@wardby/cli 0.5.2 → 0.6.0

package/dist/import/create.js

@@ -14,6 +14,16 @@ import { PostgresDatastore } from "../providers/datastore/postgres.js";
 import { decryptTransferEnvelope } from "../providers/secrets/transfer-envelope.js";
 import { mapBudget } from "./budgets.js";
 import { EVERYONE_KEY, everyoneGrantData } from "../core/grants.js";
+import { loadNativeSandboxConfig } from "../config/providers.js";
+/** Whether this process has a native sandbox configured; a bad configuration counts as not configured. */
+function nativeSandboxConfigured() {
+    try {
+        return loadNativeSandboxConfig(process.env) !== undefined;
+    }
+    catch {
+        return false;
+    }
+}
 export async function createFromBundle(bundle, recon, opts) {
     const { db, cipher, ownerId, secretMode, transferPrivateKey, allowOpenFetch } = opts;
     const agentOwnerId = opts.agentOwnerId === undefined ? ownerId : opts.agentOwnerId;
@@ -91,9 +101,16 @@ export async function createFromBundle(bundle, recon, opts) {
                 maxTurns: a.maxTurns,
                 scheduleEnabled,
                 ownerId: agentOwnerId,
+                ...(a.nativeExecutionMode
+                    ? { nativeExecutionMode: a.nativeExecutionMode === "sandbox" ? "sandbox" : "control_plane" }
+                    : {}),
             },
             update: {},
         });
+        if (a.nativeExecutionMode === "sandbox" && !nativeSandboxConfigured()) {
+            warnings.push(`agent ${a.name}: nativeExecutionMode is "sandbox" but NATIVE_SANDBOX_LAUNCHER is not configured here; ` +
+                "its runs fail with native_sandbox_unavailable until the server that runs it has a native sandbox");
+        }
         agentIdMap.set(a.name, agent.id);
         if (agentOwnerId !== null && agent.ownerId === agentOwnerId) {
             ownedAgentIds.add(agent.id);

package/dist/import/neutral-schema.d.ts

@@ -93,6 +93,8 @@ export declare const NeutralAgentSchema: z.ZodObject<{
     ownerEmail: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     kind: z.ZodDefault<z.ZodEnum<["native"]>>;
     memoryEnabled: z.ZodDefault<z.ZodBoolean>;
+    /** Where the agent's runs execute; absent = control-plane. Native agents only (every imported agent is native). */
+    nativeExecutionMode: z.ZodOptional<z.ZodEnum<["control-plane", "sandbox"]>>;
     unmodeled: z.ZodDefault<z.ZodObject<{
         description: z.ZodOptional<z.ZodDefault<z.ZodNullable<z.ZodString>>>;
         slug: z.ZodOptional<z.ZodDefault<z.ZodNullable<z.ZodString>>>;
@@ -125,6 +127,7 @@ export declare const NeutralAgentSchema: z.ZodObject<{
         slug?: string | null | undefined;
         emailAllowlist?: unknown;
     };
+    nativeExecutionMode?: "sandbox" | "control-plane" | undefined;
 }, {
     name: string;
     model: string;
@@ -134,6 +137,7 @@ export declare const NeutralAgentSchema: z.ZodObject<{
     systemPrompt: string;
     scheduleEnabled: boolean;
     kind?: "native" | undefined;
+    nativeExecutionMode?: "sandbox" | "control-plane" | undefined;
     schedule?: string | null | undefined;
     timezone?: string | undefined;
     memoryEnabled?: boolean | undefined;
@@ -252,12 +256,12 @@ export declare const NeutralAgentSecretSchema: z.ZodObject<{
     secretName: z.ZodString;
     alias: z.ZodDefault<z.ZodNullable<z.ZodString>>;
 }, "strip", z.ZodTypeAny, {
-    agentName: string;
     secretName: string;
+    agentName: string;
     alias: string | null;
 }, {
-    agentName: string;
     secretName: string;
+    agentName: string;
     alias?: string | null | undefined;
 }>;
 export type NeutralAgentSecret = z.infer<typeof NeutralAgentSecretSchema>;

package/dist/import/neutral-schema.js

@@ -34,6 +34,8 @@ export const NeutralAgentSchema = z.object({
     ownerEmail: z.string().nullable().default(null),
     kind: z.enum(["native"]).default("native"),
     memoryEnabled: z.boolean().default(false),
+    /** Where the agent's runs execute; absent = control-plane. Native agents only (every imported agent is native). */
+    nativeExecutionMode: z.enum(["control-plane", "sandbox"]).optional(),
     unmodeled: z
         .object({
         description: z.string().nullable().default(null),

package/dist/mcp/auth/access.d.ts

@@ -46,6 +46,7 @@ export declare function requireAgentAccess(ctx: McpRequestContext, id: string, r
         kind: import("#prisma").AgentKind;
         id: string;
         ownerId: string | null;
+        nativeExecutionMode: import("#prisma").NativeExecutionMode;
         systemPrompt: string;
         schedule: string | null;
         timezone: string;

package/dist/mcp/auth/ownership.d.ts

@@ -72,9 +72,9 @@ export declare function assertStrictlyOwnedTool(tool: Tool | null, id: string, p
  * triggered them. No canRead/null=public path exists here on purpose.
  */
 export declare function requireOwnedTask(db: PrismaClient, taskId: string, principalId: string): Promise<{
+    error: import("@prisma/client/runtime/client").JsonValue | null;
     status: import("#prisma").TaskStatus;
     runId: string | null;
-    error: import("@prisma/client/runtime/client").JsonValue | null;
     createdAt: Date;
     updatedAt: Date;
     kind: import("#prisma").TaskKind;

package/dist/mcp/auth/repo-authorization.js

@@ -6,6 +6,7 @@
  * side and the rules; the host call happens here, before any transaction.
  */
 import { LocalRepoError, isLocalRepository, loadLocalRepoRoots, resolveLocalRepository, } from "../../coding/local-repo.js";
+import { GITHUB_ACCOUNT_NOT_ALLOWED } from "../../config/github-allowed-accounts.js";
 import { requiredLevel } from "../../core/repo-access.js";
 import { McpError } from "../errors.js";
 import { requireScope } from "./resource-server.js";
@@ -39,6 +40,13 @@ export async function authorizeRepositoryForSet(ctx, input) {
         await canonicalLocalRepository(input.repository);
         return stamp("local_root");
     }
+    // A server-wide boundary: no admin approval reaches past it.
+    const accountDenied = await ctx.providers.repoAccess?.checkAccount?.(input.provider, input.repository);
+    if (accountDenied && !accountDenied.ok) {
+        if (accountDenied.reason === "github_account_not_allowed")
+            throw accountNotAllowed(input.repository);
+        throw new McpError(503, `Could not check whether ${input.repository}'s GitHub account is served right now; try again later.`);
+    }
     if (input.adminOverride) {
         // Role-gated: the scope alone never suffices (resource-server.ts).
         requireScope(ctx, ctx.canonicalUri, "agents:admin");
@@ -66,7 +74,13 @@ export async function authorizeRepositoryForSet(ctx, input) {
         case "insufficient_permission":
             throw new McpError(403, `Your linked GitHub account has ${decision.level ?? "no"} access to ${input.repository}; ` +
                 `this needs ${required}. Ask a repository admin for access, or a wardby admin to approve it (adminOverride).`);
+        case "github_account_not_allowed":
+            throw accountNotAllowed(input.repository);
         default:
             throw new McpError(503, `Could not verify your GitHub access to ${input.repository} right now (is the GitHub App installed on it?). Try again.`);
     }
 }
+function accountNotAllowed(repository) {
+    return new McpError(403, `${GITHUB_ACCOUNT_NOT_ALLOWED}: ${repository} belongs to a GitHub account this server does not serve. ` +
+        "An operator can add the account to WARDBY_GITHUB_ALLOWED_ACCOUNTS.");
+}

package/dist/mcp/auth/resource-server.d.ts

@@ -18,7 +18,8 @@ export declare const SCOPES_SUPPORTED: string[];
  * services:manage changes the coding-run service catalog, which decides what
  * runs next to every coding run that names an entry; admin:view reads every
  * owner's runs (the admin viewer API); models:admin changes the model catalog,
- * which prices every principal's runs.
+ * which prices every principal's runs; power:manage scales the shared coding
+ * proxy and native gateway to zero (power_sleep) and reads their state.
  * A token scope only DELEGATES — it never authorizes on its own:
  * requireScope/requireAnyScope honour one only when one of the caller's
  * roles (McpRequestContext.roles, resolved live per request) grants it.

package/dist/mcp/auth/resource-server.js

@@ -27,6 +27,9 @@ export const SCOPES_SUPPORTED = [
     // Add, override, disable and reset model catalog entries (see docs/models.md).
     // Reading the catalog (list_models, get_model) is agents:read.
     "models:admin",
+    // Scale the coding proxy and native gateway to zero now (power_sleep) and
+    // read their state (power_status); low-power mode only (docs/getting-started-gke.md).
+    "power:manage",
 ];
 /**
  * Scopes whose operations reach beyond the caller's own (or public)
@@ -36,7 +39,8 @@ export const SCOPES_SUPPORTED = [
  * services:manage changes the coding-run service catalog, which decides what
  * runs next to every coding run that names an entry; admin:view reads every
  * owner's runs (the admin viewer API); models:admin changes the model catalog,
- * which prices every principal's runs.
+ * which prices every principal's runs; power:manage scales the shared coding
+ * proxy and native gateway to zero (power_sleep) and reads their state.
  * A token scope only DELEGATES — it never authorizes on its own:
  * requireScope/requireAnyScope honour one only when one of the caller's
  * roles (McpRequestContext.roles, resolved live per request) grants it.
@@ -47,13 +51,14 @@ export const PRIVILEGED_SCOPES = [
     "services:manage",
     "admin:view",
     "models:admin",
+    "power:manage",
 ];
 /**
  * The built-in roles and the permissions (privileged scope names) each
  * grants. No roles = member: every non-privileged scope, nothing privileged.
  */
 export const ROLE_PERMISSIONS = {
-    admin: ["agents:admin", "packages:approve", "services:manage", "admin:view", "models:admin"],
+    admin: ["agents:admin", "packages:approve", "services:manage", "admin:view", "models:admin", "power:manage"],
     "package-approver": ["packages:approve"],
     "service-manager": ["services:manage"],
     "model-manager": ["models:admin"],

package/dist/mcp/auth/self-hosted/browser.d.ts

@@ -1,3 +1,3 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
-import type { SelfHostedAuthProvider } from "../../../providers/auth/self-hosted.js";
+import { type SelfHostedAuthProvider } from "../../../providers/auth/self-hosted.js";
 export declare function browserHandler(provider: SelfHostedAuthProvider): (req: IncomingMessage, res: ServerResponse, url: URL, body: unknown) => Promise<boolean>;

package/dist/mcp/auth/self-hosted/browser.js

@@ -1,4 +1,5 @@
 import { randomUUID, randomBytes } from "node:crypto";
+import { MobileDisabledError } from "../../../providers/auth/self-hosted.js";
 import { PostgresRateLimiter, RateLimitError } from "./rate-limit.js";
 import { logger } from "../../../core/logger.js";
 import { PAGE_STYLE } from "../../shared/page-style.js";
@@ -120,12 +121,24 @@ export function browserHandler(provider) {
                 // here is already a public PKCE client with validated redirect URIs.
                 if (p.application_type !== undefined && p.application_type !== "native" && p.application_type !== "web")
                     throw new Error("unsupported application_type");
-                const registered = await provider.registerClient({
-                    redirectUris: p.redirect_uris,
-                    clientName: p.client_name,
-                    grantTypes: p.grant_types,
-                    tokenEndpointAuthMethod: p.token_endpoint_auth_method,
-                });
+                let registered;
+                try {
+                    registered = await provider.registerClient({
+                        redirectUris: p.redirect_uris,
+                        clientName: p.client_name,
+                        grantTypes: p.grant_types,
+                        tokenEndpointAuthMethod: p.token_endpoint_auth_method,
+                    });
+                }
+                catch (err) {
+                    // The one registration error that names its reason: the operator
+                    // must turn mobile sign-in on. Everything else stays generic below.
+                    if (err instanceof MobileDisabledError) {
+                        json(res, 400, { error: "invalid_redirect_uri", error_description: err.message });
+                        return true;
+                    }
+                    throw err;
+                }
                 json(res, 201, {
                     client_id: registered.clientId,
                     token_endpoint_auth_method: "none",

package/dist/mcp/context.d.ts

@@ -13,10 +13,14 @@ import type { ProviderRegistry } from "../providers/index.js";
 import type { RepoAccessGate } from "../core/repo-access.js";
 import type { IssueTrackerRegistry } from "../providers/issue-tracker/types.js";
 import type { HostUserAuthorizerRegistry, ReviewHostRegistry } from "../providers/review-host/types.js";
+import type { Power } from "../core/power.js";
+import type { ChatProviderRegistry } from "../providers/chat/types.js";
 export type McpProviders = Pick<ProviderRegistry, "llm" | "engine" | "datastore" | "secrets" | "executor" | "memory"> & {
     reviewHosts?: ReviewHostRegistry;
     /** Issue trackers (Jira); empty or absent = no issue-tracker integration. */
     issueTrackers?: IssueTrackerRegistry;
+    /** Chat providers for workflow notifications (Slack); empty or absent = notifications off. */
+    chat?: ChatProviderRegistry;
     /** Identity linking (link_host_account); empty or absent = linking disabled. */
     hostUserAuthorizers?: HostUserAuthorizerRegistry;
     /**
@@ -25,6 +29,8 @@ export type McpProviders = Pick<ProviderRegistry, "llm" | "engine" | "datastore"
      * only admin approvals still work.
      */
     repoAccess?: RepoAccessGate;
+    /** Low-power mode (scale idle proxy/gateway to zero); absent = DISABLED_POWER. */
+    power?: Power;
 };
 export interface McpRequestContext {
     principal: Principal;

package/dist/mcp/host-events/github-ingress.d.ts

@@ -19,10 +19,22 @@ export interface GitHubIngressDeps {
     /** For a merged/closed PR's linked issue; absent → closed PRs are ignored. */
     issueTrackers?: IssueTrackerRegistry;
     webhookSecret: string | undefined;
-    appIdentity: () => Promise<{
+    /**
+     * The App's id, slug, and owner (the owner is always served). Throwing fails
+     * the request closed. `fresh` bypasses any cache; it is used before an
+     * uninstall, since the owner can change while the server runs.
+     */
+    appIdentity: (opts?: {
+        fresh?: boolean;
+    }) => Promise<{
         id: number;
         slug: string;
+        ownerLogin: string;
     }>;
+    /** Accounts served in addition to the App's owner (WARDBY_GITHUB_ALLOWED_ACCOUNTS). */
+    allowedAccounts: () => ReadonlySet<string>;
+    /** Removes the App from an installation on an account that isn't served; absent = ignore only. */
+    uninstallInstallation?: (installationId: number) => Promise<void>;
     now?: () => Date;
 }
 export interface GitHubIngressResult {
@@ -31,6 +43,16 @@ export interface GitHubIngressResult {
     /** Cosmetic follow-ups (reactions) to run after the response is sent. */
     afterResponse?: () => Promise<void>;
 }
+/**
+ * Which GitHub account an event belongs to. Installation events name it on
+ * the installation; repository events carry only installation.id, so the
+ * repository's owner stands in.
+ */
+export declare function eventAccount(eventName: string, payload: unknown): {
+    login: string;
+    installationId?: number;
+    uninstall: boolean;
+} | undefined;
 export declare function handleGitHubEventIngress(req: {
     headers: Record<string, string | undefined>;
     rawBody: string;

package/dist/mcp/host-events/github-ingress.js

@@ -9,8 +9,38 @@ import { maybePruneHostEventDeliveries } from "./deliveries.js";
 import { routeHostEvent } from "../../core/host-events.js";
 import { logger } from "../../core/logger.js";
 import { normalizeGitHubEvent, verifyGitHubSignature } from "../../providers/review-host/github-events.js";
+import { isGitHubAccountAllowed, trustedAccounts } from "../../config/github-allowed-accounts.js";
 const log = logger.child({ module: "github-ingress" });
 const SAFE_DELIVERY = /^[A-Za-z0-9-]{1,100}$/;
+const INSTALLATION_EVENTS = new Set(["installation", "installation_repositories"]);
+function field(value, key) {
+    return value !== null && typeof value === "object" ? value[key] : undefined;
+}
+/**
+ * Which GitHub account an event belongs to. Installation events name it on
+ * the installation; repository events carry only installation.id, so the
+ * repository's owner stands in.
+ */
+export function eventAccount(eventName, payload) {
+    if (INSTALLATION_EVENTS.has(eventName)) {
+        const installation = field(payload, "installation");
+        const login = field(field(installation, "account"), "login");
+        const id = field(installation, "id");
+        if (typeof login !== "string" || login === "")
+            return undefined;
+        return {
+            login,
+            ...(typeof id === "number" && Number.isSafeInteger(id) && id > 0 ? { installationId: id } : {}),
+            uninstall: field(payload, "action") !== "deleted",
+        };
+    }
+    const repository = field(payload, "repository");
+    const fullName = field(repository, "full_name");
+    const owner = typeof fullName === "string" && fullName.includes("/")
+        ? fullName.split("/", 1)[0]
+        : field(field(repository, "owner"), "login");
+    return typeof owner === "string" && owner !== "" ? { login: owner, uninstall: false } : undefined;
+}
 export async function handleGitHubEventIngress(req, deps) {
     if (!deps.webhookSecret)
         return { status: 404, body: { error: "not_found" } };
@@ -31,6 +61,44 @@ export async function handleGitHubEventIngress(req, deps) {
         return { status: 400, body: { error: "invalid_json" } };
     }
     const app = await deps.appIdentity();
+    const account = eventAccount(eventName, payload);
+    if (account && !isGitHubAccountAllowed(trustedAccounts(app.ownerLogin, deps.allowedAccounts()), account.login)) {
+        // Never the body: only the account and what we do about it.
+        log.warn({ event: eventName, account: account.login, installationId: account.installationId, deliveryId }, "GitHub event from an account this server does not serve ignored");
+        const uninstall = deps.uninstallInstallation;
+        const installationId = account.installationId;
+        return {
+            status: 202,
+            body: { ignored: "account_not_allowed" },
+            ...(account.uninstall && uninstall && installationId !== undefined
+                ? {
+                    afterResponse: async () => {
+                        // Destructive, so re-check against a fresh owner read: the cached
+                        // owner may be stale after an ownership transfer or rename.
+                        let fresh;
+                        try {
+                            fresh = await deps.appIdentity({ fresh: true });
+                        }
+                        catch (err) {
+                            log.warn({ err, account: account.login, installationId }, "could not re-read the App owner; not removing the App from the installation");
+                            return;
+                        }
+                        if (isGitHubAccountAllowed(trustedAccounts(fresh.ownerLogin, deps.allowedAccounts()), account.login)) {
+                            log.info({ account: account.login, installationId }, "account is served after re-reading the App owner; not removing the App from the installation");
+                            return;
+                        }
+                        try {
+                            await uninstall(installationId);
+                            log.warn({ account: account.login, installationId }, "removed the App from an installation on an account this server does not serve");
+                        }
+                        catch (err) {
+                            log.warn({ err, account: account.login, installationId }, "could not remove the App from a foreign installation");
+                        }
+                    },
+                }
+                : {}),
+        };
+    }
     const event = normalizeGitHubEvent(eventName, payload, app);
     // An event we don't act on must never claim the delivery id: recording it
     // here would let a later, real delivery of the same id (GitHub does reuse

package/dist/mcp/index.d.ts

@@ -37,5 +37,18 @@ export interface StartMcpOptions {
      */
     schedulerAttached?: boolean;
 }
+/**
+ * Fire-and-forget: starts the executor's start-up warm-up (e.g. KubernetesJobLauncher's memoized
+ * cluster preflight, via RoutingExecutor -> ContainerExecutor -> the job launcher's own `warmUp`)
+ * right when a long-running server process starts, so its first coding run doesn't pay for it.
+ * Never awaited by its caller and never throws: `warmUp()` on every implementation already swallows
+ * its own failure (logging it instead), but this still guards the call site against a surprise
+ * rejection, since nothing here may block or fail server start-up. Called from `startMcp` below —
+ * i.e. from `wardby mcp` (stdio and HTTP) and from `wardby serve`, which shares this same start-up
+ * path — and, separately, from `cli.ts`'s `scheduler()` (`wardby scheduler`), which dispatches
+ * scheduled coding runs through its own Kubernetes executor but never starts an MCP server. Never
+ * called from a one-shot CLI command (`wardby run`, `coding preflight`, migrations, imports).
+ */
+export declare function warmUpExecutor(executor: Pick<McpProviders["executor"], "warmUp">): void;
 /** The real CLI entry point: `wardby mcp`. Reads config from the environment, starts stdio or HTTP per MCP_TRANSPORT. */
 export declare function startMcp(options?: StartMcpOptions): Promise<McpServerHandle>;

package/dist/mcp/index.js

@@ -22,14 +22,18 @@ import { startModelCatalog } from "../providers/llm/catalog-store.js";
 import { PostgresDatastore } from "../providers/datastore/index.js";
 import { PostgresAgentMemory } from "../providers/memory/index.js";
 import { buildConfiguredExecutor, buildExecutor } from "../providers/executor/index.js";
+import { buildNativeSandboxExecutor } from "../native-worker/composition.js";
 import { buildSecretCipher } from "../providers/secrets/index.js";
 import { buildIssueTrackers } from "../providers/issue-tracker/index.js";
 import { buildHostUserAuthorizers, buildReviewHosts } from "../providers/review-host/index.js";
+import { buildChatProviders } from "../providers/chat/index.js";
 import { createRepoAccessGate } from "../core/repo-access.js";
 import { userCallbackPath } from "../core/host-identity-links.js";
 import { buildAuthProvider } from "../providers/auth/index.js";
 import { GitHubAppClient } from "../providers/vcs/github.js";
+import { loadGitHubAllowedAccounts } from "../config/github-allowed-accounts.js";
 import { buildMcpServer } from "./server.js";
+import { buildPower } from "../core/power-composition.js";
 import { countUnattendedSchedules, unattendedSchedulesWarning } from "./unattended-schedules.js";
 import { runStdioServer } from "./transport/stdio.js";
 import { startHttpServer } from "./transport/streamable-http.js";
@@ -43,6 +47,7 @@ import { registerAgentTools } from "./tools/agents.js";
 import { registerServiceTools } from "./tools/services.js";
 import { registerBudgetGroupTools } from "./tools/budget-groups.js";
 import { registerModelCatalogTools } from "./tools/model-catalog.js";
+import { registerPowerTools } from "./tools/power.js";
 import { registerHelpTools } from "./tools/help.js";
 import { registerTriggerTool } from "./tools/trigger.js";
 import { registerToolAuthoringTools } from "./tools/tools.js";
@@ -54,12 +59,14 @@ import { registerSubAgentTools } from "./tools/subagents.js";
 import { registerGrantTools } from "./tools/grants.js";
 import { registerRepositoryTools } from "./tools/repositories.js";
 import { registerIssueProjectTools } from "./tools/issue-projects.js";
+import { registerNotificationChannelTools } from "./tools/notification-channels.js";
 import { registerHostAccountTools } from "./tools/host-accounts.js";
 import { registerMemoryTools } from "./tools/memory.js";
 import { registerSecretsTools } from "./tools/secrets.js";
 import { registerWebhookTools } from "./tools/webhooks.js";
 import { createStdioSecretElicitationHost } from "./tools/secret-elicitation-server.js";
 import { SECRET_ELICITATION_PATH } from "./tools/secret-elicitation-form.js";
+import { installWorkflowEventRecorder } from "../core/notifications.js";
 import { logger } from "../core/logger.js";
 const mcpLog = logger.child({ module: "mcp-index" });
 const SELF_HOSTED_CLEANUP_INTERVAL_MS = 60 * 60 * 1000; // hourly
@@ -105,6 +112,7 @@ export function registerAllTools(mcp, opts) {
     registerServiceTools(mcp);
     registerBudgetGroupTools(mcp);
     registerModelCatalogTools(mcp, { refresh: opts.refreshModelCatalog });
+    registerPowerTools(mcp);
     registerHelpTools(mcp);
     registerTriggerTool(mcp);
     registerToolAuthoringTools(mcp);
@@ -116,6 +124,7 @@ export function registerAllTools(mcp, opts) {
     registerGrantTools(mcp);
     registerRepositoryTools(mcp);
     registerIssueProjectTools(mcp);
+    registerNotificationChannelTools(mcp);
     registerHostAccountTools(mcp);
     registerMemoryTools(mcp);
     registerSecretsTools(mcp, {
@@ -139,6 +148,11 @@ export function buildMcpProviders() {
     const reviewHosts = buildReviewHosts(process.env, prisma);
     const issueTrackers = buildIssueTrackers();
     const hostUserAuthorizers = buildHostUserAuthorizers();
+    // Installed here (not just serve/scheduler) so `wardby mcp`, which handles
+    // webhooks, records events too; only serve and the scheduler command start
+    // the dispatcher.
+    const chat = buildChatProviders();
+    installWorkflowEventRecorder(prisma, chat);
     // One gate (and one cache) for the whole process: set-time checks in the
     // MCP tools, repo_* calls in native runs, coding runs, and host events.
     const repoAccess = createRepoAccessGate({ db: prisma, hosts: reviewHosts });
@@ -161,7 +175,17 @@ export function buildMcpProviders() {
         repoAccess,
     };
     const nativeExecutor = buildExecutor(providerConfig, nativeProviders, prisma);
-    const executor = buildConfiguredExecutor({ native: nativeExecutor, db: prisma, providerConfig, repoAccess });
+    // One Power for the process, shared by both executors (wake) and the scheduler leader (sleep).
+    const power = buildPower({ env: process.env, db: prisma });
+    const executor = buildConfiguredExecutor({
+        native: nativeExecutor,
+        db: prisma,
+        providerConfig,
+        repoAccess,
+        power,
+        // Sandbox-mode native runs (docs/native-sandbox.md); undefined when NATIVE_SANDBOX_LAUNCHER is unset.
+        nativeSandbox: buildNativeSandboxExecutor({ db: prisma, providers: nativeProviders, power }),
+    });
     nativeProviders.executor = executor;
     return {
         providers: {
@@ -175,6 +199,8 @@ export function buildMcpProviders() {
             issueTrackers,
             hostUserAuthorizers,
             repoAccess,
+            chat,
+            power,
         },
     };
 }
@@ -187,11 +213,31 @@ async function closeQuietly(promise, what) {
         mcpLog.warn({ err }, `${what} failed during MCP shutdown`);
     }
 }
+/**
+ * Fire-and-forget: starts the executor's start-up warm-up (e.g. KubernetesJobLauncher's memoized
+ * cluster preflight, via RoutingExecutor -> ContainerExecutor -> the job launcher's own `warmUp`)
+ * right when a long-running server process starts, so its first coding run doesn't pay for it.
+ * Never awaited by its caller and never throws: `warmUp()` on every implementation already swallows
+ * its own failure (logging it instead), but this still guards the call site against a surprise
+ * rejection, since nothing here may block or fail server start-up. Called from `startMcp` below —
+ * i.e. from `wardby mcp` (stdio and HTTP) and from `wardby serve`, which shares this same start-up
+ * path — and, separately, from `cli.ts`'s `scheduler()` (`wardby scheduler`), which dispatches
+ * scheduled coding runs through its own Kubernetes executor but never starts an MCP server. Never
+ * called from a one-shot CLI command (`wardby run`, `coding preflight`, migrations, imports).
+ */
+export function warmUpExecutor(executor) {
+    void executor.warmUp?.()?.catch((err) => {
+        mcpLog.warn({ err }, "executor warm-up failed unexpectedly");
+    });
+}
 /** The real CLI entry point: `wardby mcp`. Reads config from the environment, starts stdio or HTTP per MCP_TRANSPORT. */
 export async function startMcp(options = {}) {
     const mcpConfig = loadMcpConfig();
     // Parsed up front so a malformed value fails at startup, not at shutdown.
     const drainSeconds = loadShutdownDrainSeconds();
+    // Parsed now so a malformed list stops startup instead of failing every event.
+    const allowedAccounts = loadGitHubAllowedAccounts();
+    mcpLog.info({ additionalAccounts: [...allowedAccounts] }, "GitHub App serves its owner plus WARDBY_GITHUB_ALLOWED_ACCOUNTS");
     // Loads the model catalog before anything else: running on the shipped
     // catalog alone (the fallback currentModelCatalog() uses before a store
     // is installed) would quietly re-enable models an admin turned off.
@@ -202,6 +248,7 @@ export async function startMcp(options = {}) {
     const modelCatalog = await startModelCatalog(prisma);
     const providers = options.providers ?? buildMcpProviders().providers;
     await providers.executor.launch?.();
+    warmUpExecutor(providers.executor);
     if (!options.schedulerAttached)
         await warnIfNothingWillFireSchedules();
     if (mcpConfig.transport === "stdio") {
@@ -254,7 +301,14 @@ export async function startMcp(options = {}) {
     const eventConfig = loadGitHubEventConfig();
     const githubConfig = loadGitHubVcsConfig();
     const reviewHosts = providers.reviewHosts;
-    const githubEvents = eventConfig.webhookSecret && reviewHosts?.github && githubConfig.appId && githubConfig.privateKey
+    const githubApp = githubConfig.appId && githubConfig.privateKey
+        ? new GitHubAppClient({
+            appId: githubConfig.appId,
+            privateKey: githubConfig.privateKey,
+            apiVersion: githubConfig.apiVersion,
+        })
+        : undefined;
+    const githubEvents = eventConfig.webhookSecret && reviewHosts?.github && githubApp
         ? {
             github: {
                 db: prisma,
@@ -263,14 +317,9 @@ export async function startMcp(options = {}) {
                 repoAccess: providers.repoAccess ?? createRepoAccessGate({ db: prisma, hosts: reviewHosts }),
                 ...(providers.issueTrackers ? { issueTrackers: providers.issueTrackers } : {}),
                 webhookSecret: eventConfig.webhookSecret,
-                appIdentity: (() => {
-                    const client = new GitHubAppClient({
-                        appId: githubConfig.appId,
-                        privateKey: githubConfig.privateKey,
-                        apiVersion: githubConfig.apiVersion,
-                    });
-                    return () => client.appIdentity();
-                })(),
+                appIdentity: (opts) => githubApp.appIdentity(opts),
+                allowedAccounts: () => allowedAccounts,
+                uninstallInstallation: (id) => githubApp.deleteInstallation(id),
             },
         }
         : undefined;