:-v0.125.1}` | 后端、前端 UI 和告警管理器的合体镜像     |
+| `otel-collector`                 | signoz/signoz-otel-collector:v0.144.4                             | 接收、处理和导出遥测数据                 |
 | `clickhouse`                     | clickhouse/clickhouse-server:25.5.6                               | 存储追踪、指标和日志的时序数据库         |
 | `zookeeper-1`                    | signoz/zookeeper:3.7.1                                            | ZooKeeper，用于 ClickHouse 副本元数据    |
 | `init-clickhouse`                | clickhouse/clickhouse-server:25.5.6                               | 一次性初始化，下载 histogramQuantile UDF |
-| `signoz-telemetrystore-migrator` | signoz/signoz-otel-collector:v0.144.2 | 一次性 ClickHouse Schema 迁移            |
+| `signoz-telemetrystore-migrator` | signoz/signoz-otel-collector:v0.144.4                             | 一次性 ClickHouse Schema 迁移            |

 ## 快速开始

@@ -61,13 +61,16 @@ SigNoz 是一个开源的可观测性平台，为分布式应用程序提供监
 | `SIGNOZ_PORT_OVERRIDE`           | `8080`                      | SigNoz UI 宿主机端口                |
 | `SIGNOZ_OTEL_GRPC_PORT_OVERRIDE` | `4317`                      | OTLP gRPC 接收器宿主机端口          |
 | `SIGNOZ_OTEL_HTTP_PORT_OVERRIDE` | `4318`                      | OTLP HTTP 接收器宿主机端口          |
-| `SIGNOZ_VERSION`                 | `v0.118.0`                  | SigNoz 镜像版本                     |
-| `SIGNOZ_OTEL_COLLECTOR_VERSION`  | `v0.144.2`                  | OTel Collector 镜像版本             |
+| `SIGNOZ_IMAGE_NAME`              | `signoz/signoz`             | SigNoz 镜像仓库名或镜像名           |
+| `SIGNOZ_VERSION`                 | `v0.125.1`                  | SigNoz 镜像版本                     |
+| `SIGNOZ_OTEL_COLLECTOR_VERSION`  | `v0.144.4`                  | OTel Collector 镜像版本             |
 | `SIGNOZ_CLICKHOUSE_VERSION`      | `25.5.6`                    | ClickHouse 镜像版本                 |
 | `TZ`                             | `UTC`                       | 时区                                |

 完整变量列表（含资源限制）请查看 `.env.example`。

+`SIGNOZ_IMAGE_NAME` 用于切换 SigNoz 镜像仓库，同时继续由 `SIGNOZ_VERSION` 控制标签版本。
+
 ### 发送遥测数据

 将应用程序的 OpenTelemetry SDK 配置为向以下端点导出数据：
@@ -116,7 +116,7 @@ services:
  # One-shot migration: bootstraps and runs schema migrations
  signoz-telemetrystore-migrator:
    <<: *db-depend
-    image: ${GLOBAL_REGISTRY:-}signoz/signoz-otel-collector:${SIGNOZ_OTEL_COLLECTOR_VERSION:-v0.144.2}
+    image: ${GLOBAL_REGISTRY:-}signoz/signoz-otel-collector:${SIGNOZ_OTEL_COLLECTOR_VERSION:-v0.144.4}
    restart: on-failure
    environment:
      - TZ=${TZ:-UTC}
@@ -140,7 +140,7 @@ services:
  # SigNoz all-in-one backend + frontend + alertmanager
  signoz:
    <<: *db-depend
-    image: ${GLOBAL_REGISTRY:-}signoz/signoz:${SIGNOZ_VERSION:-v0.118.0}
+    image: ${GLOBAL_REGISTRY:-}${SIGNOZ_IMAGE_NAME:-signoz/signoz}:${SIGNOZ_VERSION:-v0.125.1}
    ports:
      - '${SIGNOZ_PORT_OVERRIDE:-8080}:8080'
    volumes:
@@ -169,7 +169,7 @@ services:
  # OTel Collector for receiving telemetry data
  otel-collector:
    <<: *db-depend
-    image: ${GLOBAL_REGISTRY:-}signoz/signoz-otel-collector:${SIGNOZ_OTEL_COLLECTOR_VERSION:-v0.144.2}
+    image: ${GLOBAL_REGISTRY:-}signoz/signoz-otel-collector:${SIGNOZ_OTEL_COLLECTOR_VERSION:-v0.144.4}
    entrypoint: [/bin/sh]
    command:
      - -c