@wardby/cli 0.2.1 → 0.4.0

package/dist/mcp/host-events/jira-ingress.js

@@ -0,0 +1,92 @@
+/**
+ * Jira Cloud webhook ingress — framework-agnostic, mounted unauthenticated
+ * (by OAuth) in streamable-http.ts at /hosts/jira/events. Authenticated by the
+ * webhook secret (X-Hub-Signature, WebSub style) over the raw body. The
+ * delivery id (X-Atlassian-Webhook-Identifier) is stable across Jira's
+ * retries, so it is the dedupe key. Nothing from the body is logged.
+ */
+import { Prisma } from "#prisma";
+import { maybePruneHostEventDeliveries } from "./deliveries.js";
+import { routeIssueEvent } from "../../core/issue-events.js";
+import { logger } from "../../core/logger.js";
+import { normalizeJiraEvent, verifyJiraSignature } from "../../providers/issue-tracker/jira-events.js";
+const log = logger.child({ module: "jira-ingress" });
+const SAFE_DELIVERY = /^[A-Za-z0-9._:-]{1,200}$/;
+/** Jira retries a delivery up to 5 times, 5-15 min apart, so 2 h comfortably covers a legitimate replay. */
+const MAX_AGE_MS = 2 * 60 * 60 * 1000;
+const MAX_FUTURE_MS = 5 * 60 * 1000;
+/**
+ * Whether the payload's top-level `timestamp` is inside the replay window.
+ * Assumed to be epoch milliseconds; a value below 1e12 (before 2001 in ms)
+ * is read as seconds. The unit is unverified against a live delivery.
+ * A missing or non-numeric timestamp is not fresh.
+ */
+function isFresh(payload, nowMs) {
+    const raw = payload?.timestamp;
+    if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0)
+        return false;
+    const ts = raw < 1e12 ? raw * 1000 : raw;
+    return ts >= nowMs - MAX_AGE_MS && ts <= nowMs + MAX_FUTURE_MS;
+}
+export async function handleJiraEventIngress(req, deps) {
+    const tracker = deps.trackers.jira;
+    if (!tracker)
+        return { status: 404, body: { error: "not_found" } };
+    if (!verifyJiraSignature(req.rawBody, req.headers["x-hub-signature"], deps.webhookSecret)) {
+        return { status: 401, body: { error: "invalid_signature" } };
+    }
+    // wardby must not act as a person. A lookup failure throws (5xx), so Jira retries the delivery.
+    const identity = await tracker.identity();
+    if (identity.accountType === "atlassian") {
+        log.error("Jira token belongs to a person; refusing deliveries (use a service account)");
+        return { status: 503, body: { error: "jira_personal_account" } };
+    }
+    const deliveryId = req.headers["x-atlassian-webhook-identifier"];
+    if (!deliveryId || !SAFE_DELIVERY.test(deliveryId)) {
+        return { status: 400, body: { error: "missing_delivery_headers" } };
+    }
+    let payload;
+    try {
+        payload = JSON.parse(req.rawBody);
+    }
+    catch {
+        return { status: 400, body: { error: "invalid_json" } };
+    }
+    // Replay protection: the signature covers the body, so an old captured delivery would otherwise verify forever.
+    if (!isFresh(payload, (deps.now ?? Date.now)()))
+        return { status: 202, body: { ignored: "stale" } };
+    const event = normalizeJiraEvent(payload, identity.accountId);
+    // An event we don't act on must never claim the delivery id (see the GitHub ingress).
+    if (!event)
+        return { status: 202, body: { ignored: true } };
+    try {
+        await deps.db.hostEventDelivery.create({ data: { provider: "jira", deliveryId } });
+    }
+    catch (err) {
+        if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === "P2002") {
+            return { status: 202, body: { duplicate: true } };
+        }
+        throw err;
+    }
+    await maybePruneHostEventDeliveries(deps.db, new Date());
+    // A routing failure must not leave the delivery permanently marked done:
+    // un-record it and rethrow so Jira's retry is routed for real.
+    try {
+        const routed = await routeIssueEvent(event, { db: deps.db, executor: deps.executor, trackers: deps.trackers });
+        log.info({ kinds: event.kinds, deliveryId, runIds: routed.runIds }, "jira event routed");
+        return {
+            status: 202,
+            body: { runIds: routed.runIds },
+            afterResponse: async () => {
+                for (const followUp of routed.followUps)
+                    await followUp();
+            },
+        };
+    }
+    catch (err) {
+        await deps.db.hostEventDelivery
+            .deleteMany({ where: { provider: "jira", deliveryId } })
+            .catch((delErr) => log.warn({ err: delErr }, "could not roll back the delivery record after a routing failure"));
+        throw err;
+    }
+}

package/dist/mcp/index.d.ts

@@ -1,10 +1,19 @@
 import { type WardbyMcpServer } from "./server.js";
-import type { McpProviders } from "./context.js";
+import type { McpProviders, McpRequestContext } from "./context.js";
+import type { Principal, PrismaClient } from "#prisma";
 import { type SecretElicitationUrlBuilder } from "./tools/secrets.js";
+/**
+ * stdio's one fixed identity: the local operator (LOCAL_PRINCIPAL), trusted
+ * with every supported scope and every role — whoever can start the
+ * process already holds the database and its keys.
+ */
+export declare function localOperatorContext(principal: Principal, providers: McpProviders, db: PrismaClient): McpRequestContext;
 /** Registers the full Phase 4 tool surface — every module, in one place. */
 export declare function registerAllTools(mcp: WardbyMcpServer, opts: {
     secretElicitationUrl: SecretElicitationUrlBuilder;
     secretElicitationProtocol: boolean;
+    /** Rebuilds the process's installed model CatalogStore after set_model/disable_model/reset_model. */
+    refreshModelCatalog?: () => Promise<void>;
 }): void;
 export interface McpProviderComposition {
     providers: McpProviders;

package/dist/mcp/index.js

@@ -1,28 +1,59 @@
-import { loadProviderConfig, loadMcpConfig, loadAuthConfig } from "../config/providers.js";
+/**
+ * MCP composition root: assembles the real providers, builds one
+ * WardbyMcpServer, registers every tool module, and starts whichever
+ * transport MCP_TRANSPORT selects. No business logic lives here — this
+ * file only wires together pieces every earlier task already built and
+ * tested on their own.
+ *
+ * stdio vs. HTTP diverge on two things a live smoke test surfaced (see the
+ * ledger): stdio needs no `MCP_CANONICAL_URI` (there's no HTTP endpoint or
+ * OAuth challenge to identify) and constructs no real `AuthProvider` at all
+ * (per the design: "stdio local mode: no token; the operator is trusted") —
+ * building one unconditionally would make `wardby mcp` over stdio fail on
+ * missing `AUTH_JWKS_URI`/`AUTH_SIGNING_KEY` a deployment running stdio-only
+ * never needed to set.
+ */
+import { loadProviderConfig, loadMcpConfig, loadShutdownDrainSeconds, loadAuthConfig, loadGitHubEventConfig, loadJiraConfig, loadGitHubVcsConfig, } from "../config/providers.js";
 import { prisma } from "../core/db.js";
+import { waitForInFlightRuns } from "../core/in-flight-runs.js";
 import { NativeEngine } from "../core/engine-native.js";
 import { resolveLlmRegistrations, RoutingLlmProvider } from "../providers/llm/index.js";
+import { startModelCatalog } from "../providers/llm/catalog-store.js";
 import { PostgresDatastore } from "../providers/datastore/index.js";
 import { PostgresAgentMemory } from "../providers/memory/index.js";
 import { buildConfiguredExecutor, buildExecutor } from "../providers/executor/index.js";
 import { buildSecretCipher } from "../providers/secrets/index.js";
+import { buildIssueTrackers } from "../providers/issue-tracker/index.js";
+import { buildHostUserAuthorizers, buildReviewHosts } from "../providers/review-host/index.js";
+import { createRepoAccessGate } from "../core/repo-access.js";
+import { userCallbackPath } from "../core/host-identity-links.js";
 import { buildAuthProvider } from "../providers/auth/index.js";
+import { GitHubAppClient } from "../providers/vcs/github.js";
 import { buildMcpServer } from "./server.js";
 import { countUnattendedSchedules, unattendedSchedulesWarning } from "./unattended-schedules.js";
 import { runStdioServer } from "./transport/stdio.js";
 import { startHttpServer } from "./transport/streamable-http.js";
 import { resolvePrincipal } from "./auth/principal.js";
-import { SCOPES_SUPPORTED } from "./auth/resource-server.js";
+import { ROLE_NAMES, SCOPES_SUPPORTED, authenticate } from "./auth/resource-server.js";
 import { canonicalUrl } from "./transport/http-limits.js";
+import { createViewerApi } from "../viewer/http.js";
+import { createViewerEventBus } from "../viewer/event-bus.js";
 import { registerAgentTools } from "./tools/agents.js";
+import { registerServiceTools } from "./tools/services.js";
 import { registerBudgetGroupTools } from "./tools/budget-groups.js";
-import { registerModelTools } from "./tools/models.js";
+import { registerModelCatalogTools } from "./tools/model-catalog.js";
+import { registerHelpTools } from "./tools/help.js";
 import { registerTriggerTool } from "./tools/trigger.js";
 import { registerToolAuthoringTools } from "./tools/tools.js";
 import { registerSchedulingTools } from "./tools/scheduling.js";
 import { registerRunTools } from "./tools/runs.js";
+import { registerCostReportTools } from "./tools/cost-report.js";
 import { registerDatastoreTools } from "./tools/datastore.js";
 import { registerSubAgentTools } from "./tools/subagents.js";
+import { registerGrantTools } from "./tools/grants.js";
+import { registerRepositoryTools } from "./tools/repositories.js";
+import { registerIssueProjectTools } from "./tools/issue-projects.js";
+import { registerHostAccountTools } from "./tools/host-accounts.js";
 import { registerMemoryTools } from "./tools/memory.js";
 import { registerSecretsTools } from "./tools/secrets.js";
 import { registerWebhookTools } from "./tools/webhooks.js";
@@ -45,17 +76,46 @@ async function warnIfNothingWillFireSchedules() {
 }
 /** Placeholder identifier for stdio, which has no HTTP endpoint to name. Never surfaced: stdio's fixed context always holds every scope, so no scope challenge is ever built against it. */
 const STDIO_PLACEHOLDER_URI = "urn:wardby:local-stdio";
+/**
+ * stdio's one fixed identity: the local operator (LOCAL_PRINCIPAL), trusted
+ * with every supported scope and every role — whoever can start the
+ * process already holds the database and its keys.
+ */
+export function localOperatorContext(principal, providers, db) {
+    return {
+        principal,
+        scopes: new Set(SCOPES_SUPPORTED),
+        roles: [...ROLE_NAMES],
+        // Full access to every resource (resource-sharing grants spec §3.9),
+        // but never past the binding rules.
+        operator: true,
+        canonicalUri: STDIO_PLACEHOLDER_URI,
+        providers,
+        db,
+        clientSupportsTasks: false,
+        // Placeholder — server.ts's resolveCtx overwrites this with the
+        // current call's real mcpReq on every dispatch.
+        mcpReq: { requestState: () => undefined },
+    };
+}
 /** Registers the full Phase 4 tool surface — every module, in one place. */
 export function registerAllTools(mcp, opts) {
     registerAgentTools(mcp);
+    registerServiceTools(mcp);
     registerBudgetGroupTools(mcp);
-    registerModelTools(mcp);
+    registerModelCatalogTools(mcp, { refresh: opts.refreshModelCatalog });
+    registerHelpTools(mcp);
     registerTriggerTool(mcp);
     registerToolAuthoringTools(mcp);
     registerSchedulingTools(mcp);
     registerRunTools(mcp);
+    registerCostReportTools(mcp);
     registerDatastoreTools(mcp);
     registerSubAgentTools(mcp);
+    registerGrantTools(mcp);
+    registerRepositoryTools(mcp);
+    registerIssueProjectTools(mcp);
+    registerHostAccountTools(mcp);
     registerMemoryTools(mcp);
     registerSecretsTools(mcp, {
         buildElicitationUrl: opts.secretElicitationUrl,
@@ -75,6 +135,12 @@ export function buildMcpProviders() {
     const secrets = buildSecretCipher(providerConfig);
     const datastore = new PostgresDatastore(prisma, secrets);
     const memory = new PostgresAgentMemory(prisma);
+    const reviewHosts = buildReviewHosts();
+    const issueTrackers = buildIssueTrackers();
+    const hostUserAuthorizers = buildHostUserAuthorizers();
+    // One gate (and one cache) for the whole process: set-time checks in the
+    // MCP tools, repo_* calls in native runs, coding runs, and host events.
+    const repoAccess = createRepoAccessGate({ db: prisma, hosts: reviewHosts });
     // `nativeProviders` is passed by reference into buildExecutor, and native
     // runs it drives read `this.providers.executor` at call time (not at
     // construction time) — so patching `.executor` on afterward, once the
@@ -83,11 +149,33 @@ export function buildMcpProviders() {
     // through the same composed executor everything else uses. There's no
     // way to hand the native executor a reference to its own wrapping
     // RoutingExecutor before that wrapper is constructed.
-    const nativeProviders = { llm, engine, datastore, secrets, memory };
+    const nativeProviders = {
+        llm,
+        engine,
+        datastore,
+        secrets,
+        memory,
+        reviewHosts,
+        issueTrackers,
+        repoAccess,
+    };
     const nativeExecutor = buildExecutor(providerConfig, nativeProviders, prisma);
-    const executor = buildConfiguredExecutor({ native: nativeExecutor, db: prisma, providerConfig });
+    const executor = buildConfiguredExecutor({ native: nativeExecutor, db: prisma, providerConfig, repoAccess });
     nativeProviders.executor = executor;
-    return { providers: { llm, engine, datastore, secrets, executor, memory } };
+    return {
+        providers: {
+            llm,
+            engine,
+            datastore,
+            secrets,
+            executor,
+            memory,
+            reviewHosts,
+            issueTrackers,
+            hostUserAuthorizers,
+            repoAccess,
+        },
+    };
 }
 /** Awaits `promise` (if any), logging and swallowing a rejection instead of propagating it. */
 async function closeQuietly(promise, what) {
@@ -101,6 +189,16 @@ async function closeQuietly(promise, what) {
 /** The real CLI entry point: `wardby mcp`. Reads config from the environment, starts stdio or HTTP per MCP_TRANSPORT. */
 export async function startMcp(options = {}) {
     const mcpConfig = loadMcpConfig();
+    // Parsed up front so a malformed value fails at startup, not at shutdown.
+    const drainSeconds = loadShutdownDrainSeconds();
+    // Loads the model catalog before anything else: running on the shipped
+    // catalog alone (the fallback currentModelCatalog() uses before a store
+    // is installed) would quietly re-enable models an admin turned off.
+    // `modelCatalog` is handed to registerAllTools as `refreshModelCatalog`,
+    // which the model catalog tools (set_model, disable_model, reset_model)
+    // call via `modelCatalog.refreshNow()` after each write — there is no
+    // separate refresh tool.
+    const modelCatalog = await startModelCatalog(prisma);
     const providers = options.providers ?? buildMcpProviders().providers;
     await providers.executor.launch?.();
     if (!options.schedulerAttached)
@@ -115,27 +213,19 @@ export async function startMcp(options = {}) {
         registerAllTools(mcp, {
             secretElicitationUrl: (token) => secretElicitationHost.urlFor(token),
             secretElicitationProtocol: mcpConfig.secretElicitationProtocol,
+            refreshModelCatalog: () => modelCatalog.refreshNow(),
         });
         // stdio never carries per-call AuthInfo — one fixed, fully-trusted
         // local identity for the whole connection, per the design's own
         // "stdio local mode: no token; the operator is trusted."
         const principal = await resolvePrincipal(mcpConfig.localPrincipal, prisma);
-        mcp.setFixedContext({
-            principal,
-            scopes: new Set(SCOPES_SUPPORTED),
-            canonicalUri: STDIO_PLACEHOLDER_URI,
-            providers,
-            db: prisma,
-            clientSupportsTasks: false,
-            // Placeholder — server.ts's resolveCtx overwrites this with the
-            // current call's real mcpReq on every dispatch.
-            mcpReq: { requestState: () => undefined },
-        });
+        mcp.setFixedContext(localOperatorContext(principal, providers, prisma));
         const stdio = runStdioServer(mcp);
         return {
             close: async () => {
                 await closeQuietly(stdio.close(), "stdio transport close");
                 await closeQuietly(providers.executor.close?.(), "executor close");
+                modelCatalog.close();
             },
         };
     }
@@ -158,11 +248,81 @@ export async function startMcp(options = {}) {
     registerAllTools(mcp, {
         secretElicitationUrl: (token) => Promise.resolve(`${httpOrigin}${SECRET_ELICITATION_PATH}?t=${encodeURIComponent(token)}`),
         secretElicitationProtocol: mcpConfig.secretElicitationProtocol,
+        refreshModelCatalog: () => modelCatalog.refreshNow(),
     });
+    const eventConfig = loadGitHubEventConfig();
+    const githubConfig = loadGitHubVcsConfig();
+    const reviewHosts = providers.reviewHosts;
+    const githubEvents = eventConfig.webhookSecret && reviewHosts?.github && githubConfig.appId && githubConfig.privateKey
+        ? {
+            github: {
+                db: prisma,
+                executor: providers.executor,
+                hosts: reviewHosts,
+                repoAccess: providers.repoAccess ?? createRepoAccessGate({ db: prisma, hosts: reviewHosts }),
+                ...(providers.issueTrackers ? { issueTrackers: providers.issueTrackers } : {}),
+                webhookSecret: eventConfig.webhookSecret,
+                appIdentity: (() => {
+                    const client = new GitHubAppClient({
+                        appId: githubConfig.appId,
+                        privateKey: githubConfig.privateKey,
+                        apiVersion: githubConfig.apiVersion,
+                    });
+                    return () => client.appIdentity();
+                })(),
+            },
+        }
+        : undefined;
+    mcpLog.info({ enabled: Boolean(githubEvents) }, "GitHub host events ingress");
+    const jiraConfig = loadJiraConfig();
+    const jiraEvents = jiraConfig && providers.issueTrackers?.jira
+        ? {
+            db: prisma,
+            executor: providers.executor,
+            trackers: providers.issueTrackers,
+            webhookSecret: jiraConfig.webhookSecret,
+        }
+        : undefined;
+    mcpLog.info({ enabled: Boolean(jiraEvents) }, "Jira host events ingress");
+    if (jiraEvents) {
+        // Best effort: show which Jira account wardby acts as; never blocks startup.
+        void providers.issueTrackers?.jira?.identity().then(({ accountId, displayName, accountType }) => accountType === "atlassian"
+            ? mcpLog.error({ accountId, displayName, accountType }, "Jira token belongs to a person's account; wardby refuses to act and the Jira ingress answers 503 until a service account token is configured")
+            : mcpLog.info({ accountId, displayName, accountType }, "Jira acting as"), (err) => mcpLog.warn({ err: err instanceof Error ? err.message : String(err) }, "could not read the Jira account identity"));
+    }
+    if (jiraConfig?.tokenExpiresAt && jiraConfig.tokenExpiresAt.getTime() - Date.now() < 14 * 24 * 60 * 60 * 1000) {
+        mcpLog.warn({ expiresAt: jiraConfig.tokenExpiresAt.toISOString() }, "the Jira API token expires within 14 days; rotate WARDBY_JIRA_API_TOKEN");
+    }
+    const hostEvents = githubEvents || jiraEvents
+        ? { ...(githubEvents ? githubEvents : {}), ...(jiraEvents ? { jira: jiraEvents } : {}) }
+        : undefined;
+    const githubAuthorizer = providers.hostUserAuthorizers?.github;
+    const hostUserAuth = githubAuthorizer
+        ? {
+            github: {
+                db: prisma,
+                authorizer: githubAuthorizer,
+                redirectUri: `${httpOrigin}${userCallbackPath("github")}`,
+            },
+        }
+        : undefined;
+    mcpLog.info({ enabled: Boolean(hostUserAuth) }, "GitHub account linking");
+    const canonicalHref = canonicalUrl(mcpConfig.canonicalUri).href;
+    const viewerBus = process.env.DATABASE_URL
+        ? createViewerEventBus({ connectionString: process.env.DATABASE_URL })
+        : undefined;
+    const viewer = viewerBus
+        ? createViewerApi({
+            db: prisma,
+            bus: viewerBus,
+            authenticate: (authorization) => authenticate({ authorization }, { authProvider, db: prisma, providers, canonicalUri: canonicalHref }),
+            canonicalUri: canonicalHref,
+        })
+        : undefined;
     const http = await startHttpServer({
         mcp,
         config: {
-            canonicalUri: canonicalUrl(mcpConfig.canonicalUri).href,
+            canonicalUri: canonicalHref,
             httpBind: mcpConfig.httpBind,
             authProviderKind,
             authorizationServer: authConfig.issuer,
@@ -170,6 +330,9 @@ export async function startMcp(options = {}) {
         },
         auth: { authProvider, db: prisma, providers },
         selfHosted,
+        hostEvents,
+        hostUserAuth,
+        viewer,
     });
     const cleanupTimer = selfHosted
         ? setInterval(() => {
@@ -181,7 +344,12 @@ export async function startMcp(options = {}) {
             if (cleanupTimer)
                 clearInterval(cleanupTimer);
             await closeQuietly(http.close(), "HTTP transport close");
+            await closeQuietly(viewerBus?.close(), "viewer event bus close");
+            // Let the runs this instance is executing finish before the executor
+            // closes under them; a run abandoned here is lost, never resumed.
+            await waitForInFlightRuns(drainSeconds * 1000);
             await closeQuietly(providers.executor.close?.(), "executor close");
+            modelCatalog.close();
         },
     };
 }

package/dist/mcp/server.js

@@ -24,11 +24,15 @@
  */
 import { McpServer, fromJsonSchema, createRequestStateCodec, CLIENT_CAPABILITIES_META_KEY, } from "@modelcontextprotocol/server";
 import { randomBytes } from "node:crypto";
+import { readFileSync } from "node:fs";
 import { requireScope } from "./auth/resource-server.js";
-import { McpError } from "./errors.js";
+import { McpError, mapPrismaError } from "./errors.js";
 import { TASKS_EXTENSION_ID, clientSupportsTasks } from "./capabilities.js";
-import { visibleToPrincipal } from "./auth/ownership.js";
+import { readableAgentsWhere } from "./auth/access.js";
+import { grantedIds } from "../core/grants.js";
 import { logger } from "../core/logger.js";
+/** The package version, reported in MCP server info (package.json sits two levels up from src/mcp and dist/mcp). */
+const SERVER_VERSION = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")).version;
 const REQUEST_STATE_KEY_BYTES = 32;
 /**
  * REQUEST_STATE_KEY (hex, 32 bytes) shares the requestState HMAC key across
@@ -54,7 +58,7 @@ function loadRequestStateKey(env) {
  * with the per-agent MCP prompts registered below, which are the concrete,
  * one-call way to actually do it.
  */
-const SERVER_INSTRUCTIONS = 'wardby hosts reusable LLM agents (a system prompt, model, budget, and attached tools) that normally run on a schedule or webhook trigger. Every agent\'s full system prompt is available via list_agents/get_agent ("systemPrompt" field), and agents you can see are also registered as MCP prompts by name — you can adopt an agent\'s instructions and run them yourself, in this session, right now. This is a good way to shift work like code review left: e.g., before committing, run the "systemPrompt" of a code-review agent against your own working tree using your own tools, rather than waiting for a separately triggered run. Where a pulled prompt names a wardby-specific sandboxed tool, use your own equivalent tool for the same purpose instead.';
+const SERVER_INSTRUCTIONS = 'wardby hosts reusable LLM agents (a system prompt, model, budget, and attached tools) that normally run on a schedule or webhook trigger. Every agent\'s full system prompt is available via list_agents/get_agent ("systemPrompt" field), and agents you can see are also registered as MCP prompts by name — you can adopt an agent\'s instructions and run them yourself, in this session, right now. This is a good way to shift work like code review left: e.g., before committing, run the "systemPrompt" of a code-review agent against your own working tree using your own tools, rather than waiting for a separately triggered run. Where a pulled prompt names a wardby-specific sandboxed tool, use your own equivalent tool for the same purpose instead. To set up a first agent — an architecture keeper or a builder — read the help article "agent-recipes" with get_help_article and follow its procedure.';
 /** The MCP prompt body for one Agent — the message a client injects when a user invokes it (e.g. as a slash command). */
 function agentPromptText(agent) {
     return [
@@ -97,6 +101,7 @@ export function buildMcpServer(opts) {
             return {
                 principal: extra.principal,
                 scopes: new Set(authInfo.scopes),
+                roles: extra.roles ?? [],
                 canonicalUri: opts.config.canonicalUri,
                 providers: opts.providers,
                 db: opts.db,
@@ -117,7 +122,7 @@ export function buildMcpServer(opts) {
         requestHandlers.push({ method, scope: Array.isArray(scope) ? scope : [scope], handler });
     }
     const factory = async () => {
-        const mcpServer = new McpServer({ name: "wardby", version: "0.0.0" }, {
+        const mcpServer = new McpServer({ name: "wardby", version: SERVER_VERSION }, {
             requestState: { verify: (state, ctx) => requestStateCodec.verify(state, ctx) },
             instructions: SERVER_INSTRUCTIONS,
         });
@@ -130,7 +135,14 @@ export function buildMcpServer(opts) {
             }, async (args, sdkCtx) => {
                 const ctx = resolveCtx(sdkCtx);
                 requireScope(ctx, opts.config.canonicalUri, ...requiredScopes);
-                return spec.handler(args, ctx);
+                try {
+                    return await spec.handler(args, ctx);
+                }
+                catch (err) {
+                    // A raw Prisma error would reach the client verbatim (the SDK
+                    // renders any thrown error's message) -- see mapPrismaError.
+                    throw mapPrismaError(err);
+                }
             });
         }
         // Non-spec (extension) methods need a { params, result } schema bundle
@@ -143,7 +155,12 @@ export function buildMcpServer(opts) {
             mcpServer.server.setRequestHandler(method, { params: PERMISSIVE_SCHEMA }, async (params, sdkCtx) => {
                 const ctx = resolveCtx(sdkCtx);
                 requireScope(ctx, opts.config.canonicalUri, ...scope);
-                return (await handler(params, ctx));
+                try {
+                    return (await handler(params, ctx));
+                }
+                catch (err) {
+                    throw mapPrismaError(err);
+                }
             });
         }
         // One MCP prompt per Agent this connection can see, so a client that
@@ -154,12 +171,16 @@ export function buildMcpServer(opts) {
         // resolves it per-dispatch from the SDK's own per-call ServerContext,
         // not at factory time) — stdio's fixedContext IS set by now
         // (mcp/index.ts calls setFixedContext before serveStdio ever invokes
-        // this factory), so stdio sees every agent it owns plus public ones;
-        // HTTP conservatively falls back to public-only until this factory can
-        // see request-scoped identity. A DB hiccup here must not break tool
-        // registration — this is a discoverability nicety, not core function.
+        // this factory), so stdio sees every agent it can read;
+        // HTTP conservatively falls back to agents shared with everyone (a
+        // grant of at least read) until this factory can see request-scoped
+        // identity; stdio sees what its principal can read (the operator: all).
+        // A DB hiccup here must not break tool registration — this is a
+        // discoverability nicety, not core function.
         try {
-            const where = fixedContext ? visibleToPrincipal(fixedContext.principal.id) : { ownerId: null };
+            const where = fixedContext
+                ? await readableAgentsWhere(fixedContext, opts.db)
+                : { id: { in: await grantedIds(opts.db, "agent", null, "read") } };
             const agents = await opts.db.agent.findMany({ where });
             for (const agent of agents) {
                 mcpServer.registerPrompt(agent.name, {