@wardby/cli 0.5.3 → 0.6.0

package/dist/mcp/tools/agents.js

@@ -27,9 +27,12 @@ import { authorizeRepositoryForSet, canonicalLocalRepository, } from "../auth/re
 import { McpError } from "../errors.js";
 import { textResult } from "./text-result.js";
 // workerImageRef is the BYO-arbitrary-image escape hatch (see
-// resolveCodingWorkerImage in container.ts) — setting or changing it
-// requires a step-up beyond agents:write, the same pattern make_owner below
-// uses for its own sensitive, ownership-bypassing mutation.
+// resolveCodingWorkerImage/resolveCodingToolImage in container.ts). For a Codex agent it
+// replaces the one container that runs the whole agent; for a Claude Code agent it replaces
+// only the tool-runner container that runs the agent's commands, never the agent container
+// (which always stays the deployment's standard Claude Code image). Either way, setting or
+// changing it requires a step-up beyond agents:write, the same pattern make_owner below uses
+// for its own sensitive, ownership-bypassing mutation.
 function requireWorkerImageRefScope(ctx) {
     requireScope(ctx, ctx.canonicalUri, "agents:admin");
 }
@@ -54,6 +57,16 @@ const MAX_DELEGATIONS_PER_RUN = 20;
 const PARALLEL_DELEGATIONS_DESCRIPTION = "Native agents with sub-agents: when true, the delegate_to_* calls the agent makes in one model turn run at the same time " +
     "instead of one after another (other tool calls still run in order). The run tree still shares one budget, so later " +
     "sub-agents get what earlier ones leave. Coding sub-agents still queue for CODING_MAX_CONCURRENT slots. Default false.";
+/** Operator-facing spellings of Agent.nativeExecutionMode (the Prisma enum is `control_plane` | `sandbox`). */
+const NATIVE_EXECUTION_MODES = ["control-plane", "sandbox"];
+const toStoredMode = (mode) => mode === "sandbox" ? "sandbox" : "control_plane";
+/** An agent row as returned to operators: the mode in its hyphenated spelling, null for coding agents. */
+function withOperatorMode(agent) {
+    return {
+        ...agent,
+        nativeExecutionMode: agent.kind !== "native" ? null : agent.nativeExecutionMode === "sandbox" ? "sandbox" : "control-plane",
+    };
+}
 const agentFields = {
     name: z.string().trim().min(1).max(MAX_AGENT_NAME_CHARS),
     systemPrompt: z.string().min(1).max(MAX_SYSTEM_PROMPT_CHARS),
@@ -69,6 +82,7 @@ const agentFields = {
     budgetGroupId: z.string().min(1).max(128),
     memoryEnabled: z.boolean(),
     effort: z.enum(LLM_EFFORT_LEVELS),
+    nativeExecutionMode: z.enum(NATIVE_EXECUTION_MODES),
     defectProjectKey: z.string().regex(PROJECT_KEY, "must be an upper-case Jira project key"),
     defectIssueType: z.string().trim().min(1).max(100),
 };
@@ -102,6 +116,7 @@ const CreateAgentSchema = z
     budgetGroupId: agentFields.budgetGroupId.optional(),
     memoryEnabled: agentFields.memoryEnabled.default(false),
     effort: agentFields.effort.optional(),
+    nativeExecutionMode: agentFields.nativeExecutionMode.optional(),
     defectProjectKey: agentFields.defectProjectKey.optional(),
     defectIssueType: agentFields.defectIssueType.optional(),
     codingProfile: CodingProfileSchema.optional(),
@@ -158,6 +173,7 @@ const UpdateAgentSchema = z
     budgetGroupId: agentFields.budgetGroupId.nullable().optional(),
     memoryEnabled: agentFields.memoryEnabled.optional(),
     effort: agentFields.effort.nullable().optional(),
+    nativeExecutionMode: agentFields.nativeExecutionMode.optional(),
     defectProjectKey: agentFields.defectProjectKey.nullable().optional(),
     defectIssueType: agentFields.defectIssueType.nullable().optional(),
     codingProfile: CodingProfilePatchSchema.extend({
@@ -210,7 +226,10 @@ const profileJsonSchema = {
         collectExclude: { type: "array", maxItems: 64, items: { type: "string" } },
         toolchain: { type: "string", enum: ["node", "node-python"] },
         toolchainVersion: { type: ["string", "null"] },
-        workerImageRef: { type: ["string", "null"] },
+        workerImageRef: {
+            type: ["string", "null"],
+            description: "A digest-pinned custom image that this agent's commands run in, for your own languages and tools. Codex: build it FROM the coding-worker driver image; it runs the whole agent. Claude Code: build it FROM this release's wardby-claude-tool-runner image; it runs the agent's commands, while Claude Code itself stays on the standard image. Needs agents:admin. Null uses the toolchain's standard image.",
+        },
         workspaceDiskMb: {
             type: ["integer", "null"],
             minimum: 64,
@@ -223,6 +242,14 @@ const profileJsonSchema = {
             maximum: MAX_CODING_TURNS,
             description: `Claude Code runs only: the most agent turns (model calls) a run may take before it stops with coding_turn_limit. Null uses the worker default (${DEFAULT_CLAUDE_MAX_TURNS}). The run's budget and timeout still apply. Codex runs have no turn limit.`,
         },
+        repoSkills: {
+            type: "boolean",
+            description: "Load the repository's agent skills into runs (Codex: .agents/skills and .codex/skills; Claude Code: .claude/skills). Default true. Repository instructions (AGENTS.md for Codex, CLAUDE.md for Claude Code) load either way.",
+        },
+        claudeBareMode: {
+            type: "boolean",
+            description: "Claude Code runs only. Default true: Claude Code runs in bare mode and wardby adds the repository's CLAUDE.md and its skill list to the system prompt; the model reads a skill's SKILL.md with run_command. False: bare mode is off and Claude Code loads CLAUDE.md and skills itself (native Skill tool). Repository settings, hooks, and MCP config are never loaded either way.",
+        },
         packageAllowlist: {
             type: "object",
             description: "Approved top-level packages per ecosystem (npm, pypi). A PyPI entry may name extras, e.g. psycopg[binary]. Needs packages:approve or agents:admin.",
@@ -285,6 +312,23 @@ function validateEffort(kind, model, effort) {
                 : "It accepts no effort setting; leave effort unset (or null)."));
     }
 }
+const NATIVE_SANDBOX_MODE_DESCRIPTION = "Where a native agent's runs execute: control-plane (default, in the server process) or sandbox (an isolated container; needs the server's native sandbox configured).";
+/**
+ * The mode only applies to native agents, and `sandbox` only works where the
+ * server composed a native sandbox executor; refuse it otherwise rather than
+ * store a mode whose every run would fail closed.
+ */
+function validateNativeExecutionMode(ctx, kind, mode) {
+    if (mode == null)
+        return;
+    if (kind !== "native") {
+        throw new McpError(400, "nativeExecutionMode is only valid for native agents; coding agents do not use it.");
+    }
+    if (mode === "sandbox" && ctx.providers.executor.supportsNativeSandbox?.() !== true) {
+        throw new McpError(400, "native_sandbox_unavailable: this server has no native sandbox configured (set NATIVE_SANDBOX_LAUNCHER), " +
+            'so an agent cannot use nativeExecutionMode "sandbox".');
+    }
+}
 /**
  * A model being set (create, or update with `model`) must be runnable here:
  * in the catalog and enabled; for a native agent, its provider must also be
@@ -322,6 +366,8 @@ function storedProfile(profile) {
         packageAllowlist: profile.packageAllowlist,
         packagePolicy: profile.packagePolicy,
         services: profile.services,
+        repoSkills: profile.repoSkills,
+        claudeBareMode: profile.claudeBareMode,
     });
 }
 /** A service name an agent is allowed must exist in the catalog (any version); typos fail here, not at a run. */
@@ -366,6 +412,11 @@ export function registerAgentTools(mcp) {
                     enum: [...LLM_EFFORT_LEVELS],
                     description: "Reasoning effort for native agents. Unset uses the provider default.",
                 },
+                nativeExecutionMode: {
+                    type: "string",
+                    enum: [...NATIVE_EXECUTION_MODES],
+                    description: NATIVE_SANDBOX_MODE_DESCRIPTION,
+                },
                 defectProjectKey: { type: "string", pattern: PROJECT_KEY.source, description: DEFECT_DESCRIPTION },
                 defectIssueType: { type: "string", minLength: 1, maxLength: 100, description: DEFECT_DESCRIPTION },
                 codingProfile: { ...profileJsonSchema, required: ["repository"] },
@@ -385,12 +436,17 @@ export function registerAgentTools(mcp) {
             validateSchedule(args.schedule, args.timezone ?? "UTC");
             requireModelAvailable(ctx, args.model, args.kind);
             validateEffort(args.kind, args.model, args.effort);
+            validateNativeExecutionMode(ctx, args.kind, args.nativeExecutionMode);
             if (args.codingProfile)
                 await requireCatalogServiceNames(ctx.db, args.codingProfile.services);
             if (args.budgetGroupId) {
                 await requireReadableBudgetGroup(ctx.db, args.budgetGroupId, ctx.principal.id);
             }
-            const { codingProfile, repositoryAdminOverride, ...agentData } = args;
+            const { codingProfile, repositoryAdminOverride, nativeExecutionMode, ...agentFieldsData } = args;
+            const agentData = {
+                ...agentFieldsData,
+                ...(nativeExecutionMode ? { nativeExecutionMode: toStoredMode(nativeExecutionMode) } : {}),
+            };
             if (repositoryAdminOverride === true && !codingProfile) {
                 throw new McpError(400, "repositoryAdminOverride only applies with a codingProfile repository.");
             }
@@ -414,7 +470,7 @@ export function registerAgentTools(mcp) {
                 },
                 include: { codingProfile: true },
             });
-            return textResult(agent);
+            return textResult(withOperatorMode(agent));
         },
     });
     mcp.registerTool({
@@ -449,6 +505,11 @@ export function registerAgentTools(mcp) {
                     enum: [...LLM_EFFORT_LEVELS, null],
                     description: "Reasoning effort for native agents. Null clears it back to the provider default.",
                 },
+                nativeExecutionMode: {
+                    type: "string",
+                    enum: [...NATIVE_EXECUTION_MODES],
+                    description: NATIVE_SANDBOX_MODE_DESCRIPTION,
+                },
                 defectProjectKey: {
                     type: ["string", "null"],
                     pattern: PROJECT_KEY.source,
@@ -585,6 +646,12 @@ export function registerAgentTools(mcp) {
                 if (args.model !== undefined || args.effort !== undefined || nextKind !== existing.kind) {
                     validateEffort(nextKind, args.model ?? existing.model, args.effort !== undefined ? args.effort : existing.effort);
                 }
+                if (args.nativeExecutionMode !== undefined) {
+                    validateNativeExecutionMode(ctx, nextKind, args.nativeExecutionMode);
+                }
+                else if (nextKind === "coding" && existing.nativeExecutionMode === "sandbox") {
+                    throw new McpError(400, 'nativeExecutionMode is only valid for native agents; set nativeExecutionMode to "control-plane" before changing this agent to coding.');
+                }
                 let nextProfile = null;
                 if (nextKind === "coding") {
                     const attachedTools = await tx.agentTool.count({ where: { agentId: args.id } });
@@ -614,7 +681,11 @@ export function registerAgentTools(mcp) {
                 if (nextKind === "coding" && nextSchedule && nextScheduleEnabled && !nextProfile?.defaultTask) {
                     throw new McpError(400, "A default task is required for an enabled coding-agent schedule.");
                 }
-                const { id, codingProfile: _profilePatch, repositoryAdminOverride: _override, ...updates } = args;
+                const { id, codingProfile: _profilePatch, repositoryAdminOverride: _override, nativeExecutionMode: modeArg, ...fieldUpdates } = args;
+                const updates = {
+                    ...fieldUpdates,
+                    ...(modeArg ? { nativeExecutionMode: toStoredMode(modeArg) } : {}),
+                };
                 const stamp = authorization ? profileStamp(authorization) : {};
                 const trace = debugTraceUntil === undefined ? {} : { debugTraceUntil };
                 const profileMutation = nextKind === "native"
@@ -641,7 +712,7 @@ export function registerAgentTools(mcp) {
                     by: ctx.principal.id,
                 }, "coding debug trace set");
             }
-            return textResult(agent);
+            return textResult(withOperatorMode(agent));
         },
     });
     mcp.registerTool({
@@ -651,7 +722,7 @@ export function registerAgentTools(mcp) {
         handler: async (_args, ctx) => {
             const [where, accessOf] = await Promise.all([readableAgentsWhere(ctx), agentAccessResolver(ctx)]);
             const agents = await ctx.db.agent.findMany({ where, include: { codingProfile: true } });
-            return textResult(agents.map((agent) => ({ ...agent, access: accessOf(agent) })));
+            return textResult(agents.map((agent) => ({ ...withOperatorMode(agent), access: accessOf(agent) })));
         },
     });
     mcp.registerTool({
@@ -671,7 +742,7 @@ export function registerAgentTools(mcp) {
             // A7: a tool's code and schema are its owner's, whoever can read the
             // agent (the agent's owner included). Capabilities stay visible: config.
             return textResult({
-                ...agent,
+                ...withOperatorMode(agent),
                 access,
                 tools: agent.tools.map((attachment) => ({
                     ...attachment,
@@ -870,7 +941,7 @@ export function registerAgentTools(mcp) {
                     }
                 }
                 return {
-                    ...updated,
+                    ...withOperatorMode(updated),
                     repositoryApprovalsRevoked: revoked,
                     bindingsRemoved,
                     toolCapabilitiesSuspended,

package/dist/mcp/tools/notification-channels.d.ts

@@ -0,0 +1,2 @@
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerNotificationChannelTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/notification-channels.js

@@ -0,0 +1,293 @@
+/**
+ * NotificationChannel CRUD — admin-approved links from a Slack channel to a
+ * Jira project or to an agent (native or coding), so wardby's workflow dispatcher
+ * (core/notification-dispatcher.ts) knows where to post a card's lifecycle:
+ * picked up, PR opened, review verdict, fix rounds, merge. Outbound only —
+ * wardby never reads a channel's history, and linking posts nothing.
+ *
+ * Same trust model as link_issue_project (src/mcp/tools/issue-projects.ts):
+ * wardby cannot verify a caller's own Slack workspace access (one bot token
+ * for the whole deployment, no per-user OAuth), so link/unlink/test need
+ * agents:admin with the admin role, and the approver is stamped on the
+ * link. Exactly one of projectKey/agentId is the link's subject (enforced
+ * again by a DB CHECK constraint); `events` narrows which of the six
+ * workflow event kinds post to it (empty/omitted = all); private Slack
+ * channels always need /invite @<app> before the bot can see or post to
+ * them. See docs/private/2026-10-08-slack-workflow-notifications-design.md §8.
+ */
+import { Prisma } from "#prisma";
+import { requireAgentAccess } from "../auth/access.js";
+import { requireScope } from "../auth/resource-server.js";
+import { McpError } from "../errors.js";
+import { PROJECT_KEY } from "../../providers/issue-tracker/types.js";
+import { ChatError } from "../../providers/chat/types.js";
+import { WORKFLOW_EVENT_KINDS } from "../../core/workflow-events.js";
+import { textResult } from "./text-result.js";
+const CHAT_PROVIDERS = ["slack"];
+/** Slack channel id: C… (public) or G… (private), case-insensitive, normalized upper-case. */
+const CHANNEL_ID = /^[CG][A-Z0-9]{2,20}$/i;
+function normalizeProjectKey(projectKey) {
+    const key = projectKey.trim().toUpperCase();
+    if (!PROJECT_KEY.test(key))
+        throw new McpError(400, `invalid projectKey "${projectKey}"`);
+    return key;
+}
+function normalizeChannelId(channel) {
+    const id = channel.trim().toUpperCase();
+    if (!CHANNEL_ID.test(id)) {
+        throw new McpError(400, "Pass the channel id (C…); find it in the channel's details in Slack.");
+    }
+    return id;
+}
+export function registerNotificationChannelTools(mcp) {
+    mcp.registerTool({
+        name: "link_notification_channel",
+        scope: "agents:write",
+        description: "Links a Slack channel to a Jira project or to an agent (native or coding), so wardby posts that project's or " +
+            "agent's workflow updates there: a card picked up, a PR opened, a review verdict, fix rounds, and the merge (one thread per card). " +
+            "Outbound only — wardby never reads the channel's history, and nothing in Slack starts work. Admin-approved " +
+            "(agents:admin with the admin role), the same trust model as link_issue_project: wardby cannot verify a caller's " +
+            "own Slack workspace access, so an admin approves every link and is stamped as its authorizer. " +
+            "Exactly one of projectKey or agentId is the link's subject: a project link (with issueProvider, default jira) " +
+            "matches events for issues in that project; an agent link matches events for that agent's runs. " +
+            "channel is the Slack channel id (C… for public, G… for private), never a #name — find it in the channel's " +
+            "details in Slack. Private channels always need /invite @<app> before the bot can see or post to them. " +
+            "events narrows which of the six workflow event kinds post to this link; empty or omitted means all. " +
+            "includeCost appends the run's spend line to messages. Re-linking the same channel + subject replaces events and " +
+            "includeCost and clears any previously recorded delivery error — always send the full desired state.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                provider: { type: "string", enum: [...CHAT_PROVIDERS] },
+                channel: { type: "string", minLength: 1, maxLength: 64 },
+                projectKey: { type: "string", minLength: 1, maxLength: 255 },
+                issueProvider: { type: "string", enum: ["jira"] },
+                agentId: { type: "string" },
+                events: { type: "array", items: { type: "string", enum: [...WORKFLOW_EVENT_KINDS] }, uniqueItems: true },
+                includeCost: { type: "boolean" },
+            },
+            required: ["channel"],
+        },
+        handler: async (args, ctx) => {
+            requireScope(ctx, ctx.canonicalUri, "agents:admin");
+            const provider = args.provider ?? "slack";
+            const chat = ctx.providers.chat?.[provider];
+            if (!chat) {
+                throw new McpError(400, "Slack is not configured (WARDBY_SLACK_BOT_TOKEN). See help article errors/slack-not-configured.");
+            }
+            const hasProject = args.projectKey !== undefined;
+            const hasAgent = args.agentId !== undefined;
+            if (hasProject === hasAgent) {
+                throw new McpError(400, "Give exactly one of projectKey or agentId.");
+            }
+            let issueProvider = null;
+            let projectKey = null;
+            let agentId = null;
+            if (hasProject) {
+                issueProvider = args.issueProvider ?? "jira";
+                projectKey = normalizeProjectKey(args.projectKey);
+            }
+            else {
+                agentId = args.agentId;
+                const agent = await ctx.db.agent.findUnique({ where: { id: agentId } });
+                if (!agent)
+                    throw new McpError(404, `Agent "${agentId}" not found.`);
+            }
+            const channelId = normalizeChannelId(args.channel);
+            // `info` is undefined when channelInfo can't be validated at all
+            // (missing_scope: no channels:read/groups:read — accept the id
+            // unvalidated); any other auth failure (revoked or invalid token) is a
+            // real error the operator must fix before linking. `info` is
+            // null when the bot genuinely cannot see the channel (an error, not a
+            // validation gap) — kept out of the try/catch below so the 400 for
+            // "bot cannot see this channel" isn't routed through ChatError handling.
+            let info;
+            try {
+                info = await chat.channelInfo(channelId);
+            }
+            catch (err) {
+                if (!(err instanceof ChatError && err.code === "auth_failed"))
+                    throw err;
+                if (err.slackError !== "missing_scope") {
+                    throw new McpError(400, `Slack rejected the bot token (${err.slackError}). See help article errors/slack-auth-failed.`);
+                }
+                info = undefined;
+            }
+            if (info === null) {
+                throw new McpError(400, `The bot cannot see channel ${channelId}: invite it with /invite @<app> (private channels always need ` +
+                    "this). See errors/slack-channel-unreachable.");
+            }
+            const channelName = info ? info.name : null;
+            const events = [...new Set(args.events ?? [])];
+            const includeCost = args.includeCost ?? false;
+            const fields = {
+                channelName,
+                events,
+                includeCost,
+                lastError: null,
+                lastErrorAt: null,
+                authorizedById: ctx.principal.id,
+                authorizedAt: new Date(),
+            };
+            // Can't use Prisma `upsert` here: Postgres treats NULLs as distinct
+            // within a unique index, and this link's unique keys
+            // (provider, channelId, issueProvider, projectKey) / (provider,
+            // channelId, agentId) each have two columns that are null for the
+            // other subject kind — so the where-unique input Prisma generates for
+            // this compound key never matches an existing row the way a fully
+            // non-null key would. Find the existing row explicitly instead, then
+            // update it by id or create.
+            const subjectWhere = hasProject
+                ? { provider, channelId, issueProvider, projectKey }
+                : { provider, channelId, agentId };
+            const existing = await ctx.db.notificationChannel.findFirst({ where: subjectWhere });
+            let link;
+            if (existing) {
+                link = await ctx.db.notificationChannel.update({ where: { id: existing.id }, data: fields });
+            }
+            else {
+                try {
+                    link = await ctx.db.notificationChannel.create({
+                        data: { provider, channelId, issueProvider, projectKey, agentId, ...fields },
+                    });
+                }
+                catch (err) {
+                    if (!(err instanceof Prisma.PrismaClientKnownRequestError) || err.code !== "P2002")
+                        throw err;
+                    // Lost a create race: another concurrent link_notification_channel
+                    // call for the same channel + subject committed first. Re-linking
+                    // an existing link is normal, documented behavior (it replaces
+                    // events/includeCost and clears lastError) — so re-query and
+                    // update that row instead of surfacing the race as an error.
+                    const raced = await ctx.db.notificationChannel.findFirst({ where: subjectWhere });
+                    if (!raced)
+                        throw err;
+                    link = await ctx.db.notificationChannel.update({ where: { id: raced.id }, data: fields });
+                }
+            }
+            return textResult({ link });
+        },
+    });
+    mcp.registerTool({
+        name: "unlink_notification_channel",
+        scope: "agents:write",
+        description: "Removes a notification channel link. Admin only (agents:admin with the admin role).",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: { id: { type: "string" } },
+            required: ["id"],
+        },
+        handler: async (args, ctx) => {
+            requireScope(ctx, ctx.canonicalUri, "agents:admin");
+            const { count } = await ctx.db.notificationChannel.deleteMany({ where: { id: args.id } });
+            return textResult({ unlinked: count > 0 });
+        },
+    });
+    mcp.registerTool({
+        name: "list_notification_channels",
+        scope: "agents:read",
+        description: "Lists notification channel links, each with its pending and failed delivery counts. Filter by projectKey, " +
+            "agentId, or channel (the Slack channel id). Listing an agent's own links needs read access to that agent; " +
+            "listing without agentId (every link, including project links) needs agents:admin with the admin role.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                projectKey: { type: "string", minLength: 1, maxLength: 255 },
+                agentId: { type: "string" },
+                channel: { type: "string", minLength: 1, maxLength: 64 },
+            },
+        },
+        handler: async (args, ctx) => {
+            if (args.agentId !== undefined) {
+                await requireAgentAccess(ctx, args.agentId, "read");
+            }
+            else {
+                requireScope(ctx, ctx.canonicalUri, "agents:admin");
+            }
+            const where = {};
+            if (args.agentId !== undefined)
+                where.agentId = args.agentId;
+            if (args.projectKey !== undefined)
+                where.projectKey = normalizeProjectKey(args.projectKey);
+            if (args.channel !== undefined)
+                where.channelId = normalizeChannelId(args.channel);
+            const links = await ctx.db.notificationChannel.findMany({ where, orderBy: { createdAt: "asc" } });
+            // Counts only for the listed links' own (provider, channel) pairs, so a
+            // caller never learns about deliveries to channels it cannot list.
+            const pairKey = (r) => `${r.provider}\u0000${r.channelId}`;
+            const pairs = [
+                ...new Map(links.map((l) => [pairKey(l), { provider: l.provider, channelId: l.channelId }])).values(),
+            ];
+            const counts = pairs.length === 0
+                ? []
+                : await ctx.db.notificationDelivery.groupBy({
+                    by: ["provider", "channelId", "state"],
+                    where: { state: { in: ["pending", "failed"] }, OR: pairs },
+                    _count: true,
+                });
+            const byChannel = new Map();
+            for (const row of counts) {
+                const entry = byChannel.get(pairKey(row)) ?? { pending: 0, failed: 0 };
+                if (row.state === "pending")
+                    entry.pending = row._count;
+                else if (row.state === "failed")
+                    entry.failed = row._count;
+                byChannel.set(pairKey(row), entry);
+            }
+            const channels = links.map((l) => ({
+                ...l,
+                pending: byChannel.get(pairKey(l))?.pending ?? 0,
+                failed: byChannel.get(pairKey(l))?.failed ?? 0,
+            }));
+            return textResult({ channels });
+        },
+    });
+    mcp.registerTool({
+        name: "test_notification_channel",
+        scope: "agents:write",
+        description: "Posts a one-off confirmation message to a linked channel, to prove the bot can write there before relying on it " +
+            "for workflow notifications (a private channel needs /invite @<app> first; a channel the bot can't reach " +
+            "surfaces its error immediately instead of silently queueing). Admin only (agents:admin with the admin role).",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: { id: { type: "string" } },
+            required: ["id"],
+        },
+        handler: async (args, ctx) => {
+            requireScope(ctx, ctx.canonicalUri, "agents:admin");
+            const link = await ctx.db.notificationChannel.findUnique({ where: { id: args.id } });
+            if (!link)
+                throw new McpError(404, `Notification channel link "${args.id}" not found.`);
+            const chat = ctx.providers.chat?.[link.provider];
+            if (!chat) {
+                throw new McpError(400, "Slack is not configured (WARDBY_SLACK_BOT_TOKEN). See help article errors/slack-not-configured.");
+            }
+            try {
+                await chat.postMessage(link.channelId, { text: "✅ wardby is connected to this channel." });
+            }
+            catch (err) {
+                if (!(err instanceof ChatError))
+                    throw err;
+                if (err.code === "channel_unreachable") {
+                    await ctx.db.notificationChannel.update({
+                        where: { id: link.id },
+                        data: { lastError: err.slackError, lastErrorAt: new Date() },
+                    });
+                }
+                throw new McpError(400, `${err.code}: ${err.slackError}`);
+            }
+            // The bot can post here again: clear any recorded delivery error.
+            if (link.lastError !== null || link.lastErrorAt !== null) {
+                await ctx.db.notificationChannel.update({
+                    where: { id: link.id },
+                    data: { lastError: null, lastErrorAt: null },
+                });
+            }
+            return textResult({ tested: true });
+        },
+    });
+}

package/dist/mcp/tools/power.d.ts

@@ -0,0 +1,2 @@
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerPowerTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/power.js

@@ -0,0 +1,77 @@
+/**
+ * Low-power mode over MCP: power_status reads the coding proxy's and native
+ * gateway's state, power_sleep scales them to zero now instead of waiting out
+ * the idle window. Both need power:manage, a privileged scope honoured only
+ * for the admin role (resource-server.ts). power_sleep never stops a run: a
+ * target with active or queued runs (or, for the gateway, an active gateway
+ * session) is refused and its run ids returned. Each power_sleep is audited
+ * (event power.sleep, outcome ok or error, naming the principal), including a
+ * failed or refused call, since a failure can follow a target already slept.
+ */
+import { z } from "zod";
+import { logger } from "../../core/logger.js";
+import { DISABLED_POWER, LOW_POWER_DISABLED } from "../../core/power.js";
+import { McpError } from "../errors.js";
+import { textResult } from "./text-result.js";
+const powerToolLog = logger.child({ module: "mcp-power" });
+const TARGETS = ["proxy", "gateway"];
+const SleepSchema = z.object({ target: z.enum(TARGETS).optional() }).strict();
+const StatusSchema = z.object({}).strict();
+function parse(schema, label, value) {
+    const result = schema.safeParse(value ?? {});
+    if (!result.success) {
+        const details = result.error.issues
+            .map((issue) => `${issue.path.join(".") || "input"}: ${issue.message}`)
+            .join("; ");
+        throw new McpError(400, `Invalid ${label}: ${details}`);
+    }
+    return result.data;
+}
+export function registerPowerTools(mcp) {
+    mcp.registerTool({
+        name: "power_status",
+        scope: "power:manage",
+        description: "Admins (power:manage): low-power mode state. For the coding proxy and the native gateway: replicas, whether a ready endpoint exists, when it last woke (wokeAt), and blockers (run ids keeping it busy). Returns { enabled: false } when low-power mode is off.",
+        inputSchema: { type: "object", additionalProperties: false, properties: {} },
+        handler: async (rawArgs, ctx) => {
+            parse(StatusSchema, "power_status arguments", rawArgs);
+            return textResult(await (ctx.providers.power ?? DISABLED_POWER).status());
+        },
+    });
+    mcp.registerTool({
+        name: "power_sleep",
+        scope: "power:manage",
+        description: "Admins (power:manage): scale the coding proxy and/or native gateway to zero now, skipping low-power mode's idle window. It never stops a run: a target is refused while it has active or queued runs (for the gateway, also an active gateway session), and those run ids are returned under blocked. Recently finished runs do not block it. The next run wakes the target again. Fails (409 low_power_disabled) when low-power mode is off.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                target: {
+                    type: "string",
+                    enum: [...TARGETS],
+                    description: "Sleep only this target. Omit to sleep both.",
+                },
+            },
+        },
+        handler: async (rawArgs, ctx) => {
+            const { target } = parse(SleepSchema, "power_sleep arguments", rawArgs);
+            const targets = target ? [target] : [...TARGETS];
+            const power = ctx.providers.power ?? DISABLED_POWER;
+            const audit = { event: "power.sleep", principal: ctx.principal.id, targets };
+            let result;
+            try {
+                result = await power.sleepNow(targets);
+            }
+            catch (err) {
+                // Audited before rethrowing: sleepNow may already have slept an earlier target.
+                const error = err instanceof Error ? err.message : String(err);
+                powerToolLog.warn({ ...audit, outcome: "error", error }, "power_sleep");
+                if (err instanceof Error && err.message.startsWith(`${LOW_POWER_DISABLED}:`))
+                    throw new McpError(409, err.message);
+                throw err;
+            }
+            powerToolLog.info({ ...audit, outcome: "ok", slept: result.slept, blocked: result.blocked }, "power_sleep");
+            return textResult(result);
+        },
+    });
+}

package/dist/mcp/tools/runs.d.ts

@@ -1,8 +1,2 @@
 import type { WardbyMcpServer } from "../server.js";
-/**
- * Run visibility (resource-sharing grants spec §3.5, A6): a run's output is
- * the triggerer's and the agent owner's, never every reader's. The owner
- * (and the stdio operator) sees every run; anyone else only runs with
- * Run.triggeredById equal to themselves.
- */
 export declare function registerRunTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/runs.js

@@ -10,6 +10,11 @@ import { textResult } from "./text-result.js";
  * (and the stdio operator) sees every run; anyone else only runs with
  * Run.triggeredById equal to themselves.
  */
+/** A run row with its execution mode in the operator spelling agent tools use; null for coding runs. */
+function withOperatorMode(run) {
+    const mode = run.nativeExecutionMode;
+    return { ...run, nativeExecutionMode: mode == null ? null : mode === "sandbox" ? "sandbox" : "control-plane" };
+}
 export function registerRunTools(mcp) {
     mcp.registerTool({
         name: "list_runs",
@@ -42,7 +47,7 @@ export function registerRunTools(mcp) {
             const queuedAtByRun = new Map(queued.map((row) => [row.runId, row.queuedAt?.toISOString()]));
             return textResult(runs.map((run) => {
                 const codingQueuedAt = queuedAtByRun.get(run.id);
-                return codingQueuedAt ? { ...run, codingQueuedAt } : run;
+                return codingQueuedAt ? { ...withOperatorMode(run), codingQueuedAt } : withOperatorMode(run);
             }));
         },
     });
@@ -106,7 +111,7 @@ export function registerRunTools(mcp) {
             // Which services the run started with ("postgres 16"); never their images or environments.
             const services = codingRun ? storedServiceLabels(codingRun.services) : [];
             return textResult({
-                ...run,
+                ...withOperatorMode(run),
                 ...(codingResult ? { codingResult } : {}),
                 ...(failureCategory ? { failureCategory } : {}),
                 ...(diagnosticId ? { diagnosticId } : {}),

package/dist/mcp/tools/secret-broker-compat.d.ts

@@ -0,0 +1,12 @@
+/**
+ * A static, best-effort check: a tool granted a brokered secret that still reads secrets with
+ * secrets.get() will fail at run time. Warns; never blocks (the scan can't see dynamic code).
+ */
+export declare function toolCallsSecretsGet(code: string): boolean;
+export declare function brokerCompatibilityWarnings(tools: readonly {
+    name: string;
+    code: string;
+    allowedSecrets: readonly string[];
+}[], brokeredNames: ReadonlySet<string>): string[];
+/** An attachment's `allowedSecrets` JSON column as names (anything else is ignored). */
+export declare function allowedSecretNames(json: unknown): string[];