@wardby/cli 0.2.0 → 0.3.0

package/dist/mcp/tools/repositories.js

@@ -0,0 +1,181 @@
+/**
+ * AgentRepository CRUD — which repositories on which code-review host a
+ * native agent may act on, and which host events trigger it. Linking needs
+ * more than owning the agent: the owner's own linked GitHub account must have
+ * the link's access on the repository (write for a write link, read for a
+ * read link), or a wardby admin must approve it explicitly (adminOverride).
+ * The authorization is stamped on the link and re-checked whenever the link
+ * is used (core/repo-access.ts). A repository is an owner binding (resource-
+ * sharing grants spec §3.4.3): link/unlink are the agent owner's alone (or
+ * an admin's explicit approval), whatever grants others hold on the agent,
+ * and owner-less agents can't be linked.
+ * See docs/private/2026-09-26-repo-access-authorization-spec-and-plan.md.
+ */
+import { Prisma } from "#prisma";
+import { normalizeGitHubRepository } from "../../coding/protocol.js";
+import { requireAgentAccess, requireBindingOwner } from "../auth/access.js";
+import { authorizeRepositoryForSet } from "../auth/repo-authorization.js";
+import { requireScope } from "../auth/resource-server.js";
+import { McpError } from "../errors.js";
+import { textResult } from "./text-result.js";
+const PROVIDERS = ["github"];
+const TRIGGERS = ["pull_request", "mention"];
+const CHECK_NAME = /^[A-Za-z0-9][A-Za-z0-9 ._/()-]{0,99}$/;
+function normalizeRepository(provider, repository) {
+    try {
+        if (provider === "github")
+            return normalizeGitHubRepository(repository);
+    }
+    catch {
+        // fall through
+    }
+    throw new McpError(400, `invalid repository "${repository}" for provider ${provider}`);
+}
+async function assertNoConflicts(tx, args) {
+    if (args.triggers.length === 0 && args.checkName === null)
+        return;
+    const others = await tx.agentRepository.findMany({
+        where: { provider: args.provider, repository: args.repository, NOT: { agentId: args.agentId } },
+    });
+    if (args.triggers.includes("mention") && others.some((o) => o.triggers.includes("mention"))) {
+        throw new McpError(409, `Another agent already handles @-mentions on ${args.repository}.`);
+    }
+    // Against every other link, whatever its triggers: a check name identifies
+    // one agent's verdict on the repository (also a unique index).
+    if (args.checkName !== null && others.some((o) => o.checkName === args.checkName)) {
+        throw checkNameTaken(args.checkName, args.repository);
+    }
+}
+function checkNameTaken(checkName, repository) {
+    return new McpError(409, `Another agent already uses check name "${checkName}" on ${repository}.`);
+}
+export function registerRepositoryTools(mcp) {
+    mcp.registerTool({
+        name: "link_repository",
+        scope: "agents:write",
+        description: "Links a native agent you own to a repository on a code-review host, with its access, event triggers, and checkName. " +
+            "Your linked GitHub account (link_host_account) must have write access to the repository for a write link, or read for a " +
+            "read link; a wardby admin may instead approve it with adminOverride. checkName is only allowed (and required) with the " +
+            "pull_request trigger, and is unique per repository. Re-linking an already-linked repository replaces its access, " +
+            "triggers, and checkName (an omitted field is cleared, not kept) and re-checks access — always send the full desired state.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                agentId: { type: "string" },
+                provider: { type: "string", enum: [...PROVIDERS] },
+                repository: { type: "string", minLength: 1, maxLength: 300 },
+                access: { type: "string", enum: ["read", "write"] },
+                triggers: { type: "array", items: { type: "string", enum: [...TRIGGERS] }, uniqueItems: true },
+                checkName: { type: "string", minLength: 1, maxLength: 100 },
+                adminOverride: {
+                    type: "boolean",
+                    description: "Admins only (agents:admin with the admin role): approve this link without checking GitHub access, recorded as an admin approval. Allowed on any agent that has an owner, not only the admin's own.",
+                },
+            },
+            required: ["agentId", "repository", "access"],
+        },
+        handler: async (args, ctx) => {
+            // An admin approving a repository explicitly may do it on any agent
+            // (the role already allows reassigning any agent with make_owner);
+            // everyone else, admins included, links only agents they own.
+            let agent;
+            if (args.adminOverride === true) {
+                requireScope(ctx, ctx.canonicalUri, "agents:admin");
+                agent = await ctx.db.agent.findUnique({ where: { id: args.agentId } });
+                if (!agent)
+                    throw new McpError(404, `Agent "${args.agentId}" not found.`);
+            }
+            else {
+                agent = (await requireAgentAccess(ctx, args.agentId, "read")).agent;
+                requireBindingOwner(ctx, agent);
+            }
+            if (agent.kind !== "native") {
+                throw new McpError(400, "Repository links are for native agents only; coding agents use codingProfile.repository.");
+            }
+            const provider = args.provider ?? "github";
+            const repository = normalizeRepository(provider, args.repository);
+            const triggers = [...new Set(args.triggers ?? [])];
+            if (triggers.length > 0 && args.access !== "write")
+                throw new McpError(400, "Event triggers need write access.");
+            const checkName = args.checkName ?? null;
+            if (triggers.includes("pull_request") && !checkName) {
+                throw new McpError(400, "checkName is required with the pull_request trigger.");
+            }
+            if (checkName !== null && !triggers.includes("pull_request")) {
+                throw new McpError(400, "checkName needs the pull_request trigger (a check is only published for a dispatched PR).");
+            }
+            if (checkName !== null && !CHECK_NAME.test(checkName))
+                throw new McpError(400, "invalid checkName");
+            // The host call happens before, and outside, the serializable transaction.
+            const authorization = await authorizeRepositoryForSet(ctx, {
+                ownerId: agent.ownerId,
+                provider,
+                repository,
+                kind: args.access,
+                adminOverride: args.adminOverride === true,
+            });
+            let link;
+            try {
+                link = await ctx.db.$transaction(async (tx) => {
+                    await assertNoConflicts(tx, { agentId: args.agentId, provider, repository, triggers, checkName });
+                    const fields = { access: args.access, triggers, checkName, ...authorization };
+                    return tx.agentRepository.upsert({
+                        where: { agentId_provider_repository: { agentId: args.agentId, provider, repository } },
+                        create: { agentId: args.agentId, provider, repository, ...fields },
+                        update: fields,
+                    });
+                }, { isolationLevel: "Serializable" });
+            }
+            catch (err) {
+                if (checkName !== null && err instanceof Prisma.PrismaClientKnownRequestError && err.code === "P2002") {
+                    throw checkNameTaken(checkName, repository);
+                }
+                throw err;
+            }
+            return textResult({ linked: true, link });
+        },
+    });
+    mcp.registerTool({
+        name: "unlink_repository",
+        scope: "agents:write",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                agentId: { type: "string" },
+                provider: { type: "string", enum: [...PROVIDERS] },
+                repository: { type: "string", minLength: 1, maxLength: 300 },
+            },
+            required: ["agentId", "repository"],
+        },
+        handler: async (args, ctx) => {
+            const { agent } = await requireAgentAccess(ctx, args.agentId, "read");
+            requireBindingOwner(ctx, agent);
+            const provider = args.provider ?? "github";
+            const repository = normalizeRepository(provider, args.repository);
+            const { count } = await ctx.db.agentRepository.deleteMany({
+                where: { agentId: args.agentId, provider, repository },
+            });
+            return textResult({ unlinked: count > 0 });
+        },
+    });
+    mcp.registerTool({
+        name: "list_repositories",
+        scope: "agents:read",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: { agentId: { type: "string" } },
+            required: ["agentId"],
+        },
+        handler: async (args, ctx) => {
+            await requireAgentAccess(ctx, args.agentId, "read");
+            const links = await ctx.db.agentRepository.findMany({
+                where: { agentId: args.agentId },
+                orderBy: { createdAt: "asc" },
+            });
+            return textResult({ repositories: links });
+        },
+    });
+}

package/dist/mcp/tools/runs.d.ts

@@ -1,2 +1,8 @@
 import type { WardbyMcpServer } from "../server.js";
+/**
+ * Run visibility (resource-sharing grants spec §3.5, A6): a run's output is
+ * the triggerer's and the agent owner's, never every reader's. The owner
+ * (and the stdio operator) sees every run; anyone else only runs with
+ * Run.triggeredById equal to themselves.
+ */
 export declare function registerRunTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/runs.js

@@ -1,7 +1,15 @@
 import { McpError } from "../errors.js";
-import { requireReadableAgent } from "../auth/ownership.js";
+import { agentAccess, requireAgentAccess } from "../auth/access.js";
 import { publicCodingRunResult } from "../../coding/protocol.js";
+import { countPlanRefusals, summarizeRegistryFetches } from "../../coding/registry/report.js";
+import { storedServiceLabels } from "../../coding/services/catalog.js";
 import { textResult } from "./text-result.js";
+/**
+ * Run visibility (resource-sharing grants spec §3.5, A6): a run's output is
+ * the triggerer's and the agent owner's, never every reader's. The owner
+ * (and the stdio operator) sees every run; anyone else only runs with
+ * Run.triggeredById equal to themselves.
+ */
 export function registerRunTools(mcp) {
     mcp.registerTool({
         name: "list_runs",
@@ -12,9 +20,13 @@ export function registerRunTools(mcp) {
             required: ["agentId"],
         },
         handler: async (args, ctx) => {
-            await requireReadableAgent(ctx.db, args.agentId, ctx.principal.id);
+            const { access } = await requireAgentAccess(ctx, args.agentId, "read");
             const runs = await ctx.db.run.findMany({
-                where: { agentId: args.agentId, ...(args.status ? { status: args.status } : {}) },
+                where: {
+                    agentId: args.agentId,
+                    ...(args.status ? { status: args.status } : {}),
+                    ...(access === "owner" ? {} : { triggeredById: ctx.principal.id }),
+                },
                 take: args.limit,
                 orderBy: { startedAt: "desc" },
             });
@@ -40,21 +52,63 @@ export function registerRunTools(mcp) {
         inputSchema: { type: "object", properties: { runId: { type: "string" } }, required: ["runId"] },
         handler: async (args, ctx) => {
             const run = await ctx.db.run.findUnique({ where: { id: args.runId } });
+            const notFound = new McpError(404, `Run "${args.runId}" not found.`);
             if (!run)
-                throw new McpError(404, `Run "${args.runId}" not found.`);
-            await requireReadableAgent(ctx.db, run.agentId, ctx.principal.id);
+                throw notFound;
+            // Its triggerer keeps seeing it even after losing access to the agent;
+            // otherwise only the agent's owner. read on the agent is not enough.
+            if (run.triggeredById !== ctx.principal.id) {
+                const agent = await ctx.db.agent.findUnique({ where: { id: run.agentId } });
+                if (!agent || (await agentAccess(ctx, agent)) !== "owner")
+                    throw notFound;
+            }
             const codingRun = await ctx.db.codingRun.findUnique({
                 where: { runId: run.id },
-                select: { result: true, queuedAt: true },
+                select: {
+                    result: true,
+                    queuedAt: true,
+                    failureCategory: true,
+                    diagnosticId: true,
+                    debugTrace: true,
+                    services: true,
+                },
             });
             const codingResult = publicCodingRunResult(codingRun?.result);
             // A pending coding run with queuedAt is waiting for a concurrency slot
             // (CODING_MAX_CONCURRENT), not stuck.
             const codingQueuedAt = run.status === "pending" && codingRun?.queuedAt ? codingRun.queuedAt.toISOString() : undefined;
+            // Packages served/refused only exist for coding runs; a non-coding run
+            // has no RegistryFetch rows at all, so skip the query entirely.
+            const registryFetches = codingRun
+                ? await ctx.db.registryFetch.findMany({ where: { runId: run.id }, orderBy: { createdAt: "asc" } })
+                : [];
+            const { packages, packageRefusals } = summarizeRegistryFetches(registryFetches);
+            // Lockfile verification (POST /registry/<ecosystem>/-/plan): exact
+            // versions approved for the run, and distinct entries it refused.
+            const packagePlan = codingRun
+                ? {
+                    approved: await ctx.db.registryApprovedVersion.count({ where: { runId: run.id } }),
+                    refused: countPlanRefusals(registryFetches),
+                }
+                : undefined;
+            // A failed coding run's error is only an opaque id; these two say which
+            // stage failed and are the key an operator searches the control-plane
+            // log for (the real reason is logged there, never persisted). Both are
+            // designed to be safe to show the agent's owner (schema.prisma).
+            const failureCategory = codingRun?.failureCategory ?? undefined;
+            const diagnosticId = codingRun?.diagnosticId ?? undefined;
+            // Which services the run started with ("postgres 16"); never their images or environments.
+            const services = codingRun ? storedServiceLabels(codingRun.services) : [];
             return textResult({
                 ...run,
                 ...(codingResult ? { codingResult } : {}),
+                ...(failureCategory ? { failureCategory } : {}),
+                ...(diagnosticId ? { diagnosticId } : {}),
                 ...(codingQueuedAt ? { codingQueuedAt } : {}),
+                // An admin turned on the debug trace: the worker's full trace is in its pod log.
+                ...(codingRun?.debugTrace ? { debugTrace: true } : {}),
+                ...(services.length > 0 ? { services } : {}),
+                ...(codingRun ? { packages, packageRefusals, packagePlan } : {}),
             });
         },
     });

package/dist/mcp/tools/scheduling.js

@@ -1,7 +1,7 @@
-import { Prisma } from "@prisma/client";
+import { Prisma } from "#prisma";
 import { validateCronExpression } from "../../core/cron.js";
 import { McpError } from "../errors.js";
-import { assertCanMutate, requireOwnedAgent } from "../auth/ownership.js";
+import { assertAgentAccess, requireAgentAccess } from "../auth/access.js";
 import { textResult } from "./text-result.js";
 export function registerSchedulingTools(mcp) {
     mcp.registerTool({
@@ -20,10 +20,7 @@ export function registerSchedulingTools(mcp) {
                 throw new McpError(400, `Invalid schedule/timezone: ${err instanceof Error ? err.message : String(err)}`);
             }
             const agent = await ctx.db.$transaction(async (tx) => {
-                const existing = await tx.agent.findUnique({ where: { id: args.agentId }, include: { codingProfile: true } });
-                if (!existing)
-                    throw new McpError(404, `Agent "${args.agentId}" not found.`);
-                assertCanMutate(existing.ownerId, ctx.principal.id, `Agent "${args.agentId}" is not owned by the caller.`);
+                const { agent: existing } = await assertAgentAccess(ctx, await tx.agent.findUnique({ where: { id: args.agentId }, include: { codingProfile: true } }), args.agentId, "write", tx);
                 if (existing.kind === "coding" && !existing.codingProfile?.defaultTask) {
                     throw new McpError(400, "A default task is required before enabling a coding-agent schedule.");
                 }
@@ -40,7 +37,7 @@ export function registerSchedulingTools(mcp) {
         scope: "agents:write",
         inputSchema: { type: "object", properties: { agentId: { type: "string" } }, required: ["agentId"] },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            await requireAgentAccess(ctx, args.agentId, "write");
             const agent = await ctx.db.agent.update({ where: { id: args.agentId }, data: { scheduleEnabled: false } });
             return textResult(agent);
         },

package/dist/mcp/tools/secret-elicitation-form.d.ts

@@ -6,7 +6,7 @@
  * CSP can forbid scripts outright rather than needing a nonce.
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import type { SecretCipher } from "../../providers/secrets/types.js";
 import { type SecretElicitationPayload } from "./secret-elicitation.js";
 /** The HTTP-transport route path this form is mounted at (see streamable-http.ts). */

package/dist/mcp/tools/secret-elicitation-form.js

@@ -1,43 +1,24 @@
 import { fulfillSecretElicitation } from "./secret-elicitation.js";
+import { PAGE_STYLE } from "../shared/page-style.js";
 /** The HTTP-transport route path this form is mounted at (see streamable-http.ts). */
 export const SECRET_ELICITATION_PATH = "/elicit/secret";
 function escape(value) {
     return value.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 }
-const STYLE = `
-:root { color-scheme: light dark; }
-* { box-sizing: border-box; }
-body { margin: 0; min-height: 100vh; display: flex; align-items: center; justify-content: center; padding: 24px;
-  background: #f5f5f7; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
-.card { background: #fff; border-radius: 14px; box-shadow: 0 1px 3px rgba(0,0,0,.1), 0 8px 24px rgba(0,0,0,.08);
-  padding: 36px; max-width: 480px; width: 100%; }
-h1 { margin: 0 0 10px; font-size: 21px; }
-p { margin: 0 0 24px; color: #555; font-size: 14px; line-height: 1.5; }
-p strong { color: #111; }
-input[type=password] { display: block; width: 100%; padding: 16px 18px; font-size: 17px; letter-spacing: .02em;
-  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; border: 1px solid #d1d1d6; border-radius: 10px;
-  margin-bottom: 18px; }
-input[type=password]:focus { outline: none; border-color: #0071e3; box-shadow: 0 0 0 3px rgba(0,113,227,.15); }
-button { width: 100%; padding: 15px; font-size: 15px; font-weight: 600; color: #fff; background: #0071e3;
-  border: none; border-radius: 10px; cursor: pointer; }
-button:hover { background: #0077ed; }
-@media (prefers-color-scheme: dark) {
-  body { background: #1c1c1e; }
-  .card { background: #2c2c2e; box-shadow: none; }
-  h1 { color: #f5f5f7; }
-  p { color: #a1a1a6; }
-  p strong { color: #f5f5f7; }
-  input[type=password] { background: #1c1c1e; border-color: #48484a; color: #f5f5f7; }
-}`;
 function html(res, status, body) {
     res.setHeader("content-security-policy", "default-src 'none'; script-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'");
     res.setHeader("cache-control", "no-store");
     res.setHeader("x-content-type-options", "nosniff");
-    res.setHeader("referrer-policy", "no-referrer");
+    // Not no-referrer: under it a browser sends `Origin: null` on this page's native
+    // form POST, even to the same origin, and the HTTP transport rejects that as
+    // invalid_origin. same-origin keeps the Origin and still sends nothing,
+    // token-bearing URL included, to any other site. (The login page solves the
+    // same problem with a fetch() instead; this page runs no script at all.)
+    res.setHeader("referrer-policy", "same-origin");
     res
         .writeHead(status, { "content-type": "text/html; charset=utf-8" })
         .end(`<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">` +
-        `<title>wardby secret entry</title><style>${STYLE}</style><body><div class="card">${body}</div></body></html>`);
+        `<title>wardby secret entry</title><style>${PAGE_STYLE}</style><body><div class="card"><div class="kicker">wardby</div>${body}</div></body></html>`);
 }
 /** Handles one GET (render) or POST (submit) for the secret-entry form at the given token. */
 export async function handleSecretElicitationForm(method, token, readFormBody, res, deps) {
@@ -53,7 +34,8 @@ export async function handleSecretElicitationForm(method, token, readFormBody, r
     }
     if (method === "GET") {
         html(res, 200, `<h1>Enter secret value</h1><p>Name: <strong>${escape(payload.secretName)}</strong></p>` +
-            `<form method="post"><input type="password" name="value" autocomplete="off" required autofocus placeholder="Paste the value here">` +
+            `<form method="post"><label>Secret value` +
+            `<input type="password" name="value" autocomplete="off" required autofocus placeholder="Paste the value here"></label>` +
             `<button type="submit">Save</button></form>`);
         return;
     }

package/dist/mcp/tools/secret-elicitation.d.ts

@@ -15,7 +15,7 @@
  * Expiry is swept lazily on every read and write via a `deleteMany` rather
  * than a timer, so an idle process holds no interval.
  */
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import { type SecretMetadata } from "../../core/secrets.js";
 import type { SecretCipher } from "../../providers/secrets/types.js";
 export interface SecretElicitationPayload {

package/dist/mcp/tools/secrets.js

@@ -6,7 +6,8 @@
 import { inputRequired, inputResponse } from "@modelcontextprotocol/server";
 import { createSecret, listSecrets, attachSecret, detachSecret, deleteSecret } from "../../core/secrets.js";
 import { McpError } from "../errors.js";
-import { requireOwnedAgent, requireOwnedSecret } from "../auth/ownership.js";
+import { requireOwnedSecret } from "../auth/ownership.js";
+import { requireAgentAccess, requireBindingOwner } from "../auth/access.js";
 import { getSecretElicitationOutcome } from "./secret-elicitation.js";
 import { textResult } from "./text-result.js";
 export function registerSecretsTools(mcp, opts) {
@@ -87,9 +88,15 @@ export function registerSecretsTools(mcp, opts) {
             required: ["agentId", "name"],
         },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            // Strictly the agent owner's own secret on the owner's own agent
+            // (A2/S2-2): a binding hands the value to every tool the owner lets
+            // read it. Not even the stdio operator crosses owners.
+            const { agent } = await requireAgentAccess(ctx, args.agentId, "read");
+            requireBindingOwner(ctx, agent);
+            const ownerId = agent.ownerId;
             try {
-                await attachSecret(args.agentId, args.name, ctx.principal.id, ctx.db, args.alias ?? args.name);
+                // Resolved among the agent owner's secrets (== the caller here).
+                await attachSecret(args.agentId, args.name, ownerId, ctx.db, args.alias ?? args.name);
             }
             catch (err) {
                 throw new McpError(404, err instanceof Error ? err.message : String(err));
@@ -100,15 +107,20 @@ export function registerSecretsTools(mcp, opts) {
     mcp.registerTool({
         name: "detach_secret",
         scope: "secrets:write",
+        description: "Detaches a secret from an agent. `name` is the alias it was attached under; the secret's own name also works when no attachment has that alias.",
         inputSchema: {
             type: "object",
             properties: { agentId: { type: "string" }, name: { type: "string" } },
             required: ["agentId", "name"],
         },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
-            await detachSecret(args.agentId, args.name, ctx.db);
-            return textResult({ detached: true });
+            const { agent } = await requireAgentAccess(ctx, args.agentId, "read");
+            requireBindingOwner(ctx, agent);
+            const count = await detachSecret(args.agentId, args.name, ctx.db);
+            if (count === 0) {
+                throw new McpError(404, `No secret is attached to agent "${args.agentId}" as "${args.name}".`);
+            }
+            return textResult({ detached: true, count });
         },
     });
     mcp.registerTool({

package/dist/mcp/tools/services.d.ts

@@ -0,0 +1,2 @@
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerServiceTools(mcp: WardbyMcpServer): void;