@wardby/cli 0.2.0 → 0.3.0

package/dist/mcp/tools/budget-groups.js

@@ -107,13 +107,13 @@ export function registerBudgetGroupTools(mcp) {
         handler: async (args, ctx) => {
             const group = await ctx.db.budgetGroup.findUnique({
                 where: { id: args.id },
-                include: { agents: { select: { id: true, name: true } } },
+                include: { agents: { select: { id: true, name: true, budgetUsd: true } } },
             });
             if (!group || !canRead(group.ownerId, ctx.principal.id)) {
                 throw new McpError(404, `Budget group "${args.id}" not found.`);
             }
-            const spend = await computeGroupSpend(ctx.db, group, group.agents.map((a) => a.id), new Date());
-            return textResult({ ...group, spend });
+            const spend = await computeGroupSpend(ctx.db, group, group.agents, new Date());
+            return textResult({ ...group, agents: group.agents.map(({ id, name }) => ({ id, name })), spend });
         },
     });
     mcp.registerTool({

package/dist/mcp/tools/datastore.js

@@ -1,17 +1,15 @@
-import { Prisma } from "@prisma/client";
-import { requireOwnedAgent, requireReadableAgent, requireOwnedDatastore, canRead, assertCanMutate, } from "../auth/ownership.js";
+import { Prisma } from "#prisma";
+import { requireOwnedDatastore, canRead, assertCanMutate } from "../auth/ownership.js";
+import { requireAgentAccess, requireBindingOwner } from "../auth/access.js";
 import { createDatastore, listDatastores, deleteDatastore, attachDatastore, detachDatastore, buildSharedDatastoreAccessor, } from "../../core/datastores.js";
 import { McpError } from "../errors.js";
 import { textResult } from "./text-result.js";
 /**
  * A `boundName` names an *attachment* (agentId, boundName) -> Datastore.
- * requireOwnedAgent/requireReadableAgent only check the agent's own
- * ownership — for a public (null-owner) agent that's readable/mutable by
- * anyone, so gating solely on the agent would let a principal who attaches
- * their own private Datastore to a public agent inadvertently expose that
- * Datastore's full read/write access to every other principal, with no
- * sandbox mediation. So every boundName branch additionally checks the
- * underlying Datastore's own ownership. When no attachment exists under
+ * Agent data (the private store and bound stores) is owner-only (resource-
+ * sharing grants spec §3.4.6), and a binding only resolves while the
+ * datastore's owner is the agent's owner (core/datastores.ts). These checks
+ * on the underlying Datastore's own ownership stay as defence in depth. When no attachment exists under
  * that boundName, this resolves to `undefined` and callers fall through to
  * today's unchanged behavior (miss for reads, throw for writes) — this
  * check only ever narrows access when an attachment IS found, it never
@@ -97,8 +95,15 @@ export function registerDatastoreTools(mcp) {
             required: ["agentId", "datastoreId"],
         },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            // A binding hands the datastore to every tool the agent's owner lets
+            // read it: strictly the agent owner's own datastore on the owner's
+            // own agent (A2/S2-2). Not even the stdio operator crosses owners.
+            const { agent } = await requireAgentAccess(ctx, args.agentId, "read");
+            requireBindingOwner(ctx, agent);
             const datastore = await requireOwnedDatastore(ctx.db, args.datastoreId, ctx.principal.id);
+            if (datastore.ownerId !== agent.ownerId) {
+                throw new McpError(403, "Only a datastore owned by the agent's owner can be attached to it.");
+            }
             const boundName = args.boundName ?? datastore.name;
             try {
                 await attachDatastore(args.agentId, args.datastoreId, ctx.db, boundName);
@@ -121,8 +126,10 @@ export function registerDatastoreTools(mcp) {
             required: ["agentId", "boundName"],
         },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
-            await requireMutableSharedDatastore(ctx.db, args.agentId, args.boundName, ctx.principal.id);
+            // The agent's owner may remove any binding from it, including one to
+            // another owner's datastore left behind by a transfer.
+            const { agent } = await requireAgentAccess(ctx, args.agentId, "read");
+            requireBindingOwner(ctx, agent);
             await detachDatastore(args.agentId, args.boundName, ctx.db);
             return textResult({ detached: true });
         },
@@ -136,7 +143,7 @@ export function registerDatastoreTools(mcp) {
             required: ["agentId", "key"],
         },
         handler: async (args, ctx) => {
-            await requireReadableAgent(ctx.db, args.agentId, ctx.principal.id);
+            await requireAgentAccess(ctx, args.agentId, "owner");
             if (args.boundName) {
                 await requireReadableSharedDatastore(ctx.db, args.agentId, args.boundName, ctx.principal.id);
                 const accessor = buildSharedDatastoreAccessor(args.agentId, ctx.providers.datastore, ctx.db);
@@ -156,7 +163,7 @@ export function registerDatastoreTools(mcp) {
             required: ["agentId"],
         },
         handler: async (args, ctx) => {
-            await requireReadableAgent(ctx.db, args.agentId, ctx.principal.id);
+            await requireAgentAccess(ctx, args.agentId, "owner");
             if (args.boundName) {
                 await requireReadableSharedDatastore(ctx.db, args.agentId, args.boundName, ctx.principal.id);
                 const accessor = buildSharedDatastoreAccessor(args.agentId, ctx.providers.datastore, ctx.db);
@@ -183,7 +190,7 @@ export function registerDatastoreTools(mcp) {
             required: ["agentId", "key", "value"],
         },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            await requireAgentAccess(ctx, args.agentId, "owner");
             if (args.boundName) {
                 await requireMutableSharedDatastore(ctx.db, args.agentId, args.boundName, ctx.principal.id);
                 const accessor = buildSharedDatastoreAccessor(args.agentId, ctx.providers.datastore, ctx.db);
@@ -203,7 +210,7 @@ export function registerDatastoreTools(mcp) {
             required: ["agentId", "key"],
         },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            await requireAgentAccess(ctx, args.agentId, "owner");
             if (args.boundName) {
                 await requireMutableSharedDatastore(ctx.db, args.agentId, args.boundName, ctx.principal.id);
                 const accessor = buildSharedDatastoreAccessor(args.agentId, ctx.providers.datastore, ctx.db);

package/dist/mcp/tools/grants.d.ts

@@ -0,0 +1,2 @@
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerGrantTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/grants.js

@@ -0,0 +1,239 @@
+/**
+ * grant_access / revoke_access / list_access: the owner's sharing controls
+ * (resource-sharing grants spec §3.11). Phase 1 shares agents only; other
+ * resource types are refused as "not shareable yet".
+ *
+ * - Only the resource's owner (or the stdio operator) grants and revokes.
+ *   Admins get no implicit access: they may only list_access, for incident
+ *   response ("who can reach this?"), and reassign with make_owner.
+ * - One grant per resource and grantee, so granting again replaces the
+ *   level (also downgrades). Everyone grants are capped below write.
+ * - Takes effect on the next check; runs already in flight keep going.
+ */
+import { z } from "zod";
+import { Prisma } from "#prisma";
+import { EVERYONE_KEY, EVERYONE_MAX, LEVELS, SHAREABLE_TYPES, accessRank, atLeast, isLevel, isResourceType, principalGranteeKey, } from "../../core/grants.js";
+import { agentNotFound, assertAgentAccess, agentAccess } from "../auth/access.js";
+import { permissionsOf } from "../auth/resource-server.js";
+import { McpError } from "../errors.js";
+import { textResult } from "./text-result.js";
+const GranteeSchema = z.union([
+    z.literal("everyone"),
+    z.object({ subject: z.string().min(1).max(512) }).strict(),
+    z.object({ principalId: z.string().min(1).max(128) }).strict(),
+]);
+const TargetSchema = z.object({
+    resourceType: z.string().min(1).max(64),
+    resourceId: z.string().min(1).max(128),
+});
+const GrantSchema = TargetSchema.extend({ grantee: GranteeSchema, level: z.string().min(1).max(64) }).strict();
+const RevokeSchema = TargetSchema.extend({ grantee: GranteeSchema }).strict();
+const ListSchema = TargetSchema.strict();
+function parse(schema, label, args) {
+    const result = schema.safeParse(args);
+    if (result.success)
+        return result.data;
+    const details = result.error.issues.map((i) => `${i.path.join(".") || "input"}: ${i.message}`).join("; ");
+    throw new McpError(400, `Invalid ${label} arguments: ${details}`);
+}
+function shareableType(value) {
+    if (!isResourceType(value) || !SHAREABLE_TYPES.includes(value)) {
+        throw new McpError(400, `Resource type "${value}" is not shareable yet (shareable: ${SHAREABLE_TYPES.join(", ")}).`);
+    }
+    return value;
+}
+/** The grantee's principal (must have signed in once: never created here), or null for everyone. */
+async function resolveGrantee(db, grantee) {
+    if (grantee === "everyone")
+        return null;
+    const principal = "subject" in grantee
+        ? await db.principal.findUnique({ where: { subject: grantee.subject } })
+        : await db.principal.findUnique({ where: { id: grantee.principalId } });
+    if (!principal) {
+        throw new McpError(404, "Grantee not found: they must have signed in to wardby at least once.");
+    }
+    return principal;
+}
+/** Grant management is the owner's (or the stdio operator's). Phase 1: agents. */
+async function requireOwnedResource(ctx, db, type, id) {
+    // Only "agent" reaches here in Phase 1 (shareableType).
+    void type;
+    const row = await db.agent.findUnique({ where: { id } });
+    return (await assertAgentAccess(ctx, row, id, "owner", db)).agent;
+}
+/**
+ * The ownership check and the write in one Serializable transaction (review
+ * M3): a concurrent make_owner, which resets grants in its own transaction,
+ * conflicts instead of letting the old owner's grant land on the new
+ * owner's agent.
+ */
+function inSerializable(ctx, fn) {
+    return ctx.db.$transaction((tx) => fn(tx), { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });
+}
+function isAdmin(ctx) {
+    return ctx.scopes.has("agents:admin") && permissionsOf(ctx.roles).has("agents:admin");
+}
+const TYPE_PROPERTIES = {
+    // No enum: another type gets a clear "not shareable yet" from the handler.
+    resourceType: { type: "string", description: 'Only "agent" is shareable today.' },
+    resourceId: { type: "string" },
+};
+const GRANTEE_PROPERTY = {
+    description: 'One principal, as {"subject": "<IdP subject>"} or {"principalId": "<id>"}, or "everyone".',
+    anyOf: [
+        { type: "string", enum: ["everyone"] },
+        {
+            type: "object",
+            additionalProperties: false,
+            properties: { subject: { type: "string" } },
+            required: ["subject"],
+        },
+        {
+            type: "object",
+            additionalProperties: false,
+            properties: { principalId: { type: "string" } },
+            required: ["principalId"],
+        },
+    ],
+};
+export function registerGrantTools(mcp) {
+    mcp.registerTool({
+        name: "grant_access",
+        scope: "agents:write",
+        description: "Shares an agent you own with one principal or with everyone, at a level: " +
+            "read (see its config, never secret values or other owners' tool code); " +
+            "execute (also trigger runs and see the runs they triggered); " +
+            "write (also change its name, prompt, model, budget amount, max turns, effort, memory on/off and schedule, attach tools they can use and detach tools, and create webhooks). " +
+            "Owner-only whatever the level: the coding profile (task, base ref, protected paths, task-override opt-in, image, packages, limits), kind, budget group, sub-agents, secret/datastore/repository bindings, tool capabilities, memory and datastore contents, grants, delete. " +
+            "Consequences: execute lets them run your agent with your tools, secrets, datastores and repository, and every run shares the agent's memory; they supply no task text unless it's a coding agent with allowWebhookTaskOverride. " +
+            "Write lets them rewrite what those runs do: the prompt can make a run use everything the agent can already reach (the capabilities you granted, its memory, its linked repositories), and on a coding agent the prompt is part of every coding task, so write directs work done with your GitHub access. " +
+            "Granting again replaces the level. Everyone is capped at execute. The grantee must have signed in once.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                ...TYPE_PROPERTIES,
+                grantee: GRANTEE_PROPERTY,
+                level: { type: "string", description: "Agents: read < execute < write." },
+            },
+            required: ["resourceType", "resourceId", "grantee", "level"],
+        },
+        handler: async (rawArgs, ctx) => {
+            const args = parse(GrantSchema, "grant_access", rawArgs);
+            const type = shareableType(args.resourceType);
+            if (!isLevel(type, args.level)) {
+                throw new McpError(400, `Level "${args.level}" is not valid for ${type} (${LEVELS[type].join(" < ")}).`);
+            }
+            const { resource, principal, grant } = await inSerializable(ctx, async (tx) => {
+                const resource = await requireOwnedResource(ctx, tx, type, args.resourceId);
+                const principal = await resolveGrantee(tx, args.grantee);
+                if (principal && (principal.id === resource.ownerId || principal.id === ctx.principal.id)) {
+                    throw new McpError(400, "The owner already has full access; a grant to yourself or the owner changes nothing.");
+                }
+                if (!principal && accessRank(type, args.level) > accessRank(type, EVERYONE_MAX[type])) {
+                    throw new McpError(400, `An everyone grant can be at most ${EVERYONE_MAX[type]}: write for everyone would let anyone rewrite an agent that holds your tools and secrets.`);
+                }
+                const granteeKey = principal ? principalGranteeKey(principal.id) : EVERYONE_KEY;
+                const grant = await tx.resourceGrant.upsert({
+                    where: { resourceType_resourceId_granteeKey: { resourceType: type, resourceId: resource.id, granteeKey } },
+                    create: {
+                        resourceType: type,
+                        resourceId: resource.id,
+                        granteeKind: principal ? "principal" : "everyone",
+                        granteePrincipalId: principal?.id ?? null,
+                        granteeKey,
+                        level: args.level,
+                        source: "owner",
+                        grantedById: ctx.principal.id,
+                    },
+                    update: { level: args.level, source: "owner", grantedById: ctx.principal.id },
+                });
+                return { resource, principal, grant };
+            });
+            return textResult({
+                granted: true,
+                resourceType: type,
+                resourceId: resource.id,
+                // Echo only what the caller supplied: a principalId never reveals a subject (review M4).
+                grantee: !principal
+                    ? "everyone"
+                    : args.grantee !== "everyone" && "subject" in args.grantee
+                        ? { principalId: principal.id, subject: principal.subject }
+                        : { principalId: principal.id },
+                level: grant.level,
+            });
+        },
+    });
+    mcp.registerTool({
+        name: "revoke_access",
+        scope: "agents:write",
+        description: "Removes a grant on an agent you own. Idempotent. Takes effect on the next check (trigger, delegation, webhook fire); runs already in flight keep going.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: { ...TYPE_PROPERTIES, grantee: GRANTEE_PROPERTY },
+            required: ["resourceType", "resourceId", "grantee"],
+        },
+        handler: async (rawArgs, ctx) => {
+            const args = parse(RevokeSchema, "revoke_access", rawArgs);
+            const type = shareableType(args.resourceType);
+            const { count } = await inSerializable(ctx, async (tx) => {
+                const resource = await requireOwnedResource(ctx, tx, type, args.resourceId);
+                const granteeKey = args.grantee === "everyone"
+                    ? EVERYONE_KEY
+                    : principalGranteeKey((await resolveGrantee(tx, args.grantee)).id);
+                return tx.resourceGrant.deleteMany({ where: { resourceType: type, resourceId: resource.id, granteeKey } });
+            });
+            return textResult({ revoked: count > 0 });
+        },
+    });
+    mcp.registerTool({
+        name: "list_access",
+        scope: "agents:read",
+        description: "Lists who an agent is shared with (grant metadata only). For its owner, the stdio operator, and admins (incident response).",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: TYPE_PROPERTIES,
+            required: ["resourceType", "resourceId"],
+        },
+        handler: async (rawArgs, ctx) => {
+            const args = parse(ListSchema, "list_access", rawArgs);
+            const type = shareableType(args.resourceType);
+            const resource = await ctx.db.agent.findUnique({ where: { id: args.resourceId } });
+            if (!resource)
+                throw agentNotFound(args.resourceId);
+            if (!isAdmin(ctx)) {
+                const access = await agentAccess(ctx, resource);
+                if (!atLeast("agent", access, "read"))
+                    throw agentNotFound(args.resourceId);
+                if (access !== "owner") {
+                    throw new McpError(403, `Agent "${resource.id}": only its owner (or an admin) can list who it is shared with.`);
+                }
+            }
+            const grants = await ctx.db.resourceGrant.findMany({
+                where: { resourceType: type, resourceId: resource.id },
+                orderBy: { createdAt: "asc" },
+            });
+            const principalIds = grants.flatMap((g) => (g.granteePrincipalId ? [g.granteePrincipalId] : []));
+            const principals = principalIds.length
+                ? await ctx.db.principal.findMany({ where: { id: { in: principalIds } } })
+                : [];
+            const subjectOf = new Map(principals.map((p) => [p.id, p.subject]));
+            return textResult({
+                resourceType: type,
+                resourceId: resource.id,
+                ownerId: resource.ownerId,
+                grants: grants.map((g) => ({
+                    grantee: g.granteePrincipalId
+                        ? { principalId: g.granteePrincipalId, subject: subjectOf.get(g.granteePrincipalId) ?? null }
+                        : "everyone",
+                    level: g.level,
+                    source: g.source,
+                    grantedById: g.grantedById,
+                    updatedAt: g.updatedAt,
+                })),
+            });
+        },
+    });
+}

package/dist/mcp/tools/help.d.ts

@@ -0,0 +1,5 @@
+import type { HelpCatalog } from "../../help/catalog.js";
+import type { WardbyMcpServer } from "../server.js";
+export type HelpCatalogLoader = () => Promise<HelpCatalog>;
+/** Registers release-bundled, read-only help without exposing any instance data or credentials. */
+export declare function registerHelpTools(mcp: WardbyMcpServer, loadCatalog?: HelpCatalogLoader): void;

package/dist/mcp/tools/help.js

@@ -0,0 +1,67 @@
+import { loadBundledHelpCatalog } from "../../help/runtime.js";
+import { searchHelp } from "../../help/search.js";
+import { McpError } from "../errors.js";
+import { textResult } from "./text-result.js";
+function publicArticle(page) {
+    return {
+        id: page.id,
+        title: page.title,
+        summary: page.summary,
+        audience: page.audience,
+        tags: page.tags,
+        appliesTo: page.appliesTo,
+        headings: page.headings,
+        markdown: page.markdown,
+    };
+}
+/** Registers release-bundled, read-only help without exposing any instance data or credentials. */
+export function registerHelpTools(mcp, loadCatalog = loadBundledHelpCatalog) {
+    mcp.registerTool({
+        name: "search_help",
+        description: "Search Wardby's bundled self-hosted documentation with offline fuzzy matching.",
+        scope: "agents:read",
+        inputSchema: {
+            type: "object",
+            properties: { query: { type: "string", minLength: 1, maxLength: 200 } },
+            required: ["query"],
+            additionalProperties: false,
+        },
+        handler: async (args) => {
+            const query = args.query.trim();
+            if (!query)
+                throw new McpError(400, "search_help requires a non-empty query.");
+            const results = searchHelp(await loadCatalog(), query).slice(0, 10);
+            return textResult({
+                results: results.map((result) => ({
+                    id: result.page.id,
+                    title: result.page.title,
+                    summary: result.page.summary,
+                    audience: result.page.audience,
+                    tags: result.page.tags,
+                    ...(result.matchedHeading ? { matchedHeading: result.matchedHeading.text } : {}),
+                    excerpt: result.excerpt,
+                })),
+            });
+        },
+    });
+    mcp.registerTool({
+        name: "get_help_article",
+        description: "Read one complete Wardby self-hosted help article by its id.",
+        scope: "agents:read",
+        inputSchema: {
+            type: "object",
+            properties: { id: { type: "string", minLength: 1, maxLength: 120 } },
+            required: ["id"],
+            additionalProperties: false,
+        },
+        handler: async (args) => {
+            const id = args.id.trim();
+            if (!id)
+                throw new McpError(400, "get_help_article requires a non-empty id.");
+            const page = (await loadCatalog()).pages.find((candidate) => candidate.id === id);
+            if (!page)
+                throw new McpError(404, `Help article "${id}" not found.`);
+            return textResult(publicArticle(page));
+        },
+    });
+}

package/dist/mcp/tools/host-accounts.d.ts

@@ -0,0 +1,2 @@
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerHostAccountTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/host-accounts.js

@@ -0,0 +1,114 @@
+/**
+ * A principal's own code-review host identity (GitHub today). Repository
+ * authorization checks the agent owner's access through this identity (see
+ * core/repo-access.ts), so linking it is the first step before linking a
+ * repository or setting a coding agent's repository. Each tool acts only on
+ * the caller; an operator can list and unlink anyone's with
+ * `wardby auth host-account`.
+ */
+import { REVIEW_HOST_PROVIDERS } from "../../providers/review-host/types.js";
+import { confirmHostIdentityLink, HostLinkError, startHostIdentityLink, userCallbackPath, } from "../../core/host-identity-links.js";
+import { McpError } from "../errors.js";
+import { canonicalUrl } from "../transport/http-limits.js";
+import { textResult } from "./text-result.js";
+const PROVIDER_PROP = { type: "string", enum: [...REVIEW_HOST_PROVIDERS] };
+function asMcpError(err) {
+    return err instanceof HostLinkError ? new McpError(err.status, err.message) : err;
+}
+/** The HTTP origin the host's browser callback must reach, or null over stdio (no canonical URI). */
+function callbackOrigin(canonicalUri) {
+    try {
+        return canonicalUrl(canonicalUri).origin;
+    }
+    catch {
+        return null;
+    }
+}
+export function registerHostAccountTools(mcp) {
+    mcp.registerTool({
+        name: "link_host_account",
+        scope: "agents:write",
+        description: "Links your GitHub account to your wardby identity, so agents you own can be given repositories your GitHub account can access. " +
+            "Call it with no confirmationCode to get an authorizeUrl; open that in a browser signed in to GitHub. The page you land on shows a " +
+            "one-time code: call link_host_account again with confirmationCode set to it (within 10 minutes).",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                provider: PROVIDER_PROP,
+                confirmationCode: { type: "string", minLength: 1, maxLength: 32 },
+            },
+        },
+        handler: async (args, ctx) => {
+            const provider = args.provider ?? "github";
+            try {
+                if (args.confirmationCode !== undefined) {
+                    const linked = await confirmHostIdentityLink({
+                        db: ctx.db,
+                        principalId: ctx.principal.id,
+                        provider,
+                        confirmationCode: args.confirmationCode,
+                    });
+                    return textResult({ linked: true, provider, login: linked.login });
+                }
+                const authorizer = ctx.providers.hostUserAuthorizers?.[provider];
+                if (!authorizer) {
+                    throw new McpError(400, "GitHub account linking is not configured on this deployment: an operator must set GITHUB_APP_CLIENT_ID and " +
+                        "GITHUB_APP_CLIENT_SECRET (see docs/code-review-agents.md).");
+                }
+                const origin = callbackOrigin(ctx.canonicalUri);
+                if (!origin) {
+                    throw new McpError(400, "Linking needs wardby's HTTP transport (the GitHub callback is served at MCP_CANONICAL_URI); " +
+                        "use an MCP client connected over HTTP, or ask an operator.");
+                }
+                const started = await startHostIdentityLink({
+                    db: ctx.db,
+                    authorizer,
+                    principalId: ctx.principal.id,
+                    redirectUri: `${origin}${userCallbackPath(provider)}`,
+                });
+                return textResult({
+                    authorizeUrl: started.authorizeUrl,
+                    expiresAt: started.expiresAt.toISOString(),
+                    next: "Open authorizeUrl in a browser signed in to the GitHub account to link. Then call link_host_account " +
+                        "with confirmationCode set to the code the page shows.",
+                });
+            }
+            catch (err) {
+                throw asMcpError(err);
+            }
+        },
+    });
+    mcp.registerTool({
+        name: "get_host_account",
+        scope: "agents:read",
+        description: "Shows the GitHub account linked to your wardby identity, if any.",
+        inputSchema: { type: "object", additionalProperties: false, properties: {} },
+        handler: async (_args, ctx) => {
+            const identities = await ctx.db.hostIdentity.findMany({
+                where: { principalId: ctx.principal.id },
+                orderBy: { provider: "asc" },
+            });
+            return textResult({
+                accounts: identities.map((i) => ({
+                    provider: i.provider,
+                    login: i.login,
+                    hostUserId: i.hostUserId,
+                    linkedAt: i.linkedAt,
+                })),
+            });
+        },
+    });
+    mcp.registerTool({
+        name: "unlink_host_account",
+        scope: "agents:write",
+        description: "Unlinks your GitHub account. Repositories your agents were given through its access stop working until you link again.",
+        inputSchema: { type: "object", additionalProperties: false, properties: { provider: PROVIDER_PROP } },
+        handler: async (args, ctx) => {
+            const provider = args.provider ?? "github";
+            const { count } = await ctx.db.hostIdentity.deleteMany({ where: { principalId: ctx.principal.id, provider } });
+            await ctx.db.hostIdentityLinkRequest.deleteMany({ where: { principalId: ctx.principal.id, provider } });
+            return textResult({ unlinked: count > 0 });
+        },
+    });
+}

package/dist/mcp/tools/memory.d.ts

@@ -1,3 +1,9 @@
-/** Operator inspection of agent memory, mirroring the Datastore MCP tools (`./datastore.ts`). */
+/**
+ * Operator inspection of agent memory, mirroring the Datastore MCP tools
+ * (`./datastore.ts`). Memory is agent *data*, written by every triggerer's
+ * runs, so every tool here is owner-only whatever the grants (resource-
+ * sharing grants spec §3.4.6): showing it at read or execute would leak one
+ * triggerer's run output to another (A6 through memory).
+ */
 import type { WardbyMcpServer } from "../server.js";
 export declare function registerMemoryTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/memory.js

@@ -1,4 +1,4 @@
-import { requireOwnedAgent, requireReadableAgent } from "../auth/ownership.js";
+import { requireAgentAccess } from "../auth/access.js";
 import { textResult } from "./text-result.js";
 export function registerMemoryTools(mcp) {
     mcp.registerTool({
@@ -10,7 +10,7 @@ export function registerMemoryTools(mcp) {
             required: ["agentId", "key"],
         },
         handler: async (args, ctx) => {
-            await requireReadableAgent(ctx.db, args.agentId, ctx.principal.id);
+            await requireAgentAccess(ctx, args.agentId, "owner");
             const content = await ctx.providers.memory.get(args.agentId, args.key);
             return textResult({ content: content ?? null });
         },
@@ -24,7 +24,7 @@ export function registerMemoryTools(mcp) {
             required: ["agentId"],
         },
         handler: async (args, ctx) => {
-            await requireReadableAgent(ctx.db, args.agentId, ctx.principal.id);
+            await requireAgentAccess(ctx, args.agentId, "owner");
             const keys = await ctx.providers.memory.list(args.agentId);
             return textResult(keys);
         },
@@ -38,7 +38,7 @@ export function registerMemoryTools(mcp) {
             required: ["agentId", "key", "content"],
         },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            await requireAgentAccess(ctx, args.agentId, "owner");
             await ctx.providers.memory.set(args.agentId, args.key, args.content);
             return textResult({ ok: true });
         },
@@ -52,7 +52,7 @@ export function registerMemoryTools(mcp) {
             required: ["agentId", "key"],
         },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            await requireAgentAccess(ctx, args.agentId, "owner");
             await ctx.providers.memory.delete(args.agentId, args.key);
             return textResult({ ok: true });
         },

package/dist/mcp/tools/repositories.d.ts

@@ -0,0 +1,2 @@
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerRepositoryTools(mcp: WardbyMcpServer): void;