@wardby/cli 0.2.0 → 0.3.0

package/dist/mcp/tools/tools.js

@@ -9,15 +9,51 @@
  * (attach/detach on an agent or tool you don't own) DO throw, same
  * convention as every other tool in this codebase.
  */
-import { Prisma } from "@prisma/client";
+import { Prisma } from "#prisma";
 import { deriveJsonSchema, validateParams } from "../../sandbox/zod-params.js";
 import { runInSandbox } from "../../sandbox/run-in-sandbox.js";
 import { ToolCapabilitiesPatchSchema } from "../../sandbox/tool-capabilities.js";
 import { buildSharedDatastoreAccessor } from "../../core/datastores.js";
-import { MEMORY_TOOL_NAMES } from "../../core/memory-tools.js";
+import { findSameNamedAttachedTool, reservedToolNameReason } from "../../core/tool-names.js";
+import { ToolAttachedError, deleteToolGuarded, hasToolChanges, prepareToolUpdate, updateToolGuarded, } from "../../core/tool-admin.js";
 import { McpError } from "../errors.js";
-import { assertCanMutate, requireOwnedAgent, requireOwnedTool, requireReadableAgent, visibleToPrincipal, canRead, } from "../auth/ownership.js";
+import { requireOwnedTool, requireStrictlyOwnedTool, assertStrictlyOwnedTool, visibleToPrincipal, canRead, } from "../auth/ownership.js";
+import { agentAccessResolver, assertAgentAccess, requireAgentAccess } from "../auth/access.js";
+import { atLeast } from "../../core/grants.js";
 import { textResult } from "./text-result.js";
+/**
+ * Names the agents the caller can read (its own and ones granted to it)
+ * and only counts the rest, so a refusal never reveals another principal's
+ * agent names or ids.
+ */
+async function describeAgents(agents, ctx) {
+    const accessOf = await agentAccessResolver(ctx);
+    const readable = agents.filter((agent) => atLeast("agent", accessOf(agent), "read"));
+    const hidden = agents.length - readable.length;
+    const parts = readable.map((agent) => `"${agent.name}" (${agent.id})`);
+    if (hidden > 0)
+        parts.push(`${hidden} agent(s) owned by other principals`);
+    return parts.join(", ");
+}
+/**
+ * A tool row as a caller who doesn't own it may see it: name and
+ * description, never code or paramsZod (A7). `public` tells an owner-less
+ * tool apart from the caller's own same-named one (names are unique per
+ * owner, not globally). Shared by list_tools and get_agent.
+ */
+export function projectTool(tool, principalId) {
+    if (tool.ownerId !== null && tool.ownerId === principalId)
+        return tool;
+    return tool.ownerId === null
+        ? { id: tool.id, name: tool.name, description: tool.description, public: true }
+        : { id: tool.id, name: tool.name, description: tool.description, public: false, ownerIsCaller: false };
+}
+/** Refuses a name one of the runner's built-ins would shadow (see core/tool-names.ts). */
+function assertToolNameAllowed(name) {
+    const reason = reservedToolNameReason(name);
+    if (reason)
+        throw new McpError(400, reason);
+}
 export function registerToolAuthoringTools(mcp) {
     mcp.registerTool({
         name: "create_tool",
@@ -33,24 +69,108 @@ export function registerToolAuthoringTools(mcp) {
             required: ["name", "description", "paramsZod", "code"],
         },
         handler: async (args, ctx) => {
-            if (MEMORY_TOOL_NAMES.has(args.name)) {
-                throw new McpError(400, `Tool name "${args.name}" is reserved for the built-in agent-memory tools.`);
-            }
+            assertToolNameAllowed(args.name);
             const schemaResult = await deriveJsonSchema(args.paramsZod);
             if (!schemaResult.ok) {
                 return textResult({ ok: false, errorKind: schemaResult.errorKind, errorMessage: schemaResult.errorMessage });
             }
-            const tool = await ctx.db.tool.create({
-                data: {
-                    name: args.name,
-                    description: args.description,
-                    paramsZod: args.paramsZod,
-                    code: args.code,
-                    jsonSchema: schemaResult.value,
-                    ownerId: ctx.principal.id,
-                },
-            });
-            return textResult(tool);
+            try {
+                const tool = await ctx.db.tool.create({
+                    data: {
+                        name: args.name,
+                        description: args.description,
+                        paramsZod: args.paramsZod,
+                        code: args.code,
+                        jsonSchema: schemaResult.value,
+                        ownerId: ctx.principal.id,
+                    },
+                });
+                return textResult(tool);
+            }
+            catch (err) {
+                if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === "P2002") {
+                    throw new McpError(409, `A tool named "${args.name}" already exists for your principal.`);
+                }
+                throw err;
+            }
+        },
+    });
+    mcp.registerTool({
+        name: "update_tool",
+        scope: "tools:write",
+        description: "Replaces a tool's description, paramsZod and/or code in place (its name can't change: agents' prompts call it by name). Owner-only: public tools can't be changed over MCP. Refused while the tool is attached to any agent you don't own, including owner-less ones and agents shared with you, since the change would reach another owner's agent; detach it there first or create a new tool. Runs already started keep the version they loaded for their whole lifetime; the next run picks up the new one.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                toolId: { type: "string" },
+                description: { type: "string" },
+                paramsZod: { type: "string" },
+                code: { type: "string" },
+            },
+            required: ["toolId"],
+        },
+        handler: async (args, ctx) => {
+            const changes = { description: args.description, paramsZod: args.paramsZod, code: args.code };
+            if (!hasToolChanges(changes)) {
+                throw new McpError(400, "update_tool needs at least one of description, paramsZod or code.");
+            }
+            // Checked once up front so a non-owner never gets as far as a sandbox
+            // compile, and again (with the attachments) inside the transaction.
+            await requireStrictlyOwnedTool(ctx.db, args.toolId, ctx.principal.id);
+            const prepared = await prepareToolUpdate(changes);
+            if (!prepared.ok) {
+                return textResult({ ok: false, errorKind: prepared.errorKind, errorMessage: prepared.errorMessage });
+            }
+            // Any attachment to an agent the caller doesn't own (an owner-less one
+            // included) blocks every field; see core/tool-admin.ts for why, and
+            // for the Serializable transaction that keeps a concurrent attach from
+            // landing between the check and the write.
+            try {
+                const tool = await updateToolGuarded(ctx.db, args.toolId, prepared.data, (row) => assertStrictlyOwnedTool(row, args.toolId, ctx.principal.id));
+                return textResult(tool);
+            }
+            catch (err) {
+                if (err instanceof ToolAttachedError) {
+                    throw new McpError(409, `Tool "${args.toolId}" is attached to agents you don't own: ${await describeAgents(err.agents, ctx)}. Detach it from those agents first (or ask their owners to), or create a new tool instead.`);
+                }
+                throw err;
+            }
+        },
+    });
+    mcp.registerTool({
+        name: "delete_tool",
+        scope: "tools:write",
+        description: "Deletes a tool you own. Refused while it is attached to any agent; pass detach: true to detach it from your own agents first. It is never detached from an agent you don't own -- use detach_tool where you hold write on the agent, or ask its owner. Past runs are unaffected, and a run already under way keeps the version it loaded.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: { toolId: { type: "string" }, detach: { type: "boolean" } },
+            required: ["toolId"],
+        },
+        handler: async (args, ctx) => {
+            try {
+                const detachedFrom = await deleteToolGuarded(ctx.db, args.toolId, {
+                    detach: args.detach === true,
+                    authorize: (row) => assertStrictlyOwnedTool(row, args.toolId, ctx.principal.id),
+                });
+                return textResult({ deleted: args.toolId, detachedFrom });
+            }
+            catch (err) {
+                if (!(err instanceof ToolAttachedError))
+                    throw err;
+                const agents = await describeAgents(err.agents, ctx);
+                switch (err.reason) {
+                    // Public agents are included: pulling a tool from a shared agent
+                    // should be an explicit detach_tool.
+                    case "other_owners":
+                        throw new McpError(409, `Tool "${args.toolId}" is still attached to ${agents}. Only your own agents can be detached here; use detach_tool where you hold write on the agent, or ask the other owners to.`);
+                    case "needs_detach":
+                        throw new McpError(409, `Tool "${args.toolId}" is still attached to ${agents}. Pass detach: true to detach it from these agents and delete it.`);
+                    case "race":
+                        throw new McpError(409, `Tool "${args.toolId}" is still attached to an agent; nothing was deleted.`);
+                }
+            }
         },
     });
     mcp.registerTool({
@@ -112,6 +232,7 @@ export function registerToolAuthoringTools(mcp) {
     mcp.registerTool({
         name: "attach_tool",
         scope: "tools:write",
+        description: "Attaches a tool to an agent (needs write on the agent). The four capability fields (allowedSecrets, allowedDatastorePrefixes, allowedHosts, allowedSharedDatastorePrefixes) are the agent owner's to grant: anyone else passing one gets 403, and their attachment runs with none until the owner re-runs attach_tool with the capabilities. When the owner grants an attachment it had not granted before (someone else attached it, or the agent changed owner), every capability not passed is reset to empty, so state each one you want. Granting capabilities to a tool someone else owns vouches for code you can't read (only its owner sees it); the tool's owner can't change it while it's attached to your agent, and detaching drops your grant.",
         inputSchema: {
             type: "object",
             properties: {
@@ -141,35 +262,72 @@ export function registerToolAuthoringTools(mcp) {
             if (!patch.success) {
                 throw new McpError(400, `Invalid tool capabilities: ${patch.error.issues.map((i) => i.message).join("; ")}`);
             }
+            const capabilitiesPassed = Object.values(patch.data).some((value) => value !== undefined);
             await ctx.db.$transaction(async (tx) => {
-                const agent = await tx.agent.findUnique({ where: { id: args.agentId } });
-                if (!agent)
-                    throw new McpError(404, `Agent "${args.agentId}" not found.`);
-                assertCanMutate(agent.ownerId, ctx.principal.id, `Agent "${args.agentId}" is not owned by the caller.`);
+                const { agent } = await assertAgentAccess(ctx, await tx.agent.findUnique({ where: { id: args.agentId } }), args.agentId, "write", tx);
                 if (agent.kind === "coding") {
                     throw new McpError(400, "Native sandbox tools cannot be attached to coding agents.");
                 }
-                await requireOwnedTool(tx, args.toolId, ctx.principal.id);
+                // Capabilities carry the owner's consent (resource-sharing grants
+                // spec §3.4.2). Strict ownership: neither a write-grantee nor the
+                // stdio operator may hand the owner's secrets, datastores or
+                // network to code on the agent.
+                const isOwner = agent.ownerId !== null && agent.ownerId === ctx.principal.id;
+                if (capabilitiesPassed && !isOwner) {
+                    throw new McpError(403, "Only the agent's owner can grant capabilities to an attachment; ask them to re-run attach_tool with the capabilities.");
+                }
+                const existing = await tx.agentTool.findUnique({
+                    where: { agentId_toolId: { agentId: args.agentId, toolId: args.toolId } },
+                });
+                // Creating an attachment needs a tool the caller may attach (Phase
+                // 1: its own or an owner-less one). Re-attaching an existing one
+                // only changes its capabilities: that is how the agent's owner
+                // grants them to a write-grantee's tool, or re-grants them after a
+                // make_owner transfer, so the tool check does not apply.
+                const tool = existing
+                    ? await tx.tool.findUniqueOrThrow({ where: { id: args.toolId } })
+                    : await requireOwnedTool(tx, args.toolId, ctx.principal.id);
+                // The runtime dispatches by name, and names are only unique per
+                // owner: a second same-named tool on one agent would be a
+                // duplicate tool name to the model and silently shadow one of them.
+                const clash = await findSameNamedAttachedTool(tx, args.agentId, tool);
+                if (clash) {
+                    // The clashing tool may be another principal's private one (a
+                    // write-grantee's, or one left from before a transfer): name its
+                    // id only when the caller could read it anyway.
+                    const which = canRead(clash.ownerId, ctx.principal.id)
+                        ? ` (${clash.id})`
+                        : " (a tool owned by another principal)";
+                    throw new McpError(409, `Agent "${args.agentId}" already has a different tool named "${tool.name}" attached${which}; detach it first.`);
+                }
+                // Re-granting an attachment this owner never vouched for: what is
+                // not restated is reset, never silently adopted.
+                const keepUnstated = existing?.capabilitiesGrantedById === agent.ownerId;
+                const field = (key, empty) => patch.data[key] !== undefined ? { [key]: patch.data[key] } : keepUnstated ? {} : { [key]: empty };
+                const ownerGrant = isOwner
+                    ? {
+                        ...field("allowedSecrets", []),
+                        ...field("allowedDatastorePrefixes", []),
+                        ...field("allowedHosts", []),
+                        ...field("allowedSharedDatastorePrefixes", {}),
+                        capabilitiesGrantedById: agent.ownerId,
+                    }
+                    : {};
                 await tx.agentTool.upsert({
                     where: { agentId_toolId: { agentId: args.agentId, toolId: args.toolId } },
                     create: {
                         agentId: args.agentId,
                         toolId: args.toolId,
-                        allowedSecrets: patch.data.allowedSecrets ?? [],
-                        allowedDatastorePrefixes: patch.data.allowedDatastorePrefixes ?? [],
-                        allowedHosts: patch.data.allowedHosts ?? [],
-                        allowedSharedDatastorePrefixes: patch.data.allowedSharedDatastorePrefixes ?? {},
-                    },
-                    update: {
-                        ...(patch.data.allowedSecrets !== undefined ? { allowedSecrets: patch.data.allowedSecrets } : {}),
-                        ...(patch.data.allowedDatastorePrefixes !== undefined
-                            ? { allowedDatastorePrefixes: patch.data.allowedDatastorePrefixes }
-                            : {}),
-                        ...(patch.data.allowedHosts !== undefined ? { allowedHosts: patch.data.allowedHosts } : {}),
-                        ...(patch.data.allowedSharedDatastorePrefixes !== undefined
-                            ? { allowedSharedDatastorePrefixes: patch.data.allowedSharedDatastorePrefixes }
-                            : {}),
+                        allowedSecrets: (isOwner && patch.data.allowedSecrets) || [],
+                        allowedDatastorePrefixes: (isOwner && patch.data.allowedDatastorePrefixes) || [],
+                        allowedHosts: (isOwner && patch.data.allowedHosts) || [],
+                        allowedSharedDatastorePrefixes: (isOwner && patch.data.allowedSharedDatastorePrefixes) || {},
+                        attachedById: ctx.principal.id,
+                        capabilitiesGrantedById: isOwner ? agent.ownerId : null,
                     },
+                    // A non-owner's re-attach leaves an existing attachment's
+                    // capabilities and consent stamp untouched.
+                    update: ownerGrant,
                 });
             }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });
             return textResult({ attached: true });
@@ -184,8 +342,9 @@ export function registerToolAuthoringTools(mcp) {
             required: ["agentId", "toolId"],
         },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
-            await requireOwnedTool(ctx.db, args.toolId, ctx.principal.id);
+            // Write on the agent is enough, whoever owns the tool: an agent's
+            // owner (or write-grantee) can always pull a tool off it.
+            await requireAgentAccess(ctx, args.agentId, "write");
             await ctx.db.agentTool.deleteMany({ where: { agentId: args.agentId, toolId: args.toolId } });
             return textResult({ detached: true });
         },
@@ -195,13 +354,15 @@ export function registerToolAuthoringTools(mcp) {
         scope: "tools:write",
         inputSchema: { type: "object", properties: { agentId: { type: "string" } } },
         handler: async (args, ctx) => {
-            const project = (tool) => tool.ownerId === ctx.principal.id ? tool : { id: tool.id, name: tool.name, description: tool.description };
+            const project = (tool) => projectTool(tool, ctx.principal.id);
             if (args.agentId) {
-                await requireReadableAgent(ctx.db, args.agentId, ctx.principal.id);
+                const { access } = await requireAgentAccess(ctx, args.agentId, "read");
                 const rows = await ctx.db.agentTool.findMany({ where: { agentId: args.agentId }, include: { tool: true } });
+                // The agent's owner sees every tool on it (projected: code only for
+                // the tool's own owner); anyone else only tools they could see anyway.
                 return textResult(rows
                     .map((r) => r.tool)
-                    .filter((tool) => canRead(tool.ownerId, ctx.principal.id))
+                    .filter((tool) => access === "owner" || canRead(tool.ownerId, ctx.principal.id))
                     .map(project));
             }
             const tools = await ctx.db.tool.findMany({ where: visibleToPrincipal(ctx.principal.id) });

package/dist/mcp/tools/trigger.js

@@ -33,7 +33,8 @@ import { CodingBaseRefSchema, CodingTaskOverrideSchema } from "../../coding/prot
 import { z } from "zod";
 import { McpError } from "../errors.js";
 import { createTaskResult, getTask, cancelTask } from "../tasks/manager.js";
-import { canMutate, requireOwnedAgent, requireOwnedTask } from "../auth/ownership.js";
+import { requireOwnedTask } from "../auth/ownership.js";
+import { assertAgentAccess } from "../auth/access.js";
 import { textResult } from "./text-result.js";
 const DEFAULT_TASK_TTL_MS = 24 * 60 * 60 * 1000;
 const TriggerAgentSchema = z
@@ -50,6 +51,29 @@ function parseTriggerArgs(args) {
     const details = parsed.error.issues.map((issue) => `${issue.path.join(".") || "input"}: ${issue.message}`).join("; ");
     throw new McpError(400, `Invalid trigger_agent arguments: ${details}`);
 }
+/**
+ * A non-owner's coding task or baseRef would steer what the owner's
+ * repository authority does, so it is allowed only when the owner opted in
+ * to non-owner task text (codingProfile.allowWebhookTaskOverride, the same
+ * opt-in webhooks use). Otherwise a non-owner run uses the owner's
+ * defaultTask. Resource-sharing grants spec §3.4.5.
+ */
+function assertOverrideAllowed(principalId, agent, args) {
+    // Strictly the owner: the stdio operator's owner-level access doesn't make
+    // it the owner whose repository authority the task steers (review M8).
+    const isOwner = agent.ownerId !== null && agent.ownerId === principalId;
+    if (isOwner || (args.task === undefined && args.baseRef === undefined))
+        return;
+    if (!agent.codingProfile?.allowWebhookTaskOverride) {
+        throw new McpError(403, `Agent "${agent.id}": only its owner can pass a task or baseRef, unless the owner allows it (codingProfile.allowWebhookTaskOverride).`);
+    }
+}
+/** execute on the agent, plus the override rule; `db` is the transaction when re-checking. */
+async function requireTriggerable(ctx, row, id, args, db = ctx.db) {
+    const { agent } = await assertAgentAccess(ctx, row, id, "execute", db);
+    assertOverrideAllowed(ctx.principal.id, agent, args);
+    return agent;
+}
 export function registerTriggerTool(mcp) {
     mcp.registerTool({
         name: "trigger_agent",
@@ -62,7 +86,7 @@ export function registerTriggerTool(mcp) {
         },
         handler: async (rawArgs, ctx) => {
             const args = parseTriggerArgs(rawArgs);
-            const agent = await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            const agent = await requireTriggerable(ctx, await ctx.db.agent.findUnique({ where: { id: args.agentId }, include: { codingProfile: true } }), args.agentId, args);
             if (agent.kind !== "coding" && (args.task !== undefined || args.baseRef !== undefined)) {
                 throw new McpError(400, "Task and baseRef overrides are only valid for coding agents.");
             }
@@ -74,10 +98,11 @@ export function registerTriggerTool(mcp) {
                 codingTask: args.task,
                 codingBaseRef: args.baseRef,
                 task: ctx.clientSupportsTasks ? { principalId: ctx.principal.id, ttlMs: DEFAULT_TASK_TTL_MS } : undefined,
-                beforePersist: async (_tx, current) => {
-                    if (!canMutate(current.ownerId, ctx.principal.id)) {
-                        throw new McpError(403, `Agent "${agent.id}" is not owned by the caller.`);
-                    }
+                triggeredById: ctx.principal.id,
+                // Re-checked through the transaction: a concurrent revoke or
+                // make_owner conflicts instead of racing the run in.
+                beforePersist: async (tx, current) => {
+                    await requireTriggerable(ctx, current, agent.id, args, tx);
                     return true;
                 },
             });
@@ -88,6 +113,11 @@ export function registerTriggerTool(mcp) {
                     throw new Error("Run task was not persisted.");
                 return textResult(createTaskResult(dispatched.task, DEFAULT_TASK_TTL_MS));
             }
+            // A run refused at dispatch (its budget group or run tree is spent) is
+            // already terminal: say so now rather than only through get_run.
+            if (dispatched.run.status === "refused") {
+                return textResult({ runId: dispatched.run.id, status: "refused", error: dispatched.run.error });
+            }
             return textResult({ runId: dispatched.run.id });
         },
     });

package/dist/mcp/tools/webhooks.js

@@ -1,13 +1,17 @@
 import { createWebhook, listWebhooks, deleteWebhook } from "../../core/webhooks.js";
-import { requireOwnedAgent, requireOwnedWebhook } from "../auth/ownership.js";
+import { McpError } from "../errors.js";
+import { requireAgentAccess } from "../auth/access.js";
 import { textResult } from "./text-result.js";
 export function registerWebhookTools(mcp) {
     mcp.registerTool({
         name: "create_webhook",
         scope: "webhooks:write",
+        description: "Creates a standing trigger for an agent (needs write on it) and returns its secret once. It fires only while you still own the agent or hold execute on it.",
         inputSchema: { type: "object", properties: { agentId: { type: "string" } }, required: ["agentId"] },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            // A standing trigger that can also carry task text for a native agent:
+            // write, not just execute (resource-sharing grants spec §3.10).
+            await requireAgentAccess(ctx, args.agentId, "write");
             const created = await createWebhook(args.agentId, ctx.principal.id, ctx.db);
             return textResult(created);
         },
@@ -15,18 +19,25 @@ export function registerWebhookTools(mcp) {
     mcp.registerTool({
         name: "list_webhooks",
         scope: "webhooks:write",
+        description: "Lists webhooks you created, and every webhook on an agent you own.",
         inputSchema: { type: "object", properties: {} },
         handler: async (_args, ctx) => {
-            const webhooks = await listWebhooks(ctx.principal.id, ctx.db);
+            const webhooks = await listWebhooks(ctx.principal.id, ctx.db, { all: ctx.operator === true });
             return textResult(webhooks);
         },
     });
     mcp.registerTool({
         name: "delete_webhook",
         scope: "webhooks:write",
+        description: "Deletes a webhook you created, or any webhook on an agent you own.",
         inputSchema: { type: "object", properties: { id: { type: "string" } }, required: ["id"] },
         handler: async (args, ctx) => {
-            await requireOwnedWebhook(ctx.db, args.id, ctx.principal.id);
+            const webhook = await ctx.db.webhook.findUnique({ where: { id: args.id }, include: { agent: true } });
+            const principalId = ctx.principal.id;
+            const allowed = webhook !== null &&
+                (ctx.operator === true || webhook.ownerId === principalId || webhook.agent.ownerId === principalId);
+            if (!allowed)
+                throw new McpError(403, `Webhook "${args.id}" is not owned by the caller.`);
             await deleteWebhook(args.id, ctx.db);
             return textResult({ deleted: args.id });
         },

package/dist/mcp/transport/streamable-http.d.ts

@@ -1,10 +1,12 @@
 import { type ServerResponse } from "node:http";
 import { type PerRequestResponseMode } from "@modelcontextprotocol/server";
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import type { AuthProvider } from "../../providers/auth/types.js";
 import type { SelfHostedAuthProvider } from "../../providers/auth/self-hosted.js";
 import type { WardbyMcpServer } from "../server.js";
 import type { McpProviders } from "../context.js";
+import { type GitHubIngressDeps } from "../host-events/github-ingress.js";
+import { type HostUserCallbackDeps } from "../host-events/github-user-callback.js";
 export interface HttpServerConfig {
     canonicalUri: string;
     httpBind: {
@@ -25,6 +27,14 @@ export interface StartHttpServerOptions {
         providers: McpProviders;
     };
     selfHosted?: SelfHostedAuthProvider;
+    /** Code-review host webhooks; absent = the endpoints answer 404. */
+    hostEvents?: {
+        github?: GitHubIngressDeps;
+    };
+    /** The host identity-link browser callback (link_host_account); absent = 404. */
+    hostUserAuth?: {
+        github?: HostUserCallbackDeps;
+    };
 }
 export interface HttpServerHandle {
     port: number;

package/dist/mcp/transport/streamable-http.js

@@ -5,6 +5,8 @@ import { toNodeHandler, hostHeaderValidation } from "@modelcontextprotocol/node"
 import { authenticate, protectedResourceMetadata } from "../auth/resource-server.js";
 import { McpError } from "../errors.js";
 import { handleWebhookIngress } from "../webhooks/ingress.js";
+import { handleGitHubEventIngress } from "../host-events/github-ingress.js";
+import { handleHostUserCallback } from "../host-events/github-user-callback.js";
 import { canonicalUrl, HTTP_LIMITS, HttpBoundaryError, parseBody, readBody } from "./http-limits.js";
 import { browserHandler } from "../auth/self-hosted/browser.js";
 import { handleSecretElicitationForm, SECRET_ELICITATION_PATH } from "../tools/secret-elicitation-form.js";
@@ -73,6 +75,7 @@ export async function startHttpServer(opts) {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), HTTP_LIMITS.requestMs);
         let body;
+        let rawBody;
         try {
             const hasBody = req.method === "POST" ||
                 req.method === "PUT" ||
@@ -80,8 +83,11 @@ export async function startHttpServer(opts) {
                 req.headers["content-length"] ||
                 req.headers["transfer-encoding"];
             if (hasBody) {
-                const limit = url.pathname === "/mcp" || url.pathname.startsWith("/webhooks/") ? HTTP_LIMITS.json : HTTP_LIMITS.auth;
+                const limit = url.pathname === "/mcp" || url.pathname.startsWith("/webhooks/") || url.pathname.startsWith("/hosts/")
+                    ? HTTP_LIMITS.json
+                    : HTTP_LIMITS.auth;
                 const raw = await readBody(req, limit, controller.signal);
+                rawBody = raw;
                 body = parseBody(raw, req.headers["content-type"]);
             }
         }
@@ -117,6 +123,30 @@ export async function startHttpServer(opts) {
             sendJson(res, result.status, result.body);
             return;
         }
+        if (url.pathname === "/hosts/github/events" && req.method === "POST") {
+            if (!opts.hostEvents?.github) {
+                sendJson(res, 404, { error: "not_found" });
+                return;
+            }
+            const headers = Object.fromEntries(Object.entries(req.headers).map(([k, v]) => [k, Array.isArray(v) ? v[0] : v]));
+            const result = await handleGitHubEventIngress({ headers, rawBody: rawBody ?? "" }, opts.hostEvents.github);
+            sendJson(res, result.status, result.body);
+            if (result.afterResponse) {
+                void result.afterResponse().catch((err) => httpLog.warn({ err }, "host event follow-up failed"));
+            }
+            return;
+        }
+        if (url.pathname === "/hosts/github/user-callback" && req.method === "GET") {
+            // Unauthenticated by design (a browser redirect from GitHub): the
+            // single-use, hashed OAuth state is what binds it to a link request,
+            // and the canonical-Host check above has already run.
+            if (!opts.hostUserAuth?.github) {
+                sendJson(res, 404, { error: "not_found" });
+                return;
+            }
+            await handleHostUserCallback(url, res, opts.hostUserAuth.github);
+            return;
+        }
         if (url.pathname === "/mcp") {
             if (req.method === "POST" && (!body || body instanceof URLSearchParams))
                 throw new HttpBoundaryError(415, "expected_json");
@@ -125,7 +155,7 @@ export async function startHttpServer(opts) {
                 token: "",
                 clientId: ctx.principal.subject,
                 scopes: [...ctx.scopes],
-                extra: { principal: ctx.principal },
+                extra: { principal: ctx.principal, roles: ctx.roles },
             };
             await nodeHandler(req, res, body);
             return;

package/dist/mcp/unattended-schedules.d.ts

@@ -1,4 +1,4 @@
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 /**
  * `wardby mcp` serves the MCP surface and launches the executor, but the
  * scheduler and reconciler live in `wardby scheduler` (or in `wardby serve`,

package/dist/mcp/webhooks/ingress.d.ts

@@ -4,7 +4,7 @@
  * route in streamable-http.ts, matching the design's "route is
  * unauthenticated by OAuth" invariant.
  */
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import type { Executor } from "../../providers/executor/types.js";
 export interface WebhookIngressRequest {
     headers: Record<string, string | undefined>;

package/dist/providers/auth/delegating.d.ts

@@ -13,7 +13,25 @@ export interface DelegatingAuthConfig {
     issuer?: string;
     audience?: string;
     jwksUri?: string;
+    /**
+     * AUTH_ROLE_CLAIM: the access-token claim carrying the IdP's roles/groups —
+     * an exact top-level claim name first (e.g. Auth0's namespaced
+     * `https://wardby.example/roles`, Okta `groups`, FusionAuth `roles`), else
+     * a dotted path into nested objects (Keycloak `realm_access.roles`).
+     */
+    roleClaim?: string;
+    /**
+     * AUTH_ROLE_MAP: comma-separated `idpValue=wardbyRole` pairs, e.g.
+     * `wardby-admin=admin,wardby-packages=package-approver,wardby-services=service-manager`.
+     */
+    roleMap?: string;
 }
+/**
+ * Parses AUTH_ROLE_MAP. Whitespace around entries and around `=` is ignored;
+ * an unknown wardby role, or a malformed or empty entry, is a startup error.
+ * The LAST `=` splits an entry (wardby role names never contain one).
+ */
+export declare function parseRoleMap(value: string): Map<string, string[]>;
 /**
  * Every spelling of the configured audience a token may legitimately carry.
  *
@@ -35,6 +53,7 @@ export declare class DelegatingAuthProvider implements AuthProvider {
     private readonly config;
     private readonly audiences;
     private readonly jwks;
+    private readonly roleMap?;
     constructor(config: DelegatingAuthConfig, jwks?: JWTVerifyGetKey);
     verifyBearer(token: string): Promise<VerifiedToken>;
     profile(idToken: string): Promise<AuthProfile>;