@wardby/cli 0.1.0

package/dist/sandbox/safe-fetch.js

@@ -0,0 +1,140 @@
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { Writable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { createGunzip, createInflate, createBrotliDecompress } from "node:zlib";
+import { resolveDestination } from "./fetch-policy.js";
+import { BRIDGE_INPUT_BYTES, FETCH_RESPONSE_BYTES, FETCH_TIMEOUT_MS, MAX_REDIRECTS } from "./limits.js";
+export function pinnedLookup(destination) {
+    return (_, options, callback) => {
+        if (options?.all)
+            callback(null, [{ address: destination.address, family: destination.family }]);
+        else
+            callback(null, destination.address, destination.family);
+    };
+}
+export function requestPinned(destination, init, signal) {
+    return new Promise((resolve, reject) => {
+        // The URL preserves Host and TLS SNI. Only the vetted address reaches the socket.
+        const request = (destination.url.protocol === "https:" ? httpsRequest : httpRequest)(destination.url, {
+            method: init.method,
+            headers: init.headers,
+            lookup: pinnedLookup(destination),
+            family: destination.family,
+            agent: false,
+            signal,
+            maxHeaderSize: 16 * 1024,
+        }, resolve);
+        request.once("error", reject);
+        request.end(init.body);
+    });
+}
+async function untilAbort(promise, signal) {
+    signal.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const abort = () => reject(new Error("fetch_cancelled_or_timeout"));
+        signal.addEventListener("abort", abort, { once: true });
+        promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+    });
+}
+export async function safeFetch(input, init = {}, options = {}) {
+    const abort = new AbortController();
+    const timer = setTimeout(() => abort.abort(new Error("fetch_timeout")), FETCH_TIMEOUT_MS);
+    const signal = options.signal ? AbortSignal.any([options.signal, abort.signal]) : abort.signal;
+    let url = input;
+    let method = init.method ?? "GET";
+    let body = init.body;
+    let headers = Object.fromEntries(Object.entries(init.headers ?? {}).map(([k, v]) => [k.toLowerCase(), v]));
+    let response;
+    try {
+        if (!/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)$/.test(method))
+            throw new Error("fetch_method_invalid");
+        if (body !== undefined && (typeof body !== "string" || Buffer.byteLength(body) > BRIDGE_INPUT_BYTES))
+            throw new Error("fetch_body_limit");
+        if (Object.keys(headers).some((k) => ["host", "connection", "transfer-encoding", "content-length", "upgrade", "proxy-connection"].includes(k)))
+            throw new Error("fetch_header_invalid");
+        headers["accept-encoding"] = "identity";
+        for (let hop = 0;; hop++) {
+            signal.throwIfAborted();
+            const destination = await untilAbort(resolveDestination(url, options), signal);
+            signal.throwIfAborted();
+            response = await (options.connect ?? requestPinned)(destination, { method, headers, body }, signal);
+            const status = response.statusCode ?? 0;
+            if ([301, 302, 303, 307, 308].includes(status) && response.headers.location) {
+                response.destroy();
+                if (hop >= MAX_REDIRECTS)
+                    throw new Error("fetch_redirect_limit");
+                const next = new URL(response.headers.location, destination.url);
+                if ((status === 303 && method !== "HEAD") || ((status === 301 || status === 302) && method === "POST")) {
+                    method = "GET";
+                    body = undefined;
+                    delete headers["content-type"];
+                }
+                if (next.origin !== destination.url.origin) {
+                    if (body)
+                        throw new Error("fetch_cross_origin_body_blocked");
+                    // Only non-credential headers survive; custom API-key headers must not leak either.
+                    headers = Object.fromEntries(Object.entries(headers).filter(([key]) => ["accept", "accept-language", "content-type", "user-agent", "accept-encoding"].includes(key)));
+                }
+                url = next.href;
+                continue;
+            }
+            let encoded = 0;
+            response.on("data", (chunk) => {
+                encoded += chunk.length;
+                if (encoded > FETCH_RESPONSE_BYTES)
+                    response.destroy(new Error("fetch_response_limit"));
+            });
+            const encoding = response.headers["content-encoding"];
+            const decoder = encoding === "gzip"
+                ? createGunzip()
+                : encoding === "deflate"
+                    ? createInflate()
+                    : encoding === "br"
+                        ? createBrotliDecompress()
+                        : undefined;
+            if (encoding && encoding !== "identity" && !decoder)
+                throw new Error("fetch_encoding_invalid");
+            const chunks = [];
+            let size = 0;
+            const sink = new Writable({
+                write(chunk, _, callback) {
+                    size += chunk.length;
+                    if (size > FETCH_RESPONSE_BYTES)
+                        callback(new Error("fetch_response_limit"));
+                    else {
+                        chunks.push(chunk);
+                        callback();
+                    }
+                },
+            });
+            if (decoder)
+                await pipeline(response, decoder, sink, { signal });
+            else
+                await pipeline(response, sink, { signal });
+            const resultHeaders = Object.fromEntries(Object.entries(response.headers)
+                .filter(([key]) => !["content-encoding", "content-length", "set-cookie"].includes(key))
+                .map(([key, value]) => [key, Array.isArray(value) ? value.join(", ") : (value ?? "")]));
+            return {
+                ok: status >= 200 && status < 300,
+                status,
+                statusText: response.statusMessage ?? "",
+                url: destination.url.href,
+                headers: resultHeaders,
+                bodyBase64: Buffer.concat(chunks, size).toString("base64"),
+            };
+        }
+    }
+    catch (err) {
+        if (signal.aborted)
+            throw new Error("fetch_cancelled_or_timeout", { cause: err });
+        if (err instanceof Error && /^fetch_/.test(err.message))
+            throw err;
+        throw new Error("fetch_failed", { cause: err });
+    }
+    finally {
+        clearTimeout(timer);
+        response?.destroy();
+        abort.abort();
+    }
+}

package/dist/sandbox/tool-capabilities.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Per-attachment capability scoping for sandboxed tools (OWASP LLM08 —
+ * Excessive Agency fix): which secrets, datastore key prefixes, and fetch
+ * hosts a tool may touch, declared once at `attach_tool` time and persisted
+ * as `Json` on `AgentTool`. Mirrors the coding-agent profile's own
+ * bounded-array + zod-schema convention (`src/coding/profile.ts`) rather
+ * than a native Postgres array column.
+ */
+import { z } from "zod";
+export declare const MAX_ALLOWED_SECRETS = 64;
+export declare const MAX_ALLOWED_DATASTORE_PREFIXES = 64;
+export declare const MAX_ALLOWED_HOSTS = 64;
+export declare const MAX_ALLOWED_SHARED_DATASTORES = 16;
+/** Element that lifts the fetch allowlist entirely for a tool (existing SSRF protection against private/link-local addresses still applies). */
+export declare const FETCH_WILDCARD = "*";
+/** Full capability set — used when creating a brand-new attachment (unset fields default to deny-all). */
+export declare const ToolCapabilitiesSchema: z.ZodObject<{
+    allowedSecrets: z.ZodDefault<z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>>;
+    allowedDatastorePrefixes: z.ZodDefault<z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>>;
+    allowedHosts: z.ZodDefault<z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, "many">, string[], string[]>>;
+    allowedSharedDatastorePrefixes: z.ZodDefault<z.ZodEffects<z.ZodRecord<z.ZodEffects<z.ZodString, string, string>, z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>, Record<string, string[]>, Record<string, string[]>>>;
+}, "strict", z.ZodTypeAny, {
+    allowedSecrets: string[];
+    allowedDatastorePrefixes: string[];
+    allowedHosts: string[];
+    allowedSharedDatastorePrefixes: Record<string, string[]>;
+}, {
+    allowedSecrets?: string[] | undefined;
+    allowedDatastorePrefixes?: string[] | undefined;
+    allowedHosts?: string[] | undefined;
+    allowedSharedDatastorePrefixes?: Record<string, string[]> | undefined;
+}>;
+/** Partial capability set — used when re-declaring capabilities on an attachment that already exists; an omitted field leaves that field untouched. */
+export declare const ToolCapabilitiesPatchSchema: z.ZodObject<{
+    allowedSecrets: z.ZodOptional<z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>>;
+    allowedDatastorePrefixes: z.ZodOptional<z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>>;
+    allowedHosts: z.ZodOptional<z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, "many">, string[], string[]>>;
+    allowedSharedDatastorePrefixes: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodEffects<z.ZodString, string, string>, z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>, Record<string, string[]>, Record<string, string[]>>>;
+}, "strict", z.ZodTypeAny, {
+    allowedSecrets?: string[] | undefined;
+    allowedDatastorePrefixes?: string[] | undefined;
+    allowedHosts?: string[] | undefined;
+    allowedSharedDatastorePrefixes?: Record<string, string[]> | undefined;
+}, {
+    allowedSecrets?: string[] | undefined;
+    allowedDatastorePrefixes?: string[] | undefined;
+    allowedHosts?: string[] | undefined;
+    allowedSharedDatastorePrefixes?: Record<string, string[]> | undefined;
+}>;
+export type ToolCapabilities = z.infer<typeof ToolCapabilitiesSchema>;
+export type ToolCapabilitiesPatch = z.infer<typeof ToolCapabilitiesPatchSchema>;
+/**
+ * Coerces a Prisma `Json` column back into a string[]. Only
+ * `ToolCapabilitiesSchema`-validated data is ever written to these columns,
+ * but a DB read is never trusted blindly — malformed/foreign data degrades
+ * to "no capability" rather than throwing mid-run.
+ */
+export declare function asStringArray(value: unknown): string[];
+/**
+ * Coerces a Prisma `Json` column back into a Record<string, string[]>. Only
+ * `ToolCapabilitiesSchema`-validated data is ever written to this column,
+ * but a DB read is never trusted blindly — malformed/foreign data degrades
+ * to "no capability" (missing key, or an empty array for a malformed value)
+ * rather than throwing mid-run.
+ */
+export declare function asPrefixMap(value: unknown): Record<string, string[]>;

package/dist/sandbox/tool-capabilities.js

@@ -0,0 +1,103 @@
+/**
+ * Per-attachment capability scoping for sandboxed tools (OWASP LLM08 —
+ * Excessive Agency fix): which secrets, datastore key prefixes, and fetch
+ * hosts a tool may touch, declared once at `attach_tool` time and persisted
+ * as `Json` on `AgentTool`. Mirrors the coding-agent profile's own
+ * bounded-array + zod-schema convention (`src/coding/profile.ts`) rather
+ * than a native Postgres array column.
+ */
+import { z } from "zod";
+import { normalizeHost } from "./fetch-policy.js";
+export const MAX_ALLOWED_SECRETS = 64;
+export const MAX_ALLOWED_DATASTORE_PREFIXES = 64;
+export const MAX_ALLOWED_HOSTS = 64;
+export const MAX_ALLOWED_SHARED_DATASTORES = 16;
+const MAX_SECRET_NAME_BYTES = 1024;
+const MAX_DATASTORE_PREFIX_BYTES = 1024;
+/** Element that lifts the fetch allowlist entirely for a tool (existing SSRF protection against private/link-local addresses still applies). */
+export const FETCH_WILDCARD = "*";
+function byteLength(value) {
+    return Buffer.byteLength(value, "utf8");
+}
+function isValidHostToken(value) {
+    if (value === FETCH_WILDCARD)
+        return true;
+    try {
+        normalizeHost(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const secretNameSchema = z
+    .string()
+    .refine((v) => byteLength(v) <= MAX_SECRET_NAME_BYTES, `must be at most ${MAX_SECRET_NAME_BYTES} UTF-8 bytes`);
+const datastorePrefixSchema = z
+    .string()
+    .refine((v) => byteLength(v) <= MAX_DATASTORE_PREFIX_BYTES, `must be at most ${MAX_DATASTORE_PREFIX_BYTES} UTF-8 bytes`);
+const fetchHostSchema = z
+    .string()
+    .refine(isValidHostToken, `must be "${FETCH_WILDCARD}" or a normalizable hostname`)
+    .transform((v) => (v === FETCH_WILDCARD ? FETCH_WILDCARD : normalizeHost(v)));
+const sharedDatastorePrefixesSchema = z
+    .record(secretNameSchema, z.array(datastorePrefixSchema).max(MAX_ALLOWED_DATASTORE_PREFIXES))
+    .refine((v) => Object.keys(v).length <= MAX_ALLOWED_SHARED_DATASTORES, `at most ${MAX_ALLOWED_SHARED_DATASTORES} shared datastore bindings`);
+const toolCapabilityFields = {
+    allowedSecrets: z
+        .array(secretNameSchema)
+        .max(MAX_ALLOWED_SECRETS)
+        .transform((v) => [...new Set(v)]),
+    allowedDatastorePrefixes: z
+        .array(datastorePrefixSchema)
+        .max(MAX_ALLOWED_DATASTORE_PREFIXES)
+        .transform((v) => [...new Set(v)]),
+    allowedHosts: z
+        .array(fetchHostSchema)
+        .max(MAX_ALLOWED_HOSTS)
+        .transform((v) => [...new Set(v)]),
+    allowedSharedDatastorePrefixes: sharedDatastorePrefixesSchema,
+};
+/** Full capability set — used when creating a brand-new attachment (unset fields default to deny-all). */
+export const ToolCapabilitiesSchema = z
+    .object({
+    allowedSecrets: toolCapabilityFields.allowedSecrets.default([]),
+    allowedDatastorePrefixes: toolCapabilityFields.allowedDatastorePrefixes.default([]),
+    allowedHosts: toolCapabilityFields.allowedHosts.default([]),
+    allowedSharedDatastorePrefixes: toolCapabilityFields.allowedSharedDatastorePrefixes.default({}),
+})
+    .strict();
+/** Partial capability set — used when re-declaring capabilities on an attachment that already exists; an omitted field leaves that field untouched. */
+export const ToolCapabilitiesPatchSchema = z
+    .object({
+    allowedSecrets: toolCapabilityFields.allowedSecrets.optional(),
+    allowedDatastorePrefixes: toolCapabilityFields.allowedDatastorePrefixes.optional(),
+    allowedHosts: toolCapabilityFields.allowedHosts.optional(),
+    allowedSharedDatastorePrefixes: toolCapabilityFields.allowedSharedDatastorePrefixes.optional(),
+})
+    .strict();
+/**
+ * Coerces a Prisma `Json` column back into a string[]. Only
+ * `ToolCapabilitiesSchema`-validated data is ever written to these columns,
+ * but a DB read is never trusted blindly — malformed/foreign data degrades
+ * to "no capability" rather than throwing mid-run.
+ */
+export function asStringArray(value) {
+    return Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
+}
+/**
+ * Coerces a Prisma `Json` column back into a Record<string, string[]>. Only
+ * `ToolCapabilitiesSchema`-validated data is ever written to this column,
+ * but a DB read is never trusted blindly — malformed/foreign data degrades
+ * to "no capability" (missing key, or an empty array for a malformed value)
+ * rather than throwing mid-run.
+ */
+export function asPrefixMap(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return {};
+    const out = {};
+    for (const [key, v] of Object.entries(value)) {
+        out[key] = asStringArray(v);
+    }
+    return out;
+}

package/dist/sandbox/zod-params.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Zod-in-sandbox: the tool author's Zod schema is *source text*, compiled
+ * and evaluated inside the QuickJS sandbox — never `new Function`/`eval` in
+ * the host process. Two operations, both reusing eval-core.ts's isolated
+ * eval (pure computation, no host I/O — `installExtras` is a no-op):
+ *
+ *  - `deriveJsonSchema`: registration-time. Compiles the schema and derives
+ *    its JSON Schema (via the vendored `zod-to-json-schema`) — what's sent
+ *    to the model as the tool's `parameters`. A malformed schema fails here,
+ *    not at call time.
+ *  - `validateParams`: call-time. Compiles the same schema (again, inside
+ *    the sandbox) and parses the model-supplied arguments against it.
+ *    Zod's own validation error (a real thrown `ZodError`, whose `.message`
+ *    is already a readable issue list) becomes the sandbox failure the
+ *    engine feeds back to the model as a tool-result error — not a run
+ *    failure.
+ */
+import { type SandboxResult } from "./eval-core.js";
+/** Registration-time: compiles the schema source and derives its JSON Schema. */
+export declare function deriveJsonSchema(paramsZodSource: string): Promise<SandboxResult>;
+/** Call-time: compiles the schema source and validates the model-supplied args against it. */
+export declare function validateParams(paramsZodSource: string, rawArgs: unknown): Promise<SandboxResult>;

package/dist/sandbox/zod-params.js

@@ -0,0 +1,60 @@
+/**
+ * Zod-in-sandbox: the tool author's Zod schema is *source text*, compiled
+ * and evaluated inside the QuickJS sandbox — never `new Function`/`eval` in
+ * the host process. Two operations, both reusing eval-core.ts's isolated
+ * eval (pure computation, no host I/O — `installExtras` is a no-op):
+ *
+ *  - `deriveJsonSchema`: registration-time. Compiles the schema and derives
+ *    its JSON Schema (via the vendored `zod-to-json-schema`) — what's sent
+ *    to the model as the tool's `parameters`. A malformed schema fails here,
+ *    not at call time.
+ *  - `validateParams`: call-time. Compiles the same schema (again, inside
+ *    the sandbox) and parses the model-supplied arguments against it.
+ *    Zod's own validation error (a real thrown `ZodError`, whose `.message`
+ *    is already a readable issue list) becomes the sandbox failure the
+ *    engine feeds back to the model as a tool-result error — not a run
+ *    failure.
+ */
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+import { evalToJson } from "./eval-core.js";
+const GENERATED_DIR = fileURLToPath(new URL("./generated/", import.meta.url));
+let vendorPreludeCache;
+function getVendorPrelude() {
+    if (vendorPreludeCache)
+        return vendorPreludeCache;
+    let zodBundle;
+    let zodToJsonSchemaBundle;
+    try {
+        zodBundle = readFileSync(path.join(GENERATED_DIR, "zod.bundle.js"), "utf8");
+        zodToJsonSchemaBundle = readFileSync(path.join(GENERATED_DIR, "zod-to-json-schema.bundle.js"), "utf8");
+    }
+    catch (err) {
+        throw new Error(`Sandbox vendor bundles missing (run "npm run build:vendor" first): ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+    }
+    vendorPreludeCache =
+        `${zodBundle}\n${zodToJsonSchemaBundle}\n` +
+            `const z = __zodModule.default.z;\n` +
+            `const zodToJsonSchema = __zodToJsonSchemaModule.default.zodToJsonSchema;\n`;
+    return vendorPreludeCache;
+}
+/** Registration-time: compiles the schema source and derives its JSON Schema. */
+export async function deriveJsonSchema(paramsZodSource) {
+    const code = `${getVendorPrelude()}
+(async () => {
+  const schema = (${paramsZodSource});
+  return JSON.stringify(zodToJsonSchema(schema));
+})()`;
+    return evalToJson(code, undefined, () => { });
+}
+/** Call-time: compiles the schema source and validates the model-supplied args against it. */
+export async function validateParams(paramsZodSource, rawArgs) {
+    const code = `${getVendorPrelude()}
+(async () => {
+  const schema = (${paramsZodSource});
+  const args = ${JSON.stringify(rawArgs)};
+  return JSON.stringify(schema.parse(args));
+})()`;
+    return evalToJson(code, undefined, () => { });
+}

package/dist/serve.d.ts

@@ -0,0 +1,14 @@
+import type { McpProviders } from "./mcp/context.js";
+export interface ServeOptions {
+    /** Scheduler lease scope; defaults to "default" like `wardby scheduler --scope`. */
+    scope?: string;
+    /** Pre-built providers (tests); built once via buildMcpProviders() when omitted. */
+    providers?: McpProviders;
+}
+export interface ServeHandle {
+    /** Stops accepting schedule claims, then reconciling, then closes HTTP and the executor. */
+    close(): Promise<void>;
+    /** Whether this process currently holds the scheduler lease. */
+    isLeader(): boolean;
+}
+export declare function startServe(options?: ServeOptions): Promise<ServeHandle>;

package/dist/serve.js

@@ -0,0 +1,54 @@
+/**
+ * `wardby serve`: the complete wardby process. Runs the MCP server, the
+ * scheduler, and the reconciler together on ONE provider set and ONE
+ * executor, which is what a single-container deployment (Cloud Run, a lone
+ * VM) needs - `wardby mcp` alone never fires a schedule.
+ *
+ * Why one executor: DbosExecutor is a per-process singleton and refuses to
+ * launch twice under different ids (providers/executor/dbos.ts), and its
+ * recovery decisions key on that id. Building providers once and sharing
+ * them is the whole trick; it also gives scheduled native runs the same
+ * `providers.executor` wiring MCP-triggered runs get, so sub-agent dispatch
+ * from a scheduled run works (it does not from `wardby scheduler`).
+ *
+ * Why the scheduler and reconciler can run in every replica: the scheduler
+ * elects one ticker via a Postgres lease and enforces at-most-once with row
+ * locks regardless (core/scheduler.ts); the reconciler is deliberately not
+ * lease-gated and is safe under concurrency (core/reconciler.ts).
+ */
+import { loadCodingConcurrencyConfig, loadMcpConfig } from "./config/providers.js";
+import { drainCodingQueue } from "./core/coding-queue.js";
+import { prisma } from "./core/db.js";
+import { startReconciler } from "./core/reconciler.js";
+import { startScheduler } from "./core/scheduler.js";
+import { buildMcpProviders, startMcp } from "./mcp/index.js";
+export async function startServe(options = {}) {
+    const transport = loadMcpConfig().transport;
+    if (transport !== "http") {
+        throw new Error(`wardby serve requires MCP_TRANSPORT=http (got "${transport}"): in stdio mode stdout is the JSON-RPC wire ` +
+            `and a scheduler has no stdio client to serve. Use "wardby mcp" for stdio.`);
+    }
+    // Parsed before anything starts, so a malformed CODING_MAX_CONCURRENT or
+    // CODING_QUEUE_TIMEOUT_SEC fails fast instead of after HTTP is listening.
+    const concurrency = loadCodingConcurrencyConfig();
+    const providers = options.providers ?? buildMcpProviders().providers;
+    const mcp = await startMcp({ providers, schedulerAttached: true });
+    const reconciler = startReconciler({ executor: providers.executor });
+    const scheduler = startScheduler({
+        executor: providers.executor,
+        scope: options.scope,
+        onLeaderTick: async () => {
+            await drainCodingQueue({ db: prisma, executor: providers.executor, ...concurrency });
+        },
+    });
+    return {
+        isLeader: () => scheduler.isLeader(),
+        close: async () => {
+            // Order matters under a SIGTERM grace period: stop creating new runs,
+            // stop reaping, then let startMcp close HTTP and drain the executor.
+            scheduler.stop();
+            reconciler.stop();
+            await mcp.close();
+        },
+    };
+}

package/dist/wardby-bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/wardby-bin.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import { readFileSync } from "node:fs";
+import { CLI_USAGE } from "./cli-help.js";
+function packageVersion() {
+    const packageJson = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    if (typeof packageJson.version !== "string" || packageJson.version.length === 0) {
+        throw new Error("invalid_package_version");
+    }
+    return packageJson.version;
+}
+const command = process.argv[2];
+if (command === undefined || command === "--help" || command === "-h") {
+    process.stdout.write(`${CLI_USAGE}\n`);
+}
+else if (command === "--version" || command === "-v") {
+    process.stdout.write(`${packageVersion()}\n`);
+}
+else {
+    await import("./cli.js");
+}

package/package.json

@@ -0,0 +1,123 @@
+{
+  "name": "@wardby/cli",
+  "version": "0.1.0",
+  "description": "Self-hosted control plane for budget-guarded AI agents.",
+  "license": "Apache-2.0",
+  "homepage": "https://github.com/wardby/wardby#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/wardby/wardby.git"
+  },
+  "bugs": {
+    "url": "https://github.com/wardby/wardby/issues"
+  },
+  "keywords": [
+    "ai-agents",
+    "mcp",
+    "self-hosted",
+    "agent-governance",
+    "budget-control"
+  ],
+  "type": "module",
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "bin": {
+    "wardby": "bin/wardby.js"
+  },
+  "files": [
+    ".env.example",
+    "NOTICE",
+    "bin/",
+    "deploy/local/docker-compose.yml",
+    "dist/",
+    "prisma/migrations/",
+    "prisma/schema.prisma",
+    "scripts/git-askpass.sh"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "build:vendor": "node scripts/build-sandbox-vendor.mjs",
+    "build": "npm run build:vendor && tsc -p tsconfig.build.json",
+    "prepare": "npm run build:vendor",
+    "prepack": "npm run build",
+    "postinstall": "prisma generate --schema prisma/schema.prisma",
+    "cli": "tsx src/cli.ts",
+    "capture:autopilot": "tsx src/tools/capture-autopilot-dry-run.ts",
+    "test": "npm run build:vendor && vitest run",
+    "test:package": "node scripts/npm-package-acceptance.mjs",
+    "test:contract": "vitest run --config vitest.contract.config.ts",
+    "test:kubernetes": "WARDBY_KUBERNETES_TEST=1 vitest run src/providers/jobs/kubernetes.integration.test.ts",
+    "prisma:generate": "prisma generate",
+    "prisma:migrate": "prisma migrate deploy",
+    "db:up": "docker compose -f deploy/local/docker-compose.yml up -d",
+    "db:down": "docker compose -f deploy/local/docker-compose.yml down",
+    "coding:local:up": "docker compose --env-file .env.local -f deploy/local/docker-compose.yml -f deploy/local/docker-compose.phase5.yml up --build -d coding-proxy",
+    "coding:local:down": "docker compose --env-file .env.local -f deploy/local/docker-compose.yml -f deploy/local/docker-compose.phase5.yml down",
+    "observability:up": "docker compose --env-file .env.local -f deploy/local/docker-compose.yml -f deploy/local/docker-compose.phase5.yml -f deploy/observability/docker-compose.grafana.yml up --build -d",
+    "observability:smoke": "node scripts/grafana-smoke.mjs",
+    "observability:down": "docker compose --env-file .env.local -f deploy/local/docker-compose.yml -f deploy/local/docker-compose.phase5.yml -f deploy/observability/docker-compose.grafana.yml down",
+    "worker:image:local": "node scripts/build-local-coding-worker.mjs",
+    "test:phase5": "vitest run src/coding/observability.test.ts src/coding/profile.test.ts src/coding/protocol.test.ts src/providers/coding-proxy/proxy.test.ts src/providers/coding-proxy/secure-fetch.test.ts src/providers/coding-proxy/metering.test.ts src/providers/coding-proxy/runtime.test.ts src/providers/executor/container.test.ts src/providers/jobs/docker.test.ts src/providers/jobs/docker-isolation.test.ts src/providers/jobs/fake.test.ts src/providers/vcs/github.test.ts src/mcp/tools/trigger.test.ts src/core/webhooks.test.ts src/claude-coding-worker/driver.test.ts src/claude-coding-worker/sdk.test.ts src/claude-coding-worker/image-policy.test.ts src/claude-tool-runner/command.test.mjs src/claude-tool-runner/main.test.mjs src/claude-tool-runner/image-policy.test.ts",
+    "test:phase5:database": "vitest run src/coding/schema.database.test.ts src/providers/coding-proxy/prisma-ledger.database.test.ts src/providers/executor/container.database.test.ts src/core/coding-concurrency.database.test.ts src/core/scheduler.test.ts src/mcp/integration.test.ts",
+    "verify:phase5": "npm run typecheck && npm run test:phase5 && npm run build && npm run worker:image:policy",
+    "test:docker-isolation": "node scripts/docker-isolation-acceptance.mjs",
+    "test:docker-job": "node scripts/docker-job-acceptance.mjs",
+    "claude:images:local": "docker build -f src/claude-coding-worker/Dockerfile -t wardby-claude-coding-worker:phase5 . && docker build -f src/claude-tool-runner/Dockerfile -t wardby-claude-tool-runner:phase5 .",
+    "test:claude-compatibility": "docker build -f src/claude-coding-worker/Dockerfile.compatibility -t wardby-claude-compat:phase5 . && docker run --rm wardby-claude-compat:phase5",
+    "test:claude-docker": "node scripts/claude-docker-acceptance.mjs",
+    "test:production-boundary": "node scripts/production-boundary-policy.mjs",
+    "verify:claude-code": "npm run typecheck && npm run test:phase5 && npm run test:claude-compatibility && npm run claude:images:local && npm run test:claude-docker",
+    "worker:image:policy": "node scripts/coding-worker-image-policy.mjs"
+  },
+  "dependencies": {
+    "@anthropic-ai/bedrock-sdk": "^0.33.4",
+    "@anthropic-ai/sdk": "^0.124.0",
+    "@dbos-inc/dbos-sdk": "4.27.6",
+    "@kubernetes/client-node": "^2.0.0",
+    "@modelcontextprotocol/client": "^2.0.0",
+    "@modelcontextprotocol/node": "^2.0.0",
+    "@modelcontextprotocol/server": "^2.0.0",
+    "@prisma/client": "^6.19.3",
+    "@prometheus-io/client": "^0.16.1",
+    "croner": "^10.0.1",
+    "dotenv-flow": "^4.1.0",
+    "fast-xml-parser": "^5.11.1",
+    "gpt-tokenizer": "^2.5.0",
+    "jose": "^6.2.12",
+    "node-html-parser": "^9.0.3",
+    "openai": "^4.67.0",
+    "papaparse": "^5.7.0",
+    "pino": "^9.14.0",
+    "prisma": "^6.19.3",
+    "quickjs-emscripten": "^0.32.0",
+    "tar-stream": "^3.2.1",
+    "undici": "^8.7.0",
+    "zod": "^3.25.76",
+    "zod-to-json-schema": "^3.25.2"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@openai/codex-sdk": "0.153.4",
+    "@types/node": "^24.0.0",
+    "@types/papaparse": "^5.5.2",
+    "@types/tar-stream": "^3.1.4",
+    "esbuild": "^0.28.2",
+    "eslint": "^10.10.0",
+    "eslint-config-prettier": "^10.1.8",
+    "globals": "^17.12.0",
+    "playwright": "^1.63.0",
+    "prettier": "^3.9.6",
+    "tsx": "^4.19.0",
+    "typescript": "^5.6.0",
+    "typescript-eslint": "^8.69.0",
+    "vitest": "^4.1.11"
+  }
+}

package/prisma/migrations/20260905000000_init/migration.sql

@@ -0,0 +1,34 @@
+-- Hand-written per CLEANROOM.md (never `db push`, never generated from
+-- another project's migrations). Mirrors prisma/schema.prisma exactly.
+
+CREATE TYPE "RunStatus" AS ENUM ('pending', 'running', 'succeeded', 'failed', 'refused');
+
+CREATE TABLE "Agent" (
+    "id" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "systemPrompt" TEXT NOT NULL,
+    "model" TEXT NOT NULL,
+    "budgetUsd" DECIMAL(10,4) NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "Agent_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "Agent_name_key" ON "Agent"("name");
+
+CREATE TABLE "Run" (
+    "id" TEXT NOT NULL,
+    "agentId" TEXT NOT NULL,
+    "status" "RunStatus" NOT NULL DEFAULT 'pending',
+    "tokensIn" INTEGER NOT NULL DEFAULT 0,
+    "tokensOut" INTEGER NOT NULL DEFAULT 0,
+    "costUsd" DECIMAL(10,6) NOT NULL DEFAULT 0,
+    "error" TEXT,
+    "startedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "finishedAt" TIMESTAMP(3),
+
+    CONSTRAINT "Run_pkey" PRIMARY KEY ("id")
+);
+
+ALTER TABLE "Run" ADD CONSTRAINT "Run_agentId_fkey" FOREIGN KEY ("agentId") REFERENCES "Agent"("id") ON DELETE RESTRICT ON UPDATE CASCADE;