@wardby/cli 0.2.1 → 0.3.0

package/dist/mcp/tools/agents.js

@@ -1,11 +1,24 @@
-/** Agent CRUD with scope checks in server.ts and ownership checks here. */
+/**
+ * Agent CRUD with scope checks in server.ts and access checks here
+ * (auth/access.ts: owner, or a grant of read < execute < write). Owner-only
+ * whatever the grants: delete_agent and repository changes; make_owner is
+ * the agents:admin escape hatch. See
+ * docs/private/2026-09-26-resource-sharing-grants-spec-and-plan.md.
+ */
 import { Prisma } from "#prisma";
 import { z } from "zod";
 import { CodingProfilePatchSchema, CodingProfileSchema } from "../../coding/profile.js";
 import { codingProviderSupportsModel } from "../../coding/provider.js";
 import { validateCronExpression } from "../../core/cron.js";
-import { assertCanMutate, canRead, requireOwnedAgent, requireReadableBudgetGroup, visibleToPrincipal, } from "../auth/ownership.js";
-import { requireScope } from "../auth/resource-server.js";
+import { modelSupportedEfforts } from "../../providers/llm/routing.js";
+import { LLM_EFFORT_LEVELS, isLlmEffort } from "../../providers/llm/types.js";
+import { requireReadableBudgetGroup } from "../auth/ownership.js";
+import { agentAccessResolver, agentNotFound, assertAgentAccess, readableAgentsWhere, requireAgentAccess, } from "../auth/access.js";
+import { EVERYONE_KEY, atLeast, canDelegate, deleteGrantsFor, effectiveAccess } from "../../core/grants.js";
+import { projectTool } from "./tools.js";
+import { requireAnyScope, requireScope } from "../auth/resource-server.js";
+import { logger } from "../../core/logger.js";
+import { authorizeRepositoryForSet } from "../auth/repo-authorization.js";
 import { McpError } from "../errors.js";
 import { textResult } from "./text-result.js";
 // workerImageRef is the BYO-arbitrary-image escape hatch (see
@@ -15,6 +28,18 @@ import { textResult } from "./text-result.js";
 function requireWorkerImageRefScope(ctx) {
     requireScope(ctx, ctx.canonicalUri, "agents:admin");
 }
+// A debug trace makes the worker log prompts and repository content to its
+// pod log, so turning it on (or off) is an admin action, gated like
+// workerImageRef and audited.
+function requireDebugTraceScope(ctx) {
+    requireScope(ctx, ctx.canonicalUri, "agents:admin");
+}
+const agentsLog = logger.child({ module: "mcp-agents" });
+const MAX_DEBUG_TRACE_MINUTES = 24 * 60;
+/** Package allowlists widen what a run may download, so they need their own approval. */
+function requirePackageApproval(ctx) {
+    requireAnyScope(ctx, ctx.canonicalUri, "packages:approve", "agents:admin");
+}
 const MAX_AGENT_NAME_CHARS = 200;
 const MAX_SYSTEM_PROMPT_CHARS = 64 * 1024;
 const MAX_MODEL_CHARS = 128;
@@ -31,6 +56,7 @@ const agentFields = {
     kind: z.enum(["native", "coding"]),
     budgetGroupId: z.string().min(1).max(128),
     memoryEnabled: z.boolean(),
+    effort: z.enum(LLM_EFFORT_LEVELS),
 };
 const CreateAgentSchema = z
     .object({
@@ -45,7 +71,9 @@ const CreateAgentSchema = z
     kind: agentFields.kind.default("native"),
     budgetGroupId: agentFields.budgetGroupId.optional(),
     memoryEnabled: agentFields.memoryEnabled.default(false),
+    effort: agentFields.effort.optional(),
     codingProfile: CodingProfileSchema.optional(),
+    repositoryAdminOverride: z.boolean().optional(),
 })
     .strict()
     .superRefine((value, ctx) => {
@@ -91,21 +119,47 @@ const UpdateAgentSchema = z
     kind: agentFields.kind.optional(),
     budgetGroupId: agentFields.budgetGroupId.nullable().optional(),
     memoryEnabled: agentFields.memoryEnabled.optional(),
-    codingProfile: CodingProfilePatchSchema.optional(),
+    effort: agentFields.effort.nullable().optional(),
+    codingProfile: CodingProfilePatchSchema.extend({
+        /** Not a stored profile field: sets CodingAgentProfile.debugTraceUntil = now + minutes (null clears). */
+        debugTraceMinutes: z.number().int().min(1).max(MAX_DEBUG_TRACE_MINUTES).nullable().optional(),
+    }).optional(),
+    repositoryAdminOverride: z.boolean().optional(),
 })
     .strict();
+const REPOSITORY_ADMIN_OVERRIDE = {
+    type: "boolean",
+    description: "Admins only (agents:admin with the admin role): approve codingProfile.repository without checking GitHub access, recorded as an admin approval. On an agent the admin doesn't own, only codingProfile.repository may change.",
+};
+/** The profile columns a repository authorization is stamped into. */
+function profileStamp(authorization) {
+    return {
+        repositoryAuthorizedVia: authorization.authorizedVia,
+        repositoryAuthorizedById: authorization.authorizedById,
+        repositoryAuthorizedAt: authorization.authorizedAt,
+    };
+}
 const profileJsonSchema = {
     type: "object",
     additionalProperties: false,
     properties: {
         provider: { type: "string", enum: ["codex", "claude-code"] },
-        repository: { type: "string" },
+        repository: {
+            type: "string",
+            description: "owner/name on GitHub. Your linked GitHub account (link_host_account) must have write access to it, unless a wardby admin approves it (repositoryAdminOverride). Re-checked on every run.",
+        },
         baseRef: { type: "string" },
         defaultTask: { type: ["string", "null"] },
         allowWebhookTaskOverride: { type: "boolean" },
         timeoutSec: { type: "integer", minimum: 60, maximum: 7200 },
-        allowedEgress: { type: "array", maxItems: 64, items: { type: "string" } },
-        protectedPaths: { type: "array", minItems: 1, maxItems: 128, items: { type: "string" } },
+        protectedPaths: {
+            type: "array",
+            minItems: 1,
+            maxItems: 128,
+            items: { type: "string" },
+            description: 'Glob patterns (*, **, ?) a run may not change. A leading ! makes an exception, a literal file path without wildcards: ["docs/**", "!docs/changelog.md"] protects docs/ except the changelog. Every run also protects .wardby/** except .wardby/services.yaml, whatever this list says; exceptions cannot unprotect .wardby/.',
+        },
+        collectExclude: { type: "array", maxItems: 64, items: { type: "string" } },
         toolchain: { type: "string", enum: ["node", "node-python"] },
         toolchainVersion: { type: ["string", "null"] },
         workerImageRef: { type: ["string", "null"] },
@@ -115,6 +169,22 @@ const profileJsonSchema = {
             maximum: 32768,
             description: "Workspace disk size in MiB. Null uses the deployment default (CODING_DISK_MB), capped by the operator's CODING_MAX_DISK_MB.",
         },
+        packageAllowlist: {
+            type: "object",
+            description: "Approved top-level packages per ecosystem (npm, pypi). Needs packages:approve or agents:admin.",
+            additionalProperties: { type: "array", maxItems: 256, items: { type: "string" } },
+        },
+        packagePolicy: {
+            type: "object",
+            properties: { minReleaseAgeDays: { type: "integer", minimum: 0, maximum: 30 } },
+            additionalProperties: false,
+        },
+        services: {
+            type: "array",
+            maxItems: 16,
+            items: { type: "string" },
+            description: 'Coding-run services this agent\'s runs may start: catalog names such as "postgres" (any version the catalog has). A repository asks for them in .wardby/services.yaml on its base branch; a run asking for one not listed here is refused. Empty = none.',
+        },
     },
 };
 function invalidArguments(label, error) {
@@ -143,6 +213,24 @@ function validateSchedule(schedule, timezone) {
         throw new McpError(400, `Invalid schedule/timezone: ${error instanceof Error ? error.message : String(error)}`);
     }
 }
+/**
+ * Effort only drives the native engine, and only on a model that accepts the
+ * level; reject rather than store a setting that would silently do nothing.
+ */
+function validateEffort(kind, model, effort) {
+    if (effort == null)
+        return;
+    if (kind !== "native") {
+        throw new McpError(400, "effort is only valid for native agents; coding agents do not use it.");
+    }
+    const accepted = modelSupportedEfforts(model);
+    if (!isLlmEffort(effort) || !accepted.includes(effort)) {
+        throw new McpError(400, `Model "${model}" does not accept effort "${effort}". ` +
+            (accepted.length > 0
+                ? `Accepted levels: ${accepted.join(", ")}.`
+                : "It accepts no effort setting; leave effort unset (or null)."));
+    }
+}
 function storedProfile(profile) {
     return CodingProfileSchema.parse({
         provider: profile.provider,
@@ -151,14 +239,27 @@ function storedProfile(profile) {
         defaultTask: profile.defaultTask,
         allowWebhookTaskOverride: profile.allowWebhookTaskOverride,
         timeoutSec: profile.timeoutSec,
-        allowedEgress: profile.allowedEgress,
         protectedPaths: profile.protectedPaths,
+        collectExclude: profile.collectExclude,
         toolchain: profile.toolchain,
         toolchainVersion: profile.toolchainVersion,
         workerImageRef: profile.workerImageRef,
         workspaceDiskMb: profile.workspaceDiskMb,
+        packageAllowlist: profile.packageAllowlist,
+        packagePolicy: profile.packagePolicy,
+        services: profile.services,
     });
 }
+/** A service name an agent is allowed must exist in the catalog (any version); typos fail here, not at a run. */
+async function requireCatalogServiceNames(db, names) {
+    if (names.length === 0)
+        return;
+    const known = new Set((await db.codingService.findMany({ where: { name: { in: [...names] } }, select: { name: true } })).map((row) => row.name));
+    const unknown = names.filter((name) => !known.has(name));
+    if (unknown.length > 0) {
+        throw new McpError(400, `wardby's service catalog has no service named ${unknown.map((name) => `"${name}"`).join(", ")}; list_services shows the catalog.`);
+    }
+}
 export function registerAgentTools(mcp) {
     mcp.registerTool({
         name: "create_agent",
@@ -178,7 +279,13 @@ export function registerAgentTools(mcp) {
                 kind: { type: "string", enum: ["native", "coding"] },
                 budgetGroupId: { type: "string" },
                 memoryEnabled: { type: "boolean" },
+                effort: {
+                    type: "string",
+                    enum: [...LLM_EFFORT_LEVELS],
+                    description: "Reasoning effort for native agents. Unset uses the provider default.",
+                },
                 codingProfile: { ...profileJsonSchema, required: ["repository"] },
+                repositoryAdminOverride: REPOSITORY_ADMIN_OVERRIDE,
             },
             required: ["name", "systemPrompt", "model", "budgetUsd"],
         },
@@ -186,16 +293,39 @@ export function registerAgentTools(mcp) {
             const args = parseCreateAgent(rawArgs);
             if (args.codingProfile?.workerImageRef != null)
                 requireWorkerImageRefScope(ctx);
+            const packages = args.codingProfile;
+            if (packages &&
+                (Object.keys(packages.packageAllowlist ?? {}).length > 0 ||
+                    Object.keys(packages.packagePolicy ?? {}).length > 0))
+                requirePackageApproval(ctx);
             validateSchedule(args.schedule, args.timezone ?? "UTC");
+            validateEffort(args.kind, args.model, args.effort);
+            if (args.codingProfile)
+                await requireCatalogServiceNames(ctx.db, args.codingProfile.services);
             if (args.budgetGroupId) {
                 await requireReadableBudgetGroup(ctx.db, args.budgetGroupId, ctx.principal.id);
             }
-            const { codingProfile, ...agentData } = args;
+            const { codingProfile, repositoryAdminOverride, ...agentData } = args;
+            if (repositoryAdminOverride === true && !codingProfile) {
+                throw new McpError(400, "repositoryAdminOverride only applies with a codingProfile repository.");
+            }
+            // The creator is the owner, so it's the creator's GitHub access that counts.
+            const authorization = codingProfile
+                ? await authorizeRepositoryForSet(ctx, {
+                    ownerId: ctx.principal.id,
+                    provider: "github",
+                    repository: codingProfile.repository,
+                    kind: "coding",
+                    adminOverride: repositoryAdminOverride === true,
+                })
+                : null;
             const agent = await ctx.db.agent.create({
                 data: {
                     ...agentData,
                     ownerId: ctx.principal.id,
-                    ...(codingProfile ? { codingProfile: { create: codingProfile } } : {}),
+                    ...(codingProfile && authorization
+                        ? { codingProfile: { create: { ...codingProfile, ...profileStamp(authorization) } } }
+                        : {}),
                 },
                 include: { codingProfile: true },
             });
@@ -221,7 +351,24 @@ export function registerAgentTools(mcp) {
                 kind: { type: "string", enum: ["native", "coding"] },
                 budgetGroupId: { type: ["string", "null"] },
                 memoryEnabled: { type: "boolean" },
-                codingProfile: profileJsonSchema,
+                effort: {
+                    type: ["string", "null"],
+                    enum: [...LLM_EFFORT_LEVELS, null],
+                    description: "Reasoning effort for native agents. Null clears it back to the provider default.",
+                },
+                codingProfile: {
+                    ...profileJsonSchema,
+                    properties: {
+                        ...profileJsonSchema.properties,
+                        debugTraceMinutes: {
+                            type: ["integer", "null"],
+                            minimum: 1,
+                            maximum: MAX_DEBUG_TRACE_MINUTES,
+                            description: "Admins only (agents:admin): trace every coding run of this agent for this many minutes from now; the worker writes its full stream trace, which can include prompts and repository content, to the run pod's log. Null turns it off.",
+                        },
+                    },
+                },
+                repositoryAdminOverride: REPOSITORY_ADMIN_OVERRIDE,
             },
             required: ["id"],
         },
@@ -229,18 +376,105 @@ export function registerAgentTools(mcp) {
             const args = parseUpdateAgent(rawArgs);
             if (args.codingProfile?.workerImageRef !== undefined)
                 requireWorkerImageRefScope(ctx);
+            const debugTraceMinutes = args.codingProfile?.debugTraceMinutes;
+            if (debugTraceMinutes !== undefined)
+                requireDebugTraceScope(ctx);
+            if (args.codingProfile?.packageAllowlist !== undefined || args.codingProfile?.packagePolicy !== undefined)
+                requirePackageApproval(ctx);
+            // Repository authorization calls GitHub, so it runs before (outside) the
+            // serializable transaction, on a pre-read; the transaction then verifies
+            // the pre-read still holds. Only a changed repository (or becoming a
+            // coding agent) is re-authorized; other edits keep the existing stamp.
+            const before = await ctx.db.agent.findUnique({ where: { id: args.id }, include: { codingProfile: true } });
+            if (!before)
+                throw agentNotFound(args.id);
+            // Strict: a repository is a binding, so only the agent's owner sets
+            // one (or an admin's explicit approval, below). Not a write-grantee,
+            // not the stdio operator.
+            const isOwner = before.ownerId !== null && before.ownerId === ctx.principal.id;
+            // An admin may approve a repository (repositoryAdminOverride) on an agent
+            // they don't own, but change nothing else on it.
+            const adminEdit = args.repositoryAdminOverride === true && !isOwner;
+            if (adminEdit) {
+                requireScope(ctx, ctx.canonicalUri, "agents:admin");
+                const { id: _id, repositoryAdminOverride: _flag, codingProfile, ...others } = args;
+                const profileKeys = Object.keys(codingProfile ?? {});
+                if (Object.values(others).some((v) => v !== undefined) ||
+                    profileKeys.length !== 1 ||
+                    profileKeys[0] !== "repository") {
+                    throw new McpError(403, "On an agent you don't own, an admin may change only codingProfile.repository (with repositoryAdminOverride).");
+                }
+            }
+            else {
+                await assertAgentAccess(ctx, before, args.id, "write");
+            }
+            const repositoryAfter = (kind, profile) => kind === "coding" ? (args.codingProfile?.repository ?? profile?.repository ?? null) : null;
+            const plannedRepository = repositoryAfter(args.kind ?? before.kind, before.codingProfile);
+            const repositoryChanges = (existing) => {
+                const next = repositoryAfter(args.kind ?? existing.kind, existing.codingProfile);
+                return next !== null && (existing.kind !== "coding" || existing.codingProfile?.repository !== next);
+            };
+            const refuseRepositoryBinding = () => {
+                throw new McpError(403, `Agent "${args.id}": only its owner can give it a repository (codingProfile.repository, or becoming a coding agent); a repository is a binding, not shared config.`);
+            };
+            if (!adminEdit && !isOwner && repositoryChanges(before))
+                refuseRepositoryBinding();
+            // The coding profile as a whole (task, base ref, protected paths,
+            // task-override opt-in, image, packages, limits...), leaving coding,
+            // and budget-group membership direct what runs do with the owner's
+            // repository access and money: owner-only, like the repository itself
+            // (review I1/M1/M6). Write keeps name, prompt, model, budget amount,
+            // turns, effort, memory and schedule.
+            const ownerOnlyChange = (existingKind) => args.codingProfile !== undefined ||
+                (args.kind !== undefined && args.kind !== existingKind) ||
+                args.budgetGroupId !== undefined;
+            const refuseOwnerOnly = () => {
+                throw new McpError(403, `Agent "${args.id}": only its owner can change its coding profile, kind or budget group.`);
+            };
+            if (!adminEdit && !isOwner && ownerOnlyChange(before.kind))
+                refuseOwnerOnly();
+            const authorization = plannedRepository !== null && repositoryChanges(before)
+                ? await authorizeRepositoryForSet(ctx, {
+                    ownerId: before.ownerId,
+                    provider: "github",
+                    repository: plannedRepository,
+                    kind: "coding",
+                    adminOverride: args.repositoryAdminOverride === true,
+                })
+                : null;
+            if (args.repositoryAdminOverride === true && !authorization) {
+                throw new McpError(400, "repositoryAdminOverride only applies when the coding repository changes.");
+            }
+            const debugTraceUntil = debugTraceMinutes === undefined
+                ? undefined
+                : debugTraceMinutes === null
+                    ? null
+                    : new Date(Date.now() + debugTraceMinutes * 60_000);
             const agent = await ctx.db.$transaction(async (tx) => {
                 const existing = await tx.agent.findUnique({ where: { id: args.id }, include: { codingProfile: true } });
                 if (!existing)
-                    throw new McpError(404, `Agent "${args.id}" not found.`);
-                assertCanMutate(existing.ownerId, ctx.principal.id, `Agent "${args.id}" is not owned by the caller.`);
+                    throw agentNotFound(args.id);
+                if (!adminEdit) {
+                    await assertAgentAccess(ctx, existing, args.id, "write", tx);
+                    if (!isOwner && repositoryChanges(existing))
+                        refuseRepositoryBinding();
+                    if (!isOwner && ownerOnlyChange(existing.kind))
+                        refuseOwnerOnly();
+                }
+                if (existing.ownerId !== before.ownerId ||
+                    (repositoryChanges(existing) &&
+                        (!authorization ||
+                            repositoryAfter(args.kind ?? existing.kind, existing.codingProfile) !== plannedRepository))) {
+                    throw new McpError(409, `Agent "${args.id}" changed while it was being updated; try again.`);
+                }
                 if (args.budgetGroupId) {
-                    await requireReadableBudgetGroup(ctx.db, args.budgetGroupId, ctx.principal.id);
+                    await requireReadableBudgetGroup(tx, args.budgetGroupId, ctx.principal.id);
                 }
                 const nextKind = args.kind ?? existing.kind;
                 if (nextKind === "native" && args.codingProfile) {
                     throw new McpError(400, "A coding profile is only valid for coding agents.");
                 }
+                validateEffort(nextKind, args.model ?? existing.model, args.effort !== undefined ? args.effort : existing.effort);
                 let nextProfile = null;
                 if (nextKind === "coding") {
                     const attachedTools = await tx.agentTool.count({ where: { agentId: args.id } });
@@ -248,10 +482,13 @@ export function registerAgentTools(mcp) {
                         throw new McpError(400, "Detach all native sandbox tools before changing an agent to coding.");
                     }
                     const currentProfile = existing.codingProfile ? storedProfile(existing.codingProfile) : undefined;
-                    const profileResult = CodingProfileSchema.safeParse({ ...currentProfile, ...args.codingProfile });
+                    const { debugTraceMinutes: _minutes, ...profilePatch } = args.codingProfile ?? {};
+                    const profileResult = CodingProfileSchema.safeParse({ ...currentProfile, ...profilePatch });
                     if (!profileResult.success)
                         throw invalidArguments("coding profile", profileResult.error);
                     nextProfile = profileResult.data;
+                    if (args.codingProfile?.services !== undefined)
+                        await requireCatalogServiceNames(tx, nextProfile.services);
                     const nextModel = args.model ?? existing.model;
                     if (!codingProviderSupportsModel(nextProfile.provider, nextModel)) {
                         throw new McpError(400, `Model "${nextModel}" is not supported by coding provider "${nextProfile.provider}".`);
@@ -264,14 +501,16 @@ export function registerAgentTools(mcp) {
                 if (nextKind === "coding" && nextSchedule && nextScheduleEnabled && !nextProfile?.defaultTask) {
                     throw new McpError(400, "A default task is required for an enabled coding-agent schedule.");
                 }
-                const { id, codingProfile: _profilePatch, ...updates } = args;
+                const { id, codingProfile: _profilePatch, repositoryAdminOverride: _override, ...updates } = args;
+                const stamp = authorization ? profileStamp(authorization) : {};
+                const trace = debugTraceUntil === undefined ? {} : { debugTraceUntil };
                 const profileMutation = nextKind === "native"
                     ? existing.codingProfile
                         ? { delete: true }
                         : undefined
                     : existing.codingProfile
-                        ? { update: nextProfile }
-                        : { create: nextProfile };
+                        ? { update: { ...nextProfile, ...stamp, ...trace } }
+                        : { create: { ...nextProfile, ...stamp, ...trace } };
                 return tx.agent.update({
                     where: { id },
                     data: {
@@ -281,6 +520,14 @@ export function registerAgentTools(mcp) {
                     include: { codingProfile: true },
                 });
             }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });
+            if (debugTraceUntil !== undefined) {
+                agentsLog.info({
+                    event: "coding.debug_trace.set",
+                    agentId: agent.id,
+                    until: debugTraceUntil?.toISOString() ?? null,
+                    by: ctx.principal.id,
+                }, "coding debug trace set");
+            }
             return textResult(agent);
         },
     });
@@ -289,11 +536,9 @@ export function registerAgentTools(mcp) {
         scope: "agents:read",
         inputSchema: { type: "object", properties: {}, additionalProperties: false },
         handler: async (_args, ctx) => {
-            const agents = await ctx.db.agent.findMany({
-                where: visibleToPrincipal(ctx.principal.id),
-                include: { codingProfile: true },
-            });
-            return textResult(agents);
+            const [where, accessOf] = await Promise.all([readableAgentsWhere(ctx), agentAccessResolver(ctx)]);
+            const agents = await ctx.db.agent.findMany({ where, include: { codingProfile: true } });
+            return textResult(agents.map((agent) => ({ ...agent, access: accessOf(agent) })));
         },
     });
     mcp.registerTool({
@@ -306,14 +551,20 @@ export function registerAgentTools(mcp) {
             additionalProperties: false,
         },
         handler: async (args, ctx) => {
-            const agent = await ctx.db.agent.findUnique({
+            const { agent, access } = await assertAgentAccess(ctx, await ctx.db.agent.findUnique({
                 where: { id: args.id },
-                include: { tools: { include: { tool: true } }, codingProfile: true },
+                include: { tools: { include: { tool: true } }, codingProfile: true, repositories: true },
+            }), args.id, "read");
+            // A7: a tool's code and schema are its owner's, whoever can read the
+            // agent (the agent's owner included). Capabilities stay visible: config.
+            return textResult({
+                ...agent,
+                access,
+                tools: agent.tools.map((attachment) => ({
+                    ...attachment,
+                    tool: projectTool(attachment.tool, ctx.principal.id),
+                })),
             });
-            if (!agent || !canRead(agent.ownerId, ctx.principal.id)) {
-                throw new McpError(404, `Agent "${args.id}" not found.`);
-            }
-            return textResult(agent);
         },
     });
     mcp.registerTool({
@@ -326,9 +577,13 @@ export function registerAgentTools(mcp) {
             additionalProperties: false,
         },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.id, ctx.principal.id);
+            await requireAgentAccess(ctx, args.id, "owner");
             try {
-                await ctx.db.agent.delete({ where: { id: args.id } });
+                // Grants have no FK to the resource: removed in the same transaction.
+                await ctx.db.$transaction(async (tx) => {
+                    await deleteGrantsFor(tx, "agent", args.id);
+                    await tx.agent.delete({ where: { id: args.id } });
+                });
             }
             catch (err) {
                 // Run.agentId has no onDelete rule, so Postgres refuses to delete an
@@ -343,33 +598,176 @@ export function registerAgentTools(mcp) {
             return textResult({ deleted: args.id });
         },
     });
-    // Deliberately bypasses ownership entirely (no assertCanMutate/
-    // requireOwnedAgent call) — that's the point of this tool vs. the
-    // self-service null-owner-is-public-mutable rule everything else here
-    // follows. Gated on agents:admin, a step up from agents:write, so an
-    // ordinary caller can never reach it regardless of what they own.
-    // ownerId: null releases the agent back to public, same as any agent
-    // that was never assigned an owner.
+    // Deliberately bypasses access checks entirely: that's the point of this
+    // tool, the audited agents:admin escape hatch. Gated on agents:admin, a
+    // step up from agents:write, so an ordinary caller can never reach it
+    // regardless of what they own. The new owner must exist; releasing an
+    // agent to owner-less is gone (sharing is done with grants). Everything
+    // bound to the agent belongs to its owner, so a transfer drops what the
+    // new owner doesn't own (resource-sharing grants spec §3.6, R2-1).
     mcp.registerTool({
         name: "make_owner",
         scope: "agents:admin",
+        description: "Admins: gives an agent a new owner (an existing principal id). Secret and datastore bindings the new owner doesn't own are removed; tool capabilities the new owner never granted are suspended until they re-run attach_tool; sub-agent edges the new owner can't delegate are removed; between two owners every grant on the agent is reset (adopting an owner-less agent keeps them). Returns what changed.",
         inputSchema: {
             type: "object",
             additionalProperties: false,
-            properties: { agentId: { type: "string" }, ownerId: { type: ["string", "null"] } },
+            properties: {
+                agentId: { type: "string" },
+                ownerId: { type: ["string", "null"] },
+                keepEveryoneExecute: {
+                    type: "boolean",
+                    description: "When adopting an owner-less agent: keep an everyone grant at execute instead of lowering it to read. Anyone could then run it with the new owner's secrets and capabilities.",
+                },
+            },
             required: ["agentId", "ownerId"],
         },
         handler: async (args, ctx) => {
-            const agent = await ctx.db.agent.findUnique({ where: { id: args.agentId } });
-            if (!agent)
-                throw new McpError(404, `Agent "${args.agentId}" not found.`);
-            if (args.ownerId !== null) {
-                const principal = await ctx.db.principal.findUnique({ where: { id: args.ownerId } });
-                if (!principal)
-                    throw new McpError(400, `Principal "${args.ownerId}" not found.`);
+            if (args.ownerId === null) {
+                throw new McpError(400, "make_owner no longer releases an agent to owner-less; share it with grant_access instead (everyone at execute, or named principals).");
             }
-            const updated = await ctx.db.agent.update({ where: { id: args.agentId }, data: { ownerId: args.ownerId } });
-            return textResult(updated);
+            const newOwner = args.ownerId;
+            const principal = await ctx.db.principal.findUnique({ where: { id: newOwner } });
+            if (!principal)
+                throw new McpError(400, `Principal "${newOwner}" not found.`);
+            const result = await ctx.db.$transaction(async (tx) => {
+                const agent = await tx.agent.findUnique({ where: { id: args.agentId }, include: { codingProfile: true } });
+                if (!agent)
+                    throw agentNotFound(args.agentId);
+                // Admin and grandfathered repository approvals were granted to the
+                // agent under its current owner. Moving it away from that owner
+                // turns them into ordinary checks of the next owner's own GitHub
+                // access, so an approval never travels with the agent. An
+                // owner-less agent getting its first owner keeps them: that is the
+                // pre-upgrade step for owner-less agents with repositories.
+                const revoked = [];
+                const transfer = agent.ownerId !== null && agent.ownerId !== newOwner;
+                if (transfer) {
+                    const approved = { in: ["admin", "grandfathered"] };
+                    const reset = { authorizedVia: "host_permission", authorizedById: null, authorizedAt: new Date() };
+                    const links = await tx.agentRepository.findMany({
+                        where: { agentId: agent.id, authorizedVia: approved },
+                        orderBy: { repository: "asc" },
+                    });
+                    await tx.agentRepository.updateMany({ where: { agentId: agent.id, authorizedVia: approved }, data: reset });
+                    revoked.push(...links.map((l) => l.repository));
+                    const profile = await tx.codingAgentProfile.updateMany({
+                        where: { agentId: agent.id, repositoryAuthorizedVia: approved },
+                        data: {
+                            repositoryAuthorizedVia: reset.authorizedVia,
+                            repositoryAuthorizedById: null,
+                            repositoryAuthorizedAt: reset.authorizedAt,
+                        },
+                    });
+                    if (profile.count > 0 && agent.codingProfile)
+                        revoked.push(agent.codingProfile.repository);
+                }
+                // Grants: between two owners every grant is reset (the new owner
+                // decides who shares it); adopting an owner-less agent keeps them,
+                // but lowers an everyone grant to read unless keepEveryoneExecute:
+                // the agent may regain the new owner's secrets and capabilities
+                // (review I3).
+                const grantsReset = transfer ? await deleteGrantsFor(tx, "agent", agent.id) : 0;
+                let everyoneGrant = null;
+                if (agent.ownerId === null) {
+                    const everyone = await tx.resourceGrant.findFirst({
+                        where: { resourceType: "agent", resourceId: agent.id, granteeKey: EVERYONE_KEY },
+                    });
+                    if (everyone) {
+                        everyoneGrant = { before: everyone.level, after: everyone.level };
+                        if (everyone.level !== "read" && args.keepEveryoneExecute !== true) {
+                            await tx.resourceGrant.update({
+                                where: { id: everyone.id },
+                                data: { level: "read", source: "operator", grantedById: ctx.principal.id },
+                            });
+                            everyoneGrant.after = "read";
+                        }
+                    }
+                }
+                const updated = await tx.agent.update({ where: { id: args.agentId }, data: { ownerId: newOwner } });
+                // Secret/datastore bindings the new owner doesn't own: removed.
+                const secrets = await tx.agentSecret.findMany({
+                    where: { agentId: agent.id },
+                    include: { secret: { select: { ownerId: true } } },
+                });
+                const foreignSecrets = secrets.filter((b) => b.secret.ownerId !== newOwner);
+                if (foreignSecrets.length > 0) {
+                    await tx.agentSecret.deleteMany({
+                        where: { agentId: agent.id, secretId: { in: foreignSecrets.map((b) => b.secretId) } },
+                    });
+                }
+                const datastores = await tx.agentDatastore.findMany({
+                    where: { agentId: agent.id },
+                    include: { datastore: { select: { ownerId: true } } },
+                });
+                const foreignDatastores = datastores.filter((b) => b.datastore.ownerId !== newOwner);
+                if (foreignDatastores.length > 0) {
+                    await tx.agentDatastore.deleteMany({
+                        where: { agentId: agent.id, datastoreId: { in: foreignDatastores.map((b) => b.datastoreId) } },
+                    });
+                }
+                const bindingsRemoved = [
+                    ...foreignSecrets.map((b) => ({ kind: "secret", boundName: b.boundName, resourceId: b.secretId })),
+                    ...foreignDatastores.map((b) => ({ kind: "datastore", boundName: b.boundName, resourceId: b.datastoreId })),
+                ];
+                // Tool capabilities: rows aren't rewritten; the runner ignores any
+                // the new owner never stamped (capabilitiesGrantedById).
+                const attachments = await tx.agentTool.findMany({
+                    where: { agentId: agent.id },
+                    include: { tool: { select: { id: true, name: true } } },
+                });
+                const toolCapabilitiesSuspended = attachments
+                    .filter((at) => at.capabilitiesGrantedById !== newOwner)
+                    .map((at) => ({ toolId: at.tool.id, toolName: at.tool.name }));
+                // Sub-agent edges (both directions) the new owner can't delegate.
+                const edges = await tx.agentSubAgent.findMany({
+                    where: { OR: [{ parentAgentId: agent.id }, { childAgentId: agent.id }] },
+                    include: {
+                        parent: { select: { id: true, ownerId: true } },
+                        child: { select: { id: true, ownerId: true } },
+                    },
+                });
+                const subAgentEdgesRemoved = [];
+                for (const edge of edges) {
+                    const parent = edge.parentAgentId === agent.id ? { ownerId: newOwner } : edge.parent;
+                    const child = edge.childAgentId === agent.id ? { id: agent.id, ownerId: newOwner } : edge.child;
+                    if (!(await canDelegate(tx, parent, child))) {
+                        subAgentEdgesRemoved.push({
+                            parentAgentId: edge.parentAgentId,
+                            childAgentId: edge.childAgentId,
+                            boundName: edge.boundName,
+                        });
+                    }
+                }
+                for (const edge of subAgentEdgesRemoved) {
+                    await tx.agentSubAgent.deleteMany({
+                        where: { parentAgentId: edge.parentAgentId, childAgentId: edge.childAgentId },
+                    });
+                }
+                // Webhooks others created stay, but fire only while their creator
+                // may still trigger the agent (core/webhooks.ts).
+                const webhooks = await tx.webhook.findMany({ where: { agentId: agent.id } });
+                const webhooksInactive = [];
+                for (const webhook of webhooks) {
+                    if (webhook.ownerId === newOwner)
+                        continue;
+                    const creatorAccess = await effectiveAccess(tx, "agent", updated, webhook.ownerId);
+                    if (!atLeast("agent", creatorAccess, "execute")) {
+                        webhooksInactive.push({ id: webhook.id, createdBy: webhook.ownerId });
+                    }
+                }
+                return {
+                    ...updated,
+                    repositoryApprovalsRevoked: revoked,
+                    bindingsRemoved,
+                    toolCapabilitiesSuspended,
+                    subAgentEdgesRemoved,
+                    grantsReset,
+                    everyoneGrant,
+                    webhooksInactive,
+                };
+            }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });
+            return textResult(result);
         },
     });
 }