@wardby/cli 0.2.1 → 0.3.0

package/dist/mcp/tools/subagents.js

@@ -1,13 +1,20 @@
 /**
- * AgentSubAgent CRUD — agent-composition edges. Attach/detach require
- * ownership of both the parent and child agent (same convention as
- * attach_tool requiring ownership of both the agent and the tool), and
- * attach rejects any edge that would create a cycle in the parent/child
- * graph (§7 of the design doc) — cycles are not something Postgres can
- * enforce natively.
+ * AgentSubAgent CRUD — agent-composition edges. An edge runs the child
+ * (with its owner's bindings) whenever the parent delegates, and hands the
+ * child whatever the parent's runs pass it, so it is a binding of the
+ * parent: only the parent's owner attaches or detaches one (review I2; a
+ * write-grantee could otherwise route every run's data to their own agent).
+ * Across owners it also needs an explicit grant (resource-sharing grants
+ * spec §3.4.4, N1): the caller needs execute on the child, and the parent's
+ * owner must be the child's owner or hold execute on it (canDelegate,
+ * re-checked on every delegation at run time). The child's owner can
+ * always cut an edge. Attach also rejects any edge that would
+ * create a cycle in the parent/child graph (§7 of the design doc) — cycles
+ * are not something Postgres can enforce natively.
  */
 import { Prisma } from "#prisma";
-import { requireOwnedAgent } from "../auth/ownership.js";
+import { atLeast, canDelegate } from "../../core/grants.js";
+import { agentAccess, agentAccessResolver, agentNotFound, requireAgentAccess, requireBindingOwner, } from "../auth/access.js";
 import { McpError } from "../errors.js";
 import { textResult } from "./text-result.js";
 /**
@@ -60,8 +67,16 @@ export function registerSubAgentTools(mcp) {
             if (args.parentAgentId === args.childAgentId) {
                 throw new McpError(400, "An agent cannot be its own sub-agent.");
             }
-            const parent = await requireOwnedAgent(ctx.db, args.parentAgentId, ctx.principal.id);
-            const child = await requireOwnedAgent(ctx.db, args.childAgentId, ctx.principal.id);
+            const { agent: parent } = await requireAgentAccess(ctx, args.parentAgentId, "read");
+            requireBindingOwner(ctx, parent);
+            // The caller could trigger the child anyway; the edge must not widen that.
+            const { agent: child } = await requireAgentAccess(ctx, args.childAgentId, "execute");
+            if (parent.ownerId === null) {
+                throw new McpError(403, `Agent "${parent.id}" has no owner, so it can't take sub-agents; an admin can assign one with make_owner.`);
+            }
+            if (!(await canDelegate(ctx.db, parent, child))) {
+                throw new McpError(403, `"${child.name}" belongs to another owner, who has not given the owner of "${parent.name}" execute access to it.`);
+            }
             if (await canReach(ctx.db, args.childAgentId, args.parentAgentId)) {
                 throw new McpError(400, `Attaching "${child.name}" as a sub-agent of "${parent.name}" would create a cycle.`);
             }
@@ -95,8 +110,20 @@ export function registerSubAgentTools(mcp) {
             required: ["parentAgentId", "childAgentId"],
         },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.parentAgentId, ctx.principal.id);
-            await requireOwnedAgent(ctx.db, args.childAgentId, ctx.principal.id);
+            // The parent's owner (or the stdio operator), or the child's owner: a
+            // child's owner can always take its agent back out of someone else's
+            // composition.
+            const [parent, child] = await Promise.all([
+                ctx.db.agent.findUnique({ where: { id: args.parentAgentId } }),
+                ctx.db.agent.findUnique({ where: { id: args.childAgentId } }),
+            ]);
+            const parentAccess = parent ? await agentAccess(ctx, parent) : "none";
+            const childAccess = child ? await agentAccess(ctx, child) : "none";
+            if (parentAccess !== "owner" && childAccess !== "owner") {
+                if (!atLeast("agent", parentAccess, "read"))
+                    throw agentNotFound(args.parentAgentId);
+                throw new McpError(403, `Detaching needs ownership of "${args.parentAgentId}" or of "${args.childAgentId}".`);
+            }
             await ctx.db.agentSubAgent.deleteMany({
                 where: { parentAgentId: args.parentAgentId, childAgentId: args.childAgentId },
             });
@@ -113,20 +140,29 @@ export function registerSubAgentTools(mcp) {
             required: ["agentId"],
         },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            await requireAgentAccess(ctx, args.agentId, "read");
+            const accessOf = await agentAccessResolver(ctx);
             const [asParent, asChild] = await Promise.all([
                 ctx.db.agentSubAgent.findMany({
                     where: { parentAgentId: args.agentId },
-                    include: { child: { select: { id: true, name: true } } },
+                    include: { child: { select: { id: true, name: true, ownerId: true } } },
                 }),
                 ctx.db.agentSubAgent.findMany({
                     where: { childAgentId: args.agentId },
-                    include: { parent: { select: { id: true, name: true } } },
+                    include: { parent: { select: { id: true, name: true, ownerId: true } } },
                 }),
             ]);
+            // Only agents the caller can read are named; the rest are counted.
+            const readable = (agent) => atLeast("agent", accessOf(agent), "read");
+            const children = asParent.filter((e) => readable(e.child));
+            const parents = asChild.filter((e) => readable(e.parent));
+            const hiddenChildren = asParent.length - children.length;
+            const hiddenParents = asChild.length - parents.length;
             return textResult({
-                children: asParent.map((e) => ({ boundName: e.boundName, agentId: e.child.id, agentName: e.child.name })),
-                parents: asChild.map((e) => ({ boundName: e.boundName, agentId: e.parent.id, agentName: e.parent.name })),
+                children: children.map((e) => ({ boundName: e.boundName, agentId: e.child.id, agentName: e.child.name })),
+                parents: parents.map((e) => ({ boundName: e.boundName, agentId: e.parent.id, agentName: e.parent.name })),
+                ...(hiddenChildren > 0 ? { hiddenChildren } : {}),
+                ...(hiddenParents > 0 ? { hiddenParents } : {}),
             });
         },
     });

package/dist/mcp/tools/tools.d.ts

@@ -1,2 +1,43 @@
+/**
+ * Tool authoring — raw path only (Amendment A: the guided Elicitation/Tasks
+ * flow is deferred; this ships create_tool + dry_run_tool as the
+ * test-before-commit loop instead). A compile/validation failure is a
+ * NORMAL tool result carrying `{ok:false, errorKind, errorMessage}` — not
+ * an isError — since the call itself succeeded (compilation was attempted
+ * and correctly reported a problem the caller can fix and retry), matching
+ * runInSandbox's own SandboxResult convention. Ownership/scope failures
+ * (attach/detach on an agent or tool you don't own) DO throw, same
+ * convention as every other tool in this codebase.
+ */
+import { type Tool } from "#prisma";
 import type { WardbyMcpServer } from "../server.js";
+/**
+ * A tool row as a caller who doesn't own it may see it: name and
+ * description, never code or paramsZod (A7). `public` tells an owner-less
+ * tool apart from the caller's own same-named one (names are unique per
+ * owner, not globally). Shared by list_tools and get_agent.
+ */
+export declare function projectTool(tool: Tool, principalId: string): {
+    name: string;
+    code: string;
+    id: string;
+    ownerId: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+    description: string;
+    paramsZod: string;
+    jsonSchema: import("@prisma/client/runtime/client").JsonValue;
+} | {
+    id: string;
+    name: string;
+    description: string;
+    public: boolean;
+    ownerIsCaller?: undefined;
+} | {
+    id: string;
+    name: string;
+    description: string;
+    public: boolean;
+    ownerIsCaller: boolean;
+};
 export declare function registerToolAuthoringTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/tools.js

@@ -14,10 +14,46 @@ import { deriveJsonSchema, validateParams } from "../../sandbox/zod-params.js";
 import { runInSandbox } from "../../sandbox/run-in-sandbox.js";
 import { ToolCapabilitiesPatchSchema } from "../../sandbox/tool-capabilities.js";
 import { buildSharedDatastoreAccessor } from "../../core/datastores.js";
-import { MEMORY_TOOL_NAMES } from "../../core/memory-tools.js";
+import { findSameNamedAttachedTool, reservedToolNameReason } from "../../core/tool-names.js";
+import { ToolAttachedError, deleteToolGuarded, hasToolChanges, prepareToolUpdate, updateToolGuarded, } from "../../core/tool-admin.js";
 import { McpError } from "../errors.js";
-import { assertCanMutate, requireOwnedAgent, requireOwnedTool, requireReadableAgent, visibleToPrincipal, canRead, } from "../auth/ownership.js";
+import { requireOwnedTool, requireStrictlyOwnedTool, assertStrictlyOwnedTool, visibleToPrincipal, canRead, } from "../auth/ownership.js";
+import { agentAccessResolver, assertAgentAccess, requireAgentAccess } from "../auth/access.js";
+import { atLeast } from "../../core/grants.js";
 import { textResult } from "./text-result.js";
+/**
+ * Names the agents the caller can read (its own and ones granted to it)
+ * and only counts the rest, so a refusal never reveals another principal's
+ * agent names or ids.
+ */
+async function describeAgents(agents, ctx) {
+    const accessOf = await agentAccessResolver(ctx);
+    const readable = agents.filter((agent) => atLeast("agent", accessOf(agent), "read"));
+    const hidden = agents.length - readable.length;
+    const parts = readable.map((agent) => `"${agent.name}" (${agent.id})`);
+    if (hidden > 0)
+        parts.push(`${hidden} agent(s) owned by other principals`);
+    return parts.join(", ");
+}
+/**
+ * A tool row as a caller who doesn't own it may see it: name and
+ * description, never code or paramsZod (A7). `public` tells an owner-less
+ * tool apart from the caller's own same-named one (names are unique per
+ * owner, not globally). Shared by list_tools and get_agent.
+ */
+export function projectTool(tool, principalId) {
+    if (tool.ownerId !== null && tool.ownerId === principalId)
+        return tool;
+    return tool.ownerId === null
+        ? { id: tool.id, name: tool.name, description: tool.description, public: true }
+        : { id: tool.id, name: tool.name, description: tool.description, public: false, ownerIsCaller: false };
+}
+/** Refuses a name one of the runner's built-ins would shadow (see core/tool-names.ts). */
+function assertToolNameAllowed(name) {
+    const reason = reservedToolNameReason(name);
+    if (reason)
+        throw new McpError(400, reason);
+}
 export function registerToolAuthoringTools(mcp) {
     mcp.registerTool({
         name: "create_tool",
@@ -33,24 +69,108 @@ export function registerToolAuthoringTools(mcp) {
             required: ["name", "description", "paramsZod", "code"],
         },
         handler: async (args, ctx) => {
-            if (MEMORY_TOOL_NAMES.has(args.name)) {
-                throw new McpError(400, `Tool name "${args.name}" is reserved for the built-in agent-memory tools.`);
-            }
+            assertToolNameAllowed(args.name);
             const schemaResult = await deriveJsonSchema(args.paramsZod);
             if (!schemaResult.ok) {
                 return textResult({ ok: false, errorKind: schemaResult.errorKind, errorMessage: schemaResult.errorMessage });
             }
-            const tool = await ctx.db.tool.create({
-                data: {
-                    name: args.name,
-                    description: args.description,
-                    paramsZod: args.paramsZod,
-                    code: args.code,
-                    jsonSchema: schemaResult.value,
-                    ownerId: ctx.principal.id,
-                },
-            });
-            return textResult(tool);
+            try {
+                const tool = await ctx.db.tool.create({
+                    data: {
+                        name: args.name,
+                        description: args.description,
+                        paramsZod: args.paramsZod,
+                        code: args.code,
+                        jsonSchema: schemaResult.value,
+                        ownerId: ctx.principal.id,
+                    },
+                });
+                return textResult(tool);
+            }
+            catch (err) {
+                if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === "P2002") {
+                    throw new McpError(409, `A tool named "${args.name}" already exists for your principal.`);
+                }
+                throw err;
+            }
+        },
+    });
+    mcp.registerTool({
+        name: "update_tool",
+        scope: "tools:write",
+        description: "Replaces a tool's description, paramsZod and/or code in place (its name can't change: agents' prompts call it by name). Owner-only: public tools can't be changed over MCP. Refused while the tool is attached to any agent you don't own, including owner-less ones and agents shared with you, since the change would reach another owner's agent; detach it there first or create a new tool. Runs already started keep the version they loaded for their whole lifetime; the next run picks up the new one.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                toolId: { type: "string" },
+                description: { type: "string" },
+                paramsZod: { type: "string" },
+                code: { type: "string" },
+            },
+            required: ["toolId"],
+        },
+        handler: async (args, ctx) => {
+            const changes = { description: args.description, paramsZod: args.paramsZod, code: args.code };
+            if (!hasToolChanges(changes)) {
+                throw new McpError(400, "update_tool needs at least one of description, paramsZod or code.");
+            }
+            // Checked once up front so a non-owner never gets as far as a sandbox
+            // compile, and again (with the attachments) inside the transaction.
+            await requireStrictlyOwnedTool(ctx.db, args.toolId, ctx.principal.id);
+            const prepared = await prepareToolUpdate(changes);
+            if (!prepared.ok) {
+                return textResult({ ok: false, errorKind: prepared.errorKind, errorMessage: prepared.errorMessage });
+            }
+            // Any attachment to an agent the caller doesn't own (an owner-less one
+            // included) blocks every field; see core/tool-admin.ts for why, and
+            // for the Serializable transaction that keeps a concurrent attach from
+            // landing between the check and the write.
+            try {
+                const tool = await updateToolGuarded(ctx.db, args.toolId, prepared.data, (row) => assertStrictlyOwnedTool(row, args.toolId, ctx.principal.id));
+                return textResult(tool);
+            }
+            catch (err) {
+                if (err instanceof ToolAttachedError) {
+                    throw new McpError(409, `Tool "${args.toolId}" is attached to agents you don't own: ${await describeAgents(err.agents, ctx)}. Detach it from those agents first (or ask their owners to), or create a new tool instead.`);
+                }
+                throw err;
+            }
+        },
+    });
+    mcp.registerTool({
+        name: "delete_tool",
+        scope: "tools:write",
+        description: "Deletes a tool you own. Refused while it is attached to any agent; pass detach: true to detach it from your own agents first. It is never detached from an agent you don't own -- use detach_tool where you hold write on the agent, or ask its owner. Past runs are unaffected, and a run already under way keeps the version it loaded.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: { toolId: { type: "string" }, detach: { type: "boolean" } },
+            required: ["toolId"],
+        },
+        handler: async (args, ctx) => {
+            try {
+                const detachedFrom = await deleteToolGuarded(ctx.db, args.toolId, {
+                    detach: args.detach === true,
+                    authorize: (row) => assertStrictlyOwnedTool(row, args.toolId, ctx.principal.id),
+                });
+                return textResult({ deleted: args.toolId, detachedFrom });
+            }
+            catch (err) {
+                if (!(err instanceof ToolAttachedError))
+                    throw err;
+                const agents = await describeAgents(err.agents, ctx);
+                switch (err.reason) {
+                    // Public agents are included: pulling a tool from a shared agent
+                    // should be an explicit detach_tool.
+                    case "other_owners":
+                        throw new McpError(409, `Tool "${args.toolId}" is still attached to ${agents}. Only your own agents can be detached here; use detach_tool where you hold write on the agent, or ask the other owners to.`);
+                    case "needs_detach":
+                        throw new McpError(409, `Tool "${args.toolId}" is still attached to ${agents}. Pass detach: true to detach it from these agents and delete it.`);
+                    case "race":
+                        throw new McpError(409, `Tool "${args.toolId}" is still attached to an agent; nothing was deleted.`);
+                }
+            }
         },
     });
     mcp.registerTool({
@@ -112,6 +232,7 @@ export function registerToolAuthoringTools(mcp) {
     mcp.registerTool({
         name: "attach_tool",
         scope: "tools:write",
+        description: "Attaches a tool to an agent (needs write on the agent). The four capability fields (allowedSecrets, allowedDatastorePrefixes, allowedHosts, allowedSharedDatastorePrefixes) are the agent owner's to grant: anyone else passing one gets 403, and their attachment runs with none until the owner re-runs attach_tool with the capabilities. When the owner grants an attachment it had not granted before (someone else attached it, or the agent changed owner), every capability not passed is reset to empty, so state each one you want. Granting capabilities to a tool someone else owns vouches for code you can't read (only its owner sees it); the tool's owner can't change it while it's attached to your agent, and detaching drops your grant.",
         inputSchema: {
             type: "object",
             properties: {
@@ -141,35 +262,72 @@ export function registerToolAuthoringTools(mcp) {
             if (!patch.success) {
                 throw new McpError(400, `Invalid tool capabilities: ${patch.error.issues.map((i) => i.message).join("; ")}`);
             }
+            const capabilitiesPassed = Object.values(patch.data).some((value) => value !== undefined);
             await ctx.db.$transaction(async (tx) => {
-                const agent = await tx.agent.findUnique({ where: { id: args.agentId } });
-                if (!agent)
-                    throw new McpError(404, `Agent "${args.agentId}" not found.`);
-                assertCanMutate(agent.ownerId, ctx.principal.id, `Agent "${args.agentId}" is not owned by the caller.`);
+                const { agent } = await assertAgentAccess(ctx, await tx.agent.findUnique({ where: { id: args.agentId } }), args.agentId, "write", tx);
                 if (agent.kind === "coding") {
                     throw new McpError(400, "Native sandbox tools cannot be attached to coding agents.");
                 }
-                await requireOwnedTool(tx, args.toolId, ctx.principal.id);
+                // Capabilities carry the owner's consent (resource-sharing grants
+                // spec §3.4.2). Strict ownership: neither a write-grantee nor the
+                // stdio operator may hand the owner's secrets, datastores or
+                // network to code on the agent.
+                const isOwner = agent.ownerId !== null && agent.ownerId === ctx.principal.id;
+                if (capabilitiesPassed && !isOwner) {
+                    throw new McpError(403, "Only the agent's owner can grant capabilities to an attachment; ask them to re-run attach_tool with the capabilities.");
+                }
+                const existing = await tx.agentTool.findUnique({
+                    where: { agentId_toolId: { agentId: args.agentId, toolId: args.toolId } },
+                });
+                // Creating an attachment needs a tool the caller may attach (Phase
+                // 1: its own or an owner-less one). Re-attaching an existing one
+                // only changes its capabilities: that is how the agent's owner
+                // grants them to a write-grantee's tool, or re-grants them after a
+                // make_owner transfer, so the tool check does not apply.
+                const tool = existing
+                    ? await tx.tool.findUniqueOrThrow({ where: { id: args.toolId } })
+                    : await requireOwnedTool(tx, args.toolId, ctx.principal.id);
+                // The runtime dispatches by name, and names are only unique per
+                // owner: a second same-named tool on one agent would be a
+                // duplicate tool name to the model and silently shadow one of them.
+                const clash = await findSameNamedAttachedTool(tx, args.agentId, tool);
+                if (clash) {
+                    // The clashing tool may be another principal's private one (a
+                    // write-grantee's, or one left from before a transfer): name its
+                    // id only when the caller could read it anyway.
+                    const which = canRead(clash.ownerId, ctx.principal.id)
+                        ? ` (${clash.id})`
+                        : " (a tool owned by another principal)";
+                    throw new McpError(409, `Agent "${args.agentId}" already has a different tool named "${tool.name}" attached${which}; detach it first.`);
+                }
+                // Re-granting an attachment this owner never vouched for: what is
+                // not restated is reset, never silently adopted.
+                const keepUnstated = existing?.capabilitiesGrantedById === agent.ownerId;
+                const field = (key, empty) => patch.data[key] !== undefined ? { [key]: patch.data[key] } : keepUnstated ? {} : { [key]: empty };
+                const ownerGrant = isOwner
+                    ? {
+                        ...field("allowedSecrets", []),
+                        ...field("allowedDatastorePrefixes", []),
+                        ...field("allowedHosts", []),
+                        ...field("allowedSharedDatastorePrefixes", {}),
+                        capabilitiesGrantedById: agent.ownerId,
+                    }
+                    : {};
                 await tx.agentTool.upsert({
                     where: { agentId_toolId: { agentId: args.agentId, toolId: args.toolId } },
                     create: {
                         agentId: args.agentId,
                         toolId: args.toolId,
-                        allowedSecrets: patch.data.allowedSecrets ?? [],
-                        allowedDatastorePrefixes: patch.data.allowedDatastorePrefixes ?? [],
-                        allowedHosts: patch.data.allowedHosts ?? [],
-                        allowedSharedDatastorePrefixes: patch.data.allowedSharedDatastorePrefixes ?? {},
-                    },
-                    update: {
-                        ...(patch.data.allowedSecrets !== undefined ? { allowedSecrets: patch.data.allowedSecrets } : {}),
-                        ...(patch.data.allowedDatastorePrefixes !== undefined
-                            ? { allowedDatastorePrefixes: patch.data.allowedDatastorePrefixes }
-                            : {}),
-                        ...(patch.data.allowedHosts !== undefined ? { allowedHosts: patch.data.allowedHosts } : {}),
-                        ...(patch.data.allowedSharedDatastorePrefixes !== undefined
-                            ? { allowedSharedDatastorePrefixes: patch.data.allowedSharedDatastorePrefixes }
-                            : {}),
+                        allowedSecrets: (isOwner && patch.data.allowedSecrets) || [],
+                        allowedDatastorePrefixes: (isOwner && patch.data.allowedDatastorePrefixes) || [],
+                        allowedHosts: (isOwner && patch.data.allowedHosts) || [],
+                        allowedSharedDatastorePrefixes: (isOwner && patch.data.allowedSharedDatastorePrefixes) || {},
+                        attachedById: ctx.principal.id,
+                        capabilitiesGrantedById: isOwner ? agent.ownerId : null,
                     },
+                    // A non-owner's re-attach leaves an existing attachment's
+                    // capabilities and consent stamp untouched.
+                    update: ownerGrant,
                 });
             }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });
             return textResult({ attached: true });
@@ -184,8 +342,9 @@ export function registerToolAuthoringTools(mcp) {
             required: ["agentId", "toolId"],
         },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
-            await requireOwnedTool(ctx.db, args.toolId, ctx.principal.id);
+            // Write on the agent is enough, whoever owns the tool: an agent's
+            // owner (or write-grantee) can always pull a tool off it.
+            await requireAgentAccess(ctx, args.agentId, "write");
             await ctx.db.agentTool.deleteMany({ where: { agentId: args.agentId, toolId: args.toolId } });
             return textResult({ detached: true });
         },
@@ -195,13 +354,15 @@ export function registerToolAuthoringTools(mcp) {
         scope: "tools:write",
         inputSchema: { type: "object", properties: { agentId: { type: "string" } } },
         handler: async (args, ctx) => {
-            const project = (tool) => tool.ownerId === ctx.principal.id ? tool : { id: tool.id, name: tool.name, description: tool.description };
+            const project = (tool) => projectTool(tool, ctx.principal.id);
             if (args.agentId) {
-                await requireReadableAgent(ctx.db, args.agentId, ctx.principal.id);
+                const { access } = await requireAgentAccess(ctx, args.agentId, "read");
                 const rows = await ctx.db.agentTool.findMany({ where: { agentId: args.agentId }, include: { tool: true } });
+                // The agent's owner sees every tool on it (projected: code only for
+                // the tool's own owner); anyone else only tools they could see anyway.
                 return textResult(rows
                     .map((r) => r.tool)
-                    .filter((tool) => canRead(tool.ownerId, ctx.principal.id))
+                    .filter((tool) => access === "owner" || canRead(tool.ownerId, ctx.principal.id))
                     .map(project));
             }
             const tools = await ctx.db.tool.findMany({ where: visibleToPrincipal(ctx.principal.id) });

package/dist/mcp/tools/trigger.js

@@ -33,7 +33,8 @@ import { CodingBaseRefSchema, CodingTaskOverrideSchema } from "../../coding/prot
 import { z } from "zod";
 import { McpError } from "../errors.js";
 import { createTaskResult, getTask, cancelTask } from "../tasks/manager.js";
-import { canMutate, requireOwnedAgent, requireOwnedTask } from "../auth/ownership.js";
+import { requireOwnedTask } from "../auth/ownership.js";
+import { assertAgentAccess } from "../auth/access.js";
 import { textResult } from "./text-result.js";
 const DEFAULT_TASK_TTL_MS = 24 * 60 * 60 * 1000;
 const TriggerAgentSchema = z
@@ -50,6 +51,29 @@ function parseTriggerArgs(args) {
     const details = parsed.error.issues.map((issue) => `${issue.path.join(".") || "input"}: ${issue.message}`).join("; ");
     throw new McpError(400, `Invalid trigger_agent arguments: ${details}`);
 }
+/**
+ * A non-owner's coding task or baseRef would steer what the owner's
+ * repository authority does, so it is allowed only when the owner opted in
+ * to non-owner task text (codingProfile.allowWebhookTaskOverride, the same
+ * opt-in webhooks use). Otherwise a non-owner run uses the owner's
+ * defaultTask. Resource-sharing grants spec §3.4.5.
+ */
+function assertOverrideAllowed(principalId, agent, args) {
+    // Strictly the owner: the stdio operator's owner-level access doesn't make
+    // it the owner whose repository authority the task steers (review M8).
+    const isOwner = agent.ownerId !== null && agent.ownerId === principalId;
+    if (isOwner || (args.task === undefined && args.baseRef === undefined))
+        return;
+    if (!agent.codingProfile?.allowWebhookTaskOverride) {
+        throw new McpError(403, `Agent "${agent.id}": only its owner can pass a task or baseRef, unless the owner allows it (codingProfile.allowWebhookTaskOverride).`);
+    }
+}
+/** execute on the agent, plus the override rule; `db` is the transaction when re-checking. */
+async function requireTriggerable(ctx, row, id, args, db = ctx.db) {
+    const { agent } = await assertAgentAccess(ctx, row, id, "execute", db);
+    assertOverrideAllowed(ctx.principal.id, agent, args);
+    return agent;
+}
 export function registerTriggerTool(mcp) {
     mcp.registerTool({
         name: "trigger_agent",
@@ -62,7 +86,7 @@ export function registerTriggerTool(mcp) {
         },
         handler: async (rawArgs, ctx) => {
             const args = parseTriggerArgs(rawArgs);
-            const agent = await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            const agent = await requireTriggerable(ctx, await ctx.db.agent.findUnique({ where: { id: args.agentId }, include: { codingProfile: true } }), args.agentId, args);
             if (agent.kind !== "coding" && (args.task !== undefined || args.baseRef !== undefined)) {
                 throw new McpError(400, "Task and baseRef overrides are only valid for coding agents.");
             }
@@ -74,10 +98,11 @@ export function registerTriggerTool(mcp) {
                 codingTask: args.task,
                 codingBaseRef: args.baseRef,
                 task: ctx.clientSupportsTasks ? { principalId: ctx.principal.id, ttlMs: DEFAULT_TASK_TTL_MS } : undefined,
-                beforePersist: async (_tx, current) => {
-                    if (!canMutate(current.ownerId, ctx.principal.id)) {
-                        throw new McpError(403, `Agent "${agent.id}" is not owned by the caller.`);
-                    }
+                triggeredById: ctx.principal.id,
+                // Re-checked through the transaction: a concurrent revoke or
+                // make_owner conflicts instead of racing the run in.
+                beforePersist: async (tx, current) => {
+                    await requireTriggerable(ctx, current, agent.id, args, tx);
                     return true;
                 },
             });
@@ -88,6 +113,11 @@ export function registerTriggerTool(mcp) {
                     throw new Error("Run task was not persisted.");
                 return textResult(createTaskResult(dispatched.task, DEFAULT_TASK_TTL_MS));
             }
+            // A run refused at dispatch (its budget group or run tree is spent) is
+            // already terminal: say so now rather than only through get_run.
+            if (dispatched.run.status === "refused") {
+                return textResult({ runId: dispatched.run.id, status: "refused", error: dispatched.run.error });
+            }
             return textResult({ runId: dispatched.run.id });
         },
     });

package/dist/mcp/tools/webhooks.js

@@ -1,13 +1,17 @@
 import { createWebhook, listWebhooks, deleteWebhook } from "../../core/webhooks.js";
-import { requireOwnedAgent, requireOwnedWebhook } from "../auth/ownership.js";
+import { McpError } from "../errors.js";
+import { requireAgentAccess } from "../auth/access.js";
 import { textResult } from "./text-result.js";
 export function registerWebhookTools(mcp) {
     mcp.registerTool({
         name: "create_webhook",
         scope: "webhooks:write",
+        description: "Creates a standing trigger for an agent (needs write on it) and returns its secret once. It fires only while you still own the agent or hold execute on it.",
         inputSchema: { type: "object", properties: { agentId: { type: "string" } }, required: ["agentId"] },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            // A standing trigger that can also carry task text for a native agent:
+            // write, not just execute (resource-sharing grants spec §3.10).
+            await requireAgentAccess(ctx, args.agentId, "write");
             const created = await createWebhook(args.agentId, ctx.principal.id, ctx.db);
             return textResult(created);
         },
@@ -15,18 +19,25 @@ export function registerWebhookTools(mcp) {
     mcp.registerTool({
         name: "list_webhooks",
         scope: "webhooks:write",
+        description: "Lists webhooks you created, and every webhook on an agent you own.",
         inputSchema: { type: "object", properties: {} },
         handler: async (_args, ctx) => {
-            const webhooks = await listWebhooks(ctx.principal.id, ctx.db);
+            const webhooks = await listWebhooks(ctx.principal.id, ctx.db, { all: ctx.operator === true });
             return textResult(webhooks);
         },
     });
     mcp.registerTool({
         name: "delete_webhook",
         scope: "webhooks:write",
+        description: "Deletes a webhook you created, or any webhook on an agent you own.",
         inputSchema: { type: "object", properties: { id: { type: "string" } }, required: ["id"] },
         handler: async (args, ctx) => {
-            await requireOwnedWebhook(ctx.db, args.id, ctx.principal.id);
+            const webhook = await ctx.db.webhook.findUnique({ where: { id: args.id }, include: { agent: true } });
+            const principalId = ctx.principal.id;
+            const allowed = webhook !== null &&
+                (ctx.operator === true || webhook.ownerId === principalId || webhook.agent.ownerId === principalId);
+            if (!allowed)
+                throw new McpError(403, `Webhook "${args.id}" is not owned by the caller.`);
             await deleteWebhook(args.id, ctx.db);
             return textResult({ deleted: args.id });
         },

package/dist/mcp/transport/streamable-http.d.ts

@@ -5,6 +5,8 @@ import type { AuthProvider } from "../../providers/auth/types.js";
 import type { SelfHostedAuthProvider } from "../../providers/auth/self-hosted.js";
 import type { WardbyMcpServer } from "../server.js";
 import type { McpProviders } from "../context.js";
+import { type GitHubIngressDeps } from "../host-events/github-ingress.js";
+import { type HostUserCallbackDeps } from "../host-events/github-user-callback.js";
 export interface HttpServerConfig {
     canonicalUri: string;
     httpBind: {
@@ -25,6 +27,14 @@ export interface StartHttpServerOptions {
         providers: McpProviders;
     };
     selfHosted?: SelfHostedAuthProvider;
+    /** Code-review host webhooks; absent = the endpoints answer 404. */
+    hostEvents?: {
+        github?: GitHubIngressDeps;
+    };
+    /** The host identity-link browser callback (link_host_account); absent = 404. */
+    hostUserAuth?: {
+        github?: HostUserCallbackDeps;
+    };
 }
 export interface HttpServerHandle {
     port: number;