@wardby/cli 0.2.0 → 0.3.0

package/dist/core/tool-admin.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Updating and deleting a Tool, shared by MCP update_tool/delete_tool (the
+ * owner, over MCP) and `wardby tool update|delete` (the operator, over the
+ * CLI). Each caller brings its own authorization -- MCP is strictly
+ * owner-only and never touches public tools; the operator may change any
+ * tool -- but the attachment rules are the same for both, and are always
+ * judged against the *tool's* owner:
+ *
+ * - An update is refused while the tool is attached to any agent owned by
+ *   someone other than the tool's owner (a public agent counts, unless the
+ *   tool is public too). An attachment's grants hand whatever code the row
+ *   holds to that agent owner's secrets and hosts, and the description
+ *   reaches their model context.
+ * - A delete is refused while any attachment remains; `detach` first removes
+ *   the attachments to the tool owner's own agents (for a public tool, the
+ *   public agents), never anyone else's. The check runs before any detach,
+ *   so a refusal changes nothing.
+ *
+ * Both run in one Serializable transaction, the same isolation as MCP
+ * attach_tool, so an attach that commits between the check and the write
+ * aborts one side instead of letting new code reach a newly attached agent
+ * (pinned in core/prisma-adapter.database.test.ts). That guarantee covers
+ * MCP attach_tool only: `wardby tool attach` and the importer attach with a
+ * plain check-then-upsert, acceptable because both are operator-only.
+ */
+import { Prisma, type PrismaClient, type Tool } from "#prisma";
+export type AttachedAgent = {
+    id: string;
+    name: string;
+    ownerId: string | null;
+};
+export interface ToolChanges {
+    description?: string;
+    paramsZod?: string;
+    code?: string;
+}
+/**
+ * Why a tool change was refused because of its attachments:
+ * - `other_owners`: attached to agents owned by someone other than the
+ *   tool's owner (`agents` lists them; callers decide how much to reveal).
+ * - `needs_detach`: a delete without `detach`, still attached to the tool
+ *   owner's own agents.
+ * - `race`: an attachment committed after the check, and the RESTRICT
+ *   foreign key stopped the delete (`agents` is empty).
+ */
+export declare class ToolAttachedError extends Error {
+    readonly reason: "other_owners" | "needs_detach" | "race";
+    readonly agents: AttachedAgent[];
+    constructor(reason: "other_owners" | "needs_detach" | "race", agents: AttachedAgent[]);
+}
+/** Whether `changes` names at least one field to change. */
+export declare function hasToolChanges(changes: ToolChanges): boolean;
+/**
+ * The row update for `changes`, with jsonSchema re-derived exactly as tool
+ * creation does whenever paramsZod changes, so the cached schema never goes
+ * stale. An invalid paramsZod is returned, not thrown -- the caller reports
+ * it like create_tool does and writes nothing. Run it before the transaction
+ * so a QuickJS compile never holds one open.
+ */
+export declare function prepareToolUpdate(changes: ToolChanges): Promise<{
+    ok: true;
+    data: Prisma.ToolUpdateInput;
+} | {
+    ok: false;
+    errorKind: string;
+    errorMessage: string;
+}>;
+/** The agents `toolId` is attached to, read inside the caller's transaction. */
+export declare function attachedAgents(tx: Pick<Prisma.TransactionClient, "agentTool">, toolId: string): Promise<AttachedAgent[]>;
+/** Refuses (by throwing) unless the caller may change this tool; receives the row read inside the transaction. */
+export type AuthorizeTool = (tool: Tool | null) => void;
+export declare function updateToolGuarded(db: Pick<PrismaClient, "$transaction">, toolId: string, data: Prisma.ToolUpdateInput, authorize: AuthorizeTool): Promise<Tool>;
+/** Deletes the tool and returns the ids of the agents it was detached from. */
+export declare function deleteToolGuarded(db: Pick<PrismaClient, "$transaction">, toolId: string, options: {
+    detach: boolean;
+    authorize: AuthorizeTool;
+}): Promise<string[]>;
+/** One `wardby tool list` line: names are only unique per owner, so the id and owner disambiguate. */
+export declare function formatToolLine(tool: Pick<Tool, "id" | "name" | "description" | "ownerId">): string;
+/** Attached agents for an operator-facing refusal: unlike MCP's, nothing is redacted. */
+export declare function formatAttachedAgents(agents: AttachedAgent[]): string;

package/dist/core/tool-admin.js

@@ -0,0 +1,129 @@
+/**
+ * Updating and deleting a Tool, shared by MCP update_tool/delete_tool (the
+ * owner, over MCP) and `wardby tool update|delete` (the operator, over the
+ * CLI). Each caller brings its own authorization -- MCP is strictly
+ * owner-only and never touches public tools; the operator may change any
+ * tool -- but the attachment rules are the same for both, and are always
+ * judged against the *tool's* owner:
+ *
+ * - An update is refused while the tool is attached to any agent owned by
+ *   someone other than the tool's owner (a public agent counts, unless the
+ *   tool is public too). An attachment's grants hand whatever code the row
+ *   holds to that agent owner's secrets and hosts, and the description
+ *   reaches their model context.
+ * - A delete is refused while any attachment remains; `detach` first removes
+ *   the attachments to the tool owner's own agents (for a public tool, the
+ *   public agents), never anyone else's. The check runs before any detach,
+ *   so a refusal changes nothing.
+ *
+ * Both run in one Serializable transaction, the same isolation as MCP
+ * attach_tool, so an attach that commits between the check and the write
+ * aborts one side instead of letting new code reach a newly attached agent
+ * (pinned in core/prisma-adapter.database.test.ts). That guarantee covers
+ * MCP attach_tool only: `wardby tool attach` and the importer attach with a
+ * plain check-then-upsert, acceptable because both are operator-only.
+ */
+import { Prisma } from "#prisma";
+import { deriveJsonSchema } from "../sandbox/zod-params.js";
+/**
+ * Why a tool change was refused because of its attachments:
+ * - `other_owners`: attached to agents owned by someone other than the
+ *   tool's owner (`agents` lists them; callers decide how much to reveal).
+ * - `needs_detach`: a delete without `detach`, still attached to the tool
+ *   owner's own agents.
+ * - `race`: an attachment committed after the check, and the RESTRICT
+ *   foreign key stopped the delete (`agents` is empty).
+ */
+export class ToolAttachedError extends Error {
+    reason;
+    agents;
+    constructor(reason, agents) {
+        super(`tool_attached_${reason}`);
+        this.reason = reason;
+        this.agents = agents;
+        this.name = "ToolAttachedError";
+    }
+}
+/** Whether `changes` names at least one field to change. */
+export function hasToolChanges(changes) {
+    return changes.description !== undefined || changes.paramsZod !== undefined || changes.code !== undefined;
+}
+/**
+ * The row update for `changes`, with jsonSchema re-derived exactly as tool
+ * creation does whenever paramsZod changes, so the cached schema never goes
+ * stale. An invalid paramsZod is returned, not thrown -- the caller reports
+ * it like create_tool does and writes nothing. Run it before the transaction
+ * so a QuickJS compile never holds one open.
+ */
+export async function prepareToolUpdate(changes) {
+    const data = {
+        ...(changes.description !== undefined ? { description: changes.description } : {}),
+        ...(changes.code !== undefined ? { code: changes.code } : {}),
+    };
+    if (changes.paramsZod !== undefined) {
+        const schemaResult = await deriveJsonSchema(changes.paramsZod);
+        if (!schemaResult.ok) {
+            return { ok: false, errorKind: schemaResult.errorKind, errorMessage: schemaResult.errorMessage };
+        }
+        data.paramsZod = changes.paramsZod;
+        data.jsonSchema = schemaResult.value;
+    }
+    return { ok: true, data };
+}
+/** The agents `toolId` is attached to, read inside the caller's transaction. */
+export async function attachedAgents(tx, toolId) {
+    const rows = await tx.agentTool.findMany({
+        where: { toolId },
+        select: { agent: { select: { id: true, name: true, ownerId: true } } },
+    });
+    return rows.map((row) => row.agent);
+}
+export async function updateToolGuarded(db, toolId, data, authorize) {
+    return db.$transaction(async (tx) => {
+        const tool = await tx.tool.findUnique({ where: { id: toolId } });
+        authorize(tool);
+        const others = (await attachedAgents(tx, toolId)).filter((agent) => agent.ownerId !== tool.ownerId);
+        if (others.length > 0)
+            throw new ToolAttachedError("other_owners", others);
+        return tx.tool.update({ where: { id: toolId }, data });
+    }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });
+}
+/** Deletes the tool and returns the ids of the agents it was detached from. */
+export async function deleteToolGuarded(db, toolId, options) {
+    try {
+        return await db.$transaction(async (tx) => {
+            const tool = await tx.tool.findUnique({ where: { id: toolId } });
+            options.authorize(tool);
+            const agents = await attachedAgents(tx, toolId);
+            const own = agents.filter((agent) => agent.ownerId === tool.ownerId);
+            const others = agents.filter((agent) => agent.ownerId !== tool.ownerId);
+            if (others.length > 0)
+                throw new ToolAttachedError("other_owners", others);
+            if (own.length > 0 && !options.detach)
+                throw new ToolAttachedError("needs_detach", own);
+            if (own.length > 0) {
+                await tx.agentTool.deleteMany({ where: { toolId, agentId: { in: own.map((agent) => agent.id) } } });
+            }
+            await tx.tool.delete({ where: { id: toolId } });
+            return own.map((agent) => agent.id);
+        }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });
+    }
+    catch (err) {
+        // AgentTool.toolId is ON DELETE RESTRICT: an attachment that raced in
+        // past the check above still stops the delete, as P2003.
+        if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === "P2003") {
+            throw new ToolAttachedError("race", []);
+        }
+        throw err;
+    }
+}
+/** One `wardby tool list` line: names are only unique per owner, so the id and owner disambiguate. */
+export function formatToolLine(tool) {
+    return `${tool.id}  ${tool.name}  owner:${tool.ownerId ?? "public"}  ${tool.description}`;
+}
+/** Attached agents for an operator-facing refusal: unlike MCP's, nothing is redacted. */
+export function formatAttachedAgents(agents) {
+    return agents
+        .map((agent) => `"${agent.name}" (${agent.id}, ${agent.ownerId === null ? "public" : `owner ${agent.ownerId}`})`)
+        .join(", ");
+}

package/dist/core/tool-names.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Tool-name rules shared by every path that creates or attaches a Tool
+ * (MCP create_tool/attach_tool, `wardby tool create|attach`, the importer)
+ * and by the runner that dispatches them.
+ *
+ * Tool names are unique per owner, not globally (schema.prisma), so one
+ * agent could otherwise end up holding two same-named tools -- say its own
+ * `foo` plus a public `foo`. The runtime dispatches by name (runner.ts), so
+ * the model would see a duplicate tool name and one tool would silently
+ * shadow the other; every attach path refuses that instead
+ * (findSameNamedAttachedTool), and the runner asserts it at load time.
+ */
+import type { Prisma, PrismaClient, Tool } from "#prisma";
+/** The runner's synthesized sub-agent tools are `delegate_to_<boundName>`. */
+export declare const DELEGATE_TOOL_PREFIX = "delegate_to_";
+/**
+ * Why `name` can't be a user tool's name, or undefined if it can. Each
+ * reserved name is checked by the runner before user tools, so a user tool
+ * with one of these names could be created but never reached.
+ */
+export declare function reservedToolNameReason(name: string): string | undefined;
+/** Names appearing more than once, each reported once, in first-seen order. */
+export declare function duplicateToolNames(names: readonly string[]): string[];
+export type ToolLookupDb = Pick<PrismaClient | Prisma.TransactionClient, "tool" | "agentTool">;
+/**
+ * A tool other than `tool` that is already attached to `agentId` under the
+ * same name, or null. Run it inside the attaching transaction (attach_tool's
+ * is Serializable) so a concurrent attach can't slip in between.
+ */
+export declare function findSameNamedAttachedTool(db: Pick<ToolLookupDb, "agentTool">, agentId: string, tool: Pick<Tool, "id" | "name">): Promise<Pick<Tool, "id" | "name" | "ownerId"> | null>;
+/**
+ * Resolves a CLI tool reference: an id, else a name. A name is no longer
+ * unique across owners, so more than one match is refused -- with the
+ * candidate ids, so the operator can pass one -- rather than guessed at.
+ */
+export declare function resolveToolRef(db: Pick<ToolLookupDb, "tool">, ref: string): Promise<{
+    ok: true;
+    tool: Tool;
+} | {
+    ok: false;
+    error: string;
+}>;

package/dist/core/tool-names.js

@@ -0,0 +1,64 @@
+import { MEMORY_TOOL_NAMES } from "./memory-tools.js";
+import { SUBAGENT_MEMORY_TOOL_NAMES } from "./subagent-memory-tools.js";
+/** The runner's synthesized sub-agent tools are `delegate_to_<boundName>`. */
+export const DELEGATE_TOOL_PREFIX = "delegate_to_";
+/**
+ * Why `name` can't be a user tool's name, or undefined if it can. Each
+ * reserved name is checked by the runner before user tools, so a user tool
+ * with one of these names could be created but never reached.
+ */
+export function reservedToolNameReason(name) {
+    if (MEMORY_TOOL_NAMES.has(name))
+        return `Tool name "${name}" is reserved for the built-in agent-memory tools.`;
+    if (SUBAGENT_MEMORY_TOOL_NAMES.has(name)) {
+        return `Tool name "${name}" is reserved for the built-in sub-agent memory tools.`;
+    }
+    if (name.startsWith(DELEGATE_TOOL_PREFIX)) {
+        return `Tool names starting with "${DELEGATE_TOOL_PREFIX}" are reserved for sub-agent delegation tools.`;
+    }
+    return undefined;
+}
+/** Names appearing more than once, each reported once, in first-seen order. */
+export function duplicateToolNames(names) {
+    const seen = new Set();
+    const duplicates = new Set();
+    for (const name of names) {
+        if (seen.has(name))
+            duplicates.add(name);
+        seen.add(name);
+    }
+    return [...duplicates];
+}
+/**
+ * A tool other than `tool` that is already attached to `agentId` under the
+ * same name, or null. Run it inside the attaching transaction (attach_tool's
+ * is Serializable) so a concurrent attach can't slip in between.
+ */
+export async function findSameNamedAttachedTool(db, agentId, tool) {
+    const clash = await db.agentTool.findFirst({
+        where: { agentId, toolId: { not: tool.id }, tool: { name: tool.name } },
+        select: { tool: { select: { id: true, name: true, ownerId: true } } },
+    });
+    return clash?.tool ?? null;
+}
+/**
+ * Resolves a CLI tool reference: an id, else a name. A name is no longer
+ * unique across owners, so more than one match is refused -- with the
+ * candidate ids, so the operator can pass one -- rather than guessed at.
+ */
+export async function resolveToolRef(db, ref) {
+    const byId = await db.tool.findUnique({ where: { id: ref } });
+    if (byId)
+        return { ok: true, tool: byId };
+    const byName = await db.tool.findMany({ where: { name: ref } });
+    if (byName.length === 0)
+        return { ok: false, error: `unknown tool "${ref}".` };
+    if (byName.length > 1) {
+        const candidates = byName.map((t) => `${t.id} (owner: ${t.ownerId ?? "public"})`).join(", ");
+        return {
+            ok: false,
+            error: `ambiguous: ${byName.length} tools named "${ref}"; pass the tool id instead (${candidates}).`,
+        };
+    }
+    return { ok: true, tool: byName[0] };
+}

package/dist/core/untrusted-content.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The one place untrusted text is fenced for the model. Tool results
+ * (engine-native.ts) and a run's untrusted context (the parts of a trigger
+ * nobody vetted, e.g. a GitHub issue's title and description) are delivered
+ * inside wrapper tags; a run's task is fenced in the system prompt by
+ * run_task tags (runner.ts). Every one of those tags is only a boundary if
+ * the content inside cannot write it, so all wrapped text passes through
+ * neutraliseWrapperTags first (H5-6 / E-09).
+ */
+export declare const UNTRUSTED_TOOL_OUTPUT_TAG = "untrusted_tool_output";
+export declare const UNTRUSTED_CONTEXT_TAG = "untrusted_context";
+export declare const RUN_TASK_TAG = "run_task";
+/** Makes every fence-like tag in `content` inert. Idempotent. */
+export declare function neutraliseWrapperTags(content: string): string;
+/** `content` between `<tag>` and `</tag>`, unable to close or reopen either fence itself. */
+export declare function wrapUntrusted(tag: string, content: string): string;
+/**
+ * Stores a run's task and its untrusted context in the one Run.taskOverride
+ * column: the task, then a wrapped context block. Both parts are
+ * neutralised, so the stored text holds exactly one real context opener.
+ */
+export declare function composeTaskOverride(task: string, untrustedContext?: string): string;
+/**
+ * The inverse of composeTaskOverride, read by the runner. Everything from the
+ * first context opener on is context. A producer that wrote the opener
+ * without composeTaskOverride (a webhook caller, a delegating model) can only
+ * demote its own text into the untrusted context, never promote any.
+ */
+export declare function splitTaskOverride(taskOverride: string): {
+    task: string;
+    untrustedContext?: string;
+};

package/dist/core/untrusted-content.js

@@ -0,0 +1,72 @@
+/**
+ * The one place untrusted text is fenced for the model. Tool results
+ * (engine-native.ts) and a run's untrusted context (the parts of a trigger
+ * nobody vetted, e.g. a GitHub issue's title and description) are delivered
+ * inside wrapper tags; a run's task is fenced in the system prompt by
+ * run_task tags (runner.ts). Every one of those tags is only a boundary if
+ * the content inside cannot write it, so all wrapped text passes through
+ * neutraliseWrapperTags first (H5-6 / E-09).
+ */
+export const UNTRUSTED_TOOL_OUTPUT_TAG = "untrusted_tool_output";
+export const UNTRUSTED_CONTEXT_TAG = "untrusted_context";
+export const RUN_TASK_TAG = "run_task";
+/** Invisible characters (zero-width, bidi controls, soft hyphen, variation selectors, tag characters, ...). */
+const IGNORABLE = "\\p{Default_Ignorable_Code_Point}";
+/** "<" and its common lookalikes: fullwidth, small, angle brackets, single guillemet. */
+const BRACKET = "[<\\uFF1C\\uFE64\\u2329\\u3008\\u27E8\\u2039]";
+/** Between the bracket and the name: whitespace, invisibles, and any number of slashes, backslashes or slash lookalikes. */
+const LEAD = `[\\s${IGNORABLE}/\\\\\\uFF0F\\u2215\\u2044\\u29F8]*`;
+/** Between "run" and "task": whitespace, invisibles, "_", "-" and their dash/fullwidth lookalikes. */
+const JOIN = `[\\s${IGNORABLE}_\\-\\u2010-\\u2015\\uFF3F\\uFF0D]*`;
+/** One ASCII letter or its fullwidth form (the `i` flag covers either case). */
+const letter = (ch) => `[${ch}${String.fromCharCode(0xff41 + ch.charCodeAt(0) - 0x61)}]`;
+/** A word whose letters may be separated by invisible characters. */
+const word = (w) => [...w].map(letter).join(`[${IGNORABLE}]*`);
+/**
+ * A bracket that could be read as opening or closing one of the fences: a
+ * "<" or lookalike, then LEAD, then the start of a fence name ("untrusted…"
+ * or "run_task" / "run-task" / "run task"), in any case, with invisible
+ * characters or fullwidth letters allowed inside the name. Only the bracket
+ * is replaced, with "&lt;", so the rest of the text is unchanged.
+ *
+ * Linear time (I-1): every starred class is followed by a letter it cannot
+ * contain, so it has exactly one way to match, and a failed attempt at one
+ * bracket gives back each character at most once. Homoglyphs from other
+ * scripts inside the name (a Cyrillic "е") are not caught.
+ */
+const FENCE_TAG_LIKE = new RegExp(`${BRACKET}(?=${LEAD}(?:${word("untrusted")}|${word("run")}${JOIN}${word("task")}))`, "giu");
+/** Makes every fence-like tag in `content` inert. Idempotent. */
+export function neutraliseWrapperTags(content) {
+    return content.replace(FENCE_TAG_LIKE, "&lt;");
+}
+/** `content` between `<tag>` and `</tag>`, unable to close or reopen either fence itself. */
+export function wrapUntrusted(tag, content) {
+    return `<${tag}>\n${neutraliseWrapperTags(content)}\n</${tag}>`;
+}
+const CONTEXT_OPEN = `<${UNTRUSTED_CONTEXT_TAG}>\n`;
+const CONTEXT_CLOSE = `\n</${UNTRUSTED_CONTEXT_TAG}>`;
+/**
+ * Stores a run's task and its untrusted context in the one Run.taskOverride
+ * column: the task, then a wrapped context block. Both parts are
+ * neutralised, so the stored text holds exactly one real context opener.
+ */
+export function composeTaskOverride(task, untrustedContext) {
+    const safeTask = neutraliseWrapperTags(task);
+    return untrustedContext ? `${safeTask}\n\n${wrapUntrusted(UNTRUSTED_CONTEXT_TAG, untrustedContext)}` : safeTask;
+}
+/**
+ * The inverse of composeTaskOverride, read by the runner. Everything from the
+ * first context opener on is context. A producer that wrote the opener
+ * without composeTaskOverride (a webhook caller, a delegating model) can only
+ * demote its own text into the untrusted context, never promote any.
+ */
+export function splitTaskOverride(taskOverride) {
+    const at = taskOverride.startsWith(CONTEXT_OPEN) ? 0 : taskOverride.indexOf(`\n${CONTEXT_OPEN}`);
+    if (at < 0)
+        return { task: taskOverride };
+    const task = taskOverride.slice(0, at).trimEnd();
+    let rest = taskOverride.slice(at === 0 ? CONTEXT_OPEN.length : at + 1 + CONTEXT_OPEN.length);
+    if (rest.endsWith(CONTEXT_CLOSE))
+        rest = rest.slice(0, -CONTEXT_CLOSE.length);
+    return { task, untrustedContext: rest };
+}

package/dist/core/webhooks.d.ts

@@ -1,4 +1,4 @@
-import type { PrismaClient, Webhook } from "@prisma/client";
+import type { PrismaClient, Webhook } from "#prisma";
 import type { Executor } from "../providers/executor/types.js";
 export type WebhookMetadata = Pick<Webhook, "id" | "agentId" | "status" | "ownerId" | "createdAt" | "lastFiredAt">;
 /** Creates a webhook and returns the raw secret ONCE — only its hash is ever stored. */
@@ -6,7 +6,14 @@ export declare function createWebhook(agentId: string, ownerId: string, db: Pris
     id: string;
     secret: string;
 }>;
-export declare function listWebhooks(ownerId: string, db: PrismaClient): Promise<WebhookMetadata[]>;
+/**
+ * Webhooks the principal created, plus every webhook on an agent it owns
+ * (the agent owner must be able to see standing triggers others hold on
+ * its agent). `all` (the stdio operator) lists every webhook.
+ */
+export declare function listWebhooks(principalId: string, db: PrismaClient, opts?: {
+    all?: boolean;
+}): Promise<WebhookMetadata[]>;
 export declare function deleteWebhook(id: string, db: PrismaClient): Promise<void>;
 export type ResolveWebhookRunResult = {
     ok: true;

package/dist/core/webhooks.js

@@ -10,6 +10,7 @@
  */
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { dispatchRun } from "./dispatch.js";
+import { atLeast, effectiveAccess } from "./grants.js";
 function hashSecret(secret) {
     return createHash("sha256").update(secret).digest("hex");
 }
@@ -39,8 +40,15 @@ export async function createWebhook(agentId, ownerId, db) {
     const webhook = await db.webhook.create({ data: { agentId, ownerId, secretHash: hashSecret(secret) } });
     return { id: webhook.id, secret };
 }
-export async function listWebhooks(ownerId, db) {
-    const webhooks = await db.webhook.findMany({ where: { ownerId } });
+/**
+ * Webhooks the principal created, plus every webhook on an agent it owns
+ * (the agent owner must be able to see standing triggers others hold on
+ * its agent). `all` (the stdio operator) lists every webhook.
+ */
+export async function listWebhooks(principalId, db, opts = {}) {
+    const webhooks = await db.webhook.findMany({
+        where: opts.all ? {} : { OR: [{ ownerId: principalId }, { agent: { ownerId: principalId } }] },
+    });
     return webhooks.map(({ id, agentId, status, ownerId: owner, createdAt, lastFiredAt }) => ({
         id,
         agentId,
@@ -85,6 +93,9 @@ export async function resolveWebhookRun(id, presentedSecret, db, executor, codin
         // to modify a real repository.
         codingTask: agent.kind === "coding" ? codingTask : undefined,
         taskOverride: agent.kind === "native" ? codingTask : undefined,
+        // The webhook is its creator's standing trigger: its runs are visible to
+        // the creator (and the agent owner), like a trigger_agent call.
+        triggeredById: webhook.ownerId,
         beforePersist: async (tx, currentAgent) => {
             const current = await tx.webhook.findUnique({ where: { id } });
             if (!current) {
@@ -103,6 +114,16 @@ export async function resolveWebhookRun(id, presentedSecret, db, executor, codin
                 rejected = "disabled";
                 return false;
             }
+            // The creator must still be allowed to trigger the agent (resource-
+            // sharing grants spec §3.10): its owner, or a holder of execute. Read
+            // through tx, so a revoke or make_owner takes effect on the next fire.
+            // A webhook on a formerly public agent keeps firing through the
+            // migration's everyone-execute grant.
+            const creatorAccess = await effectiveAccess(tx, "agent", currentAgent, current.ownerId);
+            if (!atLeast("agent", creatorAccess, "execute")) {
+                rejected = "disabled";
+                return false;
+            }
             await tx.webhook.update({ where: { id }, data: { lastFiredAt: new Date() } });
             return true;
         },