"""Add scripts workingdirectory

Backs the optional "run in this folder" field on a library script. The agent
otherwise runs a delivered script from its own staging directory, which is
correct for a self-contained script and wrong for one that shells out to a
corporate tool already installed on the endpoint (Sysinternals and similar,
delivered by Intune) and referenced by relative path.

NULLABLE with no default, so every script row that existed before this
migration stays valid and keeps today's behaviour exactly: empty means the
staging directory. The path is validated in shopdb/core/api/scripts.py where a
rejection can explain itself, not in the schema where it would only produce an
IntegrityError.

This column grants no capability. A script body is already arbitrary PowerShell
run as SYSTEM and can change its own directory; the boundary is the
endpoints.runscript grant and the digest-pinned library.

Revision ID: 7d48_script_workingdir
Revises: 7d47_endpoints_operatorreports
Create Date: 2026-09-09

"""
from alembic import op
import sqlalchemy as sa


revision = '7d48_script_workingdir'
down_revision = '7d47_endpoints_operatorreports'
branch_labels = None
depends_on = None


def upgrade():
    op.add_column('scripts', sa.Column(
        'workingdirectory', sa.String(length=255), nullable=True,
        comment='Folder to run the script in; empty means the agent staging dir'))


def downgrade():
    op.drop_column('scripts', 'workingdirectory')