@wardby/cli 0.3.0 → 0.4.1

package/dist/mcp/auth/resource-server.js

@@ -21,6 +21,12 @@ export const SCOPES_SUPPORTED = [
     "agents:admin",
     // set_agent_memory / delete_agent_memory (reading memory is agents:read).
     "memory:write",
+    // Read-only, deployment-wide view of runs for the admin viewer (docs/viewer-api.md).
+    // Privileged: it shows every owner's runs, so only the admin role grants it.
+    "admin:view",
+    // Add, override, disable and reset model catalog entries (see docs/models.md).
+    // Reading the catalog (list_models, get_model) is agents:read.
+    "models:admin",
 ];
 /**
  * Scopes whose operations reach beyond the caller's own (or public)
@@ -28,20 +34,29 @@ export const SCOPES_SUPPORTED = [
  * agents:admin reassigns ANY agent's owner (make_owner) and sets a BYO
  * workerImageRef; packages:approve widens coding agents' package allowlists;
  * services:manage changes the coding-run service catalog, which decides what
- * runs next to every coding run that names an entry.
+ * runs next to every coding run that names an entry; admin:view reads every
+ * owner's runs (the admin viewer API); models:admin changes the model catalog,
+ * which prices every principal's runs.
  * A token scope only DELEGATES — it never authorizes on its own:
  * requireScope/requireAnyScope honour one only when one of the caller's
  * roles (McpRequestContext.roles, resolved live per request) grants it.
  */
-export const PRIVILEGED_SCOPES = ["agents:admin", "packages:approve", "services:manage"];
+export const PRIVILEGED_SCOPES = [
+    "agents:admin",
+    "packages:approve",
+    "services:manage",
+    "admin:view",
+    "models:admin",
+];
 /**
  * The built-in roles and the permissions (privileged scope names) each
  * grants. No roles = member: every non-privileged scope, nothing privileged.
  */
 export const ROLE_PERMISSIONS = {
-    admin: ["agents:admin", "packages:approve", "services:manage"],
+    admin: ["agents:admin", "packages:approve", "services:manage", "admin:view", "models:admin"],
     "package-approver": ["packages:approve"],
     "service-manager": ["services:manage"],
+    "model-manager": ["models:admin"],
 };
 export const ROLE_NAMES = Object.keys(ROLE_PERMISSIONS);
 export function isRoleName(name) {

package/dist/mcp/auth/self-hosted/credentials.d.ts

@@ -18,18 +18,18 @@ export declare class Credentials {
 }
 export declare function lockUser(tx: AuthDb, id: string): Promise<{
     principal: {
-        id: string;
         createdAt: Date;
+        id: string;
         subject: string;
     };
 } & {
     status: string;
-    id: string;
     createdAt: Date;
     updatedAt: Date;
-    principalId: string;
+    id: string;
     roles: string[];
     displayName: string | null;
+    principalId: string;
 }>;
 export declare class IdentityService {
     readonly db: PrismaClient;

package/dist/mcp/auth/self-hosted/session.d.ts

@@ -11,27 +11,27 @@ export declare class Sessions {
     get(token: string, tx?: AuthDb): Promise<{
         user: {
             principal: {
-                id: string;
                 createdAt: Date;
+                id: string;
                 subject: string;
             };
         } & {
             status: string;
-            id: string;
             createdAt: Date;
             updatedAt: Date;
-            principalId: string;
+            id: string;
             roles: string[];
             displayName: string | null;
+            principalId: string;
         };
     } & {
         createdAt: Date;
+        lastSeenAt: Date;
+        sessionId: string;
         expiresAt: Date;
         userId: string;
         secretHash: string;
         revokedAt: Date | null;
-        sessionId: string;
-        lastSeenAt: Date;
     }>;
     logout(token: string, challenge: string): Promise<void>;
 }

package/dist/mcp/context.d.ts

@@ -11,9 +11,12 @@ import type { Principal, PrismaClient } from "#prisma";
 import type { RequestStateAccessor } from "@modelcontextprotocol/server";
 import type { ProviderRegistry } from "../providers/index.js";
 import type { RepoAccessGate } from "../core/repo-access.js";
+import type { IssueTrackerRegistry } from "../providers/issue-tracker/types.js";
 import type { HostUserAuthorizerRegistry, ReviewHostRegistry } from "../providers/review-host/types.js";
 export type McpProviders = Pick<ProviderRegistry, "llm" | "engine" | "datastore" | "secrets" | "executor" | "memory"> & {
     reviewHosts?: ReviewHostRegistry;
+    /** Issue trackers (Jira); empty or absent = no issue-tracker integration. */
+    issueTrackers?: IssueTrackerRegistry;
     /** Identity linking (link_host_account); empty or absent = linking disabled. */
     hostUserAuthorizers?: HostUserAuthorizerRegistry;
     /**

package/dist/mcp/host-events/deliveries.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Shared housekeeping for the HostEventDelivery dedupe table. Every host
+ * ingress (GitHub, Jira) calls this after recording a delivery; one process
+ * clock keeps the prune to at most once an hour regardless of provider.
+ */
+import type { PrismaClient } from "#prisma";
+export declare function maybePruneHostEventDeliveries(db: Pick<PrismaClient, "hostEventDelivery">, now: Date): Promise<void>;
+/** Test-only: reset the prune clock. */
+export declare function resetPruneClockForTests(): void;

package/dist/mcp/host-events/deliveries.js

@@ -0,0 +1,17 @@
+import { logger } from "../../core/logger.js";
+const log = logger.child({ module: "host-event-deliveries" });
+const DELIVERY_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
+const PRUNE_INTERVAL_MS = 60 * 60 * 1000;
+let lastPruneAt = 0;
+export async function maybePruneHostEventDeliveries(db, now) {
+    if (now.getTime() - lastPruneAt <= PRUNE_INTERVAL_MS)
+        return;
+    lastPruneAt = now.getTime();
+    await db.hostEventDelivery
+        .deleteMany({ where: { receivedAt: { lt: new Date(now.getTime() - DELIVERY_RETENTION_MS) } } })
+        .catch((err) => log.warn({ err }, "delivery prune failed"));
+}
+/** Test-only: reset the prune clock. */
+export function resetPruneClockForTests() {
+    lastPruneAt = 0;
+}

package/dist/mcp/host-events/github-ingress.d.ts

@@ -7,6 +7,7 @@
 import { type PrismaClient } from "#prisma";
 import type { HostEventDb } from "../../core/host-events.js";
 import type { Executor } from "../../providers/executor/types.js";
+import type { IssueTrackerRegistry } from "../../providers/issue-tracker/types.js";
 import type { ReviewHostRegistry } from "../../providers/review-host/types.js";
 import type { RepoAccessGate } from "../../core/repo-access.js";
 export interface GitHubIngressDeps {
@@ -15,6 +16,8 @@ export interface GitHubIngressDeps {
     hosts: ReviewHostRegistry;
     /** Repository authorization for every dispatch, and the mention author's permission. */
     repoAccess: RepoAccessGate;
+    /** For a merged/closed PR's linked issue; absent → closed PRs are ignored. */
+    issueTrackers?: IssueTrackerRegistry;
     webhookSecret: string | undefined;
     appIdentity: () => Promise<{
         id: number;
@@ -32,5 +35,4 @@ export declare function handleGitHubEventIngress(req: {
     headers: Record<string, string | undefined>;
     rawBody: string;
 }, deps: GitHubIngressDeps): Promise<GitHubIngressResult>;
-/** Test-only: reset the prune clock. */
-export declare function resetPruneClockForTests(): void;
+export { resetPruneClockForTests } from "./deliveries.js";

package/dist/mcp/host-events/github-ingress.js

@@ -5,14 +5,12 @@
  * Nothing from the body is logged.
  */
 import { Prisma } from "#prisma";
+import { maybePruneHostEventDeliveries } from "./deliveries.js";
 import { routeHostEvent } from "../../core/host-events.js";
 import { logger } from "../../core/logger.js";
 import { normalizeGitHubEvent, verifyGitHubSignature } from "../../providers/review-host/github-events.js";
 const log = logger.child({ module: "github-ingress" });
-const DELIVERY_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
-const PRUNE_INTERVAL_MS = 60 * 60 * 1000;
 const SAFE_DELIVERY = /^[A-Za-z0-9-]{1,100}$/;
-let lastPruneAt = 0;
 export async function handleGitHubEventIngress(req, deps) {
     if (!deps.webhookSecret)
         return { status: 404, body: { error: "not_found" } };
@@ -49,12 +47,7 @@ export async function handleGitHubEventIngress(req, deps) {
         }
         throw err;
     }
-    if (now.getTime() - lastPruneAt > PRUNE_INTERVAL_MS) {
-        lastPruneAt = now.getTime();
-        await deps.db.hostEventDelivery
-            .deleteMany({ where: { receivedAt: { lt: new Date(now.getTime() - DELIVERY_RETENTION_MS) } } })
-            .catch((err) => log.warn({ err }, "delivery prune failed"));
-    }
+    await maybePruneHostEventDeliveries(deps.db, now);
     // The delivery row is recorded before routing so a duplicate can never
     // race past it, but that means a transient failure inside routeHostEvent
     // must not leave a delivery permanently marked "done" — GitHub's redelivery
@@ -67,6 +60,7 @@ export async function handleGitHubEventIngress(req, deps) {
             executor: deps.executor,
             hosts: deps.hosts,
             repoAccess: deps.repoAccess,
+            ...(deps.issueTrackers ? { issueTrackers: deps.issueTrackers } : {}),
             mentionHandle: app.slug,
         });
         log.info({ event: event.kind, repository: event.repository, deliveryId, runIds: routed.runIds }, "host event routed");
@@ -86,7 +80,4 @@ export async function handleGitHubEventIngress(req, deps) {
         throw err;
     }
 }
-/** Test-only: reset the prune clock. */
-export function resetPruneClockForTests() {
-    lastPruneAt = 0;
-}
+export { resetPruneClockForTests } from "./deliveries.js";

package/dist/mcp/host-events/jira-ingress.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Jira Cloud webhook ingress — framework-agnostic, mounted unauthenticated
+ * (by OAuth) in streamable-http.ts at /hosts/jira/events. Authenticated by the
+ * webhook secret (X-Hub-Signature, WebSub style) over the raw body. The
+ * delivery id (X-Atlassian-Webhook-Identifier) is stable across Jira's
+ * retries, so it is the dedupe key. Nothing from the body is logged.
+ */
+import { type PrismaClient } from "#prisma";
+import { type IssueEventDb } from "../../core/issue-events.js";
+import type { Executor } from "../../providers/executor/types.js";
+import type { IssueTrackerRegistry } from "../../providers/issue-tracker/types.js";
+export interface JiraIngressDeps {
+    db: IssueEventDb & Pick<PrismaClient, "hostEventDelivery">;
+    executor: Executor;
+    trackers: IssueTrackerRegistry;
+    webhookSecret: string;
+    /** Epoch-ms clock; injected by tests. */
+    now?: () => number;
+}
+export interface JiraIngressResult {
+    status: number;
+    body: Record<string, unknown>;
+    /** Cosmetic follow-ups to run after the response is sent. */
+    afterResponse?: () => Promise<void>;
+}
+export declare function handleJiraEventIngress(req: {
+    headers: Record<string, string | undefined>;
+    rawBody: string;
+}, deps: JiraIngressDeps): Promise<JiraIngressResult>;

package/dist/mcp/host-events/jira-ingress.js

@@ -0,0 +1,92 @@
+/**
+ * Jira Cloud webhook ingress — framework-agnostic, mounted unauthenticated
+ * (by OAuth) in streamable-http.ts at /hosts/jira/events. Authenticated by the
+ * webhook secret (X-Hub-Signature, WebSub style) over the raw body. The
+ * delivery id (X-Atlassian-Webhook-Identifier) is stable across Jira's
+ * retries, so it is the dedupe key. Nothing from the body is logged.
+ */
+import { Prisma } from "#prisma";
+import { maybePruneHostEventDeliveries } from "./deliveries.js";
+import { routeIssueEvent } from "../../core/issue-events.js";
+import { logger } from "../../core/logger.js";
+import { normalizeJiraEvent, verifyJiraSignature } from "../../providers/issue-tracker/jira-events.js";
+const log = logger.child({ module: "jira-ingress" });
+const SAFE_DELIVERY = /^[A-Za-z0-9._:-]{1,200}$/;
+/** Jira retries a delivery up to 5 times, 5-15 min apart, so 2 h comfortably covers a legitimate replay. */
+const MAX_AGE_MS = 2 * 60 * 60 * 1000;
+const MAX_FUTURE_MS = 5 * 60 * 1000;
+/**
+ * Whether the payload's top-level `timestamp` is inside the replay window.
+ * Assumed to be epoch milliseconds; a value below 1e12 (before 2001 in ms)
+ * is read as seconds. The unit is unverified against a live delivery.
+ * A missing or non-numeric timestamp is not fresh.
+ */
+function isFresh(payload, nowMs) {
+    const raw = payload?.timestamp;
+    if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0)
+        return false;
+    const ts = raw < 1e12 ? raw * 1000 : raw;
+    return ts >= nowMs - MAX_AGE_MS && ts <= nowMs + MAX_FUTURE_MS;
+}
+export async function handleJiraEventIngress(req, deps) {
+    const tracker = deps.trackers.jira;
+    if (!tracker)
+        return { status: 404, body: { error: "not_found" } };
+    if (!verifyJiraSignature(req.rawBody, req.headers["x-hub-signature"], deps.webhookSecret)) {
+        return { status: 401, body: { error: "invalid_signature" } };
+    }
+    // wardby must not act as a person. A lookup failure throws (5xx), so Jira retries the delivery.
+    const identity = await tracker.identity();
+    if (identity.accountType === "atlassian") {
+        log.error("Jira token belongs to a person; refusing deliveries (use a service account)");
+        return { status: 503, body: { error: "jira_personal_account" } };
+    }
+    const deliveryId = req.headers["x-atlassian-webhook-identifier"];
+    if (!deliveryId || !SAFE_DELIVERY.test(deliveryId)) {
+        return { status: 400, body: { error: "missing_delivery_headers" } };
+    }
+    let payload;
+    try {
+        payload = JSON.parse(req.rawBody);
+    }
+    catch {
+        return { status: 400, body: { error: "invalid_json" } };
+    }
+    // Replay protection: the signature covers the body, so an old captured delivery would otherwise verify forever.
+    if (!isFresh(payload, (deps.now ?? Date.now)()))
+        return { status: 202, body: { ignored: "stale" } };
+    const event = normalizeJiraEvent(payload, identity.accountId);
+    // An event we don't act on must never claim the delivery id (see the GitHub ingress).
+    if (!event)
+        return { status: 202, body: { ignored: true } };
+    try {
+        await deps.db.hostEventDelivery.create({ data: { provider: "jira", deliveryId } });
+    }
+    catch (err) {
+        if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === "P2002") {
+            return { status: 202, body: { duplicate: true } };
+        }
+        throw err;
+    }
+    await maybePruneHostEventDeliveries(deps.db, new Date());
+    // A routing failure must not leave the delivery permanently marked done:
+    // un-record it and rethrow so Jira's retry is routed for real.
+    try {
+        const routed = await routeIssueEvent(event, { db: deps.db, executor: deps.executor, trackers: deps.trackers });
+        log.info({ kinds: event.kinds, deliveryId, runIds: routed.runIds }, "jira event routed");
+        return {
+            status: 202,
+            body: { runIds: routed.runIds },
+            afterResponse: async () => {
+                for (const followUp of routed.followUps)
+                    await followUp();
+            },
+        };
+    }
+    catch (err) {
+        await deps.db.hostEventDelivery
+            .deleteMany({ where: { provider: "jira", deliveryId } })
+            .catch((delErr) => log.warn({ err: delErr }, "could not roll back the delivery record after a routing failure"));
+        throw err;
+    }
+}

package/dist/mcp/index.d.ts

@@ -12,6 +12,8 @@ export declare function localOperatorContext(principal: Principal, providers: Mc
 export declare function registerAllTools(mcp: WardbyMcpServer, opts: {
     secretElicitationUrl: SecretElicitationUrlBuilder;
     secretElicitationProtocol: boolean;
+    /** Rebuilds the process's installed model CatalogStore after set_model/disable_model/reset_model. */
+    refreshModelCatalog?: () => Promise<void>;
 }): void;
 export interface McpProviderComposition {
     providers: McpProviders;

package/dist/mcp/index.js

@@ -13,15 +13,17 @@
  * missing `AUTH_JWKS_URI`/`AUTH_SIGNING_KEY` a deployment running stdio-only
  * never needed to set.
  */
-import { loadProviderConfig, loadMcpConfig, loadShutdownDrainSeconds, loadAuthConfig, loadGitHubEventConfig, loadGitHubVcsConfig, } from "../config/providers.js";
+import { loadProviderConfig, loadMcpConfig, loadShutdownDrainSeconds, loadAuthConfig, loadGitHubEventConfig, loadJiraConfig, loadGitHubVcsConfig, } from "../config/providers.js";
 import { prisma } from "../core/db.js";
 import { waitForInFlightRuns } from "../core/in-flight-runs.js";
 import { NativeEngine } from "../core/engine-native.js";
 import { resolveLlmRegistrations, RoutingLlmProvider } from "../providers/llm/index.js";
+import { startModelCatalog } from "../providers/llm/catalog-store.js";
 import { PostgresDatastore } from "../providers/datastore/index.js";
 import { PostgresAgentMemory } from "../providers/memory/index.js";
 import { buildConfiguredExecutor, buildExecutor } from "../providers/executor/index.js";
 import { buildSecretCipher } from "../providers/secrets/index.js";
+import { buildIssueTrackers } from "../providers/issue-tracker/index.js";
 import { buildHostUserAuthorizers, buildReviewHosts } from "../providers/review-host/index.js";
 import { createRepoAccessGate } from "../core/repo-access.js";
 import { userCallbackPath } from "../core/host-identity-links.js";
@@ -32,21 +34,25 @@ import { countUnattendedSchedules, unattendedSchedulesWarning } from "./unattend
 import { runStdioServer } from "./transport/stdio.js";
 import { startHttpServer } from "./transport/streamable-http.js";
 import { resolvePrincipal } from "./auth/principal.js";
-import { ROLE_NAMES, SCOPES_SUPPORTED } from "./auth/resource-server.js";
+import { ROLE_NAMES, SCOPES_SUPPORTED, authenticate } from "./auth/resource-server.js";
 import { canonicalUrl } from "./transport/http-limits.js";
+import { createViewerApi } from "../viewer/http.js";
+import { createViewerEventBus } from "../viewer/event-bus.js";
 import { registerAgentTools } from "./tools/agents.js";
 import { registerServiceTools } from "./tools/services.js";
 import { registerBudgetGroupTools } from "./tools/budget-groups.js";
-import { registerModelTools } from "./tools/models.js";
+import { registerModelCatalogTools } from "./tools/model-catalog.js";
 import { registerHelpTools } from "./tools/help.js";
 import { registerTriggerTool } from "./tools/trigger.js";
 import { registerToolAuthoringTools } from "./tools/tools.js";
 import { registerSchedulingTools } from "./tools/scheduling.js";
 import { registerRunTools } from "./tools/runs.js";
+import { registerCostReportTools } from "./tools/cost-report.js";
 import { registerDatastoreTools } from "./tools/datastore.js";
 import { registerSubAgentTools } from "./tools/subagents.js";
 import { registerGrantTools } from "./tools/grants.js";
 import { registerRepositoryTools } from "./tools/repositories.js";
+import { registerIssueProjectTools } from "./tools/issue-projects.js";
 import { registerHostAccountTools } from "./tools/host-accounts.js";
 import { registerMemoryTools } from "./tools/memory.js";
 import { registerSecretsTools } from "./tools/secrets.js";
@@ -97,16 +103,18 @@ export function registerAllTools(mcp, opts) {
     registerAgentTools(mcp);
     registerServiceTools(mcp);
     registerBudgetGroupTools(mcp);
-    registerModelTools(mcp);
+    registerModelCatalogTools(mcp, { refresh: opts.refreshModelCatalog });
     registerHelpTools(mcp);
     registerTriggerTool(mcp);
     registerToolAuthoringTools(mcp);
     registerSchedulingTools(mcp);
     registerRunTools(mcp);
+    registerCostReportTools(mcp);
     registerDatastoreTools(mcp);
     registerSubAgentTools(mcp);
     registerGrantTools(mcp);
     registerRepositoryTools(mcp);
+    registerIssueProjectTools(mcp);
     registerHostAccountTools(mcp);
     registerMemoryTools(mcp);
     registerSecretsTools(mcp, {
@@ -128,6 +136,7 @@ export function buildMcpProviders() {
     const datastore = new PostgresDatastore(prisma, secrets);
     const memory = new PostgresAgentMemory(prisma);
     const reviewHosts = buildReviewHosts();
+    const issueTrackers = buildIssueTrackers();
     const hostUserAuthorizers = buildHostUserAuthorizers();
     // One gate (and one cache) for the whole process: set-time checks in the
     // MCP tools, repo_* calls in native runs, coding runs, and host events.
@@ -140,12 +149,32 @@ export function buildMcpProviders() {
     // through the same composed executor everything else uses. There's no
     // way to hand the native executor a reference to its own wrapping
     // RoutingExecutor before that wrapper is constructed.
-    const nativeProviders = { llm, engine, datastore, secrets, memory, reviewHosts, repoAccess };
+    const nativeProviders = {
+        llm,
+        engine,
+        datastore,
+        secrets,
+        memory,
+        reviewHosts,
+        issueTrackers,
+        repoAccess,
+    };
     const nativeExecutor = buildExecutor(providerConfig, nativeProviders, prisma);
     const executor = buildConfiguredExecutor({ native: nativeExecutor, db: prisma, providerConfig, repoAccess });
     nativeProviders.executor = executor;
     return {
-        providers: { llm, engine, datastore, secrets, executor, memory, reviewHosts, hostUserAuthorizers, repoAccess },
+        providers: {
+            llm,
+            engine,
+            datastore,
+            secrets,
+            executor,
+            memory,
+            reviewHosts,
+            issueTrackers,
+            hostUserAuthorizers,
+            repoAccess,
+        },
     };
 }
 /** Awaits `promise` (if any), logging and swallowing a rejection instead of propagating it. */
@@ -162,6 +191,14 @@ export async function startMcp(options = {}) {
     const mcpConfig = loadMcpConfig();
     // Parsed up front so a malformed value fails at startup, not at shutdown.
     const drainSeconds = loadShutdownDrainSeconds();
+    // Loads the model catalog before anything else: running on the shipped
+    // catalog alone (the fallback currentModelCatalog() uses before a store
+    // is installed) would quietly re-enable models an admin turned off.
+    // `modelCatalog` is handed to registerAllTools as `refreshModelCatalog`,
+    // which the model catalog tools (set_model, disable_model, reset_model)
+    // call via `modelCatalog.refreshNow()` after each write — there is no
+    // separate refresh tool.
+    const modelCatalog = await startModelCatalog(prisma);
     const providers = options.providers ?? buildMcpProviders().providers;
     await providers.executor.launch?.();
     if (!options.schedulerAttached)
@@ -176,6 +213,7 @@ export async function startMcp(options = {}) {
         registerAllTools(mcp, {
             secretElicitationUrl: (token) => secretElicitationHost.urlFor(token),
             secretElicitationProtocol: mcpConfig.secretElicitationProtocol,
+            refreshModelCatalog: () => modelCatalog.refreshNow(),
         });
         // stdio never carries per-call AuthInfo — one fixed, fully-trusted
         // local identity for the whole connection, per the design's own
@@ -187,6 +225,7 @@ export async function startMcp(options = {}) {
             close: async () => {
                 await closeQuietly(stdio.close(), "stdio transport close");
                 await closeQuietly(providers.executor.close?.(), "executor close");
+                modelCatalog.close();
             },
         };
     }
@@ -209,17 +248,19 @@ export async function startMcp(options = {}) {
     registerAllTools(mcp, {
         secretElicitationUrl: (token) => Promise.resolve(`${httpOrigin}${SECRET_ELICITATION_PATH}?t=${encodeURIComponent(token)}`),
         secretElicitationProtocol: mcpConfig.secretElicitationProtocol,
+        refreshModelCatalog: () => modelCatalog.refreshNow(),
     });
     const eventConfig = loadGitHubEventConfig();
     const githubConfig = loadGitHubVcsConfig();
     const reviewHosts = providers.reviewHosts;
-    const hostEvents = eventConfig.webhookSecret && reviewHosts?.github && githubConfig.appId && githubConfig.privateKey
+    const githubEvents = eventConfig.webhookSecret && reviewHosts?.github && githubConfig.appId && githubConfig.privateKey
         ? {
             github: {
                 db: prisma,
                 executor: providers.executor,
                 hosts: reviewHosts,
                 repoAccess: providers.repoAccess ?? createRepoAccessGate({ db: prisma, hosts: reviewHosts }),
+                ...(providers.issueTrackers ? { issueTrackers: providers.issueTrackers } : {}),
                 webhookSecret: eventConfig.webhookSecret,
                 appIdentity: (() => {
                     const client = new GitHubAppClient({
@@ -232,7 +273,29 @@ export async function startMcp(options = {}) {
             },
         }
         : undefined;
-    mcpLog.info({ enabled: Boolean(hostEvents) }, "GitHub host events ingress");
+    mcpLog.info({ enabled: Boolean(githubEvents) }, "GitHub host events ingress");
+    const jiraConfig = loadJiraConfig();
+    const jiraEvents = jiraConfig && providers.issueTrackers?.jira
+        ? {
+            db: prisma,
+            executor: providers.executor,
+            trackers: providers.issueTrackers,
+            webhookSecret: jiraConfig.webhookSecret,
+        }
+        : undefined;
+    mcpLog.info({ enabled: Boolean(jiraEvents) }, "Jira host events ingress");
+    if (jiraEvents) {
+        // Best effort: show which Jira account wardby acts as; never blocks startup.
+        void providers.issueTrackers?.jira?.identity().then(({ accountId, displayName, accountType }) => accountType === "atlassian"
+            ? mcpLog.error({ accountId, displayName, accountType }, "Jira token belongs to a person's account; wardby refuses to act and the Jira ingress answers 503 until a service account token is configured")
+            : mcpLog.info({ accountId, displayName, accountType }, "Jira acting as"), (err) => mcpLog.warn({ err: err instanceof Error ? err.message : String(err) }, "could not read the Jira account identity"));
+    }
+    if (jiraConfig?.tokenExpiresAt && jiraConfig.tokenExpiresAt.getTime() - Date.now() < 14 * 24 * 60 * 60 * 1000) {
+        mcpLog.warn({ expiresAt: jiraConfig.tokenExpiresAt.toISOString() }, "the Jira API token expires within 14 days; rotate WARDBY_JIRA_API_TOKEN");
+    }
+    const hostEvents = githubEvents || jiraEvents
+        ? { ...(githubEvents ? githubEvents : {}), ...(jiraEvents ? { jira: jiraEvents } : {}) }
+        : undefined;
     const githubAuthorizer = providers.hostUserAuthorizers?.github;
     const hostUserAuth = githubAuthorizer
         ? {
@@ -244,10 +307,22 @@ export async function startMcp(options = {}) {
         }
         : undefined;
     mcpLog.info({ enabled: Boolean(hostUserAuth) }, "GitHub account linking");
+    const canonicalHref = canonicalUrl(mcpConfig.canonicalUri).href;
+    const viewerBus = process.env.DATABASE_URL
+        ? createViewerEventBus({ connectionString: process.env.DATABASE_URL })
+        : undefined;
+    const viewer = viewerBus
+        ? createViewerApi({
+            db: prisma,
+            bus: viewerBus,
+            authenticate: (authorization) => authenticate({ authorization }, { authProvider, db: prisma, providers, canonicalUri: canonicalHref }),
+            canonicalUri: canonicalHref,
+        })
+        : undefined;
     const http = await startHttpServer({
         mcp,
         config: {
-            canonicalUri: canonicalUrl(mcpConfig.canonicalUri).href,
+            canonicalUri: canonicalHref,
             httpBind: mcpConfig.httpBind,
             authProviderKind,
             authorizationServer: authConfig.issuer,
@@ -257,6 +332,7 @@ export async function startMcp(options = {}) {
         selfHosted,
         hostEvents,
         hostUserAuth,
+        viewer,
     });
     const cleanupTimer = selfHosted
         ? setInterval(() => {
@@ -268,10 +344,12 @@ export async function startMcp(options = {}) {
             if (cleanupTimer)
                 clearInterval(cleanupTimer);
             await closeQuietly(http.close(), "HTTP transport close");
+            await closeQuietly(viewerBus?.close(), "viewer event bus close");
             // Let the runs this instance is executing finish before the executor
             // closes under them; a run abandoned here is lost, never resumed.
             await waitForInFlightRuns(drainSeconds * 1000);
             await closeQuietly(providers.executor.close?.(), "executor close");
+            modelCatalog.close();
         },
     };
 }

package/dist/mcp/server.js

@@ -24,12 +24,15 @@
  */
 import { McpServer, fromJsonSchema, createRequestStateCodec, CLIENT_CAPABILITIES_META_KEY, } from "@modelcontextprotocol/server";
 import { randomBytes } from "node:crypto";
+import { readFileSync } from "node:fs";
 import { requireScope } from "./auth/resource-server.js";
 import { McpError, mapPrismaError } from "./errors.js";
 import { TASKS_EXTENSION_ID, clientSupportsTasks } from "./capabilities.js";
 import { readableAgentsWhere } from "./auth/access.js";
 import { grantedIds } from "../core/grants.js";
 import { logger } from "../core/logger.js";
+/** The package version, reported in MCP server info (package.json sits two levels up from src/mcp and dist/mcp). */
+const SERVER_VERSION = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")).version;
 const REQUEST_STATE_KEY_BYTES = 32;
 /**
  * REQUEST_STATE_KEY (hex, 32 bytes) shares the requestState HMAC key across
@@ -55,7 +58,7 @@ function loadRequestStateKey(env) {
  * with the per-agent MCP prompts registered below, which are the concrete,
  * one-call way to actually do it.
  */
-const SERVER_INSTRUCTIONS = 'wardby hosts reusable LLM agents (a system prompt, model, budget, and attached tools) that normally run on a schedule or webhook trigger. Every agent\'s full system prompt is available via list_agents/get_agent ("systemPrompt" field), and agents you can see are also registered as MCP prompts by name — you can adopt an agent\'s instructions and run them yourself, in this session, right now. This is a good way to shift work like code review left: e.g., before committing, run the "systemPrompt" of a code-review agent against your own working tree using your own tools, rather than waiting for a separately triggered run. Where a pulled prompt names a wardby-specific sandboxed tool, use your own equivalent tool for the same purpose instead.';
+const SERVER_INSTRUCTIONS = 'wardby hosts reusable LLM agents (a system prompt, model, budget, and attached tools) that normally run on a schedule or webhook trigger. Every agent\'s full system prompt is available via list_agents/get_agent ("systemPrompt" field), and agents you can see are also registered as MCP prompts by name — you can adopt an agent\'s instructions and run them yourself, in this session, right now. This is a good way to shift work like code review left: e.g., before committing, run the "systemPrompt" of a code-review agent against your own working tree using your own tools, rather than waiting for a separately triggered run. Where a pulled prompt names a wardby-specific sandboxed tool, use your own equivalent tool for the same purpose instead. To set up a first agent — an architecture keeper or a builder — read the help article "agent-recipes" with get_help_article and follow its procedure.';
 /** The MCP prompt body for one Agent — the message a client injects when a user invokes it (e.g. as a slash command). */
 function agentPromptText(agent) {
     return [
@@ -119,7 +122,7 @@ export function buildMcpServer(opts) {
         requestHandlers.push({ method, scope: Array.isArray(scope) ? scope : [scope], handler });
     }
     const factory = async () => {
-        const mcpServer = new McpServer({ name: "wardby", version: "0.0.0" }, {
+        const mcpServer = new McpServer({ name: "wardby", version: SERVER_VERSION }, {
             requestState: { verify: (state, ctx) => requestStateCodec.verify(state, ctx) },
             instructions: SERVER_INSTRUCTIONS,
         });