@wardby/cli 0.2.1 → 0.3.0

package/dist/mcp/index.js

@@ -1,28 +1,53 @@
-import { loadProviderConfig, loadMcpConfig, loadAuthConfig } from "../config/providers.js";
+/**
+ * MCP composition root: assembles the real providers, builds one
+ * WardbyMcpServer, registers every tool module, and starts whichever
+ * transport MCP_TRANSPORT selects. No business logic lives here — this
+ * file only wires together pieces every earlier task already built and
+ * tested on their own.
+ *
+ * stdio vs. HTTP diverge on two things a live smoke test surfaced (see the
+ * ledger): stdio needs no `MCP_CANONICAL_URI` (there's no HTTP endpoint or
+ * OAuth challenge to identify) and constructs no real `AuthProvider` at all
+ * (per the design: "stdio local mode: no token; the operator is trusted") —
+ * building one unconditionally would make `wardby mcp` over stdio fail on
+ * missing `AUTH_JWKS_URI`/`AUTH_SIGNING_KEY` a deployment running stdio-only
+ * never needed to set.
+ */
+import { loadProviderConfig, loadMcpConfig, loadShutdownDrainSeconds, loadAuthConfig, loadGitHubEventConfig, loadGitHubVcsConfig, } from "../config/providers.js";
 import { prisma } from "../core/db.js";
+import { waitForInFlightRuns } from "../core/in-flight-runs.js";
 import { NativeEngine } from "../core/engine-native.js";
 import { resolveLlmRegistrations, RoutingLlmProvider } from "../providers/llm/index.js";
 import { PostgresDatastore } from "../providers/datastore/index.js";
 import { PostgresAgentMemory } from "../providers/memory/index.js";
 import { buildConfiguredExecutor, buildExecutor } from "../providers/executor/index.js";
 import { buildSecretCipher } from "../providers/secrets/index.js";
+import { buildHostUserAuthorizers, buildReviewHosts } from "../providers/review-host/index.js";
+import { createRepoAccessGate } from "../core/repo-access.js";
+import { userCallbackPath } from "../core/host-identity-links.js";
 import { buildAuthProvider } from "../providers/auth/index.js";
+import { GitHubAppClient } from "../providers/vcs/github.js";
 import { buildMcpServer } from "./server.js";
 import { countUnattendedSchedules, unattendedSchedulesWarning } from "./unattended-schedules.js";
 import { runStdioServer } from "./transport/stdio.js";
 import { startHttpServer } from "./transport/streamable-http.js";
 import { resolvePrincipal } from "./auth/principal.js";
-import { SCOPES_SUPPORTED } from "./auth/resource-server.js";
+import { ROLE_NAMES, SCOPES_SUPPORTED } from "./auth/resource-server.js";
 import { canonicalUrl } from "./transport/http-limits.js";
 import { registerAgentTools } from "./tools/agents.js";
+import { registerServiceTools } from "./tools/services.js";
 import { registerBudgetGroupTools } from "./tools/budget-groups.js";
 import { registerModelTools } from "./tools/models.js";
+import { registerHelpTools } from "./tools/help.js";
 import { registerTriggerTool } from "./tools/trigger.js";
 import { registerToolAuthoringTools } from "./tools/tools.js";
 import { registerSchedulingTools } from "./tools/scheduling.js";
 import { registerRunTools } from "./tools/runs.js";
 import { registerDatastoreTools } from "./tools/datastore.js";
 import { registerSubAgentTools } from "./tools/subagents.js";
+import { registerGrantTools } from "./tools/grants.js";
+import { registerRepositoryTools } from "./tools/repositories.js";
+import { registerHostAccountTools } from "./tools/host-accounts.js";
 import { registerMemoryTools } from "./tools/memory.js";
 import { registerSecretsTools } from "./tools/secrets.js";
 import { registerWebhookTools } from "./tools/webhooks.js";
@@ -45,17 +70,44 @@ async function warnIfNothingWillFireSchedules() {
 }
 /** Placeholder identifier for stdio, which has no HTTP endpoint to name. Never surfaced: stdio's fixed context always holds every scope, so no scope challenge is ever built against it. */
 const STDIO_PLACEHOLDER_URI = "urn:wardby:local-stdio";
+/**
+ * stdio's one fixed identity: the local operator (LOCAL_PRINCIPAL), trusted
+ * with every supported scope and every role — whoever can start the
+ * process already holds the database and its keys.
+ */
+export function localOperatorContext(principal, providers, db) {
+    return {
+        principal,
+        scopes: new Set(SCOPES_SUPPORTED),
+        roles: [...ROLE_NAMES],
+        // Full access to every resource (resource-sharing grants spec §3.9),
+        // but never past the binding rules.
+        operator: true,
+        canonicalUri: STDIO_PLACEHOLDER_URI,
+        providers,
+        db,
+        clientSupportsTasks: false,
+        // Placeholder — server.ts's resolveCtx overwrites this with the
+        // current call's real mcpReq on every dispatch.
+        mcpReq: { requestState: () => undefined },
+    };
+}
 /** Registers the full Phase 4 tool surface — every module, in one place. */
 export function registerAllTools(mcp, opts) {
     registerAgentTools(mcp);
+    registerServiceTools(mcp);
     registerBudgetGroupTools(mcp);
     registerModelTools(mcp);
+    registerHelpTools(mcp);
     registerTriggerTool(mcp);
     registerToolAuthoringTools(mcp);
     registerSchedulingTools(mcp);
     registerRunTools(mcp);
     registerDatastoreTools(mcp);
     registerSubAgentTools(mcp);
+    registerGrantTools(mcp);
+    registerRepositoryTools(mcp);
+    registerHostAccountTools(mcp);
     registerMemoryTools(mcp);
     registerSecretsTools(mcp, {
         buildElicitationUrl: opts.secretElicitationUrl,
@@ -75,6 +127,11 @@ export function buildMcpProviders() {
     const secrets = buildSecretCipher(providerConfig);
     const datastore = new PostgresDatastore(prisma, secrets);
     const memory = new PostgresAgentMemory(prisma);
+    const reviewHosts = buildReviewHosts();
+    const hostUserAuthorizers = buildHostUserAuthorizers();
+    // One gate (and one cache) for the whole process: set-time checks in the
+    // MCP tools, repo_* calls in native runs, coding runs, and host events.
+    const repoAccess = createRepoAccessGate({ db: prisma, hosts: reviewHosts });
     // `nativeProviders` is passed by reference into buildExecutor, and native
     // runs it drives read `this.providers.executor` at call time (not at
     // construction time) — so patching `.executor` on afterward, once the
@@ -83,11 +140,13 @@ export function buildMcpProviders() {
     // through the same composed executor everything else uses. There's no
     // way to hand the native executor a reference to its own wrapping
     // RoutingExecutor before that wrapper is constructed.
-    const nativeProviders = { llm, engine, datastore, secrets, memory };
+    const nativeProviders = { llm, engine, datastore, secrets, memory, reviewHosts, repoAccess };
     const nativeExecutor = buildExecutor(providerConfig, nativeProviders, prisma);
-    const executor = buildConfiguredExecutor({ native: nativeExecutor, db: prisma, providerConfig });
+    const executor = buildConfiguredExecutor({ native: nativeExecutor, db: prisma, providerConfig, repoAccess });
     nativeProviders.executor = executor;
-    return { providers: { llm, engine, datastore, secrets, executor, memory } };
+    return {
+        providers: { llm, engine, datastore, secrets, executor, memory, reviewHosts, hostUserAuthorizers, repoAccess },
+    };
 }
 /** Awaits `promise` (if any), logging and swallowing a rejection instead of propagating it. */
 async function closeQuietly(promise, what) {
@@ -101,6 +160,8 @@ async function closeQuietly(promise, what) {
 /** The real CLI entry point: `wardby mcp`. Reads config from the environment, starts stdio or HTTP per MCP_TRANSPORT. */
 export async function startMcp(options = {}) {
     const mcpConfig = loadMcpConfig();
+    // Parsed up front so a malformed value fails at startup, not at shutdown.
+    const drainSeconds = loadShutdownDrainSeconds();
     const providers = options.providers ?? buildMcpProviders().providers;
     await providers.executor.launch?.();
     if (!options.schedulerAttached)
@@ -120,17 +181,7 @@ export async function startMcp(options = {}) {
         // local identity for the whole connection, per the design's own
         // "stdio local mode: no token; the operator is trusted."
         const principal = await resolvePrincipal(mcpConfig.localPrincipal, prisma);
-        mcp.setFixedContext({
-            principal,
-            scopes: new Set(SCOPES_SUPPORTED),
-            canonicalUri: STDIO_PLACEHOLDER_URI,
-            providers,
-            db: prisma,
-            clientSupportsTasks: false,
-            // Placeholder — server.ts's resolveCtx overwrites this with the
-            // current call's real mcpReq on every dispatch.
-            mcpReq: { requestState: () => undefined },
-        });
+        mcp.setFixedContext(localOperatorContext(principal, providers, prisma));
         const stdio = runStdioServer(mcp);
         return {
             close: async () => {
@@ -159,6 +210,40 @@ export async function startMcp(options = {}) {
         secretElicitationUrl: (token) => Promise.resolve(`${httpOrigin}${SECRET_ELICITATION_PATH}?t=${encodeURIComponent(token)}`),
         secretElicitationProtocol: mcpConfig.secretElicitationProtocol,
     });
+    const eventConfig = loadGitHubEventConfig();
+    const githubConfig = loadGitHubVcsConfig();
+    const reviewHosts = providers.reviewHosts;
+    const hostEvents = eventConfig.webhookSecret && reviewHosts?.github && githubConfig.appId && githubConfig.privateKey
+        ? {
+            github: {
+                db: prisma,
+                executor: providers.executor,
+                hosts: reviewHosts,
+                repoAccess: providers.repoAccess ?? createRepoAccessGate({ db: prisma, hosts: reviewHosts }),
+                webhookSecret: eventConfig.webhookSecret,
+                appIdentity: (() => {
+                    const client = new GitHubAppClient({
+                        appId: githubConfig.appId,
+                        privateKey: githubConfig.privateKey,
+                        apiVersion: githubConfig.apiVersion,
+                    });
+                    return () => client.appIdentity();
+                })(),
+            },
+        }
+        : undefined;
+    mcpLog.info({ enabled: Boolean(hostEvents) }, "GitHub host events ingress");
+    const githubAuthorizer = providers.hostUserAuthorizers?.github;
+    const hostUserAuth = githubAuthorizer
+        ? {
+            github: {
+                db: prisma,
+                authorizer: githubAuthorizer,
+                redirectUri: `${httpOrigin}${userCallbackPath("github")}`,
+            },
+        }
+        : undefined;
+    mcpLog.info({ enabled: Boolean(hostUserAuth) }, "GitHub account linking");
     const http = await startHttpServer({
         mcp,
         config: {
@@ -170,6 +255,8 @@ export async function startMcp(options = {}) {
         },
         auth: { authProvider, db: prisma, providers },
         selfHosted,
+        hostEvents,
+        hostUserAuth,
     });
     const cleanupTimer = selfHosted
         ? setInterval(() => {
@@ -181,6 +268,9 @@ export async function startMcp(options = {}) {
             if (cleanupTimer)
                 clearInterval(cleanupTimer);
             await closeQuietly(http.close(), "HTTP transport close");
+            // Let the runs this instance is executing finish before the executor
+            // closes under them; a run abandoned here is lost, never resumed.
+            await waitForInFlightRuns(drainSeconds * 1000);
             await closeQuietly(providers.executor.close?.(), "executor close");
         },
     };

package/dist/mcp/server.js

@@ -25,9 +25,10 @@
 import { McpServer, fromJsonSchema, createRequestStateCodec, CLIENT_CAPABILITIES_META_KEY, } from "@modelcontextprotocol/server";
 import { randomBytes } from "node:crypto";
 import { requireScope } from "./auth/resource-server.js";
-import { McpError } from "./errors.js";
+import { McpError, mapPrismaError } from "./errors.js";
 import { TASKS_EXTENSION_ID, clientSupportsTasks } from "./capabilities.js";
-import { visibleToPrincipal } from "./auth/ownership.js";
+import { readableAgentsWhere } from "./auth/access.js";
+import { grantedIds } from "../core/grants.js";
 import { logger } from "../core/logger.js";
 const REQUEST_STATE_KEY_BYTES = 32;
 /**
@@ -97,6 +98,7 @@ export function buildMcpServer(opts) {
             return {
                 principal: extra.principal,
                 scopes: new Set(authInfo.scopes),
+                roles: extra.roles ?? [],
                 canonicalUri: opts.config.canonicalUri,
                 providers: opts.providers,
                 db: opts.db,
@@ -130,7 +132,14 @@ export function buildMcpServer(opts) {
             }, async (args, sdkCtx) => {
                 const ctx = resolveCtx(sdkCtx);
                 requireScope(ctx, opts.config.canonicalUri, ...requiredScopes);
-                return spec.handler(args, ctx);
+                try {
+                    return await spec.handler(args, ctx);
+                }
+                catch (err) {
+                    // A raw Prisma error would reach the client verbatim (the SDK
+                    // renders any thrown error's message) -- see mapPrismaError.
+                    throw mapPrismaError(err);
+                }
             });
         }
         // Non-spec (extension) methods need a { params, result } schema bundle
@@ -143,7 +152,12 @@ export function buildMcpServer(opts) {
             mcpServer.server.setRequestHandler(method, { params: PERMISSIVE_SCHEMA }, async (params, sdkCtx) => {
                 const ctx = resolveCtx(sdkCtx);
                 requireScope(ctx, opts.config.canonicalUri, ...scope);
-                return (await handler(params, ctx));
+                try {
+                    return (await handler(params, ctx));
+                }
+                catch (err) {
+                    throw mapPrismaError(err);
+                }
             });
         }
         // One MCP prompt per Agent this connection can see, so a client that
@@ -154,12 +168,16 @@ export function buildMcpServer(opts) {
         // resolves it per-dispatch from the SDK's own per-call ServerContext,
         // not at factory time) — stdio's fixedContext IS set by now
         // (mcp/index.ts calls setFixedContext before serveStdio ever invokes
-        // this factory), so stdio sees every agent it owns plus public ones;
-        // HTTP conservatively falls back to public-only until this factory can
-        // see request-scoped identity. A DB hiccup here must not break tool
-        // registration — this is a discoverability nicety, not core function.
+        // this factory), so stdio sees every agent it can read;
+        // HTTP conservatively falls back to agents shared with everyone (a
+        // grant of at least read) until this factory can see request-scoped
+        // identity; stdio sees what its principal can read (the operator: all).
+        // A DB hiccup here must not break tool registration — this is a
+        // discoverability nicety, not core function.
         try {
-            const where = fixedContext ? visibleToPrincipal(fixedContext.principal.id) : { ownerId: null };
+            const where = fixedContext
+                ? await readableAgentsWhere(fixedContext, opts.db)
+                : { id: { in: await grantedIds(opts.db, "agent", null, "read") } };
             const agents = await opts.db.agent.findMany({ where });
             for (const agent of agents) {
                 mcpServer.registerPrompt(agent.name, {