@wardby/cli 0.1.0

package/dist/mcp/tools/trigger.js

@@ -0,0 +1,120 @@
+/**
+ * trigger_agent + the Tasks extension's tasks/get, tasks/cancel, and
+ * tasks/update methods. A separate module from agents.ts (Task 9's pure
+ * CRUD) — this is the one place in Phase 4 that actually produces Tasks
+ * (kind:"run"; tool_authoring is reserved/unused this phase), so
+ * registering all three here — rather than splitting them into yet
+ * another file with nothing else to register — keeps the one
+ * task-producing concern together.
+ *
+ * tasks/update is registered but always rejects: a run-backed task never
+ * enters "input_required" (runs need no mid-flight input, and guided tool
+ * authoring — the one flow that would — is deferred per Amendment A), so
+ * there is never legitimately pending input to submit. Registering it
+ * anyway (rather than leaving it unregistered, -32601) gives a client that
+ * calls it a clear, on-protocol "this task isn't awaiting input" instead
+ * of a generic method-not-found.
+ *
+ * Cancellation calls the Executor's best-effort stop seam after the Task is
+ * marked cancelled. Native execution remains cooperative until the Engine
+ * accepts an AbortSignal; coding executors must stop the isolated job.
+ *
+ * Ownership: a Task is stamped with the triggering principal's id at
+ * creation (Task.principalId) — a direct column, not resolved transitively
+ * through Run -> Agent -> ownerId, so it works uniformly even for a future
+ * tool_authoring task with no Run/Agent chain. requireOwnedTask (in
+ * ../auth/ownership.js, the one seam every ownership check in this codebase
+ * routes through) checks it before tasks/get and tasks/cancel touch the
+ * task manager — a caller who guesses or is handed someone else's taskId
+ * gets 404, not another principal's final text/cost.
+ */
+import { dispatchRun } from "../../core/dispatch.js";
+import { CodingBaseRefSchema, CodingTaskOverrideSchema } from "../../coding/protocol.js";
+import { z } from "zod";
+import { McpError } from "../errors.js";
+import { createTaskResult, getTask, cancelTask } from "../tasks/manager.js";
+import { canMutate, requireOwnedAgent, requireOwnedTask } from "../auth/ownership.js";
+import { textResult } from "./text-result.js";
+const DEFAULT_TASK_TTL_MS = 24 * 60 * 60 * 1000;
+const TriggerAgentSchema = z
+    .object({
+    agentId: z.string().trim().min(1).max(128),
+    task: CodingTaskOverrideSchema.optional(),
+    baseRef: CodingBaseRefSchema.optional(),
+})
+    .strict();
+function parseTriggerArgs(args) {
+    const parsed = TriggerAgentSchema.safeParse(args);
+    if (parsed.success)
+        return parsed.data;
+    const details = parsed.error.issues.map((issue) => `${issue.path.join(".") || "input"}: ${issue.message}`).join("; ");
+    throw new McpError(400, `Invalid trigger_agent arguments: ${details}`);
+}
+export function registerTriggerTool(mcp) {
+    mcp.registerTool({
+        name: "trigger_agent",
+        scope: "runs:trigger",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: { agentId: { type: "string" }, task: { type: "string" }, baseRef: { type: "string" } },
+            required: ["agentId"],
+        },
+        handler: async (rawArgs, ctx) => {
+            const args = parseTriggerArgs(rawArgs);
+            const agent = await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            if (agent.kind !== "coding" && (args.task !== undefined || args.baseRef !== undefined)) {
+                throw new McpError(400, "Task and baseRef overrides are only valid for coding agents.");
+            }
+            const dispatched = await dispatchRun({
+                db: ctx.db,
+                executor: ctx.providers.executor,
+                agentId: agent.id,
+                trigger: "manual",
+                codingTask: args.task,
+                codingBaseRef: args.baseRef,
+                task: ctx.clientSupportsTasks ? { principalId: ctx.principal.id, ttlMs: DEFAULT_TASK_TTL_MS } : undefined,
+                beforePersist: async (_tx, current) => {
+                    if (!canMutate(current.ownerId, ctx.principal.id)) {
+                        throw new McpError(403, `Agent "${agent.id}" is not owned by the caller.`);
+                    }
+                    return true;
+                },
+            });
+            if (!dispatched)
+                throw new Error("Run dispatch was not claimed.");
+            if (ctx.clientSupportsTasks) {
+                if (!dispatched.task)
+                    throw new Error("Run task was not persisted.");
+                return textResult(createTaskResult(dispatched.task, DEFAULT_TASK_TTL_MS));
+            }
+            return textResult({ runId: dispatched.run.id });
+        },
+    });
+    // Neither handler sets `resultType` itself: it's wire-only protocol
+    // machinery (`WireOnlyResultKey` in the SDK's own types) that the SDK
+    // stamps on encode and strips on decode before application code — ours
+    // AND the calling client's — ever sees it. Confirmed empirically: a
+    // handler-returned `resultType` field never survives the round trip
+    // through this SDK's own Client, while any other field does. A real
+    // wire capture would show it; `client.request()`'s return value won't.
+    mcp.registerRequestHandler("tasks/get", "agents:read", async (params, ctx) => {
+        const { taskId } = params;
+        await requireOwnedTask(ctx.db, taskId, ctx.principal.id);
+        return getTask(taskId, ctx.db);
+    });
+    mcp.registerRequestHandler("tasks/cancel", "runs:trigger", async (params, ctx) => {
+        const { taskId } = params;
+        await requireOwnedTask(ctx.db, taskId, ctx.principal.id);
+        await cancelTask(taskId, ctx.db, async (runId) => {
+            await ctx.providers.executor.stop(runId, "cancelled by caller");
+        });
+        return {};
+    });
+    mcp.registerRequestHandler("tasks/update", "runs:trigger", async (params, ctx) => {
+        const { taskId } = params;
+        await requireOwnedTask(ctx.db, taskId, ctx.principal.id);
+        const result = await getTask(taskId, ctx.db);
+        throw new McpError(400, `Task "${taskId}" is not awaiting input (status: ${result.status}).`);
+    });
+}

package/dist/mcp/tools/webhooks.d.ts

@@ -0,0 +1,2 @@
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerWebhookTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/webhooks.js

@@ -0,0 +1,34 @@
+import { createWebhook, listWebhooks, deleteWebhook } from "../../core/webhooks.js";
+import { requireOwnedAgent, requireOwnedWebhook } from "../auth/ownership.js";
+import { textResult } from "./text-result.js";
+export function registerWebhookTools(mcp) {
+    mcp.registerTool({
+        name: "create_webhook",
+        scope: "webhooks:write",
+        inputSchema: { type: "object", properties: { agentId: { type: "string" } }, required: ["agentId"] },
+        handler: async (args, ctx) => {
+            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            const created = await createWebhook(args.agentId, ctx.principal.id, ctx.db);
+            return textResult(created);
+        },
+    });
+    mcp.registerTool({
+        name: "list_webhooks",
+        scope: "webhooks:write",
+        inputSchema: { type: "object", properties: {} },
+        handler: async (_args, ctx) => {
+            const webhooks = await listWebhooks(ctx.principal.id, ctx.db);
+            return textResult(webhooks);
+        },
+    });
+    mcp.registerTool({
+        name: "delete_webhook",
+        scope: "webhooks:write",
+        inputSchema: { type: "object", properties: { id: { type: "string" } }, required: ["id"] },
+        handler: async (args, ctx) => {
+            await requireOwnedWebhook(ctx.db, args.id, ctx.principal.id);
+            await deleteWebhook(args.id, ctx.db);
+            return textResult({ deleted: args.id });
+        },
+    });
+}

package/dist/mcp/transport/http-limits.d.ts

@@ -0,0 +1,17 @@
+import type { IncomingMessage } from "node:http";
+export declare const HTTP_LIMITS: {
+    json: number;
+    auth: number;
+    requestMs: number;
+    headersMs: number;
+};
+export declare class HttpBoundaryError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+export declare class PayloadTooLargeError extends HttpBoundaryError {
+    constructor();
+}
+export declare function canonicalUrl(value: string): URL;
+export declare function readBody(req: IncomingMessage, maxBytes: number, signal: AbortSignal): Promise<string>;
+export declare function parseBody(raw: string, contentType: string | undefined): unknown;

package/dist/mcp/transport/http-limits.js

@@ -0,0 +1,92 @@
+export const HTTP_LIMITS = { json: 1024 * 1024, auth: 64 * 1024, requestMs: 15_000, headersMs: 10_000 };
+export class HttpBoundaryError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+export class PayloadTooLargeError extends HttpBoundaryError {
+    constructor() {
+        super(413, "payload_too_large");
+    }
+}
+export function canonicalUrl(value) {
+    const url = new URL(value);
+    const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+    if (url.username ||
+        url.password ||
+        url.hash ||
+        url.search ||
+        (url.protocol !== "https:" && !(url.protocol === "http:" && loopback))) {
+        throw new Error("Canonical URI must be HTTPS (HTTP is allowed only for loopback development), without credentials, query, or fragment.");
+    }
+    return url;
+}
+export function readBody(req, maxBytes, signal) {
+    const length = req.headers["content-length"];
+    if (length && (!/^\d+$/.test(length) || Number(length) > maxBytes))
+        return Promise.reject(new PayloadTooLargeError());
+    if (req.headers["content-encoding"] && req.headers["content-encoding"] !== "identity")
+        return Promise.reject(new HttpBoundaryError(415, "unsupported_encoding"));
+    return new Promise((resolve, reject) => {
+        let size = 0;
+        const chunks = [];
+        const clean = () => {
+            req.off("data", data);
+            req.off("end", end);
+            req.off("error", error);
+            req.off("aborted", aborted);
+            signal.removeEventListener("abort", timeout);
+        };
+        const error = (err) => {
+            clean();
+            req.pause();
+            reject(err);
+        };
+        const aborted = () => error(new HttpBoundaryError(400, "incomplete_body"));
+        const timeout = () => error(new HttpBoundaryError(408, "request_timeout"));
+        const data = (chunk) => {
+            size += chunk.length;
+            if (size > maxBytes)
+                error(new PayloadTooLargeError());
+            else
+                chunks.push(chunk);
+        };
+        const end = () => {
+            clean();
+            resolve(Buffer.concat(chunks, size).toString("utf8"));
+        };
+        req.on("data", data);
+        req.once("end", end);
+        req.once("error", error);
+        req.once("aborted", aborted);
+        signal.addEventListener("abort", timeout, { once: true });
+        if (signal.aborted)
+            timeout();
+    });
+}
+export function parseBody(raw, contentType) {
+    const type = contentType?.split(";", 1)[0].trim().toLowerCase();
+    if (type === "application/json") {
+        try {
+            const value = JSON.parse(raw);
+            if (value === null || typeof value !== "object")
+                throw new Error();
+            return value;
+        }
+        catch {
+            throw new HttpBoundaryError(400, "invalid_json");
+        }
+    }
+    if (type === "application/x-www-form-urlencoded") {
+        if (/%(?![a-f\d]{2})/i.test(raw))
+            throw new HttpBoundaryError(400, "invalid_form");
+        const params = new URLSearchParams(raw);
+        for (const key of params.keys())
+            if (params.getAll(key).length !== 1)
+                throw new HttpBoundaryError(400, "duplicate_parameter");
+        return params;
+    }
+    throw new HttpBoundaryError(415, "unsupported_content_type");
+}

package/dist/mcp/transport/stdio.d.ts

@@ -0,0 +1,23 @@
+/**
+ * stdio transport: newline-delimited JSON-RPC over the process's standard
+ * streams, no OAuth (per spec: stdio SHOULD NOT use OAuth — it retrieves
+ * credentials from the environment). `serveStdio` (the real SDK's stdio
+ * serving entry) owns era negotiation and per-connection instance
+ * construction from `mcp.factory`; this file only wires the transport.
+ *
+ * Caller identity: stdio never carries per-message AuthInfo (serveStdio
+ * never sets it), so the composition root (Task 15) must call
+ * `mcp.setFixedContext(...)` with the resolved LOCAL_PRINCIPAL identity
+ * BEFORE starting the stdio server — every tool call in the connection
+ * resolves to that one fixed context, matching "the operator is trusted."
+ */
+import type { Readable, Writable } from "node:stream";
+import type { WardbyMcpServer } from "../server.js";
+export interface StdioIo {
+    input?: Readable;
+    output?: Writable;
+}
+export interface StdioHandle {
+    close(): Promise<void>;
+}
+export declare function runStdioServer(mcp: WardbyMcpServer, io?: StdioIo): StdioHandle;

package/dist/mcp/transport/stdio.js

@@ -0,0 +1,6 @@
+import { serveStdio, StdioServerTransport } from "@modelcontextprotocol/server/stdio";
+export function runStdioServer(mcp, io = {}) {
+    const transport = new StdioServerTransport(io.input, io.output);
+    const handle = serveStdio(mcp.factory, { transport });
+    return { close: () => handle.close() };
+}

package/dist/mcp/transport/streamable-http.d.ts

@@ -0,0 +1,34 @@
+import { type ServerResponse } from "node:http";
+import { type PerRequestResponseMode } from "@modelcontextprotocol/server";
+import type { PrismaClient } from "@prisma/client";
+import type { AuthProvider } from "../../providers/auth/types.js";
+import type { SelfHostedAuthProvider } from "../../providers/auth/self-hosted.js";
+import type { WardbyMcpServer } from "../server.js";
+import type { McpProviders } from "../context.js";
+export interface HttpServerConfig {
+    canonicalUri: string;
+    httpBind: {
+        host: string;
+        port: number;
+    };
+    authProviderKind: "delegating" | "self-hosted";
+    authorizationServer?: string;
+    allowedOrigins?: string[];
+    responseMode?: PerRequestResponseMode;
+}
+export interface StartHttpServerOptions {
+    mcp: WardbyMcpServer;
+    config: HttpServerConfig;
+    auth: {
+        authProvider: AuthProvider;
+        db: PrismaClient;
+        providers: McpProviders;
+    };
+    selfHosted?: SelfHostedAuthProvider;
+}
+export interface HttpServerHandle {
+    port: number;
+    close(): Promise<void>;
+}
+export declare function sendJson(res: ServerResponse, status: number, body: unknown, headers?: Record<string, string>): void;
+export declare function startHttpServer(opts: StartHttpServerOptions): Promise<HttpServerHandle>;

package/dist/mcp/transport/streamable-http.js

@@ -0,0 +1,158 @@
+import { createServer } from "node:http";
+import { randomUUID } from "node:crypto";
+import { createMcpHandler } from "@modelcontextprotocol/server";
+import { toNodeHandler, hostHeaderValidation } from "@modelcontextprotocol/node";
+import { authenticate, protectedResourceMetadata } from "../auth/resource-server.js";
+import { McpError } from "../errors.js";
+import { handleWebhookIngress } from "../webhooks/ingress.js";
+import { canonicalUrl, HTTP_LIMITS, HttpBoundaryError, parseBody, readBody } from "./http-limits.js";
+import { browserHandler } from "../auth/self-hosted/browser.js";
+import { handleSecretElicitationForm, SECRET_ELICITATION_PATH } from "../tools/secret-elicitation-form.js";
+import { logger } from "../../core/logger.js";
+const httpLog = logger.child({ module: "streamable-http" });
+export function sendJson(res, status, body, headers = {}) {
+    res
+        .writeHead(status, { "content-type": "application/json", "cache-control": "no-store", ...headers })
+        .end(JSON.stringify(body));
+}
+export async function startHttpServer(opts) {
+    const canonical = canonicalUrl(opts.config.canonicalUri);
+    if (opts.config.authProviderKind === "self-hosted" && !opts.selfHosted)
+        throw new Error("Missing self-hosted provider.");
+    const oauth = opts.config.authProviderKind === "self-hosted" ? browserHandler(opts.selfHosted) : undefined;
+    const origins = new Set([
+        canonical.origin,
+        ...(opts.config.allowedOrigins ?? []).map((value) => {
+            const url = canonicalUrl(value);
+            if (url.origin !== value)
+                throw new Error("Allowed origins must be exact origins without paths.");
+            return value;
+        }),
+    ]);
+    const validateHost = hostHeaderValidation([canonical.hostname]);
+    const nodeHandler = toNodeHandler(createMcpHandler(opts.mcp.factory, { responseMode: opts.config.responseMode }));
+    const server = createServer({ maxHeaderSize: 16 * 1024, requireHostHeader: false }, (req, res) => {
+        void route(req, res).catch((err) => {
+            if (res.headersSent) {
+                res.destroy();
+                return;
+            }
+            if (err instanceof McpError) {
+                sendJson(res, err.httpStatus, { error: "invalid_token" }, err.wwwAuthenticate ? { "www-authenticate": err.wwwAuthenticate } : {});
+            }
+            else if (err instanceof HttpBoundaryError) {
+                res.shouldKeepAlive = false;
+                // Drain without buffering while the error response flushes, then bound socket cleanup.
+                req.resume();
+                const timer = setTimeout(() => req.destroy(), 1000);
+                timer.unref();
+                req.socket.once("close", () => clearTimeout(timer));
+                sendJson(res, err.status, { error: err.message }, { connection: "close" });
+            }
+            else {
+                const id = randomUUID();
+                httpLog.error({ err, requestId: id }, "HTTP request failed");
+                sendJson(res, 500, { error: "internal_error", id });
+            }
+        });
+    });
+    async function route(req, res) {
+        const hostCount = req.rawHeaders.filter((_, i) => i % 2 === 0 && req.rawHeaders[i].toLowerCase() === "host").length;
+        if (hostCount !== 1 || req.headers.host?.toLowerCase() !== canonical.host || !validateHost(req, res)) {
+            if (!res.headersSent)
+                sendJson(res, 403, { error: "invalid_host" }, { connection: "close" });
+            return;
+        }
+        if (req.headers.origin && !origins.has(req.headers.origin)) {
+            sendJson(res, 403, { error: "invalid_origin" }, { connection: "close" });
+            return;
+        }
+        if (!req.url?.startsWith("/") || req.url.startsWith("//"))
+            throw new HttpBoundaryError(400, "invalid_target");
+        const url = new URL(req.url, canonical.origin);
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), HTTP_LIMITS.requestMs);
+        let body;
+        try {
+            const hasBody = req.method === "POST" ||
+                req.method === "PUT" ||
+                req.method === "PATCH" ||
+                req.headers["content-length"] ||
+                req.headers["transfer-encoding"];
+            if (hasBody) {
+                const limit = url.pathname === "/mcp" || url.pathname.startsWith("/webhooks/") ? HTTP_LIMITS.json : HTTP_LIMITS.auth;
+                const raw = await readBody(req, limit, controller.signal);
+                body = parseBody(raw, req.headers["content-type"]);
+            }
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (req.method === "GET" &&
+            (url.pathname === "/.well-known/oauth-protected-resource" ||
+                url.pathname ===
+                    "/.well-known/oauth-protected-resource" + (canonical.pathname === "/" ? "" : canonical.pathname))) {
+            const authorizationServers = opts.config.authProviderKind === "self-hosted"
+                ? [canonical.href]
+                : [opts.config.authorizationServer].filter((s) => !!s);
+            sendJson(res, 200, protectedResourceMetadata({ canonicalUri: canonical.href, authorizationServers }));
+            return;
+        }
+        if (url.pathname === SECRET_ELICITATION_PATH && (req.method === "GET" || req.method === "POST")) {
+            await handleSecretElicitationForm(req.method, url.searchParams.get("t"), () => Promise.resolve(body instanceof URLSearchParams ? body : new URLSearchParams()), res, {
+                verify: (token) => opts.mcp.verifyRequestState(token),
+                secrets: opts.auth.providers.secrets,
+                db: opts.auth.db,
+            });
+            return;
+        }
+        if (oauth && (await oauth(req, res, url, body)))
+            return;
+        const webhook = /^\/webhooks\/([^/]+)$/.exec(url.pathname);
+        if (webhook && req.method === "POST") {
+            if (!body || Array.isArray(body) || body instanceof URLSearchParams)
+                throw new HttpBoundaryError(415, "expected_json_object");
+            const headers = Object.fromEntries(Object.entries(req.headers).map(([k, v]) => [k, Array.isArray(v) ? v[0] : v]));
+            const result = await handleWebhookIngress(webhook[1], { headers, body: body }, opts.auth.db, opts.auth.providers.executor);
+            sendJson(res, result.status, result.body);
+            return;
+        }
+        if (url.pathname === "/mcp") {
+            if (req.method === "POST" && (!body || body instanceof URLSearchParams))
+                throw new HttpBoundaryError(415, "expected_json");
+            const ctx = await authenticate({ authorization: req.headers.authorization }, { ...opts.auth, canonicalUri: canonical.href });
+            req.auth = {
+                token: "",
+                clientId: ctx.principal.subject,
+                scopes: [...ctx.scopes],
+                extra: { principal: ctx.principal },
+            };
+            await nodeHandler(req, res, body);
+            return;
+        }
+        sendJson(res, 404, { error: "not_found" });
+    }
+    server.requestTimeout = HTTP_LIMITS.requestMs;
+    server.headersTimeout = HTTP_LIMITS.headersMs;
+    server.keepAliveTimeout = 5_000;
+    server.maxRequestsPerSocket = 100;
+    const cleanupTimer = opts.config.authProviderKind === "self-hosted"
+        ? setInterval(() => {
+            void opts.selfHosted.cleanup().catch((err) => httpLog.error({ err }, "OAuth cleanup failed"));
+        }, 15 * 60_000)
+        : undefined;
+    cleanupTimer?.unref();
+    server.once("close", () => clearInterval(cleanupTimer));
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(opts.config.httpBind.port, opts.config.httpBind.host, resolve);
+    });
+    const address = server.address();
+    return {
+        port: typeof address === "object" && address ? address.port : opts.config.httpBind.port,
+        close: () => new Promise((resolve, reject) => {
+            server.close((err) => (err ? reject(err) : resolve()));
+            server.closeIdleConnections();
+        }),
+    };
+}

package/dist/mcp/unattended-schedules.d.ts

@@ -0,0 +1,15 @@
+import type { PrismaClient } from "@prisma/client";
+/**
+ * `wardby mcp` serves the MCP surface and launches the executor, but the
+ * scheduler and reconciler live in `wardby scheduler` (or in `wardby serve`,
+ * which runs everything). A deployment running only `mcp` accepts schedules
+ * through set_schedule and then never fires them: no error, no crash,
+ * `lastScheduledAt` simply stays null. Nothing else surfaces that.
+ *
+ * Kept free of logging and process state so it can be unit-tested and reused
+ * by any composition root.
+ */
+/** Same predicate the scheduler uses to find candidates (core/scheduler.ts). */
+export declare function countUnattendedSchedules(db: Pick<PrismaClient, "agent">): Promise<number>;
+/** The warning to log for `count` unattended schedules, or null when there is nothing to warn about. */
+export declare function unattendedSchedulesWarning(count: number): string | null;

package/dist/mcp/unattended-schedules.js

@@ -0,0 +1,21 @@
+/**
+ * `wardby mcp` serves the MCP surface and launches the executor, but the
+ * scheduler and reconciler live in `wardby scheduler` (or in `wardby serve`,
+ * which runs everything). A deployment running only `mcp` accepts schedules
+ * through set_schedule and then never fires them: no error, no crash,
+ * `lastScheduledAt` simply stays null. Nothing else surfaces that.
+ *
+ * Kept free of logging and process state so it can be unit-tested and reused
+ * by any composition root.
+ */
+/** Same predicate the scheduler uses to find candidates (core/scheduler.ts). */
+export async function countUnattendedSchedules(db) {
+    return db.agent.count({ where: { scheduleEnabled: true, schedule: { not: null } } });
+}
+/** The warning to log for `count` unattended schedules, or null when there is nothing to warn about. */
+export function unattendedSchedulesWarning(count) {
+    if (count === 0)
+        return null;
+    return (`${count} agent(s) have an enabled schedule, but this process does not run the scheduler. ` +
+        `Run "wardby scheduler" alongside it, or run "wardby serve" instead, or those schedules will never fire.`);
+}

package/dist/mcp/webhooks/ingress.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Inbound webhook ingress — HTTP-framework-agnostic. Authenticated by the
+ * per-webhook secret only (never OAuth): mounted as an unauthenticated
+ * route in streamable-http.ts, matching the design's "route is
+ * unauthenticated by OAuth" invariant.
+ */
+import type { PrismaClient } from "@prisma/client";
+import type { Executor } from "../../providers/executor/types.js";
+export interface WebhookIngressRequest {
+    headers: Record<string, string | undefined>;
+    body: Record<string, unknown>;
+}
+export interface WebhookIngressResult {
+    status: number;
+    body: Record<string, unknown>;
+}
+export declare function handleWebhookIngress(webhookId: string, req: WebhookIngressRequest, db: PrismaClient, executor: Executor): Promise<WebhookIngressResult>;

package/dist/mcp/webhooks/ingress.js

@@ -0,0 +1,33 @@
+import { resolveWebhookRun } from "../../core/webhooks.js";
+import { CodingTaskOverrideSchema } from "../../coding/protocol.js";
+function extractSecret(req) {
+    return req.headers["x-webhook-secret"] ?? (typeof req.body.secret === "string" ? req.body.secret : undefined);
+}
+function extractCodingTask(req) {
+    if (req.body.task === undefined)
+        return undefined;
+    const parsed = CodingTaskOverrideSchema.safeParse(req.body.task);
+    return parsed.success ? parsed.data : undefined;
+}
+export async function handleWebhookIngress(webhookId, req, db, executor) {
+    const secret = extractSecret(req);
+    if (!secret) {
+        return { status: 401, body: { error: "invalid_secret", error_description: "No webhook secret presented." } };
+    }
+    const codingTask = extractCodingTask(req);
+    if (req.body.task !== undefined && codingTask === undefined) {
+        return { status: 400, body: { error: "invalid_task" } };
+    }
+    const result = await resolveWebhookRun(webhookId, secret, db, executor, codingTask);
+    if (result.ok) {
+        return { status: 202, body: { runId: result.runId } };
+    }
+    switch (result.reason) {
+        case "not_found":
+            return { status: 404, body: { error: "not_found" } };
+        case "invalid_secret":
+            return { status: 401, body: { error: "invalid_secret" } };
+        case "disabled":
+            return { status: 403, body: { error: "disabled" } };
+    }
+}

package/dist/observability/config.d.ts

@@ -0,0 +1,6 @@
+import type { MetricsServerConfig } from "./metrics-server.js";
+export interface MetricsConfig {
+    bind?: MetricsServerConfig;
+}
+/** Metrics remain off unless an operator explicitly configures a bind address. */
+export declare function loadMetricsConfig(env?: NodeJS.ProcessEnv): MetricsConfig;

package/dist/observability/config.js

@@ -0,0 +1,20 @@
+function parseBind(value, allowNonLoopback) {
+    const match = /^(127\.0\.0\.1|::1|0\.0\.0\.0):([0-9]{1,5})$/.exec(value);
+    if (!match) {
+        throw new Error("METRICS_BIND must be 127.0.0.1:port, ::1:port, or 0.0.0.0:port");
+    }
+    const port = Number(match[2]);
+    if (!Number.isSafeInteger(port) || port < 1 || port > 65_535) {
+        throw new Error("METRICS_BIND port must be between 1 and 65535");
+    }
+    if (match[1] === "0.0.0.0" && !allowNonLoopback) {
+        throw new Error("METRICS_BIND may use 0.0.0.0 only when METRICS_ALLOW_NON_LOOPBACK=true");
+    }
+    return { host: match[1], port };
+}
+/** Metrics remain off unless an operator explicitly configures a bind address. */
+export function loadMetricsConfig(env = process.env) {
+    if (!env.METRICS_BIND)
+        return {};
+    return { bind: parseBind(env.METRICS_BIND, env.METRICS_ALLOW_NON_LOOPBACK === "true") };
+}

package/dist/observability/metrics-server.d.ts

@@ -0,0 +1,11 @@
+import type { Registry } from "@prometheus-io/client";
+export interface MetricsServerConfig {
+    host: string;
+    port: number;
+}
+export interface MetricsServerHandle {
+    port: number;
+    close(): Promise<void>;
+}
+/** Serve the Prometheus exposition endpoint on an explicitly private listener. */
+export declare function startMetricsServer(registry: Registry, config: MetricsServerConfig): Promise<MetricsServerHandle>;