@wardby/cli 0.2.0 → 0.3.0

package/dist/mcp/auth/self-hosted/credentials.d.ts

@@ -1,4 +1,6 @@
-import type { Prisma, PrismaClient } from "@prisma/client";
+import type { Prisma, PrismaClient } from "#prisma";
+/** Rejects unknown role names loudly; returns the deduplicated list. */
+export declare function validateRoles(roles: readonly string[]): string[];
 export type AuthDb = Prisma.TransactionClient;
 export declare const DAY = 86400000;
 export declare function decodeKey(value: string, name: string): Buffer;
@@ -26,19 +28,34 @@ export declare function lockUser(tx: AuthDb, id: string): Promise<{
     createdAt: Date;
     updatedAt: Date;
     principalId: string;
+    roles: string[];
     displayName: string | null;
 }>;
 export declare class IdentityService {
     readonly db: PrismaClient;
     readonly credentials: Credentials;
     constructor(db: PrismaClient, hashKey: string);
-    createUser(subject: string): Promise<{
+    createUser(subject: string, roles?: readonly string[]): Promise<{
         userId: string;
         subject: string;
+        roles: string[];
         loginKey: string;
     }>;
     createKey(subject: string): Promise<string>;
     disableUser(subject: string): Promise<void>;
+    /**
+     * Adds and/or removes roles on an existing user (never creates one). Any
+     * actual change signs the user out in the same transaction: their OAuth
+     * grant families, refresh grants, browser sessions and unexchanged
+     * authorization codes are revoked, and they sign in and authorize afresh.
+     * (Roles are also read live on every request, so even a direct database
+     * edit applies to live tokens at once.) A no-op change revokes nothing.
+     */
+    changeRoles(subject: string, add: readonly string[], remove: readonly string[]): Promise<{
+        subject: string;
+        roles: string[];
+        revokedGrants: boolean;
+    }>;
     revokeKey(keyId: string): Promise<void>;
     listUsers(): Prisma.PrismaPromise<{
         status: string;
@@ -46,13 +63,14 @@ export declare class IdentityService {
             subject: string;
         };
         id: string;
+        roles: string[];
         displayName: string | null;
     }[]>;
     listKeys(subject: string): Prisma.PrismaPromise<{
         createdAt: Date;
         keyId: string;
-        lastUsedAt: Date | null;
         expiresAt: Date;
+        lastUsedAt: Date | null;
         revokedAt: Date | null;
     }[]>;
 }

package/dist/mcp/auth/self-hosted/credentials.js

@@ -1,5 +1,13 @@
 import { createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { requireSubject } from "../../../providers/auth/subject.js";
+import { ROLE_NAMES, isRoleName } from "../resource-server.js";
+/** Rejects unknown role names loudly; returns the deduplicated list. */
+export function validateRoles(roles) {
+    for (const r of roles)
+        if (!isRoleName(r))
+            throw new Error(`Unknown role "${r}" (known roles: ${ROLE_NAMES.join(", ")}).`);
+    return [...new Set(roles)];
+}
 export const DAY = 86_400_000;
 export function decodeKey(value, name) {
     if (!/^[a-f\d]{64}$/i.test(value))
@@ -43,16 +51,17 @@ export class IdentityService {
         this.db = db;
         this.credentials = new Credentials(hashKey);
     }
-    async createUser(subject) {
+    async createUser(subject, roles = []) {
         requireSubject(subject);
+        const granted = validateRoles(roles);
         return this.db.$transaction(async (tx) => {
             const principal = await tx.principal.upsert({ where: { subject }, create: { subject }, update: {} });
-            const user = await tx.authUser.create({ data: { principalId: principal.id } });
+            const user = await tx.authUser.create({ data: { principalId: principal.id, roles: granted } });
             const key = this.credentials.create("rvk");
             await tx.authLoginKey.create({
                 data: { keyId: key.id, userId: user.id, secretHash: key.hash, expiresAt: new Date(Date.now() + 365 * DAY) },
             });
-            return { userId: user.id, subject, loginKey: key.token };
+            return { userId: user.id, subject, roles: granted, loginKey: key.token };
         });
     }
     async createKey(subject) {
@@ -81,6 +90,49 @@ export class IdentityService {
             await tx.oAuthFamily.updateMany({ where: { userId: user.id }, data: { revokedAt: now } });
         });
     }
+    /**
+     * Adds and/or removes roles on an existing user (never creates one). Any
+     * actual change signs the user out in the same transaction: their OAuth
+     * grant families, refresh grants, browser sessions and unexchanged
+     * authorization codes are revoked, and they sign in and authorize afresh.
+     * (Roles are also read live on every request, so even a direct database
+     * edit applies to live tokens at once.) A no-op change revokes nothing.
+     */
+    async changeRoles(subject, add, remove) {
+        const adding = validateRoles(add);
+        const removing = validateRoles(remove);
+        const both = adding.filter((r) => removing.includes(r));
+        if (both.length)
+            throw new Error(`Cannot both grant and revoke: ${both.join(", ")}.`);
+        const user = await this.db.authUser.findFirst({ where: { principal: { subject: requireSubject(subject) } } });
+        if (!user)
+            throw new Error("Unknown user.");
+        return this.db.$transaction(async (tx) => {
+            await tx.$queryRaw `SELECT "id" FROM "AuthUser" WHERE "id" = ${user.id} FOR UPDATE`;
+            const current = (await tx.authUser.findUniqueOrThrow({ where: { id: user.id } })).roles ?? [];
+            const roles = ROLE_NAMES.filter((r) => (current.includes(r) || adding.includes(r)) && !removing.includes(r));
+            await tx.authUser.update({ where: { id: user.id }, data: { roles } });
+            // ANY change signs the user out (families, refresh grants, sessions,
+            // unexchanged codes): a revoked role must never come back through an
+            // old token, and a granted role must never silently widen a grant the
+            // user consented to while it was inert — they authorize afresh.
+            const changed = roles.length !== current.length || roles.some((r) => !current.includes(r));
+            if (changed) {
+                const now = new Date();
+                await tx.oAuthAuthorizationCode.updateMany({
+                    where: { userId: user.id, consumedAt: null },
+                    data: { consumedAt: now },
+                });
+                await tx.authSession.updateMany({ where: { userId: user.id, revokedAt: null }, data: { revokedAt: now } });
+                await tx.oAuthFamily.updateMany({ where: { userId: user.id, revokedAt: null }, data: { revokedAt: now } });
+                await tx.oAuthGrant.updateMany({
+                    where: { family: { userId: user.id }, revokedAt: null },
+                    data: { revokedAt: now },
+                });
+            }
+            return { subject, roles, revokedGrants: changed };
+        });
+    }
     async revokeKey(keyId) {
         const key = await this.db.authLoginKey.findUnique({ where: { keyId } });
         if (!key)
@@ -94,7 +146,13 @@ export class IdentityService {
     }
     listUsers() {
         return this.db.authUser.findMany({
-            select: { id: true, status: true, displayName: true, principal: { select: { subject: true } } },
+            select: {
+                id: true,
+                status: true,
+                roles: true,
+                displayName: true,
+                principal: { select: { subject: true } },
+            },
         });
     }
     listKeys(subject) {

package/dist/mcp/auth/self-hosted/rate-limit.d.ts

@@ -1,4 +1,4 @@
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import type { Credentials } from "./credentials.js";
 export interface RateLimiter {
     check(bucket: string, identity: string, limit: number): Promise<void>;

package/dist/mcp/auth/self-hosted/session.d.ts

@@ -1,4 +1,4 @@
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import type { Credentials } from "./credentials.js";
 import { type AuthDb } from "./credentials.js";
 export declare class Sessions {
@@ -21,13 +21,14 @@ export declare class Sessions {
             createdAt: Date;
             updatedAt: Date;
             principalId: string;
+            roles: string[];
             displayName: string | null;
         };
     } & {
         createdAt: Date;
+        expiresAt: Date;
         userId: string;
         secretHash: string;
-        expiresAt: Date;
         revokedAt: Date | null;
         sessionId: string;
         lastSeenAt: Date;

package/dist/mcp/context.d.ts

@@ -7,13 +7,39 @@
  * registry also carries jobs/email/auth/storage seams no Phase 4 tool
  * needs and this plan never builds real adapters for.
  */
-import type { Principal, PrismaClient } from "@prisma/client";
+import type { Principal, PrismaClient } from "#prisma";
 import type { RequestStateAccessor } from "@modelcontextprotocol/server";
 import type { ProviderRegistry } from "../providers/index.js";
-export type McpProviders = Pick<ProviderRegistry, "llm" | "engine" | "datastore" | "secrets" | "executor" | "memory">;
+import type { RepoAccessGate } from "../core/repo-access.js";
+import type { HostUserAuthorizerRegistry, ReviewHostRegistry } from "../providers/review-host/types.js";
+export type McpProviders = Pick<ProviderRegistry, "llm" | "engine" | "datastore" | "secrets" | "executor" | "memory"> & {
+    reviewHosts?: ReviewHostRegistry;
+    /** Identity linking (link_host_account); empty or absent = linking disabled. */
+    hostUserAuthorizers?: HostUserAuthorizerRegistry;
+    /**
+     * Repository authorization (link_repository, coding profiles, host events).
+     * Absent = nothing can be authorized through host access (fail closed);
+     * only admin approvals still work.
+     */
+    repoAccess?: RepoAccessGate;
+};
 export interface McpRequestContext {
     principal: Principal;
     scopes: Set<string>;
+    /**
+     * The caller's wardby roles (resource-server.ts ROLE_PERMISSIONS), resolved
+     * per request, never cached: a privileged scope is honoured only when one
+     * of these grants it (see requireScope). Absent/empty = member.
+     */
+    roles?: readonly string[];
+    /**
+     * The stdio local operator (set only by index.ts localOperatorContext):
+     * owner of every resource for access checks, unfiltered listings. Depends
+     * on the transport, never on the principal, so an HTTP caller whose
+     * subject equals LOCAL_PRINCIPAL never gets it (A10). It never bypasses
+     * the binding rules (auth/access.ts requireBindingOwner).
+     */
+    operator?: boolean;
     /**
      * The server's resource identifier, for tool handlers that need a
      * field-level scope step-up beyond the tool's own declared scope (e.g.

package/dist/mcp/errors.d.ts

@@ -1,9 +1,3 @@
-/**
- * MCP-layer errors that carry an HTTP status + WWW-Authenticate challenge —
- * the transport (Task 7) maps these to the actual HTTP response; JSON-RPC
- * dispatch (Task 6) maps them to a JSON-RPC error object. One error type
- * for both call sites avoids two parallel error hierarchies.
- */
 export declare class McpError extends Error {
     readonly httpStatus: number;
     readonly wwwAuthenticate?: string;
@@ -11,3 +5,28 @@ export declare class McpError extends Error {
 }
 export declare function unauthorized(message: string, resourceMetadataUrl: string): McpError;
 export declare function insufficientScope(scopes: string[], resourceMetadataUrl: string): McpError;
+/**
+ * The one place a Prisma error becomes a client-facing McpError, applied at
+ * both MCP dispatch sites (server.ts) so no handler leaks the raw
+ * "Invalid `prisma.x.create()` invocation" text. A handler that already
+ * maps an error to its own, more specific McpError keeps that message: an
+ * McpError passes through here unchanged.
+ *
+ * - P2002 (unique violation) -> 409 naming the model and the unique fields.
+ *   An `ownerId` component is described ("for this owner") rather than
+ *   named, since per-owner uniques are the common case.
+ * - P2003 (foreign key) -> 409, worded for both directions: a delete blocked
+ *   by a reference (ON DELETE RESTRICT), or an insert/update pointing at a
+ *   row that no longer exists (e.g. attach_tool racing delete_tool).
+ * - A serialization failure or deadlock in one of the Serializable
+ *   transactions, in any of the shapes isSerializationConflict knows (P2034,
+ *   a raw-statement P2010, or an unwrapped driver adapter error at COMMIT)
+ *   -> 409 asking the client to retry.
+ * - Any other Prisma client error -> a generic 500 carrying only a
+ *   reference id. Its message ("Invalid `tx.tool.update()` invocation in
+ *   /path/to/file.ts:…") can include server source paths and query detail,
+ *   so it is logged here, under that id, and never sent.
+ * - Anything else (an McpError, a plain Error) is returned unchanged for the
+ *   caller to rethrow.
+ */
+export declare function mapPrismaError(err: unknown): unknown;

package/dist/mcp/errors.js

@@ -4,6 +4,10 @@
  * dispatch (Task 6) maps them to a JSON-RPC error object. One error type
  * for both call sites avoids two parallel error hierarchies.
  */
+import { randomUUID } from "node:crypto";
+import { Prisma } from "#prisma";
+import { isSerializationConflict } from "../core/dispatch.js";
+import { logger } from "../core/logger.js";
 export class McpError extends Error {
     httpStatus;
     wwwAuthenticate;
@@ -20,3 +24,97 @@ export function unauthorized(message, resourceMetadataUrl) {
 export function insufficientScope(scopes, resourceMetadataUrl) {
     return new McpError(403, `Insufficient scope; this operation requires: ${scopes.join(" ")}`, `Bearer resource_metadata="${resourceMetadataUrl}", scope="${scopes.join(" ")}"`);
 }
+/** "BudgetGroup" -> "budget group". */
+function humanizeModel(modelName) {
+    return modelName.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase();
+}
+function withArticle(noun) {
+    return `${/^[aeiou]/.test(noun) ? "An" : "A"} ${noun}`;
+}
+/**
+ * The fields behind a P2002, from whichever shape reported them: a classic
+ * `meta.target`, the driver adapter's `constraint.fields`, or -- what
+ * @prisma/adapter-pg actually reports, since PostgreSQL always names the
+ * violated constraint -- the index name, which follows Prisma's default
+ * `<Model>_<field>[_<field>...]_key` naming for every @unique/@@unique in
+ * schema.prisma. Pinned against a real database in
+ * core/prisma-adapter.database.test.ts.
+ */
+function uniqueFields(meta, modelName) {
+    const target = meta?.target;
+    if (Array.isArray(target) && target.every((t) => typeof t === "string"))
+        return target;
+    if (typeof target === "string")
+        return [target];
+    const adapterError = meta?.driverAdapterError;
+    const constraint = adapterError?.cause?.constraint;
+    if (Array.isArray(constraint?.fields) && constraint.fields.every((f) => typeof f === "string")) {
+        return constraint.fields;
+    }
+    const index = constraint?.index;
+    if (typeof index === "string" && modelName && index.startsWith(`${modelName}_`) && index.endsWith("_key")) {
+        return index.slice(modelName.length + 1, -"_key".length).split("_");
+    }
+    return [];
+}
+/**
+ * The one place a Prisma error becomes a client-facing McpError, applied at
+ * both MCP dispatch sites (server.ts) so no handler leaks the raw
+ * "Invalid `prisma.x.create()` invocation" text. A handler that already
+ * maps an error to its own, more specific McpError keeps that message: an
+ * McpError passes through here unchanged.
+ *
+ * - P2002 (unique violation) -> 409 naming the model and the unique fields.
+ *   An `ownerId` component is described ("for this owner") rather than
+ *   named, since per-owner uniques are the common case.
+ * - P2003 (foreign key) -> 409, worded for both directions: a delete blocked
+ *   by a reference (ON DELETE RESTRICT), or an insert/update pointing at a
+ *   row that no longer exists (e.g. attach_tool racing delete_tool).
+ * - A serialization failure or deadlock in one of the Serializable
+ *   transactions, in any of the shapes isSerializationConflict knows (P2034,
+ *   a raw-statement P2010, or an unwrapped driver adapter error at COMMIT)
+ *   -> 409 asking the client to retry.
+ * - Any other Prisma client error -> a generic 500 carrying only a
+ *   reference id. Its message ("Invalid `tx.tool.update()` invocation in
+ *   /path/to/file.ts:…") can include server source paths and query detail,
+ *   so it is logged here, under that id, and never sent.
+ * - Anything else (an McpError, a plain Error) is returned unchanged for the
+ *   caller to rethrow.
+ */
+export function mapPrismaError(err) {
+    if (isSerializationConflict(err)) {
+        return new McpError(409, "A concurrent change conflicted with this one; retry the request.");
+    }
+    if (!isPrismaClientError(err))
+        return err;
+    if (!(err instanceof Prisma.PrismaClientKnownRequestError))
+        return internalDatabaseError(err);
+    const meta = err.meta;
+    const modelName = typeof meta?.modelName === "string" ? meta.modelName : undefined;
+    const noun = modelName ? humanizeModel(modelName) : undefined;
+    if (err.code === "P2002") {
+        const fields = uniqueFields(meta, modelName);
+        const named = fields.filter((f) => f !== "ownerId");
+        if (!noun || named.length === 0)
+            return new McpError(409, "A record with those values already exists.");
+        const scope = named.length < fields.length ? " for this owner" : "";
+        return new McpError(409, `${withArticle(noun)} with that ${named.join(" and ")} already exists${scope}.`);
+    }
+    if (err.code === "P2003") {
+        return new McpError(409, `The ${noun ?? "record"} conflicts with a related record: it is still referenced by another record, or refers to one that no longer exists.`);
+    }
+    return internalDatabaseError(err);
+}
+function isPrismaClientError(err) {
+    return ((err instanceof Error && err.name === "DriverAdapterError") ||
+        err instanceof Prisma.PrismaClientKnownRequestError ||
+        err instanceof Prisma.PrismaClientUnknownRequestError ||
+        err instanceof Prisma.PrismaClientValidationError ||
+        err instanceof Prisma.PrismaClientInitializationError ||
+        err instanceof Prisma.PrismaClientRustPanicError);
+}
+function internalDatabaseError(err) {
+    const reference = randomUUID();
+    logger.error({ err, reference }, "database error in an MCP handler; the client sees only the reference");
+    return new McpError(500, `Internal database error (reference: ${reference}).`);
+}

package/dist/mcp/host-events/github-ingress.d.ts

@@ -0,0 +1,36 @@
+/**
+ * GitHub App webhook ingress — framework-agnostic, mounted unauthenticated
+ * (by OAuth) in streamable-http.ts at /hosts/github/events. Authenticated by
+ * the App's webhook secret (X-Hub-Signature-256) over the raw body.
+ * Nothing from the body is logged.
+ */
+import { type PrismaClient } from "#prisma";
+import type { HostEventDb } from "../../core/host-events.js";
+import type { Executor } from "../../providers/executor/types.js";
+import type { ReviewHostRegistry } from "../../providers/review-host/types.js";
+import type { RepoAccessGate } from "../../core/repo-access.js";
+export interface GitHubIngressDeps {
+    db: HostEventDb & Pick<PrismaClient, "hostEventDelivery">;
+    executor: Executor;
+    hosts: ReviewHostRegistry;
+    /** Repository authorization for every dispatch, and the mention author's permission. */
+    repoAccess: RepoAccessGate;
+    webhookSecret: string | undefined;
+    appIdentity: () => Promise<{
+        id: number;
+        slug: string;
+    }>;
+    now?: () => Date;
+}
+export interface GitHubIngressResult {
+    status: number;
+    body: Record<string, unknown>;
+    /** Cosmetic follow-ups (reactions) to run after the response is sent. */
+    afterResponse?: () => Promise<void>;
+}
+export declare function handleGitHubEventIngress(req: {
+    headers: Record<string, string | undefined>;
+    rawBody: string;
+}, deps: GitHubIngressDeps): Promise<GitHubIngressResult>;
+/** Test-only: reset the prune clock. */
+export declare function resetPruneClockForTests(): void;

package/dist/mcp/host-events/github-ingress.js

@@ -0,0 +1,92 @@
+/**
+ * GitHub App webhook ingress — framework-agnostic, mounted unauthenticated
+ * (by OAuth) in streamable-http.ts at /hosts/github/events. Authenticated by
+ * the App's webhook secret (X-Hub-Signature-256) over the raw body.
+ * Nothing from the body is logged.
+ */
+import { Prisma } from "#prisma";
+import { routeHostEvent } from "../../core/host-events.js";
+import { logger } from "../../core/logger.js";
+import { normalizeGitHubEvent, verifyGitHubSignature } from "../../providers/review-host/github-events.js";
+const log = logger.child({ module: "github-ingress" });
+const DELIVERY_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
+const PRUNE_INTERVAL_MS = 60 * 60 * 1000;
+const SAFE_DELIVERY = /^[A-Za-z0-9-]{1,100}$/;
+let lastPruneAt = 0;
+export async function handleGitHubEventIngress(req, deps) {
+    if (!deps.webhookSecret)
+        return { status: 404, body: { error: "not_found" } };
+    if (!verifyGitHubSignature(req.rawBody, req.headers["x-hub-signature-256"], deps.webhookSecret)) {
+        return { status: 401, body: { error: "invalid_signature" } };
+    }
+    const deliveryId = req.headers["x-github-delivery"];
+    const eventName = req.headers["x-github-event"];
+    if (!deliveryId || !SAFE_DELIVERY.test(deliveryId) || !eventName) {
+        return { status: 400, body: { error: "missing_delivery_headers" } };
+    }
+    const now = (deps.now ?? (() => new Date()))();
+    let payload;
+    try {
+        payload = JSON.parse(req.rawBody);
+    }
+    catch {
+        return { status: 400, body: { error: "invalid_json" } };
+    }
+    const app = await deps.appIdentity();
+    const event = normalizeGitHubEvent(eventName, payload, app);
+    // An event we don't act on must never claim the delivery id: recording it
+    // here would let a later, real delivery of the same id (GitHub does reuse
+    // ids across distinct redeliveries of what it considers the same event)
+    // be silently swallowed as a "duplicate" of something we never routed.
+    if (!event)
+        return { status: 202, body: { ignored: true } };
+    try {
+        await deps.db.hostEventDelivery.create({ data: { provider: "github", deliveryId } });
+    }
+    catch (err) {
+        if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === "P2002") {
+            return { status: 202, body: { duplicate: true } };
+        }
+        throw err;
+    }
+    if (now.getTime() - lastPruneAt > PRUNE_INTERVAL_MS) {
+        lastPruneAt = now.getTime();
+        await deps.db.hostEventDelivery
+            .deleteMany({ where: { receivedAt: { lt: new Date(now.getTime() - DELIVERY_RETENTION_MS) } } })
+            .catch((err) => log.warn({ err }, "delivery prune failed"));
+    }
+    // The delivery row is recorded before routing so a duplicate can never
+    // race past it, but that means a transient failure inside routeHostEvent
+    // must not leave a delivery permanently marked "done" — GitHub's redelivery
+    // would then hit our P2002 dedup check and the event would be lost for
+    // good. On failure here, un-record the delivery and rethrow so the retry
+    // (ours or GitHub's redelivery) is routed for real, not reported duplicate.
+    try {
+        const routed = await routeHostEvent(event, {
+            db: deps.db,
+            executor: deps.executor,
+            hosts: deps.hosts,
+            repoAccess: deps.repoAccess,
+            mentionHandle: app.slug,
+        });
+        log.info({ event: event.kind, repository: event.repository, deliveryId, runIds: routed.runIds }, "host event routed");
+        return {
+            status: 202,
+            body: { runIds: routed.runIds },
+            afterResponse: async () => {
+                for (const followUp of routed.followUps)
+                    await followUp();
+            },
+        };
+    }
+    catch (err) {
+        await deps.db.hostEventDelivery
+            .deleteMany({ where: { provider: "github", deliveryId } })
+            .catch((delErr) => log.warn({ err: delErr }, "could not roll back the delivery record after a routing failure"));
+        throw err;
+    }
+}
+/** Test-only: reset the prune clock. */
+export function resetPruneClockForTests() {
+    lastPruneAt = 0;
+}

package/dist/mcp/host-events/github-user-callback.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The browser end of link_host_account: GitHub redirects here after the user
+ * authorizes the App (GET /hosts/github/user-callback?code&state). Mounted in
+ * streamable-http.ts behind its canonical-Host check, and only when the App's
+ * OAuth client credentials are configured. It shows the one-time
+ * confirmation code the initiating principal must submit over MCP, never a
+ * token. No script, no forms, no framing, nothing cached, no referrer.
+ */
+import type { ServerResponse } from "node:http";
+import type { PrismaClient } from "#prisma";
+import type { HostUserAuthorizer } from "../../providers/review-host/types.js";
+export interface HostUserCallbackDeps {
+    db: Pick<PrismaClient, "hostIdentityLinkRequest">;
+    authorizer: HostUserAuthorizer;
+    /** Exactly the redirect_uri the authorize URL carried (the App's registered Callback URL). */
+    redirectUri: string;
+}
+export declare function handleHostUserCallback(url: URL, res: ServerResponse, deps: HostUserCallbackDeps): Promise<void>;

package/dist/mcp/host-events/github-user-callback.js

@@ -0,0 +1,50 @@
+import { completeHostIdentityCallback } from "../../core/host-identity-links.js";
+import { PAGE_STYLE } from "../shared/page-style.js";
+function escape(value) {
+    return value.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+}
+function page(res, status, title, body) {
+    res.setHeader("content-security-policy", "default-src 'none'; style-src 'unsafe-inline'; form-action 'none'; frame-ancestors 'none'; base-uri 'none'");
+    res.setHeader("cache-control", "no-store");
+    res.setHeader("referrer-policy", "no-referrer");
+    res.setHeader("x-frame-options", "DENY");
+    res.setHeader("x-content-type-options", "nosniff");
+    res
+        .writeHead(status, { "content-type": "text/html; charset=utf-8" })
+        .end(`<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">` +
+        `<title>wardby: ${escape(title)}</title><style>${PAGE_STYLE}</style><body><div class="card"><div class="kicker">wardby</div>` +
+        `<h1>${escape(title)}</h1>${body}</div></body></html>`);
+}
+export async function handleHostUserCallback(url, res, deps) {
+    const error = url.searchParams.get("error");
+    if (error !== null) {
+        if (error === "access_denied") {
+            page(res, 200, "Linking cancelled", "<p>You cancelled on GitHub. Nothing was linked; you can close this page.</p>");
+        }
+        else {
+            page(res, 400, "Linking failed", "<p>GitHub did not authorize the link. Start again from your MCP client.</p>");
+        }
+        return;
+    }
+    const outcome = await completeHostIdentityCallback({
+        db: deps.db,
+        authorizer: deps.authorizer,
+        state: url.searchParams.get("state"),
+        code: url.searchParams.get("code"),
+        redirectUri: deps.redirectUri,
+    });
+    if (outcome.kind === "invalid") {
+        page(res, 400, "Link not valid", "<p>This link is invalid or has expired. Start again from your MCP client with <code>link_host_account</code>.</p>");
+        return;
+    }
+    if (outcome.kind === "failed") {
+        page(res, 502, "Linking failed", "<p>GitHub did not complete the sign-in. Start again from your MCP client.</p>");
+        return;
+    }
+    page(res, 200, "Confirm the link", `<p>Signed in to GitHub as <strong>@${escape(outcome.login)}</strong>, to be linked to the wardby account ` +
+        `<strong>${escape(outcome.subject)}</strong>.</p>` +
+        `<p>Give your MCP client this code (call <code>link_host_account</code> with <code>confirmationCode</code>):</p>` +
+        `<p style="font-size:2em;font-family:monospace;letter-spacing:.1em"><strong>${escape(outcome.code)}</strong></p>` +
+        `<p>It works once, within 10 minutes. <strong>If you did not start this, close this page</strong> and do not ` +
+        `share the code: someone may be trying to use your GitHub account's access.</p>`);
+}

package/dist/mcp/index.d.ts

@@ -1,6 +1,13 @@
 import { type WardbyMcpServer } from "./server.js";
-import type { McpProviders } from "./context.js";
+import type { McpProviders, McpRequestContext } from "./context.js";
+import type { Principal, PrismaClient } from "#prisma";
 import { type SecretElicitationUrlBuilder } from "./tools/secrets.js";
+/**
+ * stdio's one fixed identity: the local operator (LOCAL_PRINCIPAL), trusted
+ * with every supported scope and every role — whoever can start the
+ * process already holds the database and its keys.
+ */
+export declare function localOperatorContext(principal: Principal, providers: McpProviders, db: PrismaClient): McpRequestContext;
 /** Registers the full Phase 4 tool surface — every module, in one place. */
 export declare function registerAllTools(mcp: WardbyMcpServer, opts: {
     secretElicitationUrl: SecretElicitationUrlBuilder;